OpenAI API Platform
Connect your OpenAI organization to Safeguard. The Admin key it needs, why OpenAI's Admin keys are full access, and step-by-step setup.
Availability
The compliance tests and the usage and cost pulls are switched on per workspace. If you do not see the card or the usage panel, ask your Safeguard contact.
What it does
Safeguard reads your own OpenAI API Platform organization with your own Admin key. It reads users, invites, projects, project API keys, service accounts, Admin keys, the audit log and data retention settings for continuous compliance tests, such as access reviews, unused keys and key age. It also reads usage and costs every day and builds per-project and per-key baselines. Days well above a baseline, new API keys, Owner grants, new service accounts and bursts of failed sign-ins become detections in Detection & Response. The card is OpenAI API Platform under Compliance > Connectors (Business Applications); the usage view is the card's Usage, cost and AIDR baselines panel. ChatGPT Enterprise has its own card.
Public vs private
| Public | Private | |
|---|---|---|
| What you enter | Nothing; there is no public mode | An OpenAI Admin key |
| Credential needed | None | An Admin key (sk-admin-...) |
| What you can read | Nothing | Your organization's users, projects, keys, audit log, usage and costs |
Supported auth methods
| Method | Use it when | Notes |
|---|---|---|
Admin key (sk-admin-...) | Always; it is the only key the Administration API accepts | Full access: OpenAI has no read-only or scoped Admin key |
Permissions required
Safeguard only sends read requests (GET) with the key. OpenAI's Admin keys cannot be narrowed, so least privilege comes from the key's expiry and from who holds it.
Admin key
| Permission / scope | Required? | What Safeguard uses it for |
|---|---|---|
| Admin key created by an organization Owner (no scopes exist; every Admin key is full access) | Required | Users, invites, projects, project API keys, service accounts and Admin keys (/v1/organization/users, /invites, /projects, /projects/{id}/api_keys, /projects/{id}/service_accounts, /admin_api_keys), usage (/v1/organization/usage/completions, embeddings, moderations, images, audio_speeches, audio_transcriptions, vector_stores, code_interpreter_sessions), costs (/v1/organization/costs) and data retention |
| Audit logging turned on (Settings > Organization > Data controls > Audit logging) | Required for the audit test and the audit detections | The audit log (/v1/organization/audit_logs) |
Least privilege: OpenAI offers no read-only Admin key. Create a dedicated Admin key named "Safeguard compliance" with an expiry of 90 days or less, and rotate it.
Token types
| Token type | Works? | Notes |
|---|---|---|
Admin key (sk-admin-...) | Yes (required) | Full access; OpenAI has no read-only Admin key |
Project API key (sk-proj-...) | No | Refused before any call; project keys cannot read usage, costs or the audit log |
User or legacy API key (sk-...) | No | Refused before any call |
| ChatGPT Enterprise Compliance API key | No | Use the ChatGPT card instead |
Expiry: choose an expiry of 90 days or less when you create the key. When it expires, the card shows Not working and the panel's last error asks you to reconnect.
What we never need: a key that calls models, and any change to users, projects or keys. Safeguard never invites, removes or changes anything, even though an Admin key could.
Step-by-step setup
Create the credential in OpenAI
- Turn on audit logging first: platform.openai.com > Settings > Organization > Data controls > Audit logging.
- An organization Owner opens platform.openai.com > Settings > Organization > Admin keys and clicks Create.
- Name it "Safeguard compliance" and choose an expiry of 90 days or less.
- Copy the key (it starts
sk-admin-). OpenAI shows it only once.
Or with the OpenAI CLI
OpenAI has no CLI for creating Admin keys.
Connect it in Safeguard
- Open Compliance > Connectors and find OpenAI API Platform under Business Applications.
- Choose API token and paste the Admin key.
- Save. The card shows Verified after the first successful read.
- Open the card's Usage, cost and AIDR baselines panel and click Sync now. The first pull reads the last 35 days.
Webhooks and triggers
This integration has no webhooks. Usage, costs and the audit log are pulled once a day (the last two days are re-read each time), compliance tests run on their schedule, and Sync now pulls on demand.
What we read and store
- Read: users (role, service account or not, last key use), invites, projects, project API key and Admin key metadata (owner, created, expiry, last used; never the secret), service accounts, audit log events, data retention settings, daily usage per project, user, key and model (tokens, requests, and each endpoint's own units), and daily costs per project and line item. Every list is read to the end.
- Stored: daily usage and cost rows, the baselines, compliance test results and evidence, and detections. The key is encrypted at rest, never logged and never shown again after you save it.
- Not stored: prompts, completions, files or conversation content. Safeguard does not read them.
- No customer data from this integration is sent to third-party LLMs. These are reads of your own OpenAI account with your own key; nothing is sent to any AI model.
Troubleshooting
| Message you see | Cause | Fix |
|---|---|---|
Reconnect the OpenAI API Platform connector with a current Admin key (sk-admin-...) from platform.openai.com > Settings > Organization > Admin keys; the stored one was deleted, expired or mistyped. | OpenAI answered 401 | Create a new Admin key and reconnect |
Use an Admin key (sk-admin-...) created by an organization Owner. Project keys (sk-proj-...) cannot read usage, costs or the audit log. | OpenAI answered 403, or the key is not an Admin key | Use an Admin key created by an Owner |
Turn on audit logging (platform.openai.com > Settings > Organization > Data controls > Audit logging), then pull again. | Audit logging is off | Turn it on, then click Sync now |
AI vendor usage for this provider is not enabled for this account. | Usage pulls are not switched on for your workspace | Ask your Safeguard contact |
Rotation and disconnect
- Rotate: create a new Admin key, edit the connection in Compliance > Connectors, paste the new key and save. Then delete the old key in Settings > Organization > Admin keys.
- Disconnect: delete the connection in Compliance > Connectors, then delete the Admin key in OpenAI. Pulled rows and evidence stay for your audit trail until your retention removes them.
Vendor references
- Administration API overview, checked 2026-10-16.
- Admin APIs guide, checked 2026-10-16.
- OpenAI OpenAPI specification (openapi.yaml 2.3.0), checked 2026-10-16.
Claude (Anthropic)
Connect your Anthropic organization to Safeguard. The key each feature needs, why Anthropic's Admin keys are full access, and step-by-step setup.
Jira
Create and sync Jira issues from Safeguard. The Jira permissions and API token scopes Safeguard needs, which tokens work, and step-by-step setup.