User Guide
Searches the compliance logs of a ChatGPT Enterprise workspace. What members discussed with ChatGPT, what administrators changed, who signed in, which external apps and connectors were called, and how Codex was used are all readable from one place.
See the install guide for setup.
Conversations
Groups what members exchanged with ChatGPT into conversations. Selecting one reconstructs the full exchange in time order on the right, with user messages and model replies distinguished, alongside the model name and client type.
A single conversation arrives spread across many log files, so collection order is not conversation order. The panel re-sorts by message time.
Attachments appear as identifiers only, because the Compliance API does not serve file contents.
Logs
App auth, app calls, audit, authentication, Codex, and Codex security are searched the same way.
- Narrow by period and account; several accounts can be selected at once
- Click a cell to add that value as a condition. Conditions appear as chips and can be removed individually
- Click a row to see every field on the right, ordered by the log schema
- Period, conditions, and page are held in the address, so the view survives a reload, a shared link, or the back button
Lists show only the last 100 characters of a message body. Instructions often sit at the end of a long message, and opening a row re-reads the whole value.
Collection status
ChatGPT Enterprise > Collectors shows status, record count, and the time of the most recent collection for each target.
Removing a collector asks whether to drop the table as well. If the table is kept, re-enabling the collector appends to the same table.
Query commands
The API can also be read directly, without a collector. This is what to use for a period before collection started, or for a one-off look at a type that is not being collected.
| Command | Reads |
|---|---|
chatgpt-ent-chat-logs | Prompts and model replies |
chatgpt-ent-audit-logs | Administrative actions |
chatgpt-ent-auth-logs | Sign-in activity |
chatgpt-ent-app-auth-logs | App and connector link/unlink events |
chatgpt-ent-app-logs | App and connector calls |
chatgpt-ent-codex-logs | Codex usage |
chatgpt-ent-codex-security-logs | Codex security scan findings |
chatgpt-ent-presentation-logs | Presentation activity |
chatgpt-ent-spreadsheet-logs | Spreadsheet activity |
chatgpt-ent-custom-agents-logs | Custom agent activity |
chatgpt-ent-log-files | The compliance log file listing |
Every command takes profile, duration, from, and to. The log commands also take user, and conversations and app calls additionally accept conversation-id.
With no period given, the last 24 hours are read, because the API requires a start time.
To judge how much data a period holds before downloading any of it, list the files first.
Limits
- Retention: the API serves the last 30 days. Anything older is gone for good
- Delay: a log file appears in the listing only after it closes, so an event that just happened is not immediately visible
- File boundaries: a file is named for the time it closed, and its first records can predate that. Queries re-filter by event time
- Body encoding: HTML entities are decoded at collection time, so bodies read as originally written. Values containing tabs are rendered in a fixed-width column
- Permissions: creating and removing collectors requires an administrator. Searches run with the caller's own session, so table access control applies as usual