What this read moved
76–100 of 118This capture is too large to show at once. Changes 76-100 of 118 are below, significant first; the rest are on the following screens.
api/compliance/organizations/list Changed · +1 / -6 lines
from line 27
2727
2828## Headers
2929
30- `"anthropic-version": optional string`
31
32 The version of the Claude API you want to use.
33
34 Read more about versioning and our version history [here](https://platform.claude.com/docs/en/api/versioning).
35
3630- `"x-api-key": optional string`
3731
3832## Returns
from line 59
6559
6660```bash
6761curl https://api.anthropic.com/v1/compliance/organizations \
62 -H 'anthropic-version: 2023-06-01' \
6863 -H "Authorization: Bearer $ANTHROPIC_COMPLIANCE_API_KEY"
6964```
7065
api/compliance/organizations/roles Changed · +3 / -18 lines
from line 31
3131
3232### Headers
3333
34- `"anthropic-version": optional string`
35
36 The version of the Claude API you want to use.
37
38 Read more about versioning and our version history [here](https://platform.claude.com/docs/en/api/versioning).
39
4034- `"x-api-key": optional string`
4135
4236### Returns
from line 75
8175
8276```bash
8377curl https://api.anthropic.com/v1/compliance/organizations/$ORG_UUID/roles \
78 -H 'anthropic-version: 2023-06-01' \
8479 -H "Authorization: Bearer $ANTHROPIC_COMPLIANCE_API_KEY"
8580```
8681
from line 115
120115
121116### Headers
122117
123- `"anthropic-version": optional string`
124
125 The version of the Claude API you want to use.
126
127 Read more about versioning and our version history [here](https://platform.claude.com/docs/en/api/versioning).
128
129118- `"x-api-key": optional string`
130119
131120### Returns
from line 147
158147
159148```bash
160149curl https://api.anthropic.com/v1/compliance/organizations/$ORG_UUID/roles/$ROLE_ID \
150 -H 'anthropic-version: 2023-06-01' \
161151 -H "Authorization: Bearer $ANTHROPIC_COMPLIANCE_API_KEY"
162152```
163153
from line 257
267257
268258#### Headers
269259
270- `"anthropic-version": optional string`
271
272 The version of the Claude API you want to use.
273
274 Read more about versioning and our version history [here](https://platform.claude.com/docs/en/api/versioning).
275
276260- `"x-api-key": optional string`
277261
278262#### Returns
from line 289
305289
306290```bash
307291curl https://api.anthropic.com/v1/compliance/organizations/$ORG_UUID/roles/$ROLE_ID/permissions \
292 -H 'anthropic-version: 2023-06-01' \
308293 -H "Authorization: Bearer $ANTHROPIC_COMPLIANCE_API_KEY"
309294```
310295
api/compliance/organizations/roles/list Changed · +1 / -6 lines
from line 29
2929
3030## Headers
3131
32- `"anthropic-version": optional string`
33
34 The version of the Claude API you want to use.
35
36 Read more about versioning and our version history [here](https://platform.claude.com/docs/en/api/versioning).
37
3832- `"x-api-key": optional string`
3933
4034## Returns
from line 73
7973
8074```bash
8175curl https://api.anthropic.com/v1/compliance/organizations/$ORG_UUID/roles \
76 -H 'anthropic-version: 2023-06-01' \
8277 -H "Authorization: Bearer $ANTHROPIC_COMPLIANCE_API_KEY"
8378```
8479
api/compliance/organizations/roles/permissions Changed · +1 / -6 lines
from line 35
3535
3636### Headers
3737
38- `"anthropic-version": optional string`
39
40 The version of the Claude API you want to use.
41
42 Read more about versioning and our version history [here](https://platform.claude.com/docs/en/api/versioning).
43
4438- `"x-api-key": optional string`
4539
4640### Returns
from line 67
7367
7468```bash
7569curl https://api.anthropic.com/v1/compliance/organizations/$ORG_UUID/roles/$ROLE_ID/permissions \
70 -H 'anthropic-version: 2023-06-01' \
7671 -H "Authorization: Bearer $ANTHROPIC_COMPLIANCE_API_KEY"
7772```
7873
api/compliance/organizations/roles/permissions/list Changed · +1 / -6 lines
from line 33
3333
3434## Headers
3535
36- `"anthropic-version": optional string`
37
38 The version of the Claude API you want to use.
39
40 Read more about versioning and our version history [here](https://platform.claude.com/docs/en/api/versioning).
41
4236- `"x-api-key": optional string`
4337
4438## Returns
from line 65
7165
7266```bash
7367curl https://api.anthropic.com/v1/compliance/organizations/$ORG_UUID/roles/$ROLE_ID/permissions \
68 -H 'anthropic-version: 2023-06-01' \
7469 -H "Authorization: Bearer $ANTHROPIC_COMPLIANCE_API_KEY"
7570```
7671
api/compliance/organizations/roles/retrieve Changed · +1 / -6 lines
from line 21
2121
2222## Headers
2323
24- `"anthropic-version": optional string`
25
26 The version of the Claude API you want to use.
27
28 Read more about versioning and our version history [here](https://platform.claude.com/docs/en/api/versioning).
29
3024- `"x-api-key": optional string`
3125
3226## Returns
from line 53
5953
6054```bash
6155curl https://api.anthropic.com/v1/compliance/organizations/$ORG_UUID/roles/$ROLE_ID \
56 -H 'anthropic-version: 2023-06-01' \
6257 -H "Authorization: Bearer $ANTHROPIC_COMPLIANCE_API_KEY"
