---
title: "Get active Discovery Sessions"
method: GET
path: "/api/v1/discovery/active-sessions"
tags: ["Discoveries"]
---

# Get active Discovery Sessions

`GET /api/v1/discovery/active-sessions`

## Response `200`

List of active discovery sessions

- ApiResponseVecDiscoveryUpdatePayload
  - `data` object[] — The result payload. Omitted on failure.
    - `daemon_id` string, uuid, required — The daemon this entity refers to.
    - `discovery_id` string, uuid, nullable — The discovery configuration this session belongs to. Always enriched server-side; daemons do not send this field.
    - `discovery_type` union, required
      - object
        - `host_id` string, uuid, required — The host the daemon is running on.
        - `type` 'SelfReport', required
      - object
        - `host_naming_fallback` 'Ip' | 'BestService', required
        - `snmp_credentials` object — SNMP credentials for querying devices during discovery Server builds this mapping before initiating discovery
        - `subnet_ids` string[], nullable, required — Subnets to sweep. `null` sweeps every subnet on the network.
        - `type` 'Network', required
      - object
        - `host_id` string, uuid, required — The host the daemon is running on.
        - `host_naming_fallback` 'Ip' | 'BestService', required
        - `type` 'Docker', required
      - object — A one-shot verification of a single host: re-check the addresses and ports already recorded for it, rather than sweeping a subnet. Created by the server only (never via the API) and deleted once its session reaches a terminal phase, so it is not a discovery configuration anyone owns or sees in their scan list.
        - `host_id` string, uuid, required — ID of the host that the daemon is running on — same meaning as every other variant. The host being rescanned is `target_host_id`.
        - `ips` string[], required — Addresses to scan on that host.
        - `ports` PortType[] — Ports already known on that host, re-checked to confirm they are still open. Scanned in addition to the standard discovery set, so a rescan also surfaces newly-opened services.
          - `number` integer, required — TCP or UDP port number
          - `protocol` 'Udp' | 'Tcp', required — Transport protocol the port is open on.
          - `type` 'Ssh' | 'Telnet' | 'DnsUdp' | 'DnsTcp' | 'Samba' | 'Nfs' | 'Ftp' | 'Ipp' | 'LdpTcp' | 'LdpUdp' | 'Ldap' | 'Ldaps' | 'Kerberos' | 'Snmp' | 'SnmpAlt' | 'Rdp' | 'Ntp' | 'Sip' | 'SipTls' | 'Rtsp' | 'Dhcp' | 'Http' | 'MySql' | 'PostgreSQL' | 'MongoDB' | 'Redis' | 'MsSql' | 'Docker' | 'DockerTls' | 'Kubernetes' | 'RabbitMqMgmt' | 'Cassandra' | 'Elasticsearch' | 'InfluxDb' | 'CouchDb' | 'Kafka' | 'Http3000' | 'Http5000' | 'Http8080' | 'Http8081' | 'Http8082' | 'Http8888' | 'Http9000' | 'Https' | 'Https8443' | 'Https9443' | 'Https10443' | 'Mqtt' | 'MqttTls' | 'AMQP' | 'AMQPTls' | 'Wireguard' | 'OpenVPN' | 'BACnet' | 'JetDirect' | 'Custom' — Well-known port identifier. Auto-derived from number+protocol, so it is optional on create.
        - `settings` RescanSettings — Scan settings that apply to a single-host rescan. Deliberately narrower than [`ScanSettings`]: a rescan verifies a known host against a known port set, so the full-scan mechanism (`is_full_scan`, `full_scan_interval`) must not be expressible — promoting a rescan to a 65,535-port sweep defeats the feature. The remaining omissions are settings that cannot bind on a one-or-two address target.
          - `arp_retries` integer, nullable — ARP retry rounds. Matters more here than in a sweep: for a rescan, "did it answer" is the entire answer, so a missed round reads as a dead host.
          - `port_scan_batch_size` integer, nullable — Ports scanned concurrently per host.
          - `probe_raw_socket_ports` boolean — Whether to probe raw-socket ports 9100-9107. Correctness-affecting: with this off the scanner drops those ports from its results, so a printer's known JetDirect port would look like it had disappeared.
          - `scan_rate_pps` integer, nullable — Port scan probes per second. Operators lower this for fragile devices or noisy IDS, and a rescan must respect that as much as a discovery does.
          - `use_npcap_arp` boolean — On Windows, use Npcap broadcast ARP instead of SendARP.
        - `target_host_id` string, uuid, required — The host being rescanned.
        - `type` 'Rescan', required
      - object
        - `host_id` string, uuid, required — ID of the host that the daemon is running on
        - `host_naming_fallback` 'Ip' | 'BestService', required
        - `scan_settings` ScanSettings — Scan performance settings. Lives on the discovery entity. Numeric fields are `Option<T>` — `None` means "use daemon default". The daemon unwraps with defaults at point of use.
