Ctrlk
BlogSupport
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Cloud Consumption Dashboard

Retrieve workload consumption data per asset type, over time, and in a paginated details grid.

Cloud Consumption dashboard data — one endpoint per dashboard widget.

Cloud Runtime Security license entitlement

get

Returns the purchased vs. consumed workload entitlements for the Cloud Runtime Security license. Corresponds to the licenseCloudRuntimeSecurity widget on the dashboard. Dashboard-level filters do not apply to license-card widgets — entitlements are always reported tenant-wide.

Authorizations
AuthorizationstringRequired

JWT token for API authentication

Responses
200

License entitlement returned successfully

application/json

Public-API envelope for the license entitlement endpoints. The reply object matches the internal LicenseEntitlementData shape rendered by the dashboard license cards.

get/platform/cloud-consumption/v1/license-runtime/
GET /platform/cloud-consumption/v1/license-runtime/ HTTP/1.1
Host: api-{{fqdn}}
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "reply": {
    "license_name": "Cloud Runtime Security",
    "purchased_workloads": 500,
    "consumed_workloads": 424,
    "utilization_percent": 84.8,
    "is_over_quota": false,
    "measurement_period_days": 90,
    "items": [
      {
        "value": 30,
        "prettyName": "Scanned CaaS Instances",
        "tooltip": [
          {
            "title": "10 Containers = 1 Workload",
            "items": [
              {
                "label": "Total assets",
                "value": 300
              },
              {
                "label": "Billable workloads",
                "value": 30
              }
            ]
          }
        ]
      }
    ]
  }
}

Cloud Posture Management license entitlement

get

Returns the purchased vs. consumed workload entitlements for the Cloud Posture Management license. Corresponds to the licenseCloudPostureManagement widget on the dashboard. Dashboard-level filters do not apply — entitlements are always tenant-wide.

Authorizations
AuthorizationstringRequired

JWT token for API authentication

Responses
200

License entitlement returned successfully

application/json

Public-API envelope for the license entitlement endpoints. The reply object matches the internal LicenseEntitlementData shape rendered by the dashboard license cards.

get/platform/cloud-consumption/v1/license-posture/
GET /platform/cloud-consumption/v1/license-posture/ HTTP/1.1
Host: api-{{fqdn}}
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "reply": {
    "license_name": "Cloud Posture Management",
    "purchased_workloads": 5000,
    "consumed_workloads": 4250,
    "utilization_percent": 85,
    "is_over_quota": false,
    "measurement_period_days": 90,
    "items": [
      {
        "value": 1200,
        "prettyName": "Scanned VMs",
        "tooltip": [
          {
            "title": "1 VM = 1 Workload",
            "items": [
              {
                "label": "Total assets",
                "value": 1200
              },
              {
                "label": "Billable workloads",
                "value": 1200
              }
            ]
          }
        ]
      }
    ]
  }
}

Consumption per asset type

post

Returns workload consumption for the selected time window, aggregated by asset type (e.g. HOST, SERVERLESS-FUNCTION, CLOUD_BUCKET) and returned as one data series per cloud provider. This powers the consumptionPerAssetType horizontal stacked-bar widget on the Cloud Consumption dashboard.

The request body uses the shared DashboardFilters schema: a required time window plus optional cloud_providers, cloud_account_ids, and asset_group_ids filters.

Authorizations
AuthorizationstringRequired

JWT token for API authentication

Body

Time window plus optional dashboard-level filters, shared by the per-asset-type, over-time, and details endpoints (the latter two extend this schema with their own fields).

The requested window (from_time → to_time) must satisfy two rules: (1) to_time must be strictly greater than from_time, and (2) the total span may not exceed one year (to_time - from_time <= 365 days). Requests that violate either rule are rejected with HTTP 400. Only the most recent 12 months of consumption data are retained, so older windows return no data.

Timezone: All epoch values are interpreted in the UTC timezone. Clients must compute epoch seconds relative to UTC; from_time and to_time are each rounded down to UTC midnight (00:00:00 UTC) of their respective day.

from_timeinteger · int64Required

Start of the reporting window, in epoch seconds (UTC), inclusive. Interpreted as UTC midnight of that day; any sub-day precision is rounded down to the start of the day in UTC.

Example: 1742169600
to_timeinteger · int64 · min: 1Required

End of the reporting window, in epoch seconds (UTC), inclusive. Must be strictly greater than from_time, and the span to_time - from_time must be less than or equal to one year (365 days). Interpreted as UTC midnight.

Example: 1747526400
cloud_account_idsstring[]Optional

Optional. Restrict the response to these cloud-account IDs. When omitted or null, all cloud accounts are included.

Example: ["173478","jack-001"]
asset_group_idsstring[]Optional

Optional. Restrict the response to assets belonging to these realm-only asset groups, identified by their asset-group IDs (as returned by the internal filter-options endpoint). When omitted or null, no asset-group filter is applied.

