Integration · AI provider
OpenAI + OrchestrAI
Catalog exported 2026-09-02 · OpenAI website
Call OpenAI from your ops chat: completions, embeddings, model listing, and fine-tuning jobs with approval.
OrchestrAI exposes 5 OpenAI operations: 4 are low-risk (read-only or low-impact), and 1 create or modify resources and run only after you confirm the plan. 1 of them also carries a step-level approval gate.
What teams use it for
Data and platform teams use the OpenAI connection to test a prompt against a specific model, generate embeddings for a batch of documents during a pipeline check, and compare how OpenAI output differs from a Bedrock model on the same input before committing to one. Fine-tuning is the one operation that creates a billable job, so it is marked medium risk and asks for confirmation with the base model and training file spelled out. The connection cannot report the status of a fine-tune once it is submitted, cancel it, or upload training files, so track jobs in the OpenAI dashboard.
Every OpenAI operation, with its risk level
| Operation | What it does | Risk | Step-level approval |
|---|---|---|---|
Compare LLM Models |
Compare outputs across models | Low risk | No |
List OpenAI Models |
List available OpenAI models | Low risk | No |
OpenAI Chat Completion |
Create chat completion (GPT-4, etc.) | Low risk | No |
OpenAI Embeddings |
Generate embeddings | Low risk | No |
Create OpenAI Fine-Tune |
Create fine-tuning job | Creates resources | Yes |
Risk tiers come from the catalog: low is read-only or low-impact, medium creates resources and is reversible, high modifies existing resources, destructive may lose data. Every plan that creates or changes resources is shown with its cost estimate and waits for your confirmation. Operations marked with a step-level approval pause again on their own step. Destructive operations require a typed risk phrase.
What you connect
A OpenAI credential (stored as openai).
Operations that touch your cloud account use your connected AWS role through a short-lived token minted per run.
Connected-service tokens are envelope-encrypted with a per-record key wrapped by a cloud KMS.
Prompts that work
- Send this support ticket to gpt-4o and ask it to classify the severity as low, medium, or high
- Generate embeddings for the 200 FAQ entries in this file using text-embedding-3-small
- Compare how gpt-4o and Claude on Bedrock summarize this incident postmortem
Before anything runs
Every mutation shows its plan, cost estimate, and blast radius, then waits for your confirmation. Destructive operations require a typed risk phrase. Credentials are minted per run through OIDC federation and discarded afterward; nothing you create here is invisible later, because every resource lands in the desired-state ledger where drift is detected and can be converged. Details on the security page.
Frequently asked questions
- Does OrchestrAI store my OpenAI API key?
- The key is a connected-service token, which OrchestrAI envelope-encrypts with a per-record key wrapped by a cloud KMS. It is used only to make the completion, embedding, listing, and fine-tune requests you ask for.
- Can OrchestrAI start an OpenAI fine-tuning job?
- Yes, openai_create_fine_tune submits a job and is marked confirm, so the agent shows the model and training data reference and waits for your go-ahead. There is no operation to monitor or cancel that job afterwards.
- How does OrchestrAI authenticate to OpenAI?
- You add a OpenAI credential once in the connections screen. It is envelope-encrypted with a per-record key wrapped by a cloud KMS and is only decrypted inside the run that needs it. Some OpenAI operations also act on your AWS account, which uses a short-lived OIDC-federated token instead of stored keys.
Related integrations
Try it on your own account
Connect your cloud read-only and see your resources, drift, and costs before anything runs. $5 minimum to start. Unused credits refunded in your first 14 days.
Unused credits refunded in your first 14 days.