This guide explains how to find an agent's last online timestamp and turn it into an offline duration. It uses the same two fields Fleet Manager uses for the "Last online" column in the Devices list.

Read How to check if an agent is online first if you only need the current online/offline state.

The two timestamp fields

Two fields on the Agent endpoint (as well as the AgentList endpoint) track when connectivity last changed:

• vpnChangedOn: the last time the connection towards the VPN server changed status.
• mqttChangedOn: the last time the connection towards the MQTT server changed status.

Both are available even for offline devices: each is a timestamp of the last time that connection was updated, so they persist after the agent disconnects. That is what makes them usable as a "last seen" signal.

The logic behind "Last online"

• If both vpnChangedOn and mqttChangedOn have a timestamp, the most recent one is used.
• If only one is set, that value is used.
• If both are null, no timestamp is shown.

Getting the timestamps

To retrieve the timestamps, run the following cURL:

Request example

curl --request GET \
  --url 'https://portal.ixon.cloud/api/agents/<your_agent_id>?fields=publicId,name,activeVpnSession.rscServer.*,activeVpnSession.vpnAddress,activeVpnSession.closed,mdrServer.publicId,mdrServer.name,vpnChangedOn,mqttChangedOn' \
  --header 'Api-Version: 2' \
  --header 'Api-Application: <your_application_id>' \
  --header 'Api-Company: <your_company_id>' \
  --header 'Accept: application/json' \
  --header 'Authorization: Bearer <your_bearer_token>'

Response example

{
  "type": "Agent",
  "data": {
    "publicId": "0eF1cpO1XFEl",
    "name": "IXrouter 3",
    "activeVpnSession": null,
    "mdrServer": null,
    "vpnChangedOn": "2026-07-20T09:14:02.000000Z",
    "mqttChangedOn": "2026-07-19T22:48:31.000000Z"
  },
  "status": "success"
}

In this example, both activeVpnSession and mdrServer are null. Furthermore, both timestamps are present, so "Last online" is the later one: 2026-07-20T09:14:02Z.

Finding the offline duration

The next steps will show how to build the logic needed to return the correct timestamps and display since when an agent has been offline.

1. Confirm the agent is offline: request the subfields of both activeVpnSession and mdrServer and check that neither is populated (each is null or has no content). If either is populated, the agent is online, so there is no duration to report.
2. Take the latest of vpnChangedOn and mqttChangedOn: this is "last seen".
3. Subtract it from the current UTC time.

You can find a step-by-step Python implementation of this logic in the recipe below.

Checking many agents at once

To scan a fleet, remove the agentId from the logic and request the same fields on the AgentList endpoint and apply the same "offline since" logic per item. This is efficient for a dashboard of "how long has each device been down".

curl --request GET \
  --url 'https://portal.ixon.cloud/api/agents?fields=publicId,name,activeVpnSession.rscServer.*,activeVpnSession.vpnAddress,activeVpnSession.closed,mdrServer.publicId,mdrServer.name,vpnChangedOn,mqttChangedOn' \
  --header 'Api-Version: 2' \
  --header 'Api-Application: <your_application_id>' \
  --header 'Api-Company: <your_company_id>' \
  --header 'Accept: application/json' \
  --header 'Authorization: Bearer <your_bearer_token>'

Related

• How to check if an agent is online
• Agent endpoint reference