One read of Claude Developer Platformapi-20261020T170725Z
9 pages moved out of 785 read.
Pages moved
9
significant first
Pages read
785
in this capture
Captured
17:07 UTC
Corpus hash
cb7c2c0a7551
index-hash
What this read moved
1-9 of 9manage-claude/claude-code-analytics-api Changed · +12 / -2 lines
### Does this API include usage from Claude subscription plans?
from line 113
113113* **date:** Date in RFC 3339 format (UTC timestamp)
114114* **actor:** The user or API key that performed the Claude Code actions (either `user_actor` with `email_address` or `api_actor` with `api_key_name`)
115115* **organization\_id:** Organization UUID
116* **customer\_type:** Type of customer account (`api` for API customers, `subscription` for Pro/Team customers)
116* **customer\_type:** Type of customer account (`api` or `subscription`); records cover only usage authenticated against your Claude Console organization
117117* **terminal\_type:** Type of terminal or environment where Claude Code was used (for example, `vscode`, `iTerm.app`, `tmux`)
118118
119119#### Core metrics
from line 244
244244* **`user_actor`:** Contains `email_address` for users who authenticate through OAuth (most common)
245245* **`api_actor`:** Contains `api_key_name` for users who authenticate with an API key
246246
247The `customer_type` field indicates whether the usage is from `api` customers (pay-as-you-go API) or `subscription` customers (Pro/Team plans).
247The `customer_type` field is either `api` or `subscription`. Every record, whichever value it has, describes usage authenticated against your Claude Console organization.
248
249### Does this API include usage from Claude subscription plans?
250
251No. When someone signs in to Claude Code with a Claude subscription plan, such as Pro, Max, Team, or Enterprise, their usage is attributed to their claude.ai organization, and this API doesn't return it.
252
253To track that usage, use one of these options:
254
255* **Claude Enterprise Analytics API:** Reports Claude Code activity for Claude Enterprise organizations and isn't available on other plans. See [Analytics APIs](https://platform.claude.com/docs/en/manage-claude/analytics-api).
256* **Analytics dashboard in claude.ai:** Available on Team and Enterprise plans. See [Track team usage with analytics](https://code.claude.com/docs/en/analytics).
257* **OpenTelemetry export:** Works on any plan. See [Monitoring usage with OpenTelemetry](https://code.claude.com/docs/en/monitoring-usage).
248258
249259### What's the data retention period?
250260
manage-claude/cmek-aws-kms Changed · +85 / -85 lines
from line 13
1313This guide shows how to use an [AWS KMS](https://aws.amazon.com/kms/) key as a [customer-managed encryption key (CMEK)](https://platform.claude.com/docs/en/manage-claude/cmek) for your Anthropic organization.
1414
1515<Warning>
16 Enabling CMEK is permanent. If your KMS key is deleted or disabled, Anthropic cannot recover the data encrypted under it. Review the [warnings and limitations](https://platform.claude.com/docs/en/manage-claude/cmek) before you begin.
16 Enabling CMEK is permanent. If your key is deleted or disabled, Anthropic cannot recover the data encrypted under it. Review the [warnings and limitations](https://platform.claude.com/docs/en/manage-claude/cmek) before you start.
1717</Warning>
1818
1919<Note>
from line 120
120120 ```
121121</Warning>
122122
123<Note>
124 **Optional:** To limit the key to specific workspaces, replace the `AllowAnthropicCMEKCrypto` statement in the key policy with this one. List one compartment ID for each workspace.
125
126 ```json
127 {
128 "Sid": "AllowAnthropicCMEKCrypto",
129 "Effect": "Allow",
130 "Principal": {
131 "AWS": "arn:aws:iam::915198916910:role/anthropic-cmek-client-us"
132 },
133 "Action": ["kms:Encrypt", "kms:Decrypt"],
134 "Resource": "*",
135 "Condition": {
136 "StringEquals": {
137 "kms:EncryptionContext:anthropic:org_uuid": ["<ORGANIZATION_UUID>"]
138 },
139 "StringEqualsIfExists": {
140 "kms:EncryptionContext:anthropic:compartment_uuid": ["<COMPARTMENT_UUID>"]
141 }
142 }
143 }
144 ```
145
146 Add each workspace's compartment ID before you attach the key to it. For a new workspace:
147
148 1. Create the workspace without the key.
149 2. Add its compartment ID to the policy.
150 3. Attach the key.
151
152 **Finding your compartment ID:** In the Claude Console, go to the [Data retention](https://platform.claude.com/settings/privacy) page (`platform.claude.com/settings/privacy`). Select the workspace from the dropdown menu at the top of the page. The ID is under **Encryption key**, in the **Compartment ID** field. You can also read the `compartment_id` field returned by the [Get Workspace](https://platform.claude.com/docs/en/api/organization/workspaces/retrieve) endpoint.