6358```
6459
api/compliance/organizations/settings Changed · +1 / -6 lines
from line 28
2828
2929### Headers
3030
31- `"anthropic-version": optional string`
32
33 The version of the Claude API you want to use.
34
35 Read more about versioning and our version history [here](https://platform.claude.com/docs/en/api/versioning).
36
3731- `"x-api-key": optional string`
3832
3933### Returns
from line 331
337331
338332```bash
339333curl https://api.anthropic.com/v1/compliance/organizations/$ORGANIZATION_ID/settings \
334 -H 'anthropic-version: 2023-06-01' \
340335 -H "Authorization: Bearer $ANTHROPIC_COMPLIANCE_API_KEY"
341336```
342337
api/compliance/organizations/settings/retrieve Changed · +1 / -6 lines
from line 26
2626
2727## Headers
2828
29- `"anthropic-version": optional string`
30
31 The version of the Claude API you want to use.
32
33 Read more about versioning and our version history [here](https://platform.claude.com/docs/en/api/versioning).
34
3529- `"x-api-key": optional string`
3630
3731## Returns
from line 329
335329
336330```bash
337331curl https://api.anthropic.com/v1/compliance/organizations/$ORGANIZATION_ID/settings \
332 -H 'anthropic-version: 2023-06-01' \
338333 -H "Authorization: Bearer $ANTHROPIC_COMPLIANCE_API_KEY"
339334```
340335
api/compliance/organizations/users Changed · +1 / -6 lines
from line 31
3131
3232### Headers
3333
34- `"anthropic-version": optional string`
35
36 The version of the Claude API you want to use.
37
38 Read more about versioning and our version history [here](https://platform.claude.com/docs/en/api/versioning).
39
4034- `"x-api-key": optional string`
4135
4236### Returns
from line 91
9791
9892```bash
9993curl https://api.anthropic.com/v1/compliance/organizations/$ORG_UUID/users \
94 -H 'anthropic-version: 2023-06-01' \
10095 -H "Authorization: Bearer $ANTHROPIC_COMPLIANCE_API_KEY"
10196```
10297
api/compliance/organizations/users/list Changed · +1 / -6 lines
from line 29
2929
3030## Headers
3131
32- `"anthropic-version": optional string`
33
34 The version of the Claude API you want to use.
35
36 Read more about versioning and our version history [here](https://platform.claude.com/docs/en/api/versioning).
37
3832- `"x-api-key": optional string`
3933
4034## Returns
from line 89
9589
9690```bash
9791curl https://api.anthropic.com/v1/compliance/organizations/$ORG_UUID/users \
92 -H 'anthropic-version: 2023-06-01' \
9893 -H "Authorization: Bearer $ANTHROPIC_COMPLIANCE_API_KEY"
9994```
10095
manage-claude/cmek Changed · +3 / -3 lines
from line 58
5858**Claude Platform**
5959
6060* Message content, files and attachments (both inline attachments sent with a request and Files API uploads), and MCP and tool configuration.
61* [Claude Managed Agents](https://platform.claude.com/docs/en/managed-agents/overview) data, including agent configurations, environments, webhooks, and sessions and their events.
61* [Claude Managed Agents](https://platform.claude.com/docs/en/managed-agents/overview) data, including agent configurations, environments, webhooks, sessions and their events, [memory stores](https://platform.claude.com/docs/en/managed-agents/memory) and their memories and memory versions, and [dreams](https://platform.claude.com/docs/en/managed-agents/dreams).
6262
6363**Claude Enterprise**
6464
from line 122
122122| Batch | Bash tool |
123123| Skills | Text editor tool |
124124| Claude Managed Agents | MCP connector |
125| | Structured outputs (not available for Claude Fable or Claude Mythos models in CMEK organizations) |
126| | Advisor tool |
125| Memory stores | Structured outputs (not available for Claude Fable or Claude Mythos models in CMEK organizations) |
126| Dreams | Advisor tool |
127127| | Computer use |
128128| | Browser use |
129129| | Context management |
manage-claude/compliance-content-data Changed · +9 / -8 lines
from line 195
195195```bash cURL
196196file_id="claude_file_01UaT9wBcDfGhJkLmNpQrSv7"
197197
198curl --fail-with-body -sS -OJ \
198curl --fail-with-body -sS \
199 "https://api.anthropic.com/v1/compliance/apps/chats/files/$file_id/content" \
199200 --header "x-api-key: $ANTHROPIC_COMPLIANCE_ACCESS_KEY" \
200201 --header "anthropic-version: 2023-06-01" \
201 "https://api.anthropic.com/v1/compliance/apps/chats/files/$file_id/content"
202 --output "dashboard_mockup_v1.pdf"
202203```
203204
204The `-OJ` flags tell curl to save the response under the file name from `Content-Disposition`, which is the original file name the user uploaded.
205In curl, the `--remote-header-name` (`-J`) option, which normally saves a download under the `Content-Disposition` file name, does not read the `filename*` form, so name the saved file yourself with `--output`. In a script, take the name from the file's `filename` field in the chat messages or [Get file metadata](https://platform.claude.com/docs/en/api/compliance/apps/chats/files/retrieve) response, or decode `filename*`. Either way, it is the name the user gave the upload, so treat it as untrusted before using it as an output path: keep only the base name, allow only characters that are safe on your filesystem, and refuse names that begin with `-` or `.`.
205206
206The artifact content endpoint returns the text body of one artifact version. Pass the `version_id` from one of the entries in an assistant message's `artifacts` array, not the artifact's stable `id`. Each new version of an artifact has its own `version_id`, and the Compliance API serves the exact bytes of that version.
207Unlike the file content endpoint, the artifact content endpoint returns a JSON object. Pass the `version_id` from one of the entries in an assistant message's `artifacts` array, not the artifact's stable `id`; each new version of an artifact has its own `version_id`. The response's `content` field holds exactly that version's text, and its `title` and `artifact_type` fields describe the artifact. [Get artifact metadata](https://platform.claude.com/docs/en/api/compliance/apps/artifacts/retrieve) computes `size_bytes` and `md5` over the UTF-8 encoding of that text, so compare them with the `content` value rather than the whole response body.
207208
208209## Retrieve projects and attachments
209210
from line 307
306307```json
307308{
308309 "error": {
309 "type": "conflict_error",
310 "type": "invalid_request_error",
310311 "message": "The \"claude_proj_01KGp4eZNug9ri4kE35RSppq\" project cannot be deleted as it has chats attached to it. Delete or detach all chats, and try deleting the project again."
