diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/vpn/AddVpnUserCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/vpn/AddVpnUserCmd.java
index 9c9f1c0f50f..f3b452008c9 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/vpn/AddVpnUserCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/vpn/AddVpnUserCmd.java
@@ -125,6 +125,9 @@ public class AddVpnUserCmd extends BaseAsyncCreateCmd {
         vpnResponse.setId(vpnUser.getUuid());
         vpnResponse.setUserName(vpnUser.getUsername());
         vpnResponse.setAccountName(account.getAccountName());
+        // re-retrieve the vpnuser, as the call to `applyVpnUsers` might have changed the state
+        vpnUser = _entityMgr.findById(VpnUser.class, getEntityId());
+        vpnResponse.setState(vpnUser.getState().toString());
 
         Domain domain = _entityMgr.findById(Domain.class, account.getDomainId());
         if (domain != null) {
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/VpnUsersResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/VpnUsersResponse.java
index 3a0e84285aa..d3e4d941678 100644
--- a/api/src/main/java/org/apache/cloudstack/api/response/VpnUsersResponse.java
+++ b/api/src/main/java/org/apache/cloudstack/api/response/VpnUsersResponse.java
@@ -57,7 +57,7 @@ public class VpnUsersResponse extends BaseResponse implements ControlledEntityRe
     private String projectName;
 
     @SerializedName(ApiConstants.STATE)
-    @Param(description = "the state of the Vpn User")
+    @Param(description = "the state of the Vpn User, can be 'Add', 'Revoke' or 'Active'.")
     private String state;
 
     public void setId(String id) {