OpenAI Codex audit logs: what admins can see, by plan, and the gaps

the short answer

Partly. On ChatGPT Enterprise, the Compliance API covers Codex records under conversation_message and codex_log for local computer access with Work Cloud, available for 30 days, but OpenAI says these sources do not establish a complete record of every local command or file operation. Codex analytics are aggregate, not audit logs. For local actions, enable Codex OpenTelemetry, which is off by default, or record tool calls with hooks.

Compliance API: ChatGPT Enterprise; for local computer access with Work Cloud, Codex under conversation_message and codex_log
Record availability: 30 days in the Compliance Logs Platform; exports follow your retention
Analytics: Aggregate dashboards and API, “not raw audit logs” (OpenAI governance docs)
OpenTelemetry: Off by default; log_user_prompt = false by default
Local files: Session rollouts under ~/.codex/sessions/ (per Codex source code)

Codex Log Sources Compared

Per the Codex source code, codex.tool_result also carries the tool arguments (so shell commands) and a truncated output preview, and log events carry user.email and user.account_id for attribution. OpenAI advises treating tool arguments and outputs as sensitive and redacting them at the collector.

Source	What it records	Gaps
ChatGPT Compliance API	`conversation_message` and `codex_log` records via an append-only stream, downloaded as JSONL; the docs describe these under local computer access with Work Cloud	Not a complete record of local commands, file operations or approvals; coverage for other Codex surfaces is not mapped in the docs
Codex analytics dashboard and API	Aggregated Codex usage	Not raw audit logs; the dashboard has no stable schema, and the API is aggregate only
OpenTelemetry (`[otel]` in `config.toml`)	`codex.tool_decision` (approved or denied, and whether config or user decided), `codex.tool_result`, `codex.user_prompt` (length unless content is enabled)	Off by default; you run the collector
Local rollouts	Full sessions in `~/.codex/sessions/YYYY/MM/DD/rollout-*.jsonl`, with `cwd` and creator IDs in the header	On each laptop; documented in source code, not in the user docs
Hooks	`PreToolUse`, `PermissionRequest`, `PostToolUse`, `UserPromptSubmit` and more	You build the pipeline

Turn on Codex OpenTelemetry

Distribute it as a managed default, through the legacy managed_config.toml or a cloud or system config.toml; users can still change it during a run, because [otel] is not a requirements.toml key. See the Codex requirements.toml example. Separately, Codex sends anonymous usage analytics to OpenAI by default; [analytics] enabled = false turns that off.

[otel]
environment = "prod"
log_user_prompt = false
exporter = { otlp-http = { endpoint = "https://otel-collector.example.com/v1/logs", protocol = "binary" } }

Filling the Gap with a Hook-Level Client

Failproof hooks Codex (blocking verified on PreToolUse, PermissionRequest, UserPromptSubmit, Stop, SubagentStop and PostToolUse) and records sessions and policy decisions per machine. Codex 0.129 and later only runs hooks from ~/.codex/hooks.json after a user approves them; when failproofai config can use sudo, it writes the hooks into /etc/codex/config.toml, which runs without approval. failproofai otel enable codex sends Codex conversation logs to Failproof Cloud, and failproofai audit scans local Codex history offline.

FAQ

Does the Compliance API cover Codex CLI sessions?

It exposes Codex records under conversation_message and codex_log, but OpenAI does not map coverage per surface and says it is not a complete record of local commands. Verify against the Admin API reference for your workspace.

Are prompts in Codex telemetry by default?

No. log_user_prompt defaults to false; codex.user_prompt records length only.

How long are Codex compliance records available?

30 days in the Compliance Logs Platform; exported copies follow your own retention policy.

Sources

Checked against the sources below on October 21, 2026. Harness settings, hook capabilities and cloud features change between versions.