OpenAI

Connection

Setting	Required	Description
Admin API key	Yes	Admin key created by an organization owner under Organization settings, Admin keys. Stored encrypted.

Minimum permissions the connection requires.

Capability	Required	Granted by (any one)
Manage members	Yes	`Admin key`, `Organization owner`
Read projects	Yes	`Admin key`, `Organization owner`

Field	Type	Required	Description
`email`	string	Yes	Email address the invite goes to and the member signs in with. Klef does not change it.
`role`	enum		Organization role. Defaults to reader. Values: `reader` (Reader), `owner` (Owner).
`projects`	grant		Projects the member belongs to. Applied once the member has accepted their invite. One row grants one project.
`projects[]`	string		Project ID.
`active`	bool		Whether the person belongs to the organization. Switching it off removes a member, or withdraws an invite not yet accepted.

When Klef adopts an account that already exists in OpenAI, it works out whose it is by trying these in order. A connection can override them.

Account field	Worker field
`email`	`worker.business_email`

An OpenAI organization invite for every engineer, removed when they go, or withdrawn if never accepted.

stage active {
  target openai.user {
    email  = worker.business_email
    role   = "reader"
    active = true
  }
}