Flat ~2,000 API requests/day baseline on Cloud with almost no app traffic — what generates it?

Setup

Directus Cloud, used purely as a headless CMS for a mobile app. The app never talks to Directus directly — it goes through a Supabase Edge Function that proxies a handful of read-only routes. There are no scheduled flows (one manual flow only), no webhooks, and a handful of test users.

What I’m seeing

The API request average sits at ~2,400/day and barely moves. The important part: the baseline is ~2,000/day even on days nobody opens the app, including weekends. I know this as we’re currently in dev and only I’m using the app. That’s a flat ~1.4 requests/minute — the shape of something on a fixed interval, not of people using an app.

What I changed (and why it should have been visible)

Over the last week I did a lot of work specifically to cut Directus requests:

  • a response cache in front of the proxy (15-minute TTL), so repeated app requests don’t reach Directus at all
  • inlined M2M relations into the list query, so one item no longer costs several follow-up requests
  • one grouped query per collection instead of one per (category × collection) — 36 requests down to 6
  • moved all images to a CDN pull zone in front of /assets, and all video/audio off Directus entirely

The app’s own Directus traffic should have dropped by roughly an order of magnitude. The graph didn’t change at all. That’s what makes me think the baseline was never my app.

What I’ve already ruled out

  • The cache is healthy — zero read/write failures in my logs over 7 days.
  • No scheduled flows, no webhooks.
  • directus_activity doesn’t help: it records writes and logins, not reads, so the GET traffic I’m chasing is invisible in it.
  • Nothing on my side polls: no cron, no timers, no database webhooks, and the proxy function is invoke-only — it makes zero requests when idle.

Questions

  1. Do the platform’s own automated health checks count toward my billed API requests, and at what interval? A 60-second check is 1,440/day, a 30-second one 2,880/day — either would explain most of my baseline.
  2. Do rejected requests count? My instance is publicly reachable (/admin/login and /server/info return 200, /items/… returns 403 unauthenticated), so I assume crawlers find it. Does a 403 still count as a billed request?
  3. Do /assets requests count as API requests? Relevant to whether the CDN move should have shown up at all.
  4. Does an idle Directus Studio tab poll? If so, roughly how often?
  5. Is there any way on Cloud to see the request mix — by endpoint, IP or user-agent — without paid support? That would answer this in one look.

Happy to share exact timestamps or a graph screenshot if useful.

Thanks and best regards