OpenAI Integration

The Ledger OpenAI integration scans an OpenAI organization and inventories its active projects, project-scoped API keys, and organization-wide Admin API keys. It also collects organization member data only to enrich key creator details.

Setup is a one-time configuration using a single Admin API key with an sk-admin- prefix. Defakto stores this onboarding key encrypted and uses it to scan the OpenAI organization remotely.

What Data is Collected?

1. Identities - Active OpenAI organization projects. Archived projects are excluded.
2. Secrets - Project-scoped API keys and organization-wide Admin API keys, including each key's name, type, redacted hint, creator, creation time, and last observed use.

Raw secret values are not retained in Ledger scan results.

This integration does not discover applications on its own. To correlate OpenAI API keys with the applications that use them, configure another workload integration, such as Kubernetes or Gemini Enterprise Agent Platform (Gemini EAP).

Supported Remediations

• Unused Secret: Ledger detects OpenAI Keys that have not been used within the defined threshold (default 60 days) and suggests them for deletion.

Integration Permissions

An OpenAI organization Owner must create an Admin API key for the integration. The integration uses this key to read projects, organization users, project API key metadata, Admin API key metadata, and API key usage.

Installation

No applications are required to be installed on the target environment. You provide an OpenAI Admin API key in the Defakto Console, and Defakto uses it to scan the organization remotely.

Prerequisites

An operator must be an Owner of the OpenAI organization and must be able to create an Admin API key. The key must have an sk-admin- prefix.

Steps

1. Visit the "Integrations" page in the Defakto Console. Click "Create Integration".
2. Select "OpenAI" from the list of available integrations under "Mind". Configure the following fields, then create the integration.
   • Admin API key: An OpenAI organization Admin API key with an sk-admin- prefix. (required)
   • Integration Name: A unique name used to identify this integration in the Console. (required)
3. After the integration is created, it automatically starts scanning the connected organization. Use the "Run Now" button on the integration details page to trigger an immediate scan and refresh its inventory at any time.

Caveats

1. Each integration scans one OpenAI organization. Configure a separate integration for each organization.
2. Last-use enrichment is based on OpenAI's completions usage feed for the previous six months. A key used exclusively for other endpoints, such as embeddings, images, or audio, never appears in that feed and shows no last observed use. The timestamp also remains unset if the usage query fails.
3. Organization-wide Admin API keys are inventory-only and are not applicable for the "Unused Secret" remediation.