The Netskope AI Gateway Analytics Dashboard gives your organization a unified view into AI API activity flowing through deployed gateways. As teams adopt large language models (LLMs) and AI-powered services from providers such as OpenAI, Anthropic Claude, and Google Gemini, the dashboard delivers the visibility needed to optimize usage, enforce policy, control costs, and maintain security — all from a single pane of glass.
This document covers the business use cases the dashboard supports, a guide to each dashboard tile, and a complete reference for the key event fields displayed in the UI.
The Analytics Dashboard is designed to serve several key personas across your organization:
- IT & Security Administrators — Monitor gateway health, policy enforcement, blocked requests, and rate-limiting behavior across all providers.
- Platform / AI Operations Teams — Track model usage, measure prompt and response token consumption, and identify anomalous API activity.
- Developers & Data Scientists — Analyze request patterns, HTTP error distributions, and model-level call volumes to troubleshoot integrations.
- Finance & Procurement Teams — Understand AI provider usage volume as a foundation for cost allocation and capacity planning.
Key Business Use Cases
AI Usage Governance & Visibility
Gain a complete, real-time inventory of every AI API call transiting your organization. Know which teams are using which providers and models, at what volume, and whether usage complies with your acceptable-use policies. The dashboard surfaces the full provider and model breakdown — from high-volume flagship models to shadow or experimental usage — so you can govern AI adoption with confidence.
Security Policy Enforcement Monitoring
Track how Netskope AI Gateway policies are being applied across all requests. The Policy Applied tile shows which inspection engines (access control, DLP, AI Security Guardrails) are evaluating traffic, and the Requests by Action Taken tile shows the volume of allowed, blocked, monitored, and replaced requests. Use this data to validate that your security controls are working as intended and to tune policies over time.
Rate-Limit Management
Rate limiting is a critical cost-control and availability mechanism. The dashboard tracks rate-limited requests globally and provides a per-provider breakdown showing both the raw count and the percentage of total requests that were rate-limited. This allows you to quickly identify which provider integrations are hitting capacity thresholds, and take corrective action before business workflows are disrupted.
Token Consumption & Cost Optimization
Token usage is the primary cost driver for LLM-based services. The Token Usage Summary section breaks down prompt (input) tokens versus response (output) tokens, both in aggregate and per provider. This data enables cost attribution, model efficiency comparisons, and budget forecasting. You can identify which providers or workflows are the most token-intensive and make informed decisions about model selection or prompt optimization.
Error Diagnosis & Availability Monitoring
The HTTP Status Code Distribution tile provides a full breakdown of response codes returned to clients, including 2xx success codes, 4xx client errors (such as 401 Unauthorized or 429 Too Many Requests), and 5xx server errors from upstream providers. Use this view to quickly identify connectivity issues, authentication failures, or provider outages affecting your end users.
Gateway Fleet Management
Understand the health and composition of your gateway deployment. The Gateway Details section shows the total number of active gateways and their version distribution, making it straightforward to identify gateways running outdated versions and plan upgrades.
Trend Analysis & Capacity Planning
The API Calls Trend over time chart provides a rolling view of request volume, making it easy to spot growth trends, usage spikes, and anomalies. Use the period-over-period comparison (reference period vs. previous period) for both API call count and total tokens consumed to assess whether usage is growing at the rate you expect.
Dashboard Overview
The AI Gateway Analytics Dashboard is organized into four logical sections. Each section groups related tiles that address a specific aspect of your AI gateway activity.
| SECTION | PURPOSE |
|---|---|
| Summary KPIs | High-level counts for API calls, token consumption, rate-limited requests, and active gateways |
| API Calls Trend | Time-series chart of request volume over the selected date range |
| Token Usage Summary | Aggregated prompt and response token counts for the period |
| Distribution & Actions | Provider/model breakdowns, policy actions, and HTTP status codes |
| Gateway Details | Active gateway count, version distribution, and rate-limit table by provider |
Dashboard Tiles — Detailed Guide
Summary KPIs
Total # API Calls
Shows the total number of AI API requests processed by all gateways during the selected period. A period-over-period comparison (e.g., versus the previous month) is shown beneath the headline number so you can instantly assess whether usage is growing or contracting. This is your primary volume indicator.
Total Tokens Consumed
Displays the aggregate token count across all requests and responses for the selected period, again with a period-over-period delta. Tokens are the unit of measurement that most AI providers use to calculate cost, so this figure is your leading indicator for AI spend.
Rate-Limited Requests
The count of requests that were subject to rate-limit enforcement by an AI Gateway policy. A high number here may indicate that one or more provider integrations are saturating their allocated capacity, or that rate-limit policies need to be adjusted.
