One read of Claude Developer Platformapi-20261014T180738Z
13 pages moved out of 763 read.
Pages moved
13
significant first
Pages read
763
in this capture
Captured
18:07 UTC
Corpus hash
2a82c3c785b8
corpus-hash
What this read moved
1-13 of 13agents-and-tools/mcp-connector Changed · +4 / -4 lines
from line 1234
12341234 <Tabs>
12351235 <Tab title="Gradle">
12361236 ```kotlin
1237 implementation("com.anthropic:anthropic-java:2.71.0")
1238 implementation("com.anthropic:anthropic-java-mcp:2.71.0")
1237 implementation("com.anthropic:anthropic-java:2.72.0")
1238 implementation("com.anthropic:anthropic-java-mcp:2.72.0")
12391239 ```
12401240 </Tab>
12411241
from line 1244
12441244 <dependency>
12451245 <groupId>com.anthropic</groupId>
12461246 <artifactId>anthropic-java</artifactId>
1247 <version>2.71.0</version>
1247 <version>2.72.0</version>
12481248 </dependency>
12491249 <dependency>
12501250 <groupId>com.anthropic</groupId>
12511251 <artifactId>anthropic-java-mcp</artifactId>
1252 <version>2.71.0</version>
1252 <version>2.72.0</version>
12531253 </dependency>
12541254 ```
12551255 </Tab>
api/claude-platform-on-aws-iam-actions Changed · +46 / -10 lines
### Telemetry destinations
from line 250
250250 `ListComplianceActivities` is account-scoped, like `ListWorkspaces`. Specifying a workspace ARN on this action has no effect; use `Resource: "*"`.
251251</Note>
252252
253### Telemetry destinations
254
255| Action | Routes authorized |
256| ------------------------------------------- | -------------------------------------------------------------------------------- |
257| `CreateAccountTelemetryDestination` | `POST /v1/organizations/telemetry_destinations` |
258| `GetAccountTelemetryDestination` | `GET /v1/organizations/telemetry_destinations/{id}` |
259| `ListAccountTelemetryDestinations` | `GET /v1/organizations/telemetry_destinations` |
260| `UpdateAccountTelemetryDestination` | `POST /v1/organizations/telemetry_destinations/{id}` |
261| `DeleteAccountTelemetryDestination` | `DELETE /v1/organizations/telemetry_destinations/{id}` |
262| `TestAccountTelemetryDestination` | `POST /v1/organizations/telemetry_destinations/{id}/test` |
263| `ListAccountTelemetryDestinationWorkspaces` | `GET /v1/organizations/telemetry_destinations/{id}/workspaces` |
264| `AddTelemetryDestinationWorkspace` | `POST /v1/organizations/telemetry_destinations/{id}/workspaces/{workspace_id}` |
265| `RemoveTelemetryDestinationWorkspace` | `DELETE /v1/organizations/telemetry_destinations/{id}/workspaces/{workspace_id}` |
266
267<Note>
268 All of these actions except `AddTelemetryDestinationWorkspace` and `RemoveTelemetryDestinationWorkspace` are account-scoped, so a workspace ARN on them has no effect. Use `Resource: "*"`. A destination can export telemetry from every workspace in the organization, in every region. Grant `CreateAccountTelemetryDestination` and `UpdateAccountTelemetryDestination` only to principals you trust with all of that telemetry.
269</Note>
270
271<Note>
272 `AddTelemetryDestinationWorkspace` and `RemoveTelemetryDestinationWorkspace` apply to the workspace in the route, and only on a destination whose **Workspaces** option is **Selected**. To change an **All except** list, use `UpdateAccountTelemetryDestination`. A policy that denies `aws-external-anthropic:Create*`, `Update*`, or `Delete*` still allows adding and removing workspaces. To block every change to destinations, also deny `AddTelemetryDestinationWorkspace` and `RemoveTelemetryDestinationWorkspace`.
