> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cloud-consumption-dashboard/cloud-consumption-dashboard.md).

# Cloud Consumption Dashboard

Retrieve workload consumption data per asset type, over time, and in a paginated details grid.

Cloud Consumption dashboard data — one endpoint per dashboard widget.

## Cloud Runtime Security license entitlement

> Returns the purchased vs. consumed workload entitlements for the \*\*Cloud Runtime Security\*\* license. Corresponds to the \`licenseCloudRuntimeSecurity\` widget on the dashboard. Dashboard-level filters do \*\*not\*\* apply to license-card widgets — entitlements are always reported tenant-wide.

```json
{"openapi":"3.0.3","info":{"title":"Cortex Platform Cloud Consumption Dashboard REST APIs","version":"1.0.0"},"tags":[{"name":"Consumption","description":"Cloud Consumption dashboard data — one endpoint per dashboard widget."}],"servers":[{"url":"https://api-{{fqdn}}","description":"Production API server"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"JWT token for API authentication"}},"schemas":{"LicenseEntitlementResponse":{"type":"object","description":"Public-API envelope for the license entitlement endpoints. The `reply` object matches the internal `LicenseEntitlementData` shape rendered by the dashboard license cards.","required":["reply"],"additionalProperties":false,"properties":{"reply":{"type":"object","required":["license_name","purchased_workloads","consumed_workloads","utilization_percent","is_over_quota","measurement_period_days","items"],"properties":{"license_name":{"type":"string","description":"Human-readable license name."},"purchased_workloads":{"type":"number","format":"double","description":"Total workloads purchased (from LicensingService)."},"consumed_workloads":{"type":"number","format":"double","description":"Total billable workload units consumed (90-day rolling average)."},"utilization_percent":{"type":"number","format":"double","description":"`(consumed / purchased) * 100`. May exceed 100."},"is_over_quota":{"type":"boolean","description":"True if consumed exceeds purchased."},"measurement_period_days":{"type":"integer","description":"Rolling average window in days (always 90)."},"items":{"type":"array","items":{"$ref":"#/components/schemas/LicenseEntitlementItem"},"description":"Per-category breakdown items."}}}}},"LicenseEntitlementItem":{"type":"object","required":["value","prettyName","tooltip"],"properties":{"value":{"type":"number","format":"double","description":"Billable workload units for this category."},"prettyName":{"type":"string","description":"Display name for the category."},"tooltip":{"type":"array","items":{"$ref":"#/components/schemas/LicenseTooltip"}}}},"LicenseTooltip":{"type":"object","required":["title","items"],"properties":{"title":{"type":"string","description":"Conversion formula (e.g. `10 Containers = 1 Workload`)."},"items":{"type":"array","items":{"$ref":"#/components/schemas/LicenseTooltipItem"}}}},"LicenseTooltipItem":{"type":"object","required":["label","value"],"properties":{"label":{"type":"string"},"value":{"type":"number","format":"double"}}},"BadRequestError":{"type":"object","description":"Bad-request error envelope, matching the 4xx (400) error body used by `/platform/iam/v1/` (e.g. `RoleCreatedBadRequest`). The `data` object carries `err_msg` plus a nested `metadata` object with `err_extra` and `err_code`.","required":["data"],"additionalProperties":false,"properties":{"data":{"type":"object","required":["err_msg","metadata"],"properties":{"err_msg":{"type":"string","description":"Error message describing the issue."},"metadata":{"type":"object","required":["err_extra","err_code"],"properties":{"err_extra":{"type":"string","description":"Additional error details."},"err_code":{"type":"integer","description":"HTTP error code."}}}}}}},"ErrorResponse":{"type":"object","description":"Cortex public-API error envelope used for `401`/`403`/`404` responses, matching the `reply`-based body used by `/platform/iam/v1/` (e.g. `Unauthorized`, `UnauthorizedImproperPermissions`).","required":["reply"],"additionalProperties":false,"properties":{"reply":{"type":"object","required":["err_msg","err_code"],"properties":{"err_msg":{"type":"string","description":"Error message describing what went wrong."},"err_extra":{"type":"string","nullable":true,"description":"Additional error details if available."},"err_code":{"type":"integer","description":"HTTP status code."}}}}}},"responses":{"BadRequest":{"description":"Bad Request — the request body fails validation (missing required fields, wrong type, value out of range, unknown cloud provider, etc).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BadRequestError"}}}},"Unauthorized":{"description":"Unauthorized — invalid or missing authentication credentials.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"Forbidden":{"description":"Forbidden — the API key lacks `Cloud Consumption Command Center: View` permission, or the tenant does not have a Cloud license.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"NotFound":{"description":"Not Found — the Cloud Consumption dashboard is disabled for this tenant or the endpoint does not exist.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"TooManyRequests":{"description":"Too Many Requests — rate limit exceeded.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"InternalError":{"description":"Internal Server Error — an unexpected error occurred on the server.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}},"paths":{"/platform/cloud-consumption/v1/license-runtime/":{"get":{"tags":["Consumption"],"summary":"Cloud Runtime Security license entitlement","description":"Returns the purchased vs. consumed workload entitlements for the **Cloud Runtime Security** license. Corresponds to the `licenseCloudRuntimeSecurity` widget on the dashboard. Dashboard-level filters do **not** apply to license-card widgets — entitlements are always reported tenant-wide.","operationId":"getLicenseRuntimeEntitlement","responses":{"200":{"description":"License entitlement returned successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/LicenseEntitlementResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalError"}}}}}}
```

## Cloud Posture Management license entitlement

> Returns the purchased vs. consumed workload entitlements for the \*\*Cloud Posture Management\*\* license. Corresponds to the \`licenseCloudPostureManagement\` widget on the dashboard. Dashboard-level filters do \*\*not\*\* apply — entitlements are always tenant-wide.

```json
{"openapi":"3.0.3","info":{"title":"Cortex Platform Cloud Consumption Dashboard REST APIs","version":"1.0.0"},"tags":[{"name":"Consumption","description":"Cloud Consumption dashboard data — one endpoint per dashboard widget."}],"servers":[{"url":"https://api-{{fqdn}}","description":"Production API server"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"JWT token for API authentication"}},"schemas":{"LicenseEntitlementResponse":{"type":"object","description":"Public-API envelope for the license entitlement endpoints. The `reply` object matches the internal `LicenseEntitlementData` shape rendered by the dashboard license cards.","required":["reply"],"additionalProperties":false,"properties":{"reply":{"type":"object","required":["license_name","purchased_workloads","consumed_workloads","utilization_percent","is_over_quota","measurement_period_days","items"],"properties":{"license_name":{"type":"string","description":"Human-readable license name."},"purchased_workloads":{"type":"number","format":"double","description":"Total workloads purchased (from LicensingService)."},"consumed_workloads":{"type":"number","format":"double","description":"Total billable workload units consumed (90-day rolling average)."},"utilization_percent":{"type":"number","format":"double","description":"`(consumed / purchased) * 100`. May exceed 100."},"is_over_quota":{"type":"boolean","description":"True if consumed exceeds purchased."},"measurement_period_days":{"type":"integer","description":"Rolling average window in days (always 90)."},"items":{"type":"array","items":{"$ref":"#/components/schemas/LicenseEntitlementItem"},"description":"Per-category breakdown items."}}}}},"LicenseEntitlementItem":{"type":"object","required":["value","prettyName","tooltip"],"properties":{"value":{"type":"number","format":"double","description":"Billable workload units for this category."},"prettyName":{"type":"string","description":"Display name for the category."},"tooltip":{"type":"array","items":{"$ref":"#/components/schemas/LicenseTooltip"}}}},"LicenseTooltip":{"type":"object","required":["title","items"],"properties":{"title":{"type":"string","description":"Conversion formula (e.g. `10 Containers = 1 Workload`)."},"items":{"type":"array","items":{"$ref":"#/components/schemas/LicenseTooltipItem"}}}},"LicenseTooltipItem":{"type":"object","required":["label","value"],"properties":{"label":{"type":"string"},"value":{"type":"number","format":"double"}}},"BadRequestError":{"type":"object","description":"Bad-request error envelope, matching the 4xx (400) error body used by `/platform/iam/v1/` (e.g. `RoleCreatedBadRequest`). The `data` object carries `err_msg` plus a nested `metadata` object with `err_extra` and `err_code`.","required":["data"],"additionalProperties":false,"properties":{"data":{"type":"object","required":["err_msg","metadata"],"properties":{"err_msg":{"type":"string","description":"Error message describing the issue."},"metadata":{"type":"object","required":["err_extra","err_code"],"properties":{"err_extra":{"type":"string","description":"Additional error details."},"err_code":{"type":"integer","description":"HTTP error code."}}}}}}},"ErrorResponse":{"type":"object","description":"Cortex public-API error envelope used for `401`/`403`/`404` responses, matching the `reply`-based body used by `/platform/iam/v1/` (e.g. `Unauthorized`, `UnauthorizedImproperPermissions`).","required":["reply"],"additionalProperties":false,"properties":{"reply":{"type":"object","required":["err_msg","err_code"],"properties":{"err_msg":{"type":"string","description":"Error message describing what went wrong."},"err_extra":{"type":"string","nullable":true,"description":"Additional error details if available."},"err_code":{"type":"integer","description":"HTTP status code."}}}}}},"responses":{"BadRequest":{"description":"Bad Request — the request body fails validation (missing required fields, wrong type, value out of range, unknown cloud provider, etc).