Usage and audit log through the API

All routes live under https://chat.realmoon.ai/api/v1/orgs/{org_id}. Scopes: usage:read for usage, audit:read for the audit log. These areas have no write scope.

Usage#Link to the Usage section

What is counted#Link to the What is counted section

usage_scope is workspace when the organization counts its members’ usage, and personal when each member uses their own allowance: the figures are then empty.

Period and scope#Link to the Period and scope section

An invalid period returns 400 invalid_request with the message Période invalide : 366 jours au plus. (invalid period, 366 days at most). Responses return the effective date_from and date_to, and scope: org (the whole organization), managed_groups (the groups the key’s creator manages, without email addresses) or self (the creator only).

Period totals#Link to the Period totals section

GET /usage/summary · usage:read

curl "https://chat.realmoon.ai/api/v1/orgs/$ORG_ID/usage/summary?date_from=1759622400&date_to=1762214400" \
  -H "Authorization: Bearer $MOONAI_ADMIN_KEY"

import os
import time
import requests

now = int(time.time())
r = requests.get(
    f"https://chat.realmoon.ai/api/v1/orgs/{os.environ['ORG_ID']}/usage/summary",
    headers={"Authorization": f"Bearer {os.environ['MOONAI_ADMIN_KEY']}"},
    params={"date_from": now - 30 * 86400, "date_to": now},
    timeout=30,
)
r.raise_for_status()
summary = r.json()
print(summary["current"]["requests"], summary["near_limit"])

const now = Math.floor(Date.now() / 1000);
const url = new URL(`https://chat.realmoon.ai/api/v1/orgs/${process.env.ORG_ID}/usage/summary`);
url.search = new URLSearchParams({ date_from: now - 30 * 86400, date_to: now });
const r = await fetch(url, { headers: { Authorization: `Bearer ${process.env.MOONAI_ADMIN_KEY}` } });
if (!r.ok) throw new Error(await r.text());
const summary = await r.json();
console.log(summary.current.requests, summary.near_limit);

{
  "date_from": 1759622400,
  "date_to": 1762214400,
  "current": { "members": 380, "active_members": 295, "requests": 18422, "tokens_in": 91200000, "tokens_out": 6100000, "tokens": 97300000 },
  "previous": { "members": 379, "active_members": 280, "requests": 17003, "tokens_in": 85000000, "tokens_out": 5700000, "tokens": 90700000 },
  "month_pct_avg": 37.4,
  "near_limit": 4,
  "days": [{ "day": "2026-10-05", "requests": 512, "active": 81, "tokens_in": 2500000, "tokens_out": 170000 }],
  "usage_scope": "workspace",
  "scope": "org",
  "can_export": true
}

previous covers the preceding period of the same length. near_limit counts the members at 90% or more of their monthly limit. days (days in Paris time) is only returned for a period of 92 days or less.

By member#Link to the By member section

GET /usage · usage:read

Each item has user_id, name, email, profile_image_url, role, last_active_at, last_request_at, requests, share, month_pct, tokens_in, tokens_out, tokens and token_share. The response adds totals for the whole scope.

By group#Link to the By group section

GET /usage/groups · usage:read

Parameters: q, sort (requests, usage, tokens, active, members, name), page, limit. Each item has id, name, kind (static or dynamic), members, active_members, requests, share, tokens_in, tokens_out, tokens and token_share. A member of several groups counts in each of them: the shares can add up to more than 100.

By model#Link to the By model section

GET /usage/models · usage:read

Up to 100 models, with model_id (the model that answered), name, kind, requests, share, request_share and the tokens. model_id is image or video (kind: "media") for generated images and videos; services are not listed here.

Export as CSV#Link to the Export as CSV section

GET /usage/export?view=members · usage:read

view is members (default), groups or models; date_from, date_to and group_id apply. The file is UTF-8 with a BOM, comma-separated; a cell that starts with =, +, - or @ is prefixed with an apostrophe. Email addresses are only included with an org scope. The export is recorded in the audit log.

Audit log#Link to the Audit log section

Every admin action is recorded in the organization’s audit log, with its author: a member, an admin key (api_key:<id>) or Moon AI.

Filters#Link to the Filters section

Read the audit log#Link to the Read the audit log section

GET /audit · audit:read

curl "https://chat.realmoon.ai/api/v1/orgs/$ORG_ID/audit?action=org_member_remove&limit=20" \
  -H "Authorization: Bearer $MOONAI_ADMIN_KEY"

import os
import requests

r = requests.get(
    f"https://chat.realmoon.ai/api/v1/orgs/{os.environ['ORG_ID']}/audit",
    headers={"Authorization": f"Bearer {os.environ['MOONAI_ADMIN_KEY']}"},
    params={"action": "org_member_remove", "limit": 20},
    timeout=30,
)
r.raise_for_status()
for line in r.json()["items"]:
    print(line["created_at"], line["actor"]["name"], line["action"])

const url = new URL(`https://chat.realmoon.ai/api/v1/orgs/${process.env.ORG_ID}/audit`);
url.search = new URLSearchParams({ action: 'org_member_remove', limit: 20 });
const r = await fetch(url, { headers: { Authorization: `Bearer ${process.env.MOONAI_ADMIN_KEY}` } });
if (!r.ok) throw new Error(await r.text());
for (const line of (await r.json()).items) console.log(line.created_at, line.actor.name, line.action);

{
  "items": [
    {
      "id": 918273,
      "action": "org_group_members_add",
      "created_at": 1762209000,
      "actor": { "id": "api_key:7c1e2a4b-6d8f-4a0c-9e2b-4d6f8a0c2e4b", "name": "Synchro annuaire", "email": null, "kind": "api_key" },
      "target": null,
      "object": { "type": "group", "id": "<group id>", "name": "Professeurs" },
      "count": 3,
      "changes": null,
      "before": null,
      "after": { "group_id": "<group id>", "user_ids": ["<id 1>", "<id 2>", "<id 3>"] },
      "ip": "203.0.113.10",
      "user_agent": "curl/8.5.0",
      "people": [{ "id": "<id 1>", "name": "Léa Dupont" }]
    }
  ],
  "total": 1,
  "page": 1,
  "limit": 50,
  "can_export": true
}

For actions a member takes on their own account, the IP address, the browser and the details are not returned. Lines written by Moon AI have no IP address.

Actions and authors present#Link to the Actions and authors present section

GET /audit/facets · audit:read

Returns actions (each code present and its number of lines) and actors (200 authors at most, most active first), so you can build filters.

Export the audit log#Link to the Export the audit log section

GET /audit/export · audit:read

A CSV of the lines that match the filters, 50,000 at most, most recent first. Columns: Date, Action, Libellé, Auteur, E-mail de l'auteur, Personne visée, Objet, Détails, Adresse IP (date, action, label, author, author’s email, person targeted, object, details, IP address). The export itself is recorded in the audit log.

See also#Link to the See also section

• Usage and activity log, in the admin console
• Webhooks, to receive events as they happen