One read of Claude Developer Platformapi-20261013T030708Z
13 pages moved out of 760 read.
Pages moved
13
significant first
Pages read
760
in this capture
Captured
03:07 UTC
Corpus hash
5e568825672e
corpus-hash
What this read moved
1-13 of 13agents-and-tools/tool-use/browser-use-tool Changed · +5 / -3 lines
from line 23
2323 Google Cloud: ga
2424---
2525
26<Note>
27 **Start with the SDK toolsets:** The Python and TypeScript SDKs have a browser toolset class, in beta. Start from [a partner's integration](https://platform.claude.com/docs/en/agents-and-tools/tool-use/browser-use-sdk#partner-integrations), or see [Browser and computer use with the SDK toolsets](https://platform.claude.com/docs/en/agents-and-tools/tool-use/browser-use-sdk). Use this page as the tool reference, or when you handle the tool calls yourself.
28</Note>
29
2630The browser use tool lets Claude navigate, read, and interact with webpages in a browser that your application runs. Claude works with the page both through its structure (the accessibility tree, elements, forms, and tabs) and through screenshots and viewport coordinates.
2731
2832The tool is an Anthropic-defined [client toolset](https://platform.claude.com/docs/en/agents-and-tools/tool-use/tool-reference#client-toolsets): one `browser_toolset_20260801` entry in `tools` gives Claude 27 member tools by default, such as `navigate`, `read_page`, `left_click`, and `screenshot`, plus four more when you [enable them](https://platform.claude.com/docs/en/agents-and-tools/tool-use/browser-use-tool#enable-optional-member-tools). Your application runs every call against its own browser automation; nothing runs on Anthropic's side. The tool isn't currently available in [Claude Managed Agents](https://platform.claude.com/docs/en/managed-agents/tools).
2933
30The Python and TypeScript SDKs include a class that passes these calls to your browser code, runs the URL and file policies you set, and asks your approval callback. See [Browser and computer use with the SDK toolsets](https://platform.claude.com/docs/en/agents-and-tools/tool-use/browser-use-sdk).
31
3234Choose browser use when the task stays inside webpages and means acting on them, or when pages build their content with JavaScript. When a task needs a whole desktop, use the [computer use tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/computer-use-tool), which works through screenshots and coordinates alone. For reading pages you can point Claude to, or finding sources on the web, the [web fetch tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-fetch-tool) and [web search tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-search-tool) are lighter. They're [server tools](https://platform.claude.com/docs/en/agents-and-tools/tool-use/server-tools) that the API runs for you, with no browser to operate.
3335
3436With browser use, Claude reads and acts on live webpages, so everything a page supplies is untrusted input and the actions Claude takes can have real effects. See [Security considerations](https://platform.claude.com/docs/en/agents-and-tools/tool-use/browser-use-tool#security-considerations) before you deploy.
from line 1586
15841586
15851587<CardGroup cols={2}>
15861588 <Card title="Browser and computer use with the SDK toolsets" icon="code" href="https://platform.claude.com/docs/en/agents-and-tools/tool-use/browser-use-sdk">
1587 Write a browser driver in Python or TypeScript. The SDK runs the loop and the checks you configure.
1589 Start from a partner's driver, or write your own in Python or TypeScript. The SDK runs the loop and the checks you configure.
15881590 </Card>
15891591
15901592 <Card title="Computer use tool" icon="computer" href="https://platform.claude.com/docs/en/agents-and-tools/tool-use/computer-use-tool">
agents-and-tools/tool-use/computer-use-tool Changed · +6 / -4 lines
from line 31
3131 - Platforms other than the Claude API and Google Cloud currently offer only the [earlier beta tool versions](https://platform.claude.com/docs/en/agents-and-tools/tool-use/computer-use-tool#earlier-tool-versions).
