api-20260819T003711Z / documentation capture

manage-claude/admin-api Changed · +7 / -7 lines

from line 88

8888

8989There are five organization-level roles. See more details in the [API Console roles and permissions](https://support.claude.com/en/articles/10186004-api-console-roles-and-permissions) article.

9090

91| Role | Permissions |

92| ------------------ | ----------------------------------------------------------------------------- |

93| user | Can use Workbench |

94| claude\_code\_user | Can use Workbench and [Claude Code](https://code.claude.com/docs/en/overview) |

95| developer | Can use Workbench and manage API keys |

96| billing | Can use Workbench and manage billing details |

97| admin | Can do all of the preceding, plus manage users |

91| Role | Permissions |

92| ------------------ | ------------------------------------------------------------------------------ |

93| user | Can use Playground |

94| claude\_code\_user | Can use Playground and [Claude Code](https://code.claude.com/docs/en/overview) |

95| developer | Can use Playground and manage API keys |

96| billing | Can use Playground and manage billing details |

97| admin | Can do all of the preceding, plus manage users |

9898

9999Organization owners and primary owners have all admin permissions and can additionally manage admins. All references to the admin role on this page also apply to owners and primary owners.

100100

manage-claude/cmek Changed · +5 / -3 lines

from line 23

2323

2424## How it works

2525

26Only Organization Admins (on Claude Platform) or Owners and the Primary Owner (on Claude Enterprise) can configure CMEK. On Claude Platform, CMEK is scoped per workspace and configured with the Admin API. On Claude Enterprise, CMEK is scoped per organization and configured in [claude.ai > Organization settings > Data and privacy](https://claude.ai/admin-settings/data-privacy-controls). On either product, CMEK protects data written after the key is enabled. Existing data (prior chats, files, and sessions) remains encrypted with Anthropic-managed keys and is not re-encrypted under your key.

26Only Organization Admins (on Claude Platform) or Owners and the Primary Owner (on Claude Enterprise) can configure CMEK. On Claude Platform, CMEK is scoped per workspace and configured with the Admin API. On Claude Enterprise, CMEK is scoped per organization and configured in [claude.ai > Organization settings > Data and privacy](https://claude.ai/admin-settings/data-privacy-controls). On either product, CMEK protects data written after your key takes effect. Existing data (prior chats, files, and sessions) remains encrypted with Anthropic-managed keys and is not re-encrypted under your key.

2727

28On Claude Platform, Anthropic recommends attaching your key to a new workspace before you send any requests to that workspace. If you attach a key to a workspace that already receives requests, your key can take up to a day to take effect. Data written before then, like existing data, is encrypted with Anthropic-managed keys and is not re-encrypted.

29

2830CMEK configuration events appear in the [Compliance API Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed). The key operations Anthropic performs against your key (such as wrapping and unwrapping data keys) do not appear in the Compliance API; they appear in your cloud provider's audit logs.

2931

3032Anthropic calls your key management service from its standard public IP range. If you restrict access to your key management service by IP, allow the addresses listed in [IP addresses](https://platform.claude.com/docs/en/api/ip-addresses).

from line 79

7779

7880**Claude Platform**

7981

80* Workbench in the Claude Console is disabled.

82* Playground in the Claude Console is disabled.

8183* Portions of the Compliance API that return raw content, such as prompts, responses, and files, are disabled.

8284* Other beta and research preview features may not be covered by CMEK.

8385

from line 142

140142## Limitations

141143

142144* **Irreversible action:** Once a key is attached to a workspace, it cannot be detached or swapped. On Claude Platform, attaching a key also locks the workspace's data retention setting: you cannot turn off 30-day data retention for that workspace, and returning to zero data retention requires creating a new workspace and moving your traffic to it. Rotating the key material within the same key (for example, AWS KMS automatic rotation, a Cloud KMS rotation schedule, or an Azure Key Vault rotation policy) is supported transparently and requires no change in Anthropic. Switching to a *different* key requires creating a new workspace with the new key and migrating your data. Revoking or disabling the key makes all CMEK-protected data in that workspace permanently inaccessible, with no backout path.

143* **No retroactive encryption:** CMEK only protects data written after the key is enabled.

145* **No retroactive encryption:** CMEK only protects data written after your key takes effect (see [How it works](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works)).

144146* **Latency:** Operations that wrap or unwrap data keys make a round-trip to your key management service, which can add a small amount of latency to actions that read or write data at rest.

