Home Docs Claude Developer Platform

One capture · api

One read of Claude Developer Platformapi-20261022T173720Z

461 pages moved out of 808 read.

Pages moved 461 significant first

Pages read 808 in this capture

Captured 22 Oct 2026 17:37 UTC

Corpus hash e3e9c53ea786 corpus-hash

What this read moved

76-100 of 461, page 4 of 19

This capture is too large to show at once. Changes 76-100 of 461 are below, significant first; the rest are on the following screens.

api/beta/organization/workspaces/service_accounts Changed · +10 / -10 lines

from line 202

202202

203203```bash

204204curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/service_accounts \

205 -H 'anthropic-version: 2023-06-01' \

206 -H "X-Api-Key: $ANTHROPIC_API_KEY"

205 -H 'anthropic-version: 2026-10-21' \

206 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

207207```

208208

209209#### Response (200)

from line 426

426426```bash

427427curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/service_accounts \

428428 -H 'Content-Type: application/json' \

429 -H 'anthropic-version: 2023-06-01' \

430 -H "X-Api-Key: $ANTHROPIC_API_KEY" \

429 -H 'anthropic-version: 2026-10-21' \

430 -H "Authorization: Bearer $ANTHROPIC_API_KEY" \

431431 -d '{

432432 "service_account_id": "service_account_id",

433433 "workspace_role": "workspace_admin"

from line 632

632632

633633```bash

634634curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/service_accounts/$SERVICE_ACCOUNT_ID \

635 -H 'anthropic-version: 2023-06-01' \

636 -H "X-Api-Key: $ANTHROPIC_API_KEY"

635 -H 'anthropic-version: 2026-10-21' \

636 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

637637```

638638

639639#### Response (200)

from line 849

849849```bash

850850curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/service_accounts/$SERVICE_ACCOUNT_ID \

851851 -H 'Content-Type: application/json' \

852 -H 'anthropic-version: 2023-06-01' \

853 -H "X-Api-Key: $ANTHROPIC_API_KEY" \

852 -H 'anthropic-version: 2026-10-21' \

853 -H "Authorization: Bearer $ANTHROPIC_API_KEY" \

854854 -d '{

855855 "workspace_role": "workspace_admin"

856856 }'

from line 1030

10301030```bash

10311031curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/service_accounts/$SERVICE_ACCOUNT_ID \

10321032 -X DELETE \

1033 -H 'anthropic-version: 2023-06-01' \

1034 -H "X-Api-Key: $ANTHROPIC_API_KEY"

1033 -H 'anthropic-version: 2026-10-21' \

1034 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

10351035```

10361036

10371037#### Response (200)

api/beta/sessions Changed · +38 / -38 lines

This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.

from line 2406

24062406```bash

24072407curl https://api.anthropic.com/v1/sessions \

24082408 -H 'Content-Type: application/json' \

2409 -H 'anthropic-version: 2023-06-01' \

2409 -H 'anthropic-version: 2026-10-21' \

24102410 -H 'anthropic-beta: managed-agents-2026-04-01' \

2411 -H "X-Api-Key: $ANTHROPIC_API_KEY" \

2411 -H "Authorization: Bearer $ANTHROPIC_API_KEY" \

24122412 -d '{

24132413 "agent": "agent_011CZkYpogX7uDKUyvBTophP",

24142414 "environment_id": "env_011CZkZ9X2dpNyB7HsEFoRfW",

from line 3997

39973997

39983998```bash

39993999curl https://api.anthropic.com/v1/sessions \

4000 -H 'anthropic-version: 2023-06-01' \

4000 -H 'anthropic-version: 2026-10-21' \

40014001 -H 'anthropic-beta: managed-agents-2026-04-01' \

4002 -H "X-Api-Key: $ANTHROPIC_API_KEY"

4002 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

40034003```

40044004

40054005#### Response (200)

from line 5488

54885488

54895489```bash

54905490curl https://api.anthropic.com/v1/sessions/$SESSION_ID \

5491 -H 'anthropic-version: 2023-06-01' \

5491 -H 'anthropic-version: 2026-10-21' \

54925492 -H 'anthropic-beta: managed-agents-2026-04-01' \

5493 -H "X-Api-Key: $ANTHROPIC_API_KEY"

5493 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

54945494```

54955495

54965496#### Response (200)

from line 7556

75567556```bash

75577557curl https://api.anthropic.com/v1/sessions/$SESSION_ID \

75587558 -H 'Content-Type: application/json' \

7559 -H 'anthropic-version: 2023-06-01' \

7559 -H 'anthropic-version: 2026-10-21' \

75607560 -H 'anthropic-beta: managed-agents-2026-04-01' \

7561 -H "X-Api-Key: $ANTHROPIC_API_KEY" \

7561 -H "Authorization: Bearer $ANTHROPIC_API_KEY" \

75627562 -d '{

75637563 "title": "Order #1234 inquiry"

75647564 }'

from line 7913

79137913```bash

79147914curl https://api.anthropic.com/v1/sessions/$SESSION_ID \

79157915 -X DELETE \

7916 -H 'anthropic-version: 2023-06-01' \

7916 -H 'anthropic-version: 2026-10-21' \

79177917 -H 'anthropic-beta: managed-agents-2026-04-01' \

7918 -H "X-Api-Key: $ANTHROPIC_API_KEY"

7918 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

79197919```

79207920

79217921#### Response (200)

from line 8133

81338133

81348134 - `"claude-fable-5-1"`

81358135

8136 Frontier intelligence for ambitious tasks across coding, scientific discovery, and enterprise workflows

8137

8138 - `"claude-sonnet-5"`

8139

8140

8136 Frontier intelligence for ambitious tasks across coding, scientific discovery, an

api/beta/sessions/events Changed · +6 / -6 lines

This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.

from line 3201

32013201

32023202```bash

32033203curl https://api.anthropic.com/v1/sessions/$SESSION_ID/events \

3204 -H 'anthropic-version: 2023-06-01' \

3204 -H 'anthropic-version: 2026-10-21' \

32053205 -H 'anthropic-beta: managed-agents-2026-04-01' \

3206 -H "X-Api-Key: $ANTHROPIC_API_KEY"

3206 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

32073207```

32083208

32093209#### Response (200)

from line 4187

41874187```bash

41884188curl https://api.anthropic.com/v1/sessions/$SESSION_ID/events \

41894189 -H 'Content-Type: application/json' \

4190 -H 'anthropic-version: 2023-06-01' \

4190 -H 'anthropic-version: 2026-10-21' \

41914191 -H 'anthropic-beta: managed-agents-2026-04-01' \

4192 -H "X-Api-Key: $ANTHROPIC_API_KEY" \

4192 -H "Authorization: Bearer $ANTHROPIC_API_KEY" \

41934193 -d '{

41944194 "events": [

41954195 {

from line 7349

73497349

73507350```bash

73517351curl https://api.anthropic.com/v1/sessions/$SESSION_ID/events/stream \

7352 -H 'anthropic-version: 2023-06-01' \

7352 -H 'anthropic-version: 2026-10-21' \

73537353 -H 'anthropic-beta: managed-agents-2026-04-01' \

7354 -H "X-Api-Key: $ANTHROPIC_API_KEY"

7354 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

73557355```

73567356

73577357#### Response (200)

from line 8586

85868586

85878587 - `BetaManagedAgentsAgentToolEvaluationAlwaysAllow object`

85888588

8589 The resolved permission_policy was always_allow; accompanies evaluated_permission

8589 The resolved permission_policy was always_allow;

api/beta/sessions/resources Changed · +10 / -10 lines

from line 184

184184```bash

185185curl https://api.anthropic.com/v1/sessions/$SESSION_ID/resources \

186186 -H 'Content-Type: application/json' \

187 -H 'anthropic-version: 2023-06-01' \

187 -H 'anthropic-version: 2026-10-21' \

188188 -H 'anthropic-beta: managed-agents-2026-04-01' \

189 -H "X-Api-Key: $ANTHROPIC_API_KEY" \

189 -H "Authorization: Bearer $ANTHROPIC_API_KEY" \

190190 -d '{

191191 "file_id": "file_011CNha8iCJcU1wXNR6q4V8w",

192192 "type": "file",

from line 469

469469

470470```bash

471471curl https://api.anthropic.com/v1/sessions/$SESSION_ID/resources \

472 -H 'anthropic-version: 2023-06-01' \

472 -H 'anthropic-version: 2026-10-21' \

473473 -H 'anthropic-beta: managed-agents-2026-04-01' \

474 -H "X-Api-Key: $ANTHROPIC_API_KEY"

474 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

475475```

476476

477477#### Response (200)

from line 748

748748

749749```bash

750750curl https://api.anthropic.com/v1/sessions/$SESSION_ID/resources/$RESOURCE_ID \

751 -H 'anthropic-version: 2023-06-01' \

751 -H 'anthropic-version: 2026-10-21' \

752752 -H 'anthropic-beta: managed-agents-2026-04-01' \

753 -H "X-Api-Key: $ANTHROPIC_API_KEY"

753 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

754754```

755755

756756#### Response (200)

from line 1023

10231023```bash

10241024curl https://api.anthropic.com/v1/sessions/$SESSION_ID/resources/$RESOURCE_ID \

10251025 -H 'Content-Type: application/json' \

1026 -H 'anthropic-version: 2023-06-01' \

1026 -H 'anthropic-version: 2026-10-21' \

10271027 -H 'anthropic-beta: managed-agents-2026-04-01' \

1028 -H "X-Api-Key: $ANTHROPIC_API_KEY" \

1028 -H "Authorization: Bearer $ANTHROPIC_API_KEY" \

10291029 -d '{

10301030 "authorization_token": "ghp_exampletoken"

10311031 }'

from line 1199

11991199```bash

12001200curl https://api.anthropic.com/v1/sessions/$SESSION_ID/resources/$RESOURCE_ID \

12011201 -X DELETE \

1202 -H 'anthropic-version: 2023-06-01' \

1202 -H 'anthropic-version: 2026-10-21' \

12031203 -H 'anthropic-beta: managed-agents-2026-04-01' \

1204 -H "X-Api-Key: $ANTHROPIC_API_KEY"

1204 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

12051205```

12061206

12071207#### Response (200)

api/beta/sessions/threads Changed · +10 / -10 lines

This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.

from line 1011

10111011

10121012```bash

10131013curl https://api.anthropic.com/v1/sessions/$SESSION_ID/threads \

1014 -H 'anthropic-version: 2023-06-01' \

1014 -H 'anthropic-version: 2026-10-21' \

10151015 -H 'anthropic-beta: managed-agents-2026-04-01' \

1016 -H "X-Api-Key: $ANTHROPIC_API_KEY"

1016 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

10171017```

10181018

10191019#### Response (200)

from line 2092

20922092

20932093```bash

20942094curl https://api.anthropic.com/v1/sessions/$SESSION_ID/threads/$THREAD_ID \

2095 -H 'anthropic-version: 2023-06-01' \

2095 -H 'anthropic-version: 2026-10-21' \

20962096 -H 'anthropic-beta: managed-agents-2026-04-01' \

2097 -H "X-Api-Key: $ANTHROPIC_API_KEY"

2097 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

20982098```

20992099

21002100#### Response (200)

from line 3169

31693169```bash

31703170curl https://api.anthropic.com/v1/sessions/$SESSION_ID/threads/$THREAD_ID/archive \

31713171 -X POST \

3172 -H 'anthropic-version: 2023-06-01' \

3172 -H 'anthropic-version: 2026-10-21' \

31733173 -H 'anthropic-beta: managed-agents-2026-04-01' \

3174 -H "X-Api-Key: $ANTHROPIC_API_KEY"

3174 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

31753175```

31763176

31773177#### Response (200)

from line 8183

81838183

81848184 maxLength: 10000

81858185

8186 - `processed_at: optional string or null`

8187

8188 Timestam

8186 - `processed_at: optiona

api/beta/sessions/threads/events Changed · +4 / -4 lines

from line 3083

30833083

30843084```bash

30853085curl https://api.anthropic.com/v1/sessions/$SESSION_ID/threads/$THREAD_ID/events \

3086 -H 'anthropic-version: 2023-06-01' \

3086 -H 'anthropic-version: 2026-10-21' \

30873087 -H 'anthropic-beta: managed-agents-2026-04-01' \

3088 -H "X-Api-Key: $ANTHROPIC_API_KEY"

3088 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

30893089```

30903090

30913091#### Response (200)

from line 6246

62466246

62476247```bash

62486248curl https://api.anthropic.com/v1/sessions/$SESSION_ID/threads/$THREAD_ID/stream \

6249 -H 'anthropic-version: 2023-06-01' \

6249 -H 'anthropic-version: 2026-10-21' \

62506250 -H 'anthropic-beta: managed-agents-2026-04-01' \

6251 -H "X-Api-Key: $ANTHROPIC_API_KEY"

6251 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

62526252```

62536253

62546254#### Response (200)

api/beta/skills Changed · +18 / -18 lines

from line 224

224224```bash

225225curl https://api.anthropic.com/v1/skills \

226226 -H 'Content-Type: multipart/form-data' \

227 -H 'anthropic-version: 2023-06-01' \

228 -H "X-Api-Key: $ANTHROPIC_API_KEY" \

227 -H 'anthropic-version: 2026-10-21' \

228 -H "Authorization: Bearer $ANTHROPIC_API_KEY" \

229229 -F 'files[]=@/path/to/file'

230230```

231231

from line 482

482482

483483```bash

484484curl https://api.anthropic.com/v1/skills \

485 -H 'anthropic-version: 2023-06-01' \

486 -H "X-Api-Key: $ANTHROPIC_API_KEY"

485 -H 'anthropic-version: 2026-10-21' \

486 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

487487```

488488

489489#### Response (200)

from line 719

719719

720720```bash

721721curl https://api.anthropic.com/v1/skills/$SKILL_ID \

722 -H 'anthropic-version: 2023-06-01' \

723 -H "X-Api-Key: $ANTHROPIC_API_KEY"

722 -H 'anthropic-version: 2026-10-21' \

723 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

724724```

725725

726726#### Response (200)

from line 900

900900```bash

901901curl https://api.anthropic.com/v1/skills/$SKILL_ID \

902902 -X DELETE \

903 -H 'anthropic-version: 2023-06-01' \

904 -H "X-Api-Key: $ANTHROPIC_API_KEY"

903 -H 'anthropic-version: 2026-10-21' \

904 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

905905```

906906

907907#### Response (200)

from line 1221

12211221```bash

12221222curl https://api.anthropic.com/v1/skills/$SKILL_ID/versions \

12231223 -H 'Content-Type: multipart/form-data' \

1224 -H 'anthropic-version: 2023-06-01' \

1225 -H "X-Api-Key: $ANTHROPIC_API_KEY" \

1224 -H 'anthropic-version: 2026-10-21' \

1225 -H "Authorization: Bearer $ANTHROPIC_API_KEY" \

12261226 -F 'files[]=@/path/to/file'

12271227```

12281228

from line 1445

14451445

14461446```bash

14471447curl https://api.anthropic.com/v1/skills/$SKILL_ID/versions \

1448 -H 'anthropic-version: 2023-06-01' \

1449 -H "X-Api-Key: $ANTHROPIC_API_KEY"

1448 -H 'anthropic-version: 2026-10-21' \

1449 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

14501450```

14511451

14521452##### Response (200)

from line 1615

16151615

16161616```bash

16171617curl https://api.anthropic.com/v1/skills/$SKILL_ID/versions/$VERSION/content \

1618 -H 'anthropic-version: 2023-06-01' \

1619 -H "X-Api-Key: $ANTHROPIC_API_KEY"

1618 -H 'anthropic-version: 2026-10-21' \

1619 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

16201620```

16211621

16221622### Get Skill Version

from line 1809

18091809

18101810```bash

18111811curl https://api.anthropic.com/v1/skills/$SKILL_ID/versions/$VERSION \

1812 -H 'anthropic-version: 2023-06-01' \

1813 -H "X-Api-Key: $ANTHROPIC_API_KEY"

1812 -H 'anthropic-version: 2026-10-21' \

1813 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

18141814```

18151815

18161816##### Response (200)

from line 1992

19921992```bash

19931993curl https://api.anthropic.com/v1/skills/$SKILL_ID/versions/$VERSION \

19941994 -X DELETE \

1995 -H 'anthropic-version: 2023-06-01' \

1996 -H "X-Api-Key: $ANTHROPIC_API_KEY"

1995 -H 'anthropic-version: 2026-10-21' \

1996 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

19971997```

19981998

19991999##### Response (200)

api/beta/skills/versions Changed · +10 / -10 lines

from line 198

198198```bash

199199curl https://api.anthropic.com/v1/skills/$SKILL_ID/versions \

200200 -H 'Content-Type: multipart/form-data' \

201 -H 'anthropic-version: 2023-06-01' \

202 -H "X-Api-Key: $ANTHROPIC_API_KEY" \

201 -H 'anthropic-version: 2026-10-21' \

202 -H "Authorization: Bearer $ANTHROPIC_API_KEY" \

203203 -F 'files[]=@/path/to/file'

204204```

205205

from line 422

422422

423423```bash

424424curl https://api.anthropic.com/v1/skills/$SKILL_ID/versions \

425 -H 'anthropic-version: 2023-06-01' \

426 -H "X-Api-Key: $ANTHROPIC_API_KEY"

425 -H 'anthropic-version: 2026-10-21' \

426 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

427427```

428428

429429#### Response (200)

from line 592

592592

593593```bash

594594curl https://api.anthropic.com/v1/skills/$SKILL_ID/versions/$VERSION/content \

595 -H 'anthropic-version: 2023-06-01' \

596 -H "X-Api-Key: $ANTHROPIC_API_KEY"

595 -H 'anthropic-version: 2026-10-21' \

596 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

597597```

598598

599599## Get Skill Version

from line 786

786786

787787```bash

788788curl https://api.anthropic.com/v1/skills/$SKILL_ID/versions/$VERSION \

789 -H 'anthropic-version: 2023-06-01' \

790 -H "X-Api-Key: $ANTHROPIC_API_KEY"

789 -H 'anthropic-version: 2026-10-21' \

790 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

791791```

792792

793793#### Response (200)

from line 969

969969```bash

970970curl https://api.anthropic.com/v1/skills/$SKILL_ID/versions/$VERSION \

971971 -X DELETE \

972 -H 'anthropic-version: 2023-06-01' \

973 -H "X-Api-Key: $ANTHROPIC_API_KEY"

972 -H 'anthropic-version: 2026-10-21' \

973 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

974974```

975975

976976#### Response (200)

api/beta/tunnels Changed · +20 / -20 lines

from line 182

182182```bash

183183curl https://api.anthropic.com/v1/tunnels \

184184 -H 'Content-Type: application/json' \

185 -H 'anthropic-version: 2023-06-01' \

185 -H 'anthropic-version: 2026-10-21' \

186186 -H 'anthropic-beta: mcp-tunnels-2026-06-22' \

187 -H "X-Api-Key: $ANTHROPIC_API_KEY" \

187 -H "Authorization: Bearer $ANTHROPIC_API_KEY" \

188188 -d '{}'

189189```

190190

from line 375

375375

376376```bash

377377curl https://api.anthropic.com/v1/tunnels/$TUNNEL_ID \

378 -H 'anthropic-version: 2023-06-01' \

378 -H 'anthropic-version: 2026-10-21' \

379379 -H 'anthropic-beta: mcp-tunnels-2026-06-22' \

380 -H "X-Api-Key: $ANTHROPIC_API_KEY"

380 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

381381```

382382

383383#### Response (200)

from line 581

581581

582582```bash

583583curl https://api.anthropic.com/v1/tunnels \

584 -H 'anthropic-version: 2023-06-01' \

584 -H 'anthropic-version: 2026-10-21' \

585585 -H 'anthropic-beta: mcp-tunnels-2026-06-22' \

586 -H "X-Api-Key: $ANTHROPIC_API_KEY"

586 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

587587```

588588

589589#### Response (200)

from line 779

779779```bash

780780curl https://api.anthropic.com/v1/tunnels/$TUNNEL_ID/archive \

781781 -X POST \

782 -H 'anthropic-version: 2023-06-01' \

782 -H 'anthropic-version: 2026-10-21' \

783783 -H 'anthropic-beta: mcp-tunnels-2026-06-22' \

784 -H "X-Api-Key: $ANTHROPIC_API_KEY"

784 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

785785```

786786

787787#### Response (200)

from line 956

956956```bash

957957curl https://api.anthropic.com/v1/tunnels/$TUNNEL_ID/reveal_token \

958958 -X POST \

959 -H 'anthropic-version: 2023-06-01' \

959 -H 'anthropic-version: 2026-10-21' \

960960 -H 'anthropic-beta: mcp-tunnels-2026-06-22' \

961 -H "X-Api-Key: $ANTHROPIC_API_KEY"

961 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

962962```

963963

964964#### Response (200)

from line 1138

11381138```bash

11391139curl https://api.anthropic.com/v1/tunnels/$TUNNEL_ID/rotate_token \

11401140 -H 'Content-Type: application/json' \

1141 -H 'anthropic-version: 2023-06-01' \

1141 -H 'anthropic-version: 2026-10-21' \

11421142 -H 'anthropic-beta: mcp-tunnels-2026-06-22' \

1143 -H "X-Api-Key: $ANTHROPIC_API_KEY" \

1143 -H "Authorization: Bearer $ANTHROPIC_API_KEY" \

11441144 -d '{}'

11451145```

11461146

from line 1395

13951395```bash

13961396curl https://api.anthropic.com/v1/tunnels/$TUNNEL_ID/certificates \

13971397 -H 'Content-Type: application/json' \

1398 -H 'anthropic-version: 2023-06-01' \

1398 -H 'anthropic-version: 2026-10-21' \

13991399 -H 'anthropic-beta: mcp-tunnels-2026-06-22' \

1400 -H "X-Api-Key: $ANTHROPIC_API_KEY" \

1400 -H "Authorization: Bearer $ANTHROPIC_API_KEY" \

14011401 -d '{

14021402 "ca_certificate_pem": "ca_certificate_pem"

14031403 }'

from line 1601

16011601

16021602```bash

16031603curl https://api.anthropic.com/v1/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID \

1604 -H 'anthropic-version: 2023-06-01' \

1604 -H 'anthropic-version: 2026-10-21' \

16051605 -H 'anthropic-beta: mcp-tunnels-2026-06-22' \

1606 -H "X-Api-Key: $ANTHROPIC_API_KEY"

1606 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

16071607```

16081608

16091609##### Response (200)

from line 1820

18201820

18211821```bash

18221822curl https://api.anthropic.com/v1/tunnels/$TUNNEL_ID/certificates \

1823 -H 'anthropic-version: 2023-06-01' \

1823 -H 'anthropic-version: 2026-10-21' \

18241824 -H 'anthropic-beta: mcp-tunnels-2026-06-22' \

1825 -H "X-Api-Key: $ANTHROPIC_API_KEY"

1825 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

18261826```

18271827

18281828##### Response (200)

from line 2029

20292029```bash

20302030curl https://api.anthropic.com/v1/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID/archive \

20312031 -X POST \

2032 -H 'anthropic-version: 2023-06-01' \

2032 -H 'anthropic-version: 2026-10-21' \

20332033 -H 'anthropic-beta: mcp-tunnels-2026-06-22' \

2034 -H "X-Api-Key: $ANTHROPIC_API_KEY"

2034 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

20352035```

20362036

20372037##### Response (200)

api/beta/tunnels/certificates Changed · +8 / -8 lines

from line 194

194194```bash

195195curl https://api.anthropic.com/v1/tunnels/$TUNNEL_ID/certificates \

196196 -H 'Content-Type: application/json' \

197 -H 'anthropic-version: 2023-06-01' \

197 -H 'anthropic-version: 2026-10-21' \

198198 -H 'anthropic-beta: mcp-tunnels-2026-06-22' \

199 -H "X-Api-Key: $ANTHROPIC_API_KEY" \

199 -H "Authorization: Bearer $ANTHROPIC_API_KEY" \

200200 -d '{

201201 "ca_certificate_pem": "ca_certificate_pem"

202202 }'

from line 400

400400

401401```bash

402402curl https://api.anthropic.com/v1/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID \

403 -H 'anthropic-version: 2023-06-01' \

403 -H 'anthropic-version: 2026-10-21' \

404404 -H 'anthropic-beta: mcp-tunnels-2026-06-22' \

405 -H "X-Api-Key: $ANTHROPIC_API_KEY"

405 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

406406```

407407

408408#### Response (200)

from line 619

619619

620620```bash

621621curl https://api.anthropic.com/v1/tunnels/$TUNNEL_ID/certificates \

622 -H 'anthropic-version: 2023-06-01' \

622 -H 'anthropic-version: 2026-10-21' \

623623 -H 'anthropic-beta: mcp-tunnels-2026-06-22' \

624 -H "X-Api-Key: $ANTHROPIC_API_KEY"

624 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

625625```

626626

627627#### Response (200)

from line 828

828828```bash

829829curl https://api.anthropic.com/v1/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID/archive \

830830 -X POST \

831 -H 'anthropic-version: 2023-06-01' \

831 -H 'anthropic-version: 2026-10-21' \

832832 -H 'anthropic-beta: mcp-tunnels-2026-06-22' \

833 -H "X-Api-Key: $ANTHROPIC_API_KEY"

833 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

834834```

835835

836836#### Response (200)

api/beta/user_profiles Changed · +14 / -14 lines

from line 362

362362```bash

363363curl https://api.anthropic.com/v1/user_profiles \

364364 -H 'Content-Type: application/json' \

365 -H 'anthropic-version: 2023-06-01' \

365 -H 'anthropic-version: 2026-10-21' \

366366 -H 'anthropic-beta: user-profiles-2026-08-18' \

367 -H "X-Api-Key: $ANTHROPIC_API_KEY" \

367 -H "Authorization: Bearer $ANTHROPIC_API_KEY" \

368368 -d '{

369369 "external_user_details": {

370370 "account_status": "active",

from line 708

708708

709709```bash

710710curl https://api.anthropic.com/v1/user_profiles \

711 -H 'anthropic-version: 2023-06-01' \

711 -H 'anthropic-version: 2026-10-21' \

712712 -H 'anthropic-beta: user-profiles-2026-08-18' \

713 -H "X-Api-Key: $ANTHROPIC_API_KEY"

713 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

714714```

715715

716716#### Response (200)

from line 1014

10141014

10151015```bash

10161016curl https://api.anthropic.com/v1/user_profiles/$USER_PROFILE_ID \

1017 -H 'anthropic-version: 2023-06-01' \

1017 -H 'anthropic-version: 2026-10-21' \

10181018 -H 'anthropic-beta: user-profiles-2026-08-18' \

1019 -H "X-Api-Key: $ANTHROPIC_API_KEY"

1019 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

10201020```

10211021

10221022#### Response (200)

from line 1412

14121412```bash

14131413curl https://api.anthropic.com/v1/user_profiles/$USER_PROFILE_ID \

14141414 -H 'Content-Type: application/json' \

1415 -H 'anthropic-version: 2023-06-01' \

1415 -H 'anthropic-version: 2026-10-21' \

14161416 -H 'anthropic-beta: user-profiles-2026-08-18' \

1417 -H "X-Api-Key: $ANTHROPIC_API_KEY" \

1417 -H "Authorization: Bearer $ANTHROPIC_API_KEY" \

14181418 -d '{

14191419 "external_user_details": {

14201420 "account_status": "suspended"

from line 1605

16051605```bash

16061606curl https://api.anthropic.com/v1/user_profiles/$USER_PROFILE_ID \

16071607 -X DELETE \

1608 -H 'anthropic-version: 2023-06-01' \

1608 -H 'anthropic-version: 2026-10-21' \

16091609 -H 'anthropic-beta: user-profiles-2026-08-18' \

1610 -H "X-Api-Key: $ANTHROPIC_API_KEY"

1610 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

16111611```

16121612

16131613#### Response (200)

from line 1780

17801780```bash

17811781curl https://api.anthropic.com/v1/user_profiles/$USER_PROFILE_ID/enrollment_url \

17821782 -X POST \

1783 -H 'anthropic-version: 2023-06-01' \

1783 -H 'anthropic-version: 2026-10-21' \

17841784 -H 'anthropic-beta: user-profiles-2026-08-18' \

1785 -H "X-Api-Key: $ANTHROPIC_API_KEY"

1785 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

17861786```

17871787

17881788#### Response (200)

from line 2262

22622262```bash

22632263curl https://api.anthropic.com/v1/user_profiles/$USER_PROFILE_ID/action_urls \

22642264 -H 'Content-Type: application/json' \

2265 -H 'anthropic-version: 2023-06-01' \

2265 -H 'anthropic-version: 2026-10-21' \

22662266 -H 'anthropic-beta: user-profiles-2026-08-18' \

2267 -H "X-Api-Key: $ANTHROPIC_API_KEY" \

2267 -H "Authorization: Bearer $ANTHROPIC_API_KEY" \

22682268 -d '{

22692269 "action": {

22702270 "type": "enroll_end_user"

api/beta/vaults Changed · +26 / -26 lines

from line 190

190190```bash

191191curl https://api.anthropic.com/v1/vaults \

192192 -H 'Content-Type: application/json' \

193 -H 'anthropic-version: 2023-06-01' \

193 -H 'anthropic-version: 2026-10-21' \

194194 -H 'anthropic-beta: managed-agents-2026-04-01' \

195 -H "X-Api-Key: $ANTHROPIC_API_KEY" \

195 -H "Authorization: Bearer $ANTHROPIC_API_KEY" \

196196 -d '{

197197 "display_name": "Example vault",

198198 "metadata": {

from line 409

409409

410410```bash

411411curl https://api.anthropic.com/v1/vaults \

412 -H 'anthropic-version: 2023-06-01' \

412 -H 'anthropic-version: 2026-10-21' \

413413 -H 'anthropic-beta: managed-agents-2026-04-01' \

414 -H "X-Api-Key: $ANTHROPIC_API_KEY"

414 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

415415```

416416

417417#### Response (200)

from line 613

613613

614614```bash

615615curl https://api.anthropic.com/v1/vaults/$VAULT_ID \

616 -H 'anthropic-version: 2023-06-01' \

616 -H 'anthropic-version: 2026-10-21' \

617617 -H 'anthropic-beta: managed-agents-2026-04-01' \

618 -H "X-Api-Key: $ANTHROPIC_API_KEY"

618 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

619619```

620620

621621#### Response (200)

from line 825

825825```bash

826826curl https://api.anthropic.com/v1/vaults/$VAULT_ID \

827827 -H 'Content-Type: application/json' \

828 -H 'anthropic-version: 2023-06-01' \

828 -H 'anthropic-version: 2026-10-21' \

829829 -H 'anthropic-beta: managed-agents-2026-04-01' \

830 -H "X-Api-Key: $ANTHROPIC_API_KEY" \

830 -H "Authorization: Bearer $ANTHROPIC_API_KEY" \

831831 -d '{

832832 "display_name": "Example vault",

833833 "metadata": {

from line 1005

10051005```bash

10061006curl https://api.anthropic.com/v1/vaults/$VAULT_ID \

10071007 -X DELETE \

1008 -H 'anthropic-version: 2023-06-01' \

1008 -H 'anthropic-version: 2026-10-21' \

10091009 -H 'anthropic-beta: managed-agents-2026-04-01' \

1010 -H "X-Api-Key: $ANTHROPIC_API_KEY"