311312 }
312313}
manage-claude/compliance-errors Changed · +145 / -73 lines
### Compliance API not enabled ### Unknown query parameter ### Invalid parameter value ### Invalid pagination cursor ### Invalid, deactivated, or expired API key ### Request not authenticated ### Generated file or artifact not found ### Invalid timestamp format ### Invalid limit ### Invalid pagination ID ### Invalid API key
from line 1
11---
22title: Handle Compliance API errors
33url: https://platform.claude.com/docs/en/manage-claude/compliance-errors
4description: Every Compliance API error message with cause and fix, organized by HTTP status code.
4description: Compliance API error responses by HTTP status code, with the cause and fix for each.
55---
66
77<Note>
from line 8
88 To enable the Compliance API, see [Set up the Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api-access).
99</Note>
1010
11This page lists the response messages each documented Compliance API endpoint returns, the cause, and the fix.
11This page lists common Compliance API error responses by HTTP status code, with the cause and the fix for each.
1212
1313The Compliance API returns errors in the standard [Anthropic error format](https://platform.claude.com/docs/en/api/errors): a non-2xx status code, a `request-id` response header, and a JSON body with an `error` object containing `type` and `message`. Include the `request-id` header value when you escalate to support.
1414
from line 15
1515```json
1616{
1717 "error": {
18 "type": "authentication_error",
19 "message": "The API key provided is invalid or has been revoked."
18 "type": "permission_error",
19 "message": "Missing required scopes. Got: ['read:compliance_activities'] Needed one of: ['read:compliance_user_data', 'read:org_audit']"
2020 }
2121}
2222```
from line 23
2323
2424On this page, local sessions run on users' machines and remote sessions run in the cloud; see [Retrieve session transcripts](https://platform.claude.com/docs/en/manage-claude/compliance-sessions).
2525
26Match on `error.type`, not on the message string. Messages are stable enough to copy into runbooks but might be reworded over time; the type values are part of the API contract. The local session endpoints have a few documented exceptions where responses that share a type are told apart by their message; each is called out where it applies.
26Match on the HTTP status code and `error.type`, not on the message string. Messages are stable enough to copy into runbooks but might be reworded over time; the status codes and type values are part of the API contract. A few responses that share a status code and type are told apart by their message; each is called out where it applies.
2727
2828The following table tells you at a glance whether to retry. Each section that follows shows the verbatim error body and the fix.
2929
30| Status | Retry? | When |
31| -------------------------------------------------------------------------------------------------------------------------- | --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
32| [400 Bad Request](https://platform.claude.com/docs/en/manage-claude/compliance-errors#400-bad-request) | No | Fix the request and resend. |
33| [401 Unauthorized](https://platform.claude.com/docs/en/manage-claude/compliance-errors#401-unauthorized) | No | Fix or rotate the key, then resend. |
34| [403 Forbidden](https://platform.claude.com/docs/en/manage-claude/compliance-errors#403-forbidden) | No | Add the missing scope or use the right key type, then resend. |
35| [404 Not Found](https://platform.claude.com/docs/en/manage-claude/compliance-errors#404-not-found) | Usually no | The resource was deleted or never existed; remove it from your queue. Exceptions: on the local session endpoints, the message `Local sessions are not available.` (returned on every call, including the list) means the endpoints are currently unavailable to your parent organization, not that a session is gone; keep your queued IDs and see [Local session not found](https://platform.claude.com/docs/en/manage-claude/compliance-errors#local-session-not-found). A remote session still in `pending` status 404s on its messages endpoint until it starts; see [Remote session not found](https://platform.claude.com/docs/en/manage-claude/compliance-errors#remote-session-not-found). |
36| [409 Conflict](https://platform.claude.com/docs/en/manage-claude/compliance-errors#409-conflict) | No | The request conflicts with the resource's current state; resolve the conflict (such as detaching child resources), then retry. |
37| [429 Too Many Requests](https://platform.claude.com/docs/en/manage-claude/compliance-errors#429-too-many-requests) | Yes, after `retry-after` | Wait the seconds in `retry-after`, then retry; do not advance your cursor. |
38| [500 Internal Server Error](https://platform.claude.com/docs/en/manage-claude/compliance-errors#500-internal-server-error) | Depends on `x-should-retry` | Check the `x-should-retry` response header before retrying. |
39| [502, 503, 504, 529](https://platform.claude.com/docs/en/manage-claude/compliance-errors#500-internal-server-error) | Yes, with backoff | Transient; retry with exponential backoff. Exception: some local session 503s are not transient. See [Local sessions temporarily unavailable](https://platform.claude.com/docs/en/manage-claude/compliance-errors#local-sessions-temporarily-unavailable). |
30| Status | Retry? | When |
31| -------------------------------------------------------------------------------------------------------------------------- | --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
32| [400 Bad Request](https://platform.claude.com/docs/en/manage-claude/compliance-errors#400-bad-request) | No | Fix the request, or enable the Compliance API if the message says it is not enabled, then resend. |
33| [401 Unauthorized](https://platform.claude.com/docs/en/manage-claude/compliance-errors#401-unauthorized) | No | The key is not recognized, has been deactivated, or has expired; re-enable or replace it, then resend. |
34| [403 Forbidden](https://platform.claude.com/docs/en/manage-claude/compliance-errors#403-forbidden) | No | Add the missing scope or use the right key type, then resend. |
35| [404 Not Found](https://platform.claude.com/docs/en/manage-claude/compliance-errors#404-not-found) | Usually no | A message that names a resource means it was deleted or never existed; remove it from your queue. The bare message `Not found` means the request did not authenticate (or the path does not exist), not that a resource is gone; see [Request not authenticated](https://platform.claude.com/docs/en/manage-claude/compliance-errors#request-not-authenticated). The session endpoints add two more cases: on the local session endpoints, the message `Local sessions are not available.` (returned on every call, including the list) means the endpoints are currently unavailable to your parent organization, not that a session is gone; keep your queued IDs and see [Local session not found](https://platform.claude.com/docs/en/manage-claude/compliance-errors#local-session-not-found). A remote session still in `pending` status 404s on its messages endpoint until it starts; see [Remote session not found](https://platform.claude.com/docs/en/manage-claude/compliance-errors#remote-session-not-found). |
36| [409 Conflict](https://platform.claude.com/docs/en/manage-claude/compliance-errors#409-conflict) | No | The request conflicts with the resource's current state; resolve the conflict (such as detaching child resources), then retry. |
37| [429 Too Many Requests](https://platform.claude.com/docs/en/manage-claude/compliance-errors#429-too-many-requests) | Yes, after `retry-after` | Wait the seconds in `retry-after`, then retry; do not advance your cursor. |
38| [500 Internal Server Error](https://platform.claude.com/docs/en/manage-claude/compliance-errors#500-internal-server-error) | Depends on `x-should-retry` | Check the `x-should-retry` response header before retrying. |
39| [502, 503, 504, 529](https://platform.claude.com/docs/en/manage-claude/compliance-errors#500-internal-server-error) | Yes, with backoff | Transient; retry with exponential backoff. Exception: some local session 503s are not transient. See [Local sessions temporarily unavailable](https://platform.claude.com/docs/en/manage-claude/compliance-errors#local-sessions-temporarily-unavailable). |
4040
4141## 400 Bad Request
4242
43The request was syntactically valid but contained a parameter the server rejected. Fix the parameter and retry.
