ChatGPT Enterprise Codex Logs
Retrieve Codex usage from the ChatGPT Enterprise service, including prompts and token consumption.
chatgpt-ent-codex-logs [profile=VALUE] [duration=VALUE] [from=VALUE] [to=VALUE] [user=VALUE]
- profile=VALUE
- Optional. Profile name of the ChatGPT Enterprise workspace.
- duration=VALUE
- Optional. Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example,
10smeans data from 10 seconds earlier. The API requires a start time, so the last 24 hours are used when no period is given. - from=VALUE
- Optional. Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
- to=VALUE
- Optional. End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
- user=VALUE
- Optional. Filter by the email of the user who caused the event.
Output fields
| Field | Type | Name | Description |
|---|---|---|---|
| _time | Date | Time | e.g. 2026-09-05 09:13:44. When the event occurred. |
| profile | String | Connect profile | e.g. workspace-prod |
| user | String | User | e.g. user@example.com |
| client_id | String | Client | e.g. CODEX_CLI (the command line), CODEX_WEB (the browser) |
| detail_type | String | Detail type | e.g. PROMPT_SENT (a prompt was submitted), PROMPT_RESPONSE_RECEIVED (a reply came back) |
| model | String | Model | e.g. gpt-5-codex |
| reasoning_effort | String | Reasoning effort | e.g. low, medium, high. How much reasoning the request asked for. |
| status | String | Status | e.g. completed, failed |
| content_length | Long | Content length | e.g. 1596 |
| content | String | Content | e.g. extract urls if contains *.exe in given urls. The instruction can sit at the end of a long message, so read the whole value rather than its opening. |
| input_tokens | Long | Input tokens | e.g. 1500 |
| output_tokens | Long | Output tokens | e.g. 320 |
| cached_input_tokens | Long | Cached input tokens | e.g. 1200. Input served from cache, which is billed differently. |
| reasoning_output_tokens | Long | Reasoning output tokens | e.g. 800 |
| session_id | String | Session ID | e.g. 01990000-1111-7222-8333-444455556666. Groups the events of one Codex session. |
| turn_id | String | Turn ID | e.g. 01a00000-1111-7222-8333-444455556666. One exchange within a session. |
| service_tier | String | Service tier | e.g. default, flex, priority |
| environment_id | String | Environment ID | e.g. env-3c4d5e6f |
| workspace_id | String | Workspace ID | e.g. 9a8b7c6d-1e2f-4a3b-8c4d-5e6f70819a2b |
| type | String | Event type | e.g. CODEX_LOG |
| event_id | String | Event ID | e.g. 3c4d5e6f-7081-49a2-b3c4-d5e6f7081920 |
| user_id | String | User ID | e.g. user-AbCdEfGhIjKlMnOpQrStUvWx |
| actor_type | String | Actor type | e.g. ACCOUNT_USER |
| principal_id | String | Workspace ID | e.g. 9a8b7c6d-1e2f-4a3b-8c4d-5e6f70819a2b |
| principal_type | String | Workspace type | e.g. CHATGPT_WORKSPACE |
| file_id | String | Log file ID | e.g. eclf_0a1b2c3d4e5f60718293a4b5c6d7e8f9. Compliance log file the event was read from. |
| extra | Map | Unmapped fields | e.g. {new_field=...}. Fields this app does not recognise yet, kept so nothing is lost when the API adds them. |
| src_ip | IP | Source IP | e.g. 203.0.113.10 |
| src_country | String | Source country | e.g. KR |
| src_city | String | Source city | e.g. Seoul |
| src_region | String | Source region | e.g. Seoul |
| src_asn | String | Source ASN | e.g. 4766 |
| user_agent | String | User agent | e.g. Mozilla/5.0 |
| ja3 | String | JA3 fingerprint | e.g. a1b2c3d4e5f60718293a4b5c6d7e8f90. TLS client fingerprint; a change can mean a different client. |
| ja4 | String | JA4 fingerprint | e.g. q13d0314h3_a1b2c3d4e5f6_0a1b2c3d4e5f |
| dst_host | String | Destination host | e.g. chatgpt.com |