1010 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

10111011```

10121012

10131013#### Response (200)

from line 1198

11981198```bash

11991199curl https://api.anthropic.com/v1/vaults/$VAULT_ID/archive \

12001200 -X POST \

1201 -H 'anthropic-version: 2023-06-01' \

1201 -H 'anthropic-version: 2026-10-21' \

12021202 -H 'anthropic-beta: managed-agents-2026-04-01' \

1203 -H "X-Api-Key: $ANTHROPIC_API_KEY"

1203 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

12041204```

12051205

12061206#### Response (200)

from line 1748

17481748```bash

17491749curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials \

17501750 -H 'Content-Type: application/json' \

1751 -H 'anthropic-version: 2023-06-01' \

1751 -H 'anthropic-version: 2026-10-21' \

17521752 -H 'anthropic-beta: managed-agents-2026-04-01' \

1753 -H "X-Api-Key: $ANTHROPIC_API_KEY" \

1753 -H "Authorization: Bearer $ANTHROPIC_API_KEY" \

17541754 -d '{

17551755 "auth": {

17561756 "token": "bearer_exampletoken",

from line 2101

21012101

21022102```bash

21032103curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials \

2104 -H 'anthropic-version: 2023-06-01' \

2104 -H 'anthropic-version: 2026-10-21' \

21052105 -H 'anthropic-beta: managed-agents-2026-04-01' \

2106 -H "X-Api-Key: $ANTHROPIC_API_KEY"

2106 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

21072107```

21082108

21092109##### Response (200)

from line 2432

24322432

24332433```bash

24342434curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID \

2435 -H 'anthropic-version: 2023-06-01' \

2435 -H 'anthropic-version: 2026-10-21' \

24362436 -H 'anthropic-beta: managed-agents-2026-04-01' \

2437 -H "X-Api-Key: $ANTHROPIC_API_KEY"

2437 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

24382438```

24392439

24402440##### Response (200)

from line 2901

29012901```bash

29022902curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID \

29032903 -H 'Content-Type: application/json' \

2904 -H 'anthropic-version: 2023-06-01' \

2904 -H 'anthropic-version: 2026-10-21' \

29052905 -H 'anthropic-beta: managed-agents-2026-04-01' \

2906 -H "X-Api-Key: $ANTHROPIC_API_KEY" \

2906 -H "Authorization: Bearer $ANTHROPIC_API_KEY" \

29072907 -d '{

29082908 "display_name": "Example credential",

29092909 "metadata": {

from line 3090

30903090```bash

30913091curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID \

30923092 -X DELETE \

3093 -H 'anthropic-version: 2023-06-01' \

3093 -H 'anthropic-version: 2026-10-21' \

30943094 -H 'anthropic-beta: managed-agents-2026-04-01' \

3095 -H "X-Api-Key: $ANTHROPIC_API_KEY"

3095 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

30963096```

30973097

30983098##### Response (200)

from line 3405

34053405```bash

34063406curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID/archive \

34073407 -X POST \

3408 -H 'anthropic-version: 2023-06-01' \

3408 -H 'anthropic-version: 2026-10-21' \

34093409 -H 'anthropic-beta: managed-agents-2026-04-01' \

3410 -H "X-Api-Key: $ANTHROPIC_API_KEY"

3410 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

34113411```

34123412

34133413##### Response (200)

from line 3676

36763676```bash

36773677curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID/mcp_oauth_validate \

36783678 -X POST \

3679 -H 'anthropic-version: 2023-06-01' \

3679 -H 'anthropic-version: 2026-10-21' \

36803680 -H 'anthropic-beta: managed-agents-2026-04-01' \

3681 -H "X-Api-Key: $ANTHROPIC_API_KEY"

3681 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

36823682```

36833683

36843684##### Response (200)

api/beta/vaults/credentials Changed · +14 / -14 lines

from line 480

480480```bash

481481curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials \

482482 -H 'Content-Type: application/json' \

483 -H 'anthropic-version: 2023-06-01' \

483 -H 'anthropic-version: 2026-10-21' \

484484 -H 'anthropic-beta: managed-agents-2026-04-01' \

485 -H "X-Api-Key: $ANTHROPIC_API_KEY" \

485 -H "Authorization: Bearer $ANTHROPIC_API_KEY" \

486486 -d '{

487487 "auth": {

488488 "token": "bearer_exampletoken",

from line 833

833833

834834```bash

835835curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials \

836 -H 'anthropic-version: 2023-06-01' \

836 -H 'anthropic-version: 2026-10-21' \

837837 -H 'anthropic-beta: managed-agents-2026-04-01' \

838 -H "X-Api-Key: $ANTHROPIC_API_KEY"

838 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

839839```

840840

841841#### Response (200)

from line 1164

11641164

11651165```bash

11661166curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID \

1167 -H 'anthropic-version: 2023-06-01' \

1167 -H 'anthropic-version: 2026-10-21' \

11681168 -H 'anthropic-beta: managed-agents-2026-04-01' \

1169 -H "X-Api-Key: $ANTHROPIC_API_KEY"

1169 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

11701170```

11711171

11721172#### Response (200)

from line 1633

16331633```bash

16341634curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID \

16351635 -H 'Content-Type: application/json' \

1636 -H 'anthropic-version: 2023-06-01' \

1636 -H 'anthropic-version: 2026-10-21' \

16371637 -H 'anthropic-beta: managed-agents-2026-04-01' \

1638 -H "X-Api-Key: $ANTHROPIC_API_KEY" \

1638 -H "Authorization: Bearer $ANTHROPIC_API_KEY" \

16391639 -d '{

16401640 "display_name": "Example credential",

16411641 "metadata": {

from line 1822

18221822```bash

18231823curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID \

18241824 -X DELETE \

1825 -H 'anthropic-version: 2023-06-01' \

1825 -H 'anthropic-version: 2026-10-21' \

18261826 -H 'anthropic-beta: managed-agents-2026-04-01' \

1827 -H "X-Api-Key: $ANTHROPIC_API_KEY"

1827 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

18281828```

18291829

18301830#### Response (200)

from line 2137

21372137```bash

21382138curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID/archive \

21392139 -X POST \

2140 -H 'anthropic-version: 2023-06-01' \

2140 -H 'anthropic-version: 2026-10-21' \

21412141 -H 'anthropic-beta: managed-agents-2026-04-01' \

2142 -H "X-Api-Key: $ANTHROPIC_API_KEY"

2142 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

21432143```

21442144

21452145#### Response (200)

from line 2408

24082408```bash

24092409curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID/mcp_oauth_validate \

24102410 -X POST \

2411 -H 'anthropic-version: 2023-06-01' \

2411 -H 'anthropic-version: 2026-10-21' \

24122412 -H 'anthropic-beta: managed-agents-2026-04-01' \

2413 -H "X-Api-Key: $ANTHROPIC_API_KEY"

2413 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

24142414```

24152415

24162416#### Response (200)

api/compliance Changed · +3716 / -16 lines

This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.

The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.

from line 19

1919

2020#### Query parameters

2121

22- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 544 more`

22- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "account_migration_completed" or 558 more`

2323

2424 Filter activities by type. See the response `data` schema for the additional fields each type returns. Cannot be combined with `exclude_activity_types[]`.

2525

from line 31

3131

3232 User-initiated self-service account deletion.

3333

34 - `"account_migration_completed"`

36 A personal Claude account's migration into the organization finished: the migrated data is now part of the organization.

38 - `"account_migration_failed"`

40 A personal Claude account's migration into the organization did not complete.

42 - `"account_migration_started"`

44 A personal Claude account began migrating into the organization: its data, including conversations, projects and files, is being moved from the member's personal account into this organization.

3446 - `"admin_api_key_created"`

3547

3648 An admin API key was created.

from line 363

351363

352364 Claude Code Review configuration was enabled/disabled for an org.

353365

366 - `"claude_code_review_promo_enrolled"`

367

368 An organization admin enrolled the organization in a Claude Code Review promotion, for example by claiming promotional credits.

369

354370 - `"claude_code_review_repository_added"`

355371

356372 A repository was added to org-level Claude Code Review configuration.

from line 421

405421

406422 - `"claude_code_security_scan_project_updated"`

407423

408 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience.

424 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience, or a user paused the project's scheduled scanning, unpaused it, or lifted a billing pause on it.

409425

410426 - `"claude_code_security_scan_project_visibility_updated"`

411427

from line 739

723739

724740 SAML IdP configuration updated for a public sector organization.

725741

742 - `"claude_skill_auto_disabled"`

743

744 A skill that had been turned on for a member automatically was turned off for them automatically, not by the member; reason says why. A member turning a skill off themselves is recorded as claude_skill_disabled.

745

746 - `"claude_skill_auto_enabled"`

747

748 A skill was turned on for a member automatically, not by the member; trigger gives the cause, such as another member sharing an eligible skill with them. A member turning a skill on themselves is recorded as claude_skill_enabled.

749

726750 - `"claude_skill_created"`

727751

728752 Skill was created.

from line 899

875899

876900 A new version of an existing org-owned desktop extension was uploaded.

877901

902 - `"domain_claim_cancelled"`

903

904 A pending domain claim was cancelled before it took effect, so the personal accounts on the claimed domains will no longer be migrated or deactivated at its deadline.

905

906 - `"domain_claim_deadline_updated"`

907

908 The migration deadline of a pending domain claim was moved to a later or an earlier date by Anthropic staff or an automated process.

909

878910 - `"domain_claim_initiated"`

879911

880912 Domain capture claim initiated over personal accounts on verified domains.

from line 1911

18791911

18801912 An org-level spend limit snooze/ignore state was changed.

18811913

1914 - `"platform_telemetry_destination_auto_disabled"`

1915

1916 A telemetry destination was disabled automatically after deliveries to it failed, so no telemetry is sent to it until an administrator enables it again.

1917

1918 - `"platform_telemetry_destination_created"`

1919

1920 A telemetry destination was registered for the organization.

1921

1922 - `"platform_telemetry_destination_deleted"`

1923

1924 A telemetry destination was deleted.

1925

1926 - `"platform_telemetry_destination_updated"`

1927

1928 A telemetry destination's configuration was updated. State changes and changes of its workspace scope (the type, or the list through an update's workspace_ids) are included; the workspaces an update took off or put on the list are also recorded as workspace_removed and workspace_added activities. Previous and current values are recorded only for the endpoint URL, the traces URL, the content mode and the workspaces type.

1929

1930 - `"platform_telemetry_destination_workspace_added"`

1931

1932 A workspace was added to the workspace list of a telemetry destination. When the list type is "include", the destination starts to receive the spans of that workspace; when it is "exclude", the destination stops receiving them.

1933

1934 - `"platform_telemetry_destination_workspace_removed"`

1935

1936 A workspace was removed from the workspace list of a telemetry destination, by a change to the list or because the destination was deleted. When the list type is "include", the destination stops receiving the spans of that workspace; when it is "exclude", the destination receives them again unless the destination was deleted.

1937

18821938 - `"platform_usage_report_claude_code_viewed"`

18831939

18841940 The Claude Code usage report was viewed.

from line 2322

22662322

22672323 format: date-time

22682324

2269- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 544 more`

2325- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "account_migration_completed" or 558 more`

22702326

22712327 Exclude activities of these types. Cannot be combined with `activity_types[]`.

22722328

from line 2334

22782334

22792335 User-initiated self-service account deletion.

22802336

2337 - `"account_migration_completed"`

2338

2339 A personal Claude account's migration into the organization finished: the migrated data is now part of the organization.

2340

2341 - `"account_migration_failed"`

2342

2343 A personal Claude account's migration into the organization did not complete.

2344

2345 - `"account_migration_started"`

2346

2347 A personal Claude account began migrating into the organization: its data, including conversations, projects and files, is being moved from the member's personal account into this organization.

2348

22812349 - `"admin_api_key_created"`

22822350

22832351 An admin API key was created.

from line 2666

25982666

25992667 Claude Code Review configuration was enabled/disabled for an org.

26002668

2669 - `"claude_code_review_promo_enrolled"`

2670

2671 An organization admin enrolled the organization in a Claude Code Review promotion, for example by claiming promotional credits.

2672

26012673 - `"claude_code_review_repository_added"`

26022674

26032675 A repository was added to org-level Claude Code Review configuration.

from line 2724

26522724

26532725 - `"claude_code_security_scan_project_updated"`

26542726

2655 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience.

2727 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience, or a user paused the project's scheduled scanning, unpaused it, or lifted a billing pause on it.

26562728

26572729 - `"claude_code_security_scan_project_visibility_updated"`

26582730

from line 3042

29703042

29713043 SAML IdP configuration updated for a public sector organization.

29723044

3045 - `"claude_skill_auto_disabled"`

3046

3047 A skill that had been turned on for a member automatically was turned off for them automatically, not by the member; reason says why. A member turning a skill off themselves is recorded as claude_skill_disabled.

3048

3049 - `"claude_skill_auto_enabled"`

3050

3051 A skill was turned on for a member automatically, not by the member; trigger gives the cause, such as another member sharing an eligible skill with them. A member turning a skill on themselves is recorded as claude_skill_enabled.

3052

29733053 - `"claude_skill_created"`

29743054

29753055 Skill was created.

from line 3202

31223202

31233203 A new version of an existing org-owned desktop extension was uploaded.

31243204

3205 - `"domain_claim_cancelled"`

3206

3207 A pending domain claim was cancelled before it took effect, so the personal accounts on the claimed domains will no longer be migrated or deactivated at its deadline.

3208

3209 - `"domain_claim_deadline_updated"`

3210

3211 The migration deadline of a pending domain claim was moved to a later or an earlier date by Anthropic staff or an automated process.

3212

31253213 - `"domain_claim_initiated"`

31263214

31273215 Domain capture claim initiated over personal accounts on verified domains.

from line 4214

41264214

41274215 An org-level spend limit snooze/ignore state was changed.

41284216

4217 - `"platform_telemetry_destination_auto_disabled"`

4218

4219 A telemetry destination was disabled automatically after deliveries to it failed, so no telemetry is sent to it until an administrator enables it again.

4220

4221 - `"platform_telemetry_destination_created"`

4222

4223 A telemetry destination was registered for the organization.

4224

4225 - `"platform_telemetry_destination_deleted"`

4226

4227 A telemetry destination was deleted.

4228

4229 - `"platform_telemetry_destination_updated"`

4230

4231 A telemetry destination's configuration was updated. State changes and changes of its workspace scope (the type, or the list through an update's workspace_ids) are included; the workspaces an update took off or put on the list are also recorded as workspace_removed and workspace_added activities. Previous and current values are recorded only for the endpoint URL, the traces URL, the content mode and the workspaces type.

4232

4233 - `"platform_telemetry_destination_workspace_added"`

4234

4235 A workspace was added to the workspace list of a telemetry destination. When the list type is "include", the destination starts to receive the spans of that workspace; when it is "exclude", the destination stops receiving them.

4236

4237 - `"platform_telemetry_destination_workspace_removed"`

4238

4239 A workspace was removed from the workspace list of a telemetry destination, by a change to the list or because the destination was deleted. When the list type is "include", the destination stops receiving the spans of that workspace; when it is "exclude", the destination receives them again unless the destination was deleted.

4240

41294241 - `"platform_usage_report_claude_code_viewed"`

41304242

41314243 The Claude Code usage report was viewed.

from line 4623

45114623

45124624#### Returns

45134625

4514- `data: optional array of AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 544 more`

4626- `data: optional array of AbuseDecisionReceived or AccountDeleted or AccountMigrationCompleted or 558 more`

45154627

45164628 List of activity records. Each element's `type` field identifies which activity it is and which additional fields are present.

45174629

from line 5103

49915103

49925104 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

49935105

5106 - `AccountMigrationCompleted object`

5107

5108 A personal Claude account's migration into the organization finished: the migrated data is now part of the organization.

5109

5110 - `type: optional "account_migration_completed"`

5111

5112 default: account_migration_completed

5113

5114 - `account_migration_id: string`

5115

5116 Tagged ID of the migration, e.g. "amig_...", matching the account_migration_started activity that opened it.

5117

5118 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

5119

5120 - `APIActor object`

5121

5122 - `type: optional "api_actor"`

5123

5124 default: api_actor

5125

5126 - `api_key_id: string`

5127

5128 - `ip_address: string`

5129

5130 - `user_agent: string`

5131

5132 - `UserActor object`

5133

5134 - `type: optional "user_actor"`

5135

5136 default: user_actor

5137

5138 - `email_address: string`

5139

5140 format: email

5141

5142 - `ip_address: string`

5143

5144 - `user_agent: string`

5145

5146 - `user_id: string`

5147

5148 - `UnauthenticatedUserActor object`

5149

5150 - `type: optional "unauthenticated_user_actor"`

5151

5152 default: unauthenticated_user_actor

5153

5154 - `ip_address: string`

5155

5156 - `user_agent: string`

5157

5158 - `unauthenticated_email_address: optional string or null`

5159

5160 format: email

5161

5162 - `AnthropicActor object`

5163

5164 - `type: optional "anthropic_actor"`

5165

5166 default: anthropic_actor

5167

5168 - `email_address: optional string or null`

5169

5170 format: email

5171

5172 - `SystemActor object`

5173

5174 Automated background processing performed by Anthropic systems, acting

5175 without a user or customer credential.

5176

5177 - `type: optional "system_actor"`

5178

5179 default: system_actor

5180

5181 - `service: optional string or null`

5182

5183 Name of the automated process that performed the action, when known.

5184

5185 - `AdminAPIKeyActor object`

5186

5187 - `type: optional "admin_api_key_actor"`

5188

5189 default: admin_api_key_actor

5190

5191 - `admin_api_key_id: string`

5192

5193 - `ip_address: string`

5194

5195 - `user_agent: string`

5196

5197 - `ServiceAccountActor object`

5198

5199 - `type: optional "service_account_actor"`

5200

5201 default: service_account_actor

5202

5203 - `ip_address: string`

5204

5205 - `service_account_id: string`

5206

5207 - `user_agent: string`

5208

5209 - `ScimDirectorySyncActor object`

5210

5211 - `type: optional "scim_directory_sync_actor"`

5212

5213 default: scim_directory_sync_actor

5214

5215 - `directory_id: string`

5216

5217 - `workos_event_id: string`

5218

5219 - `idp_connection_type: optional string or null`

5220

5221 - `FederatedIdentityActor object`

5222

5223 A federated external workload authenticated via a verified OIDC token.

5224

5225 Carries the verified issuer, subject, and audience claims from the

5226 presented JWT.

5227

5228 - `type: optional "federated_identity_actor"`

5229

5230 default: federated_identity_actor

5231

5232 - `issuer: string`

5233

5234 - `subject: string`

5235

5236 - `audience: optional array of string`

5237

5238 - `ip_address: optional string or null`

5239

5240 - `user_agent: optional string or null`

5241

5242 - `FederatedActor object`

5243

5244 An external identity asserted by a trusted provider — a cloud-provider

5245 gateway or a customer-registered federation issuer — acting without an

5246 Anthropic-provisioned account or service account.

5247

5248 - `type: optional "federated_actor"`

5249

5250 default: federated_actor

5251

5252 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

5253

5254 - `FederatedActorAwsProvider object`

5255

5256 Asserting party: the AWS account the organization is bound to.

5257

5258 - `type: optional "aws"`

5259

5260 default: aws

5261

5262 - `account_id: string`

5263

5264 - `signed_principal: string`

5265

5266 The AWS-signed ARN of the IAM principal that requested the token.

5267

5268 - `FederatedActorAzureProvider object`

5269

5270 Asserting party: the Azure subscription the organization is bound to.

5271

5272 - `type: optional "azure"`

5273

5274 default: azure

5275

5276 - `subscription_id: string`

5277

5278 - `FederatedActorGcpProvider object`

5279

5280 Asserting party: the GCP project the organization is bound to.

5281

5282 - `type: optional "gcp"`

5283

5284 default: gcp

5285

5286 - `project_number: string`

5287

5288 - `FederatedActorOidcProvider object`

5289

5290 Asserting party: a customer-registered OIDC federation issuer.

5291

5292 - `type: optional "oidc"`

5293

5294 default: oidc

5295

5296 - `issuer: optional string or null`

5297

5298 The federation issuer's URL. Null when the presented credential failed verification.

5299

5300 - `ip_address: optional string or null`

5301

5302 - `subject: optional string or null`

5303

5304 The provider's verified identifier for the caller; its form depends on the provider.

5305

5306 - `user_agent: optional string or null`

5307

5308 - `AttestedDeviceActor object`

5309

5310 An attested mobile device authenticated via Apple App Attest.

5311

5312 - `type: optional "attested_device_actor"`

5313

5314 default: attested_device_actor

5315

5316 - `external_client_id: string`

5317

5318 - `kid_hash: string`

5319

5320 - `ip_address: optional string or null`

5321

5322 - `user_agent: optional string or null`

5323

5324 - `id: optional string`

5325

5326 Unique identifier for the activity e.g. 'activity_abcd1234'

5327

5328 - `created_at: optional string`

5329

5330 When this activity occurred.

5331

5332 format: date-time

5333

5334 - `migrated_user_email: optional string or null`

5335

5336 Email address of the user whose personal account was migrated, when known.

5337

5338 - `migrated_user_id: optional string or null`

5339

5340 Tagged ID of the user whose personal account was migrated, e.g. "user_...", when known.

5341

5342 - `organization_id: optional string or null`

5343

5344 Organization ID this activity is associated with

5345

5346 - `organization_uuid: optional string or null`

5347

5348 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

5349

5350 - `AccountMigrationFailed object`

5351

5352 A personal Claude account's migration into the organization did not complete.

5353

5354 - `type: optional "account_migration_failed"`

5355

5356 default: account_migration_failed

5357

5358 - `account_migration_id: string`

5359

5360 Tagged ID of the migration, e.g. "amig_...", matching the account_migration_started activity that opened it, if one was recorded; a later retry is a new migration with its own ID.

5361

5362 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

5363

5364 - `APIActor object`

5365

5366 - `type: optional "api_actor"`

5367

5368 default: api_actor

5369

5370 - `api_key_id: string`

5371

5372 - `ip_address: string`

5373

5374 - `user_agent: string`

5375

5376 - `UserActor object`

5377

5378 - `type: optional "user_actor"`

5379

5380 default: user_actor

5381

5382 - `email_address: string`

5383

5384 format: email

5385

5386 - `ip_address: string`

5387

5388 - `user_agent: string`

5389

5390 - `user_id: string`

5391

5392 - `UnauthenticatedUserActor object`

5393

5394 - `type: optional "unauthenticated_user_actor"`

5395

5396 default: unauthenticated_user_actor

5397

5398 - `ip_address: string`

5399

5400 - `user_agent: string`

5401

5402 - `unauthenticated_email_address: optional string or null`

5403

5404 format: email

5405

5406 - `AnthropicActor object`

5407

5408 - `type: optional "anthropic_actor"`

5409

5410 default: anthropic_actor

5411

5412 - `email_address: optional string or null`

5413

5414 format: email

5415

5416 - `SystemActor object`

5417

5418 Automated background processing performed by Anthropic systems, acting

5419 without a user or customer credential.

5420

5421 - `type: optional "system_actor"`

5422

5423 default: system_actor

5424

5425 - `service: optional string or null`

5426

5427 Name of the automated process that performed the action, when known.

5428

5429 - `AdminAPIKeyActor object`

5430

5431 - `type: optional "admin_api_key_actor"`

5432

5433 default: admin_api_key_actor

5434

5435 - `admin_api_key_id: string`

5436

5437 - `ip_address: string`

5438

5439 - `user_agent: string`

5440

5441 - `ServiceAccountActor object`

5442

5443 - `type: optional "service_account_actor"`

5444

5445 default: service_account_actor

5446

5447 - `ip_address: string`

5448

5449 - `service_account_id: string`

5450

5451 - `user_agent: string`

5452

5453 - `ScimDirectorySyncActor object`

5454

5455 - `type: optional "scim_directory_sync_actor"`

5456

5457 default: scim_directory_sync_actor

5458

5459 - `directory_id: string`

5460

5461 - `workos_event_id: string`

5462

5463 - `idp_connection_type: optional string or null`

5464

5465 - `FederatedIdentityActor object`

5466

5467 A federated external workload authenticated via a verified OIDC token.

5468

5469 Carries the verified issuer, subject, and audience claims from the

5470 presented JWT.

5471

5472 - `type: optional "federated_identity_actor"`

5473

5474 default: federated_identity_actor

5475

5476 - `issuer: string`

5477

5478 - `subject: string`

5479

5480 - `audience: optional array of string`

5481

5482 - `ip_address: optional string or null`

5483

5484 - `user_agent: optional string or null`

5485

5486 - `FederatedActor object`

5487

5488 An external identity asserted by a trusted provider — a cloud-provider

5489 gateway or a customer-registered federation issuer — acting without an

5490 Anthropic-provisioned account or service account.

5491

5492 - `type: optional "federated_actor"`

5493

5494 default: federated_actor

5495

5496 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

5497

5498 - `FederatedActorAwsProvider object`

5499

5500 Asserting party: the AWS account the organization is bound to.

5501

5502 - `type: optional "aws"`

5503

5504 default: aws

5505

5506 - `account_id: string`

5507

5508 - `signed_principal: string`

5509

5510 The AWS-signed ARN of the IAM principal that requested the token.

5511

5512 - `FederatedActorAzureProvider object`

5513

5514 Asserting party: the Azure subscription the organization is bound to.

5515

5516 - `type: optional "azure"`

5517

5518 default: azure

5519

5520 - `subscription_id: string`

5521

5522 - `FederatedActorGcpProvider object`

5523

5524 Asserting party: the GCP project the organization is bound to.

5525

5526 - `type: optional "gcp"`

5527

5528 default: gcp

5529

5530 - `project_number: string`

5531

5532 - `FederatedActorOidcProvider object`

5533

5534 Asserting party: a customer-registered OIDC federation issuer.

5535

5536 - `type: optional "oidc"`

5537

5538 default: oidc

5539

5540 - `issuer: optional string or null`

5541

5542 The federation issuer's URL. Null when the presented credential failed verification.

5543

5544 - `ip_address: optional string or null`

5545

5546 - `subject: optional string or null`

5547

5548 The provider's verified identifier for the caller; its form depends on the provider.

5549

5550 - `user_agent: optional string or null`

5551

5552 - `AttestedDeviceActor object`

5553

5554 An attested mobile device authenticated via Apple App Attest.

5555

5556 - `type: optional "attested_device_actor"`

5557

5558 default: attested_device_actor

5559

5560 - `external_client_id: string`

5561

5562 - `kid_hash: string`

5563

5564 - `ip_address: optional string or null`

5565

5566 - `user_agent: optional string or null`

5567

5568 - `id: optional string`

5569

5570 Unique identifier for the activity e.g. 'activity_abcd1234'

5571

5572 - `created_at: optional string`

5573

5574 When this activity occurred.

5575

5576 format: date-time

5577

5578 - `failure_reasons: optional array of "already_member_of_target" or "already_migrating" or "anthropic_staff_action" or 12 more`

5579

5580 Why the migration did not complete, each reason listed once. In these values "source" is the member's personal account and "target" is this organization. "source_equals_target", "source_not_personal_org", "user_not_member_of_source" and "user_not_sole_member_of_source": the account is not a single-member personal account that can be migrated. "target_not_enterprise_org": this organization's plan does not accept the migration. "already_member_of_target": the migration already happened. "target_membership_not_provisioned" and "target_membership_unassigned_no_seats": the member has no usable seat in this organization. "already_migrating": another migration of the same account is in progress. "source_too_large": the personal account holds more data than a migration can move. "target_became_inactive": this organization became inactive before the migration finished. "migration_failed": an error stopped the migration. "anthropic_staff_action": Anthropic staff stopped the migration. "migration_blocked_redacted": stands in for every reason that is not shared with the organization. Values may be added over time; treat an unrecognized value as a generic failure. "unspecified" is never emitted.

5581

5582 - `"already_member_of_target"`

5583

5584 - `"already_migrating"`

5585

5586 - `"anthropic_staff_action"`

5587

5588 - `"migration_blocked_redacted"`

5589

5590 - `"migration_failed"`

5591

5592 - `"source_equals_target"`

5593

5594 - `"source_not_personal_org"`

5595

5596 - `"source_too_large"`

5597

5598 - `"target_became_inactive"`

5599

5600 - `"target_membership_not_provisioned"`

5601

5602 - `"target_membership_unassigned_no_seats"`

5603

5604 - `"target_not_enterprise_org"`

5605

5606 - `"unspecified"`

5607

5608 - `"user_not_member_of_source"`

5609

5610 - `"user_not_sole_member_of_source"`

5611

5612 - `migrated_user_email: optional string or null`

5613

5614 Email address of the user whose personal account was being migrated, when known.

5615

5616 - `migrated_user_id: optional string or null`

5617

5618 Tagged ID of the user whose personal account was being migrated, e.g. "user_...", when known.

5619

5620 - `organization_id: optional string or null`

5621

5622 Organization ID this activity is associated with

5623

5624 - `organization_uuid: optional string or null`

5625

5626 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

5627

5628 - `AccountMigrationStarted object`

5629

5630 A personal Claude account began migrating into the organization: its data, including conversations, projects and files, is being moved from the member's personal account into this organization.

5631

5632 - `type: optional "account_migration_started"`

5633

5634 default: account_migration_started

5635

5636 - `account_migration_id: string`

5637

5638 Tagged ID of the migration, e.g. "amig_...". The same ID appears on the completed or failed activity that closes the migration, when one is recorded.

5639

5640 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

5641

5642 - `APIActor object`

5643

5644 - `type: optional "api_actor"`

5645

5646 default: api_actor

5647

5648 - `api_key_id: string`

5649

5650 - `ip_address: string`

5651

5652 - `user_agent: string`

5653

5654 - `UserActor object`

5655

5656 - `type: optional "user_actor"`

5657

5658 default: user_actor

5659

5660 - `email_address: string`

5661

5662 format: email

5663

5664 - `ip_address: string`

5665

5666 - `user_agent: string`

5667

5668 - `user_id: string`

5669

5670 - `UnauthenticatedUserActor object`

5671

5672 - `type: optional "unauthenticated_user_actor"`

5673

5674 default: unauthenticated_user_actor

5675

5676 - `ip_address: string`

5677

5678 - `user_agent: string`

5679

5680 - `unauthenticated_email_address: optional string or null`

5681

5682 format: email

5683

5684 - `AnthropicActor object`

5685

5686 - `type: optional "anthropic_actor"`

5687

5688 default: anthropic_actor

5689

5690 - `email_address: optional string or null`

5691

5692 format: email

5693

5694 - `SystemActor object`

5695

5696 Automated background processing performed by Anthropic systems, acting

5697 without a user or customer credential.

5698

5699 - `type: optional "system_actor"`

5700

5701 default: system_actor

5702

5703 - `service: optional string or null`

5704

5705 Name of the automated process that performed the action, when known.

5706

5707 - `AdminAPIKeyActor object`

5708

5709 - `type: optional "admin_api_key_actor"`

5710

5711 default: admin_api_key_actor

5712

5713 - `admin_api_key_id: string`

5714

5715 - `ip_address: string`

5716

5717 - `user_agent: string`

5718

5719 - `ServiceAccountActor object`

5720

5721 - `type: optional "service_account_actor"`

5722

5723 default: service_account_actor

5724

5725 - `ip_address: string`

5726

5727 - `service_account_id: string`

5728

5729 - `user_agent: string`

5730

5731 - `ScimDirectorySyncActor object`

5732

5733 - `type: optional "scim_directory_sync_actor"`

5734

5735 default: scim_directory_sync_actor

5736

5737 - `directory_id: string`

5738

5739 - `workos_event_id: string`

5740

5741 - `idp_connection_type: optional string or null`

5742

5743 - `FederatedIdentityActor object`

5744

5745 A federated external workload authenticated via a verified OIDC token.

5746

5747 Carries the verified issuer, subject, and audience claims from the

5748 presented JWT.