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BadRequestError"}}}},"Unauthorized":{"description":"Unauthorized — invalid or missing authentication credentials.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"Forbidden":{"description":"Forbidden — the API key lacks `Cloud Consumption Command Center: View` permission, or the tenant does not have a Cloud license.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"NotFound":{"description":"Not Found — the Cloud Consumption dashboard is disabled for this tenant or the endpoint does not exist.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"TooManyRequests":{"description":"Too Many Requests — rate limit exceeded.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"InternalError":{"description":"Internal Server Error — an unexpected error occurred on the server.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}},"paths":{"/platform/cloud-consumption/v1/license-posture/":{"get":{"tags":["Consumption"],"summary":"Cloud Posture Management license entitlement","description":"Returns the purchased vs. consumed workload entitlements for the **Cloud Posture Management** license. Corresponds to the `licenseCloudPostureManagement` widget on the dashboard. Dashboard-level filters do **not** apply — entitlements are always tenant-wide.","operationId":"getLicensePostureEntitlement","responses":{"200":{"description":"License entitlement returned successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/LicenseEntitlementResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalError"}}}}}}
```

## Consumption per asset type

> Returns workload consumption for the selected time window, aggregated by asset type (e.g. \`HOST\`, \`SERVERLESS-FUNCTION\`, \`CLOUD\_BUCKET\`) and returned as one data series per cloud provider. This powers the \`consumptionPerAssetType\` horizontal stacked-bar widget on the Cloud Consumption dashboard.\
> \
> The request body uses the shared \`DashboardFilters\` schema: a required time window plus optional \`cloud\_providers\`, \`cloud\_account\_ids\`, and \`asset\_group\_ids\` filters.

```json
{"openapi":"3.0.3","info":{"title":"Cortex Platform Cloud Consumption Dashboard REST APIs","version":"1.0.0"},"tags":[{"name":"Consumption","description":"Cloud Consumption dashboard data — one endpoint per dashboard widget."}],"servers":[{"url":"https://api-{{fqdn}}","description":"Production API server"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"JWT token for API authentication"}},"schemas":{"DashboardFilters":{"type":"object","description":"Time window plus optional dashboard-level filters, shared by the `per-asset-type`, `over-time`, and `details` endpoints (the latter two extend this schema with their own fields).\n\nThe requested window (`from_time` → `to_time`) must satisfy two rules: (1) `to_time` must be strictly greater than `from_time`, and (2) the total span may not exceed **one year** (`to_time - from_time <= 365 days`). Requests that violate either rule are rejected with HTTP 400. Only the most recent 12 months of consumption data are retained, so older windows return no data.\n\n**Timezone:** All epoch values are interpreted in the **UTC** timezone. Clients must compute epoch seconds relative to UTC; `from_time` and `to_time` are each rounded down to UTC midnight (00:00:00 UTC) of their respective day.","required":["from_time","to_time"],"additionalProperties":false,"properties":{"from_time":{"type":"integer","format":"int64","minimum":0,"description":"Start of the reporting window, in **epoch seconds (UTC)**, inclusive. Interpreted as UTC midnight of that day; any sub-day precision is rounded down to the start of the day in UTC."},"to_time":{"type":"integer","format":"int64","minimum":1,"description":"End of the reporting window, in **epoch seconds (UTC)**, inclusive. Must be strictly greater than `from_time`, and the span `to_time - from_time` must be less than or equal to one year (365 days). Interpreted as UTC midnight."},"cloud_providers":{"type":"array","items":{"$ref":"#/components/schemas/CloudProvider"},"description":"Optional. Restrict the response to these cloud providers. When omitted or `null`, all providers are included."},"cloud_account_ids":{"type":"array","items":{"type":"string"},"description":"Optional. Restrict the response to these cloud-account IDs. When omitted or `null`, all cloud accounts are included."},"asset_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional. Restrict the response to assets belonging to these realm-only asset groups, identified by their asset-group IDs (as returned by the internal filter-options endpoint). When omitted or `null`, no asset-group filter is applied."}}},"CloudProvider":{"type":"string","description":"Cloud provider identifier — must match the value stored in `cloud_account_provider` on the consumption snapshot tables.","enum":["AWS","AZURE","GCP","OCI","IBM","ALIBABA","ON_PREM","OTHER"]},"PerAssetTypeResponse":{"type":"object","description":"Public-API envelope for `per-asset-type`. The `reply` object is the `BarChartData` shape rendered by the horizontal stacked-bar widget on the Cloud Consumption dashboard.","required":["reply"],"additionalProperties":false,"properties":{"reply":{"$ref":"#/components/schemas/BarChartData"}}},"BarChartData":{"type":"array","description":"Data for the \"Consumption per asset type\" horizontal stacked bar chart.