145147* **Revocation delay:** Key revocation can take up to 1 hour (the cache TTL). Requests already in flight during that window may continue to succeed.

146148* **KMS costs:** CMEK requires a key in a third-party key management service (AWS KMS, Google Cloud KMS, or Azure Key Vault), which may incur separate charges billed by your KMS provider.

manage-claude/usage-cost-api Changed · +3 / -3 lines

### What happens with Playground usage? ### What happens with Anthropic Workbench usage?

from line 310

310310

311311Filter or group by `service_tier` in the usage endpoint and look for the `priority` value. Priority Tier costs are not available in the cost endpoint.

312312

313### What happens with Anthropic Workbench usage?

313### What happens with Playground usage?

314314

315API usage from the Workbench is not associated with an API key, so `api_key_id` will be `null` even when grouping by that dimension.

315API usage from Playground in the Claude Console (and from the legacy Workbench before it) is not associated with an API key, so `api_key_id` will be `null` even when grouping by that dimension.

316316

317317### How is the default workspace represented?

318318

release-notes/overview Changed · +4 / -0 lines

### August 18, 2026

from line 10

1010 For updates to Claude Code, see the [complete CHANGELOG.md](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md) in the `claude-code` repository.

1111</Tip>

1212

13### August 18, 2026

14

15* Workbench is now [**Playground**](https://platform.claude.com/playground) in the Claude Console. Playground supports every Messages API parameter and includes templates that demonstrate API features such as code execution and web search. It shows the full SDK request and the API response for each run, to help you understand the API and build with it. For more, see the [Claude Help Center](https://support.claude.com/en/articles/8606378-how-do-i-use-playground) or try it at [platform.claude.com/playground](https://platform.claude.com/playground).

16

1317### August 11, 2026

1418

1519* The [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api) now returns transcripts of Cowork and Claude Code sessions that run on your users' machines, in beta for Claude Enterprise organizations. `GET /v1/compliance/apps/sessions/local` lists sessions across your organization, `GET /v1/compliance/apps/sessions/local/{session_id}` retrieves one session's metadata, and `GET /v1/compliance/apps/sessions/local/{session_id}/messages` returns its transcript, all with your existing Compliance Access Key and the `read:compliance_user_data` scope. See [Sessions on users' machines](https://platform.claude.com/docs/en/manage-claude/compliance-sessions#retrieve-local-sessions).

api/overview Changed · +1 / -1 lines

from line 57

5757

5858### Getting API keys

5959

60The API is made available through the web [Console](https://platform.claude.com/). You can use the [Workbench](https://platform.claude.com/playground) to try out the API in the browser and then generate API keys in [Account Settings](https://platform.claude.com/settings/keys). You choose each key's [expiration](https://platform.claude.com/docs/en/manage-claude/authentication#key-expiration) when you create it. Use [workspaces](https://platform.claude.com/settings/workspaces) to segment your API keys and [control spend](https://platform.claude.com/docs/en/api/rate-limits) by use case.

60The API is made available through the web [Console](https://platform.claude.com/). You can use [Playground](https://platform.claude.com/playground) to try out the API in the browser and then generate API keys in [Account Settings](https://platform.claude.com/settings/keys). You choose each key's [expiration](https://platform.claude.com/docs/en/manage-claude/authentication#key-expiration) when you create it. Use [workspaces](https://platform.claude.com/settings/workspaces) to segment your API keys and [control spend](https://platform.claude.com/docs/en/api/rate-limits) by use case.

6161

6262## Client SDKs

6363

build-with-claude/vision Changed · +1 / -1 lines

from line 13

1313Use Claude's vision capabilities through:

1414

1515* [claude.ai](https://claude.ai/). Upload an image like you would a file, or drag and drop an image directly into the chat window.

16* The [Workbench](https://platform.claude.com/playground) in the Claude Console. Add images directly to any User message block.

16* [Playground](https://platform.claude.com/playground) in the Claude Console. Add images directly to any User message block.

1717* API request. See the following examples.

