Skip to main content

Enterprise Audit Logs

Sync Type: Incremental

Overview​

The OpenAI Enterprise Audit Logs input continuously monitors and retrieves comprehensive audit logs from your OpenAI organization. It captures critical security events including API key lifecycle management, user authentication activities, project modifications, service account changes, and organizational configuration updates. This integration enables real-time security monitoring, compliance reporting, and forensic analysis of your OpenAI infrastructure.

Prerequisites​

1. OpenAI Organization Access​

  • Active OpenAI organization account with administrative privileges
  • Organization Owner role required for audit log configuration.

2. Enable Audit Logging in Organization Settings​

⚠️ Important: Once enabled, audit logging cannot be disabled for security reasons.

Admin API Key Setup​

  1. Access Settings

    • From the OpenAI platform home page, click the Settings icon in the top-right corner.

  2. Navigate to Admin Keys

    • In the left navigation panel, select Admin Keys.

  3. Create New Key

    • Click the Create new admin key button in the top-right.

  4. Configure Key Settings

    • Name: Provide a descriptive name (e.g., "Audit Logs Integration").

    • Permissions: Choose one of the following:

      • Select Restricted.
      • Under Audit Logs Scope, set permission to Read.
      • This creates a read-only key specifically for audit log access.
      • Select All for unrestricted access.
      • ⚠️ Security Risk: Grants broad administrative permissions.

  5. Save and Store Key

    • Copy the generated API key immediately.
    • Store it securely - it cannot be retrieved later if lost.

Configuration​

Settings​

SettingTypeRequiredDescription
Backfill Start TimestringNoThe date to start fetching data from. If not specified, no past records will be fetched.

Secrets​

SecretTypeRequiredDescription
API KeystringtrueAdmin API key with audit log read permissions

Sample Record​

{
  "object": "organization.audit_log",
  "id": "audit_log-25bf005e-f060-10c3-a3cc-e4f43e6479af",
  "type": "login.succeeded",
  "effective_at": 1753089116,
  "actor": {
    "type": "session",
    "session": {
      "user": {
        "id": "user-4d29451a-aa8d-5d0b-4e4b-98d756768c0c",
        "email": "Alice Smith@monad.com"
      },
      "ip_address": "0.0.0.0",
      "user_agent": "Mozilla/5.0",
      "ja3": "ea2b6f8c-cc9a-35ec-2314-4a2595477b83",
      "ja4": "cfab795b-6c89-0820-2b27-ff70e63a8384",
      "ip_address_details": {
        "country": "USA",
        "city": "Austin",
        "region": "Texas",
        "region_code": "TX",
        "asn": "",
        "latitude": "30.2672",
        "longitude": "97.7431"
      }
    }
  }
}