Connectors OpenAI
OpenAI
The OpenAI connector reads one OpenAI API organisation with its Admin API key: users, invites, projects, API keys, rate limits, retention and permission settings, usage and, if you opt in, costs and the audit log. How the connect flow works is on How connectors work.
Who can do it
Connecting needs connections:manage (Manage connections), held by Owner, Admin and Fleet operator.
Connect
- Go to Collection › Connectors and choose Connect on OpenAI. There is one mode, API Platform: "One OpenAI API organisation, read with its Admin API key."
- Give the connection a Name.
- Paste the Admin API key into the password field. The hint reads "From the OpenAI platform's Settings › Admin keys; a project key is refused."
- Continue through Check and Rules, then choose Create connection.
The connector sends the key to OpenAI's Admin API and reads the organisation OpenAI names in its answer. You do not type an organisation.
What it reads
| Records | What you get |
|---|---|
| Users | The organisation's members and their role. |
| Invites | Pending, accepted and expired invitations. |
| Projects | Every project, archived ones included. |
| Project members | Who is in each project, and as what. |
| Project API keys | Each project's keys: owner, expiry, last use, and whether the owner still has access. |
| Service accounts | Each project's service accounts and their role. |
| Admin API keys | The organisation's Admin keys. Read only; Oxelone never creates one. |
| Project rate limits | Per-model request and token limits on each project. |
| Certificates | Uploaded certificates: active or not, and when they expire. Never the certificate itself. |
| Groups | Groups, and whether the identity provider manages them. |
| Roles | The organisation's roles, predefined and custom. |
| Data retention | The retention setting of the organisation and of each project. |
| Model permissions | Each project's allow-list or deny-list of models. |
| Hosted tool permissions | Which hosted tools each project may use. |
| Spend limits | The hard monthly spend limit of the organisation and of each project. |
| Usage | Daily token and request counts per project and model, one bucket per usage family. |
| Costs | Off by default. "Stores what the organisation spends, per project and line item, every day." |
| Audit events | Off by default. "Stores who did what, with their email and the IP address it came from." |
What it can do
All need the Organization Admin permission with write access.
| Action | Consequence | Reversible |
|---|---|---|
| Remove from organisation | The person loses access to the organisation; getting back in takes a new invite. | No |
| Demote to reader | The person keeps access and loses the owner role. | Yes |
| Delete invite | The invitation is withdrawn. "If the invite has already been accepted, it cannot be deleted." | No |
| Archive project | "Archived projects cannot be used or updated." "Projects can be created and archived, but cannot be deleted." | No |
| Remove from project | The person loses access to this project and keeps their organisation membership. | Yes |
| Delete project API key | The key stops working; its value was only ever shown at creation. | No |
| Delete service account | The service account and its key stop working; re-creating mints a new key. | No |
| Delete Admin API key | The Admin key stops working. Oxelone refuses to delete its own key. | No |
What it checks
Fourteen posture checks, no inspections.
| Rule | Severity | Action offered |
|---|---|---|
| Project API key whose owner lost access | High | Delete project API key |
| Project API key with no expiry | Medium | None |
| Admin API key with no expiry | Medium | None |
| Project API key unused for 90 days | Low | Delete project API key |
| Organisation owner | Low | None |
| Service account with the owner role | Medium | Delete service account |
| Web search enabled on a project | Low | None |
| MCP enabled on a project | Medium | None |
| Code interpreter enabled on a project | Low | None |
| File search enabled on a project | Low | None |
| Certificate expires within 30 days | Medium | None |
| Group not managed by the identity provider | Low | None |
| Failed sign-in | Low | None |
| SCIM switched off | High | None |
The last two read Audit events, so they run only if you switch that record kind on.
What it needs to be Readable
An Admin API key with the Organization Admin permission. A project key is refused. If the key lacks the permission, each row reads "Not readable — the credential lacks the Organization Admin permission."
Sync period
1 h, 6 h and 1 d. There is no 15-minute period.
When it goes wrong
The messages are the shared ones on How connectors work, for example "the vendor refused this credential (code). Check that it has the permissions this connector asks for, and that it has not expired."
With the API
Not available with an API key.