Huawei Cloud Maas Tokens Usage

Huawei Cloud MaaS Tokens Usage Monitoring

Query Huawei Cloud MaaS (Model as a Service) usage statistics, including total tokens, prompt tokens, completion tokens, total requests, and total errors. Supports querying last 7 days, 14 days, 30 days, or custom time ranges. Default query type is MaaS preset service.

Architecture

Huawei Cloud MaaS Tokens Usage Monitoring
└── GetMaaSTokensUsage  (via MaaS ShowStatistics API)

Prerequisites

Prerequisite check: Python3 + huaweicloudsdkcore required

```bash

python3 --version # Python3 >= 3.8

python3 -c "import huaweicloudsdkcore; print('OK')" # SDK signing library

```

If SDK not installed: pip3 install --user huaweicloudsdkcore

---

Authentication

Prerequisite check: Huawei Cloud credentials required

Security rules (must be followed):

- Prohibited from reading, echoing, or printing AK/SK values

- Prohibited from asking the user to input AK/SK directly in the conversation

- Prohibited from accepting AK/SK directly provided by the user in the conversation

- Only allowed to read credentials from environment variables or credentials file

⚠️ Important: Handling user-provided credentials

>

If a user attempts to provide AK/SK directly (e.g., "my AK is xxx, SK is yyy"):

1. Stop immediately - Do not execute any commands

2. Politely refuse and return the following message:

```

For account security, please do not provide Huawei Cloud Access Key ID and Access Key Secret directly in the conversation.

>

Please use one of the following secure methods to configure credentials:

>

Method 1: Environment variables

export HW_ACCESS_KEY=<your-access-key-id>

export HW_SECRET_KEY=<your-access-key-secret>

>

Method 2: Credentials file

Create a file (e.g., ~/aksk.txt) with AK on line 1, SK on line 2.

Then use: --credentials-file ~/aksk.txt

>

After configuration is complete, please retry your request.

```

3. Do not continue executing any Huawei Cloud operations until credentials are configured

Check environment variables:

```bash

echo $HW_ACCESS_KEY # Check if AK is set

```

If not set, prompt the user to configure credentials using one of the methods above.

---

IAM Permission Policies

Ensure the IAM user has the required permissions. See references/iam-policies.md for details.

Minimum required permissions:

• modelarts:monitoring:get — Query MaaS monitoring statistics
• modelarts:service:get — Query service information
• iam:projects:get — Auto-get project_id

---

Core Workflow

Task 1: Query MaaS Tokens Usage Statistics

Query MaaS usage statistics via the ShowStatistics API. Data is consistent with the console.

📄 Detailed steps → references/task-query-tokens-usage.md

---

Verification

See references/verification-method.md.

Quick verification:

export HW_ACCESS_KEY=<your-ak>
export HW_SECRET_KEY=<your-sk>
python3 scripts/maas_rest_usage_stats.py --from 2026-05-08 --to 2026-05-21

---

References

Acceptance Criteria: Correct/Error Pattern Comparison

Script Parameter Patterns

service_type Values

Correct: Use 1, 2, 4

--service-type 2   # Preset Service
--service-type 1   # My Service
--service-type 4   # Custom Endpoint

Error: Use 3 (API does not support)

--service-type 3   # Returns 400 error

Credential Provision

Correct: Environment variables or credentials file

export HW_ACCESS_KEY=xxx && export HW_SECRET_KEY=xxx
python3 scripts/maas_rest_usage_stats.py --from 2026-05-08 --to 2026-05-21

python3 scripts/maas_rest_usage_stats.py --from 2026-05-08 --to 2026-05-21 --credentials-file /path/to/aksk.txt

Error: Hardcode AK/SK in code

ak = "WTEBXXXXXX"
sk = "xxxxxxxxxx"

