Some of the data that you're looking for can be pulled with the event log API endpoint. As you can see in the sample response that I got from my own MX we get a lot of data about the specific Client VPN connection. I'm using Systems Manager sentry VPN to connect which is why the user_id is a Meraki.com email.    For your example we are going to only be looking for two specific event types: client_vpn_connect client_vpn_disconnect   The full URL will look something like this. This was created by Postman (download the Postman collection). I know the includedEventTypes look odd but it's the best way to do it.    https://api.meraki.com/api/v0/networks/{{networkId}}/events/?perPage=3&productType=appliance&includedEventTypes[]=client_vpn_connect&includedEventTypes[]=client_vpn_disconnect                         The output:   { "message": null, "pageStartAt": "2020-02-21T18:49:30.000000Z", "pageEndAt": "2020-03-21T17:49:30.156563Z", "events": [ { "occurredAt": "2020-03-21T17:48:56.583000Z", "networkId": "L_60535", "type": "client_vpn_disconnect", "description": "VPN client disconnected", "clientId": "kc2dddd", "clientDescription": "03:5e:d6:c1:b2:a3", "deviceSerial": "Q2KN-ZXYW-RYMS", "deviceName": "myMX", "eventData": { "local_ip": "172.17.8.64", "user_id": "sm_6655559290@meraki.com", "remote_ip": "166.255.249.20" } }, { "occurredAt": "2020-03-21T17:48:02.830001Z", "networkId": "L_60535", "type": "client_vpn_connect", "description": "VPN client connected", "clientId": "kc2dddd", "clientDescription": "03:5e:d6:c1:b2:a3", "deviceSerial": "Q2KN-ZXYW-RYMS", "deviceName": "myMX", "eventData": { "local_ip": "172.17.8.64", "user_id": "sm_6655559290@meraki.com", "remote_ip": "166.255.249.20" } } ] }   Another great resource you might also want to check out: cs.co/meraki_tools, it's a google sheet integration with the API all done in your browser. It has a great event log viewer where you can filter for VPN client disconnected and VPN client connected to have the data populated into rows and columns.          ... View more