Skip to main content
The OpenAI Platform integration collects organization audit logs for security monitoring and detection. It covers administrative changes, API key activity, identity configuration, and login attempts without requiring software on employee devices.
This integration connects to the OpenAI API Platform at platform.openai.com. It does not use ChatGPT Enterprise Admin Console credentials or collect prompt and response content.

​
Prerequisites

Before setting up this integration, ensure that:
  1. You are an Organization Owner in OpenAI API Platform
  2. You can change organization data controls
  3. You can create an API Platform Admin API key

​
Step 1: Enable Audit Logging

  1. Sign in to OpenAI Platform
  2. Open Settings → Data controls → Data retention
  3. Under Audit logging, click Enable
  4. Save your changes
Enabling audit logging is effectively one-way. It cannot be disabled in organization settings; an Organization Owner must contact OpenAI Support to request a change.
Audit logging must be enabled before OpenAI makes audit records available through the API. OpenAI does not backfill activity from before this setting was turned on. A newly enabled organization can return an empty audit log until someone performs an administrative action after enablement.

​
Step 2: Create a Restricted Admin API Key

  1. Open Organization Admin keys
  2. Click Create new admin key
  3. Enter a descriptive name, such as Wirespeed Audit Logs
  4. Under Permissions, select Restricted
  5. Set Audit Logs Scope to Read
  6. Leave unrelated management permissions disabled
  7. Create the key and copy it immediately
OpenAI displays the key once. If it is lost, delete it and create another key. Store it securely.
Use an API Platform Admin key, whose redacted form begins sk-admin.... Standard model/project keys and ChatGPT workspace Admin keys cannot access this endpoint. Wirespeed does not require Organization Administration Write.

​
Step 3: Connect OpenAI Platform to Wirespeed

  1. In Wirespeed, open Integrations → Add Integration
  2. Search for and select OpenAI Platform
  3. Paste the Admin API key
  4. Click Integrate
Wirespeed validates the key against the organization Audit Logs endpoint before enabling the integration. A successful connect only proves the key can call that endpoint. It does not mean events already exist.

​
What Events Are Collected?

Wirespeed imports all event types returned by the OpenAI organization Audit Logs API, including:
  • Sign-in and sign-out successes and failures
  • User, invitation, group, and service account changes
  • Role and permission assignments
  • API key creation, updates, and deletion
  • IP allowlist and SCIM configuration changes
  • Project, organization, and rate-limit changes
  • Workload identity, tunnel, certificate, and external-key changes
The first sync requests up to seven days of available history. Events from before audit logging was enabled are not available. OpenAI retains audit logs on a best-effort basis and does not guarantee a fixed retention period.
OpenAI audit logs contain administrative metadata, not model request or response content. OpenAI Zero Data Retention settings do not change audit-log availability.

​
Managed Detections

Wirespeed evaluates the collected events for: Successful and failed logins are also normalized as authentication events for SIEM searches and cross-platform login detections. Wirespeed does not create an individual detection for every login.

​
Troubleshooting

​
Invalid API Key

For 401 errors:
  1. Confirm that the entire key was pasted without spaces
  2. Confirm that it is an API Platform Admin key, not a standard OpenAI API key
  3. If the key was deleted or lost, create a replacement and update Wirespeed

​
Missing Audit Log Permission

For 403 or missing-scope errors:
  1. Create the key as an OpenAI API Platform Organization Owner
  2. Select Restricted permissions
  3. Set Audit Logs Scope to Read
  4. Replace the key in Wirespeed

​
Integration Connects but No Events Appear

A healthy integration with only an “Integration added” log usually means OpenAI returned an empty list. Confirm events exist on the vendor before expecting them in Wirespeed:
"data": [] with "has_more": false means there is nothing for Wirespeed to ingest. Then:
  1. Confirm audit logging is Active under Data controls → Data retention
  2. Create and delete a project API key, or sign out and back in
  3. Wait a few minutes and rerun the request until data contains events
  4. Allow one more minute for Wirespeed to poll
Do not use the Admin key pasted into Wirespeed as a model key. Project API keys and dashboard session activity are what produce audit records.

​
Rate Limiting

OpenAI may return 429 responses during high-volume collection. Wirespeed retries collection on a later sync without advancing past the incomplete window.

​
Additional Resources