Who's actually calling your API? Caller leaderboards and CSV export

“Who's actually using this API?” is a question most teams answer by grepping logs during an incident. It shouldn't be. Once requests are flowing into WhoHitsMyAPI (see the middleware guide if you haven't wired that up yet), two features answer it directly: the caller leaderboard on your dashboard, and a CSV/JSON export you can pull into a spreadsheet or your own BI tool.

How a “caller” is identified

Every ingested request is attributed to a caller using the first identity signal available: the callerId you pass in from your middleware (an API key name, a customer ID, whatever identifies the integration on your side) if present, otherwise the raw IP address, otherwise it's logged as unknown. That fallback chain matters — it's how the leaderboard stays useful even before every client sends acallerId: unauthenticated or pre-integration traffic still shows up, just grouped by IP instead of a name.

The dashboard leaderboard

The Top Callers panel on your dashboard ranks callers by request count over your selected window. Free plan accounts see up to 7 days of history; Pro extends that to 90 days, which is usually the difference between “who hit us yesterday” and “which integration has been quietly climbing for two months.” It sits right next to the Top Endpoints panel, so you can see both which routes get hit hardest and who's hitting them, without cross-referencing two different views.

This is also the fastest way to eyeball the abuse patterns covered in our anomaly-detection post: a caller you don't recognize sitting at the top of the leaderboard is usually the fastest lead when an ip_flood alert fires.

Exporting the raw data (Pro)

The dashboard is for a quick look; the export endpoint is for everything else — feeding a spreadsheet, a data warehouse, or a one-off investigation that needs row-level detail the aggregated leaderboard doesn't show. It's a single authenticated GET, defaults to CSV, and switches to JSON with one query param:

# CSV (default) — up to 90 days, 50,000 rows
curl -H "Authorization: Bearer $SUPABASE_ACCESS_TOKEN" \
  "https://whohitsmyapi.veridux.ai/api/analytics/export?days=30" \
  -o requests.csv

# JSON, scoped to one API key
curl -H "Authorization: Bearer $SUPABASE_ACCESS_TOKEN" \
  "https://whohitsmyapi.veridux.ai/api/analytics/export?format=json&keyId=$KEY_ID"

# Each row: timestamp, endpoint, method, caller_ip, caller_id, status_code, latency_ms

A few details worth knowing before you script against it: the CSV writer properly quotes and escapes values containing commas, quotes, or newlines (so an endpoint path or user-agent string with a stray comma won't silently shift your columns), the export is capped at 50,000 rows per request so it stays fast, andkeyId ownership is verified server-side — passing someone else's key ID just 404s rather than leaking their data.

When to use which

Leaderboard for a quick “who's active right now” glance during standup or an incident. Export when you need to hand raw numbers to someone else, backfill a dashboard in a different tool, or keep a monthly archive of caller activity outside WhoHitsMyAPI's own retention window. Both read from the exact same underlying request log, so the numbers always agree — no separate reporting pipeline to keep in sync.

Both the leaderboard and export are live features today, not a roadmap item — if you're already sending requests through/api/ingest, they're on your dashboard right now.