Summary
The API call to list channel members no longer returns LastViewedAt
I can see this is deliberate, as git checkin ba86dfc5876b354b9d3c20ff45c08ca6f8426149 on 05 Nov 2025 adds code specifically to do this (unless you are logged in as the user in question, when it does set it).
Why has this change been made?
I have an important requirement to know when each user last logged in to Mattermost. I have been satisfying that by selecting the most recent date the user visited a channel (I have to check the channel members for all channels, anyway).
Is there an alternative way of finding out this information via the API? Note that I am not admin of the self-hosted Mattermost instance in question.
I figured that was going to break at least one person!
This was an unintentional information leak so it was removed for security.
Fortunately for you I think the user status API can solve your problem here as there is a last activity field that you can access for all users: API Documentation . There is also a bulk version of that API here: API Documentation . This doesn’t give you an exact login time but I am guessing since your previous one did not either then this is likely acceptable.
From a security point of view, this change makes sense for Mattermost, but it hurts if you were using LastViewedAt. That field was leaking information about what users were doing with other users, thus it was only a matter of time until someone discovered and pulled it off the channel members API.
The good news is that the user status API is now the appropriate way to proceed. It offers you last_activity_at, which is the closest safe thing you can obtain without admin access. It’s not a legitimate login timestamp, but it does track “user was active in the system,” which is what most monitoring needs anyway.
The bulk status endpoint helps keep things running smoothly if you’re polling in bulk. Just remember that this is now a deliberate choice Mattermost is making it harder to see what users are doing, not easier.
In short, LastViewedAt is gone for security reasons, the user status API is the new standard, and this is how things will be from now on.