Example: ["ag-prod"]
Responses
200

Per-asset-type bar chart data

application/json

Public-API envelope for per-asset-type. The reply object is the BarChartData shape rendered by the horizontal stacked-bar widget on the Cloud Consumption dashboard.

post/platform/cloud-consumption/v1/per-asset-type/
POST /platform/cloud-consumption/v1/per-asset-type/ HTTP/1.1
Host: api-{{fqdn}}
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 149

{
  "from_time": 1742169600,
  "to_time": 1747526400,
  "cloud_providers": [
    "AWS",
    "GCP"
  ],
  "cloud_account_ids": [
    "173478",
    "jack-001"
  ],
  "asset_group_ids": [
    "ag-prod"
  ]
}
{
  "reply": [
    {
      "name": "AWS",
      "data": [
        [
          "Scanned VM",
          450
        ],
        [
          "Scanned CaaS instances",
          3200
        ],
        [
          "Agent protected endpoint",
          5
        ],
        [
          "Storage buckets",
          50
        ]
      ]
    },
    {
      "name": "Azure",
      "data": [
        [
          "Scanned VM",
          230
        ],
        [
          "Scanned CaaS instances",
          1800
        ],
        [
          "Agent protected endpoint",
          3
        ],
        [
          "Storage buckets",
          30
        ]
      ]
    },
    {
      "name": "GCP",
      "data": [
        [
          "Scanned VM",
          120
        ],
        [
          "Scanned CaaS instances",
          500
        ],
        [
          "Agent protected endpoint",
          0
        ],
        [
          "Storage buckets",
          0
        ]
      ]
    }
  ]
}

Consumption over time (line chart)

post

Returns a daily consumption time series for the selected time window, powering the consumptionOverTime line-chart widget on the Cloud Consumption dashboard.

By default the response contains three series: used (actual daily consumption), average (90-day rolling average), and purchased (the purchased entitlement baseline). When by_cloud_provider is true, the single used series is replaced by one used series per cloud provider (e.g. AWS, GCP, AZURE), while the average and purchased series are unchanged.

The request body extends the shared DashboardFilters schema (required time window plus optional cloud_providers, cloud_account_ids, and asset_group_ids filters) with the by_cloud_provider flag.

Authorizations
AuthorizationstringRequired

JWT token for API authentication

Body
and
Responses
200

Over-time line chart data

application/json

Public-API envelope for over-time. The reply object matches the internal LineChartData shape rendered by the line-chart widget.

post/platform/cloud-consumption/v1/over-time/
POST /platform/cloud-consumption/v1/over-time/ HTTP/1.1
Host: api-{{fqdn}}
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 71

{
  "from_time": 1742169600,
  "to_time": 1747526400,
  "by_cloud_provider": false
}
{
  "reply": {
    "series": [
      {
        "name": "used",
        "prettyName": "Used",
        "data": [
          [
            1742169600000,
            4200
          ],
          [
            1744848000000,
            4800
          ]
        ]
      },
      {
        "name": "average",
        "prettyName": "Average",
        "data": [
          [
            1742169600000,
            4350
          ],
          [
            1744848000000,
            4710
          ]
        ]
      },
      {
        "name": "purchased",
        "prettyName": "Purchased",
        "data": [
          [
            1742169600000,
            5500
          ],
          [
            1744848000000,
            5500
          ]
        ]
      }
    ]
  }
}

Consumption details grid

post

Returns detailed per-cloud-account consumption rows — one row per (cloud account, snapshot day) combination, with the workload count for every asset type. This powers the consumptionDetails grid widget on the Cloud Consumption dashboard.

The request body extends the shared DashboardFilters schema (required time window plus optional cloud_providers, cloud_account_ids, and asset_group_ids filters) with pagination (offset / limit, where limit is at most 500) and an optional single-column sort specification. The response includes total row counts so clients can build paginators.

Authorizations
AuthorizationstringRequired

JWT token for API authentication

Body
and
Responses
200

Paginated details rows

application/json

Public-API envelope for details. The reply object matches the internal ConsumptionDetailsResponse shape: paginated rows + count totals.

post/platform/cloud-consumption/v1/details/
POST /platform/cloud-consumption/v1/details/ HTTP/1.1
Host: api-{{fqdn}}
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 201

{
  "from_time": 1742169600,
  "to_time": 1747526400,
  "cloud_providers": [
    "AWS"
  ],
  "cloud_account_ids": [
    "173478"
  ],
  "asset_group_ids": [],
  "offset": 0,
  "limit": 100,
  "sort": {
    "field": "TOTAL_WORKLOAD_COUNT",
    "order": "DESC"
  }
}
{
  "reply": {
    "total_count": 1234,
    "filter_count": 1,
    "data": [
      {
        "CLOUD_PROVIDER": "AWS",
        "CLOUD_ACCOUNT_NAME": "AWS Cloud Account 173478 xx2",
        "HOST": 12,
        "SERVERLESS-FUNCTION": 45,
        "CLOUD_BUCKET": 8,
        "MANAGED-CLOUD-DATABASE": 3,
        "DBAAS_TB_STORED": 2,
        "SAAS_USERS": 0,
        "ON-PREMISE-DATA-ASSET": 5,
        "ASM": 10,
        "AGENT_HOST": 8,
        "AGENT-CAAS": 3,
        "CONTAINER-IMAGE": 15,
        "TOTAL_WORKLOAD_COUNT": 111
      }
    ]
  }
}
PreviousCloud Consumption Dashboard API overview
NextLicensing

Last updated

Was this helpful?