OpenAI / GPT coverage

Three paths to bring every OpenAI call at your company under Trefur. The Admin API connector covers the long tail (projects, members, keys, daily usage, audit events) without code changes; the proxy + SDK paths give you full content scanning where you can deploy them.

The Admin API requires Enterprise or Team — not consumer ChatGPT. The /v1/organization/* endpoints (audit logs, usage, projects, members) are only exposed to Enterprise and Team plan organizations. The connector authenticates with a scoped admin key (sk-admin-…) — separate from per-project API keys. If your org is on a free or Plus tier, use the proxy or SDK paths instead.

Choose your path

Trade-off summary. None of these mutually exclude each other — most production deployments run all three.

Path 1 — Admin API connector

The CISO mints an OpenAI Admin API key in the Platform Console once and pastes it into Trefur. Every 15 minutes Trefur polls the Admin API surfaces, records each OpenAI project + API key + service account as an observed agent, attributes daily token + cost roll-ups to a principal email via the project_users map, and writes audit events (api_key.created, project.deleted, saml.config.updated, etc.) into the activity record with canonical event types.

# 1. Mint an Admin API key in the OpenAI Platform:
#    Admin → API Keys → "Create new key" → role: Admin
#    The key prefix will be sk-admin-...
#    Available on Enterprise + Team plans only (NOT consumer ChatGPT).
#
# 2. Trefur stores the key in its AES-256-GCM credential vault.
#    Paste it under Settings → Integrations → OpenAI Admin API.
#
# 3. The connector pulls these surfaces every 15 minutes:
#    GET /v1/organization/audit_logs
#    GET /v1/organization/usage/completions
#    GET /v1/organization/projects
#    GET /v1/organization/projects/{id}/users
#    GET /v1/organization/projects/{id}/api_keys
#    GET /v1/organization/projects/{id}/service_accounts
#
# 4. Per call, we capture:
#    - project_id              -> tenant-scope inventory
#    - api_key_id + name       -> recorded as observed agents
#    - principal email         -> resolved via project_users
#    - daily token + cost      -> aggregate per (api_key, model, day)
#    - audit events            -> mapped to canonical event types
#                                 (api_key.created, project.deleted,
#                                  invite.accepted, saml.config.updated)

The Admin API does not include prompt or completion text. For per-call content scanning, layer the proxy or SDK path on top.

Path 2 — OpenAI API proxy (local collector)

Run the trefur collector and point your applications at its LLM proxy on http://localhost:9091. The path prefix /proxy/api.openai.com/… tells the collector which upstream to forward to, so it proxies every request to api.openai.com and captures the full prompt + completion. Streaming SSE calls are passed through chunk-by-chunk while we tee the content into the telemetry pipeline.

cURL

# Point your OpenAI-using application at the local collector's LLM proxy.
# The collector runs on http://localhost:9091 by default; the path prefix
# /proxy/<provider-host>/ tells it which upstream to forward to.
# (Change localhost:9091 to your collector's address if it runs elsewhere.)

# Drop-in swap for https://api.openai.com
curl http://localhost:9091/proxy/api.openai.com/v1/chat/completions \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "X-Observe-Agent-Key: trf_obs_REPLACE_ME" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gpt-4o",
    "messages": [{"role": "user", "content": "Summarize Q3 sales."}]
  }'

# Streaming responses pass through chunk-by-chunk while Trefur tees content
# into the telemetry pipeline.

Drop-in SDK swap

# Python SDK — point base_url at the collector's LLM proxy:
from openai import OpenAI
client = OpenAI(
    api_key=os.environ["OPENAI_API_KEY"],
    base_url="http://localhost:9091/proxy/api.openai.com/v1",
)

# Node.js SDK:
import OpenAI from "openai";
const client = new OpenAI({
  apiKey: process.env.OPENAI_API_KEY!,
  baseURL: "http://localhost:9091/proxy/api.openai.com/v1",
});

Path 3 — SDK patch (in-process)

The Trefur SDK monkey-patches openai (Python) or openai (Node) so calls go through OpenAI directly while telemetry is captured in-process. Same content visibility as the proxy, plus framework-level context like LangChain chain id, agent role, and tool name — surfaced as trefur.tool.name attributes via the OpenTelemetry conventions.

# In-process SDK patching captures framework-level context
# (assistant id, run id, tool calls, multi-step chains) on top of the raw
# request/response that the proxy already sees.
#
# pip install trefur-observe openai

import os
from openai import OpenAI
from trefur_observe import TrefurObserve, patch_openai

# Initialise the observe client once at startup.
observe = TrefurObserve.init(api_key=os.environ["TREFUR_API_KEY"])
# Patch the OpenAI SDK so every call is wrapped.
patch_openai(observe)

client = OpenAI()
resp = client.chat.completions.create(
    model="gpt-4o",
    messages=[{"role": "user", "content": "Summarize Q3 sales."}],
)

Roadmap — ChatGPT Enterprise content export

ChatGPT Enterprise admins can export full conversation content via OpenAI's /v1/compliance/conversations endpoint (the name comes from OpenAI's API surface, not our positioning). Wiring this into Trefur is on the roadmap — it lets internal reviewers retrieve the actual ChatGPT messages employees sent, not just usage rollups. It is intentionally not wired yet — most customers prefer the proxy/SDK paths above for per-call content capture. Reach out if you need conversation export today.

PII redaction is enabled by default

Both the proxy and the SDK paths route prompt and completion payloads through the collector's redaction pipeline before export. Built-in patterns cover email, SSN, credit card, IBAN, API keys, JWT, and phone numbers — replaced with typed placeholders ([EMAIL], [SSN], etc.). Configure the redaction level per credential, per observe key, or per tenant default in Settings → Security inside the app.

To install an SDK, see the Python or JavaScript SDK references. To run the collector LLM proxy, see collector inputs.