> For the complete documentation index, see [llms.txt](https://handbook.harmonic.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://handbook.harmonic.security/handbook/6.-observability-audit-and-evidence/6.4-analytics-and-usage-apis.md). # 6.4 Analytics and usage APIs Adoption, cost, and usage telemetry help spot shifts in AI behavior, tool adoption, connector usage, and spend anomalies. *Last reviewed: August 18, 2026* {% hint style="info" %} Usage telemetry shows how AI adoption is changing. It also points to risk shifts, such as new tools, new models, or sudden API growth. {% endhint %} ## Analytics and usage APIs: what security teams need to know Analytics and usage APIs help teams understand adoption, cost, model use, and workflow shifts. They can also reveal security signals when usage moves from approved chat to API keys, coding agents, or cloud runs. Usage data is not enough for investigations, but it is useful for review cadence and risk prioritization. ## Common analytics and usage APIs security failures * Cost spikes are treated only as finance issues. * Usage shifts to a new surface without security review. * Model or tool adoption changes after a vendor release. * API usage grows under a personal or unknown project owner. * Analytics dashboards are not exported or reviewed. ## Analytics and usage APIs security controls checklist * Track usage by product surface, project, model, user group, and environment. * Review cost and volume anomalies with security context. * Compare approved users against active usage. * Watch for shifts from chat to API, browser, desktop, or coding agents. * Use usage data to prioritize control reviews. ## Anthropic ### Overview Anthropic documents two dedicated Claude Code analytics dashboards. Team and Enterprise plans get a dashboard at claude.ai/analytics/claude-code with usage metrics, GitHub-integrated contribution metrics, and CSV export, viewable by Admins and Owners; contribution metrics are unavailable under Zero Data Retention. Claude Console (API) customers get a separate dashboard at platform.claude.com/claude-code showing usage, spend estimates, and per-user team insights, gated by the UsageView permission — a useful way to give reviewers analytics access without broader Console rights. Beyond the Claude Code dashboards, Claude Enterprise analytics provides product-specific views across Claude chat, Claude Code, and Cowork, and the Analytics API can break down usage and cost by product, model, context window, or region. Compare custom-role grants against observed activity, and watch for shifts to local MCP, Office agents, scheduled Managed Agent runs, and Claude Tag. Claude Tag adds organization and per-channel spend limits, threshold alerts, and a per-channel spend breakdown. Channel work bills to the organization, while direct messages bill to the individual's Claude account. Keep that split in usage reviews so a quiet organization channel does not hide personal DM usage, and vice versa. ### Anthropic documentation * [Track team usage with analytics (Claude Code)](https://code.claude.com/docs/en/analytics) * [Claude Code monitoring](https://code.claude.com/docs/en/monitoring-usage) * [Claude Managed Agents overview](https://platform.claude.com/docs/en/managed-agents/overview) * [Manage custom roles on Enterprise plans](https://support.claude.com/en/articles/13930452-manage-custom-roles-on-enterprise-plans) * [Monitor Claude Cowork activity with OpenTelemetry](https://support.claude.com/en/articles/14477985-monitor-claude-cowork-activity-with-opentelemetry) * [Configure OpenTelemetry for Claude's Office agents](https://support.claude.com/en/articles/14447276-configure-a-custom-opentelemetry-collector-for-office-agents) * [Claude Enterprise consumption guide](https://support.claude.com/en/articles/14782391-claude-enterprise-consumption-guide) * [What is Claude Tag?](https://support.claude.com/en/articles/15594475-what-is-claude-tag) ## OpenAI ### Overview Codex Enterprise exposes analytics dashboards and an Analytics API alongside its Compliance API. In ChatGPT Enterprise, the Analytics Viewer role grants analytics access without broader administration rights. OpenAI's Global Admin analytics now spans adoption and credit use across Chat, Work, and Codex, so those surfaces should be broken out rather than blended into a single ChatGPT count. On the API Platform, key usage can be monitored on the usage page, and separate projects can