Cost Management

Runs unlicensed

Runs unlicensed, in full. Real cost calculation, budgets, hard caps, chargeback and forecasting are available in the Development posture. Earlier releases showed only a read-only spend estimate here; 1.7.0 removed that split.

The sidebar's Cost section groups six FinOps surfaces: the live cost dashboard, token usage telemetry, model pricing, budget caps, chargeback reports, and compliance reports.

Cost dashboard

Open Cost → Cost Dashboard in the sidebar.

Figure 1. Cost dashboard with summary cards, charts, budget status, and cost records

Cost records

A table of cost records with workspace, API key, model, provider, input / output tokens, input / output cost, total cost, and timestamp. Auto-refreshes every 5 seconds.

Filters: narrow by workspace, model, provider, and date range.

Summary cards

Aggregated totals at the top of the page: total cost, total requests, total input tokens, total output tokens.

Charts

Two interactive visualizations:

• Cost by Provider — donut chart breaking down total spend by provider
• Cost by Model — horizontal bar chart showing spend per model

Figure 2. Cost dashboard with cost-by-provider donut and cost-by-model bar chart

What a soft-limit crossing actually does

Crossing a soft limit writes a BUDGET_CAP_SOFT audit event. That is the whole delivery mechanism, and the rest follows from it:

• There is no email. Nothing in the budget path sends mail. To be notified, subscribe a webhook to BUDGET_CAP_SOFT — it is a supported webhook event type — and the webhook retry and delivery-log behaviour then applies, the same as any other event.
• Deduplication is a per-budget cooldown, dvara.llm-gateway.finops.soft-alert-cooldown-minutes, default 60. Inside the window the crossing is silently skipped rather than re-emitted.

The cooldown is per pod, not fleet-wide

It is held in memory in the enforcer, so each replica keeps its own. A fleet of N pods can emit up to N alerts per cooldown window for one budget, and a restart clears the memory — so a rolling deploy can produce another. Size an on-call rule for that, or dedupe on budget_id downstream.

BUDGET_CAP_HARD is emitted the same way and is likewise a subscribable webhook event.

Budget status panel

Shows active budget caps with current spend vs. limit progress bars. Color-coded: green under the soft limit, amber at the soft limit, red at the hard limit.

Forecast cards

Shows 7-day trailing cost forecasts per model with projected month-end spend and trend indicators (increasing / decreasing / stable).

Anomaly alerts

Lists detected cost anomalies with workspace, model, current daily rate vs. baseline, deviation percentage, and detection timestamp. The threshold is configurable globally via dvara.llm-gateway.finops.anomaly-threshold-pct and per-workspace by setting cost.anomaly-threshold-pct in the workspace metadata.

Figure 3. Cost dashboard view. Forecast cards and anomaly alerts render above the records table when forecasting and anomaly detection return non-empty results — both require 7+ days of trailing cost data. With no forecasts/anomalies the page falls back to the KPI summary + chart + records layout shown here.

Spend grouped by tag

The chargeback question — which team spent this — answered from the cost dashboard's tagKey filter. Supply a tag key and the page groups spend by that tag's values.

Opt-in by key, with no default, because tags are workspace-defined: there is no key DVARA can guess, so there is no panel until you name one. The grouping respects the page's workspace filter, so a scoped view reports that workspace's spend rather than the fleet's.

Credential Forensics

Cost → Token Usage → By credential (/token-usage/by-credential, owner only) answers the reverse lookup: which workspaces sent traffic under this provider credential.

This is the page an abuse report sends you to. A provider tells you a key of yours is generating traffic they object to; on a shared or BYOK-mixed install, this is what turns that key back into a list of workspaces. Owner-only because it deliberately crosses workspace boundaries.

Token Usage page

For per-request token detail — the raw records underneath the dollar aggregates — open Cost → Token Usage in the sidebar. The page carries a filter form (workspace, API key, model, date range) that drives a summary KPI card (input / output / total tokens, request count, average tokens-per-request) and a records table (newest first, masked API keys, an estimated-flag tooltip on rows where the upstream didn't return exact counts). Pagination caps at 1000/page; default 50.

