← Cloudflare AI Gateway / ai-gateway / observability

User Insights

The User Insights dashboard shows how much your organization spends on AI, which identities are responsible for that spend, and which users deviate from their typical usage. It uses the traffic already flowing through your gateway, so there is no additional setup.

User Insights is available to all AI Gateway customers at no additional cost and works on any traffic through your gateway. Without an identity or custom metadata on your requests, all usage is grouped under a single anonymous identifier, and User Insights cannot distinguish between individual users.

To attribute usage to individual users, add a user identifier with custom metadata, or put your gateway behind Cloudflare Access. With Access, each authenticated request carries a verified identity you can filter spend and analytics by.

At the top of the User Insights page, you can view the following organization-wide metrics for the selected time range:

• Active users: Identities with gateway usage.
• Total requests: Gateway requests in this range.
• Adoption rate: IdP identities with at least one request.
• Tokens per active user: Median over this time range.
• Median spend / active user: Observed spend per attributed identity.
• Top 10% request activity: Share of attributed requests made by the most active users.
• Users to review: Users whose cost is at least 2x the median spend.
• Identity coverage: Share of requests attributed to users.

User Insights baselines each user's normal usage and flags sessions that fall outside it, which can indicate a compromised credential or a misbehaving agent.

Baselines are calculated per session, not per request. For each user, User Insights uses the 95th percentile (p95) session cost over the last 30 days. The baseline is rolling and updates as usage changes.

A session is flagged when it exceeds both of the following thresholds:

• Relative: More than 2x the user's own p95 session cost.
• Absolute: Above the organization-level p99 session cost across all users.

Both thresholds must be met. This avoids flagging small spikes from low-usage users and routine high-cost sessions from heavy users.

Flagged users appear in a filtered view with the sessions that triggered the flag and their cost. User Insights does not block requests.

Select a user to see their usage in detail:

• Spend: Total observed spend for the user in this range.
• Requests: Total gateway requests made by the user.
• Tokens: Total tokens consumed by the user.
• Gateway cached requests: Number of requests served from cache.
• Errored requests: Number of requests that returned an error.
• Cache hit rate: Share of requests served from cache.
• Sessions: Approximate session count from request metadata.
• Top model: The model the user sent the most requests to.
• Top provider: The provider the user sent the most requests to.
• Last seen: Most recent activity, from the daily spend trend.
• Active days: Number of days the user sent traffic in this range.
• Identity coverage: Share of the user's requests attributed to an identity.