153</Note>
154
123155### Create the key
124156
125157Create the key in a [US region](https://platform.claude.com/docs/en/manage-claude/cmek#availability-and-regions). For the lowest latency, use `us-east-2`.
from line 235
203235 </Tab>
204236</Tabs>
205237
206<Note>
207 **Optional:** To limit the key to specific workspaces, replace the `AllowAnthropicCMEKCrypto` statement in the key policy with this one. List one compartment ID for each workspace.
208
209 ```json
210 {
211 "Sid": "AllowAnthropicCMEKCrypto",
212 "Effect": "Allow",
213 "Principal": {
214 "AWS": "arn:aws:iam::915198916910:role/anthropic-cmek-client-us"
215 },
216 "Action": ["kms:Encrypt", "kms:Decrypt"],
217 "Resource": "*",
218 "Condition": {
219 "StringEquals": {
220 "kms:EncryptionContext:anthropic:org_uuid": ["<ORGANIZATION_UUID>"]
221 },
222 "StringEqualsIfExists": {
223 "kms:EncryptionContext:anthropic:compartment_uuid": ["<COMPARTMENT_UUID>"]
224 }
225 }
226 }
227 ```
228
229 Add each workspace's compartment ID before you attach the key to it. For a new workspace:
230
231 1. Create the workspace without the key.
232 2. Add its compartment ID to the policy.
233 3. Attach the key.
234
235 **Finding your compartment ID:** In the Claude Console, go to the [Data retention](https://platform.claude.com/settings/privacy) page (`platform.claude.com/settings/privacy`). Select the workspace from the dropdown menu at the top of the page. The ID is under **Encryption key**, in the **Compartment ID** field. You can also read the `compartment_id` field returned by the [Get Workspace](https://platform.claude.com/docs/en/api/organization/workspaces/retrieve) endpoint.
236</Note>
237
238238## Register the key with Anthropic
239239
240240Validating the key adds expected access-denied errors to CloudTrail. If you alert on these errors, see [Expected errors in CloudTrail](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#expected-errors-in-cloud-trail) first.
from line 681
681681If validation fails, common causes are:
682682
683683* **Wrong organization ID:** Make sure the `org_uuid` condition lists your bare organization ID, not the `org_`-prefixed ID.
684* **Encryption context mismatch:** If the policy has a `kms:EncryptionContext:anthropic:compartment_uuid` condition, make sure it lists the [compartment ID](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#compartment-id) of each workspace the key is attached to. On an older key, the compartment statement might still allow `kms:Encrypt`. In that case, keep the all-zeros value (`00000000-0000-0000-0000-000000000000`) in the list too.
684* **Encryption context mismatch:** If the policy has a `kms:EncryptionContext:anthropic:compartment_uuid` condition, make sure it lists the [compartment ID](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#compartment-id) of each workspace the key is attached to.
685685* **Resource control policies (RCPs):** Some RCPs deny KMS operations when `aws:PrincipalOrgID` does not match your AWS organization. An RCP like this blocks Anthropic's role. Add an exception to it for this key or for Anthropic's role ARN. Service control policies do not apply here.
686686* **Access granted through IAM instead of the key policy:** Grant Anthropic's role access in the key policy itself, not through an IAM policy in your account. To check the key policy, run `aws kms get-key-policy --region <REGION> --key-id <KEY_ARN> --policy-name default`.
687687* **Region mismatch:** Confirm that the key is in a US region.
manage-claude/cmek-azure-key-vault Changed · +6 / -4 lines
from line 13
1313This guide shows how to use an Azure Key Vault key as a [customer-managed encryption key (CMEK)](https://platform.claude.com/docs/en/manage-claude/cmek) for your Anthropic organization.
1414
1515<Warning>
16 Enabling CMEK is permanent. If your Key Vault key is deleted or disabled, Anthropic cannot recover the data encrypted under it. Review the [warnings and limitations](https://platform.claude.com/docs/en/manage-claude/cmek) before you start.
16 Enabling CMEK is permanent. If your key is deleted or disabled, Anthropic cannot recover the data encrypted under it. Review the [warnings and limitations](https://platform.claude.com/docs/en/manage-claude/cmek) before you start.
1717</Warning>
1818
1919## Prerequisites
from line 553
553553 ```ruby Ruby
554554 client = Anthropic::Client.new
555555
556 validation = client.organization.external_keys.validate("ekey_<id>")
556 external_key_id = "ekey_<id>"
557 validation = client.organization.external_keys.validate(external_key_id)
557558
558559 puts "status: #{validation.status}"
559560 puts "error: #{validation.error}"
from line 567
566567 { "type": "external_key_validation", "status": "success", "error": null }
567568 ```
568569
569 If validation fails, the `error` field describes the problem. For common causes, see [Troubleshoot validation](https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault#troubleshoot-validation).
