OpenAI

The OpenAI integration detects a variety of data loss prevention, account misconfiguration, and user security risks in an integrated OpenAI account that could leave you and your organization vulnerable.

This integration covers the following OpenAI products:

• ChatGPT Enterprise (Workspaces)
• OpenAI Platform Projects (API keys)
• GPTs (custom GPTs)

• An OpenAI organization with a ChatGPT Enterprise workspace
• Organization-level admin privileges to create and manage Admin API keys
• (Optional) A Project API key and the corresponding Project ID if you plan to include OpenAI Platform Projects in the scan scope

Compliance API access is required to use the OpenAI CASB integration. To enable Compliance API access:

1. Contact support@openai.com to request access to the Compliance API for your organization and for the API key you will use with Cloudflare CASB. In your request, include:
   • The last four characters of the API key
   • The name of the API key
   • The name of the user who created the key
   • The requested scope (read, write, or both)
2. OpenAI will verify the key and grant the requested Compliance API scopes.
3. After the scopes are granted, add the OpenAI integration to CASB. When prompted, enter your Open AI Admin API key, Organization ID, and Workspace ID (available at https://chatgpt.com/admin/settings).

For more information, refer to the OpenAI Help Center ↗︎.

For the OpenAI integration to function, Cloudflare CASB requires the following authorization via API keys:

• Admin API key (organization-level): Grants read-only access to organization/workspace metadata, GPTs, users, invites, and audit/compliance objects exposed by the ChatGPT Enterprise Compliance API.
• (Optional) Project API key (project-level): Grants read-only access to OpenAI Platform project metadata and keys.

These credentials follow the principle of least privilege so that only the minimum required access is granted.

The OpenAI integration currently scans for the following findings, or security risks. Findings are grouped by category and then ordered by severity level.

To stay up-to-date with new CASB findings as they are added, bookmark this page or subscribe to its RSS feed.

Flag risky tool and capability settings on custom GPTs.

Identify GPTs that are externally visible beyond your organization.

Detect API keys that may be stale, unused, or overdue for rotation.

Flag user/invite issues to help enforce best practices.

These findings will only appear if you added DLP profiles to your CASB integration.