The month view's usage read: one month of the router traffic ledger in every grouping (credential, agent, model, upstream and — fleet scope — tenant), the month's seal, and, for the current month, the last 24 h by the hour. It is the one usage read the UI makes; the older GET /library/router-traffic/{tenant} and GET /entities/usage_traffic stay as aliases for one release (same ledger, same numbers).

Scope and auth are the credential registry's (_scope): fleet scope sums every tenant's slice and adds by_tenant; tenant scope reads ONLY its own slice (the SQL tenant=? bind) and never sees a fleet credential name — foreign sessions read platform (owner decision 8). The reply keeps the router-traffic top-level shape (totals, by_agent/upstream/model, recent, window, measures) so the routes join renders unchanged. Always 200 on an authorised call; an unreadable ledger is available: false with a reason, never a page of zeros.