Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fdata-layer%2Fdefault-dataspace%2Fai-raw-openai-compliance-logs.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fdata-layer%2Fdefault-dataspace%2Fai-raw-openai-compliance-logs.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

# `ai.raw.openai.compliance_logs`

Note

This dataset is restricted by default: no one can read its data until access is granted through a target group rule on its access policy. It can hold conversation content, and even without content collection its metadata streams hold sensitive values: IP addresses on audit and sign-in events, device names, models, and last-seen locations on remote-control clients, and the environment variables of Codex environments. Review who needs access before you grant it. See [Access control](https://coralogix.com/docs/user-guides/data-layer/dataset-management/access-control.md).

## Purpose[​](#purpose "Direct link to Purpose")

The `ai.raw.openai.compliance_logs` dataset stores the raw records that the [OpenAI integration](https://coralogix.com/docs/integrations/ai-observability/openai.md) pulls from the ChatGPT Enterprise Compliance API. Use it to investigate workspace activity record by record: who signed in, which GPTs and projects exist and who they're shared with, which Codex tasks ran, and what the workspace spent.

`ai.raw.openai.compliance_logs` is a [predefined dataset](https://coralogix.com/docs/user-guides/data-layer/default-dataspace/predefined-datasets.md): Coralogix provisions it in the `default` dataspace, and your OpenAI integration fills it. Its entity type is `rawOpenAiComplianceLogs`.

## What one event is[​](#what-one-event-is "Direct link to What one event is")

Each event is one record from one Compliance API source: one audit or sign-in event, one inventory object such as a GPT, project, or agent, one Codex event such as a prompt, response, or tool call, one Codex task, or one cost row. The `stream` field names the source, and `data` holds the record. A record too large for one event is split into parts that share a `part_group` value; each part carries its `part` number and the total `parts`. The base fields repeat on every part, and the values moved out of it are in `data.content`, each with a `source_ptr` to its place in the original record; long strings are cut into `cx_segment` pieces. To rebuild a record, group by `part_group`, order by `part`, join the segments, and put each value back at its `source_ptr`. This `data.content` holds split fields, not conversation content.

| Field                 | Description                                                                                                                                                                                                                                                                                                                                                           |
| --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `stream`              | The source, for example `openai.compliance.gpts`. See [Streams](#streams).                                                                                                                                                                                                                                                                                            |
| `data`                | The Compliance API record. Field names follow the OpenAI Compliance API.                                                                                                                                                                                                                                                                                              |
| `resource.attributes` | Integration metadata: `service.name`, `cx.application.name`, `cx.subsystem.name`, `cx.integration.source.type`, `cx.integration.source.version`, `organization` (when an Admin API key is also configured; on organization-wide cost records, the configured Enterprise organization ID), and `workspace_id`. Organization-wide cost records carry no `workspace_id`. |

Activity records such as audit, sign-in, message, Codex, and cost events are timestamped at the record's own time in `data.timestamp`. Inventory records (users, GPTs, projects, Codex tasks and environments, files, and other snapshots) are timestamped when Coralogix collects them.

## Streams[​](#streams "Direct link to Streams")

Each stream name takes the `openai.compliance.` prefix. The tables and lists show the full name only for the first stream in each group.

### Metadata streams[​](#metadata-streams "Direct link to Metadata streams")

Metadata streams describe activity and configuration. Coralogix removes the content fields from these records before ingestion, so they hold identifiers, names, timestamps, owners, and settings, not prompts or responses.

| Group                             | Streams                                                                                                                                                             |
| --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Activity and audit                | `openai.compliance.conversation_message`, `audit`, `auth`                                                                                                           |
| Directory                         | `openai.compliance.users`, `invites`                                                                                                                                |
| GPTs and projects                 | `openai.compliance.gpts`, `gpt_configs`, `gpt_shared_users`, `projects`, `project_configs`, `project_shared_users`                                                  |
| Apps, agents, and plugins         | `openai.compliance.app`, `app_auth`, `custom_agents`, `agents`, `skills`, `agent_skills`, `plugins`, `plugin_spreadsheet`                                           |
| Memories, files, and other assets | `openai.compliance.memories`, `recordings`, `automations`, `canvases`, `library_files`                                                                              |
| Codex                             | `openai.compliance.codex`, `codex_security`, `codex_tasks`, `codex_environments`, `remote_control_environments`, `remote_control_threads`, `remote_control_clients` |
| Cost                              | `openai.compliance.costs`                                                                                                                                           |

OpenAI restates cost rows under the same `data.event_id`, and Coralogix logs a changed copy again, so keep the latest copy per `data.event_id` when you total costs.

### Content streams[​](#content-streams "Direct link to Content streams")

Content streams carry the content that the metadata streams leave out: message text, canvas text, memories, and file names. Content collection is off by default. To turn it on, contact Coralogix support.

`openai.compliance.conversation_message_content`, `codex_content`, `app_content`, `custom_agents_content`, `plugin_spreadsheet_content`, `memories_content`, `remote_control_threads_content`, `automations_content`, `canvases_content`, `library_files_content`

Each content record repeats the identifiers of its metadata record, so you can join the two.

## Query the dataset[​](#query-the-dataset "Direct link to Query the dataset")

```
source ai.raw.openai.compliance_logs

| filter $d.stream == 'openai.compliance.auth'
```

## Next steps[​](#next-steps "Direct link to Next steps")

* Set up the source: [OpenAI integrations](https://coralogix.com/docs/integrations/ai-observability/openai.md).
* Grant read access to more users: [Access control](https://coralogix.com/docs/user-guides/data-layer/dataset-management/access-control.md).
* See the other datasets Coralogix provisions in [Predefined datasets](https://coralogix.com/docs/user-guides/data-layer/default-dataspace/predefined-datasets.md).