Key Usage (who is calling your API)

Settings → DAB & API Keys → Key Usage. One table answering the question the key list can’t: which of your keys are actually being used, how hard, whether their calls are succeeding, where they’re calling from, and whether the key doing the work is still valid.

Pick a window — last hour, last 24 hours or last 7 days — and each key shows:

• Calls — how many requests that key made in the window, and the same figure as a rate (/min) so the three windows are comparable at a glance.
• Outcome — the same calls split into succeeded, rejected (4xx) and failed (5xx). A key that is mostly being rejected is usually a scope or permission problem, not a network one.
• Status — Active, Expired, Revoked or Deleted, with the date that governs it (expires 30 Sep, revoked 2 Aug). Status sits next to the traffic on purpose: the two together are what tell you something is wrong.
• Caller IP — the address the key was last used from, plus a count of any other addresses seen in the window. Read it as where this credential is being used: several addresses on a key you issued to one integration is worth a look.
• Last used — when the key last obtained a token, whatever the metrics say.
• Attention — named problems, described below.

Every key of the tenant is listed, including the platform’s own service keys (portal, sync workers) that no person owns — those normally carry most of the traffic, so a report that left them out would hide its own busiest caller. Soft-deleted keys appear too, marked Deleted, precisely so you can see if one is somehow still being called.

The Attention column flags a key whose traffic and status disagree:

• Calls after revocation / deletion / expiry — a key that should no longer work is still being used. Investigate: the caller has not been told to stop, or something is still accepting the credential.
• Expiring while in use — a key doing real work expires within 30 days. This is the one that turns into an outage on a date nobody is watching; extend it (the key’s Extend menu) or plan the rotation now.
• Mostly failing — more than half of that key’s calls are being refused.

“n/a” is not zero. Call counts come from the platform’s metrics service. When a figure reads n/a the report could not reach that service — it is not a statement that the key was idle. An idle key shows a real 0. Key names, statuses and last-used times come from your own lake and are unaffected either way. Likewise “not recorded” in the Caller IP column means no address has been captured for that key yet (nothing has used it since addresses started being recorded) — not that it was used without one.

Reading the report is read-only and needs the same API keys — view permission as the key list itself. Nothing here reveals key material: only the short public prefix each key already shows.