Agent report card
Can an agent use OpenAI API through API service lifecycle?
Grade C+: Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.
OpenAI / active
Five-stage assessment
Where agent autonomy holds and where it breaks
- EvaluateReady
- Sign upLimited
- PayLimited
- ProvisionLimited
- OperateLimited
The exact service and stable evaluation or access entrypoints are publicly discoverable.
Applicable terms are stable, readable, retrievable, and materially complete.
Eligibility conditions and required inputs are explicit and decidable.
Price or no-charge status, variables, currency, and material conditions are explicit.
Evidence and actions6 signals
Can an agent decide every material eligibility condition before commitment?
supported: freshEligibility conditions and required inputs are explicit and decidable.
OpenAI explicitly defines material eligibility conditions: the customer must represent that it is lawfully able to enter into the agreement and has authority to bind the entity. Customer and End Users must not be located in U.S. embargoed countries or identified on any Restricted Party List.
Can an agent estimate cost or confirm no-charge status before commitment?
supported: freshPrice or no-charge status, variables, currency, and material conditions are explicit.
Prepaid billing documentation explains how API users pre-purchase usage deducted from prepaid credits, configure auto recharge, set recharge amounts and limits, and notes credit expiration (1 year) and non-refundability.
Can an agent find the exact service and its stable entrypoints?
supported: freshThe exact service and stable evaluation or access entrypoints are publicly discoverable.
The service entrypoints and direct HTTP/REST API endpoints, authentication mechanisms, and request options are publicly documented in the API Reference Overview.
Are verified structured discovery artifacts available?
missing: unknownCurrent admissible evidence does not resolve this finding.
Can an agent retrieve and understand the applicable commitment terms?
supported: freshApplicable terms are stable, readable, retrievable, and materially complete.
The OpenAI Services Agreement is publicly accessible, readable, and defines terms governing APIs, ChatGPT Enterprise, data use, security, and customer obligations.
Does the vendor deliberately describe access for web agents?
missing: unknownCurrent admissible evidence does not resolve this finding.
Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.
A stable canonical route begins the required access bootstrap.
Evidence and actions5 signals
Can an agent operate the access controls and safe handoffs deterministically?
supported: freshCurrent admissible evidence does not resolve this finding.
The retained capture from platform.openai.com/signup contains only basic page title metadata and an unrendered application header ('OpenAI Platform'), which does not show or describe operable access controls or safe handoffs.
Is there a stable route to begin obtaining service access?
supported: freshA stable canonical route begins the required access bootstrap.
The canonical URL https://platform.openai.com/signup serves as the stable direct observation entry point for OpenAI Platform signup.
Can an agent obtain access without an unsupported CAPTCHA boundary?
supported: freshCurrent admissible evidence does not resolve this finding.
The captured evidence for platform.openai.com/signup contains minimal unrendered page content ('OpenAI Platform') and does not explicitly declare or observe the presence or absence of a CAPTCHA boundary.
Can an agent obtain scoped, revocable authority for this service?
supported: freshMachine credentials exist but require manual copying, broad authority, or weak lifecycle support.
First-party documentation explicitly declares machine credentials (API keys and service accounts) created and managed on the API key page, but full secret keys must be manually copied upon creation.
Can required phone verification be completed through a supported boundary?
supported: freshCurrent admissible evidence does not resolve this finding.
The captured evidence for platform.openai.com/signup contains minimal unrendered page content and does not explicitly state whether phone verification is required, absent, or resumable.
What would improve this stage
- Provide scoped delegated authorization with consent, revocation, and deterministic resumption.
The public commitment omits a material component until later in the flow.
A documented direct purchase path reaches paid access without a vendor decision point.
Evidence and actions4 signals
Can an agent construct checkout, hand off approval safely, and resume?
supported: freshCurrent admissible evidence does not resolve this finding.
The evidence outlines setting up prepaid billing and configuring auto recharge in account settings, but does not document a programmatic flow for an agent to construct checkout, hand off approval safely, and resume.
Is the exact commercial commitment disclosed before authorization?
supported: freshThe public commitment omits a material component until later in the flow.
OpenAI documents purchased-credit expiry, non-refundability, configurable recharge controls, and balance behavior, but the retained evidence does not disclose exact rates, currency, or the charge amount before authorization.
Can payment be authorized within scoped agent or explicit human authority?
supported: freshCurrent admissible evidence does not resolve this finding.
