Audit logs

Logs of user actions and configuration changes within this organization. To log events, you must activate logging in the Organization Settings. Once activated, for security reasons, logging cannot be deactivated.source

List audit logs

get https://api.openai.com/v1/organization/audit_logs

List user actions and configuration changes within this organization.source

Query parameters

Return only events whose effective_at (Unix seconds) is in this range.source

Return only events for these projects.source

Return only events with a type in one of these values. For example, project.created. For all options, see the documentation for the audit log object.source

Return only events performed by these actors. Can be a user ID, a service account ID, or an api key tracking ID.source

Return only events performed by users with these emails.source

Return only events performed on these targets. For example, a project ID updated.source

A limit on the number of objects to be returned. Limit can range between 1 and 100, and the default is 20.source

A cursor for use in pagination. after is an object ID that defines your place in the list. For instance, if you make a list request and receive 100 objects, ending with obj_foo, your subsequent call can include after=obj_foo in order to fetch the next page of the list.source

A cursor for use in pagination. before is an object ID that defines your place in the list. For instance, if you make a list request and receive 100 objects, starting with obj_foo, your subsequent call can include before=obj_foo in order to fetch the previous page of the list.source

Returns

A list of paginated Audit Log objects.source

Example request
1
2
3
curl https://api.openai.com/v1/organization/audit_logs \
-H "Authorization: Bearer $OPENAI_ADMIN_KEY" \
-H "Content-Type: application/json"
Response
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
{
    "object": "list",
    "data": [
        {
            "id": "audit_log-xxx_yyyymmdd",
            "type": "project.archived",
            "effective_at": 1722461446,
            "actor": {
                "type": "api_key",
                "api_key": {
                    "type": "user",
                    "user": {
                        "id": "user-xxx",
                        "email": "user@example.com"
                    }
                }
            },
            "project.archived": {
                "id": "proj_abc"
            },
        },
        {
            "id": "audit_log-yyy__20240101",
            "type": "api_key.updated",
            "effective_at": 1720804190,
            "actor": {
                "type": "session",
                "session": {
                    "user": {
                        "id": "user-xxx",
                        "email": "user@example.com"
                    },
                    "ip_address": "127.0.0.1",
                    "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
                }
            },
            "api_key.updated": {
                "id": "key_xxxx",
                "data": {
                    "scopes": ["resource_2.operation_2"]
                }
            },
        }
    ],
    "first_id": "audit_log-xxx__20240101",
    "last_id": "audit_log_yyy__20240101",
    "has_more": true
}

The audit log object

A log of a user action or configuration change within this organization.source

The ID of this log.source

The event type.source

The Unix timestamp (in seconds) of the event.source

The project that the action was scoped to. Absent for actions not scoped to projects.source

The actor who performed the audit logged action.source

The details for events with this type.source

The details for events with this type.source

The details for events with this type.source

The details for events with this type.source

The details for events with this type.source

The details for events with this type.source

The details for events with this type.source

The details for events with this type.source

The details for events with this type.source

The details for events with this type.source

The details for events with this type.source

The details for events with this type.source

The details for events with this type.source

The details for events with this type.source

The details for events with this type.source

The details for events with this type.source

The details for events with this type.source

The details for events with this type.source

The details for events with this type.source

The details for events with this type.source

OBJECT The audit log object
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
{
    "id": "req_xxx_20240101",
    "type": "api_key.created",
    "effective_at": 1720804090,
    "actor": {
        "type": "session",
        "session": {
            "user": {
                "id": "user-xxx",
                "email": "user@example.com"
            },
            "ip_address": "127.0.0.1",
            "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
        }
    },
    "api_key.created": {
        "id": "key_xxxx",
        "data": {
            "scopes": ["resource.operation"]
        }
    }
}