43The request was syntactically valid, but the server rejected a parameter or the Compliance API is not enabled for the organization. Fix the cause named in the message and resend.
4444
45### Invalid timestamp format
45### Compliance API not enabled
4646
4747**Type:** `invalid_request_error`
4848
4949```text wrap
50The `created_at.gte` parameter contains an invalid timestamp format. Timestamps must be provided in RFC 3339 format e.g., "2024-03-01T00:00:00Z". Got "2024-01-01".
50Compliance API is not enabled for this organization
5151```
5252
53**Cause:** A `created_at.*` or `updated_at.*` value (`.gte`, `.gt`, `.lte`, `.lt`) could not be parsed as a datetime. The message names the parameter that failed and echoes the value that was sent.
53**Cause:** The key is valid, but the Compliance API is not enabled for the organization or parent organization the key belongs to. Every endpoint returns this response until the API is enabled, and again if an administrator turns the API off.
5454
55**Fix:** Send a full RFC 3339 timestamp including time and time zone, for example, `2024-03-01T00:00:00Z` or `2024-03-01T00:00:00+00:00`.
55**Fix:** Enable the Compliance API by following [Set up the Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api-access#set-up-the-compliance-api), then resend the request.
5656
57The local session list (`GET /v1/compliance/apps/sessions/local`) also returns a 400 `invalid_request_error` when both time bounds are supplied and `created_at.lt` is not strictly after `created_at.gte`. The body reads:
57### Unknown query parameter
5858
59**Type:** `invalid_request_error`
60
5961```text wrap
60created_at.lt must be strictly after created_at.gte.
62Unknown query parameter: 'created_at[gte]'. Did you mean 'created_at.gte'?
6163```
6264
63Send a `created_at.lt` later than `created_at.gte`, or omit one of the bounds.
65**Cause:** The request included a query parameter that the endpoint does not define; the Compliance API rejects unrecognized parameters rather than ignoring them. The message names the parameter and, for near misses such as bracket notation in place of a dot or a missing `[]` suffix, suggests the defined name.
6466
65### Invalid limit
67**Fix:** Use the parameter names shown on the endpoint's [Compliance API reference](https://platform.claude.com/docs/en/api/compliance) page. Range filters use dot notation (for example, `created_at.gte`), array filters take a `[]` suffix (for example, `activity_types[]`), and the pagination parameters are `after_id`, `before_id`, or `page`, depending on the endpoint.
6668
69### Invalid parameter value
70
6771**Type:** `invalid_request_error`
6872
6973```text wrap
70The limit parameter must be between 1 and 1000, inclusive. Got 1500.
74limit: Input should be less than or equal to 1000
7175```
7276
73**Cause:** The `limit` query parameter was outside the accepted range. The bound named in the message reflects the maximum for the specific endpoint that was called.
77```text wrap
78created_at.gte: Input should be a valid datetime or date, invalid character in year
79```
7480
75**Fix:** Send a `limit` within the range the endpoint accepts. Each list endpoint has its own `limit` range; see the parameter constraints on the corresponding [Compliance API reference](https://platform.claude.com/docs/en/api/compliance) page.
81```text wrap
82activity_types[].0: Input is not one of the permitted values.
83```
7684
85**Cause:** A query parameter's value failed validation. The message starts with the parameter name (followed by the element's position for an array parameter), then states the constraint that failed. Three common cases are shown: a `limit` above the endpoint's maximum (the number in the message is that endpoint's maximum), a `created_at.*` or `updated_at.*` value that cannot be parsed as a date or timestamp, and an `activity_types[]` value that is not a supported activity type.
86
87**Fix:** Correct the parameter named in the message. Each list endpoint has its own `limit` range; see the parameter constraints on the corresponding [Compliance API reference](https://platform.claude.com/docs/en/api/compliance) page. Send timestamps in RFC 3339 format with an explicit UTC offset, for example, `2024-03-01T00:00:00Z` or `2024-03-01T00:00:00+00:00`; the local session list rejects a timestamp without an offset (`created_at.gte: Input should have timezone info`). For the supported `activity_types[]` values, see [Query compliance activities](https://platform.claude.com/docs/en/api/compliance/activities/list).
88
89The local session list (`GET /v1/compliance/apps/sessions/local`) also returns a 400 `invalid_request_error` when both time bounds are supplied and `created_at.lt` is not strictly after `created_at.gte`. The body reads:
90
91```text wrap
92created_at.lt must be strictly after created_at.gte.
93```
94
95Send a `created_at.lt` later than `created_at.gte`, or omit one of the bounds.
