chatgpt-audit-logs
Retrieve ChatGPT audit logs.
chatgpt-audit-logs profile=PROFILE [duration=NUM{mon|w|d|h|m|s}] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss] [project-id=PROJECT-ID] [user=USER] [action=ACTION]
- profile=PROFILE
- Profile name of ChatGPT
- duration=NUM{mon|w|d|h|m|s}
- Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example,
10smeans data from 10 seconds earlier. - from=yyyyMMddHHmmss
- Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
- to=yyyyMMddHHmmss
- End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
- project-id=PROJECT-ID
- Filter by project ID
- user=USER
- Filter by user email
- action=ACTION
- Filter by action type
Output Fields
| Field | Type | Name | Description |
|---|---|---|---|
| profile | String | Connect profile | Profile name of ChatGPT |
| _time | Date | Time | When the event occurred |
| id | String | ID | Unique identifier for the audit log event |
| src_ip | IP address | Source IP | IP address of the actor |
| user_type | String | User type | Type of user (session, api_key) |
| user | String | User | Email of the user who performed the action |
| action | String | Action | Type of the audit log event |
| project_name | String | Project name | Project name associated with the event |
| params | Map | Parameters | Event-specific parameters (e.g., api_key.created, certificate.deleted) |
| user_id | String | User ID | User ID who performed the action |
| service_id | String | Service ID | Service account ID for API key actions |
| api_key_id | String | API key ID | ID of the API key used |
| api_key_type | String | API key type | Type of the API key used |
| project_id | String | Project ID | Project ID associated with the event |