3232---
3333
34<Note>
35 **Start with the SDK toolsets:** For `computer_toolset_20260801`, the Python and TypeScript SDKs have a computer toolset class, in beta. Start from [a partner's integration](https://platform.claude.com/docs/en/agents-and-tools/tool-use/browser-use-sdk#partner-integrations), or see the [computer toolset](https://platform.claude.com/docs/en/agents-and-tools/tool-use/browser-use-sdk#computer-toolset) section of the SDK toolsets page. Use this page as the tool reference, or when you handle the tool calls yourself.
36</Note>
37
3438Claude can interact with computer environments through the computer use tool, which provides screenshot capabilities and mouse/keyboard control for autonomous desktop interaction.
3539
3640The computer use tool is an Anthropic-defined [client toolset](https://platform.claude.com/docs/en/agents-and-tools/tool-use/tool-reference#client-toolsets): one `{"type": "computer_toolset_20260801"}` entry in `tools` gives Claude 17 member tools such as `screenshot`, `left_click`, `type`, and `zoom`, and your application runs every call in an environment you control. It isn't currently available in [Claude Managed Agents](https://platform.claude.com/docs/en/managed-agents/tools). Claude's calls are `tool_use` blocks whose `name` is the member and which carry `"toolset_name": "computer"`, often several per turn (a [batch action](https://platform.claude.com/docs/en/agents-and-tools/tool-use/computer-use-tool#batch-actions)).
3741
38The Python and TypeScript SDKs include a class that passes these calls to your desktop code and asks your approval callback. See [Browser and computer use with the SDK toolsets](https://platform.claude.com/docs/en/agents-and-tools/tool-use/browser-use-sdk#computer-toolset).
39
4042For tasks that stay inside webpages, the [browser use tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/browser-use-tool) is the closer fit: its member tools read and act on the page itself, and it doesn't need a full desktop environment.
4143
4244<Note>
from line 2230
22282230## Next steps
22292231
22302232<CardGroup cols={2}>
2231 <Card title="Browser and computer use with the SDK toolsets" icon="code" href="https://platform.claude.com/docs/en/agents-and-tools/tool-use/browser-use-sdk#computer-toolset">
2232 Write a desktop driver in Python or TypeScript. The SDK runs the loop and the approval callback you pass.
2233 <Card title="Computer toolset in the SDKs" icon="code" href="https://platform.claude.com/docs/en/agents-and-tools/tool-use/browser-use-sdk#computer-toolset">
2234 Start from a partner's driver, or write your own in Python or TypeScript. The SDK runs the loop and the approval callback you pass.
22332235 </Card>
22342236
22352237 <Card title="Troubleshooting tool use" icon="wrench" href="https://platform.claude.com/docs/en/agents-and-tools/tool-use/troubleshooting-tool-use">
build-with-claude/claude-platform-on-aws Changed · +20 / -20 lines
from line 804
804804
805805The **Through AWS gateway** column indicates whether the page reads and writes data through the AWS gateway (and is therefore governed by [IAM actions](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions)). Pages marked **No** read organization-level metadata directly from Anthropic and bypass IAM action checks.
