Web MD Open in Web MD

Good, the data settles it empirically. Key findings from your machine:

That's the crux: local scraping systematically under-counts exactly the non-Composer surfaces — and those can be the majority of spend (Tab fires on every keystroke pause; Apply runs a model on every accept).

What "non-Composer" actually breaks into

Surface Model Local file? Gateway (BYO) sees it? Admin API sees it?
Ask / chat frontier (Opus etc.) partial (isChat bubbles)
Cmd+K inline edit frontier ✗ (not stored)
Apply Cursor fast or frontier ⚠️ only if routed to your provider
Tab autocomplete Cursor proprietary fast never (Cursor-hosted)
Bugbot / background frontier ⚠️

The important gotcha — even the gateway has a blind spot here

For "someone directly doing Opus via Cmd+K or Ask," the gateway (BYO) does capture it — it's a frontier call on the wire, surface-agnostic. But Tab and Apply run on Cursor's own hosted fast models that you cannot BYO, so the gateway never sees them. If your org-cost picture silently drops Tab, you can be missing a large, invisible chunk of usage. This is the one place gateway ≠ complete.

So the ranking flips for non-Composer

  1. Admin API usage events is now clearly #1 — it's the only source that captures every surface, because each server-side billing event is tagged with a kind/feature dimension (chat, cmd-k, composer, apply, tab, bugbot) plus model, tokens, cache split, and cost. It's the only way to answer "how much is Opus-via-Cmd+K costing us org-wide" completely. No BYO. Post-hoc.
  2. Gateway (BYO) — great for the frontier-model surfaces (Ask, Cmd+K, Composer), gives you pre-send + cache truth, but blind to Tab/Apply. Use it alongside the Admin API, not instead of it.
  3. Local scraping — only Ask chat is partially there; don't rely on it for non-Composer.

Net recommendation

For non-Composer attribution specifically, lean on the Admin API usage-events kind dimension as the source of truth, and treat the gateway as the high-fidelity supplement for the frontier surfaces where you also want pre-send estimation. The one number to watch is the Tab/Apply share — it's the part that's invisible to every non-server approach, so if you skip the Admin API you won't even know how much you're missing.

Do you want me to pull together the exact Admin API usage-events request/response (including the kind/model/cache-token fields and how per-surface attribution comes back) so you can see whether its granularity is enough before deciding how much gateway you still need?