ChatGPT Enterprise Collection

ChatGPT Enterprise Collection Integration with Onna

Overview

This guide explains how to set up a ChatGPT Enterprise collection through the Onna Platform API. You'll learn how to store your ChatGPT Enterprise API key in a wallet, create a collection, list the users in your ChatGPT workspace, choose which users and content to sync, start the sync, rotate the API key, and clean up your environment afterward.

ChatGPT Enterprise connects with an API key, not OAuth: there is no authorization URL or pairing step.

Before you start

You need two values from your ChatGPT Enterprise workspace:

• a Compliance API key, which an OpenAI workspace owner creates;
• the workspace ID of the ChatGPT workspace the key belongs to.

The ChatGPT Enterprise connector must also be enabled for your Onna account; contact Onna support to enable it.

Create a workspace

A workspace is the main container for your project in Onna. Create one with a POST request.

curl --location --request POST 'https://api.onna.com/v1/workspaces' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{
  "name": "My New Workspace",
  "description": "This is a workspace for organizing ChatGPT Enterprise data in Onna."
}'

A successful response (201) will return:

{
  "onna_id": "<WORKSPACE_ID>"
}

Create a ChatGPT Enterprise Wallet

The wallet stores the API key. Onna checks the key against your ChatGPT workspace when the wallet is created, so a wrong key or workspace ID fails now rather than when the sync runs.

curl --location --request POST 'https://api.onna.com/v1/wallets' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{
  "name": "ChatGPT Enterprise",
  "credential_type_name": "Datasource",
  "config_type": "echatgpt",
  "credentials": "<BASE64_ENCODED_CHATGPT_API_KEY>",
  "metadata": {
    "workspace_id": "<CHATGPT_WORKSPACE_ID>"
  }
}'

Where:

• name is a label for the wallet.
• credential_type_name is the credential type. For ChatGPT Enterprise, use Datasource.
• config_type identifies the service. For ChatGPT Enterprise, use echatgpt.
• credentials is the API key, base64-encoded (for example, echo -n '<CHATGPT_API_KEY>' | base64).
• metadata.workspace_id is the ChatGPT workspace the key belongs to.

A successful response (201) will return:

{
  "onna_id": "<WALLET_ID>"
}

The API key is write-only: GET /wallets and GET /wallets/<WALLET_ID> never return it.

Create a ChatGPT Enterprise Collection

Create the collection in your workspace, referencing the wallet.

curl --location --request POST 'https://api.onna.com/v1/collections' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{
  "name": "My ChatGPT Enterprise Collection",
  "onna_parent_id": "<WORKSPACE_ID>",
  "type": "echatgpt",
  "credential_id": "<WALLET_ID>"
}'

A successful response (201) will return:

{
  "onna_id": "<COLLECTION_ID>",
  "type": "echatgpt"
}

Creating the collection doesn't start a sync, so you can choose users first.

Retrieve the List of Users

List the users in the ChatGPT workspace with the collection's /users endpoint.

curl --location --request GET 'https://api.onna.com/v1/collections/<COLLECTION_ID>/users?limit=100' \
--header 'Authorization: Bearer <token>'

A successful response (200) returns:

{
  "users": [
    {
      "id": "user-abc123",
      "email": "jane@example.com",
      "name": "Jane Doe",
      "role": "standard-user",
      "status": "active"
    }
  ],
  "offset": "user-abc123"
}

• limit is at most 100 and defaults to 100.
• When offset is not null, pass it back as the offset query parameter to get the next page.
• Use each user's id in the sync filters below.

GET /collections/<COLLECTION_ID>/users/lookup isn't available for ChatGPT Enterprise collections. To select someone by address, put their email address in selected instead.

Configure Sync Filters

The sync_filters object for ChatGPT Enterprise has two keys, matching the Onna UI:

Key	Description
custodians	Which users to sync. Each selected entry is { "id": "<user id or email>" }; each excluded entry is { "id": "<user id>" }. A non-empty selected syncs only those users.
types	Which content to sync. Each entry is { "id": "files" }, { "id": "canvases" } or { "id": "recordings" }.

Both use all_selected, selected and excluded. Omitting a key syncs everything it covers, but sync_filters needs at least one key before the sync can start: to sync everyone, send "custodians": { "all_selected": true }.

Sync specific users

curl --location --request PATCH 'https://api.onna.com/v1/collections/<COLLECTION_ID>' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{
  "type_sync": "arch",
  "sync_filters": {
    "custodians": {
      "all_selected": false,
      "selected": [
        { "id": "user-abc123" },
        { "id": "john@example.com" }
      ]
    },
    "types": {
      "all_selected": true,
      "selected": [
        { "id": "files" },
        { "id": "canvases" },
        { "id": "recordings" }
      ]
    }
  }
}'

Sync every user, including ones added later

Set all_selected to true under custodians. To leave some users out while still syncing users who join the workspace later, list their user id values in excluded (email addresses are not matched there).

"custodians": {
  "all_selected": true,
  "excluded": [
    { "id": "user-def456" }
  ]
}

type_sync is "arch" to keep syncing on a schedule, or "one" for a one-time sync. A successful PATCH returns 204 No Content. A filter Onna can't use, such as an unknown content type, returns a 422.

tip

Always send the complete sync_filters object on update. Keys you omit are replaced, not merged with the previous value.

You can also send sync_filters when you create the collection if you already know the users' email addresses.

Start the Sync

curl --location --request POST 'https://api.onna.com/v1/collections/<COLLECTION_ID>/start' \
--header 'Authorization: Bearer <token>'

A successful response (200) indicates that the sync has begun. Only the users and content allowed by the filters are collected. If the collection has no sync filters yet, including an empty sync_filters object, this returns 412 "Sync filters not configured".

Rotate the API Key

To replace the key, send the new one, base64-encoded, as credentials. Onna checks it against the workspace the wallet was created for before replacing the old key, so a rejected key leaves the wallet working as before.

curl --location --request PATCH 'https://api.onna.com/v1/wallets/<WALLET_ID>' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{
  "credentials": "<BASE64_ENCODED_NEW_CHATGPT_API_KEY>"
}'

A successful response is 204 No Content. The key is always checked against the wallet's original workspace; to collect from another workspace, create a new wallet. Only the user who created the wallet can rotate its key.

Clean Up

Delete the collection and the workspace when you are done.

curl --location --request DELETE 'https://api.onna.com/v1/collections/<COLLECTION_ID>' \
--header 'Authorization: Bearer <token>'

curl --location --request DELETE 'https://api.onna.com/v1/workspaces/<WORKSPACE_ID>' \
--header 'Authorization: Bearer <token>'

Note: Deleting a collection or workspace is permanent and cannot be undone.