96
7797The session transcript endpoints (`GET /v1/compliance/apps/sessions/local/{session_id}/messages` and `GET /v1/compliance/apps/sessions/remote/{session_id}/messages`) validate their truncation parameters the same way: `tool_use_input_max_bytes` and `tool_result_max_bytes` each accept a positive byte count or `-1` (the server maximum), so a value such as `0` returns the same 400 `invalid_request_error`.
7898
79### Invalid pagination ID
99### Invalid pagination cursor
80100
81101**Type:** `invalid_request_error`
82102
83103```text wrap
84Invalid `after_id`. No activity found for `after_id` "activity_invalid123"
104Invalid activity_id format: 'activity_invalid123'
85105```
86106
87**Cause:** The `after_id` or `before_id` cursor could not be decoded as an opaque cursor or parsed as an activity ID.
107```text wrap
108Invalid pagination cursor for 'after_id'
109```
88110
111**Cause:** A pagination cursor could not be decoded. On the Activity Feed, an `after_id` or `before_id` value that is neither a cursor the API issued nor a well-formed activity ID returns the first body, which echoes the value sent. On the chat and chat message endpoints, an `after_id` or `before_id` value that cannot be decoded returns the second body, which names the parameter.
112
89113**Fix:** Treat pagination cursors as opaque strings. Always copy the `first_id` or `last_id` value returned by the previous page; stop when `has_more` is `false`. Do not construct cursors from object IDs.
90114
91The directory, project, and session endpoints (organizations, users, roles, role permissions, groups, group members, projects, project attachments, local and remote sessions, and session messages) paginate with an opaque `page` token rather than `after_id` and `before_id`. The same advice applies: pass the `next_page` value from the previous response unchanged, and stop when `has_more` is `false` (or, on the session endpoints, which return no `has_more`, when `next_page` is `null`). A malformed `page` token returns the same 400 `invalid_request_error` as a malformed `after_id` or `before_id`.
115The directory, project, and session endpoints (organizations, users, roles, role permissions, groups, group members, projects, project attachments, local and remote sessions, and session messages) paginate with an opaque `page` token rather than `after_id` and `before_id`. The same advice applies: pass the `next_page` value from the previous response unchanged, and stop when `has_more` is `false` (or, on the session endpoints, which return no `has_more`, when `next_page` is `null`). A malformed `page` token returns the same 400 `invalid_request_error` as a malformed `after_id` or `before_id`, with a message specific to the endpoint.
92116
93117The two paginated local session endpoints (the list and the messages endpoint) return the following 400 `invalid_request_error` for any `page` value they cannot decode, for example, a token that was truncated or altered after you stored it, or one issued by a different endpoint or under a different parent organization. On the local session messages endpoint (`GET /v1/compliance/apps/sessions/local/{session_id}/messages`), each `page` cursor is also bound to the session and `order` it was issued for, so a cursor issued for a different session or sort order returns the same body:
94118
from line 130
106130
107131## 401 Unauthorized
108132
109The `x-api-key` header was missing or did not match a known key. A valid key with the wrong scopes returns [403 Forbidden](https://platform.claude.com/docs/en/manage-claude/compliance-errors#403-forbidden) instead.
133The request carried a Compliance Access Key (`sk-ant-api01-...`) or Admin API key (`sk-ant-admin01-...`) that does not authenticate. A request that carries no key, or a key of another type, returns [404 Not Found](https://platform.claude.com/docs/en/manage-claude/compliance-errors#request-not-authenticated) instead on every endpoint except organization settings, and a valid key with the wrong scopes returns [403 Forbidden](https://platform.claude.com/docs/en/manage-claude/compliance-errors#403-forbidden).
110134
111### Invalid API key
135### Invalid, deactivated, or expired API key
112136
113137**Type:** `authentication_error`
114138
115139```text wrap
116The API key provided is invalid or has been revoked.
140API key is invalid.
117141```
118142
119**Cause:** The key in `x-api-key` does not exist, has been deleted, or has been disabled. A missing or empty `x-api-key` header returns the same body, so check both your secret store and the key's revocation status.
143```text wrap
144API key has been deactivated.
145```
120146
121**Fix:** Confirm the key value, check that it has not been deleted in claude.ai (Compliance Access Keys) or Claude Console (Admin API keys), and confirm it is enabled. See [Set up the Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api-access).
147```text wrap
148API key has expired.
149```
122150
151**Cause:** `API key is invalid.` means the value sent does not match a usable key, for example because it was truncated or altered when it was stored. `API key has been deactivated.` means the key has been disabled or deleted. `API key has expired.` means an Admin API key's expiration date has passed; Compliance Access Keys are not created with one.
152
153**Fix:** For `API key is invalid.`, compare the value your client sends against the secret you stored when the key was created; the full secret is displayed only once, so if your stored copy is wrong, create a new key. For `API key has been deactivated.`, re-enable the key if it was only disabled, in [claude.ai > Organization settings > API](https://claude.ai/admin-settings/api-access) for a Compliance Access Key or [Claude Console > Settings > Admin keys](https://platform.claude.com/settings/admin-keys) for an Admin API key; a deleted key cannot be restored. For a deleted or expired key, create a new key and update your integration to use it, as described in [Manage and rotate keys](https://platform.claude.com/docs/en/manage-claude/compliance-api-access#manage-and-rotate-keys).
154
123155## 403 Forbidden
124156
125The key in `x-api-key` is valid but does not carry the scope the endpoint requires. The verbatim message lists the scopes the key carries (`Got:`) and the scopes the endpoint requires (`Needed:`), so you can confirm what the key carries without rechecking Claude Console or claude.ai. Compliance Access Key scopes are immutable after creation, so each insufficient-scope fix directs you to create a new key rather than edit the existing one. A standalone Claude Console organization (one with no parent organization) cannot create a Compliance Access Key, so fixes that require one do not apply to it; it can query the Activity Feed only.
