Plans, usage and API keys in the Cockpit app

Account → Usage & API keys in Lumen mode shows what the organization sent this month, what its plan allows, and the keys that send data in. It never takes card details: paid plan changes happen on the web.

This month

Usage here is not the toolbar's time range. It counts the current calendar month in UTC (GET /api/usage from the 1st): billable entries are log entries plus metric points.

A meter under the tiles shows entries against the included allowance and storage against its cap (amber past 85%). When retained storage is over the cap the page says new data may be dropped. Below, Entries per day charts the month day by day; hover a bar for logs, metric points and the total.

Plan limits (included, cap) come from the plan row on api-core and need an organization admin; a plain member sees usage but "–" for the limits.

Platform administrators also see Usage by organization (last 30 days, logs, metrics and events per organization id).

Plans

The plan card compares the three tiers and marks the current one. The limits are each tier's defaults, as api-lumen defines them:

These match Enable → Plans. The plan actually in force comes from the server: if an organization has more entries or storage than the tier default (extra entry packs, storage GB, longer retention), those are added through billing and the usage tiles use the organization's real caps. See Billing and seats.

If the organization is on a plan, the card's header shows Billed $X/month — but only when the billing summary's Lumen plan is the same tier as the plan row. When they disagree, the figure is left out rather than shown beside a different plan.

Changing the plan

The app does not send paid-tier changes itself. The buttons on the other tiers read Upgrade to Pro, Upgrade to Enterprise or Switch to Free, with an external-link icon, and each opens that page. Pausing Lumen and purging its data are also done there.

Only organization admins and owners can see or change the plan; others see "Only organization admins can see or change the plan." The plan card calls api-core with your session (cookie style), not the Lumen bearer token: how the app authenticates.

API keys

The key list (GET /api/api-keys for your organization) shows name, the key's visible prefix, scope, created, and last used (never, or "3h ago"). A revoked key shows revoked.

Creating a key: type a name, choose the scope (read — query data, ingest — send logs and metrics, product — Pulse analytics) and Create key. The plaintext key appears once, in a bar with Copy and Dismiss; after you dismiss it or leave the page it cannot be shown again. For a browser Pulse key bound to site addresses and a project, use Pulse → Setup instead.

Revoke turns a key off at once. The app asks you to confirm first, naming the key; anything still sending with that key should start failing authentication (401). Mint a new key for a replacement. Never put an ingest key in a browser (Enable).

Only organization admins and owners can list, create or revoke keys; others see "Only organization admins can manage keys." The key list and the new key are scoped to the active organization.