Analytics & Reports
What this screen is for
Analytics & Reports on the platform plane holds the same eight reports a tenant sees, Key Health Summary, Expiration Report, Algorithm Usage, Most Used Keys, Migration Candidates, Component Distribution, Keys by Component and Usage Limits, computed over the keys of every tenant of the installation together. Each report is computed when its tab is opened. How each figure is derived, which population each report counts and where the labels overstate are the same as on the tenant screen and are described there:
Nothing here changes anything. What you choose is which report to read, its horizon or size where it has one, and whether to download the two reports that offer a CSV file.
What must exist first
The screen is offered in system context only; opening it while a tenant is assumed takes you to that tenant's own Analytics & Reports. Its navigation entry appears for anyone holding the platform permission to read analytics, which is also the one permission every report and both exports need; the server additionally refuses a caller whose token is not the platform's.
Decisions you make here
Knowing whose keys a report counts
Every report counts the keys of every tenant that has not been deleted, whatever the tenant's status, and within each tenant the same keys the tenant's own report counts: those with current material that were not deleted. The two populations under Total Keys are the same as on the tenant plane: Key Health Summary, Most Used Keys and Usage Limits count keys in every lifecycle state; Algorithm Usage and Migration Candidates count ACTIVE keys only.
A row names a key by its identifier and says nothing about which tenant owns it: no report on this screen carries a tenant column, and the server does not send one. To act on a key listed here, find it by identifier on the owning tenant's Key Inventory.
Reading the two counters across tenants
Total Cryptographic Operations, on Key Health Summary and on Most Used Keys, is marked as measured over all time and is the sum of each key's current material counter across every tenant; a rotation in any tenant starts that key's counter again at zero and lowers the figure. The Show top ranking of Most Used Keys is by that same counter across tenants, 10 by default and at most 100, applied when you press the refresh button; Export CSV uses the last applied value.
Setting the expiration horizon
Threshold days is 360 by default and at least 1, applied with Generate Report, and Action Required counts every listed key across every tenant, so a key expiring in eleven months in any tenant is counted as requiring action.
Reading an empty report
A report that could not be read is replaced by its own error and a Retry; the other tabs are unaffected. When Most Used Keys has no rows it says No usage data available; unlike the tenant screen it offers no link to an audit log, because there is no single tenant whose trail would answer.
How it relates to other screens
The keys listed here are managed on each tenant's Key Inventory, reached by assuming that tenant; expiration dates and usage limits are set on the key itself there:
A tenant administrator sees the same reports over one tenant on the tenant's own screen:
The algorithms that count as carrying quantum debt for Migration Candidates and Algorithm Usage are fixed by the platform's algorithm classification, not by any policy; what a key may rotate to is decided by the algorithm and rotation policies: