OpenAI

ChatGPT Enterprise and API Platform for FedRAMP

Learn about supported features and functionality for ChatGPT and the API with FedRAMP compliance.

Updated: 2 days ago

Overview

ChatGPT and the API for FedRAMP are versions of ChatGPT Enterprise and the API platform that have achieved Federal Risk and Authorization Management Program (FedRAMP) Moderate accreditation through the FedRAMP 20x program.

Feature availability

ChatGPT and API for FedRAMP do not initially include all features available in the commercial platforms. Over time, our goal is to bring feature parity as close as possible to the commercial ChatGPT Enterprise and API platforms while maintaining FedRAMP compliance.

The sections below list the features currently available.

ChatGPT Web

ChatGPT for FedRAMP currently supports only Chat mode.

Core features

Coming soon

  • Work mode

API

Note: FedRAMP compliance requires that all API requests use the designated gov.api.openai.com endpoint for all supported methods and models.

Methods

The following API methods are currently available:

/v1/chat/completions
/v1/conversations
/v1/files
/v1/moderations
/v1/responses
/v1/uploads

For more information about using these methods, see: API reference documentation.

Models

The FedRAMP API generally supports the latest model families available through the commercial API, including applicable mini and nano variants. Availability of specific models and snapshots may vary during rollout.

Legacy models are not available.

ChatGPT Desktop (formerly Codex)

Use the desktop app or Codex CLI with either a FedRAMP ChatGPT workspace or an API key from a FedRAMP-enabled API organization.

Before you begin

Use desktop app version 26.1002.51308 or later, or Codex CLI version 0.162.0 or later.

Sign in with ChatGPT

Follow the FedRAMP workspace configuration guide to set up ChatGPT workspace sign-in.

Workspace administrators manage workspace policies and enable Codex Local access for users.

Sign in with an API key

Follow the FedRAMP API configuration guide to set up API-key sign-in.

Use an API key from your FedRAMP-enabled API organization. Before launching the desktop app or CLI, or signing in, deploy the managed requirements.toml file described in the guide.

Features and models

Available features depend on your sign-in method, permissions, and configuration. Administrators can enable supported features after reviewing the associated risks and configuring the corresponding network controls.

You can use only models available in your FedRAMP environment.

Privacy and security

ChatGPT and API FedRAMP are designed for strict FedRAMP compliance and are operated with additional access restrictions and feature controls compared to standard ChatGPT Enterprise environments. Key Enterprise privacy measures are still in place:

  • No model training on customer data

  • Identical retention policies to ChatGPT Enterprise, including availability of the Compliance API

FAQ

Does access to a FedRAMP ChatGPT workspace also give me API access?

No. ChatGPT workspace membership and API Platform organization membership are managed separately. If your FedRAMP API organization does not appear in the API Platform, ask your API organization administrator to confirm your access.

For help enabling an API organization for FedRAMP, contact your account team. See OpenAI identity and product access.

Can I convert my existing ChatGPT Enterprise workspace to FedRAMP?

No. Existing ChatGPT Enterprise workspaces cannot be converted to FedRAMP.

However, OpenAI can support a one-time migration of users to a newly provisioned FedRAMP workspace, including ChatGPT conversations and tenant-level SSO settings. Workspace settings will need to be configured again in the new environment. For assistance, contact your account team.

Why am I receiving a fedramp_org_requires_gov_api error?

This error indicates that a request for a FedRAMP API organization was sent to the commercial API endpoint. Configure your API client or integration to use https://gov.api.openai.com/v1 and a supported method and model.

For API-key access in the desktop app or Codex CLI, follow the FedRAMP API configuration guide, including deploying the managed requirements.toml before launch or authentication.

Does FedRAMP require all conversations to be deleted after 30 days?

No. A 30-day conversation retention period is not a universal requirement for ChatGPT Enterprise FedRAMP. Conversations follow your workspace’s retention policy. Archiving a conversation does not change its retention period.

Ask your workspace owner to confirm the policy that applies to your organization. See Chat and file retention in ChatGPT.

Do commercial ChatGPT and API release announcements apply to FedRAMP?

Not necessarily. Features and models may become available in FedRAMP at different times. Check the Feature availability section above for supported capabilities.

For the desktop app and Codex CLI, availability also depends on your sign-in method, permissions, and configuration. See the FedRAMP workspace configuration guide or FedRAMP API configuration guide.

Why do users appear in our SCIM directory but not have access to our ChatGPT workspace?

Directory synchronization and workspace access are separate. Check the synchronized group’s product assignment, the user’s workspace invitation or membership, and the required sign-in method.

If workspace-level SCIM is enabled, coordinate any move to tenant-wide provisioning with your account team before changing the existing connection. See SCIM provisioning and management.

Can I convert my existing API organization to FedRAMP?

Yes. Existing API organizations can be converted to FedRAMP.

Once converted, customers must use the designated gov.api.openai.com endpoint.

Can I use live web search?

The supported search experience listed for ChatGPT Web in FedRAMP is offline web search. It uses OpenAI’s indexed and cached web content instead of live web search at the time of your request. Results may be older than the live page, and some URLs may be unavailable. When current information is essential, review the source separately and upload or paste the relevant material in accordance with your organization’s policies.

Was this article helpful?