806806
807| Page | Available | Through AWS gateway | Notes |
808| --------------------- | ------------- | ------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
809| **Usage** | Yes | No | View token usage by model, workspace, and dimension. Data can take a few minutes to appear after a request. |
810| **Cost** | Yes | No | View cost breakdowns by model and workspace. AWS Cost Explorer shows the aggregated [Claude Consumption Unit (CCU)](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#billing) line item. |
811| **Rate limits** | Yes | No | View rate limits (read-only). Tier increases go through your Anthropic account representative; see [Rate limits and quotas](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#rate-limits-and-quotas). |
812| **Workspaces** | Yes | Yes (except spend limits) | View per-region workspaces. With the Admin role, you can also create, rename, and archive workspaces, and set per-workspace [spend limits](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#spend-limits). |
813| **Encryption keys** | Yes | Yes | Under **Settings → Encryption keys**, register AWS KMS keys for [CMEK](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#claude-platform-on-aws) (Admin role). To attach a registered key to a workspace, go to [Manage → Security](https://platform.claude.com/settings/workspaces/default/security-compliance) and select the workspace in the workspace picker at the top of the sidebar. |
814| **Files** | Yes | Yes | View and manage uploaded files. |
815| **Skills** | Yes | Yes | View and manage Agent Skills. |
816| **Batches** | Yes | Yes | View and manage batch processing jobs. |
817| **Agents** | Yes | Yes | View and manage agent definitions. |
818| **Sessions** | Yes | Yes | View agent sessions and event history. |
819| **Environments** | Yes | Yes | View and manage cloud sandbox configurations for sessions. |
820| **Credential vaults** | Yes | Yes | View and manage credential vaults for session authentication. |
821| **Memory stores** | Yes | Yes | View and manage persistent agent memory. |
822| **Webhooks** | Yes | Yes | View and manage webhook endpoints under **Settings → Webhooks**. |
823| **API keys** | No | N/A | Manage API keys in the AWS Console (**Claude Platform on AWS → API keys**). See [API key authentication](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#api-key-authentication). |
824| **Members** | No | N/A | Not applicable. AWS IAM manages access. |
825| **Billing** | Yes (limited) | No | Set an organization monthly spend limit; see [Spend limits](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#spend-limits). AWS Marketplace manages invoicing. View cost breakdowns on the Cost page. |
826| **Claude Code** | No | N/A | View Claude Code usage on the Usage page. |
807| Page | Available | Through AWS gateway | Notes |
808| --------------------- | ------------- | ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
809| **Usage** | Yes | No | View token usage by model, workspace, and dimension. Data can take a few minutes to appear after a request. |
810| **Cost** | Yes | No | View cost breakdowns by model and workspace. AWS Cost Explorer shows the aggregated [Claude Consumption Unit (CCU)](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#billing) line item. |
811| **Rate limits** | Yes | No | View rate limits (read-only). Tier increases go through your Anthropic account representative; see [Rate limits and quotas](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#rate-limits-and-quotas). |
812| **Workspaces** | Yes | Yes (except spend limits) | View per-region workspaces. With the Admin role, you can also create, rename, and archive workspaces, and set per-workspace [spend limits](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#spend-limits). |
813| **Encryption keys** | Yes | Yes | A section of the [Data retention](https://platform.claude.com/settings/privacy#encryption-keys) page (`platform.claude.com/settings/privacy`), shown while **Organization** is selected in the dropdown menu at the top of the page. Register AWS KMS keys for [CMEK](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#claude-platform-on-aws) there (Admin role). To attach a registered key to a workspace, select the workspace from that dropdown menu, then select the key under **Encryption key**. |
814| **Files** | Yes | Yes | View and manage uploaded files. |
815| **Skills** | Yes | Yes | View and manage Agent Skills. |
816| **Batches** | Yes | Yes | View and manage batch processing jobs. |
817| **Agents** | Yes | Yes | View and manage agent definitions. |
818| **Sessions** | Yes | Yes | View agent sessions and event history. |
819| **Environments** | Yes | Yes | View and manage cloud sandbox configurations for sessions. |
820| **Credential vaults** | Yes | Yes | View and manage credential vaults for session authentication. |
821| **Memory stores** | Yes | Yes | View and manage persistent agent memory. |
822| **Webhooks** | Yes | Yes | View and manage webhook endpoints under **Settings → Webhooks**. |
823| **API keys** | No | N/A | Manage API keys in the AWS Console (**Claude Platform on AWS → API keys**). See [API key authentication](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#api-key-authentication). |
824| **Members** | No | N/A | Not applicable. AWS IAM manages access. |
825| **Billing** | Yes (limited) | No | Set an organization monthly spend limit; see [Spend limits](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#spend-limits). AWS Marketplace manages invoicing. View cost breakdowns on the Cost page. |
826| **Claude Code** | No | N/A | View Claude Code usage on the Usage page. |
827827
828828### Switching organizations
829829
build-with-claude/vision-coordinates Changed · +6 / -2 lines
from line 122
122122 */
123123 function roundTiesToEven(value: number): number {
124124 const floor = Math.floor(value);
125 if (value - floor !== 0.5) return Math.round(value);
125 if (value - floor !== 0.5) {
126 return Math.round(value);
127 }
126128 return floor % 2 === 0 ? floor : floor + 1;
127129 }
128130
from line 146
144146 Math.ceil(h / 28) * 28 <= maxEdge &&
145147 countImageTokens(w, h) <= maxTokens;
146148
147 if (fits(width, height)) return [width, height];
149 if (fits(width, height)) {
150 return [width, height];
151 }
148152 if (height > width) {
149153 const [resizedH, resizedW] = resizedSize(height, width, maxEdge, maxTokens);
150154 return [resizedW, resizedH];
manage-claude/api-and-data-retention Changed · +3 / -3 lines
from line 142
142142Organizations with a ZDR arrangement can make these models available in a specific workspace by enabling 30-day retention for that workspace only. Other workspaces in the organization keep zero data retention.
