v1

latestOpenAPI 3.0.02026-07-142351,1971.3 MB

Usage Metering

Get monthly usage attribution

Get monthly usage attribution. Multi-region data is available starting March 1, 2023.

This API endpoint is paginated. To make sure you receive all records, check if the value of next_record_id is set in the response. If it is, make another request and pass next_record_id as a parameter. Pseudo code example:

response := GetMonthlyUsageAttribution(start_month)
cursor := response.metadata.pagination.next_record_id
WHILE cursor != null BEGIN
  sleep(5 seconds)  # Avoid running into rate limit
  response := GetMonthlyUsageAttribution(start_month, next_record_id=cursor)
  cursor := response.metadata.pagination.next_record_id
END

get/api/v1/usage/monthly-attribution

Query parameters

start_monthstring date-time required

Datetime in ISO-8601 format, UTC, precise to month: [YYYY-MM] for usage beginning in this month. Maximum of 15 months ago.

end_monthstring date-time

Datetime in ISO-8601 format, UTC, precise to month: [YYYY-MM] for usage ending this month.

fields'api_usage' | 'api_percentage' | 'apm_fargate_usage' | 'apm_fargate_percentage' | 'appsec_fargate_usage' | 'appsec_fargate_percentage' | 'apm_host_usage' | 'apm_host_percentage' | 'apm_usm_usage' | 'apm_usm_percentage' | 'appsec_usage' | 'appsec_percentage' | 'asm_serverless_traced_invocations_usage' | 'asm_serverless_traced_invocations_percentage' | 'bits_ai_investigations_usage' | 'bits_ai_investigations_percentage' | 'browser_usage' | 'browser_percentage' | 'ci_visibility_itr_usage' | 'ci_visibility_itr_percentage' | 'cloud_siem_usage' | 'cloud_siem_percentage' | 'code_security_host_usage' | 'code_security_host_percentage' | 'container_excl_agent_usage' | 'container_excl_agent_percentage' | 'container_usage' | 'container_percentage' | 'cspm_containers_percentage' | 'cspm_containers_usage' | 'cspm_hosts_percentage' | 'cspm_hosts_usage' | 'custom_timeseries_usage' | 'custom_timeseries_percentage' | 'custom_ingested_timeseries_usage' | 'custom_ingested_timeseries_percentage' | 'cws_containers_percentage' | 'cws_containers_usage' | 'cws_fargate_task_percentage' | 'cws_fargate_task_usage' | 'cws_hosts_percentage' | 'cws_hosts_usage' | 'data_jobs_monitoring_usage' | 'data_jobs_monitoring_percentage' | 'data_stream_monitoring_usage' | 'data_stream_monitoring_percentage' | 'dbm_hosts_percentage' | 'dbm_hosts_usage' | 'dbm_queries_percentage' | 'dbm_queries_usage' | 'error_tracking_usage' | 'error_tracking_percentage' | 'estimated_indexed_spans_usage' | 'estimated_indexed_spans_percentage' | 'estimated_ingested_spans_usage' | 'estimated_ingested_spans_percentage' | 'fargate_usage' | 'fargate_percentage' | 'flex_logs_starter_usage' | 'flex_logs_starter_percentage' | 'flex_stored_logs_usage' | 'flex_stored_logs_percentage' | 'functions_usage' | 'functions_percentage' | 'incident_management_monthly_active_users_usage' | 'incident_management_monthly_active_users_percentage' | 'infra_host_usage' | 'infra_host_percentage' | 'infra_host_basic_usage' | 'infra_host_basic_percentage' | 'invocations_usage' | 'invocations_percentage' | 'lambda_traced_invocations_usage' | 'lambda_traced_invocations_percentage' | 'llm_observability_usage' | 'llm_observability_percentage' | 'llm_spans_usage' | 'llm_spans_percentage' | 'mobile_app_testing_percentage' | 'mobile_app_testing_usage' | 'ndm_netflow_usage' | 'ndm_netflow_percentage' | 'network_device_wireless_usage' | 'network_device_wireless_percentage' | 'npm_host_usage' | 'npm_host_percentage' | 'obs_pipeline_bytes_usage' | 'obs_pipeline_bytes_percentage' | 'obs_pipelines_vcpu_usage' | 'obs_pipelines_vcpu_percentage' | 'online_archive_usage' | 'online_archive_percentage' | 'product_analytics_session_usage' | 'product_analytics_session_percentage' | 'profiled_container_usage' | 'profiled_container_percentage' | 'profiled_fargate_usage' | 'profiled_fargate_percentage' | 'profiled_host_usage' | 'profiled_host_percentage' | 'published_app_usage' | 'published_app_percentage' | 'serverless_apps_usage' | 'serverless_apps_percentage' | 'serverless_apps_apm_usage' | 'serverless_apps_apm_percentage' | 'snmp_usage' | 'snmp_percentage' | 'universal_service_monitoring_usage' | 'universal_service_monitoring_percentage' | 'vuln_management_hosts_usage' | 'vuln_management_hosts_percentage' | 'sds_scanned_bytes_usage' | 'sds_scanned_bytes_percentage' | 'ci_test_indexed_spans_usage' | 'ci_test_indexed_spans_percentage' | 'ingested_logs_bytes_usage' | 'ingested_logs_bytes_percentage' | 'ci_pipeline_indexed_spans_usage' | 'ci_pipeline_indexed_spans_percentage' | 'indexed_spans_usage' | 'indexed_spans_percentage' | 'custom_event_usage' | 'custom_event_percentage' | 'logs_indexed_custom_retention_usage' | 'logs_indexed_custom_retention_percentage' | 'logs_indexed_360day_usage' | 'logs_indexed_360day_percentage' | 'logs_indexed_180day_usage' | 'logs_indexed_180day_percentage' | 'logs_indexed_90day_usage' | 'logs_indexed_90day_percentage' | 'logs_indexed_60day_usage' | 'logs_indexed_60day_percentage' | 'logs_indexed_45day_usage' | 'logs_indexed_45day_percentage' | 'logs_indexed_30day_usage' | 'logs_indexed_30day_percentage' | 'logs_indexed_15day_usage' | 'logs_indexed_15day_percentage' | 'logs_indexed_7day_usage' | 'logs_indexed_7day_percentage' | 'logs_indexed_3day_usage' | 'logs_indexed_3day_percentage' | 'logs_indexed_1day_usage' | 'logs_indexed_1day_percentage' | 'rum_ingested_usage' | 'rum_ingested_percentage' | 'rum_investigate_usage' | 'rum_investigate_percentage' | 'rum_replay_sessions_usage' | 'rum_replay_sessions_percentage' | 'rum_session_replay_add_on_usage' | 'rum_session_replay_add_on_percentage' | 'rum_browser_mobile_sessions_usage' | 'rum_browser_mobile_sessions_percentage' | 'ingested_spans_bytes_usage' | 'ingested_spans_bytes_percentage' | 'siem_12mo_retention_usage' | 'siem_12mo_retention_percentage' | 'siem_6mo_retention_usage' | 'siem_6mo_retention_percentage' | 'siem_analyzed_logs_add_on_usage' | 'siem_analyzed_logs_add_on_percentage' | 'siem_ingested_bytes_usage' | 'siem_ingested_bytes_percentage' | 'workflow_executions_usage' | 'workflow_executions_percentage' | 'sca_fargate_usage' | 'sca_fargate_percentage' | '*' required