5749

5750 - `type: optional "federated_identity_actor"`

5751

5752 default: federated_identity_actor

5753

5754 - `issuer: string`

5755

5756 - `subject: string`

5757

5758 - `audience: optional array of string`

5759

5760 - `ip_address: optional string or null`

5761

5762 - `user_agent: optional string or null`

5763

5764 - `FederatedActor object`

5765

5766 An external identity asserted by a trusted provider — a cloud-provider

5767 gateway or a customer-registered federation issuer — acting without an

5768 Anthropic-provisioned account or service account.

5769

5770 - `type: optional "federated_actor"`

5771

5772 default: federated_actor

5773

5774 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

5775

5776 - `FederatedActorAwsProvider object`

5777

5778 Asserting party: the AWS account the organization is bound to.

5779

5780 - `type: optional "aws"`

5781

5782 default: aws

5783

5784 - `account_id: string`

5785

5786 - `signed_principal: string`

5787

5788 The AWS-signed ARN of the IAM principal that requested the token.

5789

5790 - `FederatedActorAzureProvider object`

5791

5792 Asserting party: the Azure subscription the organization is bound to.

5793

5794 - `type: optional "azure"`

5795

5796 default: azure

5797

5798 - `subscription_id: string`

5799

5800 - `FederatedActorGcpProvider object`

5801

5802 Asserting party: the GCP project the organization is bound to.

5803

5804 - `type: optional "gcp"`

5805

5806 default: gcp

5807

5808 - `project_number: string`

5809

5810 - `FederatedActorOidcProvider object`

5811

5812 Asserting party: a customer-registered OIDC federation issuer.

5813

5814 - `type: optional "oidc"`

5815

5816 default: oidc

5817

5818 - `issuer: optional string or null`

5819

5820 The federation issuer's URL. Null when the presented credential failed verification.

5821

5822 - `ip_address: optional string or null`

5823

5824 - `subject: optional string or null`

5825

5826 The provider's verified identifier for the caller; its form depends on the provider.

5827

5828 - `user_agent: optional string or null`

5829

5830 - `AttestedDeviceActor object`

5831

5832 An attested mobile device authenticated via Apple App Attest.

5833

5834 - `type: optional "attested_device_actor"`

5835

5836 default: attested_device_actor

5837

5838 - `external_client_id: string`

5839

5840 - `kid_hash: string`

5841

5842 - `ip_address: optional string or null`

5843

5844 - `user_agent: optional string or null`

5845

5846 - `migrated_user_email: string`

5847

5848 Email address of the user whose personal account is being migrated.

5849

5850 - `migrated_user_id: string`

5851

5852 Tagged ID of the user whose personal account is being migrated, e.g. "user_...".

5853

5854 - `id: optional string`

5855

5856 Unique identifier for the activity e.g. 'activity_abcd1234'

5857

5858 - `created_at: optional string`

5859

5860 When this activity occurred.

5861

5862 format: date-time

5863

5864 - `organization_id: optional string or null`

5865

5866 Organization ID this activity is associated with

5867

5868 - `organization_uuid: optional string or null`

5869

5870 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

5871

49945872 - `AdminAPIKeyCreated object`

49955873

49965874 An admin API key was created.

from line 26357

2547926357

2548026358 Per-review spend limit in USD before the change. Absent when no configuration existed before this update or no limit was set.

2548126359

26360 - `previous_review_level: optional string or null`

26361

26362 Review level set for the organization's code reviews before the change: "low" (Quick), "medium" (Standard) or "high" (Deep). Absent when no configuration existed before this update or no level was set.

26363

2548226364 - `previous_show_tips: optional boolean or null`

2548326365

2548426366 Whether tip-style pull-request comments were enabled before the change. Absent when no configuration existed before this update.

from line 26369

2548726369

2548826370 Whether the verification stage of code review was enabled for the organization before the change. Absent when no configuration existed before this update or no preference was set.

2548926371

26372 - `review_level: optional string or null`

26373

26374 Review level now set for the organization's code reviews: "low" (Quick), "medium" (Standard) or "high" (Deep). Repositories without their own level use this one. Absent when no level is set; the default level, Standard, then applies.

26375

2549026376 - `show_tips: optional boolean or null`

2549126377

2549226378 Whether tip-style pull-request comments are now enabled

from line 26381

2549526381

2549626382 Whether the verification stage of code review is now enabled for the organization. Absent when the organization has not set a preference and the default applies.

2549726383

26384 - `ClaudeCodeReviewPromoEnrolled object`

26385

26386 An organization admin enrolled the organization in a Claude Code Review promotion, for example by claiming promotional credits.

26387

26388 - `type: optional "claude_code_review_promo_enrolled"`

26389

26390 default: claude_code_review_promo_enrolled

26391

26392 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

26393

26394 - `APIActor object`

26395

26396 - `type: optional "api_actor"`

26397

26398 default: api_actor

26399

26400 - `api_key_id: string`

26401

26402 - `ip_address: string`

26403

26404 - `user_agent: string`

26405

26406 - `UserActor object`

26407

26408 - `type: optional "user_actor"`

26409

26410 default: user_actor

26411

26412 - `email_address: string`

26413

26414 format: email

26415

26416 - `ip_address: string`

26417

26418 - `user_agent: string`

26419

26420 - `user_id: string`

26421

26422 - `UnauthenticatedUserActor object`

26423

26424 - `type: optional "unauthenticated_user_actor"`

26425

26426 default: unauthenticated_user_actor

26427

26428 - `ip_address: string`

26429

26430 - `user_agent: string`

26431

26432 - `unauthenticated_email_address: optional string or null`

26433

26434 format: email

26435

26436 - `AnthropicActor object`

26437

26438 - `type: optional "anthropic_actor"`

26439

26440 default: anthropic_actor

26441

26442 - `email_address: optional string or null`

26443

26444 format: email

26445

26446 - `SystemActor object`

26447

26448 Automated background processing performed by Anthropic systems, acting

26449 without a user or customer credential.

26450

26451 - `type: optional "system_actor"`

26452

26453 default: system_actor

26454

26455 - `service: optional string or null`

26456

26457 Name of the automated process that performed the action, when known.

26458

26459 - `AdminAPIKeyActor object`

26460

26461 - `type: optional "admin_api_key_actor"`

26462

26463 default: admin_api_key_actor

26464

26465 - `admin_api_key_id: string`

26466

26467 - `ip_address: string`

26468

26469 - `user_agent: string`

26470

26471 - `ServiceAccountActor object`

26472

26473 - `type: optional "service_account_actor"`

26474

26475 default: service_account_actor

26476

26477 - `ip_address: string`

26478

26479 - `service_account_id: string`

26480

26481 - `user_agent: string`

26482

26483 - `ScimDirectorySyncActor object`

26484

26485 - `type: optional "scim_directory_sync_actor"`

26486

26487 default: scim_directory_sync_actor

26488

26489 - `directory_id: string`

26490

26491 - `workos_event_id: string`

26492

26493 - `idp_connection_type: optional string or null`

26494

26495 - `FederatedIdentityActor object`

26496

26497 A federated external workload authenticated via a verified OIDC token.

26498

26499 Carries the verified issuer, subject, and audience claims from the

26500 presented JWT.

26501

26502 - `type: optional "federated_identity_actor"`

26503

26504 default: federated_identity_actor

26505

26506 - `issuer: string`

26507

26508 - `subject: string`

26509

26510 - `audience: optional array of string`

26511

26512 - `ip_address: optional string or null`

26513

26514 - `user_agent: optional string or null`

26515

26516 - `FederatedActor object`

26517

26518 An external identity asserted by a trusted provider — a cloud-provider

26519 gateway or a customer-registered federation issuer — acting without an

26520 Anthropic-provisioned account or service account.

26521

26522 - `type: optional "federated_actor"`

26523

26524 default: federated_actor

26525

26526 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

26527

26528 - `FederatedActorAwsProvider object`

26529

26530 Asserting party: the AWS account the organization is bound to.

26531

26532 - `type: optional "aws"`

26533

26534 default: aws

26535

26536 - `account_id: string`

26537

26538 - `signed_principal: string`

26539

26540 The AWS-signed ARN of the IAM principal that requested the token.

26541

26542 - `FederatedActorAzureProvider object`

26543

26544 Asserting party: the Azure subscription the organization is bound to.

26545

26546 - `type: optional "azure"`

26547

26548 default: azure

26549

26550 - `subscription_id: string`

26551

26552 - `FederatedActorGcpProvider object`

26553

26554 Asserting party: the GCP project the organization is bound to.

26555

26556 - `type: optional "gcp"`

26557

26558 default: gcp

26559

26560 - `project_number: string`

26561

26562 - `FederatedActorOidcProvider object`

26563

26564 Asserting party: a customer-registered OIDC federation issuer.

26565

26566 - `type: optional "oidc"`

26567

26568 default: oidc

26569

26570 - `issuer: optional string or null`

26571

26572 The federation issuer's URL. Null when the presented credential failed verification.

26573

26574 - `ip_address: optional string or null`

26575

26576 - `subject: optional string or null`

26577

26578 The provider's verified identifier for the caller; its form depends on the provider.

26579

26580 - `user_agent: optional string or null`

26581

26582 - `AttestedDeviceActor object`

26583

26584 An attested mobile device authenticated via Apple App Attest.

26585

26586 - `type: optional "attested_device_actor"`

26587

26588 default: attested_device_actor

26589

26590 - `external_client_id: string`

26591

26592 - `kid_hash: string`

26593

26594 - `ip_address: optional string or null`

26595

26596 - `user_agent: optional string or null`

26597

26598 - `promo_id: string`

26599

26600 Identifier of the promotion the organization enrolled in.

26601

26602 - `id: optional string`

26603

26604 Unique identifier for the activity e.g. 'activity_abcd1234'

26605

26606 - `created_at: optional string`

26607

26608 When this activity occurred.

26609

26610 format: date-time

26611

26612 - `expires_at: optional string or null`

26613

26614 When the organization's promotional access or credits expire.

26615

26616 format: date-time

26617

26618 - `organization_id: optional string or null`

26619

26620 Organization ID this activity is associated with

26621

26622 - `organization_uuid: optional string or null`

26623

26624 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

26625

2549826626 - `ClaudeCodeReviewRepositoryAdded object`

2549926627

2550026628 A repository was added to org-level Claude Code Review configuration.

from line 27359

2623127359

2623227360 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

2623327361

27362 - `previous_review_level: optional string or null`

27363

27364 Review level set for this repository's code reviews before the change: "low" (Quick), "medium" (Standard) or "high" (Deep). Absent when no level was set.

27365

27366 - `review_level: optional string or null`

27367

27368 Review level now set for this repository's code reviews: "low" (Quick), "medium" (Standard) or "high" (Deep). Absent when no level is set; the repository then uses the organization-wide level (review_level on claude_code_review_config_updated), or Standard if none is set.

27369

2623427370 - `status: optional string or null`

2623527371

2623627372 Updated status (ACTIVE/INACTIVE)

from line 29835

2869929835

2870029836 - `ClaudeCodeSecurityScanProjectUpdated object`

2870129837

28702 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience.

29838 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience, or a user paused the project's scheduled scanning, unpaused it, or lifted a billing pause on it.

2870329839

2870429840 - `type: optional "claude_code_security_scan_project_updated"`

2870529841

2870629842 default: claude_code_security_scan_project_updated

2870729843

28708 - `action: "archived" or "created" or "migrated" or 3 more`

29844 - `action: "archived" or "billing_pause_lifted" or "created" or 6 more`

2870929845

2871029846 The state change applied to the scan project.

2871129847

2871229848 - `"archived"`

2871329849

29850 - `"billing_pause_lifted"`

29851

2871429852 - `"created"`

2871529853

2871629854 - `"migrated"`

2871729855

29856 - `"paused"`

29857

2871829858 - `"resumed"`

2871929859

2872029860 - `"unarchived"`

2872129861

29862 - `"unpaused"`

29863

2872229864 - `"unspecified"`

2872329865

2872429866 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

from line 40119

3897740119

3897840120 A short provider-specific identifier for the external resource after the update, e.g. `owner/repo` for GitHub or a file ID for Google Drive.

3897940121

40122 - `ClaudeSkillAutoDisabled object`

40123

40124 A skill that had been turned on for a member automatically was turned off for them automatically, not by the member; reason says why. A member turning a skill off themselves is recorded as claude_skill_disabled.

40125

40126 - `type: optional "claude_skill_auto_disabled"`

40127

40128 default: claude_skill_auto_disabled

40129

40130 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

40131

40132 - `APIActor object`

40133

40134 - `type: optional "api_actor"`

40135

40136 default: api_actor

40137

40138 - `api_key_id: string`

40139

40140 - `ip_address: string`

40141

40142 - `user_agent: string`

40143

40144 - `UserActor object`

40145

40146 - `type: optional "user_actor"`

40147

40148 default: user_actor

40149

40150 - `email_address: string`

40151

40152 format: email

40153

40154 - `ip_address: string`

40155

40156 - `user_agent: string`

40157

40158 - `user_id: string`

40159

40160 - `UnauthenticatedUserActor object`

40161

40162 - `type: optional "unauthenticated_user_actor"`

40163

40164 default: unauthenticated_user_actor

40165

40166 - `ip_address: string`

40167

40168 - `user_agent: string`

40169

40170 - `unauthenticated_email_address: optional string or null`

40171

40172 format: email

40173

40174 - `AnthropicActor object`

40175

40176 - `type: optional "anthropic_actor"`

40177

40178 default: anthropic_actor

40179

40180 - `email_address: optional string or null`

40181

40182 format: email

40183

40184 - `SystemActor object`

40185

40186 Automated background processing performed by Anthropic systems, acting

40187 without a user or customer credential.

40188

40189 - `type: optional "system_actor"`

40190

40191 default: system_actor

40192

40193 - `service: optional string or null`

40194

40195 Name of the automated process that performed the action, when known.

40196

40197 - `AdminAPIKeyActor object`

40198

40199 - `type: optional "admin_api_key_actor"`

40200

40201 default: admin_api_key_actor

40202

40203 - `admin_api_key_id: string`

40204

40205 - `ip_address: string`

40206

40207 - `user_agent: string`

40208

40209 - `ServiceAccountActor object`

40210

40211 - `type: optional "service_account_actor"`

40212

40213 default: service_account_actor

40214

40215 - `ip_address: string`

40216

40217 - `service_account_id: string`

40218

40219 - `user_agent: string`

40220

40221 - `ScimDirectorySyncActor object`

40222

40223 - `type: optional "scim_directory_sync_actor"`

40224

40225 default: scim_directory_sync_actor

40226

40227 - `directory_id: string`

40228

40229 - `workos_event_id: string`

40230

40231 - `idp_connection_type: optional string or null`

40232

40233 - `FederatedIdentityActor object`

40234

40235 A federated external workload authenticated via a verified OIDC token.

40236

40237 Carries the verified issuer, subject, and audience claims from the

40238 presented JWT.

40239

40240 - `type: optional "federated_identity_actor"`

40241

40242 default: federated_identity_actor

40243

40244 - `issuer: string`

40245

40246 - `subject: string`

40247

40248 - `audience: optional array of string`

40249

40250 - `ip_address: optional string or null`

40251

40252 - `user_agent: optional string or null`

40253

40254 - `FederatedActor object`

40255

40256 An external identity asserted by a trusted provider — a cloud-provider

40257 gateway or a customer-registered federation issuer — acting without an

40258 Anthropic-provisioned account or service account.

40259

40260 - `type: optional "federated_actor"`

40261

40262 default: federated_actor

40263

40264 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

40265

40266 - `FederatedActorAwsProvider object`

40267

40268 Asserting party: the AWS account the organization is bound to.

40269

40270 - `type: optional "aws"`

40271

40272 default: aws

40273

40274 - `account_id: string`

40275

40276 - `signed_principal: string`

40277

40278 The AWS-signed ARN of the IAM principal that requested the token.

40279

40280 - `FederatedActorAzureProvider object`

40281

40282 Asserting party: the Azure subscription the organization is bound to.

40283

40284 - `type: optional "azure"`

40285

40286 default: azure

40287

40288 - `subscription_id: string`

40289

40290 - `FederatedActorGcpProvider object`

40291

40292 Asserting party: the GCP project the organization is bound to.

40293

40294 - `type: optional "gcp"`

40295

40296 default: gcp

40297

40298 - `project_number: string`

40299

40300 - `FederatedActorOidcProvider object`

40301

40302 Asserting party: a customer-registered OIDC federation issuer.

40303

40304 - `type: optional "oidc"`

40305

40306 default: oidc

40307

40308 - `issuer: optional string or null`

40309

40310 The federation issuer's URL. Null when the presented credential failed verification.

40311

40312 - `ip_address: optional string or null`

40313

40314 - `subject: optional string or null`

40315

40316 The provider's verified identifier for the caller; its form depends on the provider.

40317

40318 - `user_agent: optional string or null`

40319

40320 - `AttestedDeviceActor object`

40321

40322 An attested mobile device authenticated via Apple App Attest.

40323

40324 - `type: optional "attested_device_actor"`

40325

40326 default: attested_device_actor

40327

40328 - `external_client_id: string`

40329

40330 - `kid_hash: string`

40331

40332 - `ip_address: optional string or null`

40333

40334 - `user_agent: optional string or null`

40335

40336 - `reason: "auto_enable_reverted" or "content_changed" or "unspecified"`

40337

40338 Why the skill was turned off automatically: "content_changed" (a change to the skill was saved or attempted, or the skill was scanned again, and it could not be confirmed as still eligible to be on automatically) or "auto_enable_reverted" (Anthropic turned off skills that had been turned on automatically; not in response to a change to this skill).

40339

40340 - `"auto_enable_reverted"`

40341

40342 - `"content_changed"`

40343

40344 - `"unspecified"`

40345

40346 - `user_id: string`

40347

40348 The member the skill was turned off for.

40349

40350 - `id: optional string`

40351

40352 Unique identifier for the activity e.g. 'activity_abcd1234'

40353

40354 - `created_at: optional string`

40355

40356 When this activity occurred.

40357

40358 format: date-time

40359

40360 - `organization_id: optional string or null`

40361

40362 Organization ID this activity is associated with

40363

40364 - `organization_uuid: optional string or null`

40365

40366 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

40367

40368 - `shared_by_user_id: optional string or null`

40369

40370 For a skill that had been turned on because it was shared: the member who shared it.

40371

40372 - `skill_id: optional string or null`

40373

40374 The skill that was turned off.

40375

40376 - `skill_name: optional string or null`

40377

40378 The name of the skill that was turned off.

40379

40380 - `skill_version: optional string or null`

40381

40382 The version of the skill the member had just before it was turned off. Absent when not known.

40383

40384 - `ClaudeSkillAutoEnabled object`

40385

40386 A skill was turned on for a member automatically, not by the member; trigger gives the cause, such as another member sharing an eligible skill with them. A member turning a skill on themselves is recorded as claude_skill_enabled.

40387

40388 - `type: optional "claude_skill_auto_enabled"`

40389

40390 default: claude_skill_auto_enabled

40391

40392 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

40393

40394 - `APIActor object`

40395

40396 - `type: optional "api_actor"`

40397

40398 default: api_actor

40399

40400 - `api_key_id: string`

40401

40402 - `ip_address: string`

40403

40404 - `user_agent: string`

40405

40406 - `UserActor object`

40407

40408 - `type: optional "user_actor"`

40409

40410 default: user_actor

40411

40412 - `email_address: string`

40413

40414 format: email

40415

40416 - `ip_address: string`

40417

40418 - `user_agent: string`

40419

40420 - `user_id: string`

40421

40422 - `UnauthenticatedUserActor object`

40423

40424 - `type: optional "unauthenticated_user_actor"`

40425

40426 default: unauthenticated_user_actor

40427

40428 - `ip_address: string`

40429

40430 - `user_agent: string`

40431

40432 - `unauthenticated_email_address: optional string or null`

40433

40434 format: email

40435

40436 - `AnthropicActor object`

40437

40438 - `type: optional "anthropic_actor"`

40439

40440 default: anthropic_actor

40441

40442 - `email_address: optional string or null`

40443

40444 format: email

40445

40446 - `SystemActor object`

40447

40448 Automated background processing performed by Anthropic systems, acting

40449 without a user or customer credential.

40450

40451 - `type: optional "system_actor"`

40452

40453 default: system_actor

40454

40455 - `service: optional string or null`

40456

40457 Name of the automated process that performed the action, when known.

40458

40459 - `AdminAPIKeyActor object`

40460

40461 - `type: optional "admin_api_key_actor"`

40462

40463 default: admin_api_key_actor

40464

40465 - `admin_api_key_id: string`

40466

40467 - `ip_address: string`

40468

40469 - `user_agent: string`

40470

40471 - `ServiceAccountActor object`

40472

40473 - `type: optional "service_account_actor"`

40474

40475 default: service_account_actor

40476

40477 - `ip_address: string`

40478

40479 - `service_account_id: string`

40480

40481 - `user_agent: string`

40482

40483 - `ScimDirectorySyncActor object`

40484

40485 - `type: optional "scim_directory_sync_actor"`

40486

40487 default: scim_directory_sync_actor

40488

40489 - `directory_id: string`

40490

40491 - `workos_event_id: string`

40492

40493 - `idp_connection_type: optional string or null`

40494

40495 - `FederatedIdentityActor object`

40496

40497 A federated external workload authenticated via a verified OIDC token.

40498

40499 Carries the verified issuer, subject, and audience claims from the

40500 presented JWT.

40501

40502 - `type: optional "federated_identity_actor"`

40503

40504 default: federated_identity_actor

40505

40506 - `issuer: string`

40507

40508 - `subject: string`

40509

40510 - `audience: optional array of string`

40511

40512 - `ip_address: optional string or null`

40513

40514 - `user_agent: optional string or null`

40515

40516 - `FederatedActor object`

40517

40518 An external identity asserted by a trusted provider — a cloud-provider

40519 gateway or a customer-registered federation issuer — acting without an

40520 Anthropic-provisioned account or service account.

40521

40522 - `type: optional "federated_actor"`

40523

40524 default: federated_actor

40525

40526 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

40527

40528 - `FederatedActorAwsProvider object`

40529

40530 Asserting party: the AWS account the organization is bound to.

40531

40532 - `type: optional "aws"`

40533

40534 default: aws

40535

40536 - `account_id: string`

40537

40538 - `signed_principal: string`

40539

40540 The AWS-signed ARN of the IAM principal that requested the token.

40541

40542 - `FederatedActorAzureProvider object`

40543

40544 Asserting party: the Azure subscription the organization is bound to.

40545

40546 - `type: optional "azure"`

40547

40548 default: azure

40549

40550 - `subscription_id: string`

40551

40552 - `FederatedActorGcpProvider object`

40553

40554 Asserting party: the GCP project the organization is bound to.

40555

40556 - `type: optional "gcp"`

40557

40558 default: gcp

40559

40560 - `project_number: string`

40561

40562 - `FederatedActorOidcProvider object`

40563

40564 Asserting party: a customer-registered OIDC federation issuer.

40565

40566 - `type: optional "oidc"`

40567

40568 default: oidc

40569

40570 - `issuer: optional string or null`

40571

40572 The federation issuer's URL. Null when the presented credential failed verification.

40573

40574 - `ip_address: optional string or null`

40575

40576 - `subject: optional string or null`

40577

40578 The provider's verified identifier for the caller; its form depends on the provider.

40579

40580 - `user_agent: optional string or null`

40581

40582 - `AttestedDeviceActor object`

40583

40584 An attested mobile device authenticated via Apple App Attest.

40585

40586 - `type: optional "attested_device_actor"`

40587

40588 default: attested_device_actor

40589

40590 - `external_client_id: string`

40591

40592 - `kid_hash: string`

40593

40594 - `ip_address: optional string or null`

40595

40596 - `user_agent: optional string or null`

40597

40598 - `trigger: "share" or "unspecified"`

40599

40600 What caused the skill to be turned on automatically: "share" (another member shared it with the member, directly or through a group).

40601

40602 - `"share"`

40603

40604 - `"unspecified"`

40605

40606 - `user_id: string`

40607

40608 The member the skill was turned on for.

40609

40610 - `id: optional string`

40611

40612 Unique identifier for the activity e.g. 'activity_abcd1234'

40613

40614 - `created_at: optional string`

40615

40616 When this activity occurred.

40617

40618 format: date-time

40619

40620 - `organization_id: optional string or null`

40621

40622 Organization ID this activity is associated with

40623

40624 - `organization_uuid: optional string or null`

40625

40626 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

40627

40628 - `shared_at: optional string or null`

40629

40630 For a skill turned on because it was shared: when it was shared with the member or with their group.

40631

40632 format: date-time

40633

40634 - `shared_by_user_id: optional string or null`

40635

40636 For a skill turned on because it was shared: the member who shared it.

40637

40638 - `shared_via: optional "direct" or "group" or "unspecified" or null`

40639

40640 For a skill turned on because it was shared: "direct" if shared with the member themselves, "group" if shared with a group they belong to.

40641

40642 - `"direct"`

40643

40644 - `"group"`

40645

40646 - `"unspecified"`

40647

40648 - `skill_id: optional string or null`

40649

40650 The skill that was turned on.

40651

40652 - `skill_name: optional string or null`

40653

40654 The name of the skill that was turned on.

40655

40656 - `skill_version: optional string or null`

40657

40658 The version of the skill that was turned on.

40659

3898040660 - `ClaudeSkillDownloaded object`

3898140661

3898240662 A member explicitly downloaded a skill's files to their device: the Download action in Claude, a single file saved from the skill viewer, or an install they asked one of their Claude apps for. Background syncs to the Claude apps, viewing a skill in the app and services reading a skill on the member's behalf are not recorded.

from line 49269

4758949269

4759049270 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

4759149271

49272 - `DomainClaimCancelled object`

49273

49274 A pending domain claim was cancelled before it took effect, so the personal accounts on the claimed domains will no longer be migrated or deactivated at its deadline.

49275

49276 - `type: optional "domain_claim_cancelled"`

49277

49278 default: domain_claim_cancelled

49279

49280 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

49281

49282 - `APIActor object`

49283

49284 - `type: optional "api_actor"`

49285

49286 default: api_actor

49287

49288 - `api_key_id: string`

49289

49290 - `ip_address: string`

49291

49292 - `user_agent: string`

49293

49294 - `UserActor object`

49295

49296 - `type: optional "user_actor"`

49297

49298 default: user_actor

49299

49300 - `email_address: string`

49301

49302 format: email

49303

49304 - `ip_address: string`

49305

49306 - `user_agent: string`

49307

49308 - `user_id: string`

49309

49310 - `UnauthenticatedUserActor object`

49311

49312 - `type: optional "unauthenticated_user_actor"`

49313

49314 default: unauthenticated_user_actor

49315

49316 - `ip_address: string`

49317

49318 - `user_agent: string`

49319

49320 - `unauthenticated_email_address: optional string or null`

49321

49322 format: email

49323

49324 - `AnthropicActor object`

49325

49326 - `type: optional "anthropic_actor"`

49327

49328 default: anthropic_actor

49329

49330 - `email_address: optional string or null`

49331

49332 format: email

49333

49334 - `SystemActor object`

49335

49336 Automated background processing performed by Anthropic systems, acting

49337 without a user or customer credential.

49338

49339 - `type: optional "system_actor"`

49340

49341 default: system_actor

49342

49343 - `service: optional string or null`

49344

49345 Name of the automated process that performed the action, when known.

49346

49347 - `AdminAPIKeyActor object`

49348

49349 - `type: optional "admin_api_key_actor"`

49350

49351 default: admin_api_key_actor

49352

49353 - `admin_api_key_id: string`

49354

49355 - `ip_address: string`

49356

49357 - `user_agent: string`

49358

49359 - `ServiceAccountActor object`

49360

49361 - `type: optional "service_account_actor"`

49362

49363 default: service_account_actor

49364

49365 - `ip_address: string`

49366

49367 - `service_account_id: string`

49368

49369 - `user_agent: string`

49370

49371 - `ScimDirectorySyncActor object`

49372

49373 - `type: optional "scim_directory_sync_actor"`

49374

49375 default: scim_directory_sync_actor

49376

49377 - `directory_id: string`

49378

49379 - `workos_event_id: string`

49380

49381 - `idp_connection_type: optional string or null`

49382

49383 - `FederatedIdentityActor object`

49384

49385 A federated external workload authenticated via a verified OIDC token.

49386

49387 Carries the verified issuer, subject, and audience claims from the

49388 presented JWT.

49389

49390 - `type: optional "federated_identity_actor"`

49391

49392 default: federated_identity_actor

49393

49394 - `issuer: string`

49395

49396 - `subject: string`

49397

49398 - `audience: optional array of string`

49399

49400 - `ip_address: optional string or null`

49401

49402 - `user_agent: optional string or null`

49403

49404 - `FederatedActor object`

49405

49406 An external identity asserted by a trusted provider — a cloud-provider

49407 gateway or a customer-registered federation issuer — acting without an

49408 Anthropic-provisioned account or service account.

49409

49410 - `type: optional "federated_actor"`

49411

49412 default: federated_actor

49413

49414 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

49415

49416 - `FederatedActorAwsProvider object`

49417

49418 Asserting party: the AWS account the organization is bound to.

49419

49420 - `type: optional "aws"`

49421

49422 default: aws

49423

49424 - `account_id: string`

49425

49426 - `signed_principal: string`

49427

49428 The AWS-signed ARN of the IAM principal that requested the token.

49429

49430 - `FederatedActorAzureProvider object`

49431

49432 Asserting party: the Azure subscription the organization is bound to.

49433

49434 - `type: optional "azure"`

49435

49436 default: azure

49437

49438 - `subscription_id: string`

49439

49440 - `FederatedActorGcpProvider object`

49441

49442 Asserting party: the GCP project the organization is bound to.

49443

49444 - `type: optional "gcp"`

49445

49446 default: gcp

49447

49448 - `project_number: string`

49449

49450 - `FederatedActorOidcProvider object`

49451

49452 Asserting party: a customer-registered OIDC federation issuer.

49453

49454 - `type: optional "oidc"`

49455

49456 default: oidc

49457

49458 - `issuer: optional string or null`

49459

49460 The federation issuer's URL. Null when the presented credential failed verification.

49461

49462 - `ip_address: optional string or null`

49463

49464 - `subject: optional string or null`

49465

49466 The provider's verified identifier for the caller; its form depends on the provider.

49467

49468 - `user_agent: optional string or null`

49469

49470 - `AttestedDeviceActor object`

49471

49472 An attested mobile device authenticated via Apple App Attest.

49473

49474 - `type: optional "attested_device_actor"`

49475

49476 default: attested_device_actor

49477

49478 - `external_client_id: string`

49479

49480 - `kid_hash: string`

49481

49482 - `ip_address: optional string or null`

49483

49484 - `user_agent: optional string or null`

49485

49486 - `domain_claim_id: string`

49487

49488 The domain claim that was cancelled, e.g. "dclm_01Ab...".

49489

49490 - `id: optional string`

49491

49492 Unique identifier for the activity e.g. 'activity_abcd1234'

49493

49494 - `created_at: optional string`

49495

49496 When this activity occurred.

49497

49498 format: date-time

49499

49500 - `organization_id: optional string or null`

49501

49502 Organization ID this activity is associated with

49503

49504 - `organization_uuid: optional string or null`

49505

49506 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

49507

49508 - `DomainClaimDeadlineUpdated object`

49509

49510 The migration deadline of a pending domain claim was moved to a later or an earlier date by Anthropic staff or an automated process.