143143
144144<Steps>
145 <Step title="Open the workspace's privacy controls">
146 In [Claude Console > Settings > Workspaces](https://platform.claude.com/settings/workspaces), select the workspace. In the panel that opens, click **Security** to open the workspace's Security page. Under **Data retention**, click **Manage in Privacy controls**.
145 <Step title="Open the workspace's data retention settings">
146 In the Claude Console, go to the [Data retention](https://platform.claude.com/settings/privacy) page (`platform.claude.com/settings/privacy`) and select the workspace from the dropdown menu at the top of the page.
147147 </Step>
148148
149149 <Step title="Turn on 30-day data retention">
150 Enable the 30-day data retention setting for the workspace.
150 Select **Standard data retention** (30-day retention) and click **Save**. A confirmation dialog box then asks you to review and accept the terms that apply to data retention for the workspace. Data retention turns on for the workspace only after you accept them.
151151 </Step>
152152
153153 <Step title="Verify">
manage-claude/cmek-aws-kms Changed · +8 / -8 lines
from line 196
196196 </Note>
197197
198198 <Note>
199 **Finding your compartment ID:** Each workspace has a compartment ID that scopes its CMEK data. To find it in the Claude Console, go to [Manage > Security](https://platform.claude.com/settings/workspaces/default/security-compliance) and select the workspace in the workspace picker at the top of the sidebar. The ID is under **Encryption key**, in the **Compartment ID** field. You can also read the `compartment_id` field returned by the [Get Workspace](https://platform.claude.com/docs/en/api/organization/workspaces/retrieve) endpoint.
199 **Finding your compartment ID:** Each workspace has a compartment ID that scopes its CMEK data. To find it in the Claude Console, go to the [Data retention](https://platform.claude.com/settings/privacy) page (`platform.claude.com/settings/privacy`) and select the workspace from the dropdown menu at the top of the page. The ID is under **Encryption key**, in the **Compartment ID** field. You can also read the `compartment_id` field returned by the [Get Workspace](https://platform.claude.com/docs/en/api/organization/workspaces/retrieve) endpoint.
200200 </Note>
201201
202202 You can set up the key in the Claude Console or through the Admin API, with the same result.
from line 205
205205 <Tab title="Claude Console">
206206 <Steps>
207207 <Step title="Register the key with Anthropic">
208 In the Claude Console, open **Settings > Encryption keys** and click **Add key**. Enter a display name, choose **AWS KMS**, and click **Continue**. Paste the key ARN into **KMS key ARN**, and click **Add**.
208 In the Claude Console, go to the [Data retention](https://platform.claude.com/settings/privacy#encryption-keys) page (`platform.claude.com/settings/privacy`). If you don't see **Encryption keys**, select **Organization** from the dropdown menu at the top of the page. Under **Encryption keys**, click **Add key**. Enter a display name, choose **AWS KMS**, and click **Continue**. Paste the key ARN into **KMS key ARN**, and click **Add**.
