Skip to content

OpenAI

Private Beta

Cloud Security is currently in Private Beta. Features, APIs, and configuration formats described here may change before general availability. Contact us if you would like access.

Collects your OpenAI platform organization as an AI-security surface: projects, members and service accounts, API keys (with last-used timestamps, so dormant and over-scoped keys surface), org Admin API keys, mTLS certificates, and audit-log availability posture.

Auth model: an Admin API key created with the read-only api.management.read scope, calling the OpenAI Administration API.

Prerequisites

  • Organization Owner on the OpenAI platform account — only owners can create Admin API keys.

Create the Admin API key

  1. Go to platform.openai.com → Settings → Organization → Admin keys (https://platform.openai.com/settings/organization/admin-keys).
  2. Click Create admin key.
  3. Select the api.management.read scope at creation time.
  4. Copy the key (sk-admin-…) — it is displayed once.

Scope the key when you create it

Grant api.management.read during creation. Keys whose scopes are edited after the fact have been observed to keep failing with "Missing scopes: api.management.read". If a key misbehaves, delete it and create a fresh one with the scope selected up front.

Read-only by design

api.management.read is a true read-only scope. The collector never writes to your organization; it only lists projects, users, keys, certificates, and audit-log availability.

Optional: enable audit logging

The org audit log is a separate toggle in the OpenAI organization settings. It is not required for the connection, but without it there is no configuration-change forensics — the audit_logs check reports that.

Create the credentials secret

{"admin_api_key": "sk-admin-..."}

You may also paste the bare key string; it is wrapped into this shape automatically.

limacharlie hive set --hive-name secret --key openai-admin-key \
    --input-file openai-secret.json --enabled

Create the provider record

provider.yaml:

provider_type: openai
credentials: hive://secret/openai-admin-key
internal_domains: [example.com]
refresh: 6h

openai_org_id (org-…) is optional: the Admin key already implies its organization, which the collector discovers. Setting it turns that into an assertion — a mismatch fails the connection immediately rather than silently sweeping the wrong organization. Useful when one team manages several OpenAI orgs.

In the web app: Add provider → OpenAI, then set Credentials and Refresh interval.

Verify

limacharlie cloudsec provider test --input-file provider.yaml
Check Required Meaning if it fails
auth ✅ The Admin key was rejected, or lacks api.management.read. Nothing else is probed.
projects ✅ Project enumeration denied — the sweep has no accounts to walk.
project_keys ✅ Per-project API-key inventory denied — no key hygiene (dormant/over-scoped keys). Passes with a note if the org has no projects yet.
admin_keys — Org Admin-API-key hygiene (dormant / never-expiring admin keys) unavailable.
certificates — mTLS certificate hygiene unavailable. Passes with a note when the org uses no certificates.
audit_logs — Audit-log availability posture unavailable. Passes with a note when audit logging is simply not enabled.

Troubleshooting

provider test result Cause Fix
auth fails: Missing scopes: api.management.read The key was created without the scope, or the scope was added afterwards Create a new Admin key with the scope selected at creation
auth fails: 401 Not an Admin key (a project key sk-… was used), or the key was revoked Create an Admin key (sk-admin-…) as an Organization Owner
Connection fails with an org mismatch openai_org_id does not match the key's organization Correct or remove openai_org_id
Key inventory looks empty The organization has no projects, or keys live in projects the key cannot see Confirm projects exist under Settings → Organization → Projects

Known limitations

MFA/SSO enforcement, IP allow-lists, and the connector registry are console-only settings with no Administration API surface, so they are not collected. Data-plane objects (vector stores, files, assistants) require a separate per-project credential and are not part of this connector.