157The key in `x-api-key` is valid but does not carry a scope the endpoint accepts. The verbatim message lists the scopes the key carries (`Got:`) and the scopes the endpoint accepts (`Needed one of:` on read endpoints, where any one listed scope is sufficient, or `Needed:` on delete endpoints), so you can confirm what the key carries without rechecking Claude Console or claude.ai. On read endpoints the accepted list also includes `read:org_audit`, a read-only audit scope that covers every Compliance API read endpoint; see [Choose scopes for a Claude Enterprise key](https://platform.claude.com/docs/en/manage-claude/admin-api-keys#choose-scopes-for-a-claude-enterprise-key). Compliance Access Key scopes are immutable after creation, so each insufficient-scope fix directs you to create a new key rather than edit the existing one. A standalone Claude Console organization (one with no parent organization) cannot create a Compliance Access Key, so fixes that require one do not apply to it; it can query the Activity Feed only.
126158
127159### Insufficient scope: Activity Feed
128160
from line 161
129161**Type:** `permission_error`
130162
131163```text wrap
132Missing required scopes. Got: ['read:compliance_user_data'] Needed: ['read:compliance_activities']
164Missing required scopes. Got: ['read:compliance_user_data'] Needed one of: ['read:compliance_activities', 'read:org_audit']
133165```
134166
135167**Cause:** A key without `read:compliance_activities` was used to call `GET /v1/compliance/activities`. There are two common paths to this error:
from line 176
144176**Type:** `permission_error`
145177
146178```text wrap
147Missing required scopes. Got: ['read:compliance_user_data'] Needed: ['read:compliance_org_data']
179Missing required scopes. Got: ['read:compliance_user_data'] Needed one of: ['read:compliance_org_data', 'read:org_audit']
148180```
149181
150182**Cause:** A key without `read:compliance_org_data` was used to call an organizations, roles, groups, or effective-settings endpoint. There are two common paths to this error:
from line 191
159191**Type:** `permission_error`
160192
161193```text wrap
162Missing required scopes. Got: ['read:compliance_org_settings'] Needed: ['read:compliance_org_data']
194Missing required scopes. Got: ['read:compliance_org_settings'] Needed one of: ['read:compliance_org_data', 'read:org_audit']
163195```
164196
165197**Cause:** The `read:compliance_org_settings` scope was retired on June 30, 2026. `GET /v1/compliance/organizations/{organization_id}/settings` now requires `read:compliance_org_data`, the same scope as the other organization endpoints, and the retired scope no longer authorizes anything. A Compliance Access Key that carries only `read:compliance_org_settings` returns this error on every call to the settings endpoint, even though the key worked before the retirement. The retired scope can no longer be selected or granted when creating a key.
from line 203
171203**Type:** `permission_error`
172204
173205```text wrap
174Missing required scopes. Got: ['read:compliance_activities'] Needed: ['read:compliance_user_data']
206Missing required scopes. Got: ['read:compliance_activities'] Needed one of: ['read:compliance_user_data', 'read:org_audit']
175207```
176208
177209**Cause:** A key without `read:compliance_user_data` was used to call a chats, messages, files, projects, sessions, organization users, or group-members endpoint. There are two common paths to this error:
from line 227
195227
196228## 404 Not Found
197229
198The endpoint resolved but the resource ID does not exist or has already been deleted. Compliance API deletes are immediate and permanent, so a 404 on a previously known ID usually means the content was hard-deleted through a Compliance API delete call or removed by a retention policy. The session endpoints add two cases. On the local session endpoints, a separate 404 message, `Local sessions are not available.`, is returned on every call (including the list) while the endpoints are unavailable to your parent organization; it does not depend on the session ID and can be temporary. See [Local session not found](https://platform.claude.com/docs/en/manage-claude/compliance-errors#local-session-not-found). On the remote session endpoints, a session that is still being provisioned (`status` of `pending`) has no transcript yet, so its messages endpoint 404s until the session starts. See [Remote session not found](https://platform.claude.com/docs/en/manage-claude/compliance-errors#remote-session-not-found). The activity-type strings cited in each Fix (for example, `claude_chat_created`) are values you can pass to the Activity Feed `activity_types[]` filter; see [Query compliance activities](https://platform.claude.com/docs/en/api/compliance/activities/list) for every supported value.
230A 404 whose message names a resource or a resource type means the ID in the path does not exist or has already been deleted. Compliance API deletes are immediate and permanent, so a 404 on a previously known ID usually means the content is gone: hard-deleted through a Compliance API delete call, removed by a retention policy, or, for files and artifacts, deleted along with their chat by a user in claude.ai. A 404 with the bare message `Not found` is different: the request did not authenticate (or the path does not exist), and any endpoint can return it, list endpoints included; see [Request not authenticated](https://platform.claude.com/docs/en/manage-claude/compliance-errors#request-not-authenticated). The session endpoints add two cases. On the local session endpoints, a separate 404 message, `Local sessions are not available.`, is returned on every call (including the list) while the endpoints are unavailable to your parent organization; it does not depend on the session ID and can be temporary. See [Local session not found](https://platform.claude.com/docs/en/manage-claude/compliance-errors#local-session-not-found). On the remote session endpoints, a session that is still being provisioned (`status` of `pending`) has no transcript yet, so its messages endpoint 404s until the session starts. See [Remote session not found](https://platform.claude.com/docs/en/manage-claude/compliance-errors#remote-session-not-found). The activity-type strings cited in each Fix (for example, `claude_chat_created`) are values you can pass to the Activity Feed `activity_types[]` filter; see [Query compliance activities](https://platform.claude.com/docs/en/api/compliance/activities/list) for every supported value.
199231
232### Request not authenticated
233
234**Type:** `not_found_error`
235
236```text wrap
237Not found
238```
239
240**Cause:** The request did not carry a credential the Compliance API accepts: no API key was sent, or the key is not a Compliance Access Key (`sk-ant-api01-...`) or Admin API key (`sk-ant-admin01-...`), for example, a Claude API key (`sk-ant-api03-...`). The status, type, and message are the same as for a path that does not exist and do not depend on the endpoint or any resource ID, so list endpoints such as `GET /v1/compliance/activities` return this body too. The one exception is `GET /v1/compliance/organizations/{organization_id}/settings`, which answers these requests with 401 `authentication_error`. On every endpoint, a Compliance Access Key or Admin API key that does not authenticate returns [401 Unauthorized](https://platform.claude.com/docs/en/manage-claude/compliance-errors#401-unauthorized) instead.