209209
210210 The key details step shows your organization ID. Add it to the [key policy](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#key-policy) before you click **Add**.
211211 </Step>
212212
213213 <Step title="Validate the key">
214 On the **Encryption keys** page, click **Verify** next to the key. **Connected** appears when the check passes. If it fails, a message gives the reason.
214 In the **Encryption keys** list, click **Verify** next to the key. **Connected** appears when the check passes. If it fails, a message gives the reason.
215215 </Step>
216216
217217 <Step title="Attach the key to a workspace">
218 In the Claude Console, go to [Manage > Security](https://platform.claude.com/settings/workspaces/default/security-compliance) and select the workspace in the workspace picker at the top of the sidebar. Under **Encryption key**, select the key, click **Save**, and confirm. Attaching a key can't be undone. For a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).
218 In the Claude Console, go to the [Data retention](https://platform.claude.com/settings/privacy) page (`platform.claude.com/settings/privacy`) and select the workspace from the dropdown menu at the top of the page. Under **Encryption key**, select the key, click **Save**, and confirm. Attaching a key can't be undone. For a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).
219219 </Step>
220220 </Steps>
221221 </Tab>
from line 630
630630
631631* The AWS account that hosts your Claude Platform on AWS organization, with permissions to create KMS keys and set key policies (`kms:CreateKey` and `kms:PutKeyPolicy`).
632632* The **Admin** role in the Claude Console for Claude Platform on AWS. See [Using the Claude Console](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#using-the-claude-console).
633* For the IAM principal you sign in to the Claude Console with: besides `aws-external-anthropic:AssumeConsole`, the [IAM actions](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#encryption-keys) for the operations you perform there, because the Encryption keys page and key attachment go through the AWS gateway. Registering a key is `RegisterKey` (with `ListKeys` and `GetKey` to view registrations), and attaching one is `UpdateWorkspace` or `CreateWorkspace`. The external key actions (and `CreateWorkspace`) are account-scoped, so grant them on `Resource: "*"`; a policy limited to workspace ARNs does not include them.
633* For the IAM principal you sign in to the Claude Console with: besides `aws-external-anthropic:AssumeConsole`, the [IAM actions](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#encryption-keys) for the operations you perform there, because registering, listing, and attaching keys go through the AWS gateway. Registering a key is `RegisterKey` (with `ListKeys` and `GetKey` to view registrations), and attaching one is `UpdateWorkspace` or `CreateWorkspace`. The external key actions (and `CreateWorkspace`) are account-scoped, so grant them on `Resource: "*"`; a policy limited to workspace ARNs does not include them.
634634* For the IAM principal that attaches the key to a workspace (the identity you signed in to the Claude Console with): `kms:DescribeKey`, `kms:Encrypt`, and `kms:Decrypt` on the key. Your principal's access to the key is checked when you attach it, in addition to the service principal's.
635635* Optional, for the key picker in the Claude Console: `kms:ListKeys` and `kms:DescribeKey` for the principal you sign in with. Without them, paste the key ARN instead.
636636
from line 638
638638
639639The key policy has three statements: your account's root admin statement; a statement that lets the Claude Platform on AWS service principal encrypt, decrypt, and generate data keys; and a separate statement for `kms:DescribeKey`. The crypto statement carries an optional `EncryptionContext` condition that binds the key to the workspaces you list. `DescribeKey` is granted separately because it has no `EncryptionContext` parameter, so an `EncryptionContext` condition on that action would always deny.