273</Note>
274
253275### Authentication
254276
255277| Action | Routes authorized |
from line 290
268290
269291## Route-to-action mapping
270292
271The following table lists every route on Claude Platform on AWS and the IAM action required to call it. Each IAM action also authorizes requests that use the `anthropic-beta` header; beta variants of a route do not require a separate IAM action. CloudTrail classifies each action as either a Data event (high-volume, data-plane operations) or a Management event (control-plane operations). Vault and webhook actions are classified as Management events because they hold secrets (vault credentials and webhook signing secrets) and benefit from default-on audit logging. Workspace, external key, and compliance actions are also classified as Management events because they are organization-scoped control-plane operations. All other actions, including inference, batch, model, file, skill, user profile, and the remaining Claude Managed Agents actions, are classified as Data events.
293The following tables list every route on Claude Platform on AWS and the IAM action required to call it. Each IAM action also authorizes requests that use the `anthropic-beta` header; beta variants of a route do not require a separate IAM action. CloudTrail classifies each action as either a Data event (high-volume, data-plane operations) or a Management event (control-plane operations). Vault and webhook actions are classified as Management events because they hold secrets (vault credentials and webhook signing secrets) and benefit from default-on audit logging. Workspace, external key, telemetry destination, and compliance actions are also classified as Management events because they are organization-scoped control-plane operations. All other actions, including inference, batch, model, file, skill, user profile, and the remaining Claude Managed Agents actions, are classified as Data events.
272294
273295| Method | Route | IAM action | CloudTrail event type |
274296| -------- | ---------------------------------------------------- | -------------------------------- | --------------------- |
from line 401
379401| `DELETE` | `/v1/webhooks/{id}` | `DeleteWebhook` | Management |
380402| `POST` | `/v1/webhooks/{id}/regenerate_signing_secret` | `RotateWebhookSecret` | Management |
381403
382Routes not in this table are not available on Claude Platform on AWS. The gateway denies any route not listed here by default.
404The telemetry destination routes are also available on Claude Platform on AWS:
383405
406| Method | Route | IAM action | CloudTrail event type |
407| -------- | ------------------------------------------------------------------------- | ------------------------------------------- | --------------------- |
408| `POST` | `/v1/organizations/telemetry_destinations` | `CreateAccountTelemetryDestination` | Management |
409| `GET` | `/v1/organizations/telemetry_destinations` | `ListAccountTelemetryDestinations` | Management |
410| `GET` | `/v1/organizations/telemetry_destinations/{id}` | `GetAccountTelemetryDestination` | Management |
411| `POST` | `/v1/organizations/telemetry_destinations/{id}` | `UpdateAccountTelemetryDestination` | Management |
412| `DELETE` | `/v1/organizations/telemetry_destinations/{id}` | `DeleteAccountTelemetryDestination` | Management |
413| `POST` | `/v1/organizations/telemetry_destinations/{id}/test` | `TestAccountTelemetryDestination` | Management |
414| `GET` | `/v1/organizations/telemetry_destinations/{id}/workspaces` | `ListAccountTelemetryDestinationWorkspaces` | Management |
415| `POST` | `/v1/organizations/telemetry_destinations/{id}/workspaces/{workspace_id}` | `AddTelemetryDestinationWorkspace` | Management |
416| `DELETE` | `/v1/organizations/telemetry_destinations/{id}/workspaces/{workspace_id}` | `RemoveTelemetryDestinationWorkspace` | Management |
417
418Routes not in these tables are not available on Claude Platform on AWS. The gateway denies any route not listed here by default.
419
384420<Note>
385 Workspace and external key routes are the only Admin API routes available on Claude Platform on AWS. You can also create, update, or archive workspaces in the AWS Console or, with the Admin role, in the Claude Console. Encryption keys can also be registered and attached in the Claude Console.
421 Workspace, external key, and telemetry destination routes are the only Admin API routes available on Claude Platform on AWS. You can also create, update, or archive workspaces in the AWS Console or, with the Admin role, in the Claude Console. Encryption keys can also be registered and attached in the Claude Console.
386422</Note>
387423
388424## Managed policies
from line 433
397433| `AnthropicLimitedAccess` | All `AnthropicInferenceAccess` actions, plus all Claude Managed Agents actions (agents, sessions, environments, vaults, memory stores, webhooks, and self-hosted environment work) |
398434| `AnthropicSelfHostedEnvironmentAccess` | `GetEnvironment`, `ProcessEnvironmentWork`, `GetSession`, `UpdateSession`, `GetSkill`, `CallWithBearerToken` |
399435
400`AnthropicInferenceAccess` is the narrowest managed policy sufficient to run inference. It covers both synchronous and batch inference and, through the `Get*` and `List*` wildcards, grants read access to every API resource in the namespace, including Claude Managed Agents (CMA) resources (agents, sessions, environments, vaults, memory stores, and webhooks). This includes file content download through `GetFile` (see the [Files](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#files) note), skill content download through `GetSkill` (see the [Skills](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#skills) note), and memory contents through `GetMemoryStore`. Vault credential secrets and webhook signing secrets are not exposed: those fields are write-only and are never returned by `GetVault` or `GetWebhook` (see [Authenticate with vaults](https://platform.claude.com/docs/en/managed-agents/vaults)). `AnthropicInferenceAccess` does not grant file creation or deletion, skill management, user profile management, workspace mutation, encryption key management, or any Claude Managed Agents write action (create, update, archive, delete, process, or rotate). To exclude CMA reads, replace `AnthropicInferenceAccess` with a custom policy that enumerates only the specific non-CMA actions you need.
436`AnthropicInferenceAccess` is the narrowest managed policy sufficient to run inference. It covers both synchronous and batch inference and, through the `Get*` and `List*` wildcards, grants read access to every API resource in the namespace, including Claude Managed Agents (CMA) resources (agents, sessions, environments, vaults, memory stores, and webhooks). This includes file content download through `GetFile` (see the [Files](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#files) note), skill content download through `GetSkill` (see the [Skills](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#skills) note), and memory contents through `GetMemoryStore`. Vault credential secrets and webhook signing secrets are not exposed: those fields are write-only and are never returned by `GetVault` or `GetWebhook` (see [Authenticate with vaults](https://platform.claude.com/docs/en/managed-agents/vaults)). `AnthropicInferenceAccess` does not grant file creation or deletion, skill management, user profile management, workspace mutation, encryption key management, telemetry destination management, or any Claude Managed Agents write action (create, update, archive, delete, process, or rotate). To exclude CMA reads, replace `AnthropicInferenceAccess` with a custom policy that enumerates only the specific non-CMA actions you need.
401437
402438<Note>
403 `AnthropicReadOnlyAccess`, `AnthropicInferenceAccess`, and `AnthropicLimitedAccess` all carry the `Get*` and `List*` wildcards, which grant read access to all content in the workspace: file bytes, skill content, batch results, session conversation history, and memory contents. The wildcards also grant `GetKey` and `ListKeys`, which read the organization's registered encryption key configurations (key ARNs and metadata, never key material). They also grant the account-scoped `GetUserProfile` and `ListUserProfiles`, which read user profiles. The `List*` wildcard also grants `ListComplianceActivities`, which reads the organization's compliance [Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed) once the Compliance API is enabled for the organization (see [Compliance](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#compliance)). Vault credential secrets and webhook signing secrets are not exposed; those fields are write-only and are never returned by `GetVault` or `GetWebhook`. If your principal should not read existing content, use a custom policy that enumerates only the actions you need.
439 `AnthropicReadOnlyAccess`, `AnthropicInferenceAccess`, and `AnthropicLimitedAccess` all carry the `Get*` and `List*` wildcards, which grant read access to all content in the workspace: file bytes, skill content, batch results, session conversation history, and memory contents. The wildcards also grant `GetKey` and `ListKeys`, which read the organization's registered encryption key configurations (key ARNs and metadata, never key material). They also grant the account-scoped `GetUserProfile` and `ListUserProfiles`, which read user profiles. The `List*` wildcard also grants `ListComplianceActivities`, which reads the organization's compliance [Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed) once the Compliance API is enabled for the organization (see [Compliance](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#compliance)). They also grant `GetAccountTelemetryDestination`, `ListAccountTelemetryDestinations`, and `ListAccountTelemetryDestinationWorkspaces`, which read the organization's telemetry destinations but never their header values. Vault credential secrets and webhook signing secrets are not exposed; those fields are write-only and are never returned by `GetVault` or `GetWebhook`. If your principal should not read existing content, use a custom policy that enumerates only the actions you need.
