Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fdata-layer%2Fdefault-dataspace%2Fai-raw-openai-admin-logs.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fdata-layer%2Fdefault-dataspace%2Fai-raw-openai-admin-logs.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

# `ai.raw.openai.admin_logs`

Note

This dataset is restricted by default: no one can read its data until access is granted through a target group rule on its access policy. To grant access, see [Access control](https://coralogix.com/docs/user-guides/data-layer/dataset-management/access-control.md).

## Purpose[​](#purpose "Direct link to Purpose")

The `ai.raw.openai.admin_logs` dataset stores the raw records that the [OpenAI API Platform integration](https://coralogix.com/docs/integrations/ai-observability/openai/api-platform.md) pulls from the OpenAI Administration APIs. Alongside the integration's metrics, it gives you the full source records and details that the metrics don't carry: the exact usage row behind a token spike, the cost line item for a project, or the audit event that changed an API key.

`ai.raw.openai.admin_logs` is a [predefined dataset](https://coralogix.com/docs/user-guides/data-layer/default-dataspace/predefined-datasets.md): Coralogix provisions it in the `default` dataspace, and your OpenAI integration fills it. Its entity type is `rawOpenAiAdminLogs`.

## What one event is[​](#what-one-event-is "Direct link to What one event is")

Each event is one record from one Administration API endpoint: one usage row, one cost row, one directory or governance object, or one audit event. The `stream` field names the endpoint the record came from, and `data` holds the record as OpenAI returned it, with a few fields added by Coralogix.

| Field                                  | Description                                                                                                                                                          |
| -------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `stream`                               | The source endpoint, for example `openai.administration.costs`. See [Streams](#streams).                                                                             |
| `data`                                 | The OpenAI record. Field names follow the OpenAI Administration API.                                                                                                 |
| `data.organization`                    | The OpenAI organization the record belongs to. Added by Coralogix.                                                                                                   |
| `data.bucket_start`                    | Start of the usage or cost bucket, as a Unix timestamp. Present on usage and cost records.                                                                           |
| `data.user_email`, `data.project_name` | Resolved user email and project name on cost records, when OpenAI doesn't return them.                                                                               |
| `data.scope`, `data.project_id`        | Whether a governance record applies to the organization (`org`) or a project, and which project.                                                                     |
| `resource.attributes`                  | Integration metadata: `service.name`, `cx.application.name`, `cx.subsystem.name`, `cx.integration.source.type`, `cx.integration.source.version`, and `organization`. |

Minute-level completions usage is timestamped at the start of its bucket. Daily usage and cost rows are usually collected after their day ends, so they take the collection time; use `data.bucket_start` for the bucket. A bucket read while still open is written again when it's re-read, so keep the latest copy per `data.bucket_start` and grouping fields (project, model, API key, user, line item) when you sum. Directory, governance, role-based access control, and audit events are timestamped when Coralogix collects them. For the time an audit event happened, use `data.effective_at`.

## Streams[​](#streams "Direct link to Streams")

Each stream name takes the `openai.administration.` prefix. The table shows the full name only for the first stream in each row.

| Group                     | Streams                                                                                                                                                                                                                                                                 |
| ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Usage                     | `openai.administration.usage_completions`, `usage_embeddings`, `usage_images`, `usage_audio_speeches`, `usage_audio_transcriptions`, `usage_moderations`, `usage_vector_stores`, `usage_code_interpreter_sessions`, `usage_web_search_calls`, `usage_file_search_calls` |
| Cost and spend            | `openai.administration.costs`, `spend_limit`, `spend_alerts`                                                                                                                                                                                                            |
| Directory                 | `openai.administration.users`, `projects`, `project_users`, `api_keys`, `service_accounts`, `invites`, `admin_keys`                                                                                                                                                     |
| Governance                | `openai.administration.data_retention`, `certificates`, `project_certificates`, `certificate_content`, `rate_limits`, `model_permissions`, `hosted_tool_permissions`                                                                                                    |
| Role-based access control | `openai.administration.groups`, `group_roles`, `roles`, `user_roles`, `project_groups`, `project.roles`, `project.user_roles`                                                                                                                                           |
| Audit                     | `openai.administration.audit`                                                                                                                                                                                                                                           |

Audit events also carry the actor's session details at the top level of `data`: `ip_address`, `user_agent`, `ja3`, `ja4`, and the IP location fields `country`, `city`, `region`, `region_code`, `asn`, `latitude`, and `longitude`.

## Query the dataset[​](#query-the-dataset "Direct link to Query the dataset")

```
source ai.raw.openai.admin_logs

| filter $d.stream == 'openai.administration.audit'
```

## Next steps[​](#next-steps "Direct link to Next steps")

* Set up the source: [OpenAI API Platform integration](https://coralogix.com/docs/integrations/ai-observability/openai/api-platform.md).
* Grant read access to more users: [Access control](https://coralogix.com/docs/user-guides/data-layer/dataset-management/access-control.md).
* See the other datasets Coralogix provisions in [Predefined datasets](https://coralogix.com/docs/user-guides/data-layer/default-dataspace/predefined-datasets.md).