Create customer-facing API

What we're after

Customers with the appropriate role will view usage data on the web through the new Console. That console will call out to a billing service API for data.

Hypothesized benefit(s)/why:

Customers need a way to monitor their usage.

• Customers of all sizes need to know if they are purchasing too much or too little Cloud.gov access. In particular, they need to know if they will run out of credits before their IAA PoP ends.
• Enterprise customers need the ability to allocate cost (in terms of credits) to their business units, which may be organized by organizations or spaces.

Security considerations

The API must be secured. Tentatively, the console oauth flow should request the usage.reader scope. No users currently have this scope; we should figure out how to grant it. That may also occur in the console. (Platform users can currently be granted a CF Billing Auditor scope, but I don't think Pages or Workshop customers can. As such, this should probably be a separate role.)

Notes for implementers

• The console will be the only consumer of this API to start. I suggest shaping it specifically to the console's needs.
• I suggest versioning the schema. billing.fr.cloud.gov/api/v1/ or similar. We may have a direct web interface for admin tasks, so I would use a path prefix like api/.

Related issues/sub-projects