Audit Logs

ModelsExpand Collapse

AuditLogListResponse object { id, actor, effective_at, 49 more }

A log of a user action or configuration change within this organization.

id: string

The ID of this log.

actor: object { api_key, session, type }

The actor who performed the audit logged action.

api_key: optional object { id, service_account, type, user }

The API Key used to perform the audit logged action.

id: optional string

The tracking id of the API key.

service_account: optional object { id }

The service account that performed the audit logged action.

id: optional string

The service account id.

type: optional "user" or "service_account"

The type of API key. Can be either user or service_account.

One of the following:

"user"

"service_account"

user: optional object { id, email }

The user who performed the audit logged action.

id: optional string

The user id.

email: optional string

The user email.

session: optional object { ip_address, user }

The session in which the audit logged action was performed.

ip_address: optional string

The IP address from which the action was performed.

user: optional object { id, email }

The user who performed the audit logged action.

id: optional string

The user id.

email: optional string

The user email.

type: optional "session" or "api_key"

The type of actor. Is either session or api_key.

One of the following:

"session"

"api_key"

effective_at: number

The Unix timestamp (in seconds) of the event.

type: "api_key.created" or "api_key.updated" or "api_key.deleted" or 48 more

The event type.

One of the following:

"api_key.created"

"api_key.updated"

"api_key.deleted"

"certificate.created"

"certificate.updated"

"certificate.deleted"

"certificates.activated"

"certificates.deactivated"

"checkpoint.permission.created"

"checkpoint.permission.deleted"

"external_key.registered"

"external_key.removed"

"group.created"

"group.updated"

"group.deleted"

"invite.sent"

"invite.accepted"

"invite.deleted"

"ip_allowlist.created"

"ip_allowlist.updated"

"ip_allowlist.deleted"

"ip_allowlist.config.activated"

"ip_allowlist.config.deactivated"

"login.succeeded"

"login.failed"

"logout.succeeded"

"logout.failed"

"organization.updated"

"project.created"

"project.updated"

"project.archived"

"project.deleted"

"rate_limit.updated"

"rate_limit.deleted"

"resource.deleted"

"tunnel.created"

"tunnel.updated"

"tunnel.deleted"

"role.created"

"role.updated"

"role.deleted"

"role.assignment.created"

"role.assignment.deleted"

"scim.enabled"

"scim.disabled"

"service_account.created"

"service_account.updated"

"service_account.deleted"

"user.added"

"user.updated"

"user.deleted"

"api_key.created": optional object { id, data }

The details for events with this type.

id: optional string

The tracking ID of the API key.

data: optional object { scopes }

The payload used to create the API key.

scopes: optional array of string

A list of scopes allowed for the API key, e.g. ["api.model.request"]

"api_key.deleted": optional object { id }

The details for events with this type.

id: optional string

The tracking ID of the API key.

"api_key.updated": optional object { id, changes_requested }

The details for events with this type.

id: optional string

The tracking ID of the API key.

changes_requested: optional object { scopes }

The payload used to update the API key.

scopes: optional array of string

A list of scopes allowed for the API key, e.g. ["api.model.request"]

"certificate.created": optional object { id, name }

The details for events with this type.

id: optional string

The certificate ID.

The name of the certificate.

"certificate.deleted": optional object { id, certificate, name }

The details for events with this type.

id: optional string

The certificate ID.

certificate: optional string

The certificate content in PEM format.

The name of the certificate.

"certificate.updated": optional object { id, name }

The details for events with this type.

id: optional string

The certificate ID.

The name of the certificate.

"certificates.activated": optional object { certificates }

The details for events with this type.

certificates: optional array of object { id, name }

id: optional string

The certificate ID.

The name of the certificate.

"certificates.deactivated": optional object { certificates }

The details for events with this type.

certificates: optional array of object { id, name }

id: optional string

The certificate ID.

The name of the certificate.

"checkpoint.permission.created": optional object { id, data }

The project and fine-tuned model checkpoint that the checkpoint permission was created for.

id: optional string

The ID of the checkpoint permission.

data: optional object { fine_tuned_model_checkpoint, project_id }

The payload used to create the checkpoint permission.

fine_tuned_model_checkpoint: optional string

The ID of the fine-tuned model checkpoint.

project_id: optional string

The ID of the project that the checkpoint permission was created for.

"checkpoint.permission.deleted": optional object { id }

The details for events with this type.

id: optional string

The ID of the checkpoint permission.

"external_key.registered": optional object { id, data }

The details for events with this type.

id: optional string

The ID of the external key configuration.

data: optional unknown

The configuration for the external key.

"external_key.removed": optional object { id }

The details for events with this type.

id: optional string

The ID of the external key configuration.