640640
641If you plan to use the optional `EncryptionContext` condition shown here, create the workspace first (without a key), copy its compartment ID, and substitute it for `<compartment-uuid>`. To find the ID in the Claude Console, go to [Manage > Security](https://platform.claude.com/settings/workspaces/default/security-compliance) and select the workspace in the workspace picker at the top of the sidebar. The ID is under **Encryption key**, in the **Compartment ID** field. You can also read it from the `compartment_id` field returned by the [Get Workspace](https://platform.claude.com/docs/en/api/organization/workspaces/retrieve) endpoint. If you don't plan to use the condition, delete the `Condition` block from that statement.
641If you plan to use the optional `EncryptionContext` condition shown here, create the workspace first (without a key), copy its compartment ID, and substitute it for `<compartment-uuid>`. To find the ID in the Claude Console, go to the [Data retention](https://platform.claude.com/settings/privacy) page (`platform.claude.com/settings/privacy`) and select the workspace from the dropdown menu at the top of the page. The ID is under **Encryption key**, in the **Compartment ID** field. You can also read it from the `compartment_id` field returned by the [Get Workspace](https://platform.claude.com/docs/en/api/organization/workspaces/retrieve) endpoint. If you don't plan to use the condition, delete the `Condition` block from that statement.
642642
643643```bash
644644export YOUR_ACCOUNT=$(aws sts get-caller-identity --query Account --output text)
from line 694
694694
695695<Steps>
696696 <Step title="Register the key">
697 In the Claude Console, open **Settings > Encryption keys** and click **Add key**. Enter a display name, then choose the key from the key picker or choose **Enter ARN manually** and paste the key ARN, and click **Add**. The key must be in the AWS account that hosts your organization; cross-account keys are not supported. The picker lists the enabled, customer-managed, symmetric, single-region keys in your account in one of your organization's regions; for a key the picker doesn't list, enter the ARN. It lists keys only if the principal you signed in with can call `kms:ListKeys` and `kms:DescribeKey`.
697 In the Claude Console, go to the [Data retention](https://platform.claude.com/settings/privacy#encryption-keys) page (`platform.claude.com/settings/privacy`). If you don't see **Encryption keys**, select **Organization** from the dropdown menu at the top of the page. Under **Encryption keys**, click **Add key**. Enter a display name, then choose the key from the key picker or choose **Enter ARN manually** and paste the key ARN, and click **Add**. The key must be in the AWS account that hosts your organization; cross-account keys are not supported. The picker lists the enabled, customer-managed, symmetric, single-region keys in your account in one of your organization's regions; for a key the picker doesn't list, enter the ARN. It lists keys only if the principal you signed in with can call `kms:ListKeys` and `kms:DescribeKey`.
698698 </Step>
699699
700700 <Step title="Attach the key to a workspace">
701 Attach the key to a new workspace before you send any requests to that workspace. For a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works). In the Claude Console, go to [Manage > Security](https://platform.claude.com/settings/workspaces/default/security-compliance) and select the workspace in the workspace picker at the top of the sidebar. Under **Encryption key**, select the key, click **Save**, and confirm. You can also select a key when you create a workspace in the Claude Console, but only if your key policy does not yet name specific workspaces (no `EncryptionContext` condition), because the workspace's compartment ID is assigned at creation. Once attached, a workspace's key can't be changed.
701 Attach the key to a new workspace before you send any requests to that workspace. For a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works). In the Claude Console, go to the [Data retention](https://platform.claude.com/settings/privacy) page (`platform.claude.com/settings/privacy`) and select the workspace from the dropdown menu at the top of the page. Under **Encryption key**, select the key, click **Save**, and confirm. You can also select a key when you create a workspace in the Claude Console, but only if your key policy does not yet name specific workspaces (no `EncryptionContext` condition), because the workspace's compartment ID is assigned at creation. Once attached, a workspace's key can't be changed.
