API Reference

Admin

Organization

Audit Logs

Copy Markdown

Open in Claude

Open in ChatGPT

Open in Cursor

---

Copy Markdown

View as Markdown

List audit logs

admin.organization.audit_logs.list(**kwargs) -> ConversationCursorPage<AuditLogListResponse { id, effective_at, type, 57 more } >

GET/organization/audit_logs

List user actions and configuration changes within this organization.

ParametersExpand Collapse

actor_emails: Array[String]

Return only events performed by users with these emails.

actor_ids: Array[String]

Return only events performed by these actors. Can be a user ID, a service account ID, or an api key tracking ID.

after: String

A cursor for use in pagination. after is an object ID that defines your place in the list. For instance, if you make a list request and receive 100 objects, ending with obj_foo, your subsequent call can include after=obj_foo in order to fetch the next page of the list.

before: String

A cursor for use in pagination. before is an object ID that defines your place in the list. For instance, if you make a list request and receive 100 objects, starting with obj_foo, your subsequent call can include before=obj_foo in order to fetch the previous page of the list.

effective_at: EffectiveAt{ gt, gte, lt, lte}

Return only events whose effective_at (Unix seconds) is in this range.

event_types: Array[:"api_key.created" | :"api_key.updated" | :"api_key.deleted" | 144 more]

Return only events with a type in one of these values. For example, project.created. For all options, see the documentation for the audit log object.

limit: Integer

A limit on the number of objects to be returned. Limit can range between 1 and 100, and the default is 20.

project_ids: Array[String]

Return only events for these projects.

resource_ids: Array[String]

Return only events performed on these targets. For example, a project ID updated. For ChatGPT connector role events, use the workspace connector resource ID shown in details.id, such as <workspace_id>__<connector_id>.

tenant_only: bool

Return only tenant-scoped events associated with this organization. Required for tenant-scoped events such as role.bound_to_resource and role.unbound_from_resource. When true, all supplied event types must be tenant-scoped.

ReturnsExpand Collapse

class AuditLogListResponse { id, effective_at, type, 57 more }

A log of a user action or configuration change within this organization.

id: String

The ID of this log.

effective_at: Integer

The Unix timestamp (in seconds) of the event.

formatunixtime

type: :"api_key.created" | :"api_key.updated" | :"api_key.deleted" | 144 more

The event type.

actor: Actor{ api_key, session, type}

The actor who performed the audit logged action.

api_key_created: APIKeyCreated{ id, data}

The details for events with this type.

api_key_deleted: APIKeyDeleted{ id}

The details for events with this type.

api_key_updated: APIKeyUpdated{ id, changes_requested}

The details for events with this type.

certificate_created: CertificateCreated{ id, name}

The details for events with this type.

certificate_deleted: CertificateDeleted{ id, certificate, name}

The details for events with this type.

certificate_updated: CertificateUpdated{ id, name}

The details for events with this type.

certificates_activated: CertificatesActivated{ certificates}

The details for events with this type.

certificates_deactivated: CertificatesDeactivated{ certificates}

The details for events with this type.

checkpoint_permission_created: CheckpointPermissionCreated{ id, data}

The project and fine-tuned model checkpoint that the checkpoint permission was created for.

checkpoint_permission_deleted: CheckpointPermissionDeleted{ id}

The details for events with this type.

external_key_registered: ExternalKeyRegistered{ id, data}

The details for events with this type.

external_key_removed: ExternalKeyRemoved{ id}

The details for events with this type.

group_created: GroupCreated{ id, data}

The details for events with this type.

group_deleted: GroupDeleted{ id}

The details for events with this type.

group_updated: GroupUpdated{ id, changes_requested}

The details for events with this type.

invite_accepted: InviteAccepted{ id}

The details for events with this type.

invite_deleted: InviteDeleted{ id}

The details for events with this type.

invite_sent: InviteSent{ id, data}

The details for events with this type.

ip_allowlist_config_activated: IPAllowlistConfigActivated{ configs}

The details for events with this type.

ip_allowlist_config_deactivated: IPAllowlistConfigDeactivated{ configs}

The details for events with this type.

ip_allowlist_created: IPAllowlistCreated{ id, allowed_ips, name}

The details for events with this type.

ip_allowlist_deleted: IPAllowlistDeleted{ id, allowed_ips, name}

The details for events with this type.

ip_allowlist_updated: IPAllowlistUpdated{ id, allowed_ips}

The details for events with this type.

login_failed: LoginFailed{ error_code, error_message}

The details for events with this type.

login_succeeded: untyped

This event has no additional fields beyond the standard audit log attributes.

logout_failed: LogoutFailed{ error_code, error_message}

The details for events with this type.

logout_succeeded: untyped

This event has no additional fields beyond the standard audit log attributes.

organization_updated: OrganizationUpdated{ id, changes_requested}

The details for events with this type.

project: Project{ id, name}

The project that the action was scoped to. Absent for actions not scoped to projects. Note that any admin actions taken via Admin API keys are associated with the default project.

project_archived: ProjectArchived{ id}

The details for events with this type.

project_created: ProjectCreated{ id, data}

The details for events with this type.

project_deleted: ProjectDeleted{ id}

The details for events with this type.

project_updated: ProjectUpdated{ id, changes_requested}

The details for events with this type.

rate_limit_deleted: RateLimitDeleted{ id}

The details for events with this type.

rate_limit_updated: RateLimitUpdated{ id, changes_requested}

The details for events with this type.