404440</Note>
405441
406442`AnthropicLimitedAccess` includes all Claude Managed Agents actions in addition to inference actions.
from line 506
470506```
471507
472508<Note>
473 The `aws-external-anthropic:*` wildcard in the first statement includes account-scoped actions (`CreateWorkspace`, `ListWorkspaces`, `ListComplianceActivities`, the external key actions, and the user profile actions) that the workspace ARN constraint silently filters out. This is consistent with the "isolation" intent (the role cannot create workspaces, enumerate workspaces, manage encryption key registrations, read the compliance Activity Feed, or read or manage user profiles; it can still attach an already-registered key to its own workspace through `UpdateWorkspace`), but the policy contains permissions that have no effect. If the role needs user profiles, add a separate `Allow` statement for the user profile actions with `Resource: "*"`. See [Provisioning automation](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#provisioning-automation) for the account-scoped pattern.
509 The `aws-external-anthropic:*` wildcard in the first statement includes account-scoped actions (`CreateWorkspace`, `ListWorkspaces`, `ListComplianceActivities`, the external key actions, the account-scoped telemetry destination actions, and the user profile actions) that the workspace ARN constraint silently filters out. This is consistent with the "isolation" intent (the role cannot create workspaces, enumerate workspaces, manage encryption key registrations, read the compliance Activity Feed, create, read, or change telemetry destinations, or read or manage user profiles; it can still attach an already-registered key to its own workspace through `UpdateWorkspace`, and add its own workspace to a destination, or remove it from one, given the destination's ID), but the policy contains permissions that have no effect. If the role needs user profiles, add a separate `Allow` statement for the user profile actions with `Resource: "*"`. See [Provisioning automation](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#provisioning-automation) for the account-scoped pattern.
474510
475511 `CallWithBearerToken` and `AssumeConsole` are route-less actions that do not bind to a workspace ARN. The second statement grants them on `Resource: "*"` so the role can authenticate with an API key and open the Claude Console. Omit this statement if the role uses SigV4 only and does not need Claude Console access.
476512</Note>
build-with-claude/claude-in-amazon-bedrock Changed · +4 / -4 lines
from line 102
102102 <Tabs>
103103 <Tab title="Gradle">
104104 ```kotlin
105 implementation("com.anthropic:anthropic-java:2.71.0")
106 implementation("com.anthropic:anthropic-java-bedrock:2.71.0")
105 implementation("com.anthropic:anthropic-java:2.72.0")
106 implementation("com.anthropic:anthropic-java-bedrock:2.72.0")
107107 ```
108108 </Tab>
109109
from line 112
112112 <dependency>
113113 <groupId>com.anthropic</groupId>
114114 <artifactId>anthropic-java</artifactId>
115 <version>2.71.0</version>
115 <version>2.72.0</version>
116116 </dependency>
117117 <dependency>
118118 <groupId>com.anthropic</groupId>
119119 <artifactId>anthropic-java-bedrock</artifactId>
120 <version>2.71.0</version>
120 <version>2.72.0</version>
121121 </dependency>
122122 ```
123123 </Tab>
build-with-claude/claude-on-vertex-ai Changed · +4 / -4 lines
from line 45
4545 <Tab title="Java">
4646 <CodeGroup exclude="shell, python, typescript, csharp, go, php, ruby">
4747 ```groovy Gradle
48 implementation("com.anthropic:anthropic-java:2.71.0")
49 implementation("com.anthropic:anthropic-java-vertex:2.71.0")
48 implementation("com.anthropic:anthropic-java:2.72.0")
49 implementation("com.anthropic:anthropic-java-vertex:2.72.0")
5050 ```
5151
5252 ```xml Maven
from line 53
5353 <dependency>
5454 <groupId>com.anthropic</groupId>
5555 <artifactId>anthropic-java</artifactId>
56 <version>2.71.0</version>
56 <version>2.72.0</version>
5757 </dependency>
5858 <dependency>
5959 <groupId>com.anthropic</groupId>
6060 <artifactId>anthropic-java-vertex</artifactId>
61 <version>2.71.0</version>
61 <version>2.72.0</version>
6262 </dependency>
6363 ```
6464
build-with-claude/claude-platform-on-aws Changed · +6 / -6 lines
from line 305
305305
306306 <Tab title="Java">
307307 ```kotlin Gradle
308 implementation("com.anthropic:anthropic-java:2.71.0")
309 implementation("com.anthropic:anthropic-java-aws:2.71.0")
308 implementation("com.anthropic:anthropic-java:2.72.0")
309 implementation("com.anthropic:anthropic-java-aws:2.72.0")
310310 ```
311311
312312 ```xml Maven
from line 313
313313 <dependency>
314314 <groupId>com.anthropic</groupId>
315315 <artifactId>anthropic-java</artifactId>
316 <version>2.71.0</version>
316 <version>2.72.0</version>
317317 </dependency>
318318 <dependency>
319319 <groupId>com.anthropic</groupId>
320320 <artifactId>anthropic-java-aws</artifactId>
321 <version>2.71.0</version>
321 <version>2.72.0</version>
322322 </dependency>
323323 ```
324324 </Tab>
from line 573
573573* **HIPAA readiness:** Anthropic's HIPAA-ready program is not available. See [API and data retention](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention).