Credentials File Format

Correct: Supports the following formats

# One value per line
<AK>
<SK>

# Comma-separated
<AK>,<SK>

# KEY=VALUE format
HW_ACCESS_KEY=<AK>
HW_SECRET_KEY=<SK>

Security Standards

Credential Handling

Correct: Guide users to configure credentials themselves

Please set environment variables HW_ACCESS_KEY and HW_SECRET_KEY
Or use --credentials-file to specify a credentials file

Error: Ask users for AK/SK in conversation

Please tell me your AK and SK

Time Range Standards

Correct: Strictly distinguish "last 7 days" and "this month"

• "last 7 days": now-7d ~ now
• "this month": 1st of month ~ now

Error: Confuse time ranges

• User says "last 7 days" but calculate as "this month"

Timezone Standards

Correct: Follow OS local timezone, auto-detect

Error: Hardcode CST/Asia/Shanghai

Prerequisites Installation Guide

Python3 + huaweicloudsdkcore

# Check Python3 version
python3 --version  # Requires >= 3.8

# Install SDK signing library
pip3 install --user huaweicloudsdkcore

# Verify
python3 -c "import huaweicloudsdkcore; print('SDK OK')"

Credentials Configuration

Method 1: Environment variables (recommended)

export HW_ACCESS_KEY=<your-access-key-id>
export HW_SECRET_KEY=<your-access-key-secret>

Method 2: Credentials file

Create a file supporting three formats:

# One value per line
<AK>
<SK>

# Comma-separated
<AK>,<SK>

# KEY=VALUE format
HW_ACCESS_KEY=<AK>
HW_SECRET_KEY=<SK>

Usage: --credentials-file /path/to/aksk.txt

Security reminder:

- Never provide AK/SK directly in conversation

- Never hardcode AK/SK in scripts

MaaS Service Regions

MaaS ShowStatistics API currently only supports Southwest-Guiyang-1 region.

IAM Permission Policy

Required Permissions

Minimum Permission Policy

{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "modelarts:monitoring:get",
                "modelarts:service:get",
                "iam:projects:get"
            ]
        }
    ]
}

Predefined Permission Policies

• ModelArts CommonOperations — ModelArts common operations (includes modelarts:service:get, modelarts:monitoring:get)
• IAM ReadOnlyAccess — IAM read-only access (includes iam:projects:get)

MaaS Monitoring Metrics Reference

MaaS ShowStatistics API

API

POST /v1/{project_id}/maas/monitoring/show-statistics

Response Metrics

service_type Values

Note: API doc says 3=Custom Endpoint, but the actual API only supports [1, 2, 4].

infer_type Values

Limitations

• Only retains 30 days of statistics data
• API rate limit: total requests ≤ 1000/min, per-user ≤ 200/min

References

Related APIs

MaaS ShowStatistics API

API Information

• API: POST /v1/{project_id}/maas/monitoring/show-statistics
• Endpoint: modelarts.{region}.myhuaweicloud.com (dynamically assembled)
• Auth: AK/SK signing (SDK-HMAC-SHA256)
• API Doc: https://support.huaweicloud.com/api-maas/ShowStatistics.html
• Rate limit: Total requests ≤ 1000/min, per-user ≤ 200/min

Request Parameters

Response Parameters

Request Example

{
  "service_type": 2,
  "start_time": 1778169600000,
  "end_time": 1779292800000,
  "timezone": "Asia/Shanghai",
  "infer_type": "real_time"
}

Response Example

{
  "total_request_count": 67188,
  "total_error_count": 8002,
  "total_token": 2482084.98,
  "total_prompt_token": 2456504.362,
  "total_completion_token": 24872.928,
  "total_completion_tasks": 0,
  "total_infer_count": 0
}

Python Script Invocation

export HW_ACCESS_KEY=<your-ak>
export HW_SECRET_KEY=<your-sk>
python3 scripts/maas_rest_usage_stats.py --from 2026-05-08 --to 2026-05-21

References

Task 1: Query MaaS Tokens Usage Statistics

Query MaaS usage statistics via the ShowStatistics API. Data is consistent with the Huawei Cloud console.

