OpenAI API Platform source coverage
Started 2026-11-05 before control design. Scope: customer-controlled API organization/project access and developer integration boundaries, including hosted Agents, tool connections, all indexed model-family APIs, state and delivery callbacks. Baseline: no separate API Platform guide or API pack directory existed. Family/common controls and ownership are reconciled in the OpenAI family ledger. Placement: OpenAI → API Platform; API projects do not inherit ChatGPT workspace authorization.
No tenants declared — Tier 0+1 only. No credential reads, credential creation, live model requests or tenant configuration took place. Guide maturity remains ai-drafted with zero live-validation marks.
Retrieval and source-first candidates
Read the official product index, feature index and full endpoint index independently of the old ChatGPT headings. Sources below were successfully fetched 2026-11-05. Private .hth-validation/openai-api-sources/manifest.json retains URL, UTC time, status, length and SHA-256; at the API checkpoint it contained 104 successful fetches and three failed guessed routes across API and adjacent developer products. Retrieval counts are not coverage percentages. GitHub raw bodies that stalled were fetched from the official GitHub contents API and base64-decoded, without third-party reconstruction.
The initial candidates were RBAC, key governance, endpoint retention, signed callbacks, indexed Agents/tool security branches, Administration endpoints, changelog/deprecations, and adjacent Ads/SIWC/plugin/commerce products. Selecting controls followed those reads. This is their final reconciliation, including older omissions.
Daybreak correction, before control 5.4 design: a second index reconciliation found that the initial pass had read but failed to disposition the index’s Daybreak branch. Successfully fetched the complete Responses Daybreak guide, cybersecurity checks, PSP setup/operations, tool review, and native project retrieve/modify references. Official Help browser fetches verified the overview, onboarding, project setup, and troubleshooting. This is an older omission plus a model-dependent default change, not a model-catalog stub. API and workspace approval remain separate.
| Candidate / fetched official evidence | Scope, defaults and lifecycle | Disposition / actual guidance |
|---|---|---|
| RBAC, Terraform access | Org/project/direct/group grants combine; key scopes intersect permissions; 30-minute propagation | 1.1 project separation, combined-role review and denial tests. Native role/group grant, direct-member GET and CLI project inventory. Direct-member GET is explicitly not complete effective access. |
| API keys, production governance, key-list contract | Org key-type/lifetime restrictions govern new creation, leaving existing keys; secrets returned once; default list visibility can omit enabled keys with inactive owners | 1.2 keyless identity and residual key expiry/revocation review. Read pack uses owner_project_access=any and flags inactive owners; omits values, redactions, names and emails. No key creation. |
| WIF, service identities | Exact issuer/audience/claims; provider identity has no default role or key | 1.2 native 1.5.0 service account/group/role/WIF rule. X.509 has the separate mTLS certificate lifecycle in 2.1. No token/certificate created. |
| IP allowlist | Project replaces org list; API ingress only; 15-minute propagation; 50 entries | 2.1 scope/check/recovery and GET test for ip_not_authorized, distinct from bad credentials. A GET does not enforce policy. |
| mTLS, Private Link | Upload versus activation; chain/AKI/CEL; no AIA/CRL/OCSP. Private Link requires onboarding and is incompatible with IP lists and mTLS | 2.1 certificate rotation and private-endpoint/DNS/health-check procedures. These deployments are not represented as proven by the ingress GET. Provider certificate handles discovered, without claiming a complete rollout. |
| Project controls | Model allow/deny policy; five tool booleans; org all-project enablement prevents project false values; different destroy behavior | 2.2 native model/tool resources, 5.2 independent native data-source read-back. |
| Data/endpoint table | Training, abuse logs and state differ; eligibility/caching/background/tool/regional exceptions; per-object deletion | 3.1 retention/residency review and eligible native project setting; 3.2 state/offboarding/dependency inventory. GET covers Files and Vector Stores only; Agents/Conversations/ChatKit/traces/model artifacts/external copies have separate app-owned lifecycle. No universal delete claim. |
| Agent security, review, hosted network | Beta; review defaults none; hosted network enabled unless inherited; review cannot override network |
4.1 new isolated environment with explicit auto_review and disabled/restricted exact-host egress; real SDK serialization fixture. Cloud, self-hosted executor, app approval handlers and readable runtime secrets distinguished. |
