Skip to content

Open AI Agent Onboarding

Step 1: Create an Admin Key

  1. Go to platform.openai.com

  2. Sign in as an Org Owner or Admin

  3. Navigate to Settings → Organization → Admin API keys

  4. Click Create new admin key

  5. Name it (e.g. "SailPoint Entro Integration")

  6. Copy the key - it starts with sk-admin-

Note

Only Org Owners and Admins can create admin keys. If you don't see the option, ask your org owner.

Step 2: Enter Your Admin Key in the SailPoint Entro Onboarding Form

What Happens Next

Once we receive the key, our platform automatically:

  1. Discovers your org

    • users, roles, pending invites

  2. Enumerates all projects

    • active and archived

  3. For each project, collects:

    • Project members and their roles

    • API keys and their owners (human or service account)

    • Service accounts

  4. Creates a temporary read-only service account per project to access:

    • Assistants (AI agents) - name, tools, instructions, model

    • Files and vector stores (knowledge bases)

  5. Pulls usage data

    • completions, embeddings, images, audio

  6. Pulls audit logs

    • activity events (requires Org Owner + Data Controls enabled)

  7. Builds the agent inventory

    • stitches everything into identity graphs with risk scoring

    Setup requires no manual configuration, webhooks, or additional keys.

Permissions Required

The admin key needs these scopes (granted by default to admin keys):

  • organization.read

  • organization.projects.read

  • organization.audit_logs.read

  • organization.usage.read

For audit logs to contain data, the Org Owner must enable Data Controls in the OpenAI dashboard.

FAQ

Q: Is the admin key read-only?

A: Admin keys have broad access. We only perform read operations. The one write operation is creating a temporary service account per project (required to read assistant data). These can be cleaned up after the scan.

Q: How often do you scan?

A: Configurable. Default is daily.

Q: Do you need access to our cloud infrastructure?

A: No. We only need the OpenAI admin key. We detect agent capabilities (tools, knowledge files, access) from the OpenAI API. For full NHI correlation, you can optionally connect your vault/cloud separately.

Q: What if we have 100+ projects?

A: The scan iterates through all projects automatically. No manual setup per project.

Q: Can we revoke access?

A: Delete the admin key at any time in the OpenAI dashboard. Access is immediately revoked.