The Cost Dashboard is the dollar lens of the same data — tokens rolled up with pricing into spend figures grouped by workspace / model / provider / time range. Use the Cost Dashboard for spend visibility and budgets; use the Token Usage page for pricing audits, cost-per-token analysis, or reconciling a disputed workspace invoice.

See Administering DVARA for the list and summary endpoints with filter parameters (tenantId, apiKey, model, from, to) and response shape.

Model pricing

Open Cost → Model Pricing in the sidebar.

Pricing list

Lists every pricing entry with model pattern (glob), provider, input price per million tokens, output price per million tokens, effective date, and row actions.

Figure 4. Model pricing list with seeded entries

Create / edit pricing

Click New Pricing to create an entry with:

• Model Pattern — glob pattern (e.g. gpt-4o*, claude-3-sonnet*)
• Provider — optional provider scope
• Input Price / Million — USD per 1 M input tokens
• Output Price / Million — USD per 1 M output tokens
• Effective Date — when this pricing takes effect

Figure 5. Create-pricing form

Click Delete to remove a pricing entry. Requires confirmation.

Budget caps

Open Cost → Budget Caps in the sidebar.

Budget list

Lists every budget cap with name, workspace, API key, period (DAILY / WEEKLY / MONTHLY), limit (USD), soft limit percentage, enabled status, and version. Auto-refreshes every 10 seconds. A Summary row at the top shows total budgets, enabled count, and disabled count. Use the Workspace dropdown filter to narrow the list.

Workspace self-service budgets

Workspaces can create their own caps from /portal/budgets — these are stored with managedBy=TENANT and must sit at or below the effective platform ceiling (the tightest enabled PLATFORM-provenance cap that governs them). The Console's Budget list mixes both: platform-created caps are editable from here; workspace-created caps appear read-only with a lock badge. Budget evaluation is tightest-wins across every applicable cap.

Figure 6. Budget caps list with monthly and daily caps

Create / edit budget

Click New Budget to create a budget cap with:

• Name — descriptive name
• Workspace ID — scope to a workspace (blank = global: a fleet-wide cap on total spend across all workspaces, evaluated on every request)
• API Key ID — scope to a specific API key (blank = workspace-wide)
• Period — DAILY, WEEKLY, or MONTHLY
• Limit (USD) — hard spending limit
• Soft Limit % — percentage of limit at which soft alerts trigger (default: 80%)

All applicable budgets are evaluated on each request and the tightest limit wins — a global cap, the workspace's cap, and an API-key cap can all apply at once, and the first to breach blocks (hard limit) or alerts (soft limit).

Figure 7. Create-budget form

Per-call cost ceiling

Budget caps limit accumulated spend over a period. A separate, optional per-call ceiling limits the estimated cost of any single request — useful when you want a hard stop on one runaway call regardless of how much budget remains. It's off by default and set in configuration, not the Console:

# application.yml
dvara:
  llm-gateway:
    finops:
      per-call-max-cost-usd: 0.50   # reject any single request estimated above $0.50

A request whose estimated cost exceeds the ceiling is rejected before it reaches the provider with 402 Payment Required (PER_CALL_COST_EXCEEDED) and an audit event. The estimate is max_tokens × the model's output price, so the gate reflects the worst-case output cost the client declared — it applies only when the request sets max_tokens and the model has a pricing row; otherwise the call can't be priced and passes through. Override the ceiling for one workspace with cost.per-call-max-usd in the workspace's metadata — a positive value there enables the gate for that workspace even when the global ceiling is 0. This complements, and runs alongside, the accumulated-spend budget caps above.

A newly-set override takes up to a minute to apply

The per-workspace override is cached in the gate, so a ceiling you have just set keeps serving 200 for around a minute before it starts rejecting. Measured on 1.7.0: a $0.0001 ceiling on a request estimated at $1.00 served normally at first and returned 402 on a later attempt with nothing else changed.

