For AI agents: A markdown version of this page is available at https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/api/latest/usage-metering/get-monthly-usage-attribution.md. A documentation index is available at /llms.txt.
homeHomedocsDocsapiAPI
Language
Datadog site

Get monthly usage attribution

GEThttps://api.datadoghq.com/api/v1/usage/monthly-attributionhttps://api.us3.datadoghq.com/api/v1/usage/monthly-attributionhttps://api.us5.datadoghq.com/api/v1/usage/monthly-attributionhttps://api.datadoghq.eu/api/v1/usage/monthly-attributionhttps://api.ap1.datadoghq.com/api/v1/usage/monthly-attributionhttps://api.ap2.datadoghq.com/api/v1/usage/monthly-attributionhttps://api.uk1.datadoghq.com/api/v1/usage/monthly-attributionhttps://api.ddog-gov.com/api/v1/usage/monthly-attributionhttps://api.us2.ddog-gov.com/api/v1/usage/monthly-attribution

Overview

Get monthly usage attribution. Multi-region data is available starting March 1, 2023.

Note: All estimated_* usage types will be deprecated on February 1, 2027.

This API endpoint is paginated. To make sure you receive all records, check if the value of next_record_id is set in the response. If it is, make another request and pass next_record_id as a parameter. Pseudo code example:

response := GetMonthlyUsageAttribution(start_month)
cursor := response.metadata.pagination.next_record_id
WHILE cursor != null BEGIN
  sleep(5 seconds)  # Avoid running into rate limit
  response := GetMonthlyUsageAttribution(start_month, next_record_id=cursor)
  cursor := response.metadata.pagination.next_record_id
END

This endpoint requires the usage_read permission.

OAuth apps require the usage_read authorization scope to access this endpoint.

Arguments

Query Strings

Name
Type
Description
start_month [required]
string

Datetime in ISO-8601 format, UTC, precise to month: [YYYY-MM] for usage beginning in this month. Maximum of 15 months ago.

end_month
string

Datetime in ISO-8601 format, UTC, precise to month: [YYYY-MM] for usage ending this month.

fields [required]
enum

Comma-separated list of usage types to return, or * for all usage types. Usage types are in the format <usage_type>_usage and <usage_type>_percentage. Example: infra_host_usage,infra_host_percentage To obtain the complete list of usage attribution types that can be used to replace <usage_type> in the field names, make a request to the Get usage attribution types API.

