OPENAI AUDIT · ADMIN API · BETA

Which API keys are forgotten in your OpenAI org?

We pull users, projects, API keys and audit log from OpenAI's Platform admin API. Get a list of keys unused for >90 days (= leak risk), see who added what, export a monthly signed evidence pack for your auditor.

Open dashboard →Setup guide

Why this is needed

A stale API key is a breach waiting to happen.

OpenAI's admin API exposes every key per project with a `last_used_at` timestamp. In practice:

A dev created a key 2 years ago for a POC, forgot it, ran `git commit -a`.
A service account key lives in a .env file of a decommissioned Heroku app.
An employee left but their user keys were never revoked.

monsys highlights every key unused for >90 days + whose owner has left the org. Plus an audit log of who changed what. For when your auditor asks: 'prove you have no orphan keys'.

How it works

One admin key, full snapshot every hour.

Mint an Organization Admin Key

platform.openai.com → Settings → Organization → Admin Keys → Create. Not a user-key — an Admin Key has access to /v1/organization/* endpoints. Rotate every 90 days.

Paste into monsys

Dashboard → OpenAI Audit → '+ Connect org'. We verify via a test call. Admin key AES-256-GCM encrypted.

Hourly snapshot

Worker pulls users + projects + per-project API keys + audit_logs. Snapshots replaced each pull; events append-only deduped.

Evidence pack on demand

POST /api/v1/openai/evidence-packs for a period → gzipped tarball with users.jsonl + projects.jsonl + api_keys.jsonl + events.jsonl + signed manifest.

What we keep and don't

Emails hashed. We don't see prompts/completions.

KEPT

OpenAI user IDs + SHA256 of email + 4-char email prefix for display
Project IDs, names, status, timestamps
API key IDs, redacted value (sk-...xxxx), type, created + last_used
Audit events with actor-hash + target_id + timestamp

NOT KEPT

Full email addresses — dropped at ingest
Full API key value — only sk-...4-char redacted
What an API key called — not in admin API
ChatGPT browser conversations — requires Compliance API (Q4 2026)

Pricing

€1 per user + €5 per project per month.

Per-user and per-project billed separately because those are the two cost drivers. Daily snapshot, averaged over the month.

Example: 25 users, 3 active projects → 25 × €1 + 3 × €5 = €40/month.

Monthly via Stripe — separate line item 'monsys.ai OpenAI Audit — N users × €1 + M projects × €5'.

Open dashboard →Full setup guide