574574* **Computer use and browser use toolsets:** `computer_toolset_20260801` and `browser_toolset_20260801` are not currently available on Claude Platform on AWS. The beta computer use tool versions remain available for the models listed under [Earlier tool versions](https://platform.claude.com/docs/en/agents-and-tools/tool-use/computer-use-tool#earlier-tool-versions).
575575
576- **Admin API:** Workspace endpoints (create, get, list, update, and archive on `/v1/organizations/workspaces`) and external key endpoints (register, get, list, update, and delete on `/v1/organizations/external_keys`, for [CMEK](https://platform.claude.com/docs/en/manage-claude/cmek); keys are validated when attached to a workspace rather than through a validate endpoint) are available. Other Admin API endpoints (organization members, workspace members, invites, API keys, usage reports, cost reports, and rate limit reports) are not currently available. View usage and cost data in the [Claude Console](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#using-the-claude-console) instead. AWS IAM manages organization membership.
576- **Admin API:** Workspace endpoints (create, get, list, update, and archive on `/v1/organizations/workspaces`) and external key endpoints (register, get, list, update, and delete on `/v1/organizations/external_keys`, for [CMEK](https://platform.claude.com/docs/en/manage-claude/cmek); keys are validated when attached to a workspace rather than through a validate endpoint), and the [telemetry destination endpoints](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#telemetry-destinations) are available. Other Admin API endpoints (organization members, workspace members, invites, API keys, usage reports, cost reports, and rate limit reports) are not currently available. View usage and cost data in the [Claude Console](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#using-the-claude-console) instead. AWS IAM manages organization membership.
577577- **Workspace member management:** Adding or removing users from individual workspaces is not available. AWS IAM policies on workspace ARNs control access.
578578- **Claude Code workspace and Analytics API:** The Claude Code workspace with automatic rate limits is not available. Claude Code usage appears in the general usage view rather than a dedicated screen.
579579- **OAuth authentication:** Not supported. Use SigV4 or API key authentication.
from line 864
864864
865865## Monitoring and logging
866866
867AWS CloudTrail can capture all requests to Claude Platform on AWS. Workspace, external key, compliance, vault, and webhook operations are logged as Management events by default. Inference, batch, file, skill, model, user profile, and Claude Managed Agents operations (other than vaults and webhooks) are classified as Data events and require explicit data event logging configuration, which incurs additional CloudTrail charges. See the [IAM actions reference](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#route-to-action-mapping) for the full event type classification and the [AWS CloudTrail documentation](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/) for configuration details.
867AWS CloudTrail can capture all requests to Claude Platform on AWS. Workspace, external key, telemetry destination, compliance, vault, and webhook operations are logged as Management events by default. Inference, batch, file, skill, model, user profile, and Claude Managed Agents operations (other than vaults and webhooks) are classified as Data events and require explicit data event logging configuration, which incurs additional CloudTrail charges. See the [IAM actions reference](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#route-to-action-mapping) for the full event type classification and the [AWS CloudTrail documentation](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/) for configuration details.
868868
869869### Request IDs
870870
release-notes/overview Changed · +4 / -0 lines
### October 14, 2026
from line 12
1212 For updates to Claude Code, see the [complete CHANGELOG.md](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md) in the `claude-code` repository.