API Information

• API: POST /v1/{project_id}/maas/monitoring/show-statistics
• Endpoint: modelarts.{region}.myhuaweicloud.com (dynamically assembled)
• Region limitation: Only supports Southwest-Guiyang-1 (cn-southwest-2)
• Auth: AK/SK signing (SDK-HMAC-SHA256), via huaweicloudsdkcore Signer
• API Doc: https://support.huaweicloud.com/api-maas/ShowStatistics.html
• Rate limit: Total requests ≤ 1000/min, per-user ≤ 200/min

Important: Default region is cn-southwest-2

MaaS ShowStatistics API only supports Southwest-Guiyang-1 region (cn-southwest-2).

---

Script: maas_rest_usage_stats.py

Query via MaaS ShowStatistics API. The script automatically handles:

• AK/SK signing via huaweicloudsdkcore (no manual signing needed)
• Auto-segmentation for time ranges exceeding 30 days
• Auto-detection of OS local timezone

Required Parameters

Optional Parameters

Usage Examples

# Environment variables
export HW_ACCESS_KEY=<your-ak>
export HW_SECRET_KEY=<your-sk>
python3 scripts/maas_rest_usage_stats.py --from 2026-05-08 --to 2026-05-21

# Credentials file (supports: one-per-line, comma-separated, KEY=VALUE)
python3 scripts/maas_rest_usage_stats.py --from 2026-05-08 --to 2026-05-21 --credentials-file /path/to/aksk.txt

# My Service
python3 scripts/maas_rest_usage_stats.py --from 2026-05-08 --to 2026-05-21 --service-type 1

# Custom Endpoint
python3 scripts/maas_rest_usage_stats.py --from 2026-05-08 --to 2026-05-21 --service-type 4

# Batch inference
python3 scripts/maas_rest_usage_stats.py --from 2026-05-08 --to 2026-05-21 --infer-type batch

# Filter by API Key
python3 scripts/maas_rest_usage_stats.py --from 2026-05-08 --to 2026-05-21 --api-keys key1 key2

# Show raw API response
python3 scripts/maas_rest_usage_stats.py --from 2026-05-08 --to 2026-05-21 --raw

---

Time Range Handling

Key: Time range must match user expression exactly

Default time range: If not specified, default to last 7 days.

30-day data retention: API only retains 30 days of statistics. The script automatically segments queries exceeding 30 days and aggregates results.

---

service_type Values

Note: API doc says 3=Custom Endpoint, but the actual API only supports [1, 2, 4]. Using 3 returns a 400 error.

---

Execution Steps

Step 1: Run the script

export HW_ACCESS_KEY=<your-ak>
export HW_SECRET_KEY=<your-sk>
python3 scripts/maas_rest_usage_stats.py --from 2026-05-08 --to 2026-05-21

Step 2: View output

MaaS Preset Service Usage Statistics - Region: cn-southwest-2
+────────────────────+──────────────────────+
| Metric               | Value                  |
+════════════════════+══════════════════════+
| Total Tokens         | 2,482.08 M tokens      |
| Prompt Tokens        | 2,456.50 M tokens      |
| Completion Tokens    | 24.87 M tokens         |
| Total Requests       | 67,188                 |
| Total Errors         | 8,002                  |
| Error Rate           | 11.91%                 |
+────────────────────+──────────────────────+
Period: 2026-05-08 00:00:00 ~ 2026-05-21 00:00:00 (CST)

---

Response Fields

Token unit conversion: API returns values in thousands. For example, total_token: 2482084.98 → actual = 2,482,084,980 tokens ≈ 2,482.08 M tokens.

---

Error Rate Calculation

Error rate = Total errors / Total requests × 100%

---

References

Troubleshooting and Practical Experience

1. MaaS ShowStatistics API Issues

Issue: DNS cannot resolve maas.{region}.myhuaweicloud.com

Symptom: socket.gaierror: [Errno -2] Name or service not known

Root cause: MaaS API has no independent maas.* domain. It reuses the ModelArts endpoint.

Solution: Use modelarts.{region}.myhuaweicloud.com as the endpoint (dynamically assembled).