| MCP, vaults, plugins, tracing | Beta service-origin MCP bypasses executor egress; omitted tools means all; required defaults false; secrets/traces/plugin code introduce separate boundaries | 4.2 exact tools, required startup, explicit origin, URL-bound vaults, plugin review and trace retention. Builder connects to nothing. |
| Webhooks, Agent callbacks | Raw-body signature/timestamp; webhook-id delivery deduplication; retries; not exactly-once |
5.1 real SDK verification, durable atomic enqueue adapter, 400 invalid / 503 storage failure, event allowlist. Agent callback subscription remains distinct. |
| Admin APIs, audit list | Admin credential/audience distinct; cursor pagination, event type, effective_at[gte] |
5.2 fail-closed GET export, no external checkpoint advancement, real allowlist-event Sigma rule. SIEM ingestion/mapping operator-owned. |
| Spend, native rate/spend | Hard caps differ from alerts; propagation overrun/429; native threshold USD cents | 5.3 explicit positive hard cap, alerts/recovery ownership, current singular rate-limit lifecycle. |
| Daybreak, team access, PSP | Org approval, separately enabled non-default project, model permission and request selection differ. Omission defaults vary by model; GPT-6 Cyber adds approval/IP/conditional PSP. PSP stores encrypted customer records and has a distinct connection lifecycle | 5.4 explicit request selection, saved-program/model checks, Red SSO/MFA, internal-use scope, native PSP status GET and safety identifiers; 3.1–3.2 explain stored records and policy changes. No claim that the request grants access or status proves connectivity. Project Daybreak write/read fields are unverified in fetched native project/provider contracts. |
| Changelog, deprecations, full indexes | Text/image/audio/Realtime/Decisions/embeddings/moderation/fine-tuning/evals share controls but differ in data rules; legacy surfaces need migration | Scope/3.1/3.2/appendix reconcile these families. Model marketing variants do not need separate stubs. Retired video/Sora routes do not become new controls. |
| Ads auth, audit | Separate host, account keys/OAuth, ad-account roles/conversions/spend | Separate substantive Ads guide and ledger, not inherited API settings. |
| SIWC, logout, plugin OAuth, commerce, payment | Separate relying-party/resource-server/merchant contracts; limited-trial SIWC; OAuth audiences/scopes/payment boundaries | Family developer-integration controls and product dispositions, owned by family lane. No inheritance of API projects, callback signature formats or key policy. |
Six-surface census
| Surface | Status and fetched evidence | Write/enforce versus read/assess decision |
|---|---|---|
| Terraform | Available official openai/openai 1.5.0: full resources, full data sources, changelog. Installed schema 30 resources / 49 data sources, matching fetched lists |
Resources for roles/groups/service identity/WIF/model/tool/retention/spend. Independent data sources assess policy. Full list also includes certificates/external keys/MCP tunnels/invites/org settings/webhooks/rate limits/service tiers; these are not ChatGPT global-policy resources. No secret creation/state output. |
| REST / GraphQL | Available full endpoint reference/current admin.organization; beta Agents distinct. No GraphQL contract documented in fetched full API index; bounded index observation, not universal absence claim |
Six GET packs assess members/key expiry/ingress/two stores/audit/PSP saved status. Native resources handle selected writes. Other methods remain app-specific lifecycle/approval operations; no live writes. |
| CLI | Available first-party CLI guide, README; repo inventory consulted | Project inventory pack. Current README supports nested space commands and colon aliases. Pagination limitations explicit. API sources advertise no desktop/daemon/MDM org-policy file; Work/Codex clients reconciled separately. |
| SDK | Official openai 7.51.0, isolated SDK manifest and frozen Bun lock; installed with scripts disabled; actual beta.agents.sessions.create, responses.create, webhooks.unwrap, error and parameter types inspected |
Hosted/Daybreak execution entry points mutate only when explicitly called; direct execution prints drafts. MCP pure builder. Receiver verifies locally and requires durable adapter. No model/API request in tests; mocked fetch exercises actual serialization. |
| Native config / system policy | Available/beta hosted environment/network, MCP and vault request schemas | Real native request builders; no invented security.yaml/MDM policy. Conditional Azure/DNS deployment guidance is not labeled OpenAI native config. |
| SIEM | Available Admin audit export and actual ip_allowlist.updated, .deleted, .config.deactivated events |
GET exporter and experimental Sigma. No fictional SQL table/push connector. Sink mapping and protected storage require validation. |
Verified material findings
Types refer to omissions from the previous family/common baseline; the API guide is new.
