> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# OpenAI Platform

> Monitor administrative, configuration, and authentication activity across your OpenAI API Platform organization

The OpenAI Platform integration collects organization audit logs for security
monitoring and detection. It covers administrative changes, API key activity,
identity configuration, and login attempts without requiring software on
employee devices.

<Info>
  This integration connects to the OpenAI **API Platform** at
  `platform.openai.com`. It does not use ChatGPT Enterprise Admin Console
  credentials or collect prompt and response content.
</Info>

## Prerequisites

Before setting up this integration, ensure that:

1. You are an **Organization Owner** in OpenAI API Platform
2. You can change organization data controls
3. You can create an API Platform Admin API key

## Step 1: Enable Audit Logging

1. Sign in to [OpenAI Platform](https://platform.openai.com/)
2. Open **Settings** → **Data controls** → **Data retention**
3. Under **Audit logging**, click **Enable**
4. Save your changes

<Warning>
  Enabling audit logging is effectively one-way. It cannot be disabled in
  organization settings; an Organization Owner must contact OpenAI Support to
  request a change.
</Warning>

Audit logging must be enabled before OpenAI makes audit records available
through the API. OpenAI does not backfill activity from before this setting
was turned on. A newly enabled organization can return an empty audit log
until someone performs an administrative action after enablement.

## Step 2: Create a Restricted Admin API Key

1. Open [Organization Admin keys](https://platform.openai.com/settings/organization/admin-keys)
2. Click **Create new admin key**
3. Enter a descriptive name, such as `Wirespeed Audit Logs`
4. Under **Permissions**, select **Restricted**
5. Set **Audit Logs Scope** to **Read**
6. Leave unrelated management permissions disabled
7. Create the key and copy it immediately

<Warning>
  OpenAI displays the key once. If it is lost, delete it and create another
  key. Store it securely.
</Warning>

<Note>
  Use an API Platform Admin key, whose redacted form begins `sk-admin...`.
  Standard model/project keys and ChatGPT workspace Admin keys cannot access
  this endpoint. Wirespeed does not require Organization Administration Write.
</Note>

## Step 3: Connect OpenAI Platform to Wirespeed

1. In Wirespeed, open Integrations → [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse)
2. Search for and select **OpenAI Platform**
3. Paste the Admin API key
4. Click **Integrate**

Wirespeed validates the key against the organization Audit Logs endpoint before
enabling the integration. A successful connect only proves the key can call
that endpoint. It does not mean events already exist.

## What Events Are Collected?

Wirespeed imports all event types returned by the OpenAI organization Audit
Logs API, including:

* Sign-in and sign-out successes and failures
* User, invitation, group, and service account changes
* Role and permission assignments
* API key creation, updates, and deletion
* IP allowlist and SCIM configuration changes
* Project, organization, and rate-limit changes
* Workload identity, tunnel, certificate, and external-key changes

The first sync requests up to seven days of **available** history. Events from
before audit logging was enabled are not available. OpenAI retains audit logs
on a best-effort basis and does not guarantee a fixed retention period.

<Info>
  OpenAI audit logs contain administrative metadata, not model request or
  response content. OpenAI Zero Data Retention settings do not change audit-log
  availability.
</Info>

## Managed Detections

Wirespeed evaluates the collected events for:

| Detection | Condition |
| - | - |
| IP allowlist changed | An allowlist is created, updated, deleted, activated, or deactivated |
| Owner or admin role assigned | A user or service account receives elevated access |
| SCIM configuration changed | SCIM provisioning is enabled or disabled |
| Elevated API key | An API key is created with dashboard **All** (empty `scopes`), or created/updated with a `.write` / `:write` / `admin` scope |

Successful and failed logins are also normalized as authentication events for
SIEM searches and cross-platform login detections. Wirespeed does not create an
individual detection for every login.

## Troubleshooting

### Invalid API Key

For `401` errors:

1. Confirm that the entire key was pasted without spaces
2. Confirm that it is an API Platform Admin key, not a standard OpenAI API key
3. If the key was deleted or lost, create a replacement and update Wirespeed

### Missing Audit Log Permission

For `403` or missing-scope errors:

1. Create the key as an OpenAI API Platform Organization Owner
2. Select **Restricted** permissions
3. Set **Audit Logs Scope** to **Read**
4. Replace the key in Wirespeed

### Integration Connects but No Events Appear

A healthy integration with only an "Integration added" log usually means
OpenAI returned an empty list. Confirm events exist on the vendor before
expecting them in Wirespeed:

```bash theme={null}
curl -sS "https://api.openai.com/v1/organization/audit_logs?limit=5" \
  -H "Authorization: Bearer $OPENAI_ADMIN_KEY"
```

`"data": []` with `"has_more": false` means there is nothing for Wirespeed to
ingest.

Then:

1. Confirm audit logging is **Active** under **Data controls** → **Data retention**
2. Create and delete a **project** API key, or sign out and back in
3. Wait a few minutes and rerun the request until `data` contains events
4. Allow one more minute for Wirespeed to poll

Do not use the Admin key pasted into Wirespeed as a model key. Project API
keys and dashboard session activity are what produce audit records.

### Rate Limiting

OpenAI may return `429` responses during high-volume collection. Wirespeed
retries collection on a later sync without advancing past the incomplete
window.

## Additional Resources

* [OpenAI Admin and Audit Logs API](https://help.openai.com/en/articles/9687866-admin-and-audit-logs-api-for-the-api-platform)
* [OpenAI Admin APIs guide](https://developers.openai.com/api/docs/guides/admin-apis)
* [OpenAI Audit Logs API reference](https://developers.openai.com/api/reference/resources/organization/subresources/audit_logs/)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.