49511

49512 - `type: optional "domain_claim_deadline_updated"`

49513

49514 default: domain_claim_deadline_updated

49515

49516 - `action: "extended" or "shortened" or "unspecified"`

49517

49518 Whether the deadline was extended (moved later) or shortened (moved earlier).

49519

49520 - `"extended"`

49521

49522 - `"shortened"`

49523

49524 - `"unspecified"`

49525

49526 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

49527

49528 - `APIActor object`

49529

49530 - `type: optional "api_actor"`

49531

49532 default: api_actor

49533

49534 - `api_key_id: string`

49535

49536 - `ip_address: string`

49537

49538 - `user_agent: string`

49539

49540 - `UserActor object`

49541

49542 - `type: optional "user_actor"`

49543

49544 default: user_actor

49545

49546 - `email_address: string`

49547

49548 format: email

49549

49550 - `ip_address: string`

49551

49552 - `user_agent: string`

49553

49554 - `user_id: string`

49555

49556 - `UnauthenticatedUserActor object`

49557

49558 - `type: optional "unauthenticated_user_actor"`

49559

49560 default: unauthenticated_user_actor

49561

49562 - `ip_address: string`

49563

49564 - `user_agent: string`

49565

49566 - `unauthenticated_email_address: optional string or null`

49567

49568 format: email

49569

49570 - `AnthropicActor object`

49571

49572 - `type: optional "anthropic_actor"`

49573

49574 default: anthropic_actor

49575

49576 - `email_address: optional string or null`

49577

49578 format: email

49579

49580 - `SystemActor object`

49581

49582 Automated background processing performed by Anthropic systems, acting

49583 without a user or customer credential.

49584

49585 - `type: optional "system_actor"`

49586

49587 default: system_actor

49588

49589 - `service: optional string or null`

49590

49591 Name of the automated process that performed the action, when known.

49592

49593 - `AdminAPIKeyActor object`

49594

49595 - `type: optional "admin_api_key_actor"`

49596

49597 default: admin_api_key_actor

49598

49599 - `admin_api_key_id: string`

49600

49601 - `ip_address: string`

49602

49603 - `user_agent: string`

49604

49605 - `ServiceAccountActor object`

49606

49607 - `type: optional "service_account_actor"`

49608

49609 default: service_account_actor

49610

49611 - `ip_address: string`

49612

49613 - `service_account_id: string`

49614

49615 - `user_agent: string`

49616

49617 - `ScimDirectorySyncActor object`

49618

49619 - `type: optional "scim_directory_sync_actor"`

49620

49621 default: scim_directory_sync_actor

49622

49623 - `directory_id: string`

49624

49625 - `workos_event_id: string`

49626

49627 - `idp_connection_type: optional string or null`

49628

49629 - `FederatedIdentityActor object`

49630

49631 A federated external workload authenticated via a verified OIDC token.

49632

49633 Carries the verified issuer, subject, and audience claims from the

49634 presented JWT.

49635

49636 - `type: optional "federated_identity_actor"`

49637

49638 default: federated_identity_actor

49639

49640 - `issuer: string`

49641

49642 - `subject: string`

49643

49644 - `audience: optional array of string`

49645

49646 - `ip_address: optional string or null`

49647

49648 - `user_agent: optional string or null`

49649

49650 - `FederatedActor object`

49651

49652 An external identity asserted by a trusted provider — a cloud-provider

49653 gateway or a customer-registered federation issuer — acting without an

49654 Anthropic-provisioned account or service account.

49655

49656 - `type: optional "federated_actor"`

49657

49658 default: federated_actor

49659

49660 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

49661

49662 - `FederatedActorAwsProvider object`

49663

49664 Asserting party: the AWS account the organization is bound to.

49665

49666 - `type: optional "aws"`

49667

49668 default: aws

49669

49670 - `account_id: string`

49671

49672 - `signed_principal: string`

49673

49674 The AWS-signed ARN of the IAM principal that requested the token.

49675

49676 - `FederatedActorAzureProvider object`

49677

49678 Asserting party: the Azure subscription the organization is bound to.

49679

49680 - `type: optional "azure"`

49681

49682 default: azure

49683

49684 - `subscription_id: string`

49685

49686 - `FederatedActorGcpProvider object`

49687

49688 Asserting party: the GCP project the organization is bound to.

49689

49690 - `type: optional "gcp"`

49691

49692 default: gcp

49693

49694 - `project_number: string`

49695

49696 - `FederatedActorOidcProvider object`

49697

49698 Asserting party: a customer-registered OIDC federation issuer.

49699

49700 - `type: optional "oidc"`

49701

49702 default: oidc

49703

49704 - `issuer: optional string or null`

49705

49706 The federation issuer's URL. Null when the presented credential failed verification.

49707

49708 - `ip_address: optional string or null`

49709

49710 - `subject: optional string or null`

49711

49712 The provider's verified identifier for the caller; its form depends on the provider.

49713

49714 - `user_agent: optional string or null`

49715

49716 - `AttestedDeviceActor object`

49717

49718 An attested mobile device authenticated via Apple App Attest.

49719

49720 - `type: optional "attested_device_actor"`

49721

49722 default: attested_device_actor

49723

49724 - `external_client_id: string`

49725

49726 - `kid_hash: string`

49727

49728 - `ip_address: optional string or null`

49729

49730 - `user_agent: optional string or null`

49731

49732 - `domain_claim_id: string`

49733

49734 The domain claim whose deadline was moved, e.g. "dclm_01Ab...".

49735

49736 - `id: optional string`

49737

49738 Unique identifier for the activity e.g. 'activity_abcd1234'

49739

49740 - `created_at: optional string`

49741

49742 When this activity occurred.

49743

49744 format: date-time

49745

49746 - `deadline_at: optional string or null`

49747

49748 The deadline after the change.

49749

49750 format: date-time

49751

49752 - `organization_id: optional string or null`

49753

49754 Organization ID this activity is associated with

49755

49756 - `organization_uuid: optional string or null`

49757

49758 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

49759

49760 - `previous_deadline_at: optional string or null`

49761

49762 The deadline before the change.

49763

49764 format: date-time

49765

4759249766 - `DomainClaimInitiated object`

4759349767

4759449768 Domain capture claim initiated over personal accounts on verified domains.

from line 55441

5326755441

5326855442 - `token_fingerprint_sha256: optional string or null`

5326955443

53270 Org-scoped SHA-256 of the submitted token: `sha256(org_uuid || 0x00 || token)`, lowercase-hex-encoded, where `org_uuid` is the organization's UUID as a dashed lowercase string, `0x00` is a single zero byte, and `token` is the submitted value's raw bytes. Per-org correlation only — the same token in two orgs produces distinct fingerprints. Set only when the submitted value carries a known GitHub PAT prefix (a high-entropy token format); unset for all other submissions, including rejected non-PAT input.

55444 Not populated.

5327155445

5327255446 - `GitlabConfigurationCreated object`

5327355447

from line 93275

9110193275

9110293276 - `user_agent: optional string or null`

9110393277

91104 - `updates: array of Name or Capabilities or RedactContent or 104 more`

93278 - `updates: array of Name or Capabilities or RedactContent or 105 more`

9110593279

9110693280 - `Name object`

9110793281

from line 95194

9302095194

9302195195 Setting value immediately before this change. Null means the setting was not set, so its default applied.

9302295196

95197 - `ConnectorRequestsOptedIn object`

95198

95199 The organization's opt-in to connector requests, which lets members ask the organization's owners to add a connector, was changed. The "Let members request connectors" switch sets it the first time it is turned on; turning that switch off, or on again, is recorded as a `disabled_admin_request_types` change (`enable_connector` joins or leaves the list).

95200

95201 - `type: optional "connector_requests_opted_in"`

95202

95203 default: connector_requests_opted_in

95204

95205 - `current_value: optional boolean or null`

95206

95207 Setting value immediately after this change

95208

95209 - `previous_value: optional boolean or null`

95210

95211 Setting value immediately before this change. Null means the organization had never opted in or out.

95212

9302395213 - `id: optional string`

9302495214

9302595215 Unique identifier for the activity e.g. 'activity_abcd1234'

from line 114300

112110114300

112111114301 UUID of the spend limit.

112112114302

114303 - `PlatformTelemetryDestinationAutoDisabled object`

114304

114305 A telemetry destination was disabled automatically after deliveries to it failed, so no telemetry is sent to it until an administrator enables it again.

114306

114307 - `type: optional "platform_telemetry_destination_auto_disabled"`

114308

114309 default: platform_telemetry_destination_auto_disabled

114310

114311 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

114312

114313 - `APIActor object`

114314

114315 - `type: optional "api_actor"`

114316

114317 default: api_actor

114318

114319 - `api_key_id: string`

114320

114321 - `ip_address: string`

114322

114323 - `user_agent: string`

114324

114325 - `UserActor object`

114326

114327 - `type: optional "user_actor"`

114328

114329 default: user_actor

114330

114331 - `email_address: string`

114332

114333 format: email

114334

114335 - `ip_address: string`

114336

114337 - `user_agent: string`

114338

114339 - `user_id: string`

114340

114341 - `UnauthenticatedUserActor object`

114342

114343 - `type: optional "unauthenticated_user_actor"`

114344

114345 default: unauthenticated_user_actor

114346

114347 - `ip_address: string`

114348

114349 - `user_agent: string`

114350

114351 - `unauthenticated_email_address: optional string or null`

114352

114353 format: email

114354

114355 - `AnthropicActor object`

114356

114357 - `type: optional "anthropic_actor"`

114358

114359 default: anthropic_actor

114360

114361 - `email_address: optional string or null`

114362

114363 format: email

114364

114365 - `SystemActor object`

114366

114367 Automated background processing performed by Anthropic systems, acting

114368 without a user or customer credential.

114369

114370 - `type: optional "system_actor"`

114371

114372 default: system_actor

114373

114374 - `service: optional string or null`

114375

114376 Name of the automated process that performed the action, when known.

114377

114378 - `AdminAPIKeyActor object`

114379

114380 - `type: optional "admin_api_key_actor"`

114381

114382 default: admin_api_key_actor

114383

114384 - `admin_api_key_id: string`

114385

114386 - `ip_address: string`

114387

114388 - `user_agent: string`

114389

114390 - `ServiceAccountActor object`

114391

114392 - `type: optional "service_account_actor"`

114393

114394 default: service_account_actor

114395

114396 - `ip_address: string`

114397

114398 - `service_account_id: string`

114399

114400 - `user_agent: string`

114401

114402 - `ScimDirectorySyncActor object`

114403

114404 - `type: optional "scim_directory_sync_actor"`

114405

114406 default: scim_directory_sync_actor

114407

114408 - `directory_id: string`

114409

114410 - `workos_event_id: string`

114411

114412 - `idp_connection_type: optional string or null`

114413

114414 - `FederatedIdentityActor object`

114415

114416 A federated external workload authenticated via a verified OIDC token.

114417

114418 Carries the verified issuer, subject, and audience claims from the

114419 presented JWT.

114420

114421 - `type: optional "federated_identity_actor"`

114422

114423 default: federated_identity_actor

114424

114425 - `issuer: string`

114426

114427 - `subject: string`

114428

114429 - `audience: optional array of string`

114430

114431 - `ip_address: optional string or null`

114432

114433 - `user_agent: optional string or null`

114434

114435 - `FederatedActor object`

114436

114437 An external identity asserted by a trusted provider — a cloud-provider

114438 gateway or a customer-registered federation issuer — acting without an

114439 Anthropic-provisioned account or service account.

114440

114441 - `type: optional "federated_actor"`

114442

114443 default: federated_actor

114444

114445 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

114446

114447 - `FederatedActorAwsProvider object`

114448

114449 Asserting party: the AWS account the organization is bound to.

114450

114451 - `type: optional "aws"`

114452

114453 default: aws

114454

114455 - `account_id: string`

114456

114457 - `signed_principal: string`

114458

114459 The AWS-signed ARN of the IAM principal that requested the token.

114460

114461 - `FederatedActorAzureProvider object`

114462

114463 Asserting party: the Azure subscription the organization is bound to.

114464

114465 - `type: optional "azure"`

114466

114467 default: azure

114468

114469 - `subscription_id: string`

114470

114471 - `FederatedActorGcpProvider object`

114472

114473 Asserting party: the GCP project the organization is bound to.

114474

114475 - `type: optional "gcp"`

114476

114477 default: gcp

114478

114479 - `project_number: string`

114480

114481 - `FederatedActorOidcProvider object`

114482

114483 Asserting party: a customer-registered OIDC federation issuer.

114484

114485 - `type: optional "oidc"`

114486

114487 default: oidc

114488

114489 - `issuer: optional string or null`

114490

114491 The federation issuer's URL. Null when the presented credential failed verification.

114492

114493 - `ip_address: optional string or null`

114494

114495 - `subject: optional string or null`

114496

114497 The provider's verified identifier for the caller; its form depends on the provider.

114498

114499 - `user_agent: optional string or null`

114500

114501 - `AttestedDeviceActor object`

114502

114503 An attested mobile device authenticated via Apple App Attest.

114504

114505 - `type: optional "attested_device_actor"`

114506

114507 default: attested_device_actor

114508

114509 - `external_client_id: string`

114510

114511 - `kid_hash: string`

114512

114513 - `ip_address: optional string or null`

114514

114515 - `user_agent: optional string or null`

114516

114517 - `telemetry_destination_id: string`

114518

114519 Tagged telemetry destination ID, e.g. "tdst_01HX...".

114520

114521 - `trigger: "invalid_address" or "redirect" or "sustained_failure" or "unspecified"`

114522

114523 Why the destination was disabled: deliveries failed for longer than Anthropic allows ("sustained_failure"), they failed that long and the hostname does not resolve to a public address ("invalid_address"), or the endpoint answered with an HTTP redirect ("redirect").

114524

114525 - `"invalid_address"`

114526

114527 - `"redirect"`

114528

114529 - `"sustained_failure"`

114530

114531 - `"unspecified"`

114532

114533 - `id: optional string`

114534

114535 Unique identifier for the activity e.g. 'activity_abcd1234'

114536

114537 - `created_at: optional string`

114538

114539 When this activity occurred.

114540

114541 format: date-time

114542

114543 - `organization_id: optional string or null`

114544

114545 Organization ID this activity is associated with

114546

114547 - `organization_uuid: optional string or null`

114548

114549 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

114550

114551 - `PlatformTelemetryDestinationCreated object`

114552

114553 A telemetry destination was registered for the organization.

114554

114555 - `type: optional "platform_telemetry_destination_created"`

114556

114557 default: platform_telemetry_destination_created

114558

114559 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

114560

114561 - `APIActor object`

114562

114563 - `type: optional "api_actor"`

114564

114565 default: api_actor

114566

114567 - `api_key_id: string`

114568

114569 - `ip_address: string`

114570

114571 - `user_agent: string`

114572

114573 - `UserActor object`

114574

114575 - `type: optional "user_actor"`

114576

114577 default: user_actor

114578

114579 - `email_address: string`

114580

114581 format: email

114582

114583 - `ip_address: string`

114584

114585 - `user_agent: string`

114586

114587 - `user_id: string`

114588

114589 - `UnauthenticatedUserActor object`

114590

114591 - `type: optional "unauthenticated_user_actor"`

114592

114593 default: unauthenticated_user_actor

114594

114595 - `ip_address: string`

114596

114597 - `user_agent: string`

114598

114599 - `unauthenticated_email_address: optional string or null`

114600

114601 format: email

114602

114603 - `AnthropicActor object`

114604

114605 - `type: optional "anthropic_actor"`

114606

114607 default: anthropic_actor

114608

114609 - `email_address: optional string or null`

114610

114611 format: email

114612

114613 - `SystemActor object`

114614

114615 Automated background processing performed by Anthropic systems, acting

114616 without a user or customer credential.

114617

114618 - `type: optional "system_actor"`

114619

114620 default: system_actor

114621

114622 - `service: optional string or null`

114623

114624 Name of the automated process that performed the action, when known.

114625

114626 - `AdminAPIKeyActor object`

114627

114628 - `type: optional "admin_api_key_actor"`

114629

114630 default: admin_api_key_actor

114631

114632 - `admin_api_key_id: string`

114633

114634 - `ip_address: string`

114635

114636 - `user_agent: string`

114637

114638 - `ServiceAccountActor object`

114639

114640 - `type: optional "service_account_actor"`

114641

114642 default: service_account_actor

114643

114644 - `ip_address: string`

114645

114646 - `service_account_id: string`

114647

114648 - `user_agent: string`

114649

114650 - `ScimDirectorySyncActor object`

114651

114652 - `type: optional "scim_directory_sync_actor"`

114653

114654 default: scim_directory_sync_actor

114655

114656 - `directory_id: string`

114657

114658 - `workos_event_id: string`

114659

114660 - `idp_connection_type: optional string or null`

114661

114662 - `FederatedIdentityActor object`

114663

114664 A federated external workload authenticated via a verified OIDC token.

114665

114666 Carries the verified issuer, subject, and audience claims from the

114667 presented JWT.

114668

114669 - `type: optional "federated_identity_actor"`

114670

114671 default: federated_identity_actor

114672

114673 - `issuer: string`

114674

114675 - `subject: string`

114676

114677 - `audience: optional array of string`

114678

114679 - `ip_address: optional string or null`

114680

114681 - `user_agent: optional string or null`

114682

114683 - `FederatedActor object`

114684

114685 An external identity asserted by a trusted provider — a cloud-provider

114686 gateway or a customer-registered federation issuer — acting without an

114687 Anthropic-provisioned account or service account.

114688

114689 - `type: optional "federated_actor"`

114690

114691 default: federated_actor

114692

114693 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

114694

114695 - `FederatedActorAwsProvider object`

114696

114697 Asserting party: the AWS account the organization is bound to.

114698

114699 - `type: optional "aws"`

114700

114701 default: aws

114702

114703 - `account_id: string`

114704

114705 - `signed_principal: string`

114706

114707 The AWS-signed ARN of the IAM principal that requested the token.

114708

114709 - `FederatedActorAzureProvider object`

114710

114711 Asserting party: the Azure subscription the organization is bound to.

114712

114713 - `type: optional "azure"`

114714

114715 default: azure

114716

114717 - `subscription_id: string`

114718

114719 - `FederatedActorGcpProvider object`

114720

114721 Asserting party: the GCP project the organization is bound to.

114722

114723 - `type: optional "gcp"`

114724

114725 default: gcp

114726

114727 - `project_number: string`

114728

114729 - `FederatedActorOidcProvider object`

114730

114731 Asserting party: a customer-registered OIDC federation issuer.

114732

114733 - `type: optional "oidc"`

114734

114735 default: oidc

114736

114737 - `issuer: optional string or null`

114738

114739 The federation issuer's URL. Null when the presented credential failed verification.

114740

114741 - `ip_address: optional string or null`

114742

114743 - `subject: optional string or null`

114744

114745 The provider's verified identifier for the caller; its form depends on the provider.

114746

114747 - `user_agent: optional string or null`

114748

114749 - `AttestedDeviceActor object`

114750

114751 An attested mobile device authenticated via Apple App Attest.

114752

114753 - `type: optional "attested_device_actor"`

114754

114755 default: attested_device_actor

114756

114757 - `external_client_id: string`

114758

114759 - `kid_hash: string`

114760

114761 - `ip_address: optional string or null`

114762

114763 - `user_agent: optional string or null`

114764

114765 - `telemetry_destination_id: string`

114766

114767 Tagged telemetry destination ID, e.g. "tdst_01HX...".

114768

114769 - `id: optional string`

114770

114771 Unique identifier for the activity e.g. 'activity_abcd1234'

114772

114773 - `created_at: optional string`

114774

114775 When this activity occurred.

114776

114777 format: date-time

114778

114779 - `endpoint_url: optional string or null`

114780

114781 The destination's endpoint URL as stored, e.g. "https://collector.example.com/otlp"; the API refuses credentials, query strings and fragments in this URL.

114782

114783 - `organization_id: optional string or null`

114784

114785 Organization ID this activity is associated with

114786

114787 - `organization_uuid: optional string or null`

114788

114789 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

114790

114791 - `traces: optional object or null`

114792

114793 The destination's settings for traces, as the API returns them.

114794

114795 - `content_mode: string`

114796

114797 What the exported spans contain: "metadata_only", or "content" when they also carry message and tool content.

114798

114799 - `enabled: boolean`

114800

114801 Whether the destination receives traces.

114802

114803 - `endpoint_url: optional string or null`

114804

114805 The destination's separate traces URL as stored, e.g. "https://collector.example.com/v2/trace/otlp"; like the endpoint URL it never contains credentials, a query string or a fragment. Omitted when the destination has none; traces then go to the endpoint URL plus "/v1/traces".

114806

114807 - `max_content_bytes: optional number or null`

114808

114809 The most bytes of content that one exported span keeps; omitted when the destination sets no bound and only Anthropic's maximum applies.

114810

114811 - `workspaces: optional object or null`

114812

114813 Which workspaces the destination covers, as the API returns it: its type only, "all", "include" or "exclude". The workspaces put on its list by the same request are recorded as workspace_added activities.

114814

114815 - `type: string`

114816

114817 "all": every workspace of the organization; "include": the workspaces on the destination's list; "exclude": every workspace but those on its list.

114818

114819 - `PlatformTelemetryDestinationDeleted object`

114820

114821 A telemetry destination was deleted.

114822

114823 - `type: optional "platform_telemetry_destination_deleted"`

114824

114825 default: platform_telemetry_destination_deleted

114826

114827 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

114828

114829 - `APIActor object`

114830

114831 - `type: optional "api_actor"`

114832

114833 default: api_actor

114834

114835 - `api_key_id: string`

114836

114837 - `ip_address: string`

114838

114839 - `user_agent: string`

114840

114841 - `UserActor object`

114842

114843 - `type: optional "user_actor"`

114844

114845 default: user_actor

114846

114847 - `email_address: string`

114848

114849 format: email

114850

114851 - `ip_address: string`

114852

114853 - `user_agent: string`

114854

114855 - `user_id: string`

114856

114857 - `UnauthenticatedUserActor object`

114858

114859 - `type: optional "unauthenticated_user_actor"`

114860

114861 default: unauthenticated_user_actor

114862

114863 - `ip_address: string`

114864

114865 - `user_agent: string`

114866

114867 - `unauthenticated_email_address: optional string or null`

114868

114869 format: email

114870

114871 - `AnthropicActor object`

114872

114873 - `type: optional "anthropic_actor"`

114874

114875 default: anthropic_actor

114876

114877 - `email_address: optional string or null`

114878

114879 format: email

114880

114881 - `SystemActor object`

114882

114883 Automated background processing performed by Anthropic systems, acting

114884 without a user or customer credential.

114885

114886 - `type: optional "system_actor"`

114887

114888 default: system_actor

114889

114890 - `service: optional string or null`

114891

114892 Name of the automated process that performed the action, when known.

114893

114894 - `AdminAPIKeyActor object`

114895

114896 - `type: optional "admin_api_key_actor"`

114897

114898 default: admin_api_key_actor

114899

114900 - `admin_api_key_id: string`

114901

114902 - `ip_address: string`

114903

114904 - `user_agent: string`

114905

114906 - `ServiceAccountActor object`

114907

114908 - `type: optional "service_account_actor"`

114909

114910 default: service_account_actor

114911

114912 - `ip_address: string`

114913

114914 - `service_account_id: string`

114915

114916 - `user_agent: string`

114917

114918 - `ScimDirectorySyncActor object`

114919

114920 - `type: optional "scim_directory_sync_actor"`

114921

114922 default: scim_directory_sync_actor

114923

114924 - `directory_id: string`

114925

114926 - `workos_event_id: string`

114927

114928 - `idp_connection_type: optional string or null`

114929

114930 - `FederatedIdentityActor object`

114931

114932 A federated external workload authenticated via a verified OIDC token.

114933

114934 Carries the verified issuer, subject, and audience claims from the

114935 presented JWT.

114936

114937 - `type: optional "federated_identity_actor"`

114938

114939 default: federated_identity_actor

114940

114941 - `issuer: string`

114942

114943 - `subject: string`

114944

114945 - `audience: optional array of string`

114946

114947 - `ip_address: optional string or null`

114948

114949 - `user_agent: optional string or null`

114950

114951 - `FederatedActor object`

114952

114953 An external identity asserted by a trusted provider — a cloud-provider

114954 gateway or a customer-registered federation issuer — acting without an

114955 Anthropic-provisioned account or service account.

114956

114957 - `type: optional "federated_actor"`

114958

114959 default: federated_actor

114960

114961 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

114962

114963 - `FederatedActorAwsProvider object`

114964

114965 Asserting party: the AWS account the organization is bound to.

114966

114967 - `type: optional "aws"`

114968

114969 default: aws

114970

114971 - `account_id: string`

114972

114973 - `signed_principal: string`

114974

114975 The AWS-signed ARN of the IAM principal that requested the token.

114976

114977 - `FederatedActorAzureProvider object`

114978

114979 Asserting party: the Azure subscription the organization is bound to.

114980

114981 - `type: optional "azure"`

114982

114983 default: azure

114984

114985 - `subscription_id: string`

114986

114987 - `FederatedActorGcpProvider object`

114988

114989 Asserting party: the GCP project the organization is bound to.

114990

114991 - `type: optional "gcp"`

114992

114993 default: gcp

114994

114995 - `project_number: string`

114996

114997 - `FederatedActorOidcProvider object`

114998

114999 Asserting party: a customer-registered OIDC federation issuer.

115000

115001 - `type: optional "oidc"`

115002

115003 default: oidc

115004

115005 - `issuer: optional string or null`

115006

115007 The federation issuer's URL. Null when the presented credential failed verification.

115008

115009 - `ip_address: optional string or null`

115010

115011 - `subject: optional string or null`

115012

115013 The provider's verified identifier for the caller; its form depends on the provider.

115014

115015 - `user_agent: optional string or null`

115016

115017 - `AttestedDeviceActor object`

115018

115019 An attested mobile device authenticated via Apple App Attest.

115020

115021 - `type: optional "attested_device_actor"`

115022

115023 default: attested_device_actor

115024

115025 - `external_client_id: string`

115026

115027 - `kid_hash: string`

115028

115029 - `ip_address: optional string or null`

115030

115031 - `user_agent: optional string or null`

115032

115033 - `telemetry_destination_id: string`

115034

115035 Tagged telemetry destination ID, e.g. "tdst_01HX...".

115036

115037 - `id: optional string`

115038

115039 Unique identifier for the activity e.g. 'activity_abcd1234'

115040

115041 - `created_at: optional string`

115042

115043 When this activity occurred.

115044

115045 format: date-time

115046

115047 - `organization_id: optional string or null`

115048

115049 Organization ID this activity is associated with

115050

115051 - `organization_uuid: optional string or null`

115052

115053 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

115054

115055 - `PlatformTelemetryDestinationUpdated object`

115056

115057 A telemetry destination's configuration was updated. State changes and changes of its workspace scope (the type, or the list through an update's workspace_ids) are included; the workspaces an update took off or put on the list are also recorded as workspace_removed and workspace_added activities. Previous and current values are recorded only for the endpoint URL, the traces URL, the content mode and the workspaces type.

115058

115059 - `type: optional "platform_telemetry_destination_updated"`

115060

115061 default: platform_telemetry_destination_updated

115062

115063 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

115064

115065 - `APIActor object`

115066

115067 - `type: optional "api_actor"`

115068

115069 default: api_actor

115070

115071 - `api_key_id: string`

115072

115073 - `ip_address: string`

115074

115075 - `user_agent: string`

115076

115077 - `UserActor object`

115078

115079 - `type: optional "user_actor"`

115080

115081 default: user_actor

115082

115083 - `email_address: string`

115084

115085 format: email

115086

115087 - `ip_address: string`

115088

115089 - `user_agent: string`

115090

115091 - `user_id: string`

115092

115093 - `UnauthenticatedUserActor object`

115094

115095 - `type: optional "unauthenticated_user_actor"`

115096

115097 default: unauthenticated_user_actor

115098

115099 - `ip_address: string`

115100

115101 - `user_agent: string`

115102

115103 - `unauthenticated_email_address: optional string or null`

115104

115105 format: email

115106

115107 - `AnthropicActor object`

115108

115109 - `type: optional "anthropic_actor"`

115110

115111 default: anthropic_actor

115112

115113 - `email_address: optional string or null`

115114

115115 format: email

115116

115117 - `SystemActor object`

115118

115119 Automated background processing performed by Anthropic systems, acting

115120 without a user or customer credential.

115121

115122 - `type: optional "system_actor"`

115123

115124 default: system_actor

115125

115126 - `service: optional string or null`

115127

115128 Name of the automated process that performed the action, when known.

115129

115130 - `AdminAPIKeyActor object`

115131

115132 - `type: optional "admin_api_key_actor"`

115133

115134 default: admin_api_key_actor

115135

115136 - `admin_api_key_id: string`

115137

115138 - `ip_address: string`

115139

115140 - `user_agent: string`

115141

115142 - `ServiceAccountActor object`

115143

115144 - `type: optional "service_account_actor"`

115145

115146 default: service_account_actor

115147

115148 - `ip_address: string`

115149

115150 - `service_account_id: string`

115151

115152 - `user_agent: string`

115153

115154 - `ScimDirectorySyncActor object`

115155

115156 - `type: optional "scim_directory_sync_actor"`

115157

115158 default: scim_directory_sync_actor

115159

115160 - `directory_id: string`

115161

115162 - `workos_event_id: string`

115163

115164 - `idp_connection_type: optional string or null`

115165

115166 - `FederatedIdentityActor object`

115167

115168 A federated external workload authenticated via a verified OIDC token.

115169

115170 Carries the verified issuer, subject, and audience claims from the

115171 presented JWT.

