Compliance APIs as Discovery sources

Metadata only: who has a seat and who was active, which custom GPTs, agents, projects, plugins and connectors exist, who owns them and how they are shared. Intertrace never requests conversation logs, chats, messages or session transcripts. Every record is reduced to named fields before it is stored, so message text, prompts, file names and pinned workflow data never reach Discovery.

Each source has one editor on the Discovery page (needs integrations:manage, audited). Connecting makes one read with the credential before it is saved, the credential is sealed, and Test connection makes one read with the saved one. A key the vendor refuses reads "Couldn't read" on the source card, never "nothing found".

Docs: Compliance API, organizations, users and groups, Activity Feed, projects.

• The primary owner turns on the Compliance API in claude.ai → Organization settings → API.
• Create a Compliance Access Key with read:compliance_activities, read:compliance_org_data and read:compliance_user_data. Don't grant delete:compliance_user_data. An Admin API key reaches the Activity Feed only and is refused.
• Reads: organizations, their users, groups and members, projects (name, creator, whether every member can see it), and the last 30 days of the Activity Feed (who did something, and connector events: Google Drive, GitHub, GitHub Enterprise, GitLab, MCP servers; artifact publishing).
• Optional: allowed email domains and allowed groups. Active people outside them are flagged.
• The Activity Feed records that an MCP server was added, not its address: the finding tells you to review Organization settings → Connectors.

Docs: Compliance Logs Platform quickstart (list and download log files), OpenAI compliance platform for Enterprise customers (30-day retention).

• Ask OpenAI to enable the Compliance Logs Platform and create a Compliance API key with the compliance export read scope.
• OpenAI keeps these logs 30 days, so Intertrace pulls every hour (and on each scan), with a cursor per log type, and keeps a rolling summary. If Intertrace couldn't pull for longer than 30 days, the card says which days expired unread.
• Log types read: AUTH_LOG, APP_AUTH_LOG, APP_LOG, AUDIT_LOG, CUSTOM_AGENTS_LOG. CONVERSATION_MESSAGE is never requested.
• The fields inside each log line are in OpenAI's API reference, which needs a workspace admin sign-in. Intertrace reads them defensively from the shapes in published examples; a field that isn't there stays unknown.
• Not available: a GPT's configured actions. The logs say a GPT exists and how it is shared, not what its actions call.

Docs: Copilot usage user detail, audit log query API, CopilotInteraction schema (RecordType 261).

• An app registration with Reports.Read.All and AuditLogsQuery.Read.All (application permissions, admin consent). The app saved for Entra ID discovery can be reused once it has both.
• The audit API is asynchronous: Intertrace starts one audit search for CopilotInteraction over the time since the last one it read, and reads the records on a later pull. Starting a search changes nothing in the tenant. The first counts arrive with the scan after the search finishes.
• Kept: the apps each person used Copilot in, the plugins and agents Copilot called (built-in ones are marked), and how many files it read and how many carried a sensitivity label. Dropped: file names, site URLs, thread and message ids, client IPs.
• Microsoft conceals names in usage reports by default; then people are counted, not named, until an admin turns that off.

Docs: n8n public API, workflows, credentials (secrets are never returned).

• Create an API key under Settings → n8n API. The instance must be reachable at a public https address.
• Reads every workflow (with excludePinnedData=true) and keeps those with AI nodes: their triggers and whether a webhook, chat, form or MCP trigger has no authentication, the tools their agent can use and whether they change data or run code, and the credentials they hold.
• Only enumeration settings are read from nodes (authentication mode, public flag, operation, HTTP method). Prompts and messages are never kept.

• Power Platform inventory: Microsoft's inventory API supports only delegated user sign-in and returns 403 to app-only service principals (inventory API), so it can't run as a scheduled read. Copilot Studio agents in every environment are already listed by the Copilot Studio source.
• Gemini Enterprise: the documented agents list is v1alpha and returns only agents the calling identity created (assistants.agents.list); there is no documented admin read of everyone's agents, usage or connectors to build on.