ChatGPT Enterprise App Logs
Retrieve in-app requests and responses from the ChatGPT Enterprise service, which show what data ChatGPT read from or wrote to connected apps and connectors.
chatgpt-ent-app-logs [profile=VALUE] [duration=VALUE] [from=VALUE] [to=VALUE] [user=VALUE] [conversation-id=VALUE]
- profile=VALUE
- Optional. Profile name of the ChatGPT Enterprise workspace.
- duration=VALUE
- Optional. Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example,
10smeans data from 10 seconds earlier. The API requires a start time, so the last 24 hours are used when no period is given. - from=VALUE
- Optional. Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
- to=VALUE
- Optional. End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
- user=VALUE
- Optional. Filter by the email of the user who caused the event.
- conversation-id=VALUE
- Optional. Filter by the conversation the call was made from.
Output fields
| Field | Type | Name | Description |
|---|---|---|---|
| _time | Date | Time | e.g. 2026-09-05 09:13:44. When the event occurred. |
| profile | String | Connect profile | e.g. workspace-prod |
| user | String | User | e.g. user@example.com |
| app_name | String | App name | e.g. GitHub |
| action | String | Action name | e.g. get_profile, search_repositories. What the connector was asked to do. |
| log_type | String | Log type | e.g. request (the call), response (its result). Each call produces both. |
| duration | Long | Elapsed time | e.g. 2001. Milliseconds the external call took. |
| error_code | String | Error code | e.g. rate_limited. Absent when the call succeeded. |
| conversation_id | String | Conversation ID | e.g. 1a2b3c4d-5e6f-4708-9a1b-2c3d4e5f6071 |
| app_id | String | App ID | e.g. connector_0a1b2c3d4e5f60718293a4b5c6d7e8f9 |
| app_type | String | App type | e.g. SERVICE |
| connector_name | String | Connector name | e.g. GitHub |
| connector_id | String | Connector ID | e.g. connector_0a1b2c3d4e5f60718293a4b5c6d7e8f9 |
| is_sync | Boolean | Synchronous | e.g. false |
| input | Map | Request input | e.g. {_meta={timezone=Asia/Seoul}} |
| output | List | Response output | e.g. [{response={result=...}}]. Full connector reply, which can carry data fetched from the service. |
| type | String | Event type | e.g. APP_LOG |
| event_id | String | Event ID | e.g. 3c4d5e6f-7081-49a2-b3c4-d5e6f7081920 |
| user_id | String | User ID | e.g. user-AbCdEfGhIjKlMnOpQrStUvWx |
| actor_type | String | Actor type | e.g. ACCOUNT_USER |
| principal_id | String | Workspace ID | e.g. 9a8b7c6d-1e2f-4a3b-8c4d-5e6f70819a2b |
| principal_type | String | Workspace type | e.g. CHATGPT_WORKSPACE |
| file_id | String | Log file ID | e.g. eclf_0a1b2c3d4e5f60718293a4b5c6d7e8f9. Compliance log file the event was read from. |
| extra | Map | Unmapped fields | e.g. {new_field=...}. Fields this app does not recognise yet, kept so nothing is lost when the API adds them. |
| src_ip | IP | Source IP | e.g. 203.0.113.10 |
| src_country | String | Source country | e.g. KR |
| src_city | String | Source city | e.g. Seoul |
| src_region | String | Source region | e.g. Seoul |
| src_asn | String | Source ASN | e.g. 4766 |
| user_agent | String | User agent | e.g. Mozilla/5.0 |
| ja3 | String | JA3 fingerprint | e.g. a1b2c3d4e5f60718293a4b5c6d7e8f90. TLS client fingerprint; a change can mean a different client. |
| ja4 | String | JA4 fingerprint | e.g. q13d0314h3_a1b2c3d4e5f6_0a1b2c3d4e5f |
| dst_host | String | Destination host | e.g. chatgpt.com |