ChatGPT Enterprise App Auth Logs
Retrieve app and connector link and unlink events from the ChatGPT Enterprise service, which show which external services users granted ChatGPT access to.
chatgpt-ent-app-auth-logs [profile=VALUE] [duration=VALUE] [from=VALUE] [to=VALUE] [user=VALUE]
- profile=VALUE
- Optional. Profile name of the ChatGPT Enterprise workspace.
- duration=VALUE
- Optional. Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example,
10smeans data from 10 seconds earlier. The API requires a start time, so the last 24 hours are used when no period is given. - from=VALUE
- Optional. Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
- to=VALUE
- Optional. End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
- user=VALUE
- Optional. Filter by the email of the user who caused the event.
Output fields
| Field | Type | Name | Description |
|---|---|---|---|
| _time | Date | Time | e.g. 2026-09-05 09:13:44. When the event occurred. |
| profile | String | Connect profile | e.g. workspace-prod |
| user | String | User | e.g. user@example.com |
| action | String | Action | e.g. link (connector authorised), unlink (authorisation removed) |
| app_name | String | App name | e.g. GitHub |
| app_id | String | App ID | e.g. connector_0a1b2c3d4e5f60718293a4b5c6d7e8f9 |
| link_id | String | Link ID | e.g. link-5e6f7a8b |
| src_ip | IP | Source IP | e.g. 203.0.113.10 |
| src_country | String | Source country | e.g. KR |
| src_city | String | Source city | e.g. Seoul |
| user_agent | String | User agent | e.g. Mozilla/5.0 |
| src_region | String | Source region | e.g. Seoul |
| src_asn | String | Source ASN | e.g. 4766 |
| ja3 | String | JA3 fingerprint | e.g. a1b2c3d4e5f60718293a4b5c6d7e8f90. TLS client fingerprint; a change can mean a different client. |
| ja4 | String | JA4 fingerprint | e.g. q13d0314h3_a1b2c3d4e5f6_0a1b2c3d4e5f |
| dst_host | String | Destination host | e.g. chatgpt.com |
| type | String | Event type | e.g. APP_AUTH_LOG |
| event_id | String | Event ID | e.g. 3c4d5e6f-7081-49a2-b3c4-d5e6f7081920 |
| user_id | String | User ID | e.g. user-AbCdEfGhIjKlMnOpQrStUvWx |
| actor_type | String | Actor type | e.g. ACCOUNT_USER |
| principal_id | String | Workspace ID | e.g. 9a8b7c6d-1e2f-4a3b-8c4d-5e6f70819a2b |
| principal_type | String | Workspace type | e.g. CHATGPT_WORKSPACE |
| file_id | String | Log file ID | e.g. eclf_0a1b2c3d4e5f60718293a4b5c6d7e8f9. Compliance log file the event was read from. |
| extra | Map | Unmapped fields | e.g. {new_field=...}. Fields this app does not recognise yet, kept so nothing is lost when the API adds them. |