\nA flat array of series — one entry per cloud provider. Each series'\n`data` array contains `[category, value]` tuples where `category` is\nthe asset-type label (x-axis) and `value` is the workload count for\nthat provider in that category.\n","items":{"$ref":"#/components/schemas/BarChartSeries"}},"BarChartSeries":{"type":"object","description":"A single series (cloud provider) in the bar chart. The `data` array\ncontains `[category, value]` tuples — `category` is the asset-type\nlabel and `value` is the workload count for this provider in that\ncategory. Categories may differ across series (providers with no\nworkloads in a category may omit that entry).\n","required":["name","data"],"properties":{"name":{"type":"string","description":"Cloud-provider display name."},"data":{"type":"array","description":"Ordered `[category, value]` tuples. `category` is the asset-type\nlabel (x-axis); `value` is the workload count for this provider.\n","items":{"type":"array","minItems":2,"maxItems":2,"description":"[categoryLabel, workloadCount]"}}}},"BadRequestError":{"type":"object","description":"Bad-request error envelope, matching the 4xx (400) error body used by `/platform/iam/v1/` (e.g. `RoleCreatedBadRequest`). The `data` object carries `err_msg` plus a nested `metadata` object with `err_extra` and `err_code`.","required":["data"],"additionalProperties":false,"properties":{"data":{"type":"object","required":["err_msg","metadata"],"properties":{"err_msg":{"type":"string","description":"Error message describing the issue."},"metadata":{"type":"object","required":["err_extra","err_code"],"properties":{"err_extra":{"type":"string","description":"Additional error details."},"err_code":{"type":"integer","description":"HTTP error code."}}}}}}},"ErrorResponse":{"type":"object","description":"Cortex public-API error envelope used for `401`/`403`/`404` responses, matching the `reply`-based body used by `/platform/iam/v1/` (e.g. `Unauthorized`, `UnauthorizedImproperPermissions`).","required":["reply"],"additionalProperties":false,"properties":{"reply":{"type":"object","required":["err_msg","err_code"],"properties":{"err_msg":{"type":"string","description":"Error message describing what went wrong."},"err_extra":{"type":"string","nullable":true,"description":"Additional error details if available."},"err_code":{"type":"integer","description":"HTTP status code."}}}}}},"responses":{"BadRequest":{"description":"Bad Request — the request body fails validation (missing required fields, wrong type, value out of range, unknown cloud provider, etc).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BadRequestError"}}}},"Unauthorized":{"description":"Unauthorized — invalid or missing authentication credentials.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"Forbidden":{"description":"Forbidden — the API key lacks `Cloud Consumption Command Center: View` permission, or the tenant does not have a Cloud license.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"NotFound":{"description":"Not Found — the Cloud Consumption dashboard is disabled for this tenant or the endpoint does not exist.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"TooManyRequests":{"description":"Too Many Requests — rate limit exceeded.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"InternalError":{"description":"Internal Server Error — an unexpected error occurred on the server.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}},"paths":{"/platform/cloud-consumption/v1/per-asset-type/":{"post":{"tags":["Consumption"],"summary":"Consumption per asset type","description":"Returns workload consumption for the selected time window, aggregated by asset type (e.g. `HOST`, `SERVERLESS-FUNCTION`, `CLOUD_BUCKET`) and returned as one data series per cloud provider. This powers the `consumptionPerAssetType` horizontal stacked-bar widget on the Cloud Consumption dashboard.\n\nThe request body uses the shared `DashboardFilters` schema: a required time window plus optional `cloud_providers`, `cloud_account_ids`, and `asset_group_ids` filters.","operationId":"getConsumptionPerAssetType","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DashboardFilters"}}}},"responses":{"200":{"description":"Per-asset-type bar chart data","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PerAssetTypeResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalError"}}}}}}
```

## Consumption over time (line chart)

> Returns a daily consumption time series for the selected time window, powering the \`consumptionOverTime\` line-chart widget on the Cloud Consumption dashboard.\
> \
> By default the response contains three series: \`used\` (actual daily consumption), \`average\` (90-day rolling average), and \`purchased\` (the purchased entitlement baseline). When \`by\_cloud\_provider\` is \`true\`, the single \`used\` series is replaced by one \`used\` series per cloud provider (e.g. \`AWS\`, \`GCP\`, \`AZURE\`), while the \`average\` and \`purchased\` series are unchanged.\
> \
> The request body extends the shared \`DashboardFilters\` schema (required time window plus optional \`cloud\_providers\`, \`cloud\_account\_ids\`, and \`asset\_group\_ids\` filters) with the \`by\_cloud\_provider\` flag.