The evidence mentions configuring auto recharge, thresholds, and manual credit purchases, but it does not document a rail for scoped agent delegation or explicit human-confirmed authorization with receipts.
Is a direct self-service path to paid access documented?
supported: freshA documented direct purchase path reaches paid access without a vendor decision point.
OpenAI documentation details a direct self-service path to purchase prepaid API credits by going to billing overview in account settings or using the Add to balance button in the billing portal without vendor approval.
What would improve this stage
- Disclose the complete commitment before payment authorization.
Delivery needs additional human transfer or has weak scope or lifecycle semantics.
Provisioning is machine-triggerable or follows deterministically from an allowed handoff.
A synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.
Evidence and actions3 signals
Can usable access material be delivered securely to an authorized agent?
supported: freshDelivery needs additional human transfer or has weak scope or lifecycle semantics.
OpenAI API keys are created in the API key page or dashboard, where the full secret key is shown only upon creation and must be saved or exported manually.
Can an agent determine successful provisioning completion and reconcile asynchronous failure?
supported: freshA synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.
A synchronous API call to the Responses API returns a response object with a completed status and output content upon successful execution.
Can provisioning be initiated within supported agent authority?
supported: freshProvisioning is machine-triggerable or follows deterministically from an allowed handoff.
Provisioning of responses can be initiated programmatically via API calls such as client.responses.create or requests sent to post /v1/responses.
What would improve this stage
- Deliver scoped access material through a secure documented machine-usable flow.
Safe failure handling is documented only partially.
Only part of the credential lifecycle is agent-operable.
Every essential target has a stable documented agent-usable interface alternative.
Request-time authentication is documented and usable under scoped agent authority.
Essential operations have stable readable request, response, and effect semantics.
Evidence and actions6 signals
Is an agent-native protocol interface verified against the essential targets?
missing: unknownCurrent admissible evidence does not resolve this finding.
Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?
supported: freshOnly part of the credential lifecycle is agent-operable.
Documentation states users can create and manage API keys on the API key page, and if a full secret key is lost, create a new key and update the application, representing a partially manual key lifecycle without documenting programmatic rotation or compromise recovery.
Can an agent handle applicable failure modes safely?
supported: freshSafe failure handling is documented only partially.
Documentation covers API error codes (such as 401, 429, 500, and 503), rate limits, and recommends exponential backoff retry strategies respecting Retry-After headers. Full idempotency, cancellation, and reconciliation contracts for all failure modes are not completely detailed.
Can an agent authenticate service operations with scoped authority?
supported: freshRequest-time authentication is documented and usable under scoped agent authority.
Request-time authentication with scoped authority is documented, accepting HTTP Bearer tokens via API keys or short-lived access tokens via workload identity federation in the Authorization header.
Are essential operation inputs, outputs, and effects stable and decidable?
supported: freshEssential operations have stable readable request, response, and effect semantics.
Across all evaluated surfaces, essential operational inputs, outputs, schemas, parameters, rate limits, and effect semantics for the API are documented and stable.
- api-service
Can an agent perform every essential assessment target through a usable interface?
supported: freshEvery essential target has a stable documented agent-usable interface alternative.
Every essential target has documented machine-operable interfaces available through direct HTTP endpoints and official SDKs across supported environments.
- api-service
What would improve this stage
- Document applicable structured errors, retry, cancellation, and reconciliation semantics.
- Provide scoped expiry, rotation, revocation, compromise, and recovery operations.
What works
- Evaluate: The exact service and stable evaluation or access entrypoints are publicly discoverable.
What blocks agents
- Sign up: Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.
- Pay: The public commitment omits a material component until later in the flow.
- Provision: Delivery needs additional human transfer or has weak scope or lifecycle semantics.
- Operate: Safe failure handling is documented only partially.
Startup offers
OpenAI on the startup-offers board
- Free API credits, rate limit upgrades, and technical supportOpenAI Startup Credits and VC Partner Support
Improve the report
Correct it, rerun it, or improve the funnel.
- Profile
- arp_01kzf0m4xe2b7nt9w4r6dh1q8c
- Projection
- sha256:e4799b49cd56c286f3d88319b63046d1d5004e9dabc58b206774bd9bde4c1846
- Policy
- service-use-2026-08-20-public-evidence-r9 · sha256:57bf95fd6d0fe6fe9173a68b60e8d8dc2179b357c88ff4349675a72d0e1d4139
Every request carries these exact identifiers.How report cards are assessed →View the exact declaration