Provider setup

OpenAI

• Credential: an organization Admin API key, created by an organization owner under Organization settings → Admin keys. Project keys can’t read organization costs.
• We call GET /v1/organization/costs (daily buckets, grouped by project and line item) and GET /v1/organization/usage/completions (tokens by model and project).
• OpenAI reports cost by line item, so “model” is derived from the line-item label where possible. Workspaces don’t apply.
• Amounts arrive in dollars as JSON numbers; we store the exact digits received and convert to integer micros.

Anthropic (Claude Platform)

• Credential: an Admin API key (sk-ant-admin…) from an organization admin. Standard and workspace keys are rejected.
• We call GET /v1/organizations/cost_report (daily, grouped by workspace and description) and GET /v1/organizations/usage_report/messages.
• Cost amounts are decimal strings in cents (for example "123.78912" ≈ $1.24). We convert exactly and keep the original string.
• Priority Tier spend isn’t included in the cost report. The default workspace appears without an id.
• Claude Enterprise (claude.ai) organizations use a different analytics API and aren’t supported by this connector.

xAI (Grok) New

• Credential: a team-scoped management key from console.x.ai → Settings → Management keys. Create a dedicated key for the team you want to audit; organization-scoped keys and regular API keys are rejected with a clear message.
• xAI management keys can do more than read (they can also manage API keys). Audon only calls two endpoints, and you can revoke the key at any time:
  • /auth/management-keys/validation on management-api.x.ai to find the team behind the key;
  • /v1/billing/teams/{team_id}/usage for daily USD cost grouped by description (for example “Chat grok-4-0709”).
• The model is read from the description. Cached input, search and other items are categorised from the same text.
• This endpoint reports cost, not token counts, so levers that need token counts, such as model routing, don’t run on xAI data yet. Where a lever does run, it uses xAI’s published cache and batch rates.
• Built from xAI’s documentation and tested against recorded responses; a check against a live key is pending.

Groq

Groq has no usage or billing API yet (the dashboard only), so it can’t be connected by key. Send outcome telemetry with estimated cost per run to include Groq workloads.

Freshness and revisions

Providers can revise recent days. Records from the last three UTC days are marked provisional and re-reconciled on each sync. Changes to older, finalized days are recorded as reconciliation conflicts and shown in the audit’s coverage section — never silently overwritten.

Revoking access

Disconnect in Integrations (or connection_disconnect). The encrypted key is destroyed immediately.