"group.created": optional object { id, data }

The details for events with this type.

id: optional string

The ID of the group.

data: optional object { group_name }

Information about the created group.

group_name: optional string

The group name.

"group.deleted": optional object { id }

The details for events with this type.

id: optional string

The ID of the group.

"group.updated": optional object { id, changes_requested }

The details for events with this type.

id: optional string

The ID of the group.

changes_requested: optional object { group_name }

The payload used to update the group.

group_name: optional string

The updated group name.

"invite.accepted": optional object { id }

The details for events with this type.

id: optional string

The ID of the invite.

"invite.deleted": optional object { id }

The details for events with this type.

id: optional string

The ID of the invite.

"invite.sent": optional object { id, data }

The details for events with this type.

id: optional string

The ID of the invite.

data: optional object { email, role }

The payload used to create the invite.

email: optional string

The email invited to the organization.

role: optional string

The role the email was invited to be. Is either owner or member.

"ip_allowlist.config.activated": optional object { configs }

The details for events with this type.

configs: optional array of object { id, name }

The configurations that were activated.

id: optional string

The ID of the IP allowlist configuration.

The name of the IP allowlist configuration.

"ip_allowlist.config.deactivated": optional object { configs }

The details for events with this type.

configs: optional array of object { id, name }

The configurations that were deactivated.

id: optional string

The ID of the IP allowlist configuration.

The name of the IP allowlist configuration.

"ip_allowlist.created": optional object { id, allowed_ips, name }

The details for events with this type.

id: optional string

The ID of the IP allowlist configuration.

allowed_ips: optional array of string

The IP addresses or CIDR ranges included in the configuration.

The name of the IP allowlist configuration.

"ip_allowlist.deleted": optional object { id, allowed_ips, name }

The details for events with this type.

id: optional string

The ID of the IP allowlist configuration.

allowed_ips: optional array of string

The IP addresses or CIDR ranges that were in the configuration.

The name of the IP allowlist configuration.

"ip_allowlist.updated": optional object { id, allowed_ips }

The details for events with this type.

id: optional string

The ID of the IP allowlist configuration.

allowed_ips: optional array of string

The updated set of IP addresses or CIDR ranges in the configuration.

"logout.failed": optional object { error_code, error_message }

The details for events with this type.

error_code: optional string

The error code of the failure.

error_message: optional string

The error message of the failure.

"logout.succeeded": optional unknown

This event has no additional fields beyond the standard audit log attributes.

"organization.updated": optional object { id, changes_requested }

The details for events with this type.

id: optional string

The organization ID.

changes_requested: optional object { api_call_logging, api_call_logging_project_ids, description, 4 more }

The payload used to update the organization settings.

api_call_logging: optional string

How your organization logs data from supported API calls. One of disabled, enabled_per_call, enabled_for_all_projects, or enabled_for_selected_projects

api_call_logging_project_ids: optional string

The list of project ids if api_call_logging is set to enabled_for_selected_projects

description: optional string

The organization description.

The organization name.

threads_ui_visibility: optional string

Visibility of the threads page which shows messages created with the Assistants API and Playground. One of ANY_ROLE, OWNERS, or NONE.

title: optional string

The organization title.

usage_dashboard_visibility: optional string

Visibility of the usage dashboard which shows activity and costs for your organization. One of ANY_ROLE or OWNERS.

project: optional object { id, name }

The project that the action was scoped to. Absent for actions not scoped to projects. Note that any admin actions taken via Admin API keys are associated with the default project.

id: optional string

The project ID.

The project title.

"project.archived": optional object { id }

The details for events with this type.

id: optional string

The project ID.

"project.created": optional object { id, data }

The details for events with this type.

id: optional string

The project ID.

data: optional object { name, title }

The payload used to create the project.

The project name.

title: optional string

The title of the project as seen on the dashboard.

"project.deleted": optional object { id }

The details for events with this type.

id: optional string

The project ID.

"project.updated": optional object { id, changes_requested }

The details for events with this type.

id: optional string

The project ID.

changes_requested: optional object { title }

The payload used to update the project.

title: optional string

The title of the project as seen on the dashboard.

"rate_limit.deleted": optional object { id }

The details for events with this type.

id: optional string

The rate limit ID

"rate_limit.updated": optional object { id, changes_requested }

The details for events with this type.

id: optional string

The rate limit ID

changes_requested: optional object { batch_1_day_max_input_tokens, max_audio_megabytes_per_1_minute, max_images_per_1_minute, 3 more }

The payload used to update the rate limits.

batch_1_day_max_input_tokens: optional number

The maximum batch input tokens per day. Only relevant for certain models.

max_audio_megabytes_per_1_minute: optional number

The maximum audio megabytes per minute. Only relevant for certain models.

max_images_per_1_minute: optional number

The maximum images per minute. Only relevant for certain models.

max_requests_per_1_day: optional number

The maximum requests per day. Only relevant for certain models.

max_requests_per_1_minute: optional number

The maximum requests per minute.

max_tokens_per_1_minute: optional number

The maximum tokens per minute.

