# OpenAI

> Connect your OpenAI organisation to Tidal Control for AI governance and access control tests. It reads organisation-level governance data, never model content.

Source: https://tidalcontrol.com/docs/integrations/openai

Tidal Control's OpenAI integration monitors your OpenAI organisation for AI governance and access control purposes. It reads organisation-level governance data, not model usage. All access is read-only. Tidal Control never creates, modifies, or deletes anything in your OpenAI organisation.

## What this integration monitors

- **Users:** Email, name, organisation role (owner or reader), and when they were added
- **Invites:** Pending, accepted, and expired invites with their invited role
- **Projects:** Name, creation date, status, and archival date
- **Project members:** Per-project role assignments
- **Service accounts:** Non-human identities per project
- **Project API keys:** Name, creation date, last used date, redacted key value, and whether the key is owned by a user or a service account
- **Admin API keys:** Organisation-level keys with their creation and last used dates
- **Rate limits:** Request and token limits per model, per project

## Requirements

- Super User role in Tidal Control
- An OpenAI organisation on the OpenAI platform (`platform.openai.com`)
- The organisation **owner** role, since only owners can create admin keys

## Configuration step-by-step plan

We'll create an **admin key** in the OpenAI platform settings, then add the connection in Tidal Control.

**Configuration steps:**

1. **Create an admin key in OpenAI**
2. **Configure the integration in Tidal Control**

## Step 1: Create an admin key in OpenAI

- Sign in at [platform.openai.com](https://platform.openai.com) as an organisation owner
- Go to **Settings → Organization → Admin keys**
- Click **Create admin key**
- Enter a name (e.g. `Tidal Control`)
- Click **Create admin key**
- **Copy the key**: it starts with `sk-admin-` and is only shown once

> **warning:**

**Save the admin key immediately.** OpenAI only shows the full key value once at creation. If you close the dialog without copying it, you will need to create a new key.

> **info:**

**Tidal Control never reads secret key values.** The API key endpoints only return a redacted value such as `sk-...abcd`. The integration inventories your keys. It cannot recover them.

## Step 2: Configure the integration in Tidal Control

- Go to **Settings → Integrations** in Tidal Control
- Click the **plus icon** next to **OpenAI**
- Fill in the configuration:
  - **Name:** A descriptive name, e.g. `OpenAI`
  - **Admin API Key:** The admin key from step 1
- Click **"Create"** to save the integration

## Configuration fields explained

The integration dialog asks for the following values:

**Name:**
- A descriptive name for this connection
- For example: `OpenAI`, `OpenAI Production`

**Admin API Key:**
- The OpenAI organisation admin key, starting with `sk-admin-`
- Created in step 1
- A regular project API key (`sk-proj-`) will not work. It cannot call the Organization API
- Keep this value secure

## Available checks

The integration runs the following checks, grouped by the area they cover:

**AI governance (ISO/IEC 42001):**
- Inventory of AI platform projects and which of them are still active
- Which human and non-human identities can reach models
- Which credentials reach those models

**Access control (ISO 27001 A.5.15-A.5.18, SOC 2 CC6.1-CC6.3):**
- Organisation and per-project role assignments for least-privilege reviews
- Review of organisation owners as privileged access
- Pending and stale invites as provisioning evidence

**Credential hygiene (SOC 2 CC6.1):**
- Never-used keys, both project keys and organisation admin keys
- Key age, for rotation checks
- Human-owned versus service-account-owned keys

> **info:**

**Plan-dependent checks.** Some OpenAI governance settings (mTLS certificates, zero data retention, per-project model permissions, and spend alerts) are only exposed by the API when your organisation is entitled to them. If your plan does not include a setting, the corresponding check returns no data rather than failing.

## Verification

The integration is working when all of the following are true:

- Settings → Integrations shows OpenAI under **Configured Integrations**
- OpenAI tests are available in the Tests section
- Test refresh delivers results without authentication errors

## Frequently asked questions

**Does Tidal Control read our ChatGPT conversations or prompts?**
No. The integration only reads organisation governance data: users, invites, projects, service accounts, and API key metadata.

**Do I need to be an organisation owner?**
Yes. Only owners can create admin keys in OpenAI.

**Are archived projects included?**
Archived projects appear in the project inventory so you keep the lifecycle record, but their members, service accounts, and keys are not read.

**Are audit logs included?**
No. Audit logs and usage exports are separate OpenAI endpoints that this integration does not read.

## Common problems

**Authentication fails with a 401 error**
- Confirm the key starts with `sk-admin-`. A project key (`sk-proj-`) cannot call the Organization API
- Check that the key was copied in full and has not been revoked
- Confirm the account that created the key still has the organisation **owner** role

**Tests fail with a 403 error**
- The key exists but the organisation is not entitled to the requested data
- Confirm you can open **Settings → Organization** in OpenAI with the same account

**Test refresh is slow for large organisations**
- Project members, service accounts, and API keys are read per project, so organisations with many active projects take longer to refresh

**The zero data retention check fails**
- Zero data retention is a plan entitlement. If your organisation is not eligible, the check reports that rather than passing

### Still can't figure it out?

Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible.

> **info:**

**Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably.