[Share feedback] API insights in public preview

[davidstaheli]

As a GitHub Enterprise Cloud organization owner, you and your designated users can now use API insights to visualize REST API activity for your entire organization or specific apps and users.

This new feature, currently in public preview, helps you understand the sources of your REST API activity and manage against your primary rate limits—giving you visibility into the timeframe, apps, and API endpoints involved.

Check out the changelog for more details and let us know what you think!

Important

Known issues

• Searching for users, apps, or REST API routes only matches the starting characters of their names.
• Currently, this feature supports only the core category of REST API endpoints and primary rate limits. API activity for search, for GitHub Actions (using GITHUB_TOKEN), and for secondary rate-limiting is not supported. For information about API categories, see "REST API endpoints for rate limits." To learn more about primary and secondary rate limits, see "Rate limits for the REST API."

Your feedback helps us improve—let us know your thoughts, suggestions, or any issues you encountered in the comments below! Thank you for contributing to our continuous improvement! ✨

[addersuk]

This is a great enhancement to GitHub to help expose the use of API tokens and how they are being used.

I have previously experienced issues with the GitHub Actions github-token being rate limted for repos, is there any plans to expose this tokens usage in this report?

[davidstaheli]

Thank you, @addersuk. Yes, this is an important scenario. We definitely want to show API activity for the Actions GITHUB_TOKEN. We didn’t include it initially because the data differs from typical app API activity. For example, at the bottom of the main API insights page, the listed GitHub Apps represent individual app installations within the current organization. Actions is also a GitHub App, but its installations are effectively per-repository rather than a single one for the organization. We’re considering ways to represent this clearly in the UI. We don't have a timeframe for it yet, but it's an important priority. Thanks for asking about it.

[stasostrovskyi]

Hi! I think this is a great feature to see how different GitHub apps and tokens are used! We have previously created our own app that gets a list of app credentials and just checks their rate-limit periodically and dumps it in prometheus. We will be happy if we don't need to maintain it anymore :) That said, the numbers on GitHub's new dashboard doesn't seem to add up. For example, we have an app used by backstage which pulls things from GitHub relatively often and on GitHub's new dashboards it shows that in last our backstage app did 33k REST API requests and was rate-limited 0 times. But rate-limit is 15k for GitHub Apps, right? On our own dashboards we see that the same app only does up to 5k requests per hour (at least those counted towards rate limit). It would be nice to see specifically amount of requests that go towards primary rate limit + the graph per user/app.

[astendal]

Appreciate this feature! I always have the same question when I see a new org-level feature... will we get this dashboard at the Enterprise level? 😄

[Mr-Wallet]

Very cool feature, but I'm having trouble understanding the data. My org says I've made 18 requests in the last 7 days, but during business hours I average more than 18 requests per hour. A few org members have 3-10k in the last 7 days which is the order of magnitude I would expect for most of my team... but mostly the numbers are showing sub-100. Most of these requests are done through an OAuth application but the application isn't showing up at the top of the list either.

[gazab]

This is awesome and very useful for us when trying to track down if/how tokens are used!

However, yesterday when I tried this feature I could see the NAMES of the (classic) tokens being used. Today, that feature is gone. I guess for security/privacy reasons? Unfortunately this makes this way less useful.

Is there any way the token names can come back? For example if I view the insights with the account that actually owns the tokens or something?

Edit: I just found you can see the names if you click on the details for each token but not in the overview like yesterday.

[taku333]

We are using this function.

This seems to be UTC time.
Can I change it to the browser's time?

[austinpray-mixpanel]

This is amazing! We use a prometheus exporter very similar to https://github.com/kalgurn/github-rate-limits-prometheus-exporter to get alerted when our github apps are at risk of running over rate limits.

1. Do y'all have a workflow in mind for getting alerted when apps attached to your org have anomalous traffic or are being rate limited?
2. What about GitHub actions tokens being rate limited? Like in "You have exceeded a secondary rate limit." fpicalausa/remove-stale-branches#22