702702
703703 This is when the key is validated: the attach call checks your principal's access to the key and performs an encrypt/decrypt round against it with the workspace's compartment ID as the encryption context, so a problem with either the key policy or your principal's permissions surfaces as an error on that call. If the attach fails with a KMS access error, check the following:
704704
manage-claude/cmek-azure-key-vault Changed · +3 / -3 lines
from line 164
164164 <Tab title="Claude Console">
165165 <Steps>
166166 <Step title="Register the key with Anthropic">
167 In the Claude Console, open **Settings > Encryption keys** and click **Add key**. Enter a display name, choose **Azure Key Vault**, and click **Continue**. Fill in **Vault URI**, **Key name**, and **Tenant ID**, and click **Add**.
167 In the Claude Console, go to the [Data retention](https://platform.claude.com/settings/privacy#encryption-keys) page (`platform.claude.com/settings/privacy`). If you don't see **Encryption keys**, select **Organization** from the dropdown menu at the top of the page. Under **Encryption keys**, click **Add key**. Enter a display name, choose **Azure Key Vault**, and click **Continue**. Fill in **Vault URI**, **Key name**, and **Tenant ID**, and click **Add**.
168168
169169 The key details step shows the organization tag. Add it to the key, as [the create step](https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault#organization-tag) describes, before you click **Add**.
170170 </Step>
171171
172172 <Step title="Validate the key">
173 On the **Encryption keys** page, click **Verify** next to the key. **Connected** appears when the check passes. If it fails, a message gives the reason.
173 In the **Encryption keys** list, click **Verify** next to the key. **Connected** appears when the check passes. If it fails, a message gives the reason.
174174 </Step>
175175
176176 <Step title="Attach the key to a workspace">
177 In the Claude Console, go to [Manage > Security](https://platform.claude.com/settings/workspaces/default/security-compliance) and select the workspace in the workspace picker at the top of the sidebar. Under **Encryption key**, select the key, click **Save**, and confirm. Attaching a key can't be undone. For a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).
177 In the Claude Console, go to the [Data retention](https://platform.claude.com/settings/privacy) page (`platform.claude.com/settings/privacy`) and select the workspace from the dropdown menu at the top of the page. Under **Encryption key**, select the key, click **Save**, and confirm. Attaching a key can't be undone. For a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).
178178 </Step>
179179 </Steps>
180180 </Tab>
manage-claude/cmek-google-cloud-kms Changed · +3 / -3 lines
from line 155
155155 <Tab title="Claude Console">
156156 <Steps>
157157 <Step title="Register the key with Anthropic">
158 In the Claude Console, open **Settings > Encryption keys** and click **Add key**. Enter a display name, choose **Google Cloud KMS**, and click **Continue**. Paste the full key resource name into **Key resource name**, and click **Add**.
158 In the Claude Console, go to the [Data retention](https://platform.claude.com/settings/privacy#encryption-keys) page (`platform.claude.com/settings/privacy`). If you don't see **Encryption keys**, select **Organization** from the dropdown menu at the top of the page. Under **Encryption keys**, click **Add key**. Enter a display name, choose **Google Cloud KMS**, and click **Continue**. Paste the full key resource name into **Key resource name**, and click **Add**.
159159
160160 The key details step shows the organization label. Add it to the key, as [the create step](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#organization-label) describes, before you click **Add**.
161161 </Step>
162162
163163 <Step title="Validate the key">
164 On the **Encryption keys** page, click **Verify** next to the key. **Connected** appears when the check passes. If it fails, a message gives the reason.
164 In the **Encryption keys** list, click **Verify** next to the key. **Connected** appears when the check passes. If it fails, a message gives the reason.
165165 </Step>
166166
167167 <Step title="Attach the key to a workspace">
168 In the Claude Console, go to [Manage > Security](https://platform.claude.com/settings/workspaces/default/security-compliance) and select the workspace in the workspace picker at the top of the sidebar. Under **Encryption key**, select the key, click **Save**, and confirm. Attaching a key can't be undone. For a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).
168 In the Claude Console, go to the [Data retention](https://platform.claude.com/settings/privacy) page (`platform.claude.com/settings/privacy`) and select the workspace from the dropdown menu at the top of the page. Under **Encryption key**, select the key, click **Save**, and confirm. Attaching a key can't be undone. For a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).
