> For the complete documentation index, see [llms.txt](https://docs.oort.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.oort.io/integrations/openai.md). # OpenAI ## Overview Cisco Identity Intelligence can integrate with OpenAI to provide visibility into users, AI applications, and activity across your ChatGPT Enterprise workspace and OpenAI API Platform. Leveraging this data, Identity Intelligence helps your organization better understand and answer questions such as who has access to OpenAI models, how those models are being used, how they are configured and what tools they have access to. Identity Intelligence can then generate beneficial insights regarding the users, Agents and Non-Human Identities (NHIs) within OpenAI, such as improperly configured tools, improper use of tools, privilege escalation, data loss prevention, and more. ### Requirements The following are necessary to configure the OpenAI integration: 1. OpenAI Enterprise subscription 2. OpenAI workspace(s) with Compliance API Access 3. An OpenAI Enterprise Platform admin account capable of creating Admin API keys 4. A workspace owner who can create the Compliance API Key ### OpenAI API Permission Structure Identity Intelligence requests the minimal scopes necessary to complete the required operations to support the integration. For this integration, Identity Intelligence requires a \`read-only\` API token. **Note**: The OpenAI Compliance API currently utilizes a coarse-grained permission structure that only supports either `read-only` or `read-write` permissions, and requires you to grant the API token permission to the whole API. It does not support granting a token access to limited portions of the API at this time. #### Why are both API keys required? You need both a Compliance API key and an Admin API key to successfully connect the integration. Each API key provides access to a different part of your OpenAI environment that Identity Intelligence leverages for data collection.

Key	Where it is created	What it provides	What field it corresponds to in Identity Intelligence
Compliance API key	OpenAI Admin Console - for ChatGPT and Codex	Visibility into ChatGPT and Codex users, AI applications, and activity, including conversation data according to your collection preference.	Compliance API Token
Admin API key	OpenAI API Platform - for your API Platform organization	Visibility into OpenAI API Platform users, audit activity, and administrative API key information.	Admin API Token

### Managing Conversation Data Collection Preferences for ChatGPT & Codex The OpenAI Compliance API contains both conversation metadata and conversation logs regarding the conversations happening between end-users and your organization's instance of ChatGPT or Codex, which Identity Intelligence can retrieve via this integration. The conversation logs from these tools contain valuable data and information that Identity Intelligence can then analyze to generate and surface interesting insights about potential issues or risks associated with the OpenAI usage within your organization, such as detecting improper tool use or assisting with data loss prevention initiatives.\ \ However, we understand that this data may be sensitive and your org may not want, or allow, Identity Intelligence to retain conversation logs between your end-users and OpenAI models. For that reason, there are three setting options available that enable you to configure what conversation data Identity Intelligence is allowed to process so that you can select the preferred data handling method for your org. These three settings are: 1. ***\[Default Setting - Recommended ]***** Collect conversation metadata only without conversation message content** 1. Identity Intelligence will retain conversation log **metadata only**, but will not retain **any** fields that contain data regarding user prompts or model responses. \*For Workspace Agents, Identity Intelligence will collect some data but does **not** collect or support user messages, agent responses or failure details 2. **Collect conversation metadata and conversation content** 1. Identity Intelligence will collect and retain **full** conversation data, including **all** metadata, user prompts and model responses. For Workspace Agents, Identity Intelligence includes conversation content and keeps all available Workspace Agent event content supporting agent-intent 3. **Do not collect ChatGPT or Codex conversation logs** 1. Identity Intelligence will not retain **any** conversation metadata or logs, and **cannot** collect any data regarding Workspace Agents The following table depicts the different capabilities and functionality that Identity Intelligence can perform based on the available Conversation Log settings. The desired setting option will be configured during the [#identity-intelligence-configuration-steps](#identity-intelligence-configuration-steps "mention") section of the configuration process. {% hint style="info" %} The insights and capabilities listed below may represent future functionality that will be developed for the General Availability release, or after, and do *not* have guaranteed availability during Beta {% endhint %}

What it enables	Option 1: Collect conversation metadata only without conversation message content	Option 2: Collect conversation metadata & conversation content	Option 3: Do not collect ChatGPT or Codex conversation logs
Baseline visibility	✅	✅	✅
Account directory-based data and insights _{Eg: Account activity, dormant accounts, admin privileges, etc.}	✅	✅	✅
GPT definition-based data and insights _{Eg: Known risky tools, broadly defined tools, tools available to users who shouldn’t have access, etc.}	✅	✅	✅
ChatGPT Workspace Agent discovery _{Eg: Agent prompts, descriptions, starter prompts & skills, owners, tools, activity, etc.}	✅ * _see _setting _details _above	✅
Basic tool usage insights _{Eg: Which tools were executed, what tool replied, etc.}	✅	✅
Deeper insights based on detailed conversation logs _{Eg: Tool misuse, AI drift, data exfiltration, etc.}		✅

