OPENMETER_URL is required) — all responses include "source": "openmeter". It is designed for billing dashboards, cost analytics, per-user attribution, and pipeline/model breakdown workflows.
All monetary values are expressed in wei as decimal strings, with USD micro equivalents available via include=retail.
Authentication
Two auth modes are accepted. The tenant boundary is enforced identically in both: theclientId in the URL path must match the authenticated principal’s app.
Confidential client (recommended for server-to-server)
HTTP Basic auth with your M2M credentials:Provider dashboard session
A logged-in provider session whose user is the app’s owner, a platform admin, or aproviderAdmins team member may call the endpoint without Basic auth.
Requests that satisfy neither auth mode, or whose authenticated principal does not match the path
clientId, receive 404 Not Found. The endpoint deliberately does not distinguish “unauthenticated” from “not found” to avoid leaking app existence.Endpoint
Path parameters
Query parameters
All query parameters are optional.
Date format:
Date.parse-compatible strings are accepted (e.g. 2026-01-01T00:00:00.000Z or 2026-01-01). Invalid values return 400 Bad Request.
userId vs externalUserId: The userId parameter accepts the internal PymtHouse user id (endUserId), not your system’s externalUserId. Resolve an externalUserId to an endUserId via a prior groupBy=user response.
groupBy values
Response
200 OK
Response fields
The "unknown" bucket
Usage records without a resolvable userId are grouped under endUserId: "unknown" rather than silently dropped. This guarantees that totals.requestCount always equals the sum of byUser[].requestCount (including the "unknown" bucket) when groupBy=user is requested.
Usage balance
Check a user’s remaining entitlement balance before allowing access:
See Allowances for granting additional balance.
Examples
App-level totals (all time)
Per-user breakdown
Pipeline/model breakdown
Pipeline/model breakdown with retail estimates
Month-to-date window
Usage balance for a user
Filter to a single gateway request
Format wei as ETH in a shell script
SDK helper: usage by external user
Error responses
Security boundaries
- Tenant isolation is enforced by matching the authenticated client’s app to the path
clientId. A valid credential for a different app returns404. - Provider sessions must be the app owner, a platform admin, or a recorded
providerAdminsteam member. - No secrets, signer material, per-request payloads, or customer PII are returned.
- Confidential client secrets must stay server-side. Do not call this endpoint from the browser with Basic auth.
Key design decisions
- OpenMeter-authoritative. All usage reads come from OpenMeter meters (
network_fee_usd_micros,signed_ticket_count). The"source": "openmeter"field is always present. Allowance balance reads use OpenMeter entitlement APIs, never Postgres. pipeline_modelgrouping from billing events. ThegroupBy=pipeline_modeldimension aggregates from validatedusage_billing_eventsrows — records that have a fullpipeline+modelIdconstraint from the gateway payment envelope. Records without this constraint appear only intotals.- Async metering. Signing hot-path performance is not impacted by metering writes. go-livepeer emits events to Kafka; the OpenMeter collector ingests them asynchronously.
404for all auth and tenant-mismatch failures. Collapsing401,403, and “wrong app” into404prevents enumeration of validclient_ids.- Retail estimates are opt-in.
include=retailtriggers retail rate computation from the active plan’s rate cards. Authoritative invoicing remains OpenMeter after plan sync.
Implementation tasks
- Parse
totalFeeWeiandfeeWeiwithBigIntbefore any arithmetic. - When displaying fees in your dashboard, convert from wei using a safe formatter (e.g.
viem’sformatEther). - For reconciliation workflows, always supply explicit
startDate/endDatebounds. - Use
groupBy=pipeline_modelto build per-pipeline attribution dashboards. Only requests with fullpipeline+modelIdconstraints appear in this dimension. - Check
getUsageBalance()(orGET .../usage/balance) before allowing user actions that consume entitlement. - Rotate M2M client secrets periodically via the credentials endpoint.