1313</Tip>
1414
15### October 14, 2026
16
17* We've launched [OpenTelemetry export](https://platform.claude.com/docs/en/manage-claude/opentelemetry) in beta, so you can trace Messages API requests and Claude Managed Agents sessions in your observability backend. The Claude SDK emits spans in Python, TypeScript, C#, Go, Java, PHP, and Ruby. To get spans from the API, [add an OpenTelemetry destination](https://platform.claude.com/docs/en/manage-claude/opentelemetry/api#add-a-destination) in the Claude Console.
18
1519### October 9, 2026
1620
1721* You can now let a Claude Managed Agents agent use [dynamic workflows](https://platform.claude.com/docs/en/managed-agents/multiagent-orchestration#dynamic-workflows), in beta with the `managed-agents-2026-04-01` beta header. For work with many pieces, such as reviewing hundreds of documents, the agent can write a workflow. A workflow is a program that runs many agents in phases and combines their results. The server runs it in the background as a workflow run. To [turn dynamic workflows on](https://platform.claude.com/docs/en/managed-agents/multiagent-orchestration#turn-on-dynamic-workflows), set the agent's `multiagent` field to `{"type": "multiagent_20261001", "workflows": {"type": "enabled"}}`. To guide the agent, tell it in its system prompt when to start a run. Follow each run through `workflow_run.*` events on the session's event stream. See [Workflow runs](https://platform.claude.com/docs/en/managed-agents/workflow-runs).
cli-sdks-libraries/cli/quickstart Changed · +1 / -1 lines
from line 32
3232 For Linux environments, download the release binary directly.
3333
3434 ```bash
35 VERSION=1.40.0
35 VERSION=1.41.0
3636 OS=$(uname -s | tr '[:upper:]' '[:lower:]')
3737 case $(uname -m) in
3838 x86_64) ARCH=amd64 ;;
cli-sdks-libraries/sdks/java Changed · +2 / -2 lines
from line 15
1515<Tabs>
1616 <Tab title="Gradle">
1717 ```kotlin
18 implementation("com.anthropic:anthropic-java:2.71.0")
18 implementation("com.anthropic:anthropic-java:2.72.0")
1919 ```
2020 </Tab>
2121
from line 24
2424 <dependency>
2525 <groupId>com.anthropic</groupId>
2626 <artifactId>anthropic-java</artifactId>
27 <version>2.71.0</version>
27 <version>2.72.0</version>
2828 </dependency>
2929 ```
3030 </Tab>
get-started Changed · +2 / -2 lines
from line 436
436436 }
437437
438438 dependencies {
439 implementation("com.anthropic:anthropic-java:2.71.0")
439 implementation("com.anthropic:anthropic-java:2.72.0")
440440 }
441441
442442 application {
from line 462
462462 <dependency>
463463 <groupId>com.anthropic</groupId>
464464 <artifactId>anthropic-java</artifactId>
465 <version>2.71.0</version>
465 <version>2.72.0</version>
466466 </dependency>
467467 </dependencies>
468468 </project>
manage-claude/admin-api Changed · +1 / -1 lines
from line 25
2525</Note>
2626
2727<Note>
28 **Claude Platform on AWS:** Only the workspace endpoints (create, get, list, update, and archive on `/v1/organizations/workspaces`) and the external key endpoints (register, get, list, update, and delete on `/v1/organizations/external_keys`, for [CMEK](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#claude-platform-on-aws); there is no validate endpoint, because keys are validated when attached to a workspace) are available on Claude Platform on AWS. Organization members, workspace members, invites, API keys, and the usage, cost, and rate limit reports aren't. See [Claude Platform on AWS](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws).
28 **Claude Platform on AWS:** Only the workspace endpoints (create, get, list, update, and archive on `/v1/organizations/workspaces`), the external key endpoints (register, get, list, update, and delete on `/v1/organizations/external_keys`, for [CMEK](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#claude-platform-on-aws); there is no validate endpoint, because keys are validated when attached to a workspace), and the [telemetry destination endpoints](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#telemetry-destinations) are available on Claude Platform on AWS. Organization members, workspace members, invites, API keys, and the usage, cost, and rate limit reports aren't. See [Claude Platform on AWS](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws).
