MonsterOps logo MonsterOps
Docs / REST API / Sessions & CoA

Sessions & CoA API

Read live RADIUS sessions and, when a key is allowed to, cut one off with a CoA Disconnect. All paths are under /api/v1.

Method Path Scope
GET /sessions sessions.read
GET /users/{username}/sessions sessions.read
POST /coa/disconnect coa.send

List active sessions

GET /sessions returns the currently-open accounting sessions (those with no stop time), most recent first, capped at 500. This isn't a page envelope — it's a bounded list with a count:

curl -H "X-API-Key: $KEY" https://your-host/api/v1/sessions

{
  "sessions": [
    {
      "acctsessionid": "8a2f…",
      "acctuniqueid": "b17c9e4f…",
      "username": "alice",
      "nasipaddress": "10.0.0.1",
      "framedipaddress": "100.64.0.12",
      "acctstarttime": "2026-07-20T09:41:00Z",
      "acctinputoctets": 4210233,
      "acctoutputoctets": 88192011,
      "callingstationid": "AA:BB:CC:DD:EE:FF",
      "active": true
    }
  ],
  "count": 1
}

The acctuniqueid on each session is the handle you pass to CoA disconnect. Sessions are also enriched with geo-location of the calling station and the nearest auth-log outcome where available.

For one user's history (including closed sessions, up to 200), use GET /users/{username}/sessions — see Users.

Disconnect a session (CoA)

POST /coa/disconnect sends a RADIUS CoA Disconnect-Request to the NAS that owns the session, terminating it. Identify the session by its acctuniqueid:

curl -X POST -H "X-API-Key: $KEY" -H "Content-Type: application/json" \
     -d '{"acctuniqueid":"b17c9e4f…"}' \
     https://your-host/api/v1/coa/disconnect

The response reports whether the NAS accepted it:

{ "success": true, "code": 41, "message": "Session disconnected" }
  • success — true if the NAS acknowledged (Disconnect-ACK), false if it rejected or didn't answer.
  • code — the RADIUS reply code, or null on timeout.
  • message — human-readable result, including the NAS's Error-Cause on a NAK.

400 if acctuniqueid is missing from the body.

CoA has to be reachable

Disconnects go to the NAS on UDP 3799. If the device doesn't support Change-of-Authorization, isn't configured to accept it, or blocks the port, you'll get "success": false (often a timeout) even though the API call itself worked. See Sessions (UI) for the NAS-side requirements.

  • Sessions (UI) — live sessions and one-click disconnect
  • Auth Logs — the authentication attempts behind these sessions
  • NAS — the devices disconnects are sent to