ChatGPT Enterprise Audit

Workspace administration audit log (event_type = AUDIT_LOG)

#	Field	Type	Display name	Description
1	_time	DATE	Time
2	user	STRING	Account	e.g. user01@example.com
3	action	STRING	Action	e.g. CONVERSATION_DELETE, CONVERSATION_MESSAGE_RATING, FILE_DOWNLOAD, UPDATE_USER_USAGE_LIMITS, USER_ROLE_UPDATED
4	result	STRING	Result	SUCCESS, FAILURE
5	action_privilege	STRING	Privilege	ADMIN, STANDARD_USER
6	src_ip	IP	Source IP	e.g. 10.0.0.10
7	src_country	COUNTRY	Source country	e.g. KR
8	src_city	STRING	Source city	e.g. Seoul
9	src_region	STRING	Source region	e.g. Seoul
10	src_asn	STRING	Source ASN	e.g. AS00000 Example Telecom
11	src_latitude	STRING	Source latitude	e.g. 37.5665
12	src_longitude	STRING	Source longitude	e.g. 126.9780
13	params	MAP	Parameters	Payload of the action; its shape varies by action
14	user_agent	STRING	User agent	e.g. Mozilla/5.0 (Windows NT 10.0; Win64; x64)
15	dst_host	STRING	Destination hostname	e.g. chatgpt.com
16	ja3	STRING	JA3	e.g. 00000000000000000000000000000000
17	ja4	STRING	JA4	e.g. t13d1516h2_8daaf6152771_02713d6af862
18	type	STRING	Event type	e.g. AUDIT_LOG
19	event_id	STRING	Event ID	e.g. 00000000-0000-0000-0000-000000000000
20	user_id	STRING	User ID	e.g. user-A1b2C3d4E5f6G7h8I9j0K1l2
21	actor_type	STRING	Actor type	ACCOUNT_USER, SERVICE_ACCOUNT
22	principal_id	STRING	Workspace ID	e.g. 00000000-0000-0000-0000-000000000000
23	principal_type	STRING	Workspace type	CHATGPT_WORKSPACE
24	file_id	STRING	Log file ID	e.g. eclf_0000000000000000000000000000000000
25	extra	MAP	Unmapped fields	Fields the API added that this schema does not name yet