```json
{"openapi":"3.0.3","info":{"title":"Cortex Platform Cloud Consumption Dashboard REST APIs","version":"1.0.0"},"tags":[{"name":"Consumption","description":"Cloud Consumption dashboard data — one endpoint per dashboard widget."}],"servers":[{"url":"https://api-{{fqdn}}","description":"Production API server"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"JWT token for API authentication"}},"schemas":{"OverTimeRequest":{"allOf":[{"$ref":"#/components/schemas/DashboardFilters"},{"type":"object","additionalProperties":false,"properties":{"by_cloud_provider":{"type":"boolean","default":false,"description":"When `true`, the `used` series is replaced by one series per cloud provider; the `average` and `purchased` series remain unchanged."}}}]},"DashboardFilters":{"type":"object","description":"Time window plus optional dashboard-level filters, shared by the `per-asset-type`, `over-time`, and `details` endpoints (the latter two extend this schema with their own fields).\n\nThe requested window (`from_time` → `to_time`) must satisfy two rules: (1) `to_time` must be strictly greater than `from_time`, and (2) the total span may not exceed **one year** (`to_time - from_time <= 365 days`). Requests that violate either rule are rejected with HTTP 400. Only the most recent 12 months of consumption data are retained, so older windows return no data.\n\n**Timezone:** All epoch values are interpreted in the **UTC** timezone. Clients must compute epoch seconds relative to UTC; `from_time` and `to_time` are each rounded down to UTC midnight (00:00:00 UTC) of their respective day.","required":["from_time","to_time"],"additionalProperties":false,"properties":{"from_time":{"type":"integer","format":"int64","minimum":0,"description":"Start of the reporting window, in **epoch seconds (UTC)**, inclusive. Interpreted as UTC midnight of that day; any sub-day precision is rounded down to the start of the day in UTC."},"to_time":{"type":"integer","format":"int64","minimum":1,"description":"End of the reporting window, in **epoch seconds (UTC)**, inclusive. Must be strictly greater than `from_time`, and the span `to_time - from_time` must be less than or equal to one year (365 days). Interpreted as UTC midnight."},"cloud_providers":{"type":"array","items":{"$ref":"#/components/schemas/CloudProvider"},"description":"Optional. Restrict the response to these cloud providers. When omitted or `null`, all providers are included."},"cloud_account_ids":{"type":"array","items":{"type":"string"},"description":"Optional. Restrict the response to these cloud-account IDs. When omitted or `null`, all cloud accounts are included."},"asset_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional. Restrict the response to assets belonging to these realm-only asset groups, identified by their asset-group IDs (as returned by the internal filter-options endpoint). When omitted or `null`, no asset-group filter is applied."}}},"CloudProvider":{"type":"string","description":"Cloud provider identifier — must match the value stored in `cloud_account_provider` on the consumption snapshot tables.","enum":["AWS","AZURE","GCP","OCI","IBM","ALIBABA","ON_PREM","OTHER"]},"OverTimeResponse":{"type":"object","description":"Public-API envelope for `over-time`. The `reply` object matches the internal `LineChartData` shape rendered by the line-chart widget.","required":["reply"],"additionalProperties":false,"properties":{"reply":{"type":"object","required":["series"],"properties":{"series":{"type":"array","items":{"$ref":"#/components/schemas/LineChartSeries"},"description":"Array of line series. When `by_cloud_provider` is false the array contains exactly `used`, `average`, `purchased`. When true the `used` entry is replaced by one entry per cloud provider."}}}}},"LineChartSeries":{"type":"object","required":["name","prettyName","data"],"properties":{"name":{"type":"string","description":"Series identifier (`used`, `average`, `purchased`, or a cloud-provider name when `by_cloud_provider=true`)."},"prettyName":{"type":"string","description":"Display name for the legend."