169169 </Step>
170170 </Steps>
171171 </Tab>
managed-agents/event-deltas Changed · +6 / -2 lines
from line 252
252252 // 1. Note the announced id and open the snapshot. Deltas and the
253253 // buffered event carry the same id.
254254 const preview = accumulateManagedAgentsEvent(undefined, event);
255 if (preview) previews.set(event.event.id, preview);
255 if (preview) {
256 previews.set(event.event.id, preview);
257 }
256258 console.log(`event_start ${event.event.type} ${event.event.id}`);
257259 break;
258260 }
from line 754
752754 break;
753755 }
754756 }
755 if (!childThreadId) throw new Error("No child thread found");
757 if (!childThreadId) {
758 throw new Error("No child thread found");
759 }
756760
757761 // The child thread's stream takes the same event_deltas parameter as the
758762 // session stream.
managed-agents/events-and-streaming Changed · +18 / -6 lines
from line 417
417417 // Tail live events, skipping anything already seen
418418 tail: for await (const event of stream) {
419419 // Preview events (event_start/event_delta) carry no top-level id
420 if (event.type === "event_start" || event.type === "event_delta") continue;
421 if (seenEventIds.has(event.id)) continue;
420 if (event.type === "event_start" || event.type === "event_delta") {
421 continue;
422 }
423 if (seenEventIds.has(event.id)) {
424 continue;
425 }
422426 seenEventIds.add(event.id);
423427 switch (event.type) {
424428 case "agent.message":
from line 862
858862 break;
859863 }
860864 case "session.status_idle":
861 if (event.stop_reason.type === "end_turn") break loop;
865 if (event.stop_reason.type === "end_turn") {
866 break loop;
867 }
862868 break;
863869 }
864870 }
from line 1106
11001106 const stream = await client.beta.sessions.events.stream(session.id);
11011107
11021108 for await (const event of stream) {
1103 if (event.type !== "session.status_idle") continue;
1104 if (event.stop_reason.type === "end_turn") break;
1105 if (event.stop_reason.type !== "requires_action") continue;
1109 if (event.type !== "session.status_idle") {
1110 continue;
1111 }
1112 if (event.stop_reason.type === "end_turn") {
1113 break;
1114 }
1115 if (event.stop_reason.type !== "requires_action") {
1116 continue;
1117 }
11061118
11071119 for (const eventId of event.stop_reason.event_ids) {
11081120 // Approve the pending tool call
manage-claude/plugins-api Changed · +3 / -1 lines
from line 1866
18661866 const response = await client.beta.organization.plugins.versions.download(versionId, {
18671867 plugin_id: pluginId
18681868 });
1869 if (!response.body) throw new Error("The download returned no body");
1869 if (!response.body) {
1870 throw new Error("The download returned no body");
1871 }
18701872
18711873 await writeFile(`${pluginId}_${versionId}.zip`, response.body);
18721874 ```
managed-agents/workflow-runs Changed · +3 / -1 lines
from line 299
299299 } catch (error) {
300300 // The server refuses a result that comes too late, after it
301301 // archived the call's thread. Keep following the run.
302 if (!(error instanceof Anthropic.BadRequestError)) throw error;
302 if (!(error instanceof Anthropic.BadRequestError)) {
303 throw error;
304 }
303305 console.log(` Answer to ${event.name} refused: ${error.message}`);
304306 }
305307 break;
test-and-evaluate/develop-tests Changed · +3 / -1 lines
from line 743
743743 }
744744 const lcs = lcsLengths[candidateWords.length][referenceWords.length];
745745
746 if (lcs === 0) return 0;
746 if (lcs === 0) {
747 return 0;
748 }
747749 const precision = lcs / candidateWords.length;
748750 const recall = lcs / referenceWords.length;
749751 return (2 * precision * recall) / (precision + recall);