To list information about a single currently authenticated user, an HTTP GET is sent to the URI:

/api/oper/userauth

Additional parameters are used to identify the user. The action can have the following parameters:

For example, to list a user with the IPv4 address 203.0.113.5 that connected through the wan interface, a GET could be sent to the following URI:

/api/oper/userauth?ip=203.0.113.5&interface=wan

Here, the IP address 203.0.113.5 is the IP address of the user and wan is the cOS Core interface that the user has connected to.

The JSON reply sent by cOS Core will have the following form:

{
  "error": false,
  "active_users": [
    {
      "username": "user1",
      "ip": "203.0.113.5",
      "groups": "group1,group2",
      "interface": "wan",
      "agent_type": "Identity Awareness",
      "session_timeout": 60,
      "idle_timeout": 60
    }
  ]
}

The output is similar in form to the output when a list of all authenticated users is retrieved.

If the specified user cannot be found, a JSON message like the following will be returned:

{
  "error":false,
  "active_users_count":5,
  "active_users":[]
}

Here, the active_users parameter has an empty value. Note also that the active_users_count value is the total number of currently authenticated users.