Copy page

OpenAI

Enterprise Compliance Logs

Sync Type: Incremental

Overview

The OpenAI Enterprise Compliance Logs input collects compliance data from the ChatGPT Enterprise Compliance Logs Platform. Rather than polling individual event endpoints, the platform delivers immutable, time-windowed JSONL log files grouped by category — audit actions, user authentication, Codex usage, conversation messages, plugin activity, and more. This input lists the available log files for the categories you choose, downloads each one, and emits every event as an individual record for security monitoring, compliance reporting, and e-discovery.

It can collect logs for either a ChatGPT Enterprise workspace or an API Platform organization — chosen via the Source setting — and the set of available event types differs between the two.

Prerequisites

1. ChatGPT Enterprise (or Edu / Teachers) Workspace

• An active ChatGPT Enterprise, Edu, or Teachers workspace.
• Workspace Owner or Admin role to create a compliance API key and grant category scopes.

2. The source ID

• The Workspace ID (for the workspace source) or the Organization ID (for the organization source) whose logs you want to collect.

Compliance API Key Setup

1. Sign in as an Owner or Admin to the ChatGPT admin console.
2. Create a Compliance (Admin) API key scoped to the workspace or organization you want to collect from.
3. Grant the required log-category scopes for the event types you plan to collect (for example, audit, authentication, or Codex logs). A key only returns categories it is scoped for.
4. Copy and store the key securely — it cannot be retrieved again after creation.

For current access requirements, routes, schemas, and retention, the Admin API reference is the source of truth.

Configuration

Settings

Setting	Type	Required	Description
Source	one-of	Yes	Whether to collect for a Workspace or an Organization. Selecting a source reveals its ID field and its available Event Types.
— Workspace ID (Workspace source)	string	Yes	The ChatGPT Enterprise workspace ID whose compliance logs to collect.
— Organization ID (Organization source)	string	Yes	The API Platform organization ID whose compliance logs to collect.
— Event Types	array	Yes	One or more compliance log categories to collect. The available set depends on the source — see Event Types below.
Compliance API Key	string	Yes	Workspace- or organization-scoped Enterprise Compliance (admin) API key generated from the ChatGPT admin console.
Backfill Start Time	string	No	The date to start fetching data from. Defaults to the current time. Log files are retained for 30 days, so earlier start times are capped by retention.
API Rate Limit	object	No	Optional limit on the connector's outbound request rate to the source API. Leave blank to use the connector's default behavior. See API Rate Limiting for the field format, limits, and how to choose a value.

Event Types

Select one or more categories. Multiple categories are collected in a single request, and your key must be scoped for each category you select. The available categories depend on the selected Source.

Workspace source:

Value	Description
CONVERSATION_MESSAGE	Messages exchanged in conversations.
APP_LOG	Application activity logs.
APP_AUTH_LOG	Application authentication logs.
AUDIT_LOG	Admin and workspace audit actions.
AUTH_LOG	User authentication events.
CODEX_LOG	Codex usage activity.
CODEX_SECURITY_LOG	Codex security-related events.
CHATGPT_PLUGIN_SPREADSHEET	Spreadsheet plugin activity.
CHATGPT_PLUGIN_PRESENTATION	Presentation plugin activity.
CUSTOM_AGENTS_LOG	Custom agent activity.

Organization source:

Value	Description
APP_LOG	Application activity logs.
APP_AUTH_LOG	Application authentication logs.
COSTS	Organization cost and usage records.

Sample Record

Each event conforms to the shared Logs Platform envelope. Fields vary by category; common top-level fields are shown below.

Code
{
  "event_id": "07142cbd-9d44-8f98-f65d-e49c6345cc7b",
  "type": "AUDIT_LOG",
  "principal": {
    "id": "5023330c-91d2-1cdb-4f43-b90fabcbab04",
    "type": "CHATGPT_WORKSPACE"
  },
  "actor": {
    "type": "API_KEY",
    "redacted_id": "sk-...Xy9Z",
    "tracking_id": "key_d7afa6cd-345e-35df-63ca-6a8bd0bf694f",
    "user_id": "user-3d3dff4c-564a-5d67-9d92-b4d8d8c4e042",
    "user_email": "bob.williams@example.com"
  },
  "timestamp": "2026-09-05T10:36:06Z",
  "action_result": "FAILURE",
  "action_privilege": "MEMBER",
  "request_metadata": {
    "client_ip": "203.0.113.24",
    "client_ip_details": {
      "country": "",
      "city": "",
      "region": "",
      "region_code": "",
      "asn": "",
      "latitude": "",
      "longitude": ""
    },
    "client_user_agent": "monad-http-client/1.0",
    "client_ja3": "d41d8cd98f00b204e9800998ecf8427e",
    "client_ja4": "t13d1312h2_f57a46bbacb6_f50d94e863eb",
    "destination_hostname": "api.chatgpt.com"
  },
  "action_data": {
    "log_file_id": "eclf_59d2506e-6e75-4547-ca39-2e020c81e52b",
    "event_type": "AUDIT_LOG"
  },
  "action": "DOWNLOAD_WORKSPACE_LOG_FILE"
}

Troubleshooting

Common Issues

1. Authentication Errors (401 / 403)

   • Confirm the Compliance API Key is an Enterprise Compliance (admin) key scoped to the same source you selected (workspace key for a Workspace source, organization key for an Organization source), not a standard OpenAI API key.
   • Verify the key has not been revoked or rotated in the ChatGPT admin console.

2. A Selected Event Type Returns Nothing

   • A key only returns categories it is scoped for. If one event type stays empty while others produce data, ask an Owner/Admin to grant that log-category scope to the key.

3. 404 / Source Not Found on the List Endpoint

   • Check the Workspace ID or Organization ID (whichever matches the selected source) for typos or extra whitespace. It must be the ID of a workspace or organization the key can access, and it must match the source type you chose.

4. Missing Older Data / 30-Day Retention

   • The Compliance Logs Platform retains log files for 30 days only. A Backfill Start Time earlier than 30 days ago cannot recover data that has already aged out.
   • If a pipeline is paused for longer than the retention window, files from before it resumes will have expired. The connector logs a warning and skips any log file that returns 404 (expired/removed) so ingestion continues rather than stalling.
   • For longer retention, ingest continuously and retain the records in your own store per your policy.

5. Duplicate Records

   • The platform delivers at least once, so the same event can appear in more than one file. Each record is keyed on its stable event_id, so duplicates can be de-duplicated downstream. This is expected behavior.

6. Empty Incremental Syncs

   • Progress is tracked by the file window close time (last_end_time). If no new log files have been written since the last run, no records are emitted — this is expected.

7. Rate Limiting (429)

   • The connector backs off and retries automatically. If you still see sustained throttling, lower the optional API Rate Limit to stay under the account's limit.

Related Articles

• OpenAI Compliance Platform for Enterprise and Edu Customers
• Compliance API and audit events (ChatGPT Learn)
• Admin API reference

Sync frequency

By default this input polls approximately every 10 seconds, with each sync beginning after the previous one completes. A cron schedule configured on the pipeline overrides this cadence. See Input Sync Frequency for details.