### Bind the subscriber to this session's device

`POST /api/v1/admin/sessions/{id}/lock-mac`

Writes the session's calling-station MAC into the subscriber's locked-MAC list. From the next authentication onward only that device may connect. The current session is left up, since it already uses the locked MAC.

- Authentication: manager session (JWT) or API token
- Permission: `prm_users_mac_lock` (Lock user MAC)
- Risk: write
- Rate limit bucket: `t_mutate`

#### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `id` | path | integer | yes | Session id. |

#### Response — 200 OK

```json
{
  "data": {
    "user_id": 4711,
    "mac": "AA:BB:CC:DD:EE:FF",
    "locked_macs": ["AA:BB:CC:DD:EE:FF"]
  }
}
```

#### Errors

| Code | Status | When |
| --- | --- | --- |
| `ERR_VALIDATION` | 422 | the session has no owning subscriber, so there is no record to lock |

#### Note

This endpoint also turns the lock ON, which the subscriber PATCH does not. Writing mac_locked_addrs through PATCH /users/{id} without setting mac_lock_enabled stores a list that enforces nothing.