241
242**Fix:** Send the key in the `x-api-key` header and check its prefix: the Compliance API accepts only `sk-ant-api01-...` and `sk-ant-admin01-...` keys; see [Which key do you need?](https://platform.claude.com/docs/en/manage-claude/compliance-api-access#which-key-do-you-need). If the header and key are right and one path still returns `Not found` while others succeed, check that path against the [Compliance API reference](https://platform.claude.com/docs/en/api/compliance).
243
200244### Chat not found
201245
202246**Type:** `not_found_error`
203247
204248```text wrap
205Chat claude_chat_01H5CWunD7RpVJ5bHa8RCkja not found.
249Chat conversation not found: 'claude_chat_01H5CWunD7RpVJ5bHa8RCkja'
206250```
207251
208252**Cause:** The chat ID in the path does not match a chat readable through the Compliance API. The chat might have been hard-deleted through a previous Compliance API call or removed by your organization's retention policy, or it might belong to an organization the calling key cannot read. Chats that a user deleted in claude.ai do not return 404; they remain readable, with `deleted_at` populated, but without their message content.
from line 258
214258**Type:** `not_found_error`
215259
216260```text wrap
217No file found with provided id, or it has already been deleted.
261File not found: 0d3b8f72-6c1e-4a59-b2de-7f4c9a1e5b60
218262```
219263
220**Cause:** The file ID does not exist or has been deleted. This error applies to both chat-attached files (`claude_file_...`) and project files.
264**Cause:** The file ID does not exist in an organization your key can read, or the file has been deleted. Deleting a chat in claude.ai also deletes the files attached to it, although the chat itself remains listed. The message identifies the file by its underlying UUID rather than by the `claude_file_...` ID sent in the request. The metadata, content, and delete endpoints return this body; it applies to both chat-attached files (`claude_file_...`) and project files.
221265
222**Fix:** Reconcile against recent `claude_file_uploaded` or `claude_file_deleted` activities. If the file was deleted, the binary is gone; the activity record remains in the feed for the 6-year retention window.
266**Fix:** Reconcile against recent `claude_file_uploaded` or `claude_file_deleted` activities. Files deleted along with a chat have no `claude_file_deleted` activity, so check for the chat's `claude_chat_deleted` activity as well. If the file was deleted, the binary is gone; the activity records remain in the feed for the 6-year retention window.
223267
268### Generated file or artifact not found
269
270**Type:** `not_found_error`
271
272```text wrap
273Generated file not found: 'claude_gen_file_01TbR8wAcCeFhJkLnPqStUvX'
274```
275
276```text wrap
277Generated file content not found: 'claude_gen_file_01TbR8wAcCeFhJkLnPqStUvX'
278```
279
280```text wrap
281Artifact version not found: 'claude_artifact_version_01KmNpQrSt3UvWxYz5AbCdEfG'
282```
283
284**Cause:** The ID in the path does not match a tool-generated file or artifact version readable through the Compliance API. The generated-file metadata endpoint returns the first body, the content endpoint returns the second, and both artifact endpoints return the third. Generated files and artifacts are deleted with the chat they were created in, including when a user deletes the chat in claude.ai.
285
286**Fix:** Use [Get chat messages](https://platform.claude.com/docs/en/api/compliance/apps/chats/messages/list) to look up the chat the ID came from. If the chat's `deleted_at` is populated, or a `claude_chat_deleted` activity names the chat, the content is gone; remove the ID from your queue. Otherwise, confirm the ID against the `generated_files` and `artifacts` arrays on the chat's messages.
287
224288### Project not found
225289
226290**Type:** `not_found_error`
from line 293
229293No project is found with the provided id.
230294```
231295
232**Cause:** The project ID does not exist or has been deleted.
296```text wrap
297No project found with provided id, or it has already been deleted.
298```
233299
300**Cause:** The project ID does not exist or has been deleted. The project detail, attachments, and collaborators endpoints return the first body; `DELETE /v1/compliance/apps/projects/{project_id}` returns the second.
301
234302**Fix:** Reconcile against recent `claude_project_created` or `claude_project_deleted` activities. The Activity Feed continues to expose the project's lifecycle events even after the project itself is gone.
235303
236304### Project document not found
from line 306
238306**Type:** `not_found_error`
239307
240308```text wrap
241No project document found with provided id, or it has already been deleted.
309No project document found with the provided id.
242310```
243311
244**Cause:** The project document ID does not exist or has been deleted. This error applies to text project documents (`claude_proj_doc_...`), not to project files.
312```text wrap
313No project document found with the provided id, or it has already been deleted.
314```
245315
316**Cause:** The project document ID does not exist or has been deleted. The document content and metadata endpoints return the first body; `DELETE /v1/compliance/apps/projects/documents/{document_id}` returns the second. This error applies to text project documents (`claude_proj_doc_...`), not to project files.
317
246318**Fix:** Use `GET /v1/compliance/apps/projects/{project_id}/attachments` to list current attachments. If the document is missing, it was deleted; retrieve it through a `claude_project_document_uploaded` activity record if you only need the metadata.
247319
248320### Local session not found
from line 371
299371
300372## 409 Conflict
301373
302The request is well-formed and authorized but conflicts with the resource's current state.
374The request is well-formed and authorized but conflicts with the resource's current state. The body carries the `invalid_request_error` type, which 400 responses also use, so distinguish a conflict by the 409 status code rather than by `error.type`.
303375
304376### Project has attached chats
305377
306**Type:** `conflict_error`
378**Type:** `invalid_request_error`
307379
308380```text wrap
309381The "claude_proj_01KGp4eZNug9ri4kE35RSppq" project cannot be deleted as it has chats attached to it. Delete or detach all chats, and try deleting the project again.
api/beta/messages/batches/create Changed · +1 / -1 lines
from line 3926
39263926
39273927 - `temperature: optional number`
39283928
3929 **Deprecated**: Deprecated. Models released after Claude Opus 4.6 do not support setting temperature. A value of 1.0 of will be accepted for backwards compatibility, all other values will be rejected with a 400 error.