          - `arp_rate_pps` integer, nullable — ARP packets per second (default: 50)
          - `arp_retries` integer, nullable — ARP retry rounds for non-responsive targets (default: 2 = 3 total attempts)
          - `arp_scan_cutoff` integer, nullable — ARP scan cutoff prefix. Interfaced subnets larger than this prefix are truncated to this many IPs. Default: 15 (= /15, ~131K IPs). Lower values scan more IPs — increase arp_rate_pps accordingly.
          - `full_scan_interval` integer, nullable — Run a full 65k port scan every N scans. Other scans use a light port set. Default: 3. Value of 0 means never full scan. Value of 1 means every scan is full.
          - `is_full_scan` boolean — Whether this specific scan run should do a full 65k port scan. Set by the server before dispatching to the daemon — not user-configurable.
          - `max_discovery_duration` integer, nullable — Hard ceiling on how long a single discovery run may take, in seconds (default: 21600 = 6h). When hit, the run force-completes and any hosts still queued are left un-scanned until the next run. Raise this for very large networks that legitimately need more than the default window.
          - `port_scan_batch_size` integer, nullable — Ports scanned concurrently per host (default: 200, clamped 16-1000)
          - `probe_raw_socket_ports` boolean — Whether to probe raw-socket ports 9100-9107 (default: false). Disabled by default to prevent ghost printing on JetDirect printers.
          - `scan_rate_pps` integer, nullable — Port scan probes per second (default: 500)
          - `use_npcap_arp` boolean — On Windows, use Npcap broadcast ARP instead of SendARP (default: false)
        - `subnet_ids` string[], nullable, required — Subnets to scan. None = scan all interfaced subnets.
        - `type` 'Unified', required
    - `error` string, nullable — Failure message, when the run did not complete.
    - `estimated_remaining_secs` integer, nullable — Rough estimate of the time left, in seconds.
    - `finished_at` string, date-time, nullable — When the run finished. `null` while it is still going.
    - `hosts_discovered` integer, nullable — Hosts found so far.
    - `network_id` string, uuid, required — The network this entity belongs to.
    - `phase` 'AwaitingSnapshot' | 'Queued' | 'Pending' | 'Starting' | 'Started' | 'Scanning' | 'Complete' | 'Failed' | 'Cancelled', required
    - `progress` integer, required — Completion of the current phase, from 0 to 1.
    - `scanned` ScannedEntityIds — Canonical IDs of entities scanned in a discovery session. Populated daemon-side at terminal phase from `EntityBuffer`'s `Created` entries. Travels with the terminal `DiscoveryUpdatePayload` to the server, rides the in-memory `EntityOperation::Created` event published for the historical Discovery row (the event scope carries `Entity::Discovery` with the full struct, including `run_type::Historical { results }`), then is stripped before persisting into the historical Discovery row's JSONB (see the `SqlValue::RunType` bind_value handler in `backend/src/server/shared/storage/generic.rs`). Per-entity-service subscribers extract `results.scanned` from the in-memory event and call `DiscoveryFkUpdater::update_discovery_fks` to backfill `last_discovery_id` / `first_discovery_id` on the matched rows. Naming: `scanned_*` because the daemon scans entities — some submissions match existing rows (refresh), others insert new rows. Both populate the EntityBuffer with canonical (server-assigned) IDs.
      - `binding_ids` string[] — Service bindings touched by this discovery.
      - `host_ids` string[] — Hosts touched by this discovery.
      - `interface_ids` string[] — Interfaces touched by this discovery.
      - `ip_address_ids` string[] — IP addresses touched by this discovery.
      - `port_ids` string[] — Ports touched by this discovery.
      - `service_ids` string[] — Services touched by this discovery.
      - `subnet_ids` string[] — Subnets touched by this discovery.
      - `vlan_ids` string[] — VLANs touched by this discovery.
    - `session_id` string, uuid, required — The discovery run this update belongs to.
    - `started_at` string, date-time, nullable — When the run started.
    - `warnings` DiscoveryWarning[] — Non-fatal findings from a completed run — one per occurrence, each carrying the code that identifies it and the detail that fills the sentence. Unlike `error`, these do not mark the run failed. Read through [`deserialize_warnings`] rather than the derived impl, which is what keeps historical records and pre-coded daemons rendering: both send bare strings here, and both land as `Unknown` carrying that text instead of failing the whole payload.