115172

115173 - `type: optional "federated_identity_actor"`

115174

115175 default: federated_identity_actor

115176

115177 - `issuer: string`

115178

115179 - `subject: string`

115180

115181 - `audience: optional array of string`

115182

115183 - `ip_address: optional string or null`

115184

115185 - `user_agent: optional string or null`

115186

115187 - `FederatedActor object`

115188

115189 An external identity asserted by a trusted provider — a cloud-provider

115190 gateway or a customer-registered federation issuer — acting without an

115191 Anthropic-provisioned account or service account.

115192

115193 - `type: optional "federated_actor"`

115194

115195 default: federated_actor

115196

115197 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

115198

115199 - `FederatedActorAwsProvider object`

115200

115201 Asserting party: the AWS account the organization is bound to.

115202

115203 - `type: optional "aws"`

115204

115205 default: aws

115206

115207 - `account_id: string`

115208

115209 - `signed_principal: string`

115210

115211 The AWS-signed ARN of the IAM principal that requested the token.

115212

115213 - `FederatedActorAzureProvider object`

115214

115215 Asserting party: the Azure subscription the organization is bound to.

115216

115217 - `type: optional "azure"`

115218

115219 default: azure

115220

115221 - `subscription_id: string`

115222

115223 - `FederatedActorGcpProvider object`

115224

115225 Asserting party: the GCP project the organization is bound to.

115226

115227 - `type: optional "gcp"`

115228

115229 default: gcp

115230

115231 - `project_number: string`

115232

115233 - `FederatedActorOidcProvider object`

115234

115235 Asserting party: a customer-registered OIDC federation issuer.

115236

115237 - `type: optional "oidc"`

115238

115239 default: oidc

115240

115241 - `issuer: optional string or null`

115242

115243 The federation issuer's URL. Null when the presented credential failed verification.

115244

115245 - `ip_address: optional string or null`

115246

115247 - `subject: optional string or null`

115248

115249 The provider's verified identifier for the caller; its form depends on the provider.

115250

115251 - `user_agent: optional string or null`

115252

115253 - `AttestedDeviceActor object`

115254

115255 An attested mobile device authenticated via Apple App Attest.

115256

115257 - `type: optional "attested_device_actor"`

115258

115259 default: attested_device_actor

115260

115261 - `external_client_id: string`

115262

115263 - `kid_hash: string`

115264

115265 - `ip_address: optional string or null`

115266

115267 - `user_agent: optional string or null`

115268

115269 - `telemetry_destination_id: string`

115270

115271 Tagged telemetry destination ID, e.g. "tdst_01HX...".

115272

115273 - `id: optional string`

115274

115275 Unique identifier for the activity e.g. 'activity_abcd1234'

115276

115277 - `created_at: optional string`

115278

115279 When this activity occurred.

115280

115281 format: date-time

115282

115283 - `organization_id: optional string or null`

115284

115285 Organization ID this activity is associated with

115286

115287 - `organization_uuid: optional string or null`

115288

115289 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

115290

115291 - `updated_fields: optional array of string`

115292

115293 Names of the configuration fields whose value changed, e.g. "endpoint_url", "headers", "state"; "traces" when any setting for traces changed. Header names and values are never included.

115294

115295 - `updates: optional array of object`

115296

115297 The field-level value changes in this update, in this order: an "endpoint_url" entry when the endpoint URL changed, a "traces_endpoint_url" entry when the traces URL changed, a "traces_content_mode" entry when the content mode changed, and a "workspaces" entry ("all", "include" or "exclude") when the workspaces type changed; empty otherwise.

115298

115299 - `type: "endpoint_url" or "traces_content_mode" or "traces_endpoint_url" or 2 more`

115300

115301 The destination field that changed

115302

115303 - `"endpoint_url"`

115304

115305 - `"traces_content_mode"`

115306

115307 - `"traces_endpoint_url"`

115308

115309 - `"unspecified"`

115310

115311 - `"workspaces"`

115312

115313 - `current_value: string`

115314

115315 Field value immediately after this change

115316

115317 - `previous_value: string`

115318

115319 Field value immediately before this change

115320

115321 - `PlatformTelemetryDestinationWorkspaceAdded object`

115322

115323 A workspace was added to the workspace list of a telemetry destination. When the list type is "include", the destination starts to receive the spans of that workspace; when it is "exclude", the destination stops receiving them.

115324

115325 - `type: optional "platform_telemetry_destination_workspace_added"`

115326

115327 default: platform_telemetry_destination_workspace_added

115328

115329 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

115330

115331 - `APIActor object`

115332

115333 - `type: optional "api_actor"`

115334

115335 default: api_actor

115336

115337 - `api_key_id: string`

115338

115339 - `ip_address: string`

115340

115341 - `user_agent: string`

115342

115343 - `UserActor object`

115344

115345 - `type: optional "user_actor"`

115346

115347 default: user_actor

115348

115349 - `email_address: string`

115350

115351 format: email

115352

115353 - `ip_address: string`

115354

115355 - `user_agent: string`

115356

115357 - `user_id: string`

115358

115359 - `UnauthenticatedUserActor object`

115360

115361 - `type: optional "unauthenticated_user_actor"`

115362

115363 default: unauthenticated_user_actor

115364

115365 - `ip_address: string`

115366

115367 - `user_agent: string`

115368

115369 - `unauthenticated_email_address: optional string or null`

115370

115371 format: email

115372

115373 - `AnthropicActor object`

115374

115375 - `type: optional "anthropic_actor"`

115376

115377 default: anthropic_actor

115378

115379 - `email_address: optional string or null`

115380

115381 format: email

115382

115383 - `SystemActor object`

115384

115385 Automated background processing performed by Anthropic systems, acting

115386 without a user or customer credential.

115387

115388 - `type: optional "system_actor"`

115389

115390 default: system_actor

115391

115392 - `service: optional string or null`

115393

115394 Name of the automated process that performed the action, when known.

115395

115396 - `AdminAPIKeyActor object`

115397

115398 - `type: optional "admin_api_key_actor"`

115399

115400 default: admin_api_key_actor

115401

115402 - `admin_api_key_id: string`

115403

115404 - `ip_address: string`

115405

115406 - `user_agent: string`

115407

115408 - `ServiceAccountActor object`

115409

115410 - `type: optional "service_account_actor"`

115411

115412 default: service_account_actor

115413

115414 - `ip_address: string`

115415

115416 - `service_account_id: string`

115417

115418 - `user_agent: string`

115419

115420 - `ScimDirectorySyncActor object`

115421

115422 - `type: optional "scim_directory_sync_actor"`

115423

115424 default: scim_directory_sync_actor

115425

115426 - `directory_id: string`

115427

115428 - `workos_event_id: string`

115429

115430 - `idp_connection_type: optional string or null`

115431

115432 - `FederatedIdentityActor object`

115433

115434 A federated external workload authenticated via a verified OIDC token.

115435

115436 Carries the verified issuer, subject, and audience claims from the

115437 presented JWT.

115438

115439 - `type: optional "federated_identity_actor"`

115440

115441 default: federated_identity_actor

115442

115443 - `issuer: string`

115444

115445 - `subject: string`

115446

115447 - `audience: optional array of string`

115448

115449 - `ip_address: optional string or null`

115450

115451 - `user_agent: optional string or null`

115452

115453 - `FederatedActor object`

115454

115455 An external identity asserted by a trusted provider — a cloud-provider

115456 gateway or a customer-registered federation issuer — acting without an

115457 Anthropic-provisioned account or service account.

115458

115459 - `type: optional "federated_actor"`

115460

115461 default: federated_actor

115462

115463 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

115464

115465 - `FederatedActorAwsProvider object`

115466

115467 Asserting party: the AWS account the organization is bound to.

115468

115469 - `type: optional "aws"`

115470

115471 default: aws

115472

115473 - `account_id: string`

115474

115475 - `signed_principal: string`

115476

115477 The AWS-signed ARN of the IAM principal that requested the token.

115478

115479 - `FederatedActorAzureProvider object`

115480

115481 Asserting party: the Azure subscription the organization is bound to.

115482

115483 - `type: optional "azure"`

115484

115485 default: azure

115486

115487 - `subscription_id: string`

115488

115489 - `FederatedActorGcpProvider object`

115490

115491 Asserting party: the GCP project the organization is bound to.

115492

115493 - `type: optional "gcp"`

115494

115495 default: gcp

115496

115497 - `project_number: string`

115498

115499 - `FederatedActorOidcProvider object`

115500

115501 Asserting party: a customer-registered OIDC federation issuer.

115502

115503 - `type: optional "oidc"`

115504

115505 default: oidc

115506

115507 - `issuer: optional string or null`

115508

115509 The federation issuer's URL. Null when the presented credential failed verification.

115510

115511 - `ip_address: optional string or null`

115512

115513 - `subject: optional string or null`

115514

115515 The provider's verified identifier for the caller; its form depends on the provider.

115516

115517 - `user_agent: optional string or null`

115518

115519 - `AttestedDeviceActor object`

115520

115521 An attested mobile device authenticated via Apple App Attest.

115522

115523 - `type: optional "attested_device_actor"`

115524

115525 default: attested_device_actor

115526

115527 - `external_client_id: string`

115528

115529 - `kid_hash: string`

115530

115531 - `ip_address: optional string or null`

115532

115533 - `user_agent: optional string or null`

115534

115535 - `telemetry_destination_id: string`

115536

115537 Tagged telemetry destination ID, e.g. "tdst_01HX...".

115538

115539 - `workspace_id: string`

115540

115541 Tagged ID of the workspace put on the list, e.g. "wrkspc_01HX...".

115542

115543 - `id: optional string`

115544

115545 Unique identifier for the activity e.g. 'activity_abcd1234'

115546

115547 - `created_at: optional string`

115548

115549 When this activity occurred.

115550

115551 format: date-time

115552

115553 - `organization_id: optional string or null`

115554

115555 Organization ID this activity is associated with

115556

115557 - `organization_uuid: optional string or null`

115558

115559 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

115560

115561 - `PlatformTelemetryDestinationWorkspaceRemoved object`

115562

115563 A workspace was removed from the workspace list of a telemetry destination, by a change to the list or because the destination was deleted. When the list type is "include", the destination stops receiving the spans of that workspace; when it is "exclude", the destination receives them again unless the destination was deleted.

115564

115565 - `type: optional "platform_telemetry_destination_workspace_removed"`

115566

115567 default: platform_telemetry_destination_workspace_removed

115568

115569 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

115570

115571 - `APIActor object`

115572

115573 - `type: optional "api_actor"`

115574

115575 default: api_actor

115576

115577 - `api_key_id: string`

115578

115579 - `ip_address: string`

115580

115581 - `user_agent: string`

115582

115583 - `UserActor object`

115584

115585 - `type: optional "user_actor"`

115586

115587 default: user_actor

115588

115589 - `email_address: string`

115590

115591 format: email

115592

115593 - `ip_address: string`

115594

115595 - `user_agent: string`

115596

115597 - `user_id: string`

115598

115599 - `UnauthenticatedUserActor object`

115600

115601 - `type: optional "unauthenticated_user_actor"`

115602

115603 default: unauthenticated_user_actor

115604

115605 - `ip_address: string`

115606

115607 - `user_agent: string`

115608

115609 - `unauthenticated_email_address: optional string or null`

115610

115611 format: email

115612

115613 - `AnthropicActor object`

115614

115615 - `type: optional "anthropic_actor"`

115616

115617 default: anthropic_actor

115618

115619 - `email_address: optional string or null`

115620

115621 format: email

115622

115623 - `SystemActor object`

115624

115625 Automated background processing performed by Anthropic systems, acting

115626 without a user or customer credential.

115627

115628 - `type: optional "system_actor"`

115629

115630 default: system_actor

115631

115632 - `service: optional string or null`

115633

115634 Name of the automated process that performed the action, when known.

115635

115636 - `AdminAPIKeyActor object`

115637

115638 - `type: optional "admin_api_key_actor"`

115639

115640 default: admin_api_key_actor

115641

115642 - `admin_api_key_id: string`

115643

115644 - `ip_address: string`

115645

115646 - `user_agent: string`

115647

115648 - `ServiceAccountActor object`

115649

115650 - `type: optional "service_account_actor"`

115651

115652 default: service_account_actor

115653

115654 - `ip_address: string`

115655

115656 - `service_account_id: string`

115657

115658 - `user_agent: string`

115659

115660 - `ScimDirectorySyncActor object`

115661

115662 - `type: optional "scim_directory_sync_actor"`

115663

115664 default: scim_directory_sync_actor

115665

115666 - `directory_id: string`

115667

115668 - `workos_event_id: string`

115669

115670 - `idp_connection_type: optional string or null`

115671

115672 - `FederatedIdentityActor object`

115673

115674 A federated external workload authenticated via a verified OIDC token.

115675

115676 Carries the verified issuer, subject, and audience claims from the

115677 presented JWT.

115678

115679 - `type: optional "federated_identity_actor"`

115680

115681 default: federated_identity_actor

115682

115683 - `issuer: string`

115684

115685 - `subject: string`

115686

115687 - `audience: optional array of string`

115688

115689 - `ip_address: optional string or null`

115690

115691 - `user_agent: optional string or null`

115692

115693 - `FederatedActor object`

115694

115695 An external identity asserted by a trusted provider — a cloud-provider

115696 gateway or a customer-registered federation issuer — acting without an

115697 Anthropic-provisioned account or service account.

115698

115699 - `type: optional "federated_actor"`

115700

115701 default: federated_actor

115702

115703 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

115704

115705 - `FederatedActorAwsProvider object`

115706

115707 Asserting party: the AWS account the organization is bound to.

115708

115709 - `type: optional "aws"`

115710

115711 default: aws

115712

115713 - `account_id: string`

115714

115715 - `signed_principal: string`

115716

115717 The AWS-signed ARN of the IAM principal that requested the token.

115718

115719 - `FederatedActorAzureProvider object`

115720

115721 Asserting party: the Azure subscription the organization is bound to.

115722

115723 - `type: optional "azure"`

115724

115725 default: azure

115726

115727 - `subscription_id: string`

115728

115729 - `FederatedActorGcpProvider object`

115730

115731 Asserting party: the GCP project the organization is bound to.

115732

115733 - `type: optional "gcp"`

115734

115735 default: gcp

115736

115737 - `project_number: string`

115738

115739 - `FederatedActorOidcProvider object`

115740

115741 Asserting party: a customer-registered OIDC federation issuer.

115742

115743 - `type: optional "oidc"`

115744

115745 default: oidc

115746

115747 - `issuer: optional string or null`

115748

115749 The federation issuer's URL. Null when the presented credential failed verification.

115750

115751 - `ip_address: optional string or null`

115752

115753 - `subject: optional string or null`

115754

115755 The provider's verified identifier for the caller; its form depends on the provider.

115756

115757 - `user_agent: optional string or null`

115758

115759 - `AttestedDeviceActor object`

115760

115761 An attested mobile device authenticated via Apple App Attest.

115762

115763 - `type: optional "attested_device_actor"`

115764

115765 default: attested_device_actor

115766

115767 - `external_client_id: string`

115768

115769 - `kid_hash: string`

115770

115771 - `ip_address: optional string or null`

115772

115773 - `user_agent: optional string or null`

115774

115775 - `telemetry_destination_id: string`

115776

115777 Tagged telemetry destination ID, e.g. "tdst_01HX...".

115778

115779 - `workspace_id: string`

115780

115781 Tagged ID of the workspace taken off the list, e.g. "wrkspc_01HX...".

115782

115783 - `id: optional string`

115784

115785 Unique identifier for the activity e.g. 'activity_abcd1234'

115786

115787 - `created_at: optional string`

115788

115789 When this activity occurred.

115790

115791 format: date-time

115792

115793 - `organization_id: optional string or null`

115794

115795 Organization ID this activity is associated with

115796

115797 - `organization_uuid: optional string or null`

115798

115799 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

115800

112113115801 - `PlatformUsageReportClaudeCodeViewed object`

112114115802

112115115803 The Claude Code usage report was viewed.

from line 146262

142574146262

142575146263 default: text

142576146264

146265 - `added_as_context: boolean`

146266

146267 True when this text block was added to a human message as context for the assistant: the user did not type it in the message box. The wording of the app's own notes for the assistant is not exported: such a block has an empty `text`. Other added text is exported and can include content that the user or their app chose. False does not mean that the user typed the text. Always false on the last text block of a message, on assistant messages, and on messages sent before 2026-10-09, whose notes are exported in full.

146268

146269 default: false

146270

142577146271 - `text: string`

142578146272

142579146273 Text content from human or assistant

142580146274

142581146275 - `thinking_redacted: boolean`

142582146276

142583 True when content enclosed in the assistant's internal-reasoning tags (or the tag markup itself) was removed from `text` during export. Removal never occurs with this field false. Always false on human messages, whose text is exported verbatim.

146277 True when content enclosed in the assistant's internal-reasoning tags (or the tag markup itself) was removed from `text` during export. Removal never occurs with this field false. Always false on human messages.

142584146278

142585146279 default: false

142586146280

from line 146537

142843146537 "type": "text",

142844146538 "text": "Can you help me draft requirements for our new dashboard feature?",

142845146539 "truncated": false,

142846 "thinking_redacted": false

146540 "thinking_redacted": false,

146541 "added_as_context": false

142847146542 }

142848146543 ],

142849146544 "files": [

from line 146561

142866146561 "type": "text",

142867146562 "text": "I'd be happy to help you draft requirements for your dashboard feature...",

142868146563 "truncated": false,

142869 "thinking_redacted": false

146564 "thinking_redacted": false,

146565 "added_as_context": false

142870146566 }

142871146567 ],

142872146568 "artifacts": [

from line 146583

142887146583 "type": "text",

142888146584 "text": "Are there any open support tickets about the dashboard?",

142889146585 "truncated": false,

142890 "thinking_redacted": false

146586 "thinking_redacted": false,

146587 "added_as_context": false

142891146588 }

142892146589 ]

142893146590 },

from line 146621

142924146621 "type": "text",

142925146622 "text": "There are two open tickets: one about slow loading and one about a missing export button.",

142926146623 "truncated": false,

142927 "thinking_redacted": false

146624 "thinking_redacted": false,

146625 "added_as_context": false

142928146626 }

142929146627 ]

142930146628 }

from line 149197

145499149197

145500149198 Artifact identifier (tagged ID)

145501149199

145502 - `artifact_type: "claude_design" or "claude_design_systems" or "claude_docs" or 4 more`

149200 - `artifact_type: "claude_dashboards" or "claude_design" or "claude_design_systems" or 5 more`

149201

149202 Which kind of Artifact this is: `code` for a site published from Claude Code, or the built-in Artifact type it was made from — `claude_docs` (Claude Docs), `claude_slides` (Slides), `claude_design` (Design), `claude_design_systems` (a design system), `claude_motion` (Motion) or `claude_dashboards` (Dashboards). `other` is an Artifact made from a built-in type this list does not name yet.

145503149203

145504 Which kind of Artifact this is: `code` for a site published from Claude Code, or the built-in Artifact type it was made from — `claude_docs` (Claude Docs), `claude_slides` (Slides), `claude_design` (Design), `claude_design_systems` (a design system) or `claude_motion` (Motion). `other` is an Artifact made from a built-in type this list does not name yet.

149204 - `"claude_dashboards"`

145505149205

145506149206 - `"claude_design"`

145507149207

145508149208

api/compliance/activities Changed · +7278 / -14 lines

This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.

The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.

from line 17

1717

1818### Query parameters

1919

20- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 544 more`

20- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "account_migration_completed" or 558 more`

2121

2222 Filter activities by type. See the response `data` schema for the additional fields each type returns. Cannot be combined with `exclude_activity_types[]`.

2323

from line 29

2929

3030 User-initiated self-service account deletion.

3131

32 - `"account_migration_completed"`

34 A personal Claude account's migration into the organization finished: the migrated data is now part of the organization.

36 - `"account_migration_failed"`

38 A personal Claude account's migration into the organization did not complete.

40 - `"account_migration_started"`

42 A personal Claude account began migrating into the organization: its data, including conversations, projects and files, is being moved from the member's personal account into this organization.

3244 - `"admin_api_key_created"`

3345

3446 An admin API key was created.

from line 361

349361

350362 Claude Code Review configuration was enabled/disabled for an org.

351363

364 - `"claude_code_review_promo_enrolled"`

365

366 An organization admin enrolled the organization in a Claude Code Review promotion, for example by claiming promotional credits.

367

352368 - `"claude_code_review_repository_added"`

353369

354370 A repository was added to org-level Claude Code Review configuration.

from line 419

403419

404420 - `"claude_code_security_scan_project_updated"`

405421

406 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience.

422 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience, or a user paused the project's scheduled scanning, unpaused it, or lifted a billing pause on it.

407423

408424 - `"claude_code_security_scan_project_visibility_updated"`

409425

from line 737

721737

722738 SAML IdP configuration updated for a public sector organization.

723739

740 - `"claude_skill_auto_disabled"`

741

742 A skill that had been turned on for a member automatically was turned off for them automatically, not by the member; reason says why. A member turning a skill off themselves is recorded as claude_skill_disabled.

743

744 - `"claude_skill_auto_enabled"`

745

746 A skill was turned on for a member automatically, not by the member; trigger gives the cause, such as another member sharing an eligible skill with them. A member turning a skill on themselves is recorded as claude_skill_enabled.

747

724748 - `"claude_skill_created"`

725749

726750 Skill was created.

from line 897

873897

874898 A new version of an existing org-owned desktop extension was uploaded.

875899

900 - `"domain_claim_cancelled"`

901

902 A pending domain claim was cancelled before it took effect, so the personal accounts on the claimed domains will no longer be migrated or deactivated at its deadline.

903

904 - `"domain_claim_deadline_updated"`

905

906 The migration deadline of a pending domain claim was moved to a later or an earlier date by Anthropic staff or an automated process.

907

876908 - `"domain_claim_initiated"`

877909

878910 Domain capture claim initiated over personal accounts on verified domains.

from line 1909

18771909

18781910 An org-level spend limit snooze/ignore state was changed.

18791911

1912 - `"platform_telemetry_destination_auto_disabled"`

1913

1914 A telemetry destination was disabled automatically after deliveries to it failed, so no telemetry is sent to it until an administrator enables it again.

1915

1916 - `"platform_telemetry_destination_created"`

1917

1918 A telemetry destination was registered for the organization.

1919

1920 - `"platform_telemetry_destination_deleted"`

1921

1922 A telemetry destination was deleted.

1923

1924 - `"platform_telemetry_destination_updated"`

1925

1926 A telemetry destination's configuration was updated. State changes and changes of its workspace scope (the type, or the list through an update's workspace_ids) are included; the workspaces an update took off or put on the list are also recorded as workspace_removed and workspace_added activities. Previous and current values are recorded only for the endpoint URL, the traces URL, the content mode and the workspaces type.

1927

1928 - `"platform_telemetry_destination_workspace_added"`

1929

1930 A workspace was added to the workspace list of a telemetry destination. When the list type is "include", the destination starts to receive the spans of that workspace; when it is "exclude", the destination stops receiving them.

1931

1932 - `"platform_telemetry_destination_workspace_removed"`

1933

1934 A workspace was removed from the workspace list of a telemetry destination, by a change to the list or because the destination was deleted. When the list type is "include", the destination stops receiving the spans of that workspace; when it is "exclude", the destination receives them again unless the destination was deleted.

1935

18801936 - `"platform_usage_report_claude_code_viewed"`

18811937

18821938 The Claude Code usage report was viewed.

from line 2320

22642320

22652321 format: date-time

22662322

2267- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 544 more`

2323- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "account_migration_completed" or 558 more`

22682324

22692325 Exclude activities of these types. Cannot be combined with `activity_types[]`.

22702326

from line 2332

22762332

22772333 User-initiated self-service account deletion.

22782334

2335 - `"account_migration_completed"`

2336

2337 A personal Claude account's migration into the organization finished: the migrated data is now part of the organization.

2338

2339 - `"account_migration_failed"`

2340

2341 A personal Claude account's migration into the organization did not complete.

2342

2343 - `"account_migration_started"`

2344

2345 A personal Claude account began migrating into the organization: its data, including conversations, projects and files, is being moved from the member's personal account into this organization.

2346

22792347 - `"admin_api_key_created"`

22802348

22812349 An admin API key was created.

from line 2664

25962664

25972665 Claude Code Review configuration was enabled/disabled for an org.

25982666

2667 - `"claude_code_review_promo_enrolled"`

2668

2669 An organization admin enrolled the organization in a Claude Code Review promotion, for example by claiming promotional credits.

2670

25992671 - `"claude_code_review_repository_added"`

26002672

26012673 A repository was added to org-level Claude Code Review configuration.

from line 2722

26502722

26512723 - `"claude_code_security_scan_project_updated"`

26522724

2653 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience.

2725 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience, or a user paused the project's scheduled scanning, unpaused it, or lifted a billing pause on it.

26542726

26552727 - `"claude_code_security_scan_project_visibility_updated"`

26562728

from line 3040

29683040

29693041 SAML IdP configuration updated for a public sector organization.

29703042

3043 - `"claude_skill_auto_disabled"`

3044

3045 A skill that had been turned on for a member automatically was turned off for them automatically, not by the member; reason says why. A member turning a skill off themselves is recorded as claude_skill_disabled.

3046

3047 - `"claude_skill_auto_enabled"`

3048

3049 A skill was turned on for a member automatically, not by the member; trigger gives the cause, such as another member sharing an eligible skill with them. A member turning a skill on themselves is recorded as claude_skill_enabled.

3050

29713051 - `"claude_skill_created"`

29723052

29733053 Skill was created.

from line 3200

31203200

31213201 A new version of an existing org-owned desktop extension was uploaded.

31223202

3203 - `"domain_claim_cancelled"`

3204

3205 A pending domain claim was cancelled before it took effect, so the personal accounts on the claimed domains will no longer be migrated or deactivated at its deadline.

3206

3207 - `"domain_claim_deadline_updated"`

3208

3209 The migration deadline of a pending domain claim was moved to a later or an earlier date by Anthropic staff or an automated process.

3210

31233211 - `"domain_claim_initiated"`

31243212

31253213 Domain capture claim initiated over personal accounts on verified domains.

from line 4212

41244212

41254213 An org-level spend limit snooze/ignore state was changed.

41264214

4215 - `"platform_telemetry_destination_auto_disabled"`

4216

4217 A telemetry destination was disabled automatically after deliveries to it failed, so no telemetry is sent to it until an administrator enables it again.

4218

4219 - `"platform_telemetry_destination_created"`

4220

4221 A telemetry destination was registered for the organization.

4222

4223 - `"platform_telemetry_destination_deleted"`

4224

4225 A telemetry destination was deleted.

4226

4227 - `"platform_telemetry_destination_updated"`

4228

4229 A telemetry destination's configuration was updated. State changes and changes of its workspace scope (the type, or the list through an update's workspace_ids) are included; the workspaces an update took off or put on the list are also recorded as workspace_removed and workspace_added activities. Previous and current values are recorded only for the endpoint URL, the traces URL, the content mode and the workspaces type.

4230

4231 - `"platform_telemetry_destination_workspace_added"`

4232

4233 A workspace was added to the workspace list of a telemetry destination. When the list type is "include", the destination starts to receive the spans of that workspace; when it is "exclude", the destination stops receiving them.

4234

4235 - `"platform_telemetry_destination_workspace_removed"`

4236

4237 A workspace was removed from the workspace list of a telemetry destination, by a change to the list or because the destination was deleted. When the list type is "include", the destination stops receiving the spans of that workspace; when it is "exclude", the destination receives them again unless the destination was deleted.

4238

41274239 - `"platform_usage_report_claude_code_viewed"`

41284240

41294241 The Claude Code usage report was viewed.

from line 4621

45094621

45104622### Returns

45114623

4512- `data: optional array of AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 544 more`

4624- `data: optional array of AbuseDecisionReceived or AccountDeleted or AccountMigrationCompleted or 558 more`

45134625

45144626 List of activity records. Each element's `type` field identifies which activity it is and which additional fields are present.

45154627

from line 5101

49895101

49905102 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

49915103

5104 - `AccountMigrationCompleted object`

5105

5106 A personal Claude account's migration into the organization finished: the migrated data is now part of the organization.

5107

5108 - `type: optional "account_migration_completed"`

5109

5110 default: account_migration_completed

5111

5112 - `account_migration_id: string`

5113

5114 Tagged ID of the migration, e.g. "amig_...", matching the account_migration_started activity that opened it.

5115

5116 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

5117

5118 - `APIActor object`

5119

5120 - `type: optional "api_actor"`

5121

5122 default: api_actor

5123

5124 - `api_key_id: string`

5125

5126 - `ip_address: string`

5127

5128 - `user_agent: string`

5129

5130 - `UserActor object`

5131

5132 - `type: optional "user_actor"`

5133

5134 default: user_actor

5135

5136 - `email_address: string`

5137

5138 format: email

5139

5140 - `ip_address: string`

5141

5142 - `user_agent: string`

5143

5144 - `user_id: string`

5145

5146 - `UnauthenticatedUserActor object`

5147

5148 - `type: optional "unauthenticated_user_actor"`

5149

5150 default: unauthenticated_user_actor

5151

5152 - `ip_address: string`

5153

5154 - `user_agent: string`

5155

5156 - `unauthenticated_email_address: optional string or null`

5157

5158 format: email

5159

5160 - `AnthropicActor object`

5161

5162 - `type: optional "anthropic_actor"`

5163

5164 default: anthropic_actor

5165

5166 - `email_address: optional string or null`

5167

5168 format: email

5169

5170 - `SystemActor object`

5171

5172 Automated background processing performed by Anthropic systems, acting

5173 without a user or customer credential.

5174

5175 - `type: optional "system_actor"`

5176

5177 default: system_actor

5178

5179 - `service: optional string or null`

5180

5181 Name of the automated process that performed the action, when known.

5182

5183 - `AdminAPIKeyActor object`

5184

5185 - `type: optional "admin_api_key_actor"`

5186

5187 default: admin_api_key_actor

5188

5189 - `admin_api_key_id: string`

5190

5191 - `ip_address: string`

5192

5193 - `user_agent: string`

5194

5195 - `ServiceAccountActor object`

5196

5197 - `type: optional "service_account_actor"`

5198

5199 default: service_account_actor

5200

5201 - `ip_address: string`

5202

5203 - `service_account_id: string`

5204

5205 - `user_agent: string`

5206

5207 - `ScimDirectorySyncActor object`

5208

5209 - `type: optional "scim_directory_sync_actor"`

5210

5211 default: scim_directory_sync_actor

5212

5213 - `directory_id: string`

5214

5215 - `workos_event_id: string`

5216

5217 - `idp_connection_type: optional string or null`

5218

5219 - `FederatedIdentityActor object`

5220

5221 A federated external workload authenticated via a verified OIDC token.

5222

5223 Carries the verified issuer, subject, and audience claims from the

5224 presented JWT.

5225

5226 - `type: optional "federated_identity_actor"`

5227

5228 default: federated_identity_actor

5229

5230 - `issuer: string`

5231

5232 - `subject: string`

5233

5234 - `audience: optional array of string`

5235

5236 - `ip_address: optional string or null`

5237

5238 - `user_agent: optional string or null`

5239

5240 - `FederatedActor object`

5241

5242 An external identity asserted by a trusted provider — a cloud-provider

5243 gateway or a customer-registered federation issuer — acting without an

5244 Anthropic-provisioned account or service account.

5245

5246 - `type: optional "federated_actor"`

5247

5248 default: federated_actor

5249

5250 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

5251

5252 - `FederatedActorAwsProvider object`

5253

5254 Asserting party: the AWS account the organization is bound to.

5255

5256 - `type: optional "aws"`

5257

5258 default: aws

5259

5260 - `account_id: string`

5261

5262 - `signed_principal: string`

5263

5264 The AWS-signed ARN of the IAM principal that requested the token.

5265

5266 - `FederatedActorAzureProvider object`

5267

5268 Asserting party: the Azure subscription the organization is bound to.

5269

5270 - `type: optional "azure"`

5271

5272 default: azure

5273

5274 - `subscription_id: string`

5275

5276 - `FederatedActorGcpProvider object`

5277

5278 Asserting party: the GCP project the organization is bound to.

5279

5280 - `type: optional "gcp"`

5281

5282 default: gcp

5283

5284 - `project_number: string`

5285

5286 - `FederatedActorOidcProvider object`

5287

5288 Asserting party: a customer-registered OIDC federation issuer.

5289

5290 - `type: optional "oidc"`

5291

5292 default: oidc

5293

5294 - `issuer: optional string or null`

5295

5296 The federation issuer's URL. Null when the presented credential failed verification.

5297

5298 - `ip_address: optional string or null`

5299

5300 - `subject: optional string or null`

5301

5302 The provider's verified identifier for the caller; its form depends on the provider.

5303

5304 - `user_agent: optional string or null`

5305

5306 - `AttestedDeviceActor object`

5307

5308 An attested mobile device authenticated via Apple App Attest.

5309

5310 - `type: optional "attested_device_actor"`

5311

5312 default: attested_device_actor

5313

5314 - `external_client_id: string`

5315

5316 - `kid_hash: string`

5317

5318 - `ip_address: optional string or null`

5319

5320 - `user_agent: optional string or null`

5321

5322 - `id: optional string`

5323

5324 Unique identifier for the activity e.g. 'activity_abcd1234'

5325

5326 - `created_at: optional string`

5327

5328 When this activity occurred.

5329

5330 format: date-time

5331

5332 - `migrated_user_email: optional string or null`

5333

5334 Email address of the user whose personal account was migrated, when known.

5335

5336 - `migrated_user_id: optional string or null`

5337

5338 Tagged ID of the user whose personal account was migrated, e.g. "user_...", when known.

5339

5340 - `organization_id: optional string or null`

5341

5342 Organization ID this activity is associated with

5343

5344 - `organization_uuid: optional string or null`

5345

5346 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

5347

5348 - `AccountMigrationFailed object`

5349

5350 A personal Claude account's migration into the organization did not complete.

5351

5352 - `type: optional "account_migration_failed"`

5353

5354 default: account_migration_failed

5355

5356 - `account_migration_id: string`

5357

5358 Tagged ID of the migration, e.g. "amig_...", matching the account_migration_started activity that opened it, if one was recorded; a later retry is a new migration with its own ID.