**Note:** Identity Intelligence discovers Workspace Agents from their activity in the Compliance API logs, such as creation, updates, and runs. An agent with no activity since collection started appears after its next activity. ## OpenAI Configuration Steps #### Copy your Workspace ID and Organization ID 1. Sign in to the [OpenAI workspace console](https://admin.openai.com/workspace) 2. Select the workspace you want to connect to Identity Intelligence. Confirm the workspace name you have selected is the correct workspace before copying any identifiers 3. Under **General**, open **Workspace Settings** 4. Copy down the **Workspace ID** and **Organization ID** found on the **Workspace Admin Settings page**. You will need both of these IDs in later steps to complete the integration set up process 1. Note: The Tenant ID shown on this page is **not** required for this integration

1. Proceed to the next section of the documentation #### Create the Compliance API Key - ChatGPT and Codex The Compliance API Keyys allows Identity Intelligence to access to your organization's ChatGPT and Codex workspace data. For more information, refer to OpenAI's [workspace key authentication instructions](https://chatgpt.com/public/admin/api-reference#tag/Introduction). 1. Sign into OpenAI Admin console with a workspace owner account and navigate to **Credentials > Admin Keys** 2. Select **Create new admin key** and choose the relevant workspace you want to connect to Identity Intelligence 3. Give the key a name that is easy to recognize as linked to Identity Intelligence (eg: `Cisco Identity Intelligence Compliance API Key` ) 1. Note: OpenAI does **not** provide the option to create an admin API key linked to a service account 4. Select **Read only** permissions 5. Then, select **Create Admin Key.** After you have successfully created the key, **make sure to save the secret value.** You will need this for later steps and you will **not** be able to access it again - OpenAI displays it only once 6. Proceed to the next section of the documentation **Troubleshooting** If compliance access or the required permissions are unavailable, confirm that you are signed in as a **workspace owner** in the correct workspace. Contact your OpenAI account team or support to confirm or enable access if needed. #### Create the Admin API key - OpenAI API Platform Switch to the **OpenAI API Platform** to create a second, separate key. This key gives Identity Intelligence access to your API Platform organization's users and audit activity. 1. Sign in to OpenAI API Platform as an API Platform organization owner and navigate to [**Organization > Admin Keys**](https://platform.openai.com/settings/organization/admin-keys) 2. Select **Create new admin key** and give the key a name that is easy to recognize as linked to Identity Intelligence (eg: `Cisco Identity Intelligence Admin API Key` ) 3. Select **Restricted** permissions, then set both **Audit Logs** and **Organization Adminstration** to **Read.** The settings should look like this:

4. Once you have applied the correct permissions and scopes, select **Create Admin Key.** After you have successfully created the key, **make sure to save the secret value.** You will need this for later steps and you will **not** be able to access it again - OpenAI displays it only once 5. Navigate to the [data retention controls settings](https://platform.openai.com/settings/organization/data-controls/data-retention) section in OpenAI and **enable audit logging** if it is not already enabled. This allows Identity Intelligence to collect audit activity from your API Platform organization 6. You should have have your organization's Workspace ID, Organization ID and 2 separate secret values - the Compliance key and API Platform Admin Key 7. Proceed to the next section of the documentation ## Identity Intelligence Configuration Steps After you have completed the OpenAI configuration steps outlined above, navigate to the **Integrations** page within your Identity Intelligence tenant and perform the following steps: 1. Sign into Identity Intelligence with an admin role. 2. Navigate to the **Integrations** page and select the **Add Integration** button. Locate the **OpenAI Enterprise** tile and select **Add Integration** within the respective tile 3. Enter an easily recognizable display name for this integration (eg: `OpenAI `). This display name will be used throughout Identity Intelligence to identify the integration among your other connected sources 4. Enter the workspace ID and organization ID that you copied during Step 4 of the [#copy-your-workspace-id-and-organization-id](#copy-your-workspace-id-and-organization-id "mention")section above into the matching fields in the form

1. Select the desired Conversation Log Collection setting 1. More detailed info on the available settings are provided above in the [Managing Conversation Data Collection Preferences](#managing-conversation-data-collection-preferences-for-chatgpt-and-codex) section 2. Paste the Compliance key secret generated in the [#create-the-compliance-api-key-chatgpt-and-codex](#create-the-compliance-api-key-chatgpt-and-codex "mention") section of this documentation into the **Compliance API Token** field 3. Paste the Admin API key secret generated in the [#create-the-admin-api-key-openai-api-platform](#create-the-admin-api-key-openai-api-platform "mention")section of this documentation into the **Admin API Token** field 4. Select the **Connect** button to test the configuration connection 5. Once the connection test is successful, navigate back to the main **Integrations** landing page, locate the OpenAI integration in your list of integrations. Select the **3-dot menu button** on right-hand side of the relevant row to open the menu, then select **Collect Now** to begin the OpenAI data ingestion process 6. **Note**: Data collection can take some time, depending on the size of your environment. We recommend giving data ingestion a few days to stabilize before closely examining the results