Show and Manage GlobalProtect Users (API)

1. View all GlobalProtect users.

   Make a request to view all GlobalProtect users:

   curl -X POST 'https://<firewall>/api?type=op&cmd=<show><global-protect-gateway><current-user/>
   							</global-protect-gateway></show>' 
   					

   The response contains a list of users along with related information including IP addresses, logins, and client information:

   
   						<response status="success">
     <result>
       <entry>
         <domain/>
         <islocal>yes</islocal>
         <username>dward</username>
         <computer>Dan’s iPhone</computer>
         <client>Apple iOS 8.1.2</client>
         <vpn-type>Device Level VPN</vpn-type>
         <virtual-ip>192.168.2.1</virtual-ip>
         <public-ip>166.173.63.240</public-ip>
         <tunnel-type>SSL</tunnel-type>
         <login-time>Jan.22 01:50:36</login-time>
         <login-time-utc>1421916636</login-time-utc>
         <lifetime>2592000</lifetime>
       </entry>
     </result>
   </response>
    
   					

   The <login-time-utc> field is the login date/time in UNIX time format (number of seconds elapsed since 00:00:00 1 Jan 1970). To find the list of users, filter the output for this field and compare the <login-time-utc> value to current date and time (or another date and time).
2. Disconnect a GlobalProtect user.

   Upon identifying the user that you want to disconnect, send a request that includes the GlobalProtect gateway, username, computer, and aforce-logout reason:

   curl -X POST 'https://<firewall>/api?type=op&cmd=<request><global-protect-gateway><client-logout>
   							<gateway>Home-N</gateway><user>dward</user><reason>force-logout</reason>
   							<computer>Dan’s%20iPhone</computer></client-logout></global-protect-gateway>
   							</request>' 
   					

   A successful response shows that the user has been successfully disconnected:

   
   						<response status="success">
     <result>
       <response status="success">
         <gateway>Home-N</gateway>
         <domain>(null)</domain>
         <user>dward</user>
         <computer>Dan’s iPhone</computer>
       </response>
     </result>
   </response>