"role.assignment.created": optional object { id, principal_id, principal_type, 2 more }

The details for events with this type.

id: optional string

The identifier of the role assignment.

principal_id: optional string

The principal (user or group) that received the role.

principal_type: optional string

The type of principal (user or group) that received the role.

resource_id: optional string

The resource the role assignment is scoped to.

resource_type: optional string

The type of resource the role assignment is scoped to.

"role.assignment.deleted": optional object { id, principal_id, principal_type, 2 more }

The details for events with this type.

id: optional string

The identifier of the role assignment.

principal_id: optional string

The principal (user or group) that had the role removed.

principal_type: optional string

The type of principal (user or group) that had the role removed.

resource_id: optional string

The resource the role assignment was scoped to.

resource_type: optional string

The type of resource the role assignment was scoped to.

"role.created": optional object { id, permissions, resource_id, 2 more }

The details for events with this type.

id: optional string

The role ID.

permissions: optional array of string

The permissions granted by the role.

resource_id: optional string

The resource the role is scoped to.

resource_type: optional string

The type of resource the role belongs to.

role_name: optional string

The name of the role.

"role.deleted": optional object { id }

The details for events with this type.

id: optional string

The role ID.

"role.updated": optional object { id, changes_requested }

The details for events with this type.

id: optional string

The role ID.

changes_requested: optional object { description, metadata, permissions_added, 4 more }

The payload used to update the role.

description: optional string

The updated role description, when provided.

metadata: optional unknown

Additional metadata stored on the role.

permissions_added: optional array of string

The permissions added to the role.

permissions_removed: optional array of string

The permissions removed from the role.

resource_id: optional string

The resource the role is scoped to.

resource_type: optional string

The type of resource the role belongs to.

role_name: optional string

The updated role name, when provided.

"scim.disabled": optional object { id }

The details for events with this type.

id: optional string

The ID of the SCIM was disabled for.

"scim.enabled": optional object { id }

The details for events with this type.

id: optional string

The ID of the SCIM was enabled for.

"service_account.created": optional object { id, data }

The details for events with this type.

id: optional string

The service account ID.

data: optional object { role }

The payload used to create the service account.

role: optional string

The role of the service account. Is either owner or member.

"service_account.deleted": optional object { id }

The details for events with this type.

id: optional string

The service account ID.

"service_account.updated": optional object { id, changes_requested }

The details for events with this type.

id: optional string

The service account ID.

changes_requested: optional object { role }

The payload used to updated the service account.

role: optional string

The role of the service account. Is either owner or member.

"user.added": optional object { id, data }

The details for events with this type.

id: optional string

The user ID.

data: optional object { role }

The payload used to add the user to the project.

role: optional string

The role of the user. Is either owner or member.

"user.deleted": optional object { id }

The details for events with this type.

id: optional string

The user ID.

"user.updated": optional object { id, changes_requested }

The details for events with this type.

id: optional string

The project ID.

changes_requested: optional object { role }

The payload used to update the user.

role: optional string

The role of the user. Is either owner or member.

AuditLogGetCostsResponse object { data, has_more, next_page, object }

data: array of object { end_time, object, result, start_time }

end_time: number

object: "bucket"

result: array of object { input_tokens, num_model_requests, object, 10 more } or object { input_tokens, num_model_requests, object, 4 more } or object { input_tokens, num_model_requests, object, 4 more } or 6 more

One of the following:

UsageCompletionsResult object { input_tokens, num_model_requests, object, 10 more }

The aggregated completions usage details of the specific time bucket.

input_tokens: number

The aggregated number of text input tokens used, including cached tokens. For customers subscribe to scale tier, this includes scale tier tokens.

num_model_requests: number

The count of requests made to the model.

object: "organization.usage.completions.result"

output_tokens: number

The aggregated number of text output tokens used. For customers subscribe to scale tier, this includes scale tier tokens.

api_key_id: optional string

When group_by=api_key_id, this field provides the API key ID of the grouped usage result.

batch: optional boolean

When group_by=batch, this field tells whether the grouped usage result is batch or not.

input_audio_tokens: optional number

The aggregated number of audio input tokens used, including cached tokens.

input_cached_tokens: optional number

The aggregated number of text input tokens that has been cached from previous requests. For customers subscribe to scale tier, this includes scale tier tokens.

model: optional string

When group_by=model, this field provides the model name of the grouped usage result.

output_audio_tokens: optional number

The aggregated number of audio output tokens used.

project_id: optional string

When group_by=project_id, this field provides the project ID of the grouped usage result.

service_tier: optional string

When group_by=service_tier, this field provides the service tier of the grouped usage result.

user_id: optional string

When group_by=user_id, this field provides the user ID of the grouped usage result.