Active Gateways
The distinct count of AI Gateway appliances that processed at least one request in the selected time period. This provides a quick sanity check that all expected gateways are operational and receiving traffic.
API Calls Trend (Over Time)
An area chart plotting daily API call volume across the selected date range. Peaks and troughs in this chart correlate with business activity patterns. Use this view to identify unexpected spikes (which may indicate runaway automation or a security incident) or unexpected drops (which may indicate an outage or misconfiguration). The chart supports zoom controls on both axes.
Token Usage Summary
Three single-value tiles that provide a snapshot of token consumption for the last 30 days:
- Prompt Tokens — Total input tokens sent by clients across all requests.
- Response Tokens — Total output tokens returned by AI providers across all responses.
- Total Tokens Consumed — The sum of prompt and response tokens.
A prompt-heavy workload (high input, low output) may indicate long system prompts or document-embedding use cases. A response-heavy workload suggests verbose model outputs, which can be optimized through prompt engineering or model selection.
Distribution & Actions
API Calls per AI Provider
A horizontal bar chart ranking all configured AI providers by total request volume. This tile immediately shows you which provider is handling the most traffic and surfaces any unexpected or unauthorized provider usage. The provider name corresponds to the AI Provider Name field (x_ai_provider) in the underlying event data.
API Calls per Response Model
A horizontal bar chart showing request volumes broken down by the specific model that fulfilled each request (as reported by the provider). This is the response-side model (x_rs_ai_model), which may differ from the model the client originally requested — for example, when a provider substitutes an equivalent model or when a fallback occurs.
Requests by Action Taken
A grouped column chart showing the volume of requests in each Gateway Action category:
- Allowed — Requests permitted without modification.
- Blocked — Requests denied by an AI Gateway policy.
- Monitored — Requests permitted but flagged for review.
- Replaced — Requests where the response content was intercepted by AI Gateway and replaced with a custom, admin-defined message.
A high blocked or replaced count is an indicator that your security policies are actively enforcing against non-compliant AI usage.
Policy Applied
A pie chart showing the distribution of requests across different inspection engine types (e.g., access control, DLP, AI Security Guardrails, rate limiting, CORS, caching). Each segment represents requests that were evaluated by that policy type. This tile helps you understand the composition of your policy enforcement workload.
HTTP Status Code Distribution
A bar chart showing the frequency of each HTTP status code returned by the gateway to clients. Key codes to watch include:
- 200 — Successful responses.
- 401 — Authentication failures (missing or invalid API tokens).
- 429 — Rate limit exceeded.
- 500 / 502 / 503 / 504 — Server-side or upstream provider errors.
A sudden increase in 5xx codes may indicate a provider outage or a misconfiguration in the gateway routing rules.
Token Usage by Provider
A grouped column chart displaying prompt (input) and response (output) token consumption broken down by an AI provider. Use this view to compare the token efficiency of different providers and to allocate costs by provider for internal chargeback purposes.
Gateway Details
Active Gateways (Summary)
A single-value tile confirming the count of distinct active gateways in the selected period. This figure matches the Summary KPI at the top of the dashboard but is repeated here for quick reference alongside the version detail below.
Active Gateways and Versions
A column chart showing how many active gateways are running each gateway software version. Use this to identify gateways running outdated or pre-release (beta/alpha) versions and prioritize upgrade work. Version strings such as v2.0.0 and v2.1.0beta are displayed as individual columns.
Rate-Limited Requests by Provider
A detailed table showing, for each AI provider: the number of authenticated requests, the number that were rate-limited, and rate-limited requests as a percentage of total requests. Providers with a consistently high percentage (typically above 10%) may require adjustment of their assigned rate-limit policies or capacity increases from the provider.
Dashboard Filters
The following global filters are available at the top of the dashboard and apply to all tiles unless noted:
| FILTER | DESCRIPTION |
|---|---|
| Event Date | Date range picker. Selects the time window for all tiles. Default is a relative timeframe (e.g., last 30 days). |
| Timeframe | Sets the granularity or rolling period (e.g., month). Used by period-over-period comparisons. |
| Reference Date | Sets the anchor date for the current-period calculation in period-over-period KPIs (e.g., 2026/04/01). Sets the anchor date for the current-period calculation in period-over-period KPIs (e.g., 2026/04/01). |
Additional filters (Gateway Name, Token Group, AI Provider, Model, Action) are available in the drill-down views. See the full filter reference in the AI Gateway documentation at /en/ai-gateway.