5359

5360 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

5361

5362 - `APIActor object`

5363

5364 - `type: optional "api_actor"`

5365

5366 default: api_actor

5367

5368 - `api_key_id: string`

5369

5370 - `ip_address: string`

5371

5372 - `user_agent: string`

5373

5374 - `UserActor object`

5375

5376 - `type: optional "user_actor"`

5377

5378 default: user_actor

5379

5380 - `email_address: string`

5381

5382 format: email

5383

5384 - `ip_address: string`

5385

5386 - `user_agent: string`

5387

5388 - `user_id: string`

5389

5390 - `UnauthenticatedUserActor object`

5391

5392 - `type: optional "unauthenticated_user_actor"`

5393

5394 default: unauthenticated_user_actor

5395

5396 - `ip_address: string`

5397

5398 - `user_agent: string`

5399

5400 - `unauthenticated_email_address: optional string or null`

5401

5402 format: email

5403

5404 - `AnthropicActor object`

5405

5406 - `type: optional "anthropic_actor"`

5407

5408 default: anthropic_actor

5409

5410 - `email_address: optional string or null`

5411

5412 format: email

5413

5414 - `SystemActor object`

5415

5416 Automated background processing performed by Anthropic systems, acting

5417 without a user or customer credential.

5418

5419 - `type: optional "system_actor"`

5420

5421 default: system_actor

5422

5423 - `service: optional string or null`

5424

5425 Name of the automated process that performed the action, when known.

5426

5427 - `AdminAPIKeyActor object`

5428

5429 - `type: optional "admin_api_key_actor"`

5430

5431 default: admin_api_key_actor

5432

5433 - `admin_api_key_id: string`

5434

5435 - `ip_address: string`

5436

5437 - `user_agent: string`

5438

5439 - `ServiceAccountActor object`

5440

5441 - `type: optional "service_account_actor"`

5442

5443 default: service_account_actor

5444

5445 - `ip_address: string`

5446

5447 - `service_account_id: string`

5448

5449 - `user_agent: string`

5450

5451 - `ScimDirectorySyncActor object`

5452

5453 - `type: optional "scim_directory_sync_actor"`

5454

5455 default: scim_directory_sync_actor

5456

5457 - `directory_id: string`

5458

5459 - `workos_event_id: string`

5460

5461 - `idp_connection_type: optional string or null`

5462

5463 - `FederatedIdentityActor object`

5464

5465 A federated external workload authenticated via a verified OIDC token.

5466

5467 Carries the verified issuer, subject, and audience claims from the

5468 presented JWT.

5469

5470 - `type: optional "federated_identity_actor"`

5471

5472 default: federated_identity_actor

5473

5474 - `issuer: string`

5475

5476 - `subject: string`

5477

5478 - `audience: optional array of string`

5479

5480 - `ip_address: optional string or null`

5481

5482 - `user_agent: optional string or null`

5483

5484 - `FederatedActor object`

5485

5486 An external identity asserted by a trusted provider — a cloud-provider

5487 gateway or a customer-registered federation issuer — acting without an

5488 Anthropic-provisioned account or service account.

5489

5490 - `type: optional "federated_actor"`

5491

5492 default: federated_actor

5493

5494 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

5495

5496 - `FederatedActorAwsProvider object`

5497

5498 Asserting party: the AWS account the organization is bound to.

5499

5500 - `type: optional "aws"`

5501

5502 default: aws

5503

5504 - `account_id: string`

5505

5506 - `signed_principal: string`

5507

5508 The AWS-signed ARN of the IAM principal that requested the token.

5509

5510 - `FederatedActorAzureProvider object`

5511

5512 Asserting party: the Azure subscription the organization is bound to.

5513

5514 - `type: optional "azure"`

5515

5516 default: azure

5517

5518 - `subscription_id: string`

5519

5520 - `FederatedActorGcpProvider object`

5521

5522 Asserting party: the GCP project the organization is bound to.

5523

5524 - `type: optional "gcp"`

5525

5526 default: gcp

5527

5528 - `project_number: string`

5529

5530 - `FederatedActorOidcProvider object`

5531

5532 Asserting party: a customer-registered OIDC federation issuer.

5533

5534 - `type: optional "oidc"`

5535

5536 default: oidc

5537

5538 - `issuer: optional string or null`

5539

5540 The federation issuer's URL. Null when the presented credential failed verification.

5541

5542 - `ip_address: optional string or null`

5543

5544 - `subject: optional string or null`

5545

5546 The provider's verified identifier for the caller; its form depends on the provider.

5547

5548 - `user_agent: optional string or null`

5549

5550 - `AttestedDeviceActor object`

5551

5552 An attested mobile device authenticated via Apple App Attest.

5553

5554 - `type: optional "attested_device_actor"`

5555

5556 default: attested_device_actor

5557

5558 - `external_client_id: string`

5559

5560 - `kid_hash: string`

5561

5562 - `ip_address: optional string or null`

5563

5564 - `user_agent: optional string or null`

5565

5566 - `id: optional string`

5567

5568 Unique identifier for the activity e.g. 'activity_abcd1234'

5569

5570 - `created_at: optional string`

5571

5572 When this activity occurred.

5573

5574 format: date-time

5575

5576 - `failure_reasons: optional array of "already_member_of_target" or "already_migrating" or "anthropic_staff_action" or 12 more`

5577

5578 Why the migration did not complete, each reason listed once. In these values "source" is the member's personal account and "target" is this organization. "source_equals_target", "source_not_personal_org", "user_not_member_of_source" and "user_not_sole_member_of_source": the account is not a single-member personal account that can be migrated. "target_not_enterprise_org": this organization's plan does not accept the migration. "already_member_of_target": the migration already happened. "target_membership_not_provisioned" and "target_membership_unassigned_no_seats": the member has no usable seat in this organization. "already_migrating": another migration of the same account is in progress. "source_too_large": the personal account holds more data than a migration can move. "target_became_inactive": this organization became inactive before the migration finished. "migration_failed": an error stopped the migration. "anthropic_staff_action": Anthropic staff stopped the migration. "migration_blocked_redacted": stands in for every reason that is not shared with the organization. Values may be added over time; treat an unrecognized value as a generic failure. "unspecified" is never emitted.

5579

5580 - `"already_member_of_target"`

5581

5582 - `"already_migrating"`

5583

5584 - `"anthropic_staff_action"`

5585

5586 - `"migration_blocked_redacted"`

5587

5588 - `"migration_failed"`

5589

5590 - `"source_equals_target"`

5591

5592 - `"source_not_personal_org"`

5593

5594 - `"source_too_large"`

5595

5596 - `"target_became_inactive"`

5597

5598 - `"target_membership_not_provisioned"`

5599

5600 - `"target_membership_unassigned_no_seats"`

5601

5602 - `"target_not_enterprise_org"`

5603

5604 - `"unspecified"`

5605

5606 - `"user_not_member_of_source"`

5607

5608 - `"user_not_sole_member_of_source"`

5609

5610 - `migrated_user_email: optional string or null`

5611

5612 Email address of the user whose personal account was being migrated, when known.

5613

5614 - `migrated_user_id: optional string or null`

5615

5616 Tagged ID of the user whose personal account was being migrated, e.g. "user_...", when known.

5617

5618 - `organization_id: optional string or null`

5619

5620 Organization ID this activity is associated with

5621

5622 - `organization_uuid: optional string or null`

5623

5624 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

5625

5626 - `AccountMigrationStarted object`

5627

5628 A personal Claude account began migrating into the organization: its data, including conversations, projects and files, is being moved from the member's personal account into this organization.

5629

5630 - `type: optional "account_migration_started"`

5631

5632 default: account_migration_started

5633

5634 - `account_migration_id: string`

5635

5636 Tagged ID of the migration, e.g. "amig_...". The same ID appears on the completed or failed activity that closes the migration, when one is recorded.

5637

5638 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

5639

5640 - `APIActor object`

5641

5642 - `type: optional "api_actor"`

5643

5644 default: api_actor

5645

5646 - `api_key_id: string`

5647

5648 - `ip_address: string`

5649

5650 - `user_agent: string`

5651

5652 - `UserActor object`

5653

5654 - `type: optional "user_actor"`

5655

5656 default: user_actor

5657

5658 - `email_address: string`

5659

5660 format: email

5661

5662 - `ip_address: string`

5663

5664 - `user_agent: string`

5665

5666 - `user_id: string`

5667

5668 - `UnauthenticatedUserActor object`

5669

5670 - `type: optional "unauthenticated_user_actor"`

5671

5672 default: unauthenticated_user_actor

5673

5674 - `ip_address: string`

5675

5676 - `user_agent: string`

5677

5678 - `unauthenticated_email_address: optional string or null`

5679

5680 format: email

5681

5682 - `AnthropicActor object`

5683

5684 - `type: optional "anthropic_actor"`

5685

5686 default: anthropic_actor

5687

5688 - `email_address: optional string or null`

5689

5690 format: email

5691

5692 - `SystemActor object`

5693

5694 Automated background processing performed by Anthropic systems, acting

5695 without a user or customer credential.

5696

5697 - `type: optional "system_actor"`

5698

5699 default: system_actor

5700

5701 - `service: optional string or null`

5702

5703 Name of the automated process that performed the action, when known.

5704

5705 - `AdminAPIKeyActor object`

5706

5707 - `type: optional "admin_api_key_actor"`

5708

5709 default: admin_api_key_actor

5710

5711 - `admin_api_key_id: string`

5712

5713 - `ip_address: string`

5714

5715 - `user_agent: string`

5716

5717 - `ServiceAccountActor object`

5718

5719 - `type: optional "service_account_actor"`

5720

5721 default: service_account_actor

5722

5723 - `ip_address: string`

5724

5725 - `service_account_id: string`

5726

5727 - `user_agent: string`

5728

5729 - `ScimDirectorySyncActor object`

5730

5731 - `type: optional "scim_directory_sync_actor"`

5732

5733 default: scim_directory_sync_actor

5734

5735 - `directory_id: string`

5736

5737 - `workos_event_id: string`

5738

5739 - `idp_connection_type: optional string or null`

5740

5741 - `FederatedIdentityActor object`

5742

5743 A federated external workload authenticated via a verified OIDC token.

5744

5745 Carries the verified issuer, subject, and audience claims from the

5746 presented JWT.

5747

5748 - `type: optional "federated_identity_actor"`

5749

5750 default: federated_identity_actor

5751

5752 - `issuer: string`

5753

5754 - `subject: string`

5755

5756 - `audience: optional array of string`

5757

5758 - `ip_address: optional string or null`

5759

5760 - `user_agent: optional string or null`

5761

5762 - `FederatedActor object`

5763

5764 An external identity asserted by a trusted provider — a cloud-provider

5765 gateway or a customer-registered federation issuer — acting without an

5766 Anthropic-provisioned account or service account.

5767

5768 - `type: optional "federated_actor"`

5769

5770 default: federated_actor

5771

5772 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

5773

5774 - `FederatedActorAwsProvider object`

5775

5776 Asserting party: the AWS account the organization is bound to.

5777

5778 - `type: optional "aws"`

5779

5780 default: aws

5781

5782 - `account_id: string`

5783

5784 - `signed_principal: string`

5785

5786 The AWS-signed ARN of the IAM principal that requested the token.

5787

5788 - `FederatedActorAzureProvider object`

5789

5790 Asserting party: the Azure subscription the organization is bound to.

5791

5792 - `type: optional "azure"`

5793

5794 default: azure

5795

5796 - `subscription_id: string`

5797

5798 - `FederatedActorGcpProvider object`

5799

5800 Asserting party: the GCP project the organization is bound to.

5801

5802 - `type: optional "gcp"`

5803

5804 default: gcp

5805

5806 - `project_number: string`

5807

5808 - `FederatedActorOidcProvider object`

5809

5810 Asserting party: a customer-registered OIDC federation issuer.

5811

5812 - `type: optional "oidc"`

5813

5814 default: oidc

5815

5816 - `issuer: optional string or null`

5817

5818 The federation issuer's URL. Null when the presented credential failed verification.

5819

5820 - `ip_address: optional string or null`

5821

5822 - `subject: optional string or null`

5823

5824 The provider's verified identifier for the caller; its form depends on the provider.

5825

5826 - `user_agent: optional string or null`

5827

5828 - `AttestedDeviceActor object`

5829

5830 An attested mobile device authenticated via Apple App Attest.

5831

5832 - `type: optional "attested_device_actor"`

5833

5834 default: attested_device_actor

5835

5836 - `external_client_id: string`

5837

5838 - `kid_hash: string`

5839

5840 - `ip_address: optional string or null`

5841

5842 - `user_agent: optional string or null`

5843

5844 - `migrated_user_email: string`

5845

5846 Email address of the user whose personal account is being migrated.

5847

5848 - `migrated_user_id: string`

5849

5850 Tagged ID of the user whose personal account is being migrated, e.g. "user_...".

5851

5852 - `id: optional string`

5853

5854 Unique identifier for the activity e.g. 'activity_abcd1234'

5855

5856 - `created_at: optional string`

5857

5858 When this activity occurred.

5859

5860 format: date-time

5861

5862 - `organization_id: optional string or null`

5863

5864 Organization ID this activity is associated with

5865

5866 - `organization_uuid: optional string or null`

5867

5868 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

5869

49925870 - `AdminAPIKeyCreated object`

49935871

49945872 An admin API key was created.

from line 26355

2547726355

2547826356 Per-review spend limit in USD before the change. Absent when no configuration existed before this update or no limit was set.

2547926357

26358 - `previous_review_level: optional string or null`

26359

26360 Review level set for the organization's code reviews before the change: "low" (Quick), "medium" (Standard) or "high" (Deep). Absent when no configuration existed before this update or no level was set.

26361

2548026362 - `previous_show_tips: optional boolean or null`

2548126363

2548226364 Whether tip-style pull-request comments were enabled before the change. Absent when no configuration existed before this update.

from line 26367

2548526367

2548626368 Whether the verification stage of code review was enabled for the organization before the change. Absent when no configuration existed before this update or no preference was set.

2548726369

26370 - `review_level: optional string or null`

26371

26372 Review level now set for the organization's code reviews: "low" (Quick), "medium" (Standard) or "high" (Deep). Repositories without their own level use this one. Absent when no level is set; the default level, Standard, then applies.

26373

2548826374 - `show_tips: optional boolean or null`

2548926375

2549026376 Whether tip-style pull-request comments are now enabled

from line 26379

2549326379

2549426380 Whether the verification stage of code review is now enabled for the organization. Absent when the organization has not set a preference and the default applies.

2549526381

26382 - `ClaudeCodeReviewPromoEnrolled object`

26383

26384 An organization admin enrolled the organization in a Claude Code Review promotion, for example by claiming promotional credits.

26385

26386 - `type: optional "claude_code_review_promo_enrolled"`

26387

26388 default: claude_code_review_promo_enrolled

26389

26390 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

26391

26392 - `APIActor object`

26393

26394 - `type: optional "api_actor"`

26395

26396 default: api_actor

26397

26398 - `api_key_id: string`

26399

26400 - `ip_address: string`

26401

26402 - `user_agent: string`

26403

26404 - `UserActor object`

26405

26406 - `type: optional "user_actor"`

26407

26408 default: user_actor

26409

26410 - `email_address: string`

26411

26412 format: email

26413

26414 - `ip_address: string`

26415

26416 - `user_agent: string`

26417

26418 - `user_id: string`

26419

26420 - `UnauthenticatedUserActor object`

26421

26422 - `type: optional "unauthenticated_user_actor"`

26423

26424 default: unauthenticated_user_actor

26425

26426 - `ip_address: string`

26427

26428 - `user_agent: string`

26429

26430 - `unauthenticated_email_address: optional string or null`

26431

26432 format: email

26433

26434 - `AnthropicActor object`

26435

26436 - `type: optional "anthropic_actor"`

26437

26438 default: anthropic_actor

26439

26440 - `email_address: optional string or null`

26441

26442 format: email

26443

26444 - `SystemActor object`

26445

26446 Automated background processing performed by Anthropic systems, acting

26447 without a user or customer credential.

26448

26449 - `type: optional "system_actor"`

26450

26451 default: system_actor

26452

26453 - `service: optional string or null`

26454

26455 Name of the automated process that performed the action, when known.

26456

26457 - `AdminAPIKeyActor object`

26458

26459 - `type: optional "admin_api_key_actor"`

26460

26461 default: admin_api_key_actor

26462

26463 - `admin_api_key_id: string`

26464

26465 - `ip_address: string`

26466

26467 - `user_agent: string`

26468

26469 - `ServiceAccountActor object`

26470

26471 - `type: optional "service_account_actor"`

26472

26473 default: service_account_actor

26474

26475 - `ip_address: string`

26476

26477 - `service_account_id: string`

26478

26479 - `user_agent: string`

26480

26481 - `ScimDirectorySyncActor object`

26482

26483 - `type: optional "scim_directory_sync_actor"`

26484

26485 default: scim_directory_sync_actor

26486

26487 - `directory_id: string`

26488

26489 - `workos_event_id: string`

26490

26491 - `idp_connection_type: optional string or null`

26492

26493 - `FederatedIdentityActor object`

26494

26495 A federated external workload authenticated via a verified OIDC token.

26496

26497 Carries the verified issuer, subject, and audience claims from the

26498 presented JWT.

26499

26500 - `type: optional "federated_identity_actor"`

26501

26502 default: federated_identity_actor

26503

26504 - `issuer: string`

26505

26506 - `subject: string`

26507

26508 - `audience: optional array of string`

26509

26510 - `ip_address: optional string or null`

26511

26512 - `user_agent: optional string or null`

26513

26514 - `FederatedActor object`

26515

26516 An external identity asserted by a trusted provider — a cloud-provider

26517 gateway or a customer-registered federation issuer — acting without an

26518 Anthropic-provisioned account or service account.

26519

26520 - `type: optional "federated_actor"`

26521

26522 default: federated_actor

26523

26524 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

26525

26526 - `FederatedActorAwsProvider object`

26527

26528 Asserting party: the AWS account the organization is bound to.

26529

26530 - `type: optional "aws"`

26531

26532 default: aws

26533

26534 - `account_id: string`

26535

26536 - `signed_principal: string`

26537

26538 The AWS-signed ARN of the IAM principal that requested the token.

26539

26540 - `FederatedActorAzureProvider object`

26541

26542 Asserting party: the Azure subscription the organization is bound to.

26543

26544 - `type: optional "azure"`

26545

26546 default: azure

26547

26548 - `subscription_id: string`

26549

26550 - `FederatedActorGcpProvider object`

26551

26552 Asserting party: the GCP project the organization is bound to.

26553

26554 - `type: optional "gcp"`

26555

26556 default: gcp

26557

26558 - `project_number: string`

26559

26560 - `FederatedActorOidcProvider object`

26561

26562 Asserting party: a customer-registered OIDC federation issuer.

26563

26564 - `type: optional "oidc"`

26565

26566 default: oidc

26567

26568 - `issuer: optional string or null`

26569

26570 The federation issuer's URL. Null when the presented credential failed verification.

26571

26572 - `ip_address: optional string or null`

26573

26574 - `subject: optional string or null`

26575

26576 The provider's verified identifier for the caller; its form depends on the provider.

26577

26578 - `user_agent: optional string or null`

26579

26580 - `AttestedDeviceActor object`

26581

26582 An attested mobile device authenticated via Apple App Attest.

26583

26584 - `type: optional "attested_device_actor"`

26585

26586 default: attested_device_actor

26587

26588 - `external_client_id: string`

26589

26590 - `kid_hash: string`

26591

26592 - `ip_address: optional string or null`

26593

26594 - `user_agent: optional string or null`

26595

26596 - `promo_id: string`

26597

26598 Identifier of the promotion the organization enrolled in.

26599

26600 - `id: optional string`

26601

26602 Unique identifier for the activity e.g. 'activity_abcd1234'

26603

26604 - `created_at: optional string`

26605

26606 When this activity occurred.

26607

26608 format: date-time

26609

26610 - `expires_at: optional string or null`

26611

26612 When the organization's promotional access or credits expire.

26613

26614 format: date-time

26615

26616 - `organization_id: optional string or null`

26617

26618 Organization ID this activity is associated with

26619

26620 - `organization_uuid: optional string or null`

26621

26622 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

26623

2549626624 - `ClaudeCodeReviewRepositoryAdded object`

2549726625

2549826626 A repository was added to org-level Claude Code Review configuration.

from line 27357

2622927357

2623027358 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

2623127359

27360 - `previous_review_level: optional string or null`

27361

27362 Review level set for this repository's code reviews before the change: "low" (Quick), "medium" (Standard) or "high" (Deep). Absent when no level was set.

27363

27364 - `review_level: optional string or null`

27365

27366 Review level now set for this repository's code reviews: "low" (Quick), "medium" (Standard) or "high" (Deep). Absent when no level is set; the repository then uses the organization-wide level (review_level on claude_code_review_config_updated), or Standard if none is set.

27367

2623227368 - `status: optional string or null`

2623327369

2623427370 Updated status (ACTIVE/INACTIVE)

from line 29833

2869729833

2869829834 - `ClaudeCodeSecurityScanProjectUpdated object`

2869929835

28700 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience.

29836 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience, or a user paused the project's scheduled scanning, unpaused it, or lifted a billing pause on it.

2870129837

2870229838 - `type: optional "claude_code_security_scan_project_updated"`

2870329839

2870429840 default: claude_code_security_scan_project_updated

2870529841

28706 - `action: "archived" or "created" or "migrated" or 3 more`

29842 - `action: "archived" or "billing_pause_lifted" or "created" or 6 more`

2870729843

2870829844 The state change applied to the scan project.

2870929845

2871029846 - `"archived"`

2871129847

29848 - `"billing_pause_lifted"`

29849

2871229850 - `"created"`

2871329851

2871429852 - `"migrated"`

2871529853

29854 - `"paused"`

29855

2871629856 - `"resumed"`

2871729857

2871829858 - `"unarchived"`

2871929859

29860 - `"unpaused"`

29861

2872029862 - `"unspecified"`

2872129863

2872229864 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

from line 40117

3897540117

3897640118 A short provider-specific identifier for the external resource after the update, e.g. `owner/repo` for GitHub or a file ID for Google Drive.

3897740119

40120 - `ClaudeSkillAutoDisabled object`

40121

40122 A skill that had been turned on for a member automatically was turned off for them automatically, not by the member; reason says why. A member turning a skill off themselves is recorded as claude_skill_disabled.

40123

40124 - `type: optional "claude_skill_auto_disabled"`

40125

40126 default: claude_skill_auto_disabled

40127

40128 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

40129

40130 - `APIActor object`

40131

40132 - `type: optional "api_actor"`

40133

40134 default: api_actor

40135

40136 - `api_key_id: string`

40137

40138 - `ip_address: string`

40139

40140 - `user_agent: string`

40141

40142 - `UserActor object`

40143

40144 - `type: optional "user_actor"`

40145

40146 default: user_actor

40147

40148 - `email_address: string`

40149

40150 format: email

40151

40152 - `ip_address: string`

40153

40154 - `user_agent: string`

40155

40156 - `user_id: string`

40157

40158 - `UnauthenticatedUserActor object`

40159

40160 - `type: optional "unauthenticated_user_actor"`

40161

40162 default: unauthenticated_user_actor

40163

40164 - `ip_address: string`

40165

40166 - `user_agent: string`

40167

40168 - `unauthenticated_email_address: optional string or null`

40169

40170 format: email

40171

40172 - `AnthropicActor object`

40173

40174 - `type: optional "anthropic_actor"`

40175

40176 default: anthropic_actor

40177

40178 - `email_address: optional string or null`

40179

40180 format: email

40181

40182 - `SystemActor object`

40183

40184 Automated background processing performed by Anthropic systems, acting

40185 without a user or customer credential.

40186

40187 - `type: optional "system_actor"`

40188

40189 default: system_actor

40190

40191 - `service: optional string or null`

40192

40193 Name of the automated process that performed the action, when known.

40194

40195 - `AdminAPIKeyActor object`

40196

40197 - `type: optional "admin_api_key_actor"`

40198

40199 default: admin_api_key_actor

40200

40201 - `admin_api_key_id: string`

40202

40203 - `ip_address: string`

40204

40205 - `user_agent: string`

40206

40207 - `ServiceAccountActor object`

40208

40209 - `type: optional "service_account_actor"`

40210

40211 default: service_account_actor

40212

40213 - `ip_address: string`

40214

40215 - `service_account_id: string`

40216

40217 - `user_agent: string`

40218

40219 - `ScimDirectorySyncActor object`

40220

40221 - `type: optional "scim_directory_sync_actor"`

40222

40223 default: scim_directory_sync_actor

40224

40225 - `directory_id: string`

40226

40227 - `workos_event_id: string`

40228

40229 - `idp_connection_type: optional string or null`

40230

40231 - `FederatedIdentityActor object`

40232

40233 A federated external workload authenticated via a verified OIDC token.

40234

40235 Carries the verified issuer, subject, and audience claims from the

40236 presented JWT.

40237

40238 - `type: optional "federated_identity_actor"`

40239

40240 default: federated_identity_actor

40241

40242 - `issuer: string`

40243

40244 - `subject: string`

40245

40246 - `audience: optional array of string`

40247

40248 - `ip_address: optional string or null`

40249

40250 - `user_agent: optional string or null`

40251

40252 - `FederatedActor object`

40253

40254 An external identity asserted by a trusted provider — a cloud-provider

40255 gateway or a customer-registered federation issuer — acting without an

40256 Anthropic-provisioned account or service account.

40257

40258 - `type: optional "federated_actor"`

40259

40260 default: federated_actor

40261

40262 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

40263

40264 - `FederatedActorAwsProvider object`

40265

40266 Asserting party: the AWS account the organization is bound to.

40267

40268 - `type: optional "aws"`

40269

40270 default: aws

40271

40272 - `account_id: string`

40273

40274 - `signed_principal: string`

40275

40276 The AWS-signed ARN of the IAM principal that requested the token.

40277

40278 - `FederatedActorAzureProvider object`

40279

40280 Asserting party: the Azure subscription the organization is bound to.

40281

40282 - `type: optional "azure"`

40283

40284 default: azure

40285

40286 - `subscription_id: string`

40287

40288 - `FederatedActorGcpProvider object`

40289

40290 Asserting party: the GCP project the organization is bound to.

40291

40292 - `type: optional "gcp"`

40293

40294 default: gcp

40295

40296 - `project_number: string`

40297

40298 - `FederatedActorOidcProvider object`

40299

40300 Asserting party: a customer-registered OIDC federation issuer.

40301

40302 - `type: optional "oidc"`

40303

40304 default: oidc

40305

40306 - `issuer: optional string or null`

40307

40308 The federation issuer's URL. Null when the presented credential failed verification.

40309

40310 - `ip_address: optional string or null`

40311

40312 - `subject: optional string or null`

40313

40314 The provider's verified identifier for the caller; its form depends on the provider.

40315

40316 - `user_agent: optional string or null`

40317

40318 - `AttestedDeviceActor object`

40319

40320 An attested mobile device authenticated via Apple App Attest.

40321

40322 - `type: optional "attested_device_actor"`

40323

40324 default: attested_device_actor

40325

40326 - `external_client_id: string`

40327

40328 - `kid_hash: string`

40329

40330 - `ip_address: optional string or null`

40331

40332 - `user_agent: optional string or null`

40333

40334 - `reason: "auto_enable_reverted" or "content_changed" or "unspecified"`

40335

40336 Why the skill was turned off automatically: "content_changed" (a change to the skill was saved or attempted, or the skill was scanned again, and it could not be confirmed as still eligible to be on automatically) or "auto_enable_reverted" (Anthropic turned off skills that had been turned on automatically; not in response to a change to this skill).

40337

40338 - `"auto_enable_reverted"`

40339

40340 - `"content_changed"`

40341

40342 - `"unspecified"`

40343

40344 - `user_id: string`

40345

40346 The member the skill was turned off for.

40347

40348 - `id: optional string`

40349

40350 Unique identifier for the activity e.g. 'activity_abcd1234'

40351

40352 - `created_at: optional string`

40353

40354 When this activity occurred.

40355

40356 format: date-time

40357

40358 - `organization_id: optional string or null`

40359

40360 Organization ID this activity is associated with

40361

40362 - `organization_uuid: optional string or null`

40363

40364 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

40365

40366 - `shared_by_user_id: optional string or null`

40367

40368 For a skill that had been turned on because it was shared: the member who shared it.

40369

40370 - `skill_id: optional string or null`

40371

40372 The skill that was turned off.

40373

40374 - `skill_name: optional string or null`

40375

40376 The name of the skill that was turned off.

40377

40378 - `skill_version: optional string or null`

40379

40380 The version of the skill the member had just before it was turned off. Absent when not known.

40381

40382 - `ClaudeSkillAutoEnabled object`

40383

40384 A skill was turned on for a member automatically, not by the member; trigger gives the cause, such as another member sharing an eligible skill with them. A member turning a skill on themselves is recorded as claude_skill_enabled.

40385

40386 - `type: optional "claude_skill_auto_enabled"`

40387

40388 default: claude_skill_auto_enabled

40389

40390 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

40391

40392 - `APIActor object`

40393

40394 - `type: optional "api_actor"`

40395

40396 default: api_actor

40397

40398 - `api_key_id: string`

40399

40400 - `ip_address: string`

40401

40402 - `user_agent: string`

40403

40404 - `UserActor object`

40405

40406 - `type: optional "user_actor"`

40407

40408 default: user_actor

40409

40410 - `email_address: string`

40411

40412 format: email

40413

40414 - `ip_address: string`

40415

40416 - `user_agent: string`

40417

40418 - `user_id: string`

40419

40420 - `UnauthenticatedUserActor object`

40421

40422 - `type: optional "unauthenticated_user_actor"`

40423

40424 default: unauthenticated_user_actor

40425

40426 - `ip_address: string`

40427

40428 - `user_agent: string`

40429

40430 - `unauthenticated_email_address: optional string or null`

40431

40432 format: email

40433

40434 - `AnthropicActor object`

40435

40436 - `type: optional "anthropic_actor"`

40437

40438 default: anthropic_actor

40439

40440 - `email_address: optional string or null`

40441

40442 format: email

40443

40444 - `SystemActor object`

40445

40446 Automated background processing performed by Anthropic systems, acting

40447 without a user or customer credential.

