### List live sessions

`GET /api/v1/admin/sessions`

Sessions with no stop time, paginated with the standard list parameters. A non-admin caller sees only sessions belonging to their own manager subtree, injected server-side.

- Authentication: manager session (JWT) or API token
- Permission: `prm_report_sessions` (Sessions report)
- Risk: read

#### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `q` | query | string | no | Searches username, first and last name, framed IP, device MAC and NAS name. |
| `filter[nas_id]` | query | integer | no | Sessions on one registered NAS. |
| `filter[kind]` | query | enum | no | subscriber, guest, voucher or unknown. |
| `filter[has_ip]` | query | boolean | no | Sessions that were assigned a framed IP. |
| `filter[duration_band]` | query | string | no | Duration bucket. The value "stale" means no accounting update for longer than the tenant's idle window, which is the practical definition of a ghost session. |
| `filter[expired]` | query | boolean | no | Sessions whose owner's subscription has run out but who are still connected. |

#### Response — 200 OK

```json
{
  "data": [
    {
      "id": 8821904,
      "acct_session_id": "81b0c4e2",
      "username": "ahmed",
      "user_id": 4711,
      "kind": "subscriber",
      "nas_ip": "10.20.0.1",
      "nas_id": 3,
      "nas_name": "cairo-edge-1",
      "vendor": "mikrotik",
      "framed_ip": "10.64.12.51",
      "calling_station_id": "AA:BB:CC:DD:EE:FF",
      "start_time": "2026-09-20 07:11:02",
      "update_time": "2026-09-20 09:06:02",
      "session_time": 6900,
      "input_octets": 412000000,
      "output_octets": 5100000000,
      "profile_name": "Home 20M",
      "usage": { "percent": 55.0, "dimension": "data" }
    }
  ],
  "meta": { "page": 1, "page_size": 50, "total": 318, "has_next": true }
}
```

#### Note

user_id is null for a session this instance cannot tie to a subscriber row, such as an anonymous voucher or an orphan left by a NAS restart. status and usage are absent on those too. Do not assume every live session has an owner.