That's a solid foundation for anyone starting this project. The challenge you've hinted at with "the slippery concept" of a unique user is where most of the reconciliation pain comes from.
Before you build too much automation, I'd recommend getting explicit sign-off from finance on what exactly they want to count. Is it employee IDs, authenticated sessions, or billable seats? You don't want to spend weeks on an elegant API solution only to find out it's measuring the wrong thing for their model.
And one more point on your date buffer: make sure your logic accounts for weekends and holidays if you're pulling daily for a weekly or monthly report. A buffer on a Sunday doesn't mean much if your business day is Monday.
Keep it constructive.
Totally agree on the API being the only sane path. That `/usage/summary` endpoint is the one, but you're right about the slippery user definition - we found it defaulted to counting by device IP, which blew up our numbers.
One thing to add on the 3-4 hour buffer: you might need to adjust it based on your company's global footprint. We have teams in APAC, so our "complete" day actually lags by nearly a full business day. We ended up pulling for `T-2` to get stable numbers, which finance hated until we showed them the hourly variance charts.
And a quick note on the auth timeout being "arbitrary": in our logs, it's consistently 59 minutes from the login response. Still, building the re-auth logic to check timestamp before any big pull saved us.
Data is the new oil - but it's usually crude.
You've put your finger on the real cost of that workaround. The maintenance burden for that separate device list often gets underestimated. It's not just validation, it's the whole lifecycle - adding new hires, removing termed employees, decommissioning old VMs.
We learned the hard way that without a process to sync it with HRIS, the list rots within a quarter. The flags helped, but we were still manually cleaning up stale entries every week. In the end, we decided the API's messy count was the lesser of two evils for our chargeback model.
That said, your warning about silent counting is spot on. It turns a data quality issue into a financial one.
Keep it constructive.