1818

1919On the API, provide images to Claude as `image` content blocks using one of three source types:

home Changed · +1 / -1 lines

from line 95

9595 </HomeJourneyLink>

9696

9797 <HomeJourneyLink icon="message" href="https://platform.claude.com/playground">

98 Try the Workbench

98 Try the API in Playground

9999 </HomeJourneyLink>

100100 </HomeJourneyStep>

101101

intro Changed · +1 / -1 lines

from line 75

7575

7676<CardGroup cols={3}>

7777 <Card title="Developer Console" icon="computer" href="https://platform.claude.com/">

78 Prototype and test prompts in your browser with the Workbench.

78 Explore and understand the API in your browser with Playground.

7979 </Card>

8080

8181 <Card title="API Reference" icon="code" href="https://platform.claude.com/docs/en/api/overview">

manage-claude/access-transparency Changed · +1 / -1 lines

from line 167

167167| Claude for Enterprise (claude.ai seats) | No | Not covered |

168168| Claude for Work | No | Not covered |

169169| Claude Free, Pro, Max | No | Consumer plans are not eligible |

170| Anthropic Workbench | No | The Workbench stores data in data stores that are not covered by Access Transparency |

170| Playground (Claude Console) | No | Not covered |

171171| Microsoft Foundry | No | Not available |

172172| Amazon Bedrock, Google Cloud | No | Partner-operated platforms; refer to those platforms' transparency controls |

173173

manage-claude/api-and-data-retention Changed · +2 / -2 lines

from line 30

3030

3131### What ZDR does not cover

3232

33* **Console and Workbench:** Any usage on Claude Console or the Workbench prompt-testing interface.

33* **Claude Console:** Any usage in the Claude Console, including Playground.

3434* **Claude Managed Agents:** Claude Managed Agents is a stateful resource; session transcripts persist until you delete them.

3535* **Claude consumer products:** Claude Free, Pro, and Max plans, including when customers on those plans use Claude's web, desktop, or mobile apps or Claude Code.

3636* **Claude Teams and Claude Enterprise product interfaces:** These interfaces are not ZDR-eligible. The exception is Claude Code used through Claude Enterprise with ZDR enabled; see [What ZDR covers](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#what-zdr-covers).

from line 59

5959### What HIPAA readiness does not cover

6060

6161* **Claude consumer products:** Claude Free, Pro, and Max plans.

62* **Console and Workbench:** Usage through the Claude Console interface (enabling HIPAA readiness from Console settings is supported; processing PHI through the Console is not covered).

62* **Claude Console:** Usage through the Claude Console interface (enabling HIPAA readiness from Console settings is supported; processing PHI through the Console is not covered).

6363* **Partner-operated platforms:** Amazon Bedrock and Google Cloud's Agent Platform. Refer to those platforms' compliance documentation.

6464* **Claude Platform on AWS and Microsoft Foundry:** HIPAA readiness is not available on these platforms.

6565* **Third-party integrations:** Data processed by external tools or services connected to your application.

manage-claude/cmek-aws-kms Changed · +2 / -0 lines

from line 190

190190 </Step>

191191

192192 <Step title="Attach the key to a workspace">

193 Once the key is validated, attach it to a new workspace before you send any requests to that workspace. For a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).

194

193195 ```bash

194196 curl -sS -X POST https://api.anthropic.com/v1/organizations/workspaces/<workspace-id> \

195197 -H "x-api-key: <anthropic-admin-api-key>" \

manage-claude/cmek-azure-key-vault Changed · +1 / -1 lines

from line 199

199199 </Step>

200200

201201 <Step title="Attach the key to a workspace">

202 Once the key is validated, attach it to a workspace to enable CMEK for that workspace's data.

202 Once the key is validated, attach it to a new workspace before you send any requests to that workspace. For a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).

203203

204204 ```bash

205205 curl -sS -X POST https://api.anthropic.com/v1/organizations/workspaces/<workspace-id> \

manage-claude/cmek-google-cloud-kms Changed · +2 / -0 lines

from line 191

191191 </Step>

192192

193193 <Step title="Attach the key to a workspace">

194 Once the key is validated, attach it to a new workspace before you send any requests to that workspace. For a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).

195

194196 ```bash

195197 curl -sS -X POST https://api.anthropic.com/v1/organizations/workspaces/<workspace-id> \

196198 -H "x-api-key: <anthropic-admin-api-key>" \

manage-claude/workspaces Changed · +1 / -1 lines

from line 38

3838

3939| Role | Permissions |

4040| --------------------------- | ----------------------------------------------------------------------------------------------- |

41| Workspace User | Use the Anthropic Workbench only |

41| Workspace User | Use Playground only |

4242| Workspace Limited Developer | Create and manage API keys, use the API. Cannot access session tracing views or download files. |

4343| Workspace Developer | Create and manage API keys, use the API |

4444| Workspace Admin | Full control over workspace settings and members |

One read of Claude Developer Platformapi-20260819T003711Z

What this read moved