},"data":{"type":"array","description":"Ordered time-series points. Each point is `[epochMilliseconds, value]`.","items":{"type":"array","minItems":2,"maxItems":2,"items":{"type":"number"}}}}},"BadRequestError":{"type":"object","description":"Bad-request error envelope, matching the 4xx (400) error body used by `/platform/iam/v1/` (e.g. `RoleCreatedBadRequest`). The `data` object carries `err_msg` plus a nested `metadata` object with `err_extra` and `err_code`.","required":["data"],"additionalProperties":false,"properties":{"data":{"type":"object","required":["err_msg","metadata"],"properties":{"err_msg":{"type":"string","description":"Error message describing the issue."},"metadata":{"type":"object","required":["err_extra","err_code"],"properties":{"err_extra":{"type":"string","description":"Additional error details."},"err_code":{"type":"integer","description":"HTTP error code."}}}}}}},"ErrorResponse":{"type":"object","description":"Cortex public-API error envelope used for `401`/`403`/`404` responses, matching the `reply`-based body used by `/platform/iam/v1/` (e.g. `Unauthorized`, `UnauthorizedImproperPermissions`).","required":["reply"],"additionalProperties":false,"properties":{"reply":{"type":"object","required":["err_msg","err_code"],"properties":{"err_msg":{"type":"string","description":"Error message describing what went wrong."},"err_extra":{"type":"string","nullable":true,"description":"Additional error details if available."},"err_code":{"type":"integer","description":"HTTP status code."}}}}}},"responses":{"BadRequest":{"description":"Bad Request — the request body fails validation (missing required fields, wrong type, value out of range, unknown cloud provider, etc).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BadRequestError"}}}},"Unauthorized":{"description":"Unauthorized — invalid or missing authentication credentials.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"Forbidden":{"description":"Forbidden — the API key lacks `Cloud Consumption Command Center: View` permission, or the tenant does not have a Cloud license.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"NotFound":{"description":"Not Found — the Cloud Consumption dashboard is disabled for this tenant or the endpoint does not exist.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"TooManyRequests":{"description":"Too Many Requests — rate limit exceeded.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"InternalError":{"description":"Internal Server Error — an unexpected error occurred on the server.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}},"paths":{"/platform/cloud-consumption/v1/over-time/":{"post":{"tags":["Consumption"],"summary":"Consumption over time (line chart)","description":"Returns a daily consumption time series for the selected time window, powering the `consumptionOverTime` line-chart widget on the Cloud Consumption dashboard.\n\nBy default the response contains three series: `used` (actual daily consumption), `average` (90-day rolling average), and `purchased` (the purchased entitlement baseline). When `by_cloud_provider` is `true`, the single `used` series is replaced by one `used` series per cloud provider (e.g. `AWS`, `GCP`, `AZURE`), while the `average` and `purchased` series are unchanged.\n\nThe request body extends the shared `DashboardFilters` schema (required time window plus optional `cloud_providers`, `cloud_account_ids`, and `asset_group_ids` filters) with the `by_cloud_provider` flag.","operationId":"getConsumptionOverTime","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OverTimeRequest"}}}},"responses":{"200":{"description":"Over-time line chart data","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OverTimeResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalError"}}}}}}
```

## Consumption details grid

> Returns detailed per-cloud-account consumption rows — one row per (cloud account, snapshot day) combination, with the workload count for every asset type. This powers the \`consumptionDetails\` grid widget on the Cloud Consumption dashboard.\
> \
> The request body extends the shared \`DashboardFilters\` schema (required time window plus optional \`cloud\_providers\`, \`cloud\_account\_ids\`, and \`asset\_group\_ids\` filters) with pagination (\`offset\` / \`limit\`, where \`limit\` is at most 500) and an optional single-column \`sort\` specification. The response includes total row counts so clients can build paginators.

