Conventions

Responses#

A list is named after what it holds, with a summary of totals where there is one:

A single record comes under its own name, like { "organization": { … } } or { "bill": { … } }.

Field types#

  • Money is in USD, as a number, like 12.5.
  • Timestamps are ISO 8601 in UTC, like 2026-11-08T09:00:00Z.
  • Accounts are identified by their 12-digit AWS account_id.

Filters#

  • A filter is named after the field it matches, without an _id or _type suffix: ?region=us-east-1 returns the records whose region is us-east-1, and ?account=123456789012 the ones whose account_id is 123456789012.
  • Repeat a filter to match any of several values: ?region=us-east-1&region=eu-west-1.
  • state filters by lifecycle state, including on resources where AWS names the field status, like EKS clusters.
  • An unknown filter value returns 422 with the invalid_filter code.

Errors#

An error always has a code and a message:

StatusCodeWhen
401unauthorizedThe key is missing, expired, or revoked
403forbiddenThe key can't read this, like a locked project
404not_foundThe organization or record doesn't exist, or isn't yours
422invalid_filterA filter value is unknown, or a required parameter is missing
429rate_limitedThe key made more than 60 requests in a minute

Rate limits#

An API key can make 60 requests a minute, across every endpoint. Past that, the API returns 429 until the minute is up.