Open More → History (/history). Paste an IP, MAC, hostname, hex client-id / DUID, or a switch port (Gi1/0/12). Lattice detects which. Occupancy is every remaining lease row — not Audit, not the Search timeline. A prefix is not a History identity — open the subnet instead.
Readonly can look. CSV downloads the hold table.
Lookups
Who occupied this IP? Paste the address. The sentence is the story: how many holds, who has it now, who had it before. Current reservation/assignment/exclude is On the plan now — that is intent, not a hold.
Who had it last Tuesday? Fill As of with a calendar day (YYYY-MM-DD, that whole day on this computer) or an RFC3339 instant. CSV uses the same timezone as the page. From/to clips overlapping holds. Do not combine As of with From/to.
Which NICs has this hostname used? Paste the name. A laptop that changed NIC shows two MACs. Subnets this name occupied are listed; each hold links the IP and MAC.
A MAC works the same way: where this client has been, which IPs, option 82 circuit/remote, first-grant node → last-renew node.
What sat on this switch port? Paste the circuit-id (Gi1/0/12). Relays have to send option 82; otherwise History says so. A remote-id that looks like a hostname uses ?remote= on the URL. Optional relay address when the same port name exists in more than one building.
A reserved printer that moved racks is the same report: holds, the reservation on the plan, Audit create of that reservation.
The whole VLAN last Tuesday? Not History paste of a CIDR. Open the subnet and use As of on the address map. Occupancy is who held each address at the end of that day (now, if you pick today). Reservations, assignments, and excludes on that map are the current plan, not time-travel. CSV is that day’s hold table.
Not Audit, not Search, not Leases
| Someone asks | Use |
|---|---|
Who reserved .10? | Audit |
| What IP does this MAC have now? | Search (lands on the object). A full MAC also opens the DHCP timeline |
| Force-release / filter by state | Leases |
Who held .55 last Tuesday? Where has this MAC been? Which NICs did this hostname use? What sat on Gi1/0/12? | History |
| What was on vlan 20 last Tuesday? | Subnet As of on the address map |
Last occupant on the address map (with As of empty) is only the latest free-IP row. History is the full list.
NAK/silent on the History page is the last 7 days (why DHCP said no). That is not occupancy. Full MAC timeline stays on Search.
Retention
Occupancy is every remaining lease row. Lattice does not prune expired or released leases. NAK/silent events are the last 7 days. Audit is retained separately (Settings, default 365 days).
API
Exactly one of ip, mac, hostname, client_id, duid, circuit, remote. giaddr is optional and only valid with circuit or remote. at= is a point in time (RFC3339) or a calendar day (YYYY-MM-DD). tz= is an IANA zone for date-only at / from / to (the console sends the browser zone; default UTC). from/to clip overlapping holds (not with at). format=csv is the hold table. A CIDR is not an identity — use the subnet history route.
curl -s -H "authorization: Bearer $TOKEN" \
'http://127.0.0.1:8080/api/v1/history?ip=10.10.10.55'
curl -s -H "authorization: Bearer $TOKEN" \
'http://127.0.0.1:8080/api/v1/history?hostname=maya-chen-mbp&at=2026-08-18'
curl -s -H "authorization: Bearer $TOKEN" \
'http://127.0.0.1:8080/api/v1/history?circuit=Gi1/0/12'
curl -s -H "authorization: Bearer $TOKEN" \
'http://127.0.0.1:8080/api/v1/history?mac=aa:bb:cc:dd:ee:ff&format=csv' -o history.csv
Fleet
On a cluster opened in Fleet, History is the same report through the tunnel. Fleet-wide History (GET /fleet/v1/history) fans out live occupancy to allowed clusters — not a replica of leases. As-of needs that cluster’s lease table. Optional cluster_id narrows to one site. Paste includes switch ports. CSV includes the cluster name and matches the lookup that succeeded.