OpenAI

The OpenAI integration monitors your OpenAI platform organization — members and their organization roles, projects and project membership, service accounts, groups, custom roles, project and admin API keys, mTLS certificates and pending invitations — plus each project's declared model and hosted-tool policy. When an Enterprise plan exposes them it also reads audit logs (for last-activity enrichment and the OpenAI event stream) and cost reporting, and when a ChatGPT Enterprise Compliance API key is supplied it reads the ChatGPT workspace and its members.

Before starting

• You need the owner role in your OpenAI organization to provision an Admin API key with full read access.
• Optional: a ChatGPT Enterprise plan and a Compliance API key if you want ChatGPT workspace visibility.
• Audit logs, cost reporting, groups, custom roles and mTLS certificates depend on your plan. Each is read on a best-effort basis and skipped when unavailable — the rest of the sync is unaffected.

1. Create an Admin API key

1. In the OpenAI platform, go to Settings → Organization → Admin keys and create an Admin API key (it starts with sk-admin-...). Only organization owners can provision one.
2. Copy the key — it is shown once.

note

SlashID only reads with this key. It never retrieves a usable API key secret: OpenAI returns a key's secret exactly once, at creation, and the sync reads only the redacted form (sk-...abcd) that the listing endpoints return.

2. Find your organization ID

Your organization ID starts with org- and is shown in Settings → Organization → General in the OpenAI platform. It is also echoed on every Admin API response:

curl https://api.openai.com/v1/organization/projects?limit=1 \
  --header "Authorization: Bearer $OPENAI_ADMIN_KEY"

If the key does not belong to the organization you entered, the connection's admin_key_valid preflight check fails with a message naming the organization.

3. (Optional) Create a Compliance API key — ChatGPT Enterprise only

If your organization uses ChatGPT Enterprise, create a Compliance API key in the ChatGPT admin settings with the workspace read scopes. This unlocks the ChatGPT workspace and its members as a separate identity type (openai_workspace_user), which is distinct from the platform organization's members.

Without it, SlashID syncs the platform organization only. The compliance endpoints are never dialled with the Admin API key.

4. Create your OpenAI ↔ SlashID integration

Go to the SlashID Console integrations page and create an OpenAI connection:

SlashID Console field	Description	Example
Name of the connection	Arbitrary name for this connection	OpenAI Production
Organization ID	Your OpenAI organization ID (step 2)	org-a1B2c3D4e5F6
Admin API key	The key you created in step 1	sk-admin-...
Compliance API key	Optional — the ChatGPT Enterprise key from step 3	sk-...
Authoritative status	Whether OpenAI identities are the primary source of truth when reconciling across sources	Primary or Secondary

Verification

After the first sync, SlashID shows:

• Users — organization members with their organization role, SCIM-managed flag, enabled/banned state and, with audit logs available, last activity and last IP,
• Service accounts — project-scoped non-human identities, with the project role they hold,
• Projects — with owner counts, rate limits, and the declared model policy (allow list or deny list) and hosted-tool enablement,
• Groups and custom roles, with their memberships and grants,
• API keys — project keys and organization admin keys, with the redacted key hint, creation and last-used timestamps, and the owner they belong to,
• mTLS certificates and pending invitations,
• Models and tools each project declares access to, coalesced with the same nodes that observed AI traffic produces, so declared and actual usage line up on one graph.

Connection preflight checks validate the credential and each permission. Required checks mirror what the sync hard-fails on; optional slices degrade gracefully.

Troubleshooting

• admin_key_valid fails with "was rejected" — the Admin API key is invalid or revoked. Create a new one (step 1). Admin keys start with sk-admin-.
• admin_key_valid fails with "does not have access to organization …" — the key was accepted but is not permitted to read the organization you entered. Check the organization ID (step 2), and confirm the key was provisioned by an organization owner.
• list_users or list_projects fails — these are required. The sync aborts rather than importing an empty list, because an empty list would delete every OpenAI identity on the next reconcile.
• list_project_users, list_project_service_accounts or list_project_api_keys fails — the key cannot read one of the per-project collections. The sync reads every project and aborts on the first denial, so these are required too. All three are reported as skipped when the organization has no projects.
• list_groups or list_roles fails — groups and custom roles require a plan that exposes them. Group memberships and role grants are skipped; the rest of the sync continues.
• list_admin_api_keys fails — reading organization admin keys requires an owner-provisioned key. Without it, admin keys are not inventoried, including any that never expire.
• list_invites or list_certificates fails — pending invitations or mTLS certificates are skipped. Certificates require the certificates feature on your plan.
• read_audit_logs fails — audit logs are available on Enterprise plans only. Last-activity enrichment and the OpenAI event stream are skipped.
• read_costs fails — cost reporting requires billing access on the Admin API key. OpenAI spend is not attributed to projects or keys.
• compliance_workspace fails — the Compliance API key lacks the workspace read scopes. The ChatGPT workspace and its members are skipped. This check is reported as skipped, not failed, when no compliance key is configured.