OpenAI / GPT coverage

The Admin API connector brings every OpenAI project, member, API key, daily cost and audit event at your company under Trefur, without code changes. OpenTelemetry traces from your own agents add the prompt and completion detail.

The Admin API requires Enterprise or Team — not consumer ChatGPT. The /v1/organization/* endpoints (audit logs, usage, projects, members) are only exposed to Enterprise and Team plan organizations. The connector authenticates with a scoped admin key (sk-admin-…) — separate from per-project API keys. If your org is on a free or Plus tier, send your agents' OpenTelemetry traces instead.

Choose your path

What the connector gives you, at a glance.

Path 1 — Admin API connector

The CISO mints an OpenAI Admin API key in the Platform Console once and pastes it into Trefur. Every 15 minutes Trefur polls the Admin API surfaces, records each OpenAI project + API key + service account as an observed agent, attributes daily token + cost roll-ups to a principal email via the project_users map, and writes audit events (api_key.created, project.deleted, saml.config.updated, etc.) into the activity record with canonical event types.

# 1. Mint an Admin API key in the OpenAI Platform:
#    Admin → API Keys → "Create new key" → role: Admin
#    The key prefix will be sk-admin-...
#    Available on Enterprise + Team plans only (NOT consumer ChatGPT).
#
# 2. Trefur stores the key in its AES-256-GCM credential vault.
#    Paste it under Sources → Connections → OpenAI Admin API.
#
# 3. The connector pulls these surfaces every 15 minutes:
#    GET /v1/organization/audit_logs
#    GET /v1/organization/usage/completions
#    GET /v1/organization/projects
#    GET /v1/organization/projects/{id}/users
#    GET /v1/organization/projects/{id}/api_keys
#    GET /v1/organization/projects/{id}/service_accounts
#
# 4. Per call, we capture:
#    - project_id              -> tenant-scope inventory
#    - api_key_id + name       -> recorded as observed agents
#    - principal email         -> resolved via project_users
#    - daily token + cost      -> aggregate per (api_key, model, day)
#    - audit events            -> mapped to canonical event types
#                                 (api_key.created, project.deleted,
#                                  invite.accepted, saml.config.updated)

The Admin API does not include prompt or completion text. For per-call content scanning, layer OpenTelemetry traces from your agents on top.

Per-call content: OpenTelemetry traces

For prompt, completion and tool-call detail from the agents you own, send their OpenTelemetry traces to Trefur over OTLP/HTTP. Spans that follow the OpenTelemetry GenAI semantic conventions need no mapping; the quickstart shows the exporter settings.

ChatGPT Enterprise conversation content

ChatGPT Enterprise admins can export full conversation content via OpenAI's /v1/compliance/conversations endpoint (the name comes from OpenAI's API surface, not our positioning). Trefur does not import that export: the connector brings in usage, not the messages employees sent. For per-call content capture, use OpenTelemetry traces from your agents. Contact us if you need ChatGPT Enterprise conversation content.