Audit your AI spend from the export you already have

Run this with an organization admin key in OPENAI_ADMIN_KEY: it asks for the last 31 days, one bucket per day and model, and saves the JSON. One response holds up to 31 daily buckets. If it ends with "has_more": true, fetch the next page by adding &page=<the next_page value> to the same URL. To audit every page as one export, save the responses into one file — as a JSON array of the responses, or one response per line — and drop that; or drop each saved page on its own.

curl -s "https://api.openai.com/v1/organization/usage/completions?start_time=$(( $(date +%s) - 31*86400 ))&bucket_width=1d&limit=31&group_by=model" \
  -H "Authorization: Bearer $OPENAI_ADMIN_KEY" \
  -o openai-usage.json

Run this with an Admin API key in ANTHROPIC_ADMIN_KEY: it asks for the last 31 days, one bucket per day and model, and saves the JSON (the date command works on macOS and Linux). One response holds up to 31 daily buckets. If it ends with "has_more": true, fetch the next page by adding &page=<the next_page value> to the same URL. To audit every page as one export, save the responses into one file — as a JSON array of the responses, or one response per line — and drop that; or drop each saved page on its own.

START=$(date -u -v-31d +%Y-%m-%dT00:00:00Z 2>/dev/null || date -u -d "31 days ago" +%Y-%m-%dT00:00:00Z)
curl -s -g "https://api.anthropic.com/v1/organizations/usage_report/messages?starting_at=$START&bucket_width=1d&limit=31&group_by[]=model" \
  -H "x-api-key: $ANTHROPIC_ADMIN_KEY" \
  -H "anthropic-version: 2023-06-01" \
  -o anthropic-usage.json

The same Admin API key, the billed dollars instead of the tokens: one bucket per day, each charge named with its model. Save it into the same file as the usage report (a JSON array of the two responses) to compare the book with what you were billed. One response holds up to 31 daily buckets. If it ends with "has_more": true, fetch the next page by adding &page=<the next_page value> to the same URL. To audit every page as one export, save the responses into one file — as a JSON array of the responses, or one response per line — and drop that; or drop each saved page on its own.

START=$(date -u -v-31d +%Y-%m-%dT00:00:00Z 2>/dev/null || date -u -d "31 days ago" +%Y-%m-%dT00:00:00Z)
curl -s -g "https://api.anthropic.com/v1/organizations/cost_report?starting_at=$START&bucket_width=1d&limit=31&group_by[]=description" \
  -H "x-api-key: $ANTHROPIC_ADMIN_KEY" \
  -H "anthropic-version: 2023-06-01" \
  -o anthropic-cost.json

platform.openai.com → Usage → Export. Column names are matched tolerantly (case and spacing don't matter).

platform.claude.com (formerly console.anthropic.com) → Usage (or Cost) → Export CSV. Cache read/write columns and workspaces are picked up.

Your LiteLLM proxy's /spend/logs output, as a JSON array or one record per line. Key aliases become dimensions.

With model invocation logging on (Bedrock → Settings), drop the delivered records — an S3 object once unzipped is one record per line — or a CloudWatch Logs export of the log group, as below. Each invocation is one request; cache reads and writes are carried.

aws logs filter-log-events \
  --log-group-name <your-bedrock-invocation-log-group> \
  --start-time $(( ($(date +%s) - 31*86400) * 1000 )) \
  --output json > bedrock-invocations.json

The Azure Monitor metrics of your Azure OpenAI resource, split by deployment and model, as below. Tokens are priced by the model; the deployment name is kept as the dimension. Per-deployment rows (deploymentName, promptTokens, completionTokens) are read too.

az monitor metrics list --resource <your-azure-openai-resource-id> \
  --metrics ProcessedPromptTokens GeneratedTokens --aggregation Total --interval P1D \
  --start-time $(date -u -v-31d +%Y-%m-%dT00:00:00Z 2>/dev/null || date -u -d "31 days ago" +%Y-%m-%dT00:00:00Z) \
  --filter "ModelDeploymentName eq '*' and ModelName eq '*'" -o json > azure-openai-usage.json

Rows of your Cloud Billing export to BigQuery, as JSON or newline-delimited JSON. Vertex AI token SKUs are priced and compared with the billed cost; other services are skipped and counted. Credits are named, not netted.

bq query --use_legacy_sql=false --format=json --max_rows=100000 \
  'SELECT service, sku, usage, cost, currency, usage_start_time, credits
   FROM `<project>.<dataset>.gcp_billing_export_v1_<id>`
   WHERE service.description = "Vertex AI"
     AND usage_start_time >= TIMESTAMP_SUB(CURRENT_TIMESTAMP(), INTERVAL 31 DAY)' > vertex-billing.json

One JSON object per line with model + input_tokens/prompt_tokens + output_tokens/completion_tokens, optional cost.