Requires an authenticated provider service-account API credential, the provider-only agentUsageData flag (default off), and a delegated user: an x-bobsled-delegated-user assertion naming the human the agent acts for. Access requires that user to have Usage page access: Bobsled staff, or a provider owner with usageInMenu; storage additionally requires usageStorageSection (staff bypass); exclusions require usageMacExclusion (no staff bypass). Calls without a valid delegated user are refused; service-account permissions never substitute. Every result belongs to the authenticated provider in this deployment. Defaults to the latest available provider month (storage defaults to the current UTC month). Date bounds are inclusive. A start-only range newer than available data returns an empty page; explicitly reversed bounds are rejected. Pagination is applied after exact totals. MAC and transfer analytics refresh daily at 14:00 UTC; storage is measured every 24 hours; a null analyticsUpdatedAt means the last successful refresh is unknown. Current pricing applies to provider-only monthly quantities; MAC counts are deduplicated across providers at environment level, so provider counts and estimates are not additive billing totals. Transfers use GiB (1,073,741,824 bytes); storage pricing uses decimal TB (1,000,000,000,000 bytes). Costs preserve unrounded UI calculations. Exclusions are inert and hidden when usageMacExclusion is disabled. Storage returns daily point-in-time gauges; monthlyRunRateUsd applies the TB-month tariff to that snapshot, not daily billed spend. Use the latest snapshot, never sum snapshots or monthly run rates as consumption. A 403 denies current access; a 503 means data is unavailable, not zero.