Allowed enum values: api_usage, api_percentage, apm_fargate_usage, apm_fargate_percentage, appsec_fargate_usage, appsec_fargate_percentage, apm_host_usage, apm_host_percentage, apm_usm_usage, apm_usm_percentage
Show 161 moreappsec_usage, appsec_percentage, asm_serverless_traced_invocations_usage, asm_serverless_traced_invocations_percentage, bits_ai_investigations_usage, bits_ai_investigations_percentage, browser_usage, browser_percentage, ci_visibility_itr_usage, ci_visibility_itr_percentage, cloud_siem_usage, cloud_siem_percentage, code_security_host_usage, code_security_host_percentage, container_excl_agent_usage, container_excl_agent_percentage, container_usage, container_percentage, cspm_containers_percentage, cspm_containers_usage, cspm_hosts_percentage, cspm_hosts_usage, custom_timeseries_usage, custom_timeseries_percentage, custom_ingested_timeseries_usage, custom_ingested_timeseries_percentage, cws_containers_percentage, cws_containers_usage, cws_fargate_task_percentage, cws_fargate_task_usage, cws_hosts_percentage, cws_hosts_usage, data_jobs_monitoring_usage, data_jobs_monitoring_percentage, data_stream_monitoring_usage, data_stream_monitoring_percentage, dbm_hosts_percentage, dbm_hosts_usage, dbm_queries_percentage, dbm_queries_usage, error_tracking_usage, error_tracking_percentage, estimated_indexed_spans_usage, estimated_indexed_spans_percentage, estimated_ingested_spans_usage, estimated_ingested_spans_percentage, fargate_usage, fargate_percentage, flex_logs_starter_usage, flex_logs_starter_percentage, flex_stored_logs_usage, flex_stored_logs_percentage, functions_usage, functions_percentage, incident_management_monthly_active_users_usage, incident_management_monthly_active_users_percentage, infra_host_usage, infra_host_percentage, infra_host_basic_usage, infra_host_basic_percentage, invocations_usage, invocations_percentage, lambda_traced_invocations_usage, lambda_traced_invocations_percentage, llm_observability_usage, llm_observability_percentage, llm_spans_usage, llm_spans_percentage, mobile_app_testing_percentage, mobile_app_testing_usage, ndm_netflow_usage, ndm_netflow_percentage, network_device_wireless_usage, network_device_wireless_percentage, npm_host_usage, npm_host_percentage, obs_pipeline_bytes_usage, obs_pipeline_bytes_percentage, obs_pipelines_vcpu_usage, obs_pipelines_vcpu_percentage, online_archive_usage, online_archive_percentage, product_analytics_session_usage, product_analytics_session_percentage, profiled_container_usage, profiled_container_percentage, profiled_fargate_usage, profiled_fargate_percentage, profiled_host_usage, profiled_host_percentage, published_app_usage, published_app_percentage, serverless_apps_usage, serverless_apps_percentage, serverless_apps_apm_usage, serverless_apps_apm_percentage, snmp_usage, snmp_percentage, universal_service_monitoring_usage, universal_service_monitoring_percentage, vuln_management_hosts_usage, vuln_management_hosts_percentage, sds_scanned_bytes_usage, sds_scanned_bytes_percentage, ci_test_indexed_spans_usage, ci_test_indexed_spans_percentage, ingested_logs_bytes_usage, ingested_logs_bytes_percentage, ci_pipeline_indexed_spans_usage, ci_pipeline_indexed_spans_percentage, indexed_spans_usage, indexed_spans_percentage, custom_event_usage, custom_event_percentage, logs_indexed_custom_retention_usage, logs_indexed_custom_retention_percentage, logs_indexed_360day_usage, logs_indexed_360day_percentage, logs_indexed_180day_usage, logs_indexed_180day_percentage, logs_indexed_90day_usage, logs_indexed_90day_percentage, logs_indexed_60day_usage, logs_indexed_60day_percentage, logs_indexed_45day_usage, logs_indexed_45day_percentage, logs_indexed_30day_usage, logs_indexed_30day_percentage, logs_indexed_15day_usage, logs_indexed_15day_percentage, logs_indexed_7day_usage, logs_indexed_7day_percentage, logs_indexed_3day_usage, logs_indexed_3day_percentage, logs_indexed_1day_usage, logs_indexed_1day_percentage, rum_ingested_usage, rum_ingested_percentage, rum_investigate_usage, rum_investigate_percentage, rum_replay_sessions_usage, rum_replay_sessions_percentage, rum_session_replay_add_on_usage, rum_session_replay_add_on_percentage, rum_browser_mobile_sessions_usage, rum_browser_mobile_sessions_percentage, ingested_spans_bytes_usage, ingested_spans_bytes_percentage, siem_12mo_retention_usage, siem_12mo_retention_percentage, siem_6mo_retention_usage, siem_6mo_retention_percentage, siem_analyzed_logs_add_on_usage, siem_analyzed_logs_add_on_percentage, siem_ingested_bytes_usage, siem_ingested_bytes_percentage, workflow_executions_usage, workflow_executions_percentage, sca_fargate_usage, sca_fargate_percentage, *
sort_direction
enum

The direction to sort by: [desc, asc].

Default: desc
Allowed enum values: desc, asc
sort_name
enum

The field to sort by. Sort fields are in the format <usage_type>_usage. Example: infra_host_usage To obtain the complete list of usage attribution types that can be used to replace <usage_type> in the field names, make a request to the Get usage attribution types API.