role_assignment_created: RoleAssignmentCreated{ id, principal_id, principal_type, 2 more}

The details for events with this type.

role_assignment_deleted: RoleAssignmentDeleted{ id, principal_id, principal_type, 2 more}

The details for events with this type.

role_bound_to_resource: RoleBoundToResource{ id, connector_id, connector_name, 7 more}

The details for events with this type.

role_created: RoleCreated{ id, permissions, resource_id, 2 more}

The details for events with this type.

role_deleted: RoleDeleted{ id}

The details for events with this type.

role_unbound_from_resource: RoleUnboundFromResource{ id, connector_id, connector_name, 7 more}

The details for events with this type.

role_updated: RoleUpdated{ id, changes_requested}

The details for events with this type.

scim_disabled: ScimDisabled{ id}

The details for events with this type.

scim_enabled: ScimEnabled{ id}

The details for events with this type.

service_account_created: ServiceAccountCreated{ id, data}

The details for events with this type.

service_account_deleted: ServiceAccountDeleted{ id}

The details for events with this type.

service_account_updated: ServiceAccountUpdated{ id, changes_requested}

The details for events with this type.

user_added: UserAdded{ id, data}

The details for events with this type.

user_deleted: UserDeleted{ id}

The details for events with this type.

user_updated: UserUpdated{ id, changes_requested}

The details for events with this type.

workload_identity_provider_mapping_created: WorkloadIdentityProviderMappingCreated{ id, data, identity_provider_id}

The details for events with this type.

workload_identity_provider_mapping_deleted: WorkloadIdentityProviderMappingDeleted{ id, identity_provider_id, project_id, service_account_id}

The details for events with this type.

workload_identity_provider_mapping_updated: WorkloadIdentityProviderMappingUpdated{ id, changes_requested, identity_provider_id}

The details for events with this type.

workload_identity_provider_created: WorkloadIdentityProviderCreated{ id, data}

The details for events with this type.

workload_identity_provider_deleted: WorkloadIdentityProviderDeleted{ id, name}

The details for events with this type.

workload_identity_provider_updated: WorkloadIdentityProviderUpdated{ id, changes_requested}

The details for events with this type.

List audit logs

Ruby

HTTP

Python

TypeScript

Go

Ruby

Java

CLI Tool

require "openai"

openai = OpenAI::Client.new(admin_api_key: "My Admin API Key")

page = openai.admin.organization.audit_logs.list

puts(page)

{
    "object": "list",
    "data": [
        {
            "id": "audit_log-xxx_yyyymmdd",
            "type": "project.archived",
            "effective_at": 1722461446,
            "actor": {
                "type": "api_key",
                "api_key": {
                    "type": "user",
                    "user": {
                        "id": "user-xxx",
                        "email": "user@example.com"
                    }
                }
            },
            "project.archived": {
                "id": "proj_abc"
            },
        },
        {
            "id": "audit_log-yyy__20240101",
            "type": "api_key.updated",
            "effective_at": 1720804190,
            "actor": {
                "type": "session",
                "session": {
                    "user": {
                        "id": "user-xxx",
                        "email": "user@example.com"
                    },
                    "ip_address": "127.0.0.1",
                    "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36",
                    "ja3": "a497151ce4338a12c4418c44d375173e",
                    "ja4": "q13d0313h3_55b375c5d22e_c7319ce65786",
                    "ip_address_details": {
                      "country": "US",
                      "city": "San Francisco",
                      "region": "California",
                      "region_code": "CA",
                      "asn": "1234",
                      "latitude": "37.77490",
                      "longitude": "-122.41940"
                    }
                }
            },
            "api_key.updated": {
                "id": "key_xxxx",
                "data": {
                    "scopes": ["resource_2.operation_2"]
                }
            },
        }
    ],
    "first_id": "audit_log-xxx__20240101",
    "last_id": "audit_log_yyy__20240101",
    "has_more": true
}

Returns Examples

{
    "object": "list",
    "data": [
        {
            "id": "audit_log-xxx_yyyymmdd",
            "type": "project.archived",
            "effective_at": 1722461446,
            "actor": {
                "type": "api_key",
                "api_key": {
                    "type": "user",
                    "user": {
                        "id": "user-xxx",
                        "email": "user@example.com"
                    }
                }
            },
            "project.archived": {
                "id": "proj_abc"
            },
        },
        {
            "id": "audit_log-yyy__20240101",
            "type": "api_key.updated",
            "effective_at": 1720804190,
            "actor": {
                "type": "session",
                "session": {
                    "user": {
                        "id": "user-xxx",
                        "email": "user@example.com"
                    },
                    "ip_address": "127.0.0.1",
                    "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36",
                    "ja3": "a497151ce4338a12c4418c44d375173e",
                    "ja4": "q13d0313h3_55b375c5d22e_c7319ce65786",
                    "ip_address_details": {
                      "country": "US",
                      "city": "San Francisco",
                      "region": "California",
                      "region_code": "CA",
                      "asn": "1234",
                      "latitude": "37.77490",
                      "longitude": "-122.41940"
                    }
                }
            },
            "api_key.updated": {
                "id": "key_xxxx",
                "data": {
                    "scopes": ["resource_2.operation_2"]
                }
            },
        }
    ],
    "first_id": "audit_log-xxx__20240101",
    "last_id": "audit_log_yyy__20240101",
    "has_more": true
}