# Enterprise Compliance Logs

**Sync Type: Incremental**

## Overview

The OpenAI Enterprise Compliance Logs input collects compliance data from the ChatGPT Enterprise **Compliance Logs Platform**. Rather than polling individual event endpoints, the platform delivers immutable, time-windowed **JSONL** log files grouped by category — audit actions, user authentication, Codex usage, conversation messages, plugin activity, and more. This input lists the available log files for the categories you choose, downloads each one, and emits every event as an individual record for security monitoring, compliance reporting, and e-discovery.

It can collect logs for either a ChatGPT Enterprise **workspace** or an API Platform **organization** — chosen via the **Source** setting — and the set of available event types differs between the two.

## Prerequisites

### 1. ChatGPT Enterprise (or Edu / Teachers) Workspace
- An active ChatGPT Enterprise, Edu, or Teachers workspace.
- Workspace **Owner** or **Admin** role to create a compliance API key and grant category scopes.

### 2. The source ID
- The **Workspace ID** (for the workspace source) or the **Organization ID** (for the organization source) whose logs you want to collect.

## Compliance API Key Setup

1. **Sign in as an Owner or Admin** to the ChatGPT admin console.
2. **Create a Compliance (Admin) API key** scoped to the workspace or organization you want to collect from.
3. **Grant the required log-category scopes** for the event types you plan to collect (for example, audit, authentication, or Codex logs). A key only returns categories it is scoped for.
4. **Copy and store the key securely** — it cannot be retrieved again after creation.

For current access requirements, routes, schemas, and retention, the [Admin API reference](https://chatgpt.com/public/admin/api-reference) is the source of truth.

## Configuration

### Settings

| Setting | Type | Required | Description |
|---------|------|----------|-------------|
| Source | one-of | Yes | Whether to collect for a **Workspace** or an **Organization**. Selecting a source reveals its ID field and its available Event Types. |
| — Workspace ID *(Workspace source)* | string | Yes | The ChatGPT Enterprise workspace ID whose compliance logs to collect. |
| — Organization ID *(Organization source)* | string | Yes | The API Platform organization ID whose compliance logs to collect. |
| — Event Types | array | Yes | One or more compliance log categories to collect. The available set depends on the source — see [Event Types](#event-types) below. |
| Compliance API Key | string | Yes | Workspace- or organization-scoped Enterprise Compliance (admin) API key generated from the ChatGPT admin console. |
| Backfill Start Time | string | No | The date to start fetching data from. Defaults to the current time. Log files are retained for 30 days, so earlier start times are capped by retention. |
| API Rate Limit | object | No | Optional limit on the connector's outbound request rate to the source API. Leave blank to use the connector's default behavior. See [API Rate Limiting](../../guides/rate-limiting) for the field format, limits, and how to choose a value. |

### Event Types

Select one or more categories. Multiple categories are collected in a single request, and your key must be scoped for each category you select. **The available categories depend on the selected Source.**

**Workspace source:**

| Value | Description |
|-------|-------------|
| `CONVERSATION_MESSAGE` | Messages exchanged in conversations. |
| `APP_LOG` | Application activity logs. |
| `APP_AUTH_LOG` | Application authentication logs. |
| `AUDIT_LOG` | Admin and workspace audit actions. |
| `AUTH_LOG` | User authentication events. |
| `CODEX_LOG` | Codex usage activity. |
| `CODEX_SECURITY_LOG` | Codex security-related events. |
| `CHATGPT_PLUGIN_SPREADSHEET` | Spreadsheet plugin activity. |
| `CHATGPT_PLUGIN_PRESENTATION` | Presentation plugin activity. |
| `CUSTOM_AGENTS_LOG` | Custom agent activity. |

**Organization source:**

| Value | Description |
|-------|-------------|
| `APP_LOG` | Application activity logs. |
| `APP_AUTH_LOG` | Application authentication logs. |
| `COSTS` | Organization cost and usage records. |

