OpenAI

Overview

Connect your OpenAI Platform organization and get OpenAI API cost and usage in the same views as your cloud and other AI spend - cost per model, project, API key, and member, with daily granularity.

Three connection types are listed in the wizard, by OpenAI product:

OpenAI Platform - API usage billed to an OpenAI organization. Available now.
ChatGPT/Codex Enterprise - Coming soon.

This article covers the OpenAI Platform connection. Documentation for the other two will follow when they ship.

Why it matters

OpenAI API spend is driven by model choice, prompt volume, and output size - all of which shift as teams iterate. Connecting brings that spend into Umbrella so you can see which projects and models drive cost, tie API usage to engineering output, and set anomaly alerts on OpenAI the same way you would for AWS or Azure.

What gets tracked

Signal	Granularity
Cost per model	Daily
Cost per project	Daily
Cost per API key	Daily
Cost per member	Daily
Usage (requests, tokens)	Per model, project, API key, member

Umbrella reads cost and usage reports from the OpenAI Platform. The connection does not access prompt contents, completions, or any model inputs.

📘
Member names and emails
Per-member attribution includes names and email addresses when your organization's privacy setting allows it. If the setting is off, member-level rows are anonymized.

Which OpenAI product is supported

OpenAI product	Status
OpenAI Platform (API usage)	Available
OpenAI Codex	Coming soon
ChatGPT Enterprise	Coming soon

Codex and ChatGPT Enterprise appear in the wizard as disabled cards with a Coming soon chip. Pick OpenAI Platform for this release.

Before you start

OpenAI organization owner access on platform.openai.com.
Ability to create an Admin API key in the organization. Admin keys live under Settings → Organization → Admin keys and are distinct from project API keys and secret keys.

Step 1: Account details

Open Cloud Connections → Add connection → OpenAI to launch the wizard.

Field	What it is
Onboard this account to	Choose A customer (then pick the customer name) or My organization.
Display account name	Label this connection carries in Umbrella (e.g. Acme OpenAI). This label identifies the connection throughout Umbrella Cost.
OpenAI connection type	Choose OpenAI Platform. Codex and ChatGPT Enterprise are disabled with a Coming soon chip.

Click Continue.

Step 2: OpenAI Platform setup

Open platform.openai.com in another tab, sign in as an organization owner, and create the Admin API key.

🚧
Must be an Admin API key
Project API keys and user secret keys are rejected - they can't read organization-level cost and usage. Create the key from Settings → Organization → Admin keys, not from a project or your personal keys page.

Create the Admin API key

Sign in as an organization owner. Open platform.openai.com and switch to the organization you want to connect.
Open Admin keys. Go to Settings → Organization → Admin keys.
Create a new Admin key. Give it a descriptive name (e.g. Umbrella Cost).
Copy the key. It's shown only once. Copy it before leaving the page.

Fill in the connection fields

Field	Value
Admin API key	The Admin key from the step above. Encrypted at rest by Umbrella.

📘
No Organization ID needed
Umbrella resolves your OpenAI organization automatically from the Admin key. There is no separate Organization ID field to fill in.

Click Create connection.

After you connect

Umbrella begins pulling OpenAI cost and usage reports and refreshes daily. The connection first appears in Pending Data state and flips to Healthy once the first batch lands.

From here you can:

Explore OpenAI spend in the Cost & Usage Explorer, broken down by model, project, API key, or member.
Build a dimension to organize spend by team or product group.
Enable anomaly alerts on OpenAI API cost against baseline.
Track model mix - which models projects are routing to and how that shifts over time.

Key rotation

OpenAI Admin keys don't expire automatically, so rotation is on your own schedule. To rotate cleanly:

Create a replacement Admin key in Settings → Organization → Admin keys on platform.openai.com.
Update the key in Umbrella under Cloud Connections → [your connection] → Edit.
Delete the old key from the Admin keys page.

Rotating quarterly is a reasonable baseline; align to your own credential-hygiene policy.

Troubleshooting

"Project key rejected" or "Secret key rejected." Umbrella requires an Admin API key, not a project API key or user secret key. Create a new key from Settings → Organization → Admin keys - project and user key pages won't produce the right type.
"Wrong role" or authentication failure. The key must be created by an organization owner. Members with lower roles can't create Admin keys, and keys they create don't have the required read scope on cost and usage reports.
No member names or emails appear. Your organization's privacy setting is restricting PII. Enable member attribution in Umbrella settings if you want names and emails to appear in per-member cost breakdowns.
Connection resolves to the wrong organization. The Admin key is tied to one specific OpenAI organization. If the key was created in a different org than you expected, delete the connection, switch orgs in platform.openai.com, create a new Admin key there, and reconnect.