Allowed enum values: api_usage, api_percentage, apm_fargate_usage, apm_fargate_percentage, appsec_fargate_usage, appsec_fargate_percentage, apm_host_usage, apm_host_percentage, apm_usm_usage, apm_usm_percentage
Show 161 moreappsec_usage, appsec_percentage, asm_serverless_traced_invocations_usage, asm_serverless_traced_invocations_percentage, bits_ai_investigations_usage, bits_ai_investigations_percentage, browser_usage, browser_percentage, ci_visibility_itr_usage, ci_visibility_itr_percentage, cloud_siem_usage, cloud_siem_percentage, code_security_host_usage, code_security_host_percentage, container_excl_agent_usage, container_excl_agent_percentage, container_usage, container_percentage, cspm_containers_percentage, cspm_containers_usage, cspm_hosts_percentage, cspm_hosts_usage, custom_timeseries_usage, custom_timeseries_percentage, custom_ingested_timeseries_usage, custom_ingested_timeseries_percentage, cws_containers_percentage, cws_containers_usage, cws_fargate_task_percentage, cws_fargate_task_usage, cws_hosts_percentage, cws_hosts_usage, data_jobs_monitoring_usage, data_jobs_monitoring_percentage, data_stream_monitoring_usage, data_stream_monitoring_percentage, dbm_hosts_percentage, dbm_hosts_usage, dbm_queries_percentage, dbm_queries_usage, error_tracking_usage, error_tracking_percentage, estimated_indexed_spans_usage, estimated_indexed_spans_percentage, estimated_ingested_spans_usage, estimated_ingested_spans_percentage, fargate_usage, fargate_percentage, flex_logs_starter_usage, flex_logs_starter_percentage, flex_stored_logs_usage, flex_stored_logs_percentage, functions_usage, functions_percentage, incident_management_monthly_active_users_usage, incident_management_monthly_active_users_percentage, infra_host_usage, infra_host_percentage, infra_host_basic_usage, infra_host_basic_percentage, invocations_usage, invocations_percentage, lambda_traced_invocations_usage, lambda_traced_invocations_percentage, llm_observability_usage, llm_observability_percentage, llm_spans_usage, llm_spans_percentage, mobile_app_testing_percentage, mobile_app_testing_usage, ndm_netflow_usage, ndm_netflow_percentage, network_device_wireless_usage, network_device_wireless_percentage, npm_host_usage, npm_host_percentage, obs_pipeline_bytes_usage, obs_pipeline_bytes_percentage, obs_pipelines_vcpu_usage, obs_pipelines_vcpu_percentage, online_archive_usage, online_archive_percentage, product_analytics_session_usage, product_analytics_session_percentage, profiled_container_usage, profiled_container_percentage, profiled_fargate_usage, profiled_fargate_percentage, profiled_host_usage, profiled_host_percentage, published_app_usage, published_app_percentage, serverless_apps_usage, serverless_apps_percentage, serverless_apps_apm_usage, serverless_apps_apm_percentage, snmp_usage, snmp_percentage, universal_service_monitoring_usage, universal_service_monitoring_percentage, vuln_management_hosts_usage, vuln_management_hosts_percentage, sds_scanned_bytes_usage, sds_scanned_bytes_percentage, ci_test_indexed_spans_usage, ci_test_indexed_spans_percentage, ingested_logs_bytes_usage, ingested_logs_bytes_percentage, ci_pipeline_indexed_spans_usage, ci_pipeline_indexed_spans_percentage, indexed_spans_usage, indexed_spans_percentage, custom_event_usage, custom_event_percentage, logs_indexed_custom_retention_usage, logs_indexed_custom_retention_percentage, logs_indexed_360day_usage, logs_indexed_360day_percentage, logs_indexed_180day_usage, logs_indexed_180day_percentage, logs_indexed_90day_usage, logs_indexed_90day_percentage, logs_indexed_60day_usage, logs_indexed_60day_percentage, logs_indexed_45day_usage, logs_indexed_45day_percentage, logs_indexed_30day_usage, logs_indexed_30day_percentage, logs_indexed_15day_usage, logs_indexed_15day_percentage, logs_indexed_7day_usage, logs_indexed_7day_percentage, logs_indexed_3day_usage, logs_indexed_3day_percentage, logs_indexed_1day_usage, logs_indexed_1day_percentage, rum_ingested_usage, rum_ingested_percentage, rum_investigate_usage, rum_investigate_percentage, rum_replay_sessions_usage, rum_replay_sessions_percentage, rum_session_replay_add_on_usage, rum_session_replay_add_on_percentage, rum_browser_mobile_sessions_usage, rum_browser_mobile_sessions_percentage, ingested_spans_bytes_usage, ingested_spans_bytes_percentage, siem_12mo_retention_usage, siem_12mo_retention_percentage, siem_6mo_retention_usage, siem_6mo_retention_percentage, siem_analyzed_logs_add_on_usage, siem_analyzed_logs_add_on_percentage, siem_ingested_bytes_usage, siem_ingested_bytes_percentage, workflow_executions_usage, workflow_executions_percentage, sca_fargate_usage, sca_fargate_percentage, *
tag_breakdown_keys
string

Comma separated list of tag keys used to group usage. If no value is provided the usage will not be broken down by tags.

To see which tags are available, look for the value of tag_config_source in the API response.

next_record_id
string

List following results with a next_record_id provided in the previous query.

include_descendants
boolean

Include child org usage in the response. Defaults to true.

Default: true

Response

OK

Response containing the monthly Usage Summary by tag(s).

Field
Type
Description
metadata
object

The object containing document metadata.

usage
[object]

Get usage summary by tag(s).

Code Example

# Required query arguments
export start_month="CHANGE_ME"
export fields="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v1/usage/monthly-attribution?start_month=${start_month}&fields=${fields}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Required query arguments
export start_month="CHANGE_ME"
export fields="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v1/usage/monthly-attribution?start_month=${start_month}&fields=${fields}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Required query arguments
export start_month="CHANGE_ME"
export fields="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v1/usage/monthly-attribution?start_month=${start_month}&fields=${fields}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Required query arguments
export start_month="CHANGE_ME"
export fields="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v1/usage/monthly-attribution?start_month=${start_month}&fields=${fields}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Required query arguments
export start_month="CHANGE_ME"
export fields="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v1/usage/monthly-attribution?start_month=${start_month}&fields=${fields}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Required query arguments
export start_month="CHANGE_ME"
export fields="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v1/usage/monthly-attribution?start_month=${start_month}&fields=${fields}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Required query arguments
export start_month="CHANGE_ME"
export fields="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v1/usage/monthly-attribution?start_month=${start_month}&fields=${fields}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Required query arguments
export start_month="CHANGE_ME"
export fields="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v1/usage/monthly-attribution?start_month=${start_month}&fields=${fields}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Required query arguments
export start_month="CHANGE_ME"
export fields="CHANGE_ME"

# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v1/usage/monthly-attribution?start_month=${start_month}&fields=${fields}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"