2929</Note>
3030
3131## Authentication
manage-claude/api-and-data-retention Changed · +1 / -0 lines
from line 191
191191| [Memory tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/memory-tool) | `/v1/messages`<br />with `memory` tool | <Eligible>Yes</Eligible> | <Eligible>Yes</Eligible> | Client-side memory storage where you control data retention. |
192192| [Messages API](https://platform.claude.com/docs/en/build-with-claude/working-with-messages) | `/v1/messages` | <Eligible>Yes</Eligible> | <Eligible>Yes</Eligible> | Standard API calls for generating Claude responses. |
193193| [Mid-conversation system messages](https://platform.claude.com/docs/en/build-with-claude/mid-conversation-system-messages) | `/v1/messages`<br />with `role: "system"` messages | <Eligible>Yes</Eligible> | <Eligible>Yes</Eligible> | Request-shape capability of the Messages API; mid-conversation system messages flow through the standard inference path and nothing is stored server-side after the response. |
194| [OpenTelemetry export](https://platform.claude.com/docs/en/manage-claude/opentelemetry) | `/v1/organizations/telemetry_destinations` | <Eligible>Yes</Eligible> | <Eligible status="no">No</Eligible> | Beta. Spans have the same ZDR eligibility as the feature that produces them. HIPAA organizations can export metadata. SDK spans go directly from your environment to your exporter. After delivery, the data is held by the service that you chose, outside Anthropic, under that service's retention and access controls. |
194195| [PDF support](https://platform.claude.com/docs/en/build-with-claude/pdf-support) | `/v1/messages` | <Eligible>Yes</Eligible> | <Eligible>Yes</Eligible> | HIPAA eligibility applies to PDFs sent inline through the Messages API, not through the Files API. |
195196| [Programmatic tool calling](https://platform.claude.com/docs/en/agents-and-tools/tool-use/programmatic-tool-calling) | `/v1/messages`<br />with `code_execution` tool | <Eligible status="no">No</Eligible> | <Eligible status="no">No</Eligible> | Built on code execution containers; data retained up to 30 days. See [Programmatic tool calling](https://platform.claude.com/docs/en/agents-and-tools/tool-use/programmatic-tool-calling#data-retention). |
196197| [Prompt caching](https://platform.claude.com/docs/en/build-with-claude/prompt-caching) | `/v1/messages` | <Eligible>Yes</Eligible> | <Eligible>Yes</Eligible> | Your prompts and Claude's outputs are not stored. KV cache representations and cryptographic hashes are held in memory for the cache TTL and promptly deleted after expiry. See [Prompt caching](https://platform.claude.com/docs/en/build-with-claude/prompt-caching#data-retention). |
manage-claude/cmek Changed · +2 / -0 lines
from line 108
108108* Claude Managed Agents [vault credential](https://platform.claude.com/docs/en/managed-agents/vaults) values, such as OAuth tokens and client secrets. These are stored under Anthropic-managed encryption, are write-only, and are never returned in API responses.
109109* [User profiles](https://platform.claude.com/docs/en/api/beta/user_profiles): the `name`, `external_id`, and `metadata` fields are stored under Anthropic-managed encryption, not your key. Do not store sensitive personal data in profile `metadata`.
110110
111- [OpenTelemetry destination](https://platform.claude.com/docs/en/manage-claude/opentelemetry#add-a-destination) request headers, such as the API key header of your observability backend. These are stored under Anthropic-managed encryption. Their values are write-only and are never returned in API responses.
112
111113**Claude Enterprise**
112114
113115* Beta and research preview features might not be covered by CMEK and can break in CMEK organizations, for example, Claude Security and the Claude Design app at claude.ai/design.
managed-agents/self-hosted-sandboxes-workers Changed · +1 / -1 lines
from line 447
447447
448448 ```dockerfile
449449 FROM your-base-image
450 ARG ANT_VERSION=1.40.0
450 ARG ANT_VERSION=1.41.0
451451 ARG TARGETARCH
452452 RUN ARCH=$([ "$TARGETARCH" = "arm64" ] && echo arm64 || echo amd64) && \
453453 curl -fsSL "https://github.com/anthropics/anthropic-cli/releases/download/v${ANT_VERSION}/ant_${ANT_VERSION}_linux_${ARCH}.tar.gz" \