Przejdź do treści

OpenAI connector

What this connector reads

The OpenAI connector reads your OpenAI organisation's project list and the models invoked by each project over the last 30 days. We see project names, project IDs, and model identifiers (gpt-4o, gpt-4o-mini, o1-mini, etc.) — not request bodies, not response contents, not user prompts.

This connector covers OpenAI API platform organisations only. It does not cover ChatGPT Enterprise workspaces — the enterprise admin API is separate, and integration is on our roadmap.

What you (the customer) need to do

You will need an OpenAI organisation owner or admin.

  1. In OpenAI's platform console, go to Settings → Admin keys → Create admin key. Admin keys begin with sk-admin-…. They are distinct from regular sk-… API keys: admin keys can call /v1/organization/* endpoints but cannot make completions.
  2. Copy the admin key. Treat it as a credential — it can read billing, project membership, and usage data for your org.
  3. In Secruna, open Connections → Connect OpenAI. (screenshot placeholder TODO)
  4. Paste the admin key. We immediately validate it by calling GET /v1/organization/users?limit=1 — a 401 here indicates a non-admin key and we reject without storing.
  5. On success, the key is encrypted and stored in our Azure Key Vault under the connection ID; the connection is active.

Permissions / scopes requested

OpenAI admin keys do not have OAuth scopes; they grant access to the entire /v1/organization/* namespace. The endpoints Secruna actually exercises are:

Endpoint Why
GET /v1/organization/users?limit=1 Validation only, on connect and on every discovery run.
GET /v1/organization/projects (paginated) List projects in the org.
GET /v1/organization/usage/completions (per project, 30-day window, group_by=model) Determine which models each project has used recently.

We never call:

  • /v1/chat/completions, /v1/responses, /v1/embeddings, or any inference endpoint
  • /v1/files or /v1/fine-tuning
  • /v1/organization/invites, /v1/organization/users write methods, or any other mutation

What we do NOT touch

  • Prompts and completions. We use the aggregated usage API, which reports counts by model — not requests, not message content, not embeddings inputs.
  • Fine-tuned models beyond their identifier appearing in usage data.
  • Files uploaded to your OpenAI account.
  • Billing data. We do not call /v1/organization/usage/billing or any spend-related endpoint.

How to revoke access

  1. In OpenAI platform console → Admin keys, click Revoke on the admin key you issued to Secruna. Once revoked, our next API call returns 401 and discovery stops returning data.
  2. In Secruna, open Connections and click Disconnect on the OpenAI row. We delete the encrypted secret from Key Vault on disconnect.
  3. Within 90 days every artefact collected through this connection is purged. See data retention policy.

We recommend rotating the admin key once a quarter even without a revocation event. The flow: create a new admin key, paste it into Secruna (creates a new connection), revoke the old key, then disconnect the old Secruna connection.

Troubleshooting

Error you see Likely cause Fix
Key is not an admin-scoped OpenAI key You pasted a regular sk-… key, not an sk-admin-… key. Generate an admin key in Settings → Admin keys.
OpenAI key validation failed: 429 The org has hit its API rate limit. Wait 60 seconds and retry.
Connection active but 0 projects listed The org has only the default project and it has no usage in the last 30 days. Verify in OpenAI console that the org has projects with recent activity.
Model usage list empty for a project that has activity The 30-day usage rollup hasn't backfilled yet for very recent usage (typically <2h delay). Re-trigger discovery later.