570 If validation fails, see [Troubleshoot validation](https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault#troubleshoot-validation).
570571 </Step>
571572
572573 <Step title="Attach the key to a workspace">
from line 675
674675 ```ruby Ruby
675676 client = Anthropic::Client.new
676677
678 workspace_id = "<workspace-id>"
677679 workspace = client.organization.workspaces.update(
678 "<workspace-id>",
680 workspace_id,
679681 external_key_id: "ekey_<id>"
680682 )
681683
manage-claude/cmek-claude-platform-on-aws Changed · +8 / -8 lines
from line 7
77This guide shows how to use an [AWS KMS](https://aws.amazon.com/kms/) key as a [customer-managed encryption key (CMEK)](https://platform.claude.com/docs/en/manage-claude/cmek) on [Claude Platform on AWS](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws). For Claude Platform or Claude Enterprise, follow [Configure AWS KMS for CMEK](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms) instead.
88
99<Warning>
10 Enabling CMEK is permanent. If your KMS key is deleted or disabled, Anthropic cannot recover the data encrypted under it. Review the [warnings and limitations](https://platform.claude.com/docs/en/manage-claude/cmek) before you begin.
10 Enabling CMEK is permanent. If your key is deleted or disabled, Anthropic cannot recover the data encrypted under it. Review the [warnings and limitations](https://platform.claude.com/docs/en/manage-claude/cmek) before you start.
1111</Warning>
1212
1313## Prerequisites
from line 107
107107 **Finding your compartment ID:** In the Claude Console, go to the [Data retention](https://platform.claude.com/settings/privacy) page (`platform.claude.com/settings/privacy`). Select the workspace from the dropdown menu at the top of the page. The ID is under **Encryption key**, in the **Compartment ID** field. You can also read the `compartment_id` field returned by the [Get Workspace](https://platform.claude.com/docs/en/api/organization/workspaces/retrieve) endpoint.
108108</Note>
109109
110<Note>
111 **Optional:** To limit both service principal statements further, add an `aws:SourceArn` condition to each. The source ARN on every call is the [workspace's ARN](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#service-details), in the form `arn:aws:aws-external-anthropic:<REGION>:<AWS_ACCOUNT_ID>:workspace/<WORKSPACE_ID>`.
112
113 * **All workspaces in your AWS account:** `"ArnLike": {"aws:SourceArn": "arn:aws:aws-external-anthropic:*:<AWS_ACCOUNT_ID>:workspace/*"}`
114 * **Specific workspaces:** the same condition, with a list of full workspace ARNs instead of the wildcard
115</Note>
116
110117### Create the key
111118
112119Create the key in the AWS account that hosts your Claude Platform on AWS organization, in the same region as the workspace.
from line 196
189196 Copy `KeyMetadata.Arn` from the output. You need it to register the key.
190197 </Tab>
191198</Tabs>
192
193<Note>
194 **Optional:** To limit both service principal statements further, add an `aws:SourceArn` condition to each. The source ARN on every call is the [workspace's ARN](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#service-details), in the form `arn:aws:aws-external-anthropic:<REGION>:<AWS_ACCOUNT_ID>:workspace/<WORKSPACE_ID>`.
195
196 * **All workspaces in your AWS account:** `"ArnLike": {"aws:SourceArn": "arn:aws:aws-external-anthropic:*:<AWS_ACCOUNT_ID>:workspace/*"}`
197 * **Specific workspaces:** the same condition, with a list of full workspace ARNs instead of the wildcard
198</Note>
199199
200200## Register the key with Anthropic
201201
manage-claude/rate-limits-api Changed · +4 / -2 lines
from line 475
475475 ```
476476</CodeGroup>
477477
478If the model string doesn't match any group, the endpoint returns a 404 error. The `model` parameter is supported on the organization endpoint only; the workspace endpoint doesn't accept it.
478If the model string doesn't match any group, the endpoint returns a 404 error. Any model your organization has access to matches its group. The `model` parameter is supported on the organization endpoint only; the workspace endpoint doesn't accept it.
479479
480480## Workspace rate limits
481481
from line 490
490490For complete parameter details and response schemas, see the [Workspace Rate Limits API reference](https://platform.claude.com/docs/en/api/organization/workspaces/rate_limits/list).
