ai.raw.openai.compliance_logs
This dataset is restricted by default: no one can read its data until access is granted through a target group rule on its access policy. It can hold conversation content, and even without content collection its metadata streams hold sensitive values: IP addresses on audit and sign-in events, device names, models, and last-seen locations on remote-control clients, and the environment variables of Codex environments. Review who needs access before you grant it. See Access control.
Purpose
The ai.raw.openai.compliance_logs dataset stores the raw records that the OpenAI integration pulls from the ChatGPT Enterprise Compliance API. Use it to investigate workspace activity record by record: who signed in, which GPTs and projects exist and who they're shared with, which Codex tasks ran, and what the workspace spent.
ai.raw.openai.compliance_logs is a predefined dataset: Coralogix provisions it in the default dataspace, and your OpenAI integration fills it. Its entity type is rawOpenAiComplianceLogs.
What one event is
Each event is one record from one Compliance API source: one audit or sign-in event, one inventory object such as a GPT, project, or agent, one Codex event such as a prompt, response, or tool call, one Codex task, or one cost row. The stream field names the source, and data holds the record. A record too large for one event is split into parts that share a part_group value; each part carries its part number and the total parts. The base fields repeat on every part, and the values moved out of it are in data.content, each with a source_ptr to its place in the original record; long strings are cut into cx_segment pieces. To rebuild a record, group by part_group, order by part, join the segments, and put each value back at its source_ptr. This data.content holds split fields, not conversation content.
| Field | Description |
|---|---|
stream | The source, for example openai.compliance.gpts. See Streams. |
data | The Compliance API record. Field names follow the OpenAI Compliance API. |
resource.attributes | Integration metadata: service.name, cx.application.name, cx.subsystem.name, cx.integration.source.type, cx.integration.source.version, organization (when an Admin API key is also configured; on organization-wide cost records, the configured Enterprise organization ID), and workspace_id. Organization-wide cost records carry no workspace_id. |
Activity records such as audit, sign-in, message, Codex, and cost events are timestamped at the record's own time in data.timestamp. Inventory records (users, GPTs, projects, Codex tasks and environments, files, and other snapshots) are timestamped when Coralogix collects them.
Streams
Each stream name takes the openai.compliance. prefix. The tables and lists show the full name only for the first stream in each group.
Metadata streams
Metadata streams describe activity and configuration. Coralogix removes the content fields from these records before ingestion, so they hold identifiers, names, timestamps, owners, and settings, not prompts or responses.
| Group | Streams |
|---|---|
| Activity and audit | openai.compliance.conversation_message, audit, auth |
| Directory | openai.compliance.users, invites |
| GPTs and projects | openai.compliance.gpts, gpt_configs, gpt_shared_users, projects, project_configs, project_shared_users |
| Apps, agents, and plugins | openai.compliance.app, app_auth, custom_agents, agents, skills, agent_skills, plugins, plugin_spreadsheet |
| Memories, files, and other assets | openai.compliance.memories, recordings, automations, canvases, library_files |
| Codex | openai.compliance.codex, codex_security, codex_tasks, codex_environments, remote_control_environments, remote_control_threads, remote_control_clients |
| Cost | openai.compliance.costs |
OpenAI restates cost rows under the same data.event_id, and Coralogix logs a changed copy again, so keep the latest copy per data.event_id when you total costs.
Content streams
Content streams carry the content that the metadata streams leave out: message text, canvas text, memories, and file names. Content collection is off by default. To turn it on, contact Coralogix support.
openai.compliance.conversation_message_content, codex_content, app_content, custom_agents_content, plugin_spreadsheet_content, memories_content, remote_control_threads_content, automations_content, canvases_content, library_files_content
Each content record repeats the identifiers of its metadata record, so you can join the two.
Query the dataset
source ai.raw.openai.compliance_logs
| filter $d.stream == 'openai.compliance.auth'
Next steps
- Set up the source: OpenAI integrations.
- Grant read access to more users: Access control.
- See the other datasets Coralogix provisions in Predefined datasets.