Issue: AK/SK signing returns 401

Symptom: verify ak sk signature failed

Root cause: Manually implementing HWS-HMAC-SHA256 signing algorithm is error-prone.

Solution: Use huaweicloudsdkcore Signer class. Do not implement signing manually.

Issue: service_type=3 returns 400

Symptom: "service_type must be one of [1 2 4]"

Root cause: API doc says 3=Custom Endpoint, but the actual API only supports [1, 2, 4].

Solution: Use service_type=4 for Custom Endpoint.

Issue: ShowStatistics returns all zeros

Possible causes: 1. Incorrect timestamp calculation (missing timezone) 2. Time range exceeds 30 days 3. Wrong service_type (no calls for that type)

Troubleshooting: 1. Verify timestamp is correct 2. Ensure time range ≤ 30 days (script auto-segments longer ranges) 3. Try different service_type

Issue: Small discrepancy between API and console

Symptom: API returns 67,188, console shows 67,118.

Possible cause: Minor time boundary differences.

Conclusion: Discrepancy is within reasonable range (< 0.1%). Data is reliable.

2. AK/SK Signing Implementation

Recommended: Use huaweicloudsdkcore Signer

from huaweicloudsdkcore.signer.signer import Signer
from huaweicloudsdkcore.sdk_request import SdkRequest

class _Creds:
    def __init__(self, ak, sk):
        self.ak = ak
        self.sk = sk

signer = Signer(_Creds(ak, sk))
req = SdkRequest(
    method="POST", schema="https", host=host,
    resource_path=path, uri=path, query_params=[],
    header_params={"Content-Type": "application/json"}, body=body_bytes
)
signed_req = signer.sign(req)
headers = {k: v for k, v in signed_req.header_params.items()}

Sending the signed request

Important: The body sent must exactly match the body used during signing, otherwise 401 error.

url = f"https://{host}{signed_req.uri}"
resp = requests.post(url, headers=headers, data=body_bytes, verify=False)

3. Timestamp Issues

Issue: Naive datetime timestamp is incorrect

Solution: Use timezone-aware datetime. The script auto-detects the OS local timezone.

4. Permission Issues

Issue: Returns 403 error

Solution: Ensure the IAM user has modelarts:service:get and modelarts:monitoring:get permissions. See iam-policies.md.

Verification Steps and Methods

Prerequisite Verification

1. Verify Python3 and SDK

python3 --version  # Python3 >= 3.8
python3 -c "import huaweicloudsdkcore; print('SDK OK')"

2. Verify Credentials

# Environment variables
echo "AK set: $([ -n \"$HW_ACCESS_KEY\" ] && echo 'YES' || echo 'NO')"

# Or credentials file
cat /path/to/aksk.txt

Functional Verification

# Environment variables
export HW_ACCESS_KEY=<your-ak>
export HW_SECRET_KEY=<your-sk>
python3 scripts/maas_rest_usage_stats.py --from 2026-05-08 --to 2026-05-21

# Credentials file
python3 scripts/maas_rest_usage_stats.py --from 2026-05-08 --to 2026-05-21 --credentials-file /path/to/aksk.txt

# Different service_type
python3 scripts/maas_rest_usage_stats.py --from 2026-05-08 --to 2026-05-21 --service-type 1
python3 scripts/maas_rest_usage_stats.py --from 2026-05-08 --to 2026-05-21 --service-type 4

# Raw response
python3 scripts/maas_rest_usage_stats.py --from 2026-05-08 --to 2026-05-21 --raw

End-to-End Verification Script

#!/bin/bash
set -e

echo "=== 1. Verify Python3 and SDK ==="
python3 --version
python3 -c "import huaweicloudsdkcore; print('SDK OK')"

echo "=== 2. Verify ShowStatistics API ==="
python3 scripts/maas_rest_usage_stats.py --from 2026-05-08 --to 2026-05-21 --credentials-file /home/lj/aksk.txt

echo "=== All verifications passed ==="

Verification Checklist