Audit Logs
List user actions and configuration changes within this organization.
List audit logs
GET
/organization/audit_logsModels
AuditLogListResponse object { id, effective_at, type, 59 more } A log of a user action or configuration change within this organization.
AuditLogListResponse object { id, effective_at, type, 59 more }
A log of a user action or configuration change within this organization.
id: string The ID of this log. effective_at: integer The Unix timestamp (in seconds) of the event. formatunixtime type: "api_key.created" or "api_key.updated" or "api_key.deleted" or 146 more The event type. One of the following: "api_key.created" "api_key.updated" "api_key.deleted" "certificate.created" "certificate.updated" "certificate.deleted" "certificates.activated" "certificates.deactivated" "checkpoint.permission.created" "checkpoint.permission.deleted" "external_key.registered" "external_key.removed" "external_storage.registered" "external_storage.removed" "group.created" "group.updated" "group.deleted" "invite.sent" "invite.accepted" "invite.deleted" "ip_allowlist.created" "ip_allowlist.updated" "ip_allowlist.deleted" "ip_allowlist.config.activated" "ip_allowlist.config.deactivated" "login.succeeded" "login.failed" "logout.succeeded" "logout.failed" "organization.updated" "project.created" "project.updated" "project.archived" "project.deleted" "rate_limit.updated" "rate_limit.deleted" "resource.deleted" "tunnel.created" "tunnel.updated" "tunnel.deleted" "workload_identity_provider.created" "workload_identity_provider.updated" "workload_identity_provider.deleted" "workload_identity_provider_mapping.created" "workload_identity_provider_mapping.updated" "workload_identity_provider_mapping.deleted" "role.created" "role.updated" "role.deleted" "role.assignment.created" "role.assignment.deleted" "role.bound_to_resource" "role.unbound_from_resource" "scim.enabled" "scim.disabled" "service_account.created" "service_account.updated" "service_account.deleted" "user.added" "user.updated" "user.deleted" "tenant.metadata.updated" "tenant.microsoft_entra_mapping.upserted" "tenant.microsoft_entra_mapping.deleted" "tenant.workload_identity.provider.created" "tenant.workload_identity.provider.updated" "tenant.workload_identity.provider.archived" "tenant.workload_identity.mapping.created" "tenant.workload_identity.mapping.updated" "tenant.workload_identity.mapping.archived" "tenant.workload_identity.binding.created" "tenant.workload_identity.principal.provisioned" "tenant.workload_identity.access_token.issued" "tenant.admin_api_key.created" "tenant.admin_api_key.updated" "tenant.admin_api_key.deleted" "tenant.project_api_key.created" "tenant.trusted_access.business_verification.started" "tenant.trusted_access.application.submitted" "tenant.chatgpt_access_token.revoked" "tenant.migration.completed" "tenant.sso.migrated" "tenant.domains.migrated" "tenant.sso_connection.created" "tenant.sso_connection.updated" "tenant.sso_connection.deleted" "tenant.sso_connection.setup.started" "tenant.policy.created" "tenant.policy.updated" "tenant.policy.deleted" "tenant.policy.attached" "tenant.policy.detached" "tenant.principal_authentication_policy.resolved" "tenant.scim.setup.started" "tenant.scim.deletion.requested" "tenant.scim.directory.created" "tenant.product_access_policy.updated" "tenant.resource_share_grant.created" "tenant.resource_share_grant.updated" "tenant.resource_share_grant.accepted" "tenant.resource_share_grant.declined" "tenant.resource_share_grant.revoked" "tenant.resource_share_grant.deleted" "tenant.service_account.updated" "tenant.service_account.deleted" "tenant.service_account.token.revoked" "tenant.billing.overage_limit.updated" "tenant.billing.alerts.updated" "tenant.billing.info.updated" "tenant.usage_limit.workspace.updated" "tenant.usage_limit.group.updated" "tenant.usage_limit.user.updated" "tenant.usage_limit.increase_request.updated" "tenant.usage_limit.increase_request.resolved" "tenant.group.created" "tenant.group.updated" "tenant.group.deleted" "tenant.group.member.added" "tenant.group.member.removed" "tenant.migration_rollout.status.updated" "tenant.migration_rollout.tier.updated" "tenant.role.metadata.updated" "tenant.custom_role.created" "tenant.custom_role.updated" "tenant.custom_role.deleted" "tenant.role_assignment.created" "tenant.role_assignment.deleted" "tenant.resource_role_assignment.created" "tenant.resource_role_assignment.deleted" "tenant.resource_access.updated" "tenant.resource_access.deleted" "tenant.ads_account.onboarding.redemption" "tenant.session_policy.created" "tenant.session_policy.updated" "tenant.session_policy.deleted" "tenant.session_revocation.started" "tenant.third_party_app_policy.updated" "tenant.user.added" "tenant.user.updated" "tenant.user.removed" "tenant.user.looked_up" "tenant.user.invited" "tenant.membership.revoked" "tenant.api_organization_invite.upserted" "tenant.api_organization_invite.deleted" "tenant.chatgpt_workspace_invite.upserted" "tenant.membership.accepted" "tenant.membership.declined" "tenant.workspace_invite_email_settings.updated" actor: optional object or null The actor who performed the audit logged action. api_key: optional { id, service_account, type, user } The API Key used to perform the audit logged action. id: optional string The tracking id of the API key. service_account: optional { id } The service account that performed the audit logged action. id: optional string The service account id. type: optional "user" or "service_account" The type of API key. Can be either user or service_account. One of the following: "user" "service_account" user: optional { id, email } The user who performed the audit logged action. id: optional string The user id. email: optional string The user email. session: optional { ip_address, user } The session in which the audit logged action was performed. ip_address: optional string The IP address from which the action was performed. user: optional { id, email } The user who performed the audit logged action. id: optional string The user id. email: optional string The user email. type: optional "session" or "api_key" The type of actor. Is either session or api_key. One of the following: "session" "api_key" "api_key.created": optional { id, data } The details for events with this type. id: optional string The tracking ID of the API key. data: optional { scopes } The payload used to create the API key. scopes: optional array of string A list of scopes allowed for the API key, e.g. ["api.model.request"] "api_key.deleted": optional { id } The details for events with this type. id: optional string The tracking ID of the API key. "api_key.updated": optional { id, changes_requested } The details for events with this type. id: optional string The tracking ID of the API key. changes_requested: optional { scopes } The payload used to update the API key. scopes: optional array of string A list of scopes allowed for the API key, e.g. ["api.model.request"] "certificate.created": optional { id, name } The details for events with this type. id: optional string The certificate ID. name: optional string The name of the certificate. "certificate.deleted": optional { id, certificate, name } The details for events with this type. id: optional string The certificate ID. certificate: optional string The certificate content in PEM format. name: optional string The name of the certificate. "certificate.updated": optional { id, name } The details for events with this type. id: optional string The certificate ID. name: optional string The name of the certificate. "certificates.activated": optional { certificates } The details for events with this type. certificates: optional array of { id, name } id: optional string The certificate ID. name: optional string The name of the certificate. "certificates.deactivated": optional { certificates } The details for events with this type. certificates: optional array of { id, name } id: optional string The certificate ID. name: optional string The name of the certificate. "checkpoint.permission.created": optional { id, data } The project and fine-tuned model checkpoint that the checkpoint permission was created for. id: optional string The ID of the checkpoint permission. data: optional { fine_tuned_model_checkpoint, project_id } The payload used to create the checkpoint permission. fine_tuned_model_checkpoint: optional string The ID of the fine-tuned model checkpoint. project_id: optional string The ID of the project that the checkpoint permission was created for. "checkpoint.permission.deleted": optional { id } The details for events with this type. id: optional string The ID of the checkpoint permission. "external_key.registered": optional { id, data } The details for events with this type. id: optional string The ID of the external key configuration. data: optional unknown The configuration for the external key. "external_key.removed": optional { id } The details for events with this type. id: optional string The ID of the external key configuration. "external_storage.registered": optional { id, data } The details for events with this type. id: optional string The ID of the external storage configuration. data: optional { geography, provider } The configuration for the external storage. geography: optional string The OpenAI geography derived from the storage region. provider: optional AwsExternalStorageProvider or AzureExternalStorageProvider or GcpExternalStorageProvider or OciExternalStorageProvider The external storage provider configuration. One of the following: AwsExternalStorageProvider { account_id, bucket, external_id, 3 more } account_id: string bucket: string external_id: string region: string role_arn: string type: "aws" (default: "aws") AzureExternalStorageProvider { account_name, container, region, 4 more } account_name: string container: string region: string resource_group: string subscription_id: string tenant_id: string type: "azure" (default: "azure") GcpExternalStorageProvider { audience, bucket, region, 4 more } audience: string bucket: string region: string type: "gcp" (default: "gcp") workload_identity_pool_id: string