Oleria doesn’t import ChatGPT conversations, files, or prompts. This integration covers identity and access governance only.
What Oleria discovers
Once connected, Oleria continuously discovers and maps the following from your OpenAI organization:- Accounts - every member of your OpenAI organization, with their organization role (Owner or Reader), whether the account is enabled, when it was added, and whether it’s managed through SCIM. Owners are marked as administrators. Last activity is the last time one of the member’s API keys was used.
- Projects - every active project appears as a group, with its members and each member’s project role (Owner or Member). Service accounts appear as members of the project they belong to.
- Groups - organization groups, their members, and the projects each group has access to. Groups that your identity provider syncs through SCIM are marked as synced groups.
- Roles - organization roles and project roles, both predefined and custom, with the permissions each role grants. Each project role appears once per project, so an assignment keeps its project. Oleria maps the users and groups each role is assigned to directly. A role that a user holds only through a group appears through that group.
- Non-human identities - project service accounts, project API keys, and Admin API keys. Each key is paired with a credential that shows its status (active, disabled when its owner has lost access to the project, or expired), its expiry, and when it was last used, and is linked to the user or service account that owns it. Oleria never reads key values.
- ChatGPT workspace users - with the optional ChatGPT workspace Admin key, every user in your ChatGPT workspace, with their workspace role (Owner, Admin, or Member) and status. Workspace owners and admins are marked as administrators.
- Custom GPTs - with the optional ChatGPT workspace Admin key, when AI agent discovery is turned on for your Oleria workspace: the custom GPTs in your ChatGPT workspace and the user who owns each one.
- Activity - events from the OpenAI audit log, once audit logging is turned on: sign-ins and sign-outs, member, project, group, role, and service account changes, API key creation and deletion, and organization setting changes such as IP allowlist, SCIM, certificate, and rate limit changes. Other event types are kept under their OpenAI event name. With the optional ChatGPT workspace Admin key, Oleria also imports ChatGPT sign-in events and Codex activity.
Prerequisites
- An OpenAI organization Owner, to create the Admin API key. Only Owners can create Admin API keys.
- Your OpenAI organization ID.
- Optional: a ChatGPT Enterprise or Edu workspace, and a workspace Owner to create the ChatGPT workspace Admin key.
- Admin access to the Oleria workspace.
Set up the OpenAI Admin API key
1
Create an Admin API key
Sign in to the OpenAI Platform as an organization Owner and go to Settings -> Organization -> Admin keys. Select Create new admin key, enter a descriptive name (for example,
Oleria), and choose its permissions. Give the key full access: that covers everything Oleria reads, including the audit log, and the write access that remediation actions need. OpenAI notes that some groups and roles endpoints need scopes a narrower key doesn’t include.2
Copy the key
Copy the key and store it securely. OpenAI shows it only once and can’t recover a lost key.
3
Copy your organization ID
Go to Settings -> Organization -> General and copy the Organization ID. It starts with
org-.The Admin API doesn’t return the organization ID, so Oleria can’t check it against the key. Copy the ID from the same organization you created the key in.
4
Turn on audit logging
To collect audit activity, go to Settings -> Data controls -> Data retention. Under Audit logging, select Enable and save your changes. OpenAI records audit events only from the time audit logging is turned on, and once it’s on, only OpenAI Support can turn it off.
Optional: set up ChatGPT workspace access
Add this key if you use ChatGPT Enterprise or Edu and want Oleria to read your ChatGPT workspace users, custom GPTs, and sign-in and Codex activity. You enter it in the connection form as the ChatGPT Compliance API key. In the ChatGPT Admin Console, OpenAI calls it a workspace Admin key.1
Open the ChatGPT Admin Console
Sign in to the ChatGPT Admin Console as a workspace Owner. Select your tenant if you’re asked to, then select the ChatGPT workspace you want to connect.
2
Create a workspace Admin key
Open Credentials -> Admin keys and select Create new admin key. Enter a descriptive name and choose an expiration. Under permissions, select Read only. If you choose Custom instead, grant read access to workspace users, GPTs, and the authentication and Codex logs. Select Submit, then copy the key and store it securely. You can’t view it again.
3
Copy the workspace ID
Copy the ID of the same ChatGPT workspace from the Admin Console. It’s a UUID, such as
a1b2c3d4-e5f6-7890-abcd-ef1234567890, and it isn’t your OpenAI organization ID.A ChatGPT workspace Admin key reads one ChatGPT workspace only, and an API Platform Admin API key can’t read ChatGPT workspaces. A workspace Admin key also stops working when it expires, is revoked, or its creator loses access to the workspace. When it stops working, syncs still succeed, but custom GPTs and ChatGPT activity stop updating and custom GPTs disappear from Oleria. Replace the key by editing the integration. For details, see OpenAI’s Managing Admin keys in Admin Console article.