```json
{"openapi":"3.0.3","info":{"title":"Cortex Platform Cloud Consumption Dashboard REST APIs","version":"1.0.0"},"tags":[{"name":"Consumption","description":"Cloud Consumption dashboard data — one endpoint per dashboard widget."}],"servers":[{"url":"https://api-{{fqdn}}","description":"Production API server"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"JWT token for API authentication"}},"schemas":{"DetailsRequest":{"allOf":[{"$ref":"#/components/schemas/DashboardFilters"},{"type":"object","additionalProperties":false,"properties":{"offset":{"type":"integer","minimum":0,"default":0,"description":"Optional. Zero-based index of the first row to return, used for pagination. Defaults to `0` (the first row)."},"limit":{"type":"integer","minimum":1,"maximum":500,"default":100,"description":"Optional. Maximum number of rows to return in a single page. Must be between 1 and 500 inclusive. Defaults to `100`."},"sort":{"$ref":"#/components/schemas/SortRequest"}}}]},"DashboardFilters":{"type":"object","description":"Time window plus optional dashboard-level filters, shared by the `per-asset-type`, `over-time`, and `details` endpoints (the latter two extend this schema with their own fields).\n\nThe requested window (`from_time` → `to_time`) must satisfy two rules: (1) `to_time` must be strictly greater than `from_time`, and (2) the total span may not exceed **one year** (`to_time - from_time <= 365 days`). Requests that violate either rule are rejected with HTTP 400. Only the most recent 12 months of consumption data are retained, so older windows return no data.\n\n**Timezone:** All epoch values are interpreted in the **UTC** timezone. Clients must compute epoch seconds relative to UTC; `from_time` and `to_time` are each rounded down to UTC midnight (00:00:00 UTC) of their respective day.","required":["from_time","to_time"],"additionalProperties":false,"properties":{"from_time":{"type":"integer","format":"int64","minimum":0,"description":"Start of the reporting window, in **epoch seconds (UTC)**, inclusive. Interpreted as UTC midnight of that day; any sub-day precision is rounded down to the start of the day in UTC."},"to_time":{"type":"integer","format":"int64","minimum":1,"description":"End of the reporting window, in **epoch seconds (UTC)**, inclusive. Must be strictly greater than `from_time`, and the span `to_time - from_time` must be less than or equal to one year (365 days). Interpreted as UTC midnight."},"cloud_providers":{"type":"array","items":{"$ref":"#/components/schemas/CloudProvider"},"description":"Optional. Restrict the response to these cloud providers. When omitted or `null`, all providers are included."},"cloud_account_ids":{"type":"array","items":{"type":"string"},"description":"Optional. Restrict the response to these cloud-account IDs. When omitted or `null`, all cloud accounts are included."},"asset_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional. Restrict the response to assets belonging to these realm-only asset groups, identified by their asset-group IDs (as returned by the internal filter-options endpoint). When omitted or `null`, no asset-group filter is applied."}}},"CloudProvider":{"type":"string","description":"Cloud provider identifier — must match the value stored in `cloud_account_provider` on the consumption snapshot tables.","enum":["AWS","AZURE","GCP","OCI","IBM","ALIBABA","ON_PREM","OTHER"]},"SortRequest":{"type":"object","description":"Optional single-column sort specification for the details endpoint. The entire `sort` object is optional; when omitted, the server applies its default ordering. When provided, `field` is also optional — if `field` is omitted, only `order` is considered against the default sort column.","additionalProperties":false,"properties":{"field":{"type":"string","minLength":1,"description":"Optional. Name of the column to sort on. Must match one of the column names in `ConsumptionDetailsRow` (e.g. `TOTAL_WORKLOAD_COUNT`). When omitted, the server's default sort column is used."},"order":{"type":"string","enum":["ASC","DESC"],"default":"ASC","description":"Optional. Sort direction (case-sensitive): `ASC` for ascending or `DESC` for descending. Defaults to `ASC`."}}},"DetailsResponse":{"type":"object","description":"Public-API envelope for `details`. The `reply` object matches the internal `ConsumptionDetailsResponse` shape: paginated rows + count totals.","required":["reply"],"additionalProperties":false,"properties":{"reply":{"type":"object","required":["data","total_count","filter_count"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/ConsumptionDetailsRow"}},"total_count":{"type":"integer","minimum":0,"description":"Total rows matching the time window, **before** dashboard-level filters and pagination."},"filter_count":{"type":"integer","minimum":0,"description":"Total rows matching the time window **and** dashboard-level filters (i.e. the count the client paginates over)."