Key Event Fields — Reference
The following table lists the key fields surfaced in the AI Gateway Analytics Dashboard UI. Each row shows the Display Name as it appears in the dashboard, the underlying field name used in event data and LookML, a description, and which UI group the field belongs to.
General
| DISPLAY NAME | DESCRIPTION |
|---|---|
| Date and Time | Timestamp (seconds since epoch) when the request was received by the gateway. |
| Transaction ID | Unique identifier for each individual API request processed by the gateway. |
| Response ID | Unique identifier for the AI response, as provided by the upstream AI provider. |
| Conversation ID | Unique conversation identifier returned by providers that support multi-turn conversation context. |
| Incident ID | Identifier generated by the AI security solution for correlation. Defaults to the transaction ID when a policy match occurs. |
Gateway
| DISPLAY NAME | DESCRIPTION |
|---|---|
| Gateway Name | Human-readable name identifying the AI Gateway appliance that processed the request. |
| Gateway ID | Unique identifier for the AI Gateway appliance. |
| Gateway Version | Software version of the AI Gateway appliance (e.g., v2.0.0). |
AI Provider
| DISPLAY NAME | DESCRIPTION |
|---|---|
| AI Provider Name | Name of the AI provider configured for this request (e.g., OpenAI, Anthropic, Google DeepMind). |
| AI Schema | The API schema configured for the provider (e.g., openai, claude, gemini). Determines how requests and responses are parsed. |
| Requested Model | The specific AI model requested by the client application. |
| Response Model | The actual AI model used by the provider to fulfill the request. May differ from the requested model. |
| Input Tokens Used | Number of input (prompt) tokens consumed for this request, as reported by the AI provider. |
| Output Tokens Used | Number of output (response) tokens generated for this request, as reported by the AI provider. |
| Total Tokens Used | Total token count (input + output) for this request, as reported by the AI provider. |
Client Connection
| DISPLAY NAME | DESCRIPTION |
|---|---|
| Status Code | HTTP status code returned by the gateway to the requesting client. |
| HTTP Method | HTTP method of the client request (e.g., GET, POST). |
| HTTP Protocol | HTTP protocol version used by the client (e.g., HTTP/1.1, HTTP/2). |
| URL | Full URL including scheme, domain, path, and query string. |
| DOMAIN | Fully qualified domain name of the AI Gateway. |
| PATH | API path component of the client request URL. |
| QUERY | Query string component of the client request URL. |
| SOURCE IP | Source IP address of the client connection to the gateway. |
| DESTINATION IP | Destination IP address on the client-to-gateway connection. |
| CLIENT SSL ERROR | Description of any SSL/TLS handshake error on the client-to-gateway connection. |
Remote Connection
| DISPLAY NAME | DESCRIPTION |
|---|---|
| Remote URL | Full URL of the upstream AI provider endpoint. |
| Remote Domain | Fully qualified domain name of the upstream AI provider. |
| Remote Path | API path component of the request sent to the upstream provider. |
| Remote Status Code | HTTP status code returned by the upstream AI provider to the gateway. |
| Remote Response Time | Duration in milliseconds from the first byte sent to the provider to the last byte received from the provider. |
| Server SSL Error | Description of any SSL/TLS handshake error on the gateway-to-provider connection. |
Policy
| DISPLAY NAME | DESCRIPTION |
|---|---|
| Gateway Action | The final action taken by the gateway for this request: allow, monitor, block, or replace. |
| Gateway Action Reason | The reason for the action taken (e.g., policy match, rate limit exceeded, capacity overage, fallback). |
| Policy Type | The type of policy that was triggered: Access Control, DLP, or AI Security Guardrails. |
| Policy Name | The name of the specific policy rule that was triggered. |
| Policy Action | The action defined in the triggered policy: allow, alert, block, or replace. |
| Policy Profiles | The profile(s) associated with the triggered policy (e.g., DLP profile name, guardrail profile). |
| Activity | Intended activity type for the request: Prompt/Response, Upload, Download, or Other. |
| Token Group | The token group that the API token used for this request belongs to (maps to user groups in gateway policy). |
| Custom Attributes | JSON object containing custom key-value attributes attached to the request for policy or classification purposes. |
Prompt & Response Content
| DISPLAY NAME | DESCRIPTION |
|---|---|
| Prompt Details | Array of JSON objects representing the prompt sent to the AI provider. Each object contains the role (system, user) and content. Limited to 2,000 characters. |
| Response Details | Array of JSON objects representing the response returned by the AI provider. Each object contains the role (assistant) and content or tool call. Limited to 2,000 characters. |
To learn more: AI Gateway