workload_identity_project_number: string workload_identity_provider_id: string OciExternalStorageProvider { bucket, region, tenancy_ocid, type } bucket: string region: string tenancy_ocid: string type: "oci" (default: "oci") "external_storage.removed": optional { id } The details for events with this type. id: optional string The ID of the external storage configuration. "group.created": optional { id, data } The details for events with this type. id: optional string The ID of the group. data: optional { group_name } Information about the created group. group_name: optional string The group name. "group.deleted": optional { id } The details for events with this type. id: optional string The ID of the group. "group.updated": optional { id, changes_requested } The details for events with this type. id: optional string The ID of the group. changes_requested: optional { group_name } The payload used to update the group. group_name: optional string The updated group name. "invite.accepted": optional { id } The details for events with this type. id: optional string The ID of the invite. "invite.deleted": optional { id } The details for events with this type. id: optional string The ID of the invite. "invite.sent": optional { id, data } The details for events with this type. id: optional string The ID of the invite. data: optional { email, role } The payload used to create the invite. email: optional string The email invited to the organization. role: optional string The role the email was invited to be. Is either owner or member. "ip_allowlist.config.activated": optional { configs } The details for events with this type. configs: optional array of { id, name } The configurations that were activated. id: optional string The ID of the IP allowlist configuration. name: optional string The name of the IP allowlist configuration. "ip_allowlist.config.deactivated": optional { configs } The details for events with this type. configs: optional array of { id, name } The configurations that were deactivated. id: optional string The ID of the IP allowlist configuration. name: optional string The name of the IP allowlist configuration. "ip_allowlist.created": optional { id, allowed_ips, name } The details for events with this type. id: optional string The ID of the IP allowlist configuration. allowed_ips: optional array of string The IP addresses or CIDR ranges included in the configuration. name: optional string The name of the IP allowlist configuration. "ip_allowlist.deleted": optional { id, allowed_ips, name } The details for events with this type. id: optional string The ID of the IP allowlist configuration. allowed_ips: optional array of string The IP addresses or CIDR ranges that were in the configuration. name: optional string The name of the IP allowlist configuration. "ip_allowlist.updated": optional { id, allowed_ips } The details for events with this type. id: optional string The ID of the IP allowlist configuration. allowed_ips: optional array of string The updated set of IP addresses or CIDR ranges in the configuration. "login.failed": optional { error_code, error_message } The details for events with this type. error_code: optional string The error code of the failure. error_message: optional string The error message of the failure. "login.succeeded": optional unknown This event has no additional fields beyond the standard audit log attributes. "logout.failed": optional { error_code, error_message } The details for events with this type. error_code: optional string The error code of the failure. error_message: optional string The error message of the failure. "logout.succeeded": optional unknown This event has no additional fields beyond the standard audit log attributes. "organization.updated": optional { id, changes_requested } The details for events with this type. id: optional string The organization ID. changes_requested: optional { api_call_logging, api_call_logging_project_ids, description, 4 more } The payload used to update the organization settings. api_call_logging: optional string How your organization logs data from supported API calls. One of disabled, enabled_per_call, enabled_for_all_projects, or enabled_for_selected_projects api_call_logging_project_ids: optional string The list of project ids if api_call_logging is set to enabled_for_selected_projects description: optional string The organization description. name: optional string The organization name. threads_ui_visibility: optional string Visibility of the threads page which shows messages created with the Assistants API and Playground. One of ANY_ROLE, OWNERS, or NONE. title: optional string The organization title. usage_dashboard_visibility: optional string Visibility of the usage dashboard which shows activity and costs for your organization. One of ANY_ROLE or OWNERS. project: optional { id, name } The project that the action was scoped to. Absent for actions not scoped to projects. Note that any admin actions taken via Admin API keys are associated with the default project. id: optional string The project ID. name: optional