| Type | Title / what the guide should say | Verified evidence | Target |
|---|---|---|---|
| OMISSION | API access is separate; combined grants and residual keys need review | RBAC, governance | 1.1–1.2 |
| OMISSION | Native enforcement and assessment surfaces exist, including keyless WIF | Terraform, 1.5.0 release | 1.2/2.2/3.1/5.2–5.3 |
| OMISSION | Network scope/compatibility and certificate rotation require explicit choices | IP lists, mTLS, Private Link | 2.1 |
| OMISSION | Training defaults do not imply no retained state or endpoint exceptions | Data table | 3.1–3.2 |
| OMISSION | Agents default review is none; service MCP bypasses environment egress | Review, MCP | 4.1–4.2 |
| OMISSION | Callback delivery and audit exports have distinct IDs/schemas | Webhooks, audit | 5.1–5.2 |
| OMISSION | Current hard spend limits exist and cents matter | Spend | 5.3 |
| DEPRECATED | Deprecated aggregate rate limits removed in provider 1.0.0; use singular resource | Changelog | Appendix |
| OMISSION | Daybreak admission is separate from model permissions and workspace access; PSP has customer-owned storage responsibilities | Daybreak, team setup, PSP | 5.4, 3.1–3.2 |
| CHANGED_DEFAULT | Omitting the Cyber request parameter does not mean the same safeguards across models; Terra uses standard treatment while earlier eligible models can select Daybreak implicitly | Daybreak defaults | 5.4 |
Validation and limits
- PASS:
bun test scripts/test-openai-api-refresh.test.ts— 16 tests / 110 assertions with the isolated actual SDK 7.51.0: webhook freshness/signatures/durable retry; hosted/Daybreak native serialization and explicit selection/no fallback; MCP constraints; complete paginated export; key visibility; ingress; two-store inventory and PSP saved status. Transport fixtures verify secret-free argv, quoted stdin credentials, curlrc suppression, fixed origins/explicit loopback, private-file permissions/cleanup, late-page zero-output failure, raw-error omission and oversized-body refusal. - PASS:
bun install --cwd packs/openai-api/sdk --frozen-lockfile --ignore-scripts. Tests import the installed SDK from this exact directory. No ambient root dependency or root manifest/lockfile changes are required. - PASS: official provider 1.5.0
terraform init -backend=false -input=false,terraform validate,terraform providers schema -json;terraform fmt -check packs/openai-api/terraform. No plan/apply or API authentication. Sandbox escalation enabled only the local provider socket and loopback tests. - Structural/generated/site integration is the family lane’s final gate; this child task does not mutate shared generated files or Git metadata.
- DRIFT-CHECKED-ONLY: public implementation paths. VERIFIED-LIVE: 0. Console steps, eligibility, WIF exchange, network/certificate/private-link enforcement, actual SDK execution, callback deployment, SIEM mapping and endpoint deletion were not tenant-tested.
- Daybreak project toggle fields remain unverified in the inspected project retrieve/modify references and provider schema; documented console setup is retained. The current API model table does not specify Terra’s exact explicit program value, so the guide does not infer it from Red approval. Saved PSP
validatedis not continuous health, and a GET does not perform validation. Cloud storage/EKM, enabled policy, per-user enforcement and actual streamingcyber_policyhandling require authorized integration validation. - No product-specific CIS/STIG/SCuBA setting identifiers or vulnerability claims published. No third-party source was required for these interface omissions. An unresearched external baseline is not asserted absent.
- Failed guesses
/api/docs/guides/security.md,/api/docs/guides/cli.md,/plugins/security-privacy.mdreturned generic 404 shells. Real indexes supplied API replacements and plugin auth. These failures establish no feature absence; broader plugin/commerce coverage is reconciled by family lane.
Final API/provider/CLI retrieval subset: 100 successful first-party bodies, including full indexes and the official provider/CLI references; four additional current Help pages verify Daybreak overview/onboarding/setup/troubleshooting. Adjacent Ads, SIWC, plugin and commerce bodies are excluded from that subset.
Authored corpus: 12 leveled controls; 12 guide includes; 18 rendered pack artifacts across Terraform/API/CLI/SDK/Sigma, plus shared versions.tf and GET helper. Dependency-only SDK manifest/Bun lock and Terraform provider lock are excluded from pack counts. Counts describe authored coverage, not exhaustive future completeness.