isolate staging from production with different rate and spend limits. Group adoption metrics by surface and execution location. Work on web and mobile runs in the cloud; Work and Codex in the new desktop app can use local files and applications; Codex also remains available through CLI, IDE, web, and cloud clients. Each path has different controls and evidence. ### OpenAI documentation * [Codex governance](https://developers.openai.com/codex/enterprise/governance) * [Managing members, seat types, roles and access in ChatGPT Enterprise](https://help.openai.com/en/articles/8266401-managing-members-seat-types-roles-and-access-in-chatgpt-enterprise) * [Production best practices](https://developers.openai.com/api/docs/guides/production-best-practices) * [ChatGPT desktop app and Codex clients](https://learn.chatgpt.com/docs/features) * [Work Admin FAQ](https://learn.chatgpt.com/docs/enterprise/work-admin-faq) ### Applicable Harmonic guides for OpenAI * [Securing ChatGPT Enterprise Guide](https://www.harmonic.security/resources/securing-chatgpt-enterprise-guide) * [Securing Codex Best Practice](https://www.harmonic.security/resources/securing-codex-best-practice) ## Frequently asked questions about analytics and usage APIs ### What do AI usage APIs show? They show adoption, volume, cost, model use, project activity, and surface shifts, with depth varying by provider and plan. OpenAI offers cross-surface analytics for Chat, Work, and Codex, Codex Enterprise adds an Analytics API, and Claude Code has Team/Enterprise and Console dashboards with CSV export. None is an investigation-grade audit log. ### Are usage APIs audit logs? No. They measure activity but usually lack the prompt, tool-call, and approval detail investigations need — that lives in compliance APIs, OpenTelemetry, and endpoint evidence. Use analytics to decide where to look, then switch to audit sources to answer what happened. ### What usage anomalies matter? Watch for cost spikes, new projects, unusual model use, unexpected API growth, and usage outside approved groups. A shift in surface matters most: a team whose usage moves from workspace chat to API keys or unattended runs has changed its evidence path, not just its bill. ### Can usage APIs detect shadow AI? They can surface strong leads. API usage growing under an unknown or personal project owner, spend appearing outside managed organizations, and active users who are not in the approved group are all shadow-AI signals visible in usage data. Confirming and attributing the activity still requires identity, network, or endpoint evidence, so treat analytics as the tripwire rather than the proof. ### Who should review usage data? Platform, security, finance, and business owners should review it together, because the same spike can be a budget problem, a rollout success, or an exfiltration signal. Give reviewers scoped access — ChatGPT Enterprise has an Analytics Viewer role and the Claude Console dashboard is gated by the UsageView permission — so reporting does not require admin rights. ## Applicable regulations and frameworks | Governance page | Relationship to this article | | ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------ | | G.1 Map your controls to NIST AI RMF and CSF 2.0 | This article supplies implementation evidence for the NIST AI RMF and matching NIST CSF 2.0 outcomes. | | G.5 SANS Critical AI Security Guidelines mapping | This article implements relevant SANS Monitoring and GRC guidance. | | G.8 ISO/IEC 42001 AI management system | This article supports ISO/IEC 42001 AIMS preparation through objectives, measures, and performance evidence. | ## Related handbook guidance * [6. Observability, Audit & Evidence](/handbook/6.-observability-audit-and-evidence.md) * [6.1 The audit gap: what you can and can't see](/handbook/6.-observability-audit-and-evidence/6.1-the-audit-gap-what-you-can-and-cant-see.md) * [6.5 Routing AI telemetry to your SIEM](/handbook/6.-observability-audit-and-evidence/6.5-routing-ai-telemetry-to-your-siem.md) * [6.7 Continuous review cadence](/handbook/6.-observability-audit-and-evidence/6.7-continuous-review-cadence.md) * [7.2 Pilot design and success metrics](/handbook/7.-rollout-and-operations/7.2-pilot-design-and-success-metrics.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://handbook.harmonic.security/handbook/6.-observability-audit-and-evidence/6.4-analytics-and-usage-apis.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.