Configure OpenAI Codex Integration

1. Retrieve your Prisma AIRS credentials:

   1. Log into Strata Cloud Manager (SCM).
   2. Click AI Security > AI Runtime > API Applications:
   3. Click Manage in the upper right portion of the AI Applications page:
   4. Select API Keys.
   5. In the Manage API Keys screen, click Add New Application/API Key.
   6. Follow the onboarding work flow to generate a new API Key and endpoint URL. Copy both values; you'll use this information to configure the OpenAI Codex.
2. Configure the OpenAI Codex:

   1. Sign in to the OpenAI Codex Enterprise admin dashboard.
   2. Locate the security or API integration settings.
   3. Paste the Prisma AIRS API key and endpoint URL into the designated fields.
   4. Save the configuration.
3. Activate org-wide scanning in the OpenAI Codex Enterprise admin dashboard.

   Once saved, all users in Codes across your OpenAI organization are automatically routed through the Prisma AIRS Runtime API for real-time inspection. No additional action is required.

   What Gets Inspected

   Prisma AIRS scans every developer prompt before it reaches the model, covering two threat vectors:

   Data Loss Prevention

   Data Loss Prevention (DLP)	Examples
   Secrets and credentials	API keys, passwords, tokens, private keys
   PII and financial data	Personal identifiers, regulated data patterns
   Proprietary code and IP	Internal architecture, trade secrets, custom pattern rules

   Threat and Malicious Code Detection

   Threat Type	Description
   Malicious code patterns	Obfuscated scripts, dangerous command executions, known exploit patterns
   Malicious URLs	Phishing domains or unverified links embedded in prompts
   Prompt manipulation attacks	Adversarial inputs designed to bypass controls or alter model behavior

   How it Works

   Prisma AIRS operates as an inline security layer between the developer and the destination model:

   • The developer submits a prompt in OpenAI Codex.
   • The prompt is routed to the Prisma AIRS Runtime API for inspection.
   • If clean — the prompt is forwarded to the model as normal.
   • If a threat is detected — a block verdict is returned and the prompt is stopped before reaching the model or any MCP server.

   Developers see no difference in their normal workflow. Security teams receive centralized logs and policy enforcement across the entire engineering organization.

   Audit & Visibility

   Because inspection occurs at the administrative API layer, security teams gain:

   • Centralized policy enforcement — consistent rules applied across all users and sessions
   • Audit-ready logging — full visibility into blocked and allowed traffic
   • No per-developer configuration — governance is org-wide from a single control point