Supported metrics for monthly usage attribution requests. Usage types are in the format <usage_type>_usage. To obtain the complete list of valid usage types, make a request to the Get usage attribution types API.

Comma-separated list of usage types to return, or * for all usage types. Usage types are in the format <usage_type>_usage and <usage_type>_percentage. Example: infra_host_usage,infra_host_percentage To obtain the complete list of usage attribution types that can be used to replace <usage_type> in the field names, make a request to the Get usage attribution types API.

sort_direction'desc' | 'asc'

The direction to sort by.

The direction to sort by: [desc, asc].

sort_name'api_usage' | 'api_percentage' | 'apm_fargate_usage' | 'apm_fargate_percentage' | 'appsec_fargate_usage' | 'appsec_fargate_percentage' | 'apm_host_usage' | 'apm_host_percentage' | 'apm_usm_usage' | 'apm_usm_percentage' | 'appsec_usage' | 'appsec_percentage' | 'asm_serverless_traced_invocations_usage' | 'asm_serverless_traced_invocations_percentage' | 'bits_ai_investigations_usage' | 'bits_ai_investigations_percentage' | 'browser_usage' | 'browser_percentage' | 'ci_visibility_itr_usage' | 'ci_visibility_itr_percentage' | 'cloud_siem_usage' | 'cloud_siem_percentage' | 'code_security_host_usage' | 'code_security_host_percentage' | 'container_excl_agent_usage' | 'container_excl_agent_percentage' | 'container_usage' | 'container_percentage' | 'cspm_containers_percentage' | 'cspm_containers_usage' | 'cspm_hosts_percentage' | 'cspm_hosts_usage' | 'custom_timeseries_usage' | 'custom_timeseries_percentage' | 'custom_ingested_timeseries_usage' | 'custom_ingested_timeseries_percentage' | 'cws_containers_percentage' | 'cws_containers_usage' | 'cws_fargate_task_percentage' | 'cws_fargate_task_usage' | 'cws_hosts_percentage' | 'cws_hosts_usage' | 'data_jobs_monitoring_usage' | 'data_jobs_monitoring_percentage' | 'data_stream_monitoring_usage' | 'data_stream_monitoring_percentage' | 'dbm_hosts_percentage' | 'dbm_hosts_usage' | 'dbm_queries_percentage' | 'dbm_queries_usage' | 'error_tracking_usage' | 'error_tracking_percentage' | 'estimated_indexed_spans_usage' | 'estimated_indexed_spans_percentage' | 'estimated_ingested_spans_usage' | 'estimated_ingested_spans_percentage' | 'fargate_usage' | 'fargate_percentage' | 'flex_logs_starter_usage' | 'flex_logs_starter_percentage' | 'flex_stored_logs_usage' | 'flex_stored_logs_percentage' | 'functions_usage' | 'functions_percentage' | 'incident_management_monthly_active_users_usage' | 'incident_management_monthly_active_users_percentage' | 'infra_host_usage' | 'infra_host_percentage' | 'infra_host_basic_usage' | 'infra_host_basic_percentage' | 'invocations_usage' | 'invocations_percentage' | 'lambda_traced_invocations_usage' | 'lambda_traced_invocations_percentage' | 'llm_observability_usage' | 'llm_observability_percentage' | 'llm_spans_usage' | 'llm_spans_percentage' | 'mobile_app_testing_percentage' | 'mobile_app_testing_usage' | 'ndm_netflow_usage' | 'ndm_netflow_percentage' | 'network_device_wireless_usage' | 'network_device_wireless_percentage' | 'npm_host_usage' | 'npm_host_percentage' | 'obs_pipeline_bytes_usage' | 'obs_pipeline_bytes_percentage' | 'obs_pipelines_vcpu_usage' | 'obs_pipelines_vcpu_percentage' | 'online_archive_usage' | 'online_archive_percentage' | 'product_analytics_session_usage' | 