OpenAI

Configuring OpenAI integration

Tidal Control's OpenAI integration monitors your OpenAI organisation for AI governance and access control purposes. It reads organisation-level governance data, not model usage. All access is read-only — Tidal Control never creates, modifies, or deletes anything in your OpenAI organisation.

What this integration monitors:

Users: Email, name, organisation role (owner or reader), and when they were added
Invites: Pending, accepted, and expired invites with their invited role
Projects: Name, creation date, status, and archival date
Project members: Per-project role assignments
Service accounts: Non-human identities per project
Project API keys: Name, creation date, last used date, redacted key value, and whether the key is owned by a user or a service account
Admin API keys: Organisation-level keys with their creation and last used dates
Rate limits: Request and token limits per model, per project

Requirements:

Super User role in Tidal Control
An OpenAI organisation on the OpenAI platform (platform.openai.com)
The organisation owner role, since only owners can create admin keys

Configuration step-by-step plan

What we're going to do: We'll create an admin key in the OpenAI platform settings, then add the connection in Tidal Control.

Configuration steps:

Create an admin key in OpenAI
Configure the integration in Tidal Control

Step 1: Create an admin key in OpenAI

Sign in at platform.openai.com as an organisation owner
Go to Settings → Organization → Admin keys
Click Create admin key
Enter a name (e.g. Tidal Control)
Click Create admin key
Copy the key — it starts with sk-admin- and is only shown once

Warning

Save the admin key immediately. OpenAI only shows the full key value once at creation. If you close the dialog without copying it, you will need to create a new key.

Info

Tidal Control never reads secret key values. The API key endpoints only return a redacted value such as sk-...abcd. The integration inventories your keys — it cannot recover them.

Step 2: Configure the integration in Tidal Control

Go to Settings → Integrations in Tidal Control
Click the plus icon next to OpenAI
Fill in the configuration:
- Name: A descriptive name, e.g. OpenAI
- Admin API Key: The admin key from step 1
Click "Create" to save the integration

Configuration fields explained

Name:

A descriptive name for this connection
For example: OpenAI, OpenAI Production

Admin API Key:

The OpenAI organisation admin key, starting with sk-admin-
Created in step 1
A regular project API key (sk-proj-) will not work — it cannot call the Organization API
Keep this value secure

Available checks

AI governance (ISO/IEC 42001):

Inventory of AI platform projects and which of them are still active
Which human and non-human identities can reach models
Which credentials reach those models

Access control (ISO 27001 A.5.15 – A.5.18, SOC 2 CC6.1 – CC6.3):

Organisation and per-project role assignments for least-privilege reviews
Review of organisation owners as privileged access
Pending and stale invites as provisioning evidence

Credential hygiene (SOC 2 CC6.1):

Never-used keys, both project keys and organisation admin keys
Key age, for rotation checks
Human-owned versus service-account-owned keys

Info

Plan-dependent checks. Some OpenAI governance settings — mTLS certificates, zero data retention, per-project model permissions, and spend alerts — are only exposed by the API when your organisation is entitled to them. If your plan does not include a setting, the corresponding check returns no data rather than failing.

Verification

Check integration status:

Settings → Integrations shows "Connected" status for OpenAI
OpenAI tests are available in the Tests section
Test refresh delivers results without authentication errors

Frequently asked questions

Does Tidal Control read our ChatGPT conversations or prompts? No. The integration only reads organisation governance data: users, invites, projects, service accounts, and API key metadata.

Do I need to be an organisation owner? Yes. Only owners can create admin keys in OpenAI.

Are archived projects included? Archived projects appear in the project inventory so you keep the lifecycle record, but their members, service accounts, and keys are not read.

Are audit logs included? No. Audit logs and usage exports are separate OpenAI endpoints that this integration does not read.

Common problems

Authentication fails with a 401 error

Confirm the key starts with sk-admin- — a project key (sk-proj-) cannot call the Organization API
Check that the key was copied in full and has not been revoked
Confirm the account that created the key still has the organisation owner role

Tests fail with a 403 error

The key exists but the organisation is not entitled to the requested data
Confirm you can open Settings → Organization in OpenAI with the same account

Test refresh is slow for large organisations

Project members, service accounts, and API keys are read per project, so organisations with many active projects take longer to refresh

The zero data retention check fails

Zero data retention is a plan entitlement. If your organisation is not eligible, the check reports that rather than passing

Still can't figure it out?

Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible.

Info

Gather support info: Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably.