OpenAI
Kaca iki diterjemahake nganggo mesin. Deleng artikel asli basa Inggris.

EKM (Kunci Eksternal) ing Management API

Sinau carane ngatur kunci eksternal kanggo EKM nganggo API Manajemen.

Pembaruan: 7 hours ago

Ringkesan

Akses

  • Titik pungkasan EKM bisa diakses ing API Manajemen nganggo Kunci API Admin. https://platform.openai.com/settings/organization/admin-keys (aja nganggo kunci API biasa). Kunci API Admin kasedhiya kanggo pamilik organisasi.

  • Gunakake api.external_keys.write kanggo nggawe utawa mbusak kunci eksternal, lan api.external_keys.read kanggo ndeleng dhaptar utawa validasi kunci eksternal. Siji kunci mung mbutuhake loro cakupan idin kasebut yen kudu nindakake operasi maca lan nulis.

  • Saiki, kita kudu ngaktifake tandha fitur kanggo organisasi sampeyan supaya bisa ngakses titik pungkasan iki. Tandha fitur wis aktif yen sampeyan ndeleng external_key_id ing respons saka titik pungkasan Dhaptar Proyek sing wis ana: https://api.openai.com/v1/organization/projects.

Panggunaan

Watesan

  • Sampeyan kudu nyoba EKM dhisik ing proyek anyar liwat API Manajemen.

  • Kita nyaranake nggawe proyek anyar kanggo beban kerja EKM sampeyan. Nanging, yen pengin EKM ing proyek sing wis ana, kita bisa ngaktifake tandha fitur kanggo sampeyan. Gatekake praktik paling apik ing ngisor iki sadurunge ngetrapake EKM ing proyek produksi sampeyan sing wis ana.

    • Coba dhisik kabeh fitur API sing sampeyan gunakake ing produksi ing proyek API EKM kanggo uji coba.

    • Trapake EKM kanthi bertahap, aja langsung ing kabeh proyek API produksi bebarengan.

Endpoints level organisasi

Daftarake kunci eksternal ing organisasi sampeyan

AWS

Tuladha panjaluk:

  • type: string - mesthi “aws”

  • name: string - Jeneng sing gampang dingerteni kanggo konfigurasi sampeyan

  • role_arn: string - ARN peran sing bakal digunakake OpenAI ing cloud sampeyan

  • kms_arn: string - ARN Sistem Manajemen Kunci kanggo kunci utama sing sampeyan atur

  • external_id: string - ID Organisasi utawa ID proyek API sampeyan

curl -X POST \
-H "Content-type: application/json" \
-H "Authorization: Bearer $TOKEN" \
"https://api.openai.com/v1/organization/external_keys" \
-d '{
  "type": "aws",
  "name": "AWS EKM Config",
  "role_arn": "arn:aws:iam::<12_DIGIT_ACCOUNT_NUMBER>:role/<ROLE>",
  "kms_arn": "arn:aws:kms:<REGION>:<ACCOUNT_NUMBER>:key/<UUID>",
  "external_id": "<your org id or project id>"
}'

Tuladha respons:

{
  "id": "extkey_xxxx",
  "object": "organization.external_key",
  "created_at": 1746175499,
  "api_project_ids": [],
  "type": "aws",
  "name": "AWS EKM Config",
  "role_arn": "arn:aws:iam::<ACCOUNT_NUMBER>:role/<ROLE>",
  "kms_arn": "arn:aws:kms:<REGION>:<ACCOUNT_NUMBER>:key/<UUID>",
  "external_id": "<your org id or project id>"
}

GCP

Tuladha panjaluk:

  • type: string - mesthi “gcp”,

  • name: string - Jeneng sing gampang dingerteni kanggo konfigurasi sampeyan

  • workload_identity_project_number: string - Nomer proyek GCP awujud angka ing ngendi sampeyan ndhaptar identitas beban kerja OpenAI

  • workload_identity_pool_id: string - Pool sing ngemot panyedhiya Workload Identity sing sampeyan dhaptar kanggo OpenAI

  • workload_identity_provider_id: string - Panyedhiya Workload Identity sing sampeyan dhaptar kanggo OpenAI

  • audience: string - Audiens sing kudu dilebokake OpenAI ing token nalika nggunakake peran liwat GCP STS sampeyan

  • kms_project_id: string - Jeneng proyek GCP sing dadi panggonan KMS sampeyan

  • kms_key_ring_name: string - Dering kunci Sistem Manajemen Kunci sing ngemot kunci utama sing sampeyan atur

  • kms_key_name: string - Jeneng kunci utama Sistem Manajemen Kunci

  • kms_key_location: string - Wilayah panggonan kunci utama Sistem Manajemen Kunci sampeyan

Yen KMS sampeyan ana ing proyek GCP sing beda karo proyek panggonan sampeyan ndhaptar Workload Identity OpenAI, priksa manawa paling ora KMS wis diaktifake ing proyek sing ngemot Workload Identity OpenAI kanthi mbukak https://console.developers.google.com/apis/api/cloudkms.googleapis.com/overview.

curl -X POST \
-H "Content-type: application/json" \
-H "Authorization: Bearer $TOKEN" \
"https://api.openai.com/v1/organization/external_keys" \
-d '{
  "type": "gcp",
  "name": "GCP EKM Config",
  "workload_identity_project_number": "123456789012",
  "workload_identity_pool_id": "openai-azure",
  "workload_identity_provider_id": "openai-ekm-service-role",
  "audience": "<your org id or project id>",
  "kms_project_id": "adjective-noun-12345",
  "kms_key_name": "openai-kms-key",
  "kms_key_ring_name": "openai-kms-key-ring",
  "kms_key_location": "us-east1"
}'

Tuladha respons:

{
  "id": "extkey_xxxxxx",
  "object": "organization.external_key",
  "created_at": 1746174349,
  "api_project_ids": [],
  "type": "gcp",
  "name": "GCP EKM Config",
  "workload_identity_project_number": "123456789012",
  "kms_key_ring_name": "openai-kms-key-ring",
  "kms_key_name": "openai-kms-key",
  "kms_key_location": "us-east1",
  "audience": "<your org id or project id>",
  "kms_project_id": "adjective-noun-12345",
  "workload_identity_pool_id": "openai-azure",
  "workload_identity_provider_id": "openai-ekm-service-role"
}

Azure

Tuladha panjaluk:

  • type: string - mesthi “azure”,

  • name: string - Jeneng sing gampang dingerteni kanggo konfigurasi sampeyan

  • tenant_id: string - UUID tenant Azure sampeyan

  • vault_uri: string - URI vault Azure sing ngemot kunci utama sing sampeyan atur

  • key_name: string - Jeneng kunci utama Azure Key Vault sing sampeyan atur.

curl -X POST \
-H "Content-type: application/json" \
-H "Authorization: Bearer $TOKEN" \
"https://api.openai.com/v1/organization/external_keys" \
-d '{
  "type": "azure",
  "name": "Azure EKM Config",
  "tenant_id": "<UUID>",
  "vault_uri": "https://<VAULT_NAME>.vault.azure.net/",
  "key_name": "org-xxx--some-key"
}'

Tuladha respons:

{
  "id": "extkey_xxxx",
  "object": "organization.external_key",
  "created_at": 1746174377,
  "api_project_ids": [],
  "type": "azure",
  "name": "Azure EKM Config",
  "tenant_id": "<UUID>",
  "vault_uri": "https://<VAULT_NAME>.vault.azure.net/",
  "key_name": "org-xxx--some-key"
}

Busak kunci eksternal sing kadhaptar ing organisasi sampeyan

Cathetan: Sampeyan mung bisa mbusak kunci eksternal yen ora digandhengake karo proyek API aktif utawa papan kerja apa wae. Yen digandhengake karo proyek API aktif, arsipake proyek kasebut dhisik. Yen digandhengake karo papan kerja, kunci kasebut ora bisa dibusak.

Tuladha panjaluk

curl -X DELETE \
-H "Authorization: Bearer $TOKEN" \
"https://api.openai.com/v1/organization/external_keys/extkey_xxxx"

Tuladha respons

{
  "id": "extkey_xxxxx",
  "object": "organization.external_key.deleted",
  "created_at": 1746127808,
  "api_project_ids": [],
  "type": "aws",
  "account_number": "123456789012",
  "kms_arn": "arn:aws:kms:<REGION>:<ACCOUNT_NUMBER>:key/<UUID>",
  "name": "AWS EKM Config",
  "role_arn": "arn:aws:iam::<ACCOUNT_NUMBER>:role/<ROLE>"
}

Jupuk kunci eksternal sing kadhaptar ing organisasi sampeyan

Tuladha panjaluk

curl -X GET \
-H "Authorization: Bearer $TOKEN" \
"https://api.openai.com/v1/organization/external_keys"

Tuladha respons

{
  "object": "list",
  "data": [
    {
      "id": "extkey_xxxx",
      "object": "organization.external_key",
      "created_at": 1746127808,
      "api_project_ids": [],
      "type": "aws",
      "name": "AWS EKM Config",
      "account_number": "123456789012",
      "kms_arn": "arn:aws:kms:<REGION>:<ACCOUNT_NUMBER>:key/<UUID>",
      "role_arn": "arn:aws:iam::<ACCOUNT_NUMBER>:role/<ROLE>"
    }
  ],
  "first_id": "extkey_xxxx",
  "has_more": false,
  "last_id": "extkey_xxxx"
}

Validasi kunci eksternal

Sampeyan bisa nggunakake titik pungkasan iki kanggo mriksa sawetara bab:

  • Konfigurasi cloud eksternal sampeyan tetep valid kanggo OpenAI sawise sampeyan ngowahi konfigurasi kasebut (sampeyan bakal ndeleng respons kasil).

  • Pencabutan kunci sampeyan wis ditindakake kanthi bener, lagi diproses dening OpenAI, lan bakal ditrapake sawise TTL cache 1 jam entek (sampeyan bakal ndeleng respons kesalahan).

Tuladha panjaluk

curl -X POST -H "Authorization: Bearer $TOKEN" \
"https://api.openai.com/v1/organization/external_keys/extkey_xxx/validate"

Tuladha respons

{
  "status": "success"
}

Utawa, ana error sing ditampilake saka panyedhiya cloud.

Endpoints level proyek

Gawe proyek anyar nganggo ID kunci eksternal

Iki padha karo titik pungkasan Gawe Proyek sing wis ana, nanging ana tambahan parameter external_key_id ing panjaluk lan respons.

Tuladha panjaluk

curl -X POST \
-H "Content-type: application/json" \
-H "Authorization: Bearer $TOKEN" \
"https://api.openai.com/v1/organization/projects" \
-d '{
  "name": "Some Project",
  "external_key_id": "extkey_xxxx"
}'

Tuladha respons

{
  "object": "organization.project",
  "id": "proj_xxxxx",
  "name": "Some Project",
  "external_key_id": "extkey_xxxx",
  "created_at": 1740012721,
  "archived_at": null,
  "status": "active"
}

[Diwatesi] Nganyari proyek sing wis ana nganggo ID kunci eksternal

Iki padha karo titik pungkasan Nganyari Proyek sing wis ana, nanging ana tambahan parameter external_key_id ing panjaluk lan respons.

Kita nyaranake nggawe proyek API anyar kanggo beban kerja EKM sampeyan. Yen pengin EKM ing kabeh proyek API sampeyan sing wis ana, hubungi direktur akun sampeyan lan kita bakal ngaktifake tandha fitur kanggo sampeyan. Gatekake praktik paling apik ing ngisor iki sadurunge ngetrapake EKM ing proyek produksi sampeyan sing wis ana.

  • Coba dhisik kabeh fitur API sing sampeyan gunakake ing produksi ing proyek API EKM kanggo uji coba.

  • Trapake EKM kanthi bertahap, aja langsung ing kabeh proyek API produksi bebarengan.

Tuladha panjaluk

curl -X POST \
-H "Content-type: application/json" \
-H "Authorization: Bearer $TOKEN" \
"https://api.openai.com/v1/organization/projects/proj_xxx" \
-d '{
  "external_key_id": "extkey_xxxx"
}'

Deleng dhaptar kabeh proyek ing organisasi sampeyan

Iki padha karo titik pungkasan sing wis ana, nanging ana tambahan external_key_id ing respons API.

Tuladha panjaluk

curl -X GET \
-H "Authorization: Bearer $TOKEN" \
"https://api.openai.com/v1/organization/projects"

Tuladha respons

{
  "object": "list",
  "data": [
    {
      "object": "organization.project",
      "id": "proj_xxxx",
      "name": "Project Name",
      "external_key_id": "extkey_xxxx",
      "created_at": 1717798982,
      "archived_at": null,
      "status": "active"
    }
  ],
  "first_id": "proj_xxxx",
  "last_id": "proj_xxxx",
  "has_more": true
}

Apa artikel iki migunani kanggo sampeyan?