## Sample Record

Each event conforms to the shared Logs Platform envelope. Fields vary by category; common top-level fields are shown below.

```json
{
  "event_id": "07142cbd-9d44-8f98-f65d-e49c6345cc7b",
  "type": "AUDIT_LOG",
  "principal": {
    "id": "5023330c-91d2-1cdb-4f43-b90fabcbab04",
    "type": "CHATGPT_WORKSPACE"
  },
  "actor": {
    "type": "API_KEY",
    "redacted_id": "sk-...Xy9Z",
    "tracking_id": "key_d7afa6cd-345e-35df-63ca-6a8bd0bf694f",
    "user_id": "user-3d3dff4c-564a-5d67-9d92-b4d8d8c4e042",
    "user_email": "bob.williams@example.com"
  },
  "timestamp": "2026-09-05T10:36:06Z",
  "action_result": "FAILURE",
  "action_privilege": "MEMBER",
  "request_metadata": {
    "client_ip": "203.0.113.24",
    "client_ip_details": {
      "country": "",
      "city": "",
      "region": "",
      "region_code": "",
      "asn": "",
      "latitude": "",
      "longitude": ""
    },
    "client_user_agent": "monad-http-client/1.0",
    "client_ja3": "d41d8cd98f00b204e9800998ecf8427e",
    "client_ja4": "t13d1312h2_f57a46bbacb6_f50d94e863eb",
    "destination_hostname": "api.chatgpt.com"
  },
  "action_data": {
    "log_file_id": "eclf_59d2506e-6e75-4547-ca39-2e020c81e52b",
    "event_type": "AUDIT_LOG"
  },
  "action": "DOWNLOAD_WORKSPACE_LOG_FILE"
}
```

## Troubleshooting

### Common Issues

1. **Authentication Errors (401 / 403)**
   - Confirm the Compliance API Key is an **Enterprise Compliance (admin)** key scoped to the **same source you selected** (workspace key for a Workspace source, organization key for an Organization source), not a standard OpenAI API key.
   - Verify the key has not been revoked or rotated in the ChatGPT admin console.

2. **A Selected Event Type Returns Nothing**
   - A key only returns categories it is **scoped** for. If one event type stays empty while others produce data, ask an Owner/Admin to grant that log-category scope to the key.

3. **404 / Source Not Found on the List Endpoint**
   - Check the **Workspace ID** or **Organization ID** (whichever matches the selected source) for typos or extra whitespace. It must be the ID of a workspace or organization the key can access, and it must match the source type you chose.

4. **Missing Older Data / 30-Day Retention**
   - The Compliance Logs Platform retains log files for **30 days only**. A **Backfill Start Time** earlier than 30 days ago cannot recover data that has already aged out.
   - If a pipeline is paused for longer than the retention window, files from before it resumes will have expired. The connector logs a warning and skips any log file that returns `404` (expired/removed) so ingestion continues rather than stalling.
   - For longer retention, ingest continuously and retain the records in your own store per your policy.

5. **Duplicate Records**
   - The platform delivers **at least once**, so the same event can appear in more than one file. Each record is keyed on its stable `event_id`, so duplicates can be de-duplicated downstream. This is expected behavior.

6. **Empty Incremental Syncs**
   - Progress is tracked by the file window close time (`last_end_time`). If no new log files have been written since the last run, no records are emitted — this is expected.

7. **Rate Limiting (429)**
   - The connector backs off and retries automatically. If you still see sustained throttling, lower the optional **API Rate Limit** to stay under the account's limit.

## Related Articles

- [OpenAI Compliance Platform for Enterprise and Edu Customers](https://help.openai.com/en/articles/9261474-openai-compliance-platform-for-enterprise-and-edu-customers)
- [Compliance API and audit events (ChatGPT Learn)](https://learn.chatgpt.com/docs/enterprise/compliance-api)
- [Admin API reference](https://chatgpt.com/public/admin/api-reference)

## Sync frequency

By default this input polls approximately every 10 seconds, with each sync beginning after the previous one completes. A cron schedule configured on the pipeline overrides this cadence. See [Input Sync Frequency](../../guides/sync-frequency) for details.