      - union — A single non-fatal finding from one discovery run, about one device, neighbour, or the scan itself. Serialized with the code as the tag, so the generated TypeScript is a discriminated union the UI can switch on exhaustively. The derived `Deserialize` reads that shape; the leniency that keeps historical records and pre-coded daemons working lives in [`deserialize_warnings`], which is applied at the one field that holds these.
        - object — The interface *set* was cut short, so interfaces are genuinely missing.
          - `address` string, required — The device whose walk fell short.
          - `code` 'InterfaceSetCutShort', required
          - `collected` integer, required — Interfaces read before the walk stopped.
        - object — The set was complete and only the attribute columns fell short, so nothing is missing — some descriptions or speeds are just blank. Kept apart from the above because reporting this as possible data loss sends people hunting for interfaces that were never absent.
          - `address` string, required — The device whose walk fell short.
          - `code` 'InterfaceDetailsCutShort', required
          - `collected` integer, required — Interfaces whose attribute columns were read in full.
        - object — Stopped at our own entry cap. The device is fine and larger than we read.
          - `address` string, required — The device this group was read from.
          - `code` 'SnmpWalkEntryCap', required
          - `group` 'Lldp' | 'Cdp' | 'Interfaces' | 'BridgePortNumbering' | 'BridgeForwarding' | 'VlanMembership' | 'ArpTable' | 'DeviceInventory' | 'IpAddresses' | 'LldpLocalPorts' | 'VlanNames', required — An SNMP data group a walk may come up short on. An enum rather than a free string so the code derivation below is exhaustive: every group has to declare which consequence sentence describes it, and a new one cannot be added without choosing.
          - `limit` integer, required — Entries per table that collection stops at.
        - object — The device does not implement this MIB. Not a fault, and no later scan will change it.
          - `address` string, required — The device this group was read from.
          - `code` 'SnmpWalkUnsupported', required
          - `group` 'Lldp' | 'Cdp' | 'Interfaces' | 'BridgePortNumbering' | 'BridgeForwarding' | 'VlanMembership' | 'ArpTable' | 'DeviceInventory' | 'IpAddresses' | 'LldpLocalPorts' | 'VlanNames', required — An SNMP data group a walk may come up short on. An enum rather than a free string so the code derivation below is exhaustive: every group has to declare which consequence sentence describes it, and a new one cannot be added without choosing.
        - object — The agent answered out of step with what was asked — stale or non-advancing responses.
          - `address` string, required — The device this group was read from.
          - `code` 'SnmpWalkDesynchronised', required
          - `group` 'Lldp' | 'Cdp' | 'Interfaces' | 'BridgePortNumbering' | 'BridgeForwarding' | 'VlanMembership' | 'ArpTable' | 'DeviceInventory' | 'IpAddresses' | 'LldpLocalPorts' | 'VlanNames', required — An SNMP data group a walk may come up short on. An enum rather than a free string so the code derivation below is exhaustive: every group has to declare which consequence sentence describes it, and a new one cannot be added without choosing.
        - object — A partial read whose rows are thrown away rather than recorded, so the device contributes nothing for this group however much it answered.
          - `address` string, required — The device this group was read from.
          - `code` 'SnmpWalkPartialDiscarded', required
          - `group` 'Lldp' | 'Cdp' | 'Interfaces' | 'BridgePortNumbering' | 'BridgeForwarding' | 'VlanMembership' | 'ArpTable' | 'DeviceInventory' | 'IpAddresses' | 'LldpLocalPorts' | 'VlanNames', required — An SNMP data group a walk may come up short on. An enum rather than a free string so the code derivation below is exhaustive: every group has to declare which consequence sentence describes it, and a new one cannot be added without choosing.
        - object — A partial read whose rows were recorded as far as they got.
          - `address` string, required — The device this group was read from.
          - `code` 'SnmpWalkPartialRecorded', required
          - `group` 'Lldp' | 'Cdp' | 'Interfaces' | 'BridgePortNumbering' | 'BridgeForwarding' | 'VlanMembership' | 'ArpTable' | 'DeviceInventory' | 'IpAddresses' | 'LldpLocalPorts' | 'VlanNames', required — An SNMP data group a walk may come up short on. An enum rather than a free string so the code derivation below is exhaustive: every group has to declare which consequence sentence describes it, and a new one cannot be added without choosing.
        - object — Nothing came back for the root of the bridge MIB, which switches commonly do not implement.
          - `address` string, required — The device this group was read from.
          - `code` 'SnmpWalkBridgeMibAbsent', required
          - `group` 'Lldp' | 'Cdp' | 'Interfaces' | 'BridgePortNumbering' | 'BridgeForwarding' | 'VlanMembership' | 'ArpTable' | 'DeviceInventory' | 'IpAddresses' | 'LldpLocalPorts' | 'VlanNames', required — An SNMP data group a walk may come up short on. An enum rather than a free string so the code derivation below is exhaustive: every group has to declare which consequence sentence describes it, and a new one cannot be added without choosing.