string The project title. "project.archived": optional { id } The details for events with this type. id: optional string The project ID. "project.created": optional { id, data } The details for events with this type. id: optional string The project ID. data: optional { name, title } The payload used to create the project. name: optional string The project name. title: optional string The title of the project as seen on the dashboard. "project.deleted": optional { id } The details for events with this type. id: optional string The project ID. "project.updated": optional { id, changes_requested } The details for events with this type. id: optional string The project ID. changes_requested: optional { title } The payload used to update the project. title: optional string The title of the project as seen on the dashboard. "rate_limit.deleted": optional { id } The details for events with this type. id: optional string The rate limit ID "rate_limit.updated": optional { id, changes_requested } The details for events with this type. id: optional string The rate limit ID changes_requested: optional { batch_1_day_max_input_tokens, max_audio_megabytes_per_1_minute, max_images_per_1_minute, 3 more } The payload used to update the rate limits. batch_1_day_max_input_tokens: optional integer The maximum batch input tokens per day. Only relevant for certain models. max_audio_megabytes_per_1_minute: optional integer The maximum audio megabytes per minute. Only relevant for certain models. max_images_per_1_minute: optional integer The maximum images per minute. Only relevant for certain models. max_requests_per_1_day: optional integer The maximum requests per day. Only relevant for certain models. max_requests_per_1_minute: optional integer The maximum requests per minute. max_tokens_per_1_minute: optional integer The maximum tokens per minute. "role.assignment.created": optional { id, principal_id, principal_type, 2 more } The details for events with this type. id: optional string The identifier of the role assignment. principal_id: optional string The principal (user or group) that received the role. principal_type: optional string The type of principal (user or group) that received the role. resource_id: optional string The resource the role assignment is scoped to. resource_type: optional string The type of resource the role assignment is scoped to. "role.assignment.deleted": optional { id, principal_id, principal_type, 2 more } The details for events with this type. id: optional string The identifier of the role assignment. principal_id: optional string The principal (user or group) that had the role removed. principal_type: optional string The type of principal (user or group) that had the role removed. resource_id: optional string The resource the role assignment was scoped to. resource_type: optional string The type of resource the role assignment was scoped to. "role.bound_to_resource": optional { id, connector_id, connector_name, 7 more } The details for events with this type. id: optional string The ID of the resource the role was bound to. ChatGPT workspace connector resources use <workspace_id>__<connector_id>. connector_id: optional string The connector ID for a ChatGPT workspace connector resource. connector_name: optional string The connector display name for a ChatGPT workspace connector resource, or the connector ID when the display name could not be resolved. enabled: optional boolean Whether the connector is enabled for the role. permissions: optional array of string The permissions granted to the role for the resource. resource_id: optional string The ID of the resource the role was bound to. resource_type: optional string The type of resource the role was bound to. role_id: optional string The ID of the role that was bound to the resource. source: optional "role_toggle" or "role_connector_update" or "role_delete" or 2 more The connector role mutation path that produced the event. One of the following: "role_toggle" "role_connector_update" "role_delete" "workspace_permissions" "connector_publish" workspace_id: optional string The workspace ID for a ChatGPT workspace connector resource. "role.created": optional { id, permissions, resource_id, 2 more } The details for events with this type. id: optional string The role ID. permissions: optional array of string The permissions granted by the role. resource_id: optional string The resource the role is scoped to. resource_type: optional string The type of resource the role belongs to. role_name: optional string The name of the role. "role.deleted": optional { id } The details for events with this type. id: optional string The role ID. "role.unbound_from_resource": optional { id, connector_id, connector_name, 7 more } The details for events with this type. id: optional string The ID of the resource the role was unbound from. ChatGPT workspace connector resources use <workspace_id>__<connector_id>. connector_id: optional string The connector ID for a ChatGPT workspace connector resource. connector_name: optional string The connector display