UsageEmbeddingsResult object { input_tokens, num_model_requests, object, 4 more }

The aggregated embeddings usage details of the specific time bucket.

input_tokens: number

The aggregated number of input tokens used.

num_model_requests: number

The count of requests made to the model.

object: "organization.usage.embeddings.result"

api_key_id: optional string

When group_by=api_key_id, this field provides the API key ID of the grouped usage result.

model: optional string

When group_by=model, this field provides the model name of the grouped usage result.

project_id: optional string

When group_by=project_id, this field provides the project ID of the grouped usage result.

user_id: optional string

When group_by=user_id, this field provides the user ID of the grouped usage result.

UsageModerationsResult object { input_tokens, num_model_requests, object, 4 more }

The aggregated moderations usage details of the specific time bucket.

input_tokens: number

The aggregated number of input tokens used.

num_model_requests: number

The count of requests made to the model.

object: "organization.usage.moderations.result"

api_key_id: optional string

When group_by=api_key_id, this field provides the API key ID of the grouped usage result.

model: optional string

When group_by=model, this field provides the model name of the grouped usage result.

project_id: optional string

When group_by=project_id, this field provides the project ID of the grouped usage result.

user_id: optional string

When group_by=user_id, this field provides the user ID of the grouped usage result.

UsageImagesResult object { images, num_model_requests, object, 6 more }

The aggregated images usage details of the specific time bucket.

images: number

The number of images processed.

num_model_requests: number

The count of requests made to the model.

object: "organization.usage.images.result"

api_key_id: optional string

When group_by=api_key_id, this field provides the API key ID of the grouped usage result.

model: optional string

When group_by=model, this field provides the model name of the grouped usage result.

project_id: optional string

When group_by=project_id, this field provides the project ID of the grouped usage result.

size: optional string

When group_by=size, this field provides the image size of the grouped usage result.

source: optional string

When group_by=source, this field provides the source of the grouped usage result, possible values are image.generation, image.edit, image.variation.

user_id: optional string

When group_by=user_id, this field provides the user ID of the grouped usage result.

UsageAudioSpeechesResult object { characters, num_model_requests, object, 4 more }

The aggregated audio speeches usage details of the specific time bucket.

characters: number

The number of characters processed.

num_model_requests: number

The count of requests made to the model.

object: "organization.usage.audio_speeches.result"

api_key_id: optional string

When group_by=api_key_id, this field provides the API key ID of the grouped usage result.

model: optional string

When group_by=model, this field provides the model name of the grouped usage result.

project_id: optional string

When group_by=project_id, this field provides the project ID of the grouped usage result.

user_id: optional string

When group_by=user_id, this field provides the user ID of the grouped usage result.

UsageAudioTranscriptionsResult object { num_model_requests, object, seconds, 4 more }

The aggregated audio transcriptions usage details of the specific time bucket.

num_model_requests: number

The count of requests made to the model.

object: "organization.usage.audio_transcriptions.result"

seconds: number

The number of seconds processed.

api_key_id: optional string

When group_by=api_key_id, this field provides the API key ID of the grouped usage result.

model: optional string

When group_by=model, this field provides the model name of the grouped usage result.

project_id: optional string

When group_by=project_id, this field provides the project ID of the grouped usage result.

user_id: optional string

When group_by=user_id, this field provides the user ID of the grouped usage result.

UsageVectorStoresResult object { object, usage_bytes, project_id }

The aggregated vector stores usage details of the specific time bucket.

object: "organization.usage.vector_stores.result"

usage_bytes: number

The vector stores usage in bytes.

project_id: optional string

When group_by=project_id, this field provides the project ID of the grouped usage result.

UsageCodeInterpreterSessionsResult object { object, num_sessions, project_id }

The aggregated code interpreter sessions usage details of the specific time bucket.

object: "organization.usage.code_interpreter_sessions.result"

num_sessions: optional number

The number of code interpreter sessions.

project_id: optional string

When group_by=project_id, this field provides the project ID of the grouped usage result.

CostsResult object { object, amount, line_item, project_id }

The aggregated costs details of the specific time bucket.

object: "organization.costs.result"

amount: optional object { currency, value }

The monetary value in its associated currency.

currency: optional string

Lowercase ISO-4217 currency e.g. “usd”

value: optional number

The numeric value of the cost.

line_item: optional string

When group_by=line_item, this field provides the line item of the grouped costs result.

project_id: optional string

When group_by=project_id, this field provides the project ID of the grouped costs result.

start_time: number

has_more: boolean

next_page: string

object: "page"

Suggested

Audit Logs

List audit logs

Costs

ModelsExpand Collapse