The failure mode is the misleading direction — you set a ceiling, send the request that should breach it, get 200, and conclude the feature is broken. Wait a minute and retry before diagnosing anything. Same shape as the poll delay on policy activation.

Budget status

Click the status icon on any budget row to view current period usage:

• Current Spend — amount spent in the current period
• Limit — configured limit
• Period Start / End — boundaries of the current budget period
• Utilization % — spend / limit percentage with a color-coded progress bar
• Remaining — dollars remaining before the hard limit

Figure 8. Budget usage panel with spend vs limit progress

Click Delete to remove a budget cap. Requires confirmation.

Which calls get a cost record

A cost record is written when the provider reported usage and a matching price row exists. Per path:

path	usage row	cost record
ordinary call	yes	yes
streaming	yes — exact where the provider returns a usage block, otherwise estimated	yes
cache hit	yes, marked HIT	no — no upstream call was made, so it books $0
blocked before dispatch (policy, guardrail, budget, per-call ceiling)	no	no
failed call — no usage returned	no	no
model with no price row	yes	no

Served volume and upstream cost are therefore deliberately different numbers. A cache hit counts toward what you served and toward nothing you were charged; the monthly usage report splits them for exactly that reason.

Retries and provider fallback are not separate rows: a request produces at most one usage row and one cost record, attributed to the provider that actually answered.

Chargeback reports

Open Cost → Chargeback Reports in the sidebar.

Report list

Lists every generated chargeback report with ID, workspace, period (from–to), generated date, and generated by. Auto-refreshes every 10 seconds.

Figure 9. Chargeback reports list

Generate report

Click Generate to create a new chargeback report:

• Workspace ID — scope to a specific workspace (blank = all workspaces)
• From / To — reporting period date range

The report includes seven sections: workspace summary, API key summary, model summary, provider summary, daily breakdown, forecasts, and anomalies.

Download

• PDF — click the PDF icon to download a formatted PDF report
• CSV — click the CSV icon to download raw data as CSV

Figure 10. Generated chargeback PDF (first page). Header carries the report ID, workspace ID, period, and generation timestamp; the body lays out Workspace Summary (total cost / requests / top model), Model Breakdown (per-model cost split with avg/request), Provider Breakdown, Daily Cost Trend (one row per day in the period), and on subsequent pages the Cost Forecast (7-day + 30-day trailing) and Cost Anomalies sections. The CSV download has the same data in a flat schema.

Click Delete to remove a report. Requires confirmation.

Compliance reports

Open Cost → Compliance Reports in the sidebar.

Report list

Lists every compliance report with ID, type (SOC2 / HIPAA / GDPR / RBI / SEBI), workspace, period, generated date, and actions. Auto-refreshes every 10 seconds. Use the Type and Workspace dropdown filters to narrow the list.

Figure 11. Compliance reports list

Generate report

Click Generate to create a new compliance report:

• Type — SOC2 Type II, HIPAA, GDPR, or India RBI / SEBI
• Workspace ID — scope to a specific workspace (blank = all workspaces)
• From / To — reporting period date range

Report contents by type:

SOC2	HIPAA	GDPR
Audit chain integrity	Access log	Data processing activities
Access control summary	Authorization log	Workspace data residency
Policy enforcement summary	Policy violations	Consent and policy status
Data residency	Data access patterns	Data retention
Token usage summary	Audit integrity	Audit integrity
Event count by type

The India RBI and SEBI reports share a common section set — data localization (residency), tamper-evident audit-chain integrity, access control, policy enforcement, and token usage — with regulator-specific framing (RBI emphasizes data localization; SEBI emphasizes recordkeeping and audit trail). Scheduled generation is configured via dvara.flightdeck.compliance.rbi-schedule / .sebi-schedule.

Figure 12. Generating a compliance report. The type selection drives which audit-event categories are aggregated (per the table above); workspace + date range scope the evidence window. Generated PDFs are cryptographically signed end-to-end so an auditor can verify the export hasn't been altered.

Click the PDF icon to download the compliance report as a formatted PDF. Click Delete to remove a report (requires confirmation).