        - object — Nothing came back at all, and the device stopped answering rather than reporting empty.
          - `address` string, required — The device this group was read from.
          - `code` 'SnmpWalkNoAnswer', required
          - `group` 'Lldp' | 'Cdp' | 'Interfaces' | 'BridgePortNumbering' | 'BridgeForwarding' | 'VlanMembership' | 'ArpTable' | 'DeviceInventory' | 'IpAddresses' | 'LldpLocalPorts' | 'VlanNames', required — An SNMP data group a walk may come up short on. An enum rather than a free string so the code derivation below is exhaustive: every group has to declare which consequence sentence describes it, and a new one cannot be added without choosing.
        - object — The device published a count, and the read ended before reaching it.
          - `address` string, required — The device that published the count.
          - `code` 'ClaimedCountReadCutShort', required
          - `expected` integer, required — Rows the device said it had.
          - `group` 'Lldp' | 'Cdp' | 'Interfaces' | 'BridgePortNumbering' | 'BridgeForwarding' | 'VlanMembership' | 'ArpTable' | 'DeviceInventory' | 'IpAddresses' | 'LldpLocalPorts' | 'VlanNames', required — An SNMP data group a walk may come up short on. An enum rather than a free string so the code derivation below is exhaustive: every group has to declare which consequence sentence describes it, and a new one cannot be added without choosing.
          - `observed` integer, required — Rows the read returned.
          - `source` 'IfNumber' | 'SysServicesBridgeBit' | 'LldpLocalIdentity' | 'Dot1dBaseNumPorts', required — Where a device's claim about itself came from. Named rather than folded into a sentence because the operator's next step depends on it: a wrong `ifNumber` is a firmware bug to report upstream, while a set bridge bit over an empty bridge table is usually a missing SNMP view or VLAN context on their side.
        - object — The device published a count, the read finished, and it came up short anyway.
          - `address` string, required — The device that published the count.
          - `code` 'ClaimedCountUnderRead', required
          - `expected` integer, required — Rows the device said it had.
          - `group` 'Lldp' | 'Cdp' | 'Interfaces' | 'BridgePortNumbering' | 'BridgeForwarding' | 'VlanMembership' | 'ArpTable' | 'DeviceInventory' | 'IpAddresses' | 'LldpLocalPorts' | 'VlanNames', required — An SNMP data group a walk may come up short on. An enum rather than a free string so the code derivation below is exhaustive: every group has to declare which consequence sentence describes it, and a new one cannot be added without choosing.
          - `observed` integer, required — Rows the read returned.
          - `source` 'IfNumber' | 'SysServicesBridgeBit' | 'LldpLocalIdentity' | 'Dot1dBaseNumPorts', required — Where a device's claim about itself came from. Named rather than folded into a sentence because the operator's next step depends on it: a wrong `ifNumber` is a firmware bug to report upstream, while a set bridge bit over an empty bridge table is usually a missing SNMP view or VLAN context on their side.
        - object — The device declared the capability, and the read ended without returning any.
          - `address` string, required — The device that declared the capability.
          - `code` 'ClaimedCapabilityReadCutShort', required
          - `group` 'Lldp' | 'Cdp' | 'Interfaces' | 'BridgePortNumbering' | 'BridgeForwarding' | 'VlanMembership' | 'ArpTable' | 'DeviceInventory' | 'IpAddresses' | 'LldpLocalPorts' | 'VlanNames', required — An SNMP data group a walk may come up short on. An enum rather than a free string so the code derivation below is exhaustive: every group has to declare which consequence sentence describes it, and a new one cannot be added without choosing.
          - `source` 'IfNumber' | 'SysServicesBridgeBit' | 'LldpLocalIdentity' | 'Dot1dBaseNumPorts', required — Where a device's claim about itself came from. Named rather than folded into a sentence because the operator's next step depends on it: a wrong `ifNumber` is a firmware bug to report upstream, while a set bridge bit over an empty bridge table is usually a missing SNMP view or VLAN context on their side.
        - object — The device declared the capability, the read finished, and it returned none.
          - `address` string, required — The device that declared the capability.
          - `code` 'ClaimedCapabilityEmpty', required
          - `group` 'Lldp' | 'Cdp' | 'Interfaces' | 'BridgePortNumbering' | 'BridgeForwarding' | 'VlanMembership' | 'ArpTable' | 'DeviceInventory' | 'IpAddresses' | 'LldpLocalPorts' | 'VlanNames', required — An SNMP data group a walk may come up short on. An enum rather than a free string so the code derivation below is exhaustive: every group has to declare which consequence sentence describes it, and a new one cannot be added without choosing.
