Architecture

The data path

your application
      │
      ▼
Azure API Management  ──emits──▶  Log Analytics workspace
      │                              │
      ▼                              │  ApiManagementGatewayLogs
Azure OpenAI                         │  ApiManagementGatewayLlmLog
                                     │
                                     ▼
                          the workbook and queries
                          (run here, results stay here)

Metergrade appears nowhere in that diagram. The check is a set of queries you run against your own workspace; the kit is how you obtain them.

Why two tables

Neither table alone can answer what a workload cost.

ApiManagementGatewayLogs carries request identity — which API, which operation, which product and subscription, the response code and the timing. It does not know anything about models or tokens.

ApiManagementGatewayLlmLog carries the economics — model, deployment, prompt tokens, completion tokens. It identifies the request only by CorrelationId. It does not contain ApiId or OperationId.

So attribution — connecting consumption to an accountable workload — is a property of the join between them, on CorrelationId. Any query that tries to read an API identity directly from the LLM table does not return an empty result; it fails to resolve and does not run.

One row per request, not per log record

ApiManagementGatewayLlmLog does not emit one record per request. Request, response and streamed-chunk records are written separately under a single CorrelationId.

Counting records therefore overstates traffic — on a streaming-heavy estate, by a multiple — and summing token columns across those records double-counts any value reported more than once.

Every query in the kit collapses the table to one row per CorrelationId before it counts or sums anything. See Evidence rules for how a value is chosen when records disagree.

The boundary, stated precisely

• The queries read metadata: identity, status, timing, model, deployment and token counts.
• They never read RequestMessages, ResponseMessages, RequestBody or ResponseBody. Prompt and completion content is not touched, and a test in the kit's build enforces that rather than documenting it.
• Results render in your Azure portal. There is no egress.