'product_analytics_session_percentage' | 'profiled_container_usage' | 'profiled_container_percentage' | 'profiled_fargate_usage' | 'profiled_fargate_percentage' | 'profiled_host_usage' | 'profiled_host_percentage' | 'published_app_usage' | 'published_app_percentage' | 'serverless_apps_usage' | 'serverless_apps_percentage' | 'serverless_apps_apm_usage' | 'serverless_apps_apm_percentage' | 'snmp_usage' | 'snmp_percentage' | 'universal_service_monitoring_usage' | 'universal_service_monitoring_percentage' | 'vuln_management_hosts_usage' | 'vuln_management_hosts_percentage' | 'sds_scanned_bytes_usage' | 'sds_scanned_bytes_percentage' | 'ci_test_indexed_spans_usage' | 'ci_test_indexed_spans_percentage' | 'ingested_logs_bytes_usage' | 'ingested_logs_bytes_percentage' | 'ci_pipeline_indexed_spans_usage' | 'ci_pipeline_indexed_spans_percentage' | 'indexed_spans_usage' | 'indexed_spans_percentage' | 'custom_event_usage' | 'custom_event_percentage' | 'logs_indexed_custom_retention_usage' | 'logs_indexed_custom_retention_percentage' | 'logs_indexed_360day_usage' | 'logs_indexed_360day_percentage' | 'logs_indexed_180day_usage' | 'logs_indexed_180day_percentage' | 'logs_indexed_90day_usage' | 'logs_indexed_90day_percentage' | 'logs_indexed_60day_usage' | 'logs_indexed_60day_percentage' | 'logs_indexed_45day_usage' | 'logs_indexed_45day_percentage' | 'logs_indexed_30day_usage' | 'logs_indexed_30day_percentage' | 'logs_indexed_15day_usage' | 'logs_indexed_15day_percentage' | 'logs_indexed_7day_usage' | 'logs_indexed_7day_percentage' | 'logs_indexed_3day_usage' | 'logs_indexed_3day_percentage' | 'logs_indexed_1day_usage' | 'logs_indexed_1day_percentage' | 'rum_ingested_usage' | 'rum_ingested_percentage' | 'rum_investigate_usage' | 'rum_investigate_percentage' | 'rum_replay_sessions_usage' | 'rum_replay_sessions_percentage' | 'rum_session_replay_add_on_usage' | 'rum_session_replay_add_on_percentage' | 'rum_browser_mobile_sessions_usage' | 'rum_browser_mobile_sessions_percentage' | 'ingested_spans_bytes_usage' | 'ingested_spans_bytes_percentage' | 'siem_12mo_retention_usage' | 'siem_12mo_retention_percentage' | 'siem_6mo_retention_usage' | 'siem_6mo_retention_percentage' | 'siem_analyzed_logs_add_on_usage' | 'siem_analyzed_logs_add_on_percentage' | 'siem_ingested_bytes_usage' | 'siem_ingested_bytes_percentage' | 'workflow_executions_usage' | 'workflow_executions_percentage' | 'sca_fargate_usage' | 'sca_fargate_percentage' | '*'

Supported metrics for monthly usage attribution requests. Usage types are in the format <usage_type>_usage. To obtain the complete list of valid usage types, make a request to the Get usage attribution types API.

The field to sort by. Sort fields are in the format <usage_type>_usage. Example: infra_host_usage To obtain the complete list of usage attribution types that can be used to replace <usage_type> in the field names, make a request to the Get usage attribution types API.

tag_breakdown_keysstring

Comma separated list of tag keys used to group usage. If no value is provided the usage will not be broken down by tags.

To see which tags are available, look for the value of tag_config_source in the API response.

next_record_idstring

List following results with a next_record_id provided in the previous query.

include_descendantsboolean

Include child org usage in the response. Defaults to true.

Response

OK