          - `source` 'IfNumber' | 'SysServicesBridgeBit' | 'LldpLocalIdentity' | 'Dot1dBaseNumPorts', required — Where a device's claim about itself came from. Named rather than folded into a sentence because the operator's next step depends on it: a wrong `ifNumber` is a firmware bug to report upstream, while a set bridge bit over an empty bridge table is usually a missing SNMP view or VLAN context on their side.
        - object — Neighbours whose local port matched no interface, so they were discarded entirely.
          - `address` string, required — The device that reported the neighbours.
          - `code` 'LldpLocalPortDropped', required
          - `dropped` integer, required — Neighbours discarded for want of a matching interface.
          - `total` integer, required — Neighbours the device reported in all.
        - object — Neighbours whose local port could not be identified but did match an interface number, so they are drawn against a port that may be the wrong one.
          - `address` string, required — The device that reported the neighbours.
          - `code` 'LldpLocalPortMisplaced', required
          - `misplaced` integer, required — Neighbours drawn against a port that may be the wrong one.
        - object — The column carrying the identifier stopped early, so a rescan may recover these.
          - `address` string, required — The device that reported the records.
          - `consequence` 'AllLinksLost' | 'SomeLinksLost', required — What discarding a device's malformed neighbour records cost it. A slot value rather than two codes per reason: losing every link and losing some of them is a difference in severity, not in failure mode, and the metric asks about mode. Splitting it into codes would double the enum to say something the operator reads in one clause.
          - `discarded` integer, required — Records thrown away for want of a usable identifier.
          - `group` 'Lldp' | 'Cdp' | 'Interfaces' | 'BridgePortNumbering' | 'BridgeForwarding' | 'VlanMembership' | 'ArpTable' | 'DeviceInventory' | 'IpAddresses' | 'LldpLocalPorts' | 'VlanNames', required — An SNMP data group a walk may come up short on. An enum rather than a free string so the code derivation below is exhaustive: every group has to declare which consequence sentence describes it, and a new one cannot be added without choosing.
          - `kept` integer, required — Records that survived, which is what decides whether this cost the device some of its topology or all of it.
          - `code` 'MalformedNeighboursWalkCutShort', required
        - object — Rows that never appeared in the identifying column at all.
          - `address` string, required — The device that reported the records.
          - `consequence` 'AllLinksLost' | 'SomeLinksLost', required — What discarding a device's malformed neighbour records cost it. A slot value rather than two codes per reason: losing every link and losing some of them is a difference in severity, not in failure mode, and the metric asks about mode. Splitting it into codes would double the enum to say something the operator reads in one clause.
          - `discarded` integer, required — Records thrown away for want of a usable identifier.
          - `group` 'Lldp' | 'Cdp' | 'Interfaces' | 'BridgePortNumbering' | 'BridgeForwarding' | 'VlanMembership' | 'ArpTable' | 'DeviceInventory' | 'IpAddresses' | 'LldpLocalPorts' | 'VlanNames', required — An SNMP data group a walk may come up short on. An enum rather than a free string so the code derivation below is exhaustive: every group has to declare which consequence sentence describes it, and a new one cannot be added without choosing.
          - `kept` integer, required — Records that survived, which is what decides whether this cost the device some of its topology or all of it.
          - `code` 'MalformedNeighboursGhostRows', required
        - object — Neighbours listed and then never given an identifier.
          - `address` string, required — The device that reported the records.
          - `consequence` 'AllLinksLost' | 'SomeLinksLost', required — What discarding a device's malformed neighbour records cost it. A slot value rather than two codes per reason: losing every link and losing some of them is a difference in severity, not in failure mode, and the metric asks about mode. Splitting it into codes would double the enum to say something the operator reads in one clause.
          - `discarded` integer, required — Records thrown away for want of a usable identifier.
          - `group` 'Lldp' | 'Cdp' | 'Interfaces' | 'BridgePortNumbering' | 'BridgeForwarding' | 'VlanMembership' | 'ArpTable' | 'DeviceInventory' | 'IpAddresses' | 'LldpLocalPorts' | 'VlanNames', required — An SNMP data group a walk may come up short on. An enum rather than a free string so the code derivation below is exhaustive: every group has to declare which consequence sentence describes it, and a new one cannot be added without choosing.
          - `kept` integer, required — Records that survived, which is what decides whether this cost the device some of its topology or all of it.
          - `code` 'MalformedNeighboursIncompleteRecords', required
        - object — The identifying column held a value of a type it cannot hold.
          - `address` string, required — The device that reported the records.
          - `consequence` 'AllLinksLost' | 'SomeLinksLost', required — What discarding a device's malformed neighbour records cost it. A slot value rather than two codes per reason: losing every link and losing some of them is a difference in severity, not in failure mode, and the metric asks about mode. Splitting it into codes would double the enum to say something the operator reads in one clause.
