Tigera

Calico Cloud Usage API

A read-only REST API on the Calico Cloud SaaS management plane that returns the same vCPU usage and managed-cluster data shown on the Usage Metrics page, for capacity planning, FinOps and license-compliance workflows. Three documented datasets — contracts (start/end dates, vCPU hours, package, add-ons), summary (per-project vCPU totals and usage over time) and managed clusters (per-cluster usage rows, optional project filter, CSV output) — with startTime, endTime and granularity query parameters. Authentication is an organization-scoped read-only API key generated in the web console.

GitHub

Documentation

📖
Documentation
https://docs.tigera.io/calico-cloud/operations/usage-api
📖
Authentication
https://raw.githubusercontent.com/api-evangelist/tigera/refs/heads/main/authentication/tigera-authentication.yml

API entry from apis.yml

apis.yml Raw ↑ 
aid: tigera:calico-cloud-usage-api
name: Calico Cloud Usage API
description: A read-only REST API on the Calico Cloud SaaS management plane that returns the same vCPU
  usage and managed-cluster data shown on the Usage Metrics page, for capacity planning, FinOps and license-compliance
  workflows. Three documented datasets — contracts (start/end dates, vCPU hours, package, add-ons), summary
  (per-project vCPU totals and usage over time) and managed clusters (per-cluster usage rows, optional
  project filter, CSV output) — with startTime, endTime and granularity query parameters. Authentication
  is an organization-scoped read-only API key generated in the web console.
humanURL: https://docs.tigera.io/calico-cloud/operations/usage-api
tags:
- FinOps
- Usage
- SaaS
properties:
- type: Documentation
  url: https://docs.tigera.io/calico-cloud/operations/usage-api
- type: Authentication
  url: authentication/tigera-authentication.yml
x-evidence:
  docs_url: https://docs.tigera.io/calico-cloud/operations/usage-api
  http_status: 200
  fetched: '2026-08-05'
  base_url_note: Tigera does not publish the Usage API host in public documentation. The console generates
    a ready-made command per API key ("Actions > Generate commands"), so the base URL is only visible
    to authenticated customers. Recorded without a baseURL rather than guessed.