Issue/Help with "Current Connected User List"

Documentation link

https://pan.dev/access/docs/insights/examples/mobile-users-dashboard/current-connected-user-list/

Related page:

https://pan.dev/access/docs/insights/examples/mobile-users-dashboard/mu-users-list/

Describe the problem

The documentation for current_connected_user_list in Prisma Access Insights v2.0 appears to be incomplete or inaccurate, especially when compared with the behavior of gp_mobileusers/user_list.

Tested tenant: TSG_ID=1737xxxx82
Base URL: https://pa-us01.api.prismaaccess.com

Note: the TSG ID is valid, and the same token/TSG combination works successfully with other Prisma Access Insights v2.0 endpoints, including gp_mobileusers/user_list.

The documentation shows the following endpoint:

POST /api/sase/v2.0/resource/custom/query/gp_mobileusers/current_connected_user_list
Prisma-Tenant: {{tsg_id}}
Authorization: Bearer {{jwt_token}}
Content-Type: application/json

It also provides an example payload using the edge_location_display_name filter:

{
  "filter": {
    "rules": [
      {
        "property": "edge_location_display_name",
        "operator": "equals",
        "values": ["US Central"]
      }
    ]
  }
}

However, in practice, current_connected_user_list returns an empty list both with the documented edge_location_display_name filter and with an event_time filter.

Example request using the documented edge_location_display_name filter:

{
  "filter": {
    "rules": [
      {
        "property": "edge_location_display_name",
        "operator": "equals",
        "values": ["US Central"]
      }
    ]
  },
  "count": 100
}

Response:

{
  "header": {
    "dataCount": 0,
    "requestId": "0101443d-521e-401e-88a6-1aea22b79c19",
    "status": {
      "subCode": 204
    }
  },
  "data": []
}

Example request using the event_time filter:

{
  "filter": {
    "rules": [
      {
        "property": "event_time",
        "operator": "last_n_hours",
        "values": [1]
      }
    ]
  },
  "count": 100
}

Response:

{
  "header": {
    "dataCount": 0,
    "requestId": "e637fa94-2d22-41f9-a115-9f34822c2a82",
    "status": {
      "subCode": 204
    }
  },
  "data": []
}

At the same time, gp_mobileusers/user_list returns users using the same valid TSG ID, token, and API region.

Example working request to user_list:

POST /api/sase/v2.0/resource/custom/query/gp_mobileusers/user_list

Payload:

{
  "filter": {
    "rules": [
      {
        "property": "event_time",
        "operator": "last_n_days",
        "values": [30]
      }
    ]
  },
  "count": 10000
}

The response contains users, for example:

{
  "gpuser_name": "user@example.com",
  "num_connections": 1,
  "user_location": "Kyoto",
  "pa_location": "Hong Kong",
  "user_location_country": "Japan",
  "client_private_address": "10.x.x.x",
  "user_source_ip": "x.x.x.x",
  "client_gp_version": "6.3.3",
  "login_timestamp": 1789395165000,
  "auth_type": "Cookie",
  "client_os_version": "Microsoft Windows 11 Enterprise , 64-bit"
}

This creates ambiguity because:

• current_connected_user_list is documented as a way to view currently connected Mobile Users.
• The documented edge_location_display_name example returns 204/data: [].
• An event_time filter also returns 204/data: [].
• gp_mobileusers/user_list returns users with the same valid TSG/token/region.
• It is unclear whether current_connected_user_list requires additional filters, permissions, or tenant configuration.
• It is unclear whether this endpoint is intended to return a real current snapshot or only works under specific conditions.

The metadata endpoint for current_connected_user_list returns these fields:

GET /api/sase/v2.0/resource/custom/gp_mobileusers/current_connected_user_list

Response:

{
  "header": {
    "createdAt": "2026-09-14T17:21:40Z",
    "recordCount": 5
  },
  "data": [
    {
      "name": "event_time",
      "description": "event_time",
      "data_type": "string",
      "field_type": "string"
    },
    {
      "name": "edge_location_display_name",
      "description": "edge_location_display_name",
      "data_type": "string",
      "field_type": "string"
    },
    {
      "name": "client_gp_version",
      "description": "client_gp_version",
      "data_type": "string",
      "field_type": "string"
    },
    {
      "name": "auth_type",
      "description": "auth_type",
      "data_type": "string",
      "field_type": "string"
    },
    {
      "name": "client_os_version",
      "description": "client_os_version",
      "data_type": "string",
      "field_type": "string"
    }
  ]
}

However, the documentation page does not explain how these fields should be used, which filters are required, or under which conditions current_connected_user_list should return data.

Start with the current_connected_user_list documentation and the related mu-users-list page, then compare their examples with the documented POST endpoint and metadata GET endpoint. Reproduce the edge_location_display_name and event_time requests using the stated tenant, token, and region, and compare them with gp_mobileusers/user_list. Done means the documentation explains the fields, required filters, permissions or tenant conditions, and whether the endpoint is a current snapshot.