          - `discarded` integer, required — Records thrown away for want of a usable identifier.
          - `group` 'Lldp' | 'Cdp' | 'Interfaces' | 'BridgePortNumbering' | 'BridgeForwarding' | 'VlanMembership' | 'ArpTable' | 'DeviceInventory' | 'IpAddresses' | 'LldpLocalPorts' | 'VlanNames', required — An SNMP data group a walk may come up short on. An enum rather than a free string so the code derivation below is exhaustive: every group has to declare which consequence sentence describes it, and a new one cannot be added without choosing.
          - `kept` integer, required — Records that survived, which is what decides whether this cost the device some of its topology or all of it.
          - `code` 'MalformedNeighboursUnexpectedType', required
        - object — The record's position in the neighbour table could not be read.
          - `address` string, required — The device that reported the records.
          - `consequence` 'AllLinksLost' | 'SomeLinksLost', required — What discarding a device's malformed neighbour records cost it. A slot value rather than two codes per reason: losing every link and losing some of them is a difference in severity, not in failure mode, and the metric asks about mode. Splitting it into codes would double the enum to say something the operator reads in one clause.
          - `discarded` integer, required — Records thrown away for want of a usable identifier.
          - `group` 'Lldp' | 'Cdp' | 'Interfaces' | 'BridgePortNumbering' | 'BridgeForwarding' | 'VlanMembership' | 'ArpTable' | 'DeviceInventory' | 'IpAddresses' | 'LldpLocalPorts' | 'VlanNames', required — An SNMP data group a walk may come up short on. An enum rather than a free string so the code derivation below is exhaustive: every group has to declare which consequence sentence describes it, and a new one cannot be added without choosing.
          - `kept` integer, required — Records that survived, which is what decides whether this cost the device some of its topology or all of it.
          - `code` 'MalformedNeighboursUnreadableIndex', required
        - object — SNMP answered and every table came back empty.
          - `address` string, required — The device that answered.
          - `code` 'SnmpCollectedNothing', required
        - object — The device answered correctly and persisting its VLANs failed.
          - `address` string, required — The device whose VLANs could not be recorded.
          - `code` 'VlanRecordingFailed', required
        - object — The credential's address is not on any subnet this scan covers.
          - `address` string, required — The address the credential is bound to.
          - `code` 'CredentialTargetNotScanned', required
          - `integration` 'Snmp' | 'DockerProxy' | 'DockerSocket' | 'PodmanProxy' | 'PodmanSocket' | 'UnifiController' | 'InstantOn' | 'Unknown', required
        - object — Nothing answered at the credential's address during the scan.
          - `address` string, required — The address the credential is bound to.
          - `code` 'CredentialTargetNotResponding', required
          - `integration` 'Snmp' | 'DockerProxy' | 'DockerSocket' | 'PodmanProxy' | 'PodmanSocket' | 'UnifiController' | 'InstantOn' | 'Unknown', required
        - object — The port the credential needs was not open, so it was never tried.
          - `address` string, required — The address the credential is bound to.
          - `code` 'CredentialGateClosed', required
          - `integration` 'Snmp' | 'DockerProxy' | 'DockerSocket' | 'PodmanProxy' | 'PodmanSocket' | 'UnifiController' | 'InstantOn' | 'Unknown', required
          - `ports` integer[], required — The ports that had to be open for the probe to run.
        - object — The credential was refused.
          - `address` string, required — The address the credential was tried against.
          - `detail` string, nullable, required — The library's own diagnostic — free text, so it can only ever be displayed. It is the one thing the code cannot supersede: the code says which failure mode, this says what actually came back ("connection refused (os error 111)"), and it is now attributable to this one address rather than being the first message of a whole batch.
          - `integration` 'Snmp' | 'DockerProxy' | 'DockerSocket' | 'PodmanProxy' | 'PodmanSocket' | 'UnifiController' | 'InstantOn' | 'Unknown', required
          - `code` 'CredentialRejected', required
        - object — The credential is incomplete and could not be used.
          - `address` string, required — The address the credential was tried against.
          - `detail` string, nullable, required — The library's own diagnostic — free text, so it can only ever be displayed. It is the one thing the code cannot supersede: the code says which failure mode, this says what actually came back ("connection refused (os error 111)"), and it is now attributable to this one address rather than being the first message of a whole batch.
          - `integration` 'Snmp' | 'DockerProxy' | 'DockerSocket' | 'PodmanProxy' | 'PodmanSocket' | 'UnifiController' | 'InstantOn' | 'Unknown', required
          - `code` 'CredentialMalformed', required
        - object — TLS could not be negotiated.