491491
492492<Tip>
493 To retrieve your organization's workspace IDs, use the [List Workspaces](https://platform.claude.com/docs/en/api/organization/workspaces/list) endpoint, or find them in the [Claude Console](https://platform.claude.com/settings/workspaces). The default workspace cannot have rate limit overrides, and this endpoint returns a 404 error for it, with or without `include_inherited`; use the organization endpoint to read its limits.
493 To retrieve your organization's workspace IDs, use the [List Workspaces](https://platform.claude.com/docs/en/api/organization/workspaces/list) endpoint, or find them in the [Claude Console](https://platform.claude.com/settings/workspaces). List Workspaces includes the default workspace only when you pass `include_default=true`.
494494</Tip>
495495
496496<CodeGroup>
from line 1087
10871087### Which model strings appear in the `models` list?
10881088
10891089Every model ID and alias that counts against the group, including dated IDs (such as `claude-sonnet-4-5-20250929`) and undated aliases (such as `claude-sonnet-4-5`). Look up any model string you pass to the Messages API and you'll find it in exactly one `model_group` entry.
1090
1091The list covers the models your organization has access to, so it can differ between organizations.
10901092
10911093### What does it mean if a group is missing from the workspace response?
10921094
api/rate-limits Changed · +1 / -1 lines
from line 275
275275
276276Note:
277277
278* You can't set limits on the default Workspace.
278* You can't set spend limits on the default Workspace.
279279* If not set, Workspace limits match the Organization's limit.
280280* Workspace limits are set per limiter type (such as requests per minute, input tokens per minute, or output tokens per minute).
281281* Organization-wide limits always apply, even if Workspace limits add up to more.
manage-claude/cmek-google-cloud-kms Changed · +1 / -1 lines
from line 13
1313This guide shows how to use a Google Cloud KMS key as a [customer-managed encryption key (CMEK)](https://platform.claude.com/docs/en/manage-claude/cmek) for your Anthropic organization.
1414
1515<Warning>
16 Enabling CMEK is permanent. If your KMS key is deleted or disabled, Anthropic cannot recover the data encrypted under it. Review the [warnings and limitations](https://platform.claude.com/docs/en/manage-claude/cmek) before you begin.
16 Enabling CMEK is permanent. If your key is deleted or disabled, Anthropic cannot recover the data encrypted under it. Review the [warnings and limitations](https://platform.claude.com/docs/en/manage-claude/cmek) before you start.
1717</Warning>
1818
1919## Prerequisites
manage-claude/inference-hooks Changed · +1 / -1 lines
from line 79
7979
8080One hook governs conversations across all Claude products in your Claude Enterprise organization, including, but not limited to, claude.ai, Cowork, Claude Code, Claude for Microsoft 365, Claude Tag, and Claude in Chrome, whether they run on the web, in the desktop or mobile apps, in the CLI, or in Slack. Inference hooks are not available on Amazon Bedrock or Google Cloud.
8181
82Governed requests are the inference requests behind the user's conversation. Ancillary requests aren't sent to your endpoint. These include conversation title generation and a measurement that Anthropic runs on Claude's reply after Claude Tag has posted it in Slack. System prompts and tool definitions are never included in what is sent. In voice mode, prompts and tool calls are sent to your endpoint too, though a small share of tool calls isn't, so don't rely on inference hooks as your only control for voice. If your endpoint denies a request in voice mode, the voice call usually ends with a general error message, and your deny reason isn't shown.
82Governed requests are the inference requests behind the user's conversation or session. System prompts and tool definitions are never included in what is sent. In voice mode, prompts and tool calls are sent to your endpoint too, though a small share of tool calls isn't, so don't rely on inference hooks as your only control for voice. If your endpoint denies a request in voice mode, the voice call usually ends with a general error message, and your deny reason isn't shown.
8383
8484With **Validate tool calls** on, `tool_call` events may leave out calls to some of claude.ai's own tools, such as tools that list, search for, or suggest connectors, plugins, or skills, suggest starting research or turning on web search, search for other tools, switch to a larger model, end the chat, give Claude the user's local time, or read the user's own past chats and saved memory. These calls and their results stay in the conversation, so the next `prompt` event from that conversation, if there is one, includes them.
8585
manage-claude/workspaces Changed · +1 / -1 lines
from line 1025
10251025* **Rate limits:** Limit requests per minute, input tokens per minute, or output tokens per minute. To set these, go to the [Rate limits](https://platform.claude.com/usage/limits) page in the Claude Console, select the workspace from the **Workspace** dropdown menu, and click **Edit** next to a model.
10261026
10271027<Note>
1028 - You cannot set limits on the Default Workspace
1028 - You cannot set spend limits on the Default Workspace
10291029 - If not set, workspace limits match the organization's limits
10301030 - Organization-wide limits always apply, even if workspace limits add up to more
10311031</Note>