Connect to Oleria
1
Open the integration
Go to your Oleria workspace, select Integrations, then select the ChatGPT & Codex tile.
2
Complete the connection form
Fill in the connection form:
3
Authenticate
Select Authenticate. Before it saves anything, Oleria checks that the Admin API key can read members, projects, groups, roles, and Admin API keys and, if you entered one, that the ChatGPT key can read your workspace users. If a check fails, the error names what the key can’t read. The audit log isn’t required: if audit logging is off, the integration still connects, and activity starts once you turn audit logging on.
Verify the integration
Confirm the integration appears on the Connected tab of your Oleria Integrations page as ChatGPT & Codex (org-…), with a status of Healthy. After the first sync completes, check that members, projects, groups, roles, service accounts, and API keys appear in your Oleria workspace, and that organization Owners are marked as administrators.When you edit the integration, leave Admin API key or ChatGPT Compliance API key blank to keep the stored key. The organization ID can’t be changed, and a new Admin API key must belong to the same organization. To stop collecting ChatGPT workspace data, clear ChatGPT workspace ID, which also removes the stored ChatGPT key.
Remediation actions
Oleria can take these actions in your OpenAI organization with the Admin API key. They need a key with write permissions. Before an action runs, Oleria checks that the key works, but it can’t see the key’s permissions. If the key lacks the write permission an action needs, OpenAI rejects the change and the action fails with a permission error.
Keep these limits in mind when you use these actions:
- Account actions apply to OpenAI organization members. Oleria doesn’t change ChatGPT workspace users, so manage them in the ChatGPT Admin Console or your identity provider. For service accounts and API keys, use Disable non-human identity.
- Oleria won’t remove the Owner whose Admin API key the integration uses, or remove that Owner from a group, project, or role, or reverse an action that added them, because that could lock the integration out. It also won’t delete the integration’s own Admin API key. If Oleria can’t identify which key the integration uses, it refuses these actions instead of guessing.
- Remove from role works only on roles assigned directly to the member. If the member holds the role through a group, remove them from the group instead.
- If the member is already in the requested state, Oleria makes no change, and reverting the action does nothing.
- If OpenAI applies a change but its response is lost, Oleria reads the membership or role again and reports what actually happened.
- Change the membership of groups that your identity provider syncs through SCIM in the identity provider, not in OpenAI.
Known limitations
- No MFA, single sign-on, or last sign-in data. OpenAI’s admin APIs don’t report these for members. Last activity reflects API key use. Dashboard sign-ins appear as activity once audit logging is on.
- Activity starts when audit logging is turned on. OpenAI doesn’t record audit events from before that point.
- ChatGPT activity covers the last 30 days. OpenAI’s Compliance Platform keeps logs for 30 days, so Oleria can’t import older ChatGPT sign-in or Codex events.
- Project API key permissions aren’t shown. OpenAI’s key listings don’t include a project key’s permissions, so its credential reports authority as unavailable. Admin API keys are shown with full authority over the organization.
- Archived projects aren’t shown. Oleria imports active projects only.
- ChatGPT workspace groups aren’t synced, and ChatGPT workspace users can’t be changed from Oleria.
- Codex isn’t inventoried. Oleria doesn’t list Codex cloud environments, tasks, or Codex access tokens. Codex use appears through Codex activity (with the ChatGPT workspace Admin key) and through the API keys and audit trail of your OpenAI organization.
- Only custom GPTs are discovered as AI agents. Workspace agents and other agents aren’t discovered.
- Removals are permanent. Removing a member or deleting a service account or key can’t be undone through OpenAI’s API.
Existing ChatGPT SCIM connections
Earlier ChatGPT connections used a SCIM base URL and token from ChatGPT directory sync. Those credentials can’t authenticate to the OpenAI Admin API, so the connection stops syncing and its error asks you to reconnect with an OpenAI Admin API key. You can’t convert it by editing it.1
Create the new credentials
Create an Admin API key and copy your organization ID, as described in Set up the OpenAI Admin API key. To keep seeing your ChatGPT workspace users, also create a ChatGPT workspace Admin key, as described in Optional: set up ChatGPT workspace access.
2
Connect again
Add a new ChatGPT & Codex integration, as described in Connect to Oleria.
3
Remove the old connection
Remove the old ChatGPT SCIM connection. Removing an integration deletes its data from Oleria, and active access reviews and investigations that use it lose their context.