          - `address` string, required — The address the credential was tried against.
          - `detail` string, nullable, required — The library's own diagnostic — free text, so it can only ever be displayed. It is the one thing the code cannot supersede: the code says which failure mode, this says what actually came back ("connection refused (os error 111)"), and it is now attributable to this one address rather than being the first message of a whole batch.
          - `integration` 'Snmp' | 'DockerProxy' | 'DockerSocket' | 'PodmanProxy' | 'PodmanSocket' | 'UnifiController' | 'InstantOn' | 'Unknown', required
          - `code` 'CredentialTlsFailed', required
        - object — Something answered that is not the expected service.
          - `address` string, required — The address the credential was tried against.
          - `detail` string, nullable, required — The library's own diagnostic — free text, so it can only ever be displayed. It is the one thing the code cannot supersede: the code says which failure mode, this says what actually came back ("connection refused (os error 111)"), and it is now attributable to this one address rather than being the first message of a whole batch.
          - `integration` 'Snmp' | 'DockerProxy' | 'DockerSocket' | 'PodmanProxy' | 'PodmanSocket' | 'UnifiController' | 'InstantOn' | 'Unknown', required
          - `code` 'CredentialNotThisService', required
        - object — Authenticated, then failed while collecting.
          - `address` string, required — The address the credential was tried against.
          - `detail` string, nullable, required — The library's own diagnostic — free text, so it can only ever be displayed. It is the one thing the code cannot supersede: the code says which failure mode, this says what actually came back ("connection refused (os error 111)"), and it is now attributable to this one address rather than being the first message of a whole batch.
          - `integration` 'Snmp' | 'DockerProxy' | 'DockerSocket' | 'PodmanProxy' | 'PodmanSocket' | 'UnifiController' | 'InstantOn' | 'Unknown', required
          - `code` 'CredentialCollectionFailed', required
        - object — Authenticated, then ran out of time while collecting.
          - `address` string, required — The address the credential was tried against.
          - `detail` string, nullable, required — The library's own diagnostic — free text, so it can only ever be displayed. It is the one thing the code cannot supersede: the code says which failure mode, this says what actually came back ("connection refused (os error 111)"), and it is now attributable to this one address rather than being the first message of a whole batch.
          - `integration` 'Snmp' | 'DockerProxy' | 'DockerSocket' | 'PodmanProxy' | 'PodmanSocket' | 'UnifiController' | 'InstantOn' | 'Unknown', required
          - `code` 'CredentialCollectionTimedOut', required
        - object — Nothing was reachable at the address.
          - `address` string, required — The address the credential was tried against.
          - `detail` string, nullable, required — The library's own diagnostic — free text, so it can only ever be displayed. It is the one thing the code cannot supersede: the code says which failure mode, this says what actually came back ("connection refused (os error 111)"), and it is now attributable to this one address rather than being the first message of a whole batch.
          - `integration` 'Snmp' | 'DockerProxy' | 'DockerSocket' | 'PodmanProxy' | 'PodmanSocket' | 'UnifiController' | 'InstantOn' | 'Unknown', required
          - `code` 'CredentialUnreachable', required
        - object — The attempt timed out before anything answered.
          - `address` string, required — The address the credential was tried against.
          - `detail` string, nullable, required — The library's own diagnostic — free text, so it can only ever be displayed. It is the one thing the code cannot supersede: the code says which failure mode, this says what actually came back ("connection refused (os error 111)"), and it is now attributable to this one address rather than being the first message of a whole batch.
          - `integration` 'Snmp' | 'DockerProxy' | 'DockerSocket' | 'PodmanProxy' | 'PodmanSocket' | 'UnifiController' | 'InstantOn' | 'Unknown', required
          - `code` 'CredentialTimedOut', required
        - object — The run hit its global time limit, with an estimate of the work left.
          - `code` 'ScanTimeLimitWithEstimate', required
          - `hosts_not_scanned` integer, required — Hosts still queued when the run stopped.
          - `hours` integer, required — The limit the run hit, in hours.
          - `minutes_remaining` integer, required — Estimated minutes of work left at that point.
        - object — The run hit its global time limit, with no usable estimate.
          - `code` 'ScanTimeLimit', required
          - `hosts_not_scanned` integer, required — Hosts still queued when the run stopped.
          - `hours` integer, required — The limit the run hit, in hours.
        - object — The advertised identifier matches no host on this network.
          - `host_id` string, uuid, required — The local device that saw the neighbour, not the far end — the far end is what could not be identified.
          - `identifier` string, required — The chassis ID (LLDP) or device id (CDP) that did not identify one host.
          - `if_descr` string, required — The local interface that advertised the neighbour.
          - `sys_name` string, nullable, required — The far end's advertised `sysName`, where it sent one.