3929 **Deprecated**: Deprecated. Models released after Claude Opus 4.6 do not support setting temperature. A value of 1.0 will be accepted for backwards compatibility, all other values will be rejected with a 400 error.
39303930
39313931 Amount of randomness injected into the response.
39323932
api/beta/organization/rbac_groups/create Changed · +0 / -1 lines
from line 69
6969curl https://api.anthropic.com/v1/organizations/rbac_groups \
7070 -H 'Content-Type: application/json' \
7171 -H 'anthropic-version: 2023-06-01' \
72 -H 'anthropic-beta: ce-user-management-2026-07-13' \
7372 -H "X-Api-Key: $ANTHROPIC_API_KEY" \
7473 -d '{
7574 "name": "Engineering"
api/beta/organization/rbac_groups/delete Changed · +0 / -1 lines
from line 39
3939curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID \
4040 -X DELETE \
4141 -H 'anthropic-version: 2023-06-01' \
42 -H 'anthropic-beta: ce-user-management-2026-07-13' \
4342 -H "X-Api-Key: $ANTHROPIC_API_KEY"
4443```
4544
api/beta/organization/rbac_groups/list Changed · +0 / -1 lines
from line 82
8282```bash
8383curl https://api.anthropic.com/v1/organizations/rbac_groups \
8484 -H 'anthropic-version: 2023-06-01' \
85 -H 'anthropic-beta: ce-user-management-2026-07-13' \
8685 -H "X-Api-Key: $ANTHROPIC_API_KEY"
8786```
8887
api/beta/organization/rbac_groups/members Changed · +0 / -3 lines
from line 76
7676```bash
7777curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members \
7878 -H 'anthropic-version: 2023-06-01' \
79 -H 'anthropic-beta: ce-user-management-2026-07-13' \
8079 -H "X-Api-Key: $ANTHROPIC_API_KEY"
8180```
8281
from line 153
154153curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members \
155154 -H 'Content-Type: application/json' \
156155 -H 'anthropic-version: 2023-06-01' \
157 -H 'anthropic-beta: ce-user-management-2026-07-13' \
158156 -H "X-Api-Key: $ANTHROPIC_API_KEY" \
159157 -d '{
160158 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
from line 213
215213curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members/$USER_ID \
216214 -X DELETE \
217215 -H 'anthropic-version: 2023-06-01' \
218 -H 'anthropic-beta: ce-user-management-2026-07-13' \
219216 -H "X-Api-Key: $ANTHROPIC_API_KEY"
220217```
221218
api/beta/organization/rbac_groups/members/create Changed · +0 / -1 lines
from line 59
5959curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members \
6060 -H 'Content-Type: application/json' \
6161 -H 'anthropic-version: 2023-06-01' \
62 -H 'anthropic-beta: ce-user-management-2026-07-13' \
6362 -H "X-Api-Key: $ANTHROPIC_API_KEY" \
6463 -d '{
6564 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
api/beta/organization/rbac_groups/members/delete Changed · +0 / -1 lines
from line 45
4545curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members/$USER_ID \
4646 -X DELETE \
4747 -H 'anthropic-version: 2023-06-01' \
48 -H 'anthropic-beta: ce-user-management-2026-07-13' \
4948 -H "X-Api-Key: $ANTHROPIC_API_KEY"
5049```
5150
api/beta/organization/rbac_groups/members/list Changed · +0 / -1 lines
from line 74
7474```bash
7575curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members \
7676 -H 'anthropic-version: 2023-06-01' \
77 -H 'anthropic-beta: ce-user-management-2026-07-13' \
7877 -H "X-Api-Key: $ANTHROPIC_API_KEY"
7978```
8079
api/beta/organization/rbac_groups/retrieve Changed · +0 / -1 lines
from line 66
6666```bash
6767curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID \
6868 -H 'anthropic-version: 2023-06-01' \
69 -H 'anthropic-beta: ce-user-management-2026-07-13' \
7069 -H "X-Api-Key: $ANTHROPIC_API_KEY"
7170```
7271
api/beta/organization/rbac_groups/update Changed · +0 / -1 lines
from line 75
7575curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID \
7676 -H 'Content-Type: application/json' \
7777 -H 'anthropic-version: 2023-06-01' \
78 -H 'anthropic-beta: ce-user-management-2026-07-13' \
7978 -H "X-Api-Key: $ANTHROPIC_API_KEY" \
8079 -d '{
8180 "name": "Engineering"
api/beta/organization/rbac_roles Changed · +0 / -3 lines
from line 73
7373```bash
7474curl https://api.anthropic.com/v1/organizations/rbac_roles \
7575 -H 'anthropic-version: 2023-06-01' \
76 -H 'anthropic-beta: ce-user-management-2026-07-13' \
7776 -H "X-Api-Key: $ANTHROPIC_API_KEY"
7877```
7978
from line 145
146145```bash
147146curl https://api.anthropic.com/v1/organizations/rbac_roles/$ROLE_ID \
148147 -H 'anthropic-version: 2023-06-01' \
149 -H 'anthropic-beta: ce-user-management-2026-07-13' \
150148 -H "X-Api-Key: $ANTHROPIC_API_KEY"
151149```
152150
from line 351
353351```bash
354352curl https://api.anthropic.com/v1/organizations/rbac_roles/$ROLE_ID/permissions \
355353 -H 'anthropic-version: 2023-06-01' \
356 -H 'anthropic-beta: ce-user-management-2026-07-13' \
357354 -H "X-Api-Key: $ANTHROPIC_API_KEY"
358355```
359356
api/beta/organization/rbac_roles/list Changed · +0 / -1 lines
from line 71
7171```bash
7272curl https://api.anthropic.com/v1/organizations/rbac_roles \
7373 -H 'anthropic-version: 2023-06-01' \
74 -H 'anthropic-beta: ce-user-management-2026-07-13' \
7574 -H "X-Api-Key: $ANTHROPIC_API_KEY"
7675```
7776