Monthly usage

Metered usage for the month (default: current). meters breaks the period down per canonical meter — recall, memorize, ingest, storage, egress — each row carrying used/included/overage against the workspace's plan inclusions, plus the informational chunks_ingested row. egress (tokens returned) has no plan allowance yet, so its included/overage are 0; render those columns as — rather than as a zero-sized inclusion. Also carries point-in-time gauges: namespace count and key counts by env.

Quota pools at the billing account. Each row's used is THIS workspace's own quantity; the number quota is enforced against is the account total in meters[].account.used, summed over the workspaces listed in the top-level account.workspaces. A bar drawn from used against included shows a multi-workspace customer a healthy figure and is then contradicted by a refusal — draw account.used against account.included. overage is likewise account-scoped. The four capped meters carry an account block; egress and chunks_ingested do not, because nothing caps them. When the pooled read is unavailable the top-level account says so (status: "unavailable") and no row carries a pooled figure — the per-workspace number is never substituted for it.

Per-workspace breakdown. Each account block MAY carry by_workspace: the pooled used segmented by contributing workspace, sorted descending and summing exactly to account.used. It is computed upstream and forwarded unchanged — do not re-sum or re-sort it. It is OPTIONAL and its absence carries no information: it is omitted both when the upstream reports no breakdown and when THE CALLER MAY NOT SEE EVERY WORKSPACE THE ACCOUNT OWNS. Per-workspace figures are a disclosure the pooled total is not — a credential scoped to some of an account's workspaces can learn the size of the pool it is measured against, but not which siblings make it up — so the field appears only when the caller's workspace visibility is a superset of account.workspaces (a session-lane owner, or a credential scoped to *). The two omissions are indistinguishable on purpose; treat a missing by_workspace as "no segmentation available" and render the pooled bar unsegmented.

Class B read-only — all three lanes, via the IDOR-safe Kairos preflight. The namespaces gauge degrades to 0 rather than failing the response when the underlying memories scan cannot be computed, so a usage read does not 502 just because Kairos is down.

Requires the usage:read scope. Accepts all three lanes: a session JWT (bounded by the caller's role on this workspace) or an il_* machine credential whose own scope set, workspace set and validity window cover it — both ceilings apply and neither can raise the other, so a credential carrying usage:read is still refused where the role does not permit it.

A credential with no scope record resolves to LEGACY_DEFAULT, which INCLUDES usage:read — every key minted before scoping keeps working here.