          - `code` 'LldpNeighbourNotFound', required
        - object — The advertised identifier matches several hosts, so none can be picked.
          - `host_id` string, uuid, required — The local device that saw the neighbour, not the far end — the far end is what could not be identified.
          - `identifier` string, required — The chassis ID (LLDP) or device id (CDP) that did not identify one host.
          - `if_descr` string, required — The local interface that advertised the neighbour.
          - `sys_name` string, nullable, required — The far end's advertised `sysName`, where it sent one.
          - `code` 'LldpNeighbourAmbiguous', required
        - object — The far end resolved, and its port id is of a subtype there is no lookup for.
          - `host_id` string, uuid, required — The local device that saw the neighbour, and the port it saw it on.
          - `if_descr` string, required — The local interface that advertised the neighbour.
          - `port_desc` string, nullable, required — `lldpRemPortDesc`, the last-resort tier. Present because "the id failed and the description was empty" and "both were tried and neither matched" call for different fixes.
          - `port_id` string, nullable, required — The advertised port id in `Debug` form, which carries subtype and value together (`MacAddress("00:ad:24:af:4e:00")`, `InterfaceName("2")`). Both halves are needed: the subtype says which tier ran and the value says what it looked for.
          - `remote_host_id` string, uuid, required — The far-end device, already resolved — this is what makes it distinct from [`UnmatchedNeighbour`].
          - `code` 'LldpPortNoStrategy', required
        - object — The far end resolved, and none of its ports matches the advertised port id.
          - `host_id` string, uuid, required — The local device that saw the neighbour, and the port it saw it on.
          - `if_descr` string, required — The local interface that advertised the neighbour.
          - `port_desc` string, nullable, required — `lldpRemPortDesc`, the last-resort tier. Present because "the id failed and the description was empty" and "both were tried and neither matched" call for different fixes.
          - `port_id` string, nullable, required — The advertised port id in `Debug` form, which carries subtype and value together (`MacAddress("00:ad:24:af:4e:00")`, `InterfaceName("2")`). Both halves are needed: the subtype says which tier ran and the value says what it looked for.
          - `remote_host_id` string, uuid, required — The far-end device, already resolved — this is what makes it distinct from [`UnmatchedNeighbour`].
          - `code` 'LldpPortNotFound', required
        - object — The far end resolved, and several of its ports match, so it identifies none.
          - `host_id` string, uuid, required — The local device that saw the neighbour, and the port it saw it on.
          - `if_descr` string, required — The local interface that advertised the neighbour.
          - `port_desc` string, nullable, required — `lldpRemPortDesc`, the last-resort tier. Present because "the id failed and the description was empty" and "both were tried and neither matched" call for different fixes.
          - `port_id` string, nullable, required — The advertised port id in `Debug` form, which carries subtype and value together (`MacAddress("00:ad:24:af:4e:00")`, `InterfaceName("2")`). Both halves are needed: the subtype says which tier ran and the value says what it looked for.
          - `remote_host_id` string, uuid, required — The far-end device, already resolved — this is what makes it distinct from [`UnmatchedNeighbour`].
          - `code` 'LldpPortAmbiguous', required
        - object — The run produced more warnings than the scan record holds. Emitted rather than dropping the tail silently — a list that simply stops reads as though that was all of them.
          - `code` 'WarningsTruncated', required
          - `elided` integer, required — Warnings dropped past the record's cap.
        - object — A warning this binary does not recognise: a bare string from a historical record or a pre-coded daemon, or a code from a newer one. Carries the original text so scan history keeps rendering; the code itself is what reaches the metric, never `detail`.
          - `code` 'Unknown', required
          - `detail` string, required — The original warning text, rendered as-is.
  - `error` string, nullable — Human-readable failure message. Omitted on success.
  - `meta` ApiMeta, required — API metadata included in all responses
    - `api_version` integer, required — API version (integer, increments on breaking changes)
    - `server_version` string, required — Server version (semver)
  - `success` boolean, required — `true` when the request succeeded. `false` responses carry `error` instead of `data`.

## Changes

> 72 revisions in range; 66 could not be searched.

- **2026-04-20** `f04499e2280f` — 1 warning, 1 info
  - removed the optional property `data/items/scanned` from the response with the `200` status
  - removed the `AwaitingSnapshot` enum value from the `data/items/phase` response property for the response status `200`

[Change history](https://skmtc.dev/scanopy/apis/scanopy-api/changes/api/v1/discovery/active-sessions/get.md)

---

[API](https://skmtc.dev/scanopy/apis/scanopy-api.md) · [All operations](https://skmtc.dev/scanopy/apis/scanopy-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/scanopy/scanopy-api/revisions/d061209476f3/schema)