}}}}},"ConsumptionDetailsRow":{"type":"object","description":"A single row in the consumption-details grid. Column names are UPPER_CASE per be3 convention; hyphenated names match the internal table schema.","required":["CLOUD_PROVIDER","CLOUD_ACCOUNT_NAME","HOST","SERVERLESS-FUNCTION","CLOUD_BUCKET","MANAGED-CLOUD-DATABASE","DBAAS_TB_STORED","SAAS_USERS","ON-PREMISE-DATA-ASSET","ASM","AGENT_HOST","AGENT-CAAS","CONTAINER-IMAGE","TOTAL_WORKLOAD_COUNT"],"properties":{"CLOUD_PROVIDER":{"$ref":"#/components/schemas/CloudProvider"},"CLOUD_ACCOUNT_NAME":{"type":"string"},"HOST":{"type":"number","format":"double","description":"Host count (scanned VMs without containers)."},"SERVERLESS-FUNCTION":{"type":"number","format":"double"},"CLOUD_BUCKET":{"type":"number","format":"double"},"MANAGED-CLOUD-DATABASE":{"type":"number","format":"double"},"DBAAS_TB_STORED":{"type":"number","format":"double","description":"DBaaS terabytes stored."},"SAAS_USERS":{"type":"number","format":"double"},"ON-PREMISE-DATA-ASSET":{"type":"number","format":"double"},"ASM":{"type":"number","format":"double","description":"Attack Surface Management asset count."},"AGENT_HOST":{"type":"number","format":"double"},"AGENT-CAAS":{"type":"number","format":"double"},"CONTAINER-IMAGE":{"type":"number","format":"double"},"TOTAL_WORKLOAD_COUNT":{"type":"number","format":"double","description":"Total billable workload units for this cloud account."}}},"BadRequestError":{"type":"object","description":"Bad-request error envelope, matching the 4xx (400) error body used by `/platform/iam/v1/` (e.g. `RoleCreatedBadRequest`). The `data` object carries `err_msg` plus a nested `metadata` object with `err_extra` and `err_code`.","required":["data"],"additionalProperties":false,"properties":{"data":{"type":"object","required":["err_msg","metadata"],"properties":{"err_msg":{"type":"string","description":"Error message describing the issue."},"metadata":{"type":"object","required":["err_extra","err_code"],"properties":{"err_extra":{"type":"string","description":"Additional error details."},"err_code":{"type":"integer","description":"HTTP error code."}}}}}}},"ErrorResponse":{"type":"object","description":"Cortex public-API error envelope used for `401`/`403`/`404` responses, matching the `reply`-based body used by `/platform/iam/v1/` (e.g. `Unauthorized`, `UnauthorizedImproperPermissions`).","required":["reply"],"additionalProperties":false,"properties":{"reply":{"type":"object","required":["err_msg","err_code"],"properties":{"err_msg":{"type":"string","description":"Error message describing what went wrong."},"err_extra":{"type":"string","nullable":true,"description":"Additional error details if available."},"err_code":{"type":"integer","description":"HTTP status code."}}}}}},"responses":{"BadRequest":{"description":"Bad Request — the request body fails validation (missing required fields, wrong type, value out of range, unknown cloud provider, etc).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BadRequestError"}}}},"Unauthorized":{"description":"Unauthorized — invalid or missing authentication credentials.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"Forbidden":{"description":"Forbidden — the API key lacks `Cloud Consumption Command Center: View` permission, or the tenant does not have a Cloud license.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"NotFound":{"description":"Not Found — the Cloud Consumption dashboard is disabled for this tenant or the endpoint does not exist.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"TooManyRequests":{"description":"Too Many Requests — rate limit exceeded.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"InternalError":{"description":"Internal Server Error — an unexpected error occurred on the server.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}},"paths":{"/platform/cloud-consumption/v1/details/":{"post":{"tags":["Consumption"],"summary":"Consumption details grid","description":"Returns detailed per-cloud-account consumption rows — one row per (cloud account, snapshot day) combination, with the workload count for every asset type. This powers the `consumptionDetails` grid widget on the Cloud Consumption dashboard.\n\nThe request body extends the shared `DashboardFilters` schema (required time window plus optional `cloud_providers`, `cloud_account_ids`, and `asset_group_ids` filters) with pagination (`offset` / `limit`, where `limit` is at most 500) and an optional single-column `sort` specification. The response includes total row counts so clients can build paginators.","operationId":"getConsumptionDetails","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DetailsRequest"}}}},"responses":{"200":{"description":"Paginated details rows","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DetailsResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalError"}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cloud-consumption-dashboard/cloud-consumption-dashboard.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.