name for a ChatGPT workspace connector resource, or the connector ID when the display name could not be resolved. enabled: optional boolean Whether the connector is enabled for the role. permissions: optional array of string The permissions remaining for the role after the change. resource_id: optional string The ID of the resource the role was unbound from. resource_type: optional string The type of resource the role was unbound from. role_id: optional string The ID of the role that was unbound from the resource. source: optional "role_toggle" or "role_connector_update" or "role_delete" or 2 more The connector role mutation path that produced the event. One of the following: "role_toggle" "role_connector_update" "role_delete" "workspace_permissions" "connector_publish" workspace_id: optional string The workspace ID for a ChatGPT workspace connector resource. "role.updated": optional { id, changes_requested } The details for events with this type. id: optional string The role ID. changes_requested: optional { description, metadata, permissions_added, 4 more } The payload used to update the role. description: optional string The updated role description, when provided. metadata: optional unknown Additional metadata stored on the role. permissions_added: optional array of string The permissions added to the role. permissions_removed: optional array of string The permissions removed from the role. resource_id: optional string The resource the role is scoped to. resource_type: optional string The type of resource the role belongs to. role_name: optional string The updated role name, when provided. "scim.disabled": optional { id } The details for events with this type. id: optional string The ID of the SCIM was disabled for. "scim.enabled": optional { id } The details for events with this type. id: optional string The ID of the SCIM was enabled for. "service_account.created": optional { id, data } The details for events with this type. id: optional string The service account ID. data: optional { role } The payload used to create the service account. role: optional string The role of the service account. Is either owner or member. "service_account.deleted": optional { id } The details for events with this type. id: optional string The service account ID. "service_account.updated": optional { id, changes_requested } The details for events with this type. id: optional string The service account ID. changes_requested: optional { role } The payload used to updated the service account. role: optional string The role of the service account. Is either owner or member. "user.added": optional { id, data } The details for events with this type. id: optional string The user ID. data: optional { role } The payload used to add the user to the project. role: optional string The role of the user. Is either owner or member. "user.deleted": optional { id } The details for events with this type. id: optional string The user ID. "user.updated": optional { id, changes_requested } The details for events with this type. id: optional string The project ID. changes_requested: optional { role } The payload used to update the user. role: optional string The role of the user. Is either owner or member. "workload_identity_provider_mapping.created": optional { id, data, identity_provider_id } The details for events with this type. id: optional string The workload identity provider mapping ID. data: optional unknown The payload used to create the workload identity provider mapping. identity_provider_id: optional string The workload identity provider ID. "workload_identity_provider_mapping.deleted": optional { id, identity_provider_id, project_id, service_account_id } The details for events with this type. id: optional string The workload identity provider mapping ID. identity_provider_id: optional string The workload identity provider ID. project_id: optional string The project ID. service_account_id: optional string The mapped service account ID. "workload_identity_provider_mapping.updated": optional { id, changes_requested, identity_provider_id } The details for events with this type. id: optional string The workload identity provider mapping ID. changes_requested: optional unknown The payload used to update the workload identity provider mapping. identity_provider_id: optional string The workload identity provider ID. "workload_identity_provider.created": optional { id, data } The details for events with this type. id: optional string The workload identity provider ID. data: optional unknown The payload used to create the workload identity provider. "workload_identity_provider.deleted": optional { id, name } The details for events with this type. id: optional string The workload identity provider ID. name: optional string The workload identity provider name. "workload_identity_provider.updated": optional { id, changes_requested } The details for events with this type. id: optional string The workload identity provider ID. changes_requested: optional unknown The payload used to update the workload identity provider.