Feature Request: admin API: allow `group_by[]=api_key_id` on the `cost_report` endpoint, i.e., enable reporting per-API-key cost

Admin API: allow group_by[]=api_key_id on the Cost Report endpoint

Summary

GET /v1/organizations/cost_report can only group by description and workspace_id. There is currently no way to retrieve accurate billed cost per API key through the public Admin API, even though Anthropic clearly computes this internally in the admin console's cost breakdown UI.

It would helpful to add api_key_id as an allowed group_by[] value on cost_report (ideally alongside model and token_type), returning the billed amount per key.

Current behavior

Per the docs, /v1/organizations/cost_report's group_by[] accepts only "description" (token type) or "workspace_id", so cost can be attributed to a workspace, but not to an individual API key within it. We could give each API key its own workspace but this is not the intended form factor for a workspace.

/v1/organizations/usage_report/messages does allow querying for token usage on a per-API-key level, and in many cases we can infer cost by multiple token usage by cost-per-token. However, I found recently that when I queried Opus 4.7 and the request got blocked, it would get logged as tokens in usage_report but not get logged as cost by cost_report. For work that can have a lot of blocked requests (e.g., research evaluating or testing model guardrails, and other kinds of AI safety work), relying on usage_reports will lead to significant over-estimates of cost (which indeed happened in my company where one API key's cost was over-reported by $2k).

The per-API-key cost data does exist internally — the admin console UI hits the endpoint https://platform.claude.com/api/organizations/<ORG_ID>/usage_cost?starting_on=2026-06-01&ending_before=2026-07-01&group_by=api_key_id and reports per-API-key cost. However I would like to track the costs programmatically so that I can set up alerts for API keys that are spending a lot of money, disable API keys that hit a cost threshold, etc. That endpoint needs a browser session key for authentication so it's not appropriate for programmatic access.

I recognize this is not the appropriate repo for this request since it's about the admin API, but I couldn't find a more suitable repo, and this repo has a related request in #276.