40448

40449 - `type: optional "system_actor"`

40450

40451 default: system_actor

40452

40453 - `service: optional string or null`

40454

40455 Name of the automated process that performed the action, when known.

40456

40457 - `AdminAPIKeyActor object`

40458

40459 - `type: optional "admin_api_key_actor"`

40460

40461 default: admin_api_key_actor

40462

40463 - `admin_api_key_id: string`

40464

40465 - `ip_address: string`

40466

40467 - `user_agent: string`

40468

40469 - `ServiceAccountActor object`

40470

40471 - `type: optional "service_account_actor"`

40472

40473 default: service_account_actor

40474

40475 - `ip_address: string`

40476

40477 - `service_account_id: string`

40478

40479 - `user_agent: string`

40480

40481 - `ScimDirectorySyncActor object`

40482

40483 - `type: optional "scim_directory_sync_actor"`

40484

40485 default: scim_directory_sync_actor

40486

40487 - `directory_id: string`

40488

40489 - `workos_event_id: string`

40490

40491 - `idp_connection_type: optional string or null`

40492

40493 - `FederatedIdentityActor object`

40494

40495 A federated external workload authenticated via a verified OIDC token.

40496

40497 Carries the verified issuer, subject, and audience claims from the

40498 presented JWT.

40499

40500 - `type: optional "federated_identity_actor"`

40501

40502 default: federated_identity_actor

40503

40504 - `issuer: string`

40505

40506 - `subject: string`

40507

40508 - `audience: optional array of string`

40509

40510 - `ip_address: optional string or null`

40511

40512 - `user_agent: optional string or null`

40513

40514 - `FederatedActor object`

40515

40516 An external identity asserted by a trusted provider — a cloud-provider

40517 gateway or a customer-registered federation issuer — acting without an

40518 Anthropic-provisioned account or service account.

40519

40520 - `type: optional "federated_actor"`

40521

40522 default: federated_actor

40523

40524 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

40525

40526 - `FederatedActorAwsProvider object`

40527

40528 Asserting party: the AWS account the organization is bound to.

40529

40530 - `type: optional "aws"`

40531

40532 default: aws

40533

40534 - `account_id: string`

40535

40536 - `signed_principal: string`

40537

40538 The AWS-signed ARN of the IAM principal that requested the token.

40539

40540 - `FederatedActorAzureProvider object`

40541

40542 Asserting party: the Azure subscription the organization is bound to.

40543

40544 - `type: optional "azure"`

40545

40546 default: azure

40547

40548 - `subscription_id: string`

40549

40550 - `FederatedActorGcpProvider object`

40551

40552 Asserting party: the GCP project the organization is bound to.

40553

40554 - `type: optional "gcp"`

40555

40556 default: gcp

40557

40558 - `project_number: string`

40559

40560 - `FederatedActorOidcProvider object`

40561

40562 Asserting party: a customer-registered OIDC federation issuer.

40563

40564 - `type: optional "oidc"`

40565

40566 default: oidc

40567

40568 - `issuer: optional string or null`

40569

40570 The federation issuer's URL. Null when the presented credential failed verification.

40571

40572 - `ip_address: optional string or null`

40573

40574 - `subject: optional string or null`

40575

40576 The provider's verified identifier for the caller; its form depends on the provider.

40577

40578 - `user_agent: optional string or null`

40579

40580 - `AttestedDeviceActor object`

40581

40582 An attested mobile device authenticated via Apple App Attest.

40583

40584 - `type: optional "attested_device_actor"`

40585

40586 default: attested_device_actor

40587

40588 - `external_client_id: string`

40589

40590 - `kid_hash: string`

40591

40592 - `ip_address: optional string or null`

40593

40594 - `user_agent: optional string or null`

40595

40596 - `trigger: "share" or "unspecified"`

40597

40598 What caused the skill to be turned on automatically: "share" (another member shared it with the member, directly or through a group).

40599

40600 - `"share"`

40601

40602 - `"unspecified"`

40603

40604 - `user_id: string`

40605

40606 The member the skill was turned on for.

40607

40608 - `id: optional string`

40609

40610 Unique identifier for the activity e.g. 'activity_abcd1234'

40611

40612 - `created_at: optional string`

40613

40614 When this activity occurred.

40615

40616 format: date-time

40617

40618 - `organization_id: optional string or null`

40619

40620 Organization ID this activity is associated with

40621

40622 - `organization_uuid: optional string or null`

40623

40624 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

40625

40626 - `shared_at: optional string or null`

40627

40628 For a skill turned on because it was shared: when it was shared with the member or with their group.

40629

40630 format: date-time

40631

40632 - `shared_by_user_id: optional string or null`

40633

40634 For a skill turned on because it was shared: the member who shared it.

40635

40636 - `shared_via: optional "direct" or "group" or "unspecified" or null`

40637

40638 For a skill turned on because it was shared: "direct" if shared with the member themselves, "group" if shared with a group they belong to.

40639

40640 - `"direct"`

40641

40642 - `"group"`

40643

40644 - `"unspecified"`

40645

40646 - `skill_id: optional string or null`

40647

40648 The skill that was turned on.

40649

40650 - `skill_name: optional string or null`

40651

40652 The name of the skill that was turned on.

40653

40654 - `skill_version: optional string or null`

40655

40656 The version of the skill that was turned on.

40657

3897840658 - `ClaudeSkillDownloaded object`

3897940659

3898040660 A member explicitly downloaded a skill's files to their device: the Download action in Claude, a single file saved from the skill viewer, or an install they asked one of their Claude apps for. Background syncs to the Claude apps, viewing a skill in the app and services reading a skill on the member's behalf are not recorded.

from line 49267

4758749267

4758849268 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

4758949269

49270 - `DomainClaimCancelled object`

49271

49272 A pending domain claim was cancelled before it took effect, so the personal accounts on the claimed domains will no longer be migrated or deactivated at its deadline.

49273

49274 - `type: optional "domain_claim_cancelled"`

49275

49276 default: domain_claim_cancelled

49277

49278 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

49279

49280 - `APIActor object`

49281

49282 - `type: optional "api_actor"`

49283

49284 default: api_actor

49285

49286 - `api_key_id: string`

49287

49288 - `ip_address: string`

49289

49290 - `user_agent: string`

49291

49292 - `UserActor object`

49293

49294 - `type: optional "user_actor"`

49295

49296 default: user_actor

49297

49298 - `email_address: string`

49299

49300 format: email

49301

49302 - `ip_address: string`

49303

49304 - `user_agent: string`

49305

49306 - `user_id: string`

49307

49308 - `UnauthenticatedUserActor object`

49309

49310 - `type: optional "unauthenticated_user_actor"`

49311

49312 default: unauthenticated_user_actor

49313

49314 - `ip_address: string`

49315

49316 - `user_agent: string`

49317

49318 - `unauthenticated_email_address: optional string or null`

49319

49320 format: email

49321

49322 - `AnthropicActor object`

49323

49324 - `type: optional "anthropic_actor"`

49325

49326 default: anthropic_actor

49327

49328 - `email_address: optional string or null`

49329

49330 format: email

49331

49332 - `SystemActor object`

49333

49334 Automated background processing performed by Anthropic systems, acting

49335 without a user or customer credential.

49336

49337 - `type: optional "system_actor"`

49338

49339 default: system_actor

49340

49341 - `service: optional string or null`

49342

49343 Name of the automated process that performed the action, when known.

49344

49345 - `AdminAPIKeyActor object`

49346

49347 - `type: optional "admin_api_key_actor"`

49348

49349 default: admin_api_key_actor

49350

49351 - `admin_api_key_id: string`

49352

49353 - `ip_address: string`

49354

49355 - `user_agent: string`

49356

49357 - `ServiceAccountActor object`

49358

49359 - `type: optional "service_account_actor"`

49360

49361 default: service_account_actor

49362

49363 - `ip_address: string`

49364

49365 - `service_account_id: string`

49366

49367 - `user_agent: string`

49368

49369 - `ScimDirectorySyncActor object`

49370

49371 - `type: optional "scim_directory_sync_actor"`

49372

49373 default: scim_directory_sync_actor

49374

49375 - `directory_id: string`

49376

49377 - `workos_event_id: string`

49378

49379 - `idp_connection_type: optional string or null`

49380

49381 - `FederatedIdentityActor object`

49382

49383 A federated external workload authenticated via a verified OIDC token.

49384

49385 Carries the verified issuer, subject, and audience claims from the

49386 presented JWT.

49387

49388 - `type: optional "federated_identity_actor"`

49389

49390 default: federated_identity_actor

49391

49392 - `issuer: string`

49393

49394 - `subject: string`

49395

49396 - `audience: optional array of string`

49397

49398 - `ip_address: optional string or null`

49399

49400 - `user_agent: optional string or null`

49401

49402 - `FederatedActor object`

49403

49404 An external identity asserted by a trusted provider — a cloud-provider

49405 gateway or a customer-registered federation issuer — acting without an

49406 Anthropic-provisioned account or service account.

49407

49408 - `type: optional "federated_actor"`

49409

49410 default: federated_actor

49411

49412 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

49413

49414 - `FederatedActorAwsProvider object`

49415

49416 Asserting party: the AWS account the organization is bound to.

49417

49418 - `type: optional "aws"`

49419

49420 default: aws

49421

49422 - `account_id: string`

49423

49424 - `signed_principal: string`

49425

49426 The AWS-signed ARN of the IAM principal that requested the token.

49427

49428 - `FederatedActorAzureProvider object`

49429

49430 Asserting party: the Azure subscription the organization is bound to.

49431

49432 - `type: optional "azure"`

49433

49434 default: azure

49435

49436 - `subscription_id: string`

49437

49438 - `FederatedActorGcpProvider object`

49439

49440 Asserting party: the GCP project the organization is bound to.

49441

49442 - `type: optional "gcp"`

49443

49444 default: gcp

49445

49446 - `project_number: string`

49447

49448 - `FederatedActorOidcProvider object`

49449

49450 Asserting party: a customer-registered OIDC federation issuer.

49451

49452 - `type: optional "oidc"`

49453

49454 default: oidc

49455

49456 - `issuer: optional string or null`

49457

49458 The federation issuer's URL. Null when the presented credential failed verification.

49459

49460 - `ip_address: optional string or null`

49461

49462 - `subject: optional string or null`

49463

49464 The provider's verified identifier for the caller; its form depends on the provider.

49465

49466 - `user_agent: optional string or null`

49467

49468 - `AttestedDeviceActor object`

49469

49470 An attested mobile device authenticated via Apple App Attest.

49471

49472 - `type: optional "attested_device_actor"`

49473

49474 default: attested_device_actor

49475

49476 - `external_client_id: string`

49477

49478 - `kid_hash: string`

49479

49480 - `ip_address: optional string or null`

49481

49482 - `user_agent: optional string or null`

49483

49484 - `domain_claim_id: string`

49485

49486 The domain claim that was cancelled, e.g. "dclm_01Ab...".

49487

49488 - `id: optional string`

49489

49490 Unique identifier for the activity e.g. 'activity_abcd1234'

49491

49492 - `created_at: optional string`

49493

49494 When this activity occurred.

49495

49496 format: date-time

49497

49498 - `organization_id: optional string or null`

49499

49500 Organization ID this activity is associated with

49501

49502 - `organization_uuid: optional string or null`

49503

49504 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

49505

49506 - `DomainClaimDeadlineUpdated object`

49507

49508 The migration deadline of a pending domain claim was moved to a later or an earlier date by Anthropic staff or an automated process.

49509

49510 - `type: optional "domain_claim_deadline_updated"`

49511

49512 default: domain_claim_deadline_updated

49513

49514 - `action: "extended" or "shortened" or "unspecified"`

49515

49516 Whether the deadline was extended (moved later) or shortened (moved earlier).

49517

49518 - `"extended"`

49519

49520 - `"shortened"`

49521

49522 - `"unspecified"`

49523

49524 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

49525

49526 - `APIActor object`

49527

49528 - `type: optional "api_actor"`

49529

49530 default: api_actor

49531

49532 - `api_key_id: string`

49533

49534 - `ip_address: string`

49535

49536 - `user_agent: string`

49537

49538 - `UserActor object`

49539

49540 - `type: optional "user_actor"`

49541

49542 default: user_actor

49543

49544 - `email_address: string`

49545

49546 format: email

49547

49548 - `ip_address: string`

49549

49550 - `user_agent: string`

49551

49552 - `user_id: string`

49553

49554 - `UnauthenticatedUserActor object`

49555

49556 - `type: optional "unauthenticated_user_actor"`

49557

49558 default: unauthenticated_user_actor

49559

49560 - `ip_address: string`

49561

49562 - `user_agent: string`

49563

49564 - `unauthenticated_email_address: optional string or null`

49565

49566 format: email

49567

49568 - `AnthropicActor object`

49569

49570 - `type: optional "anthropic_actor"`

49571

49572 default: anthropic_actor

49573

49574 - `email_address: optional string or null`

49575

49576 format: email

49577

49578 - `SystemActor object`

49579

49580 Automated background processing performed by Anthropic systems, acting

49581 without a user or customer credential.

49582

49583 - `type: optional "system_actor"`

49584

49585 default: system_actor

49586

49587 - `service: optional string or null`

49588

49589 Name of the automated process that performed the action, when known.

49590

49591 - `AdminAPIKeyActor object`

49592

49593 - `type: optional "admin_api_key_actor"`

49594

49595 default: admin_api_key_actor

49596

49597 - `admin_api_key_id: string`

49598

49599 - `ip_address: string`

49600

49601 - `user_agent: string`

49602

49603 - `ServiceAccountActor object`

49604

49605 - `type: optional "service_account_actor"`

49606

49607 default: service_account_actor

49608

49609 - `ip_address: string`

49610

49611 - `service_account_id: string`

49612

49613 - `user_agent: string`

49614

49615 - `ScimDirectorySyncActor object`

49616

49617 - `type: optional "scim_directory_sync_actor"`

49618

49619 default: scim_directory_sync_actor

49620

49621 - `directory_id: string`

49622

49623 - `workos_event_id: string`

49624

49625 - `idp_connection_type: optional string or null`

49626

49627 - `FederatedIdentityActor object`

49628

49629 A federated external workload authenticated via a verified OIDC token.

49630

49631 Carries the verified issuer, subject, and audience claims from the

49632 presented JWT.

49633

49634 - `type: optional "federated_identity_actor"`

49635

49636 default: federated_identity_actor

49637

49638 - `issuer: string`

49639

49640 - `subject: string`

49641

49642 - `audience: optional array of string`

49643

49644 - `ip_address: optional string or null`

49645

49646 - `user_agent: optional string or null`

49647

49648 - `FederatedActor object`

49649

49650 An external identity asserted by a trusted provider — a cloud-provider

49651 gateway or a customer-registered federation issuer — acting without an

49652 Anthropic-provisioned account or service account.

49653

49654 - `type: optional "federated_actor"`

49655

49656 default: federated_actor

49657

49658 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

49659

49660 - `FederatedActorAwsProvider object`

49661

49662 Asserting party: the AWS account the organization is bound to.

49663

49664 - `type: optional "aws"`

49665

49666 default: aws

49667

49668 - `account_id: string`

49669

49670 - `signed_principal: string`

49671

49672 The AWS-signed ARN of the IAM principal that requested the token.

49673

49674 - `FederatedActorAzureProvider object`

49675

49676 Asserting party: the Azure subscription the organization is bound to.

49677

49678 - `type: optional "azure"`

49679

49680 default: azure

49681

49682 - `subscription_id: string`

49683

49684 - `FederatedActorGcpProvider object`

49685

49686 Asserting party: the GCP project the organization is bound to.

49687

49688 - `type: optional "gcp"`

49689

49690 default: gcp

49691

49692 - `project_number: string`

49693

49694 - `FederatedActorOidcProvider object`

49695

49696 Asserting party: a customer-registered OIDC federation issuer.

49697

49698 - `type: optional "oidc"`

49699

49700 default: oidc

49701

49702 - `issuer: optional string or null`

49703

49704 The federation issuer's URL. Null when the presented credential failed verification.

49705

49706 - `ip_address: optional string or null`

49707

49708 - `subject: optional string or null`

49709

49710 The provider's verified identifier for the caller; its form depends on the provider.

49711

49712 - `user_agent: optional string or null`

49713

49714 - `AttestedDeviceActor object`

49715

49716 An attested mobile device authenticated via Apple App Attest.

49717

49718 - `type: optional "attested_device_actor"`

49719

49720 default: attested_device_actor

49721

49722 - `external_client_id: string`

49723

49724 - `kid_hash: string`

49725

49726 - `ip_address: optional string or null`

49727

49728 - `user_agent: optional string or null`

49729

49730 - `domain_claim_id: string`

49731

49732 The domain claim whose deadline was moved, e.g. "dclm_01Ab...".

49733

49734 - `id: optional string`

49735

49736 Unique identifier for the activity e.g. 'activity_abcd1234'

49737

49738 - `created_at: optional string`

49739

49740 When this activity occurred.

49741

49742 format: date-time

49743

49744 - `deadline_at: optional string or null`

49745

49746 The deadline after the change.

49747

49748 format: date-time

49749

49750 - `organization_id: optional string or null`

49751

49752 Organization ID this activity is associated with

49753

49754 - `organization_uuid: optional string or null`

49755

49756 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

49757

49758 - `previous_deadline_at: optional string or null`

49759

49760 The deadline before the change.

49761

49762 format: date-time

49763

4759049764 - `DomainClaimInitiated object`

4759149765

4759249766 Domain capture claim initiated over personal accounts on verified domains.

from line 55439

5326555439

5326655440 - `token_fingerprint_sha256: optional string or null`

5326755441

53268 Org-scoped SHA-256 of the submitted token: `sha256(org_uuid || 0x00 || token)`, lowercase-hex-encoded, where `org_uuid` is the organization's UUID as a dashed lowercase string, `0x00` is a single zero byte, and `token` is the submitted value's raw bytes. Per-org correlation only — the same token in two orgs produces distinct fingerprints. Set only when the submitted value carries a known GitHub PAT prefix (a high-entropy token format); unset for all other submissions, including rejected non-PAT input.

55442 Not populated.

5326955443

5327055444 - `GitlabConfigurationCreated object`

5327155445

from line 93273

9109993273

9110093274 - `user_agent: optional string or null`

9110193275

91102 - `updates: array of Name or Capabilities or RedactContent or 104 more`

93276 - `updates: array of Name or Capabilities or RedactContent or 105 more`

9110393277

9110493278 - `Name object`

9110593279

from line 95192

9301895192

9301995193 Setting value immediately before this change. Null means the setting was not set, so its default applied.

9302095194

95195 - `ConnectorRequestsOptedIn object`

95196

95197 The organization's opt-in to connector requests, which lets members ask the organization's owners to add a connector, was changed. The "Let members request connectors" switch sets it the first time it is turned on; turning that switch off, or on again, is recorded as a `disabled_admin_request_types` change (`enable_connector` joins or leaves the list).

95198

95199 - `type: optional "connector_requests_opted_in"`

95200

95201 default: connector_requests_opted_in

95202

95203 - `current_value: optional boolean or null`

95204

95205 Setting value immediately after this change

95206

95207 - `previous_value: optional boolean or null`

95208

95209 Setting value immediately before this change. Null means the organization had never opted in or out.

95210

9302195211 - `id: optional string`

9302295212

9302395213 Unique identifier for the activity e.g. 'activity_abcd1234'

from line 114298

112108114298

112109114299 UUID of the spend limit.

112110114300

114301 - `PlatformTelemetryDestinationAutoDisabled object`

114302

114303 A telemetry destination was disabled automatically after deliveries to it failed, so no telemetry is sent to it until an administrator enables it again.

114304

114305 - `type: optional "platform_telemetry_destination_auto_disabled"`

114306

114307 default: platform_telemetry_destination_auto_disabled

114308

114309 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

114310

114311 - `APIActor object`

114312

114313 - `type: optional "api_actor"`

114314

114315 default: api_actor

114316

114317 - `api_key_id: string`

114318

114319 - `ip_address: string`

114320

114321 - `user_agent: string`

114322

114323 - `UserActor object`

114324

114325 - `type: optional "user_actor"`

114326

114327 default: user_actor

114328

114329 - `email_address: string`

114330

114331 format: email

114332

114333 - `ip_address: string`

114334

114335 - `user_agent: string`

114336

114337 - `user_id: string`

114338

114339 - `UnauthenticatedUserActor object`

114340

114341 - `type: optional "unauthenticated_user_actor"`

114342

114343 default: unauthenticated_user_actor

114344

114345 - `ip_address: string`

114346

114347 - `user_agent: string`

114348

114349 - `unauthenticated_email_address: optional string or null`

114350

114351 format: email

114352

114353 - `AnthropicActor object`

114354

114355 - `type: optional "anthropic_actor"`

114356

114357 default: anthropic_actor

114358

114359 - `email_address: optional string or null`

114360

114361 format: email

114362

114363 - `SystemActor object`

114364

114365 Automated background processing performed by Anthropic systems, acting

114366 without a user or customer credential.

114367

114368 - `type: optional "system_actor"`

114369

114370 default: system_actor

114371

114372 - `service: optional string or null`

114373

114374 Name of the automated process that performed the action, when known.

114375

114376 - `AdminAPIKeyActor object`

114377

114378 - `type: optional "admin_api_key_actor"`

114379

114380 default: admin_api_key_actor

114381

114382 - `admin_api_key_id: string`

114383

114384 - `ip_address: string`

114385

114386 - `user_agent: string`

114387

114388 - `ServiceAccountActor object`

114389

114390 - `type: optional "service_account_actor"`

114391

114392 default: service_account_actor

114393

114394 - `ip_address: string`

114395

114396 - `service_account_id: string`

114397

114398 - `user_agent: string`

114399

114400 - `ScimDirectorySyncActor object`

114401

114402 - `type: optional "scim_directory_sync_actor"`

114403

114404 default: scim_directory_sync_actor

114405

114406 - `directory_id: string`

114407

114408 - `workos_event_id: string`

114409

114410 - `idp_connection_type: optional string or null`

114411

114412 - `FederatedIdentityActor object`

114413

114414 A federated external workload authenticated via a verified OIDC token.

114415

114416 Carries the verified issuer, subject, and audience claims from the

114417 presented JWT.

114418

114419 - `type: optional "federated_identity_actor"`

114420

114421 default: federated_identity_actor

114422

114423 - `issuer: string`

114424

114425 - `subject: string`

114426

114427 - `audience: optional array of string`

114428

114429 - `ip_address: optional string or null`

114430

114431 - `user_agent: optional string or null`

114432

114433 - `FederatedActor object`

114434

114435 An external identity asserted by a trusted provider — a cloud-provider

114436 gateway or a customer-registered federation issuer — acting without an

114437 Anthropic-provisioned account or service account.

114438

114439 - `type: optional "federated_actor"`

114440

114441 default: federated_actor

114442

114443 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

114444

114445 - `FederatedActorAwsProvider object`

114446

114447 Asserting party: the AWS account the organization is bound to.

114448

114449 - `type: optional "aws"`

114450

114451 default: aws

114452

114453 - `account_id: string`

114454

114455 - `signed_principal: string`

114456

114457 The AWS-signed ARN of the IAM principal that requested the token.

114458

114459 - `FederatedActorAzureProvider object`

114460

114461 Asserting party: the Azure subscription the organization is bound to.

114462

114463 - `type: optional "azure"`

114464

114465 default: azure

114466

114467 - `subscription_id: string`

114468

114469 - `FederatedActorGcpProvider object`

114470

114471 Asserting party: the GCP project the organization is bound to.

114472

114473 - `type: optional "gcp"`

114474

114475 default: gcp

114476

114477 - `project_number: string`

114478

114479 - `FederatedActorOidcProvider object`

114480

114481 Asserting party: a customer-registered OIDC federation issuer.

114482

114483 - `type: optional "oidc"`

114484

114485 default: oidc

114486

114487 - `issuer: optional string or null`

114488

114489 The federation issuer's URL. Null when the presented credential failed verification.

114490

114491 - `ip_address: optional string or null`

114492

114493 - `subject: optional string or null`

114494

114495 The provider's verified identifier for the caller; its form depends on the provider.

114496

114497 - `user_agent: optional string or null`

114498

114499 - `AttestedDeviceActor object`

114500

114501 An attested mobile device authenticated via Apple App Attest.

114502

114503 - `type: optional "attested_device_actor"`

114504

114505 default: attested_device_actor

114506

114507 - `external_client_id: string`

114508

114509 - `kid_hash: string`

114510

114511 - `ip_address: optional string or null`

114512

114513 - `user_agent: optional string or null`

114514

114515 - `telemetry_destination_id: string`

114516

114517 Tagged telemetry destination ID, e.g. "tdst_01HX...".

114518

114519 - `trigger: "invalid_address" or "redirect" or "sustained_failure" or "unspecified"`

114520

114521 Why the destination was disabled: deliveries failed for longer than Anthropic allows ("sustained_failure"), they failed that long and the hostname does not resolve to a public address ("invalid_address"), or the endpoint answered with an HTTP redirect ("redirect").

114522

114523 - `"invalid_address"`

114524

114525 - `"redirect"`

114526

114527 - `"sustained_failure"`

114528

114529 - `"unspecified"`

114530

114531 - `id: optional string`

114532

114533 Unique identifier for the activity e.g. 'activity_abcd1234'

114534

114535 - `created_at: optional string`

114536

114537 When this activity occurred.

114538

114539 format: date-time

114540

114541 - `organization_id: optional string or null`

114542

114543 Organization ID this activity is associated with

114544

114545 - `organization_uuid: optional string or null`

114546

114547 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

114548

114549 - `PlatformTelemetryDestinationCreated object`

114550

114551 A telemetry destination was registered for the organization.

114552

114553 - `type: optional "platform_telemetry_destination_created"`

114554

114555 default: platform_telemetry_destination_created

114556

114557 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

114558

114559 - `APIActor object`

114560

114561 - `type: optional "api_actor"`

114562

114563 default: api_actor

114564

114565 - `api_key_id: string`

114566

114567 - `ip_address: string`

114568

114569 - `user_agent: string`

114570

114571 - `UserActor object`

114572

114573 - `type: optional "user_actor"`

114574

114575 default: user_actor

114576

114577 - `email_address: string`

114578

114579 format: email

114580

114581 - `ip_address: string`

114582

114583 - `user_agent: string`

114584

114585 - `user_id: string`

114586

114587 - `UnauthenticatedUserActor object`

114588

114589 - `type: optional "unauthenticated_user_actor"`

114590

114591 default: unauthenticated_user_actor

114592

114593 - `ip_address: string`

114594

114595 - `user_agent: string`

114596

114597 - `unauthenticated_email_address: optional string or null`

114598

114599 format: email

114600

114601 - `AnthropicActor object`

114602

114603 - `type: optional "anthropic_actor"`

114604

114605 default: anthropic_actor

114606

114607 - `email_address: optional string or null`

114608

114609 format: email

114610

114611 - `SystemActor object`

114612

114613 Automated background processing performed by Anthropic systems, acting

114614 without a user or customer credential.

114615

114616 - `type: optional "system_actor"`

114617

114618 default: system_actor

114619

114620 - `service: optional string or null`

114621

114622 Name of the automated process that performed the action, when known.

114623

114624 - `AdminAPIKeyActor object`

114625

114626 - `type: optional "admin_api_key_actor"`

114627

114628 default: admin_api_key_actor

114629

114630 - `admin_api_key_id: string`

114631

114632 - `ip_address: string`

114633

114634 - `user_agent: string`

114635

114636 - `ServiceAccountActor object`

114637

114638 - `type: optional "service_account_actor"`

114639

114640 default: service_account_actor

114641

114642 - `ip_address: string`

114643

114644 - `service_account_id: string`

114645

114646 - `user_agent: string`

114647

114648 - `ScimDirectorySyncActor object`

114649

114650 - `type: optional "scim_directory_sync_actor"`

114651

114652 default: scim_directory_sync_actor

114653

114654 - `directory_id: string`

114655

114656 - `workos_event_id: string`

114657

114658 - `idp_connection_type: optional string or null`

114659

114660 - `FederatedIdentityActor object`

114661

114662 A federated external workload authenticated via a verified OIDC token.

114663

114664 Carries the verified issuer, subject, and audience claims from the

114665 presented JWT.

114666

114667 - `type: optional "federated_identity_actor"`

114668

114669 default: federated_identity_actor

114670

114671 - `issuer: string`

114672

114673 - `subject: string`

114674

114675 - `audience: optional array of string`

114676

114677 - `ip_address: optional string or null`

114678

114679 - `user_agent: optional string or null`

114680

114681 - `FederatedActor object`

114682

114683 An external identity asserted by a trusted provider — a cloud-provider

114684 gateway or a customer-registered federation issuer — acting without an

114685 Anthropic-provisioned account or service account.

114686

114687 - `type: optional "federated_actor"`

114688

114689 default: federated_actor

114690

114691 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

114692

114693 - `FederatedActorAwsProvider object`

114694

114695 Asserting party: the AWS account the organization is bound to.

114696

114697 - `type: optional "aws"`

114698

114699 default: aws

114700

114701 - `account_id: string`

114702

114703 - `signed_principal: string`

114704

114705 The AWS-signed ARN of the IAM principal that requested the token.

114706

114707 - `FederatedActorAzureProvider object`

114708

114709 Asserting party: the Azure subscription the organization is bound to.

114710

114711 - `type: optional "azure"`

114712

114713 default: azure

114714

114715 - `subscription_id: string`

114716

114717 - `FederatedActorGcpProvider object`

114718

114719 Asserting party: the GCP project the organization is bound to.

114720

114721 - `type: optional "gcp"`

114722

114723 default: gcp

114724

114725 - `project_number: string`

114726

114727 - `FederatedActorOidcProvider object`

114728

114729 Asserting party: a customer-registered OIDC federation issuer.

114730

114731 - `type: optional "oidc"`

114732

114733 default: oidc

114734

114735 - `issuer: optional string or null`

114736

114737 The federation issuer's URL. Null when the presented credential failed verification.

114738

114739 - `ip_address: optional string or null`

114740

114741 - `subject: optional string or null`

114742

114743 The provider's verified identifier for the caller; its form depends on the provider.

114744

114745 - `user_agent: optional string or null`

114746

114747 - `AttestedDeviceActor object`

114748

114749 An attested mobile device authenticated via Apple App Attest.

114750

114751 - `type: optional "attested_device_actor"`

114752

114753 default: attested_device_actor

114754

114755 - `external_client_id: string`

114756

114757 - `kid_hash: string`

114758

114759 - `ip_address: optional string or null`

114760

114761 - `user_agent: optional string or null`

114762

114763 - `telemetry_destination_id: string`

114764

114765 Tagged telemetry destination ID, e.g. "tdst_01HX...".

114766

114767 - `id: optional string`

114768

114769 Unique identifier for the activity e.g. 'activity_abcd1234'

114770

114771 - `created_at: optional string`

114772

114773 When this activity occurred.

114774

114775 format: date-time

114776

114777 - `endpoint_url: optional string or null`

114778

114779 The destination's endpoint URL as stored, e.g. "https://collector.example.com/otlp"; the API refuses credentials, query strings and fragments in this URL.

114780

114781 - `organization_id: optional string or null`

114782

114783 Organization ID this activity is associated with

114784

114785 - `organization_uuid: optional string or null`

114786

114787 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

114788

114789 - `traces: optional object or null`

114790

114791 The destination's settings for traces, as the API returns them.

114792

114793 - `content_mode: string`

114794

114795 What the exported spans contain: "metadata_only", or "content" when they also carry message and tool content.

114796

114797 - `enabled: boolean`

114798

114799 Whether the destination receives traces.

114800

114801 - `endpoint_url: optional string or null`

114802

114803 The destination's separate traces URL as stored, e.g. "https://collector.example.com/v2/trace/otlp"; like the endpoint URL it never contains credentials, a query string or a fragment. Omitted when the destination has none; traces then go to the endpoint URL plus "/v1/traces".

114804

114805 - `max_content_bytes: optional number or null`

114806

114807 The most bytes of content that one exported span keeps; omitted when the destination sets no bound and only Anthropic's maximum applies.

114808

114809 - `workspaces: optional object or null`

114810

114811 Which workspaces the destination covers, as the API returns it: its type only, "all", "include" or "exclude". The workspaces put on its list by the same request are recorded as workspace_added activities.

114812

114813 - `type: string`

114814

114815 "all": every workspace of the organization; "include": the workspaces on the destination's list; "exclude": every workspace but those on its list.

114816

114817 - `PlatformTelemetryDestinationDeleted object`

114818

114819 A telemetry destination was deleted.

114820

114821 - `type: optional "platform_telemetry_destination_deleted"`

114822

114823 default: platform_telemetry_destination_deleted

114824

114825 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

114826

114827 - `APIActor object`

114828

114829 - `type: optional "api_actor"`

114830

114831 default: api_actor

114832

114833 - `api_key_id: string`

114834

114835 - `ip_address: string`

114836

114837 - `user_agent: string`

114838

114839 - `UserActor object`

114840

114841 - `type: optional "user_actor"`

114842

114843 default: user_actor

114844

114845 - `email_address: string`

114846

114847 format: email

114848

114849 - `ip_address: string`

114850

114851 - `user_agent: string`

114852

114853 - `user_id: string`

114854

114855 - `UnauthenticatedUserActor object`

114856

114857 - `type: optional "unauthenticated_user_actor"`

114858

114859 default: unauthenticated_user_actor

114860

114861 - `ip_address: string`

114862

114863 - `user_agent: string`

114864

114865 - `unauthenticated_email_address: optional string or null`

114866

114867 format: email

114868

114869 - `AnthropicActor object`

114870

114871 - `type: optional "anthropic_actor"`

114872

114873 default: anthropic_actor

114874

114875 - `email_address: optional string or null`

114876

114877 format: email

114878

114879 - `SystemActor object`

114880

114881 Automated background processing performed by Anthropic systems, acting

114882 without a user or customer credential.

114883

114884 - `type: optional "system_actor"`

114885

114886 default: system_actor

114887

114888 - `service: optional string or null`

114889

114890 Name of the automated process that performed the action, when known.

114891

114892 - `AdminAPIKeyActor object`

114893

114894 - `type: optional "admin_api_key_actor"`

114895

114896 default: admin_api_key_actor

114897

114898 - `admin_api_key_id: string`

114899

114900 - `ip_address: string`

114901

114902 - `user_agent: string`

114903

114904 - `ServiceAccountActor object`

114905

114906 - `type: optional "service_account_actor"`

114907

114908 default: service_account_actor

114909

114910 - `ip_address: string`

114911

114912 - `service_account_id: string`

114913

114914 - `user_agent: string`

114915

114916 - `ScimDirectorySyncActor object`

114917

114918 - `type: optional "scim_directory_sync_actor"`

114919

114920 default: scim_directory_sync_actor

114921

114922 - `directory_id: string`

114923

114924 - `workos_event_id: string`

114925

114926 - `idp_connection_type: optional string or null`

114927

114928 - `FederatedIdentityActor object`

114929

114930 A federated external workload authenticated via a verified OIDC token.

114931

114932 Carries the verified issuer, subject, and audience claims from the

114933 presented JWT.

114934

114935 - `type: optional "federated_identity_actor"`

114936

114937 default: federated_identity_actor

114938

114939 - `issuer: string`

114940

114941 - `subject: string`

114942

114943 - `audience: optional array of string`

114944

114945 - `ip_address: optional string or null`

114946

114947 - `user_agent: optional string or null`

114948

114949 - `FederatedActor object`

114950

114951 An external identity asserted by a trusted provider — a cloud-provider

114952 gateway or a customer-registered federation issuer — acting without an

114953 Anthropic-provisioned account or service account.

114954

114955 - `type: optional "federated_actor"`

114956

114957 default: federated_actor

114958

114959 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

114960

114961 - `FederatedActorAwsProvider object`

114962

114963 Asserting party: the AWS account the organization is bound to.

114964

114965 - `type: optional "aws"`

114966

114967 default: aws

114968

114969 - `account_id: string`

114970

114971 - `signed_principal: string`

114972

114973 The AWS-signed ARN of the IAM principal that requested the token.

114974

114975 - `FederatedActorAzureProvider object`

114976

114977 Asserting party: the Azure subscription the organization is bound to.

114978

114979 - `type: optional "azure"`

114980

114981 default: azure

114982

114983 - `subscription_id: string`

114984

114985 - `FederatedActorGcpProvider object`

114986

114987 Asserting party: the GCP project the organization is bound to.

114988

114989 - `type: optional "gcp"`

114990

114991 default: gcp

114992

114993 - `project_number: string`

114994

114995 - `FederatedActorOidcProvider object`

114996

114997 Asserting party: a customer-registered OIDC federation issuer.

114998

114999 - `type: optional "oidc"`

115000

115001 default: oidc

115002

115003 - `issuer: optional string or null`

115004

115005 The federation issuer's URL. Null when the presented credential failed verification.

115006

115007 - `ip_address: optional string or null`

115008

115009 - `subject: optional string or null`

115010

115011 The provider's verified identifier for the caller; its form depends on the provider.

115012

115013 - `user_agent: optional string or null`

115014

115015 - `AttestedDeviceActor object`

115016

115017 An attested mobile device authenticated via Apple App Attest.

115018

115019 - `type: optional "attested_device_actor"`

115020

115021 default: attested_device_actor

115022

115023 - `external_client_id: string`

115024

115025 - `kid_hash: string`

115026

115027 - `ip_address: optional string or null`

115028

115029 - `user_agent: optional string or null`

115030

115031 - `telemetry_destination_id: string`

115032

115033 Tagged telemetry destination ID, e.g. "tdst_01HX...".

115034

115035 - `id: optional string`

115036

115037 Unique identifier for the activity e.g. 'activity_abcd1234'

115038

115039 - `created_at: optional string`

115040

115041 When this activity occurred.

115042

115043 format: date-time

115044

115045 - `organization_id: optional string or null`

115046

115047 Organization ID this activity is associated with

115048

115049 - `organization_uuid: optional string or null`

115050

115051 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

115052

115053 - `PlatformTelemetryDestinationUpdated object`

115054

115055 A telemetry destination's configuration was updated. State changes and changes of its workspace scope (the type, or the list through an update's workspace_ids) are included; the workspaces an update took off or put on the list are also recorded as workspace_removed and workspace_added activities. Previous and current values are recorded only for the endpoint URL, the traces URL, the content mode and the workspaces type.

115056

115057 - `type: optional "platform_telemetry_destination_updated"`

115058

115059 default: platform_telemetry_destination_updated

115060

115061 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

115062

115063 - `APIActor object`

115064

115065 - `type: optional "api_actor"`

115066

115067 default: api_actor

115068

115069 - `api_key_id: string`

115070

115071 - `ip_address: string`

115072

115073 - `user_agent: string`

115074

115075 - `UserActor object`

115076

115077 - `type: optional "user_actor"`

115078

115079 default: user_actor

115080

115081 - `email_address: string`

115082

115083 format: email

115084

115085 - `ip_address: string`

115086

115087 - `user_agent: string`

115088

115089 - `user_id: string`

115090

115091 - `UnauthenticatedUserActor object`

115092

115093 - `type: optional "unauthenticated_user_actor"`

115094

115095 default: unauthenticated_user_actor

115096

115097 - `ip_address: string`

115098

115099 - `user_agent: string`

115100

115101 - `unauthenticated_email_address: optional string or null`

115102

115103 format: email

115104

115105 - `AnthropicActor object`

115106

115107 - `type: optional "anthropic_actor"`

115108

115109 default: anthropic_actor

115110

115111 - `email_address: optional string or null`

115112

115113 format: email

115114

115115 - `SystemActor object`

115116

115117 Automated background processing performed by Anthropic systems, acting

115118 without a user or customer credential.

115119

115120 - `type: optional "system_actor"`

115121

115122 default: system_actor

115123

115124 - `service: optional string or null`

115125

115126 Name of the automated process that performed the action, when known.

115127

115128 - `AdminAPIKeyActor object`

115129

115130 - `type: optional "admin_api_key_actor"`

115131

115132 default: admin_api_key_actor

115133

115134 - `admin_api_key_id: string`

115135

115136 - `ip_address: string`

115137

115138 - `user_agent: string`

115139

115140 - `ServiceAccountActor object`

115141

115142 - `type: optional "service_account_actor"`

115143

115144 default: service_account_actor

115145

115146 - `ip_address: string`

115147

115148 - `service_account_id: string`

115149

115150 - `user_agent: string`

115151

115152 - `ScimDirectorySyncActor object`

115153

115154 - `type: optional "scim_directory_sync_actor"`

115155

115156 default: scim_directory_sync_actor

115157

115158 - `directory_id: string`

115159

115160 - `workos_event_id: string`

115161

115162 - `idp_connection_type: optional string or null`

115163

115164 - `FederatedIdentityActor object`

115165

115166 A federated external workload authenticated via a verified OIDC token.

115167

115168 Carries the verified issuer, subject, and audience claims from the

115169 presented JWT.

115170

115171 - `type: optional "federated_identity_actor"`

115172

115173 default: federated_identity_actor

115174

115175 - `issuer: string`

115176

115177 - `subject: string`

115178

115179 - `audience: optional array of string`

115180

115181 - `ip_address: optional string or null`

115182

115183 - `user_agent: optional string or null`

115184

115185 - `FederatedActor object`

115186

115187 An external identity asserted by a trusted provider — a cloud-provider

115188 gateway or a customer-registered federation issuer — acting without an

115189 Anthropic-provisioned account or service account.

115190

115191 - `type: optional "federated_actor"`

115192

115193 default: federated_actor

115194

115195 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

115196

115197 - `FederatedActorAwsProvider object`

115198

115199 Asserting party: the AWS account the organization is bound to.

115200

115201 - `type: optional "aws"`

115202

115203 default: aws

115204

115205 - `account_id: string`

115206

115207 - `signed_principal: string`

115208

115209 The AWS-signed ARN of the IAM principal that requested the token.

115210

115211 - `FederatedActorAzureProvider object`

115212

115213 Asserting party: the Azure subscription the organization is bound to.

115214

115215 - `type: optional "azure"`

115216

115217 default: azure

115218

115219 - `subscription_id: string`

115220

115221 - `FederatedActorGcpProvider object`

115222

115223 Asserting party: the GCP project the organization is bound to.

115224

115225 - `type: optional "gcp"`

115226

115227 default: gcp

115228

115229 - `project_number: string`

115230

115231 - `FederatedActorOidcProvider object`

115232

115233 Asserting party: a customer-registered OIDC federation issuer.

115234

115235 - `type: optional "oidc"`

115236

115237 default: oidc

115238

115239 - `issuer: optional string or null`

115240

115241 The federation issuer's URL. Null when the presented credential failed verification.

115242

115243 - `ip_address: optional string or null`

115244

115245 - `subject: optional string or null`

115246

115247 The provider's verified identifier for the caller; its form depends on the provider.

115248

115249 - `user_agent: optional string or null`

115250

115251 - `AttestedDeviceActor object`

115252

115253 An attested mobile device authenticated via Apple App Attest.

115254

115255 - `type: optional "attested_device_actor"`

115256

115257 default: attested_device_actor

115258

115259 - `external_client_id: string`

115260

115261 - `kid_hash: string`

115262

115263 - `ip_address: optional string or null`

115264

115265 - `user_agent: optional string or null`

115266

115267 - `telemetry_destination_id: string`

115268

115269 Tagged telemetry destination ID, e.g. "tdst_01HX...".

115270

115271 - `id: optional string`

115272

115273 Unique identifier for the activity e.g. 'activity_abcd1234'

115274

115275 - `created_at: optional string`

115276

115277 When this activity occurred.

115278

115279 format: date-time

115280

115281 - `organization_id: optional string or null`

115282

115283 Organization ID this activity is associated with

115284

115285 - `organization_uuid: optional string or null`

115286

115287 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

115288

115289 - `updated_fields: optional array of string`

115290

115291 Names of the configuration fields whose value changed, e.g. "endpoint_url", "headers", "state"; "traces" when any setting for traces changed. Header names and values are never included.

115292

115293 - `updates: optional array of object`

115294

115295 The field-level value changes in this update, in this order: an "endpoint_url" entry when the endpoint URL changed, a "traces_endpoint_url" entry when the traces URL changed, a "traces_content_mode" entry when the content mode changed, and a "workspaces" entry ("all", "include" or "exclude") when the workspaces type changed; empty otherwise.

115296

115297 - `type: "endpoint_url" or "traces_content_mode" or "traces_endpoint_url" or 2 more`

115298

115299 The destination field that changed

115300

115301 - `"endpoint_url"`

115302

115303 - `"traces_content_mode"`

115304

115305 - `"traces_endpoint_url"`

115306

115307 - `"unspecified"`

115308

115309 - `"workspaces"`

115310

115311 - `current_value: string`

115312

115313 Field value immediately after this change

115314

115315 - `previous_value: string`

115316

115317 Field value immediately before this change

115318

115319 - `PlatformTelemetryDestinationWorkspaceAdded object`

115320

115321 A workspace was added to the workspace list of a telemetry destination. When the list type is "include", the destination starts to receive the spans of that workspace; when it is "exclude", the destination stops receiving them.

115322

115323 - `type: optional "platform_telemetry_destination_workspace_added"`

115324

115325 default: platform_telemetry_destination_workspace_added

115326

115327 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

115328

115329 - `APIActor object`

115330

115331 - `type: optional "api_actor"`

115332

115333 default: api_actor

115334

115335 - `api_key_id: string`

115336

115337 - `ip_address: string`

115338

115339 - `user_agent: string`

115340

115341 - `UserActor object`

115342

115343 - `type: optional "user_actor"`

115344

115345 default: user_actor

115346

115347 - `email_address: string`

115348

115349 format: email

115350

115351 - `ip_address: string`

115352

115353 - `user_agent: string`

115354

115355 - `user_id: string`

115356

115357 - `UnauthenticatedUserActor object`

115358

115359 - `type: optional "unauthenticated_user_actor"`

115360

115361 default: unauthenticated_user_actor

115362

115363 - `ip_address: string`

115364

115365 - `user_agent: string`

115366

115367 - `unauthenticated_email_address: optional string or null`

115368

115369 format: email

115370

115371 - `AnthropicActor object`

115372

115373 - `type: optional "anthropic_actor"`

115374

115375 default: anthropic_actor

115376

115377 - `email_address: optional string or null`

115378

115379 format: email

115380

115381 - `SystemActor object`

115382

115383 Automated background processing performed by Anthropic systems, acting

115384 without a user or customer credential.

115385

115386 - `type: optional "system_actor"`

115387

115388 default: system_actor

115389

115390 - `service: optional string or null`

115391

115392 Name of the automated process that performed the action, when known.

115393

115394 - `AdminAPIKeyActor object`

115395

115396 - `type: optional "admin_api_key_actor"`

115397

115398 default: admin_api_key_actor

115399

115400 - `admin_api_key_id: string`

115401

115402 - `ip_address: string`

115403

115404 - `user_agent: string`

115405

115406 - `ServiceAccountActor object`

115407

115408 - `type: optional "service_account_actor"`

115409

115410 default: service_account_actor

115411

115412 - `ip_address: string`

115413

115414 - `service_account_id: string`

115415

115416 - `user_agent: string`

115417

115418 - `ScimDirectorySyncActor object`

115419

115420 - `type: optional "scim_directory_sync_actor"`

115421

115422 default: scim_directory_sync_actor

115423

115424 - `directory_id: string`

115425

115426 - `workos_event_id: string`

115427

115428 - `idp_connection_type: optional string or null`

115429

115430 - `FederatedIdentityActor object`

115431

115432 A federated external workload authenticated via a verified OIDC token.

115433

115434 Carries the verified issuer, subject, and audience claims from the

115435 presented JWT.

115436

115437 - `type: optional "federated_identity_actor"`

115438

115439 default: federated_identity_actor

115440

115441 - `issuer: string`

115442

115443 - `subject: string`

115444

115445 - `audience: optional array of string`

115446

115447 - `ip_address: optional string or null`

115448

115449 - `user_agent: optional string or null`

115450

115451 - `FederatedActor object`

115452

115453 An external identity asserted by a trusted provider — a cloud-provider

115454 gateway or a customer-registered federation issuer — acting without an

115455 Anthropic-provisioned account or service account.

115456

115457 - `type: optional "federated_actor"`

115458

115459 default: federated_actor

115460

115461 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

115462

115463 - `FederatedActorAwsProvider object`

115464

115465 Asserting party: the AWS account the organization is bound to.

115466

115467 - `type: optional "aws"`

115468

115469 default: aws

115470

115471 - `account_id: string`

115472

115473 - `signed_principal: string`

115474

115475 The AWS-signed ARN of the IAM principal that requested the token.

115476

115477 - `FederatedActorAzureProvider object`

115478

115479 Asserting party: the Azure subscription the organization is bound to.

115480

115481 - `type: optional "azure"`

115482

115483 default: azure

115484

115485 - `subscription_id: string`

115486

115487 - `FederatedActorGcpProvider object`

115488

115489 Asserting party: the GCP project the organization is bound to.

115490

115491 - `type: optional "gcp"`

115492

115493 default: gcp

115494

115495 - `project_number: string`

115496

115497 - `FederatedActorOidcProvider object`

115498

115499 Asserting party: a customer-registered OIDC federation issuer.

115500

115501 - `type: optional "oidc"`

115502

115503 default: oidc

115504

115505 - `issuer: optional string or null`

115506

115507 The federation issuer's URL. Null when the presented credential failed verification.

115508

115509 - `ip_address: optional string or null`

115510

115511 - `subject: optional string or null`

115512

115513 The provider's verified identifier for the caller; its form depends on the provider.

115514

115515 - `user_agent: optional string or null`

115516

115517 - `AttestedDeviceActor object`

115518

115519 An attested mobile device authenticated via Apple App Attest.

115520

115521 - `type: optional "attested_device_actor"`

115522

115523 default: attested_device_actor

115524

115525 - `external_client_id: string`

115526

115527 - `kid_hash: string`

115528

115529 - `ip_address: optional string or null`

115530

115531 - `user_agent: optional string or null`

115532

115533 - `telemetry_destination_id: string`

115534

115535 Tagged telemetry destination ID, e.g. "tdst_01HX...".

115536

115537 - `workspace_id: string`

115538

115539 Tagged ID of the workspace put on the list, e.g. "wrkspc_01HX...".

115540

115541 - `id: optional string`

115542

115543 Unique identifier for the activity e.g. 'activity_abcd1234'

115544

115545 - `created_at: optional string`

115546

115547 When this activity occurred.

115548

115549 format: date-time

115550

115551 - `organization_id: optional string or null`

115552

115553 Organization ID this activity is associated with

115554

115555 - `organization_uuid: optional string or null`

115556

115557 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

115558

115559 - `PlatformTelemetryDestinationWorkspaceRemoved object`

115560

115561 A workspace was removed from the workspace list of a telemetry destination, by a change to the list or because the destination was deleted. When the list type is "include", the destination stops receiving the spans of that workspace; when it is "exclude", the destination receives them again unless the destination was deleted.

115562

115563 - `type: optional "platform_telemetry_destination_workspace_removed"`

115564

115565 default: platform_telemetry_destination_workspace_removed

115566

115567 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

115568

115569 - `APIActor object`

115570

115571 - `type: optional "api_actor"`

115572

115573 default: api_actor

115574

115575 - `api_key_id: string`

115576

115577 - `ip_address: string`

115578

115579 - `user_agent: string`

115580

115581 - `UserActor object`

115582

115583 - `type: optional "user_actor"`

115584

115585 default: user_actor

115586

115587 - `email_address: string`

115588

115589 format: email

115590

115591 - `ip_address: string`

115592

115593 - `user_agent: string`

115594

115595 - `user_id: string`

115596

115597 - `UnauthenticatedUserActor object`

115598

115599 - `type: optional "unauthenticated_user_actor"`

115600

115601 default: unauthenticated_user_actor

115602

115603 - `ip_address: string`

115604

115605 - `user_agent: string`

115606

115607 - `unauthenticated_email_address: optional string or null`

115608

115609 format: email

115610

115611 - `AnthropicActor object`

115612

115613 - `type: optional "anthropic_actor"`

115614

115615 default: anthropic_actor

115616

115617 - `email_address: optional string or null`

115618

115619 format: email

115620

115621 - `SystemActor object`

115622

115623 Automated background processing performed by Anthropic systems, acting

115624 without a user or customer credential.

115625

115626 - `type: optional "system_actor"`

115627

115628 default: system_actor

115629

115630 - `service: optional string or null`

115631

115632 Name of the automated process that performed the action, when known.

115633

115634 - `AdminAPIKeyActor object`

115635

115636 - `type: optional "admin_api_key_actor"`

115637

115638 default: admin_api_key_actor

115639

115640 - `admin_api_key_id: string`

115641

115642 - `ip_address: string`

115643

115644 - `user_agent: string`

115645

115646 - `ServiceAccountActor object`

115647

115648 - `type: optional "service_account_actor"`

115649

115650 default: service_account_actor

115651

115652 - `ip_address: string`

115653

115654 - `service_account_id: string`

115655

115656 - `user_agent: string`

115657

115658 - `ScimDirectorySyncActor object`

115659

115660 - `type: optional "scim_directory_sync_actor"`

115661

115662 default: scim_directory_sync_actor

115663

115664 - `directory_id: string`

115665

115666 - `workos_event_id: string`

115667

115668 - `idp_connection_type: optional string or null`

115669

115670 - `FederatedIdentityActor object`

115671

115672 A federated external workload authenticated via a verified OIDC token.

115673

115674 Carries the verified issuer, subject, and audience claims from the

115675 presented JWT.

115676

115677 - `type: optional "federated_identity_actor"`

115678

115679 default: federated_identity_actor

115680

115681 - `issuer: string`

115682

115683 - `subject: string`

115684

115685 - `audience: optional array of string`

115686

115687 - `ip_address: optional string or null`

115688

115689 - `user_agent: optional string or null`

115690

115691 - `FederatedActor object`

115692

115693 An external identity asserted by a trusted provider — a cloud-provider

115694 gateway or a customer-registered federation issuer — acting without an

115695 Anthropic-provisioned account or service account.

115696

115697 - `type: optional "federated_actor"`

115698

115699 default: federated_actor

115700

115701 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

115702

115703 - `FederatedActorAwsProvider object`

115704

115705 Asserting party: the AWS account the organization is bound to.

115706

115707 - `type: optional "aws"`

115708

115709 default: aws

115710

115711 - `account_id: string`

115712

115713 - `signed_principal: string`

115714

115715 The AWS-signed ARN of the IAM principal that requested the token.

115716

115717 - `FederatedActorAzureProvider object`

115718

115719 Asserting party: the Azure subscription the organization is bound to.

115720

115721 - `type: optional "azure"`

115722

115723 default: azure

115724

115725 - `subscription_id: string`

115726

115727 - `FederatedActorGcpProvider object`

115728

115729 Asserting party: the GCP project the organization is bound to.

115730

115731 - `type: optional "gcp"`

115732

115733 default: gcp

115734

115735 - `project_number: string`

115736

115737 - `FederatedActorOidcProvider object`

115738

115739 Asserting party: a customer-registered OIDC federation issuer.

115740

115741 - `type: optional "oidc"`

115742

115743 default: oidc

115744

115745 - `issuer: optional string or null`

115746

115747 The federation issuer's URL. Null when the presented credential failed verification.

115748

115749 - `ip_address: optional string or null`

115750

115751 - `subject: optional string or null`

115752

115753 The provider's verified identifier for the caller; its form depends on the provider.

115754

115755 - `user_agent: optional string or null`

115756

115757 - `AttestedDeviceActor object`

115758

115759 An attested mobile device authenticated via Apple App Attest.

115760

115761 - `type: optional "attested_device_actor"`

115762

115763 default: attested_device_actor

115764

115765 - `external_client_id: string`

115766

115767 - `kid_hash: string`

115768

115769 - `ip_address: optional string or null`

115770

115771 - `user_agent: optional string or null`

115772

115773 - `telemetry_destination_id: string`

115774

115775 Tagged telemetry destination ID, e.g. "tdst_01HX...".

115776

115777 - `workspace_id: string`

115778

115779 Tagged ID of the workspace taken off the list, e.g. "wrkspc_01HX...".

115780

115781 - `id: optional string`

115782

115783 Unique identifier for the activity e.g. 'activity_abcd1234'

115784

115785 - `created_at: optional string`

115786

115787 When this activity occurred.

115788

115789 format: date-time

115790

115791 - `organization_id: optional string or null`

115792

115793 Organization ID this activity is associated with

115794

115795 - `organization_uuid: optional string or null`

115796

115797 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

115798

112111115799 - `PlatformUsageReportClaudeCodeViewed object`

112112115800

112113115801 The Claude Code usage report was viewed.

from line 144544

140856144544

140857144545### Activity List Response

140858144546

140859- `ActivityListResponse = AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 544 more`

144547- `ActivityListResponse = AbuseDecisionReceived or AccountDeleted or AccountMigrationCompleted or 558 more`

140860144548

140861144549 - `AbuseDecisionReceived object`

140862144550

from line 145022

141334145022

141335145023 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

141336145024

145025 - `AccountMigrationCompleted object`

145026

145027 A personal Claude account's migration into the organization finished: the migrated data is now part of the organization.

145028

145029 - `type: optional "account_migration_completed"`

145030

145031 default: account_migration_completed

145032

145033 - `account_migration_id: string`

145034

145035 Tagged ID of the migration, e.g. "amig_...", matching the account_migration_started activity that opened it.

145036

145037 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

145038

145039 - `APIActor object`

145040

145041 - `type: optional "api_actor"`

145042

145043 default: api_actor

145044

145045 - `api_key_id: string`

145046

145047 - `ip_address: string`

145048

145049 - `user_agent: string`

145050

145051 - `UserActor object`

145052

145053 - `type: optional "user_actor"`

145054

145055 default: user_actor

145056

145057 - `email_address: string`

145058

145059 format: email

145060

145061 - `ip_address: string`

145062

145063 - `user_agent: string`

145064

145065 - `user_id: string`

145066

145067 - `UnauthenticatedUserActor object`

145068

145069 - `type: optional "unauthenticated_user_actor"`

145070

145071 default: unauthenticated_user_actor

145072

145073 - `ip_address: string`

145074

145075 - `user_agent: string`

145076

145077 - `unauthenticated_email_address: optional string or null`

145078

145079 format: email

145080

145081 - `AnthropicActor object`

145082

145083 - `type: optional "anthropic_actor"`

145084

145085 default: anthropic_actor

145086

145087 - `email_address: optional string or null`

145088

145089 format: email

145090

145091 - `SystemActor object`

145092

145093 Automated background processing performed by Anthropic systems, acting

145094 without a user or customer credential.

145095

145096 - `type: optional "system_actor"`

145097

145098 default: system_actor

145099

145100 - `service: optional string or null`

145101

145102 Name of the automated process that performed the action, when known.

145103

145104 - `AdminAPIKeyActor object`

145105

145106 - `type: optional "admin_api_key_actor"`

145107

145108 default: admin_api_key_actor

145109

145110 - `admin_api_key_id: string`

145111

145112 - `ip_address: string`

145113

145114 - `user_agent: string`

145115

145116 - `ServiceAccountActor object`

145117

145118 - `type: optional "service_account_actor"`

145119

145120 default: service_account_actor

145121

145122 - `ip_address: string`

145123

145124 - `service_account_id: string`

145125

145126 - `user_agent: string`

145127

145128 - `ScimDirectorySyncActor object`

145129

145130 - `type: optional "scim_directory_sync_actor"`

145131

145132 default: scim_directory_sync_actor

145133

145134 - `directory_id: string`

145135

145136 - `workos_event_id: string`

145137

145138 - `idp_connection_type: optional string or null`

145139

145140 - `FederatedIdentityActor object`

145141

145142 A federated external workload authenticated via a verified OIDC token.

145143

145144 Carries the verified issuer, subject, and audience claims from the

145145 presented JWT.

145146

145147 - `type: optional "federated_identity_actor"`

145148

145149 default: federated_identity_actor

145150

145151 - `issuer: string`

145152

145153 - `subject: string`

145154

145155 - `audience: optional array of string`

145156

145157 - `ip_address: optional string or null`

145158

145159 - `user_agent: optional string or null`

145160

145161 - `FederatedActor object`

145162

145163 An external identity asserted by a trusted provider — a cloud-provider

145164 gateway or a customer-registered federation issuer — acting without an

145165 Anthropic-provisioned account or service account.

145166

145167 - `type: optional "federated_actor"`

145168

145169 default: federated_actor

145170

145171 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

145172

145173 - `FederatedActorAwsProvider object`

145174

145175 Asserting party: the AWS account the organization is bound to.

145176

145177 - `type: optional "aws"`

145178

145179 default: aws

145180

145181 - `account_id: string`

145182

145183 - `signed_principal: string`

145184

145185 The AWS-signed ARN of the IAM principal that requested the token.

145186

145187 - `FederatedActorAzureProvider object`

145188

145189 Asserting party: the Azure subscription the organization is bound to.

145190

145191 - `type: optional "azure"`

145192

145193 default: azure

145194

145195 - `subscription_id: string`

145196

145197 - `FederatedActorGcpProvider object`

145198

145199 Asserting party: the GCP project the organization is bound to.

145200

145201 - `type: optional "gcp"`

145202

145203 default: gcp

145204

145205 - `project_number: string`

145206

145207 - `FederatedActorOidcProvider object`

145208

145209 Asserting party: a customer-registered OIDC federation issuer.

145210

145211 - `type: optional "oidc"`

145212

145213 default: oidc

145214

145215 - `issuer: optional string or null`

145216

145217 The federation issuer's URL. Null when the presented credential failed verification.

145218

145219 - `ip_address: optional string or null`

145220

145221 - `subject: optional string or null`

145222

145223 The provider's verified identifier for the caller; its form depends on the provider.

145224

145225 - `user_agent: optional string or null`

145226

145227 - `AttestedDeviceActor object`

145228

145229 An attested mobile device authenticated via Apple App Attest.

145230

145231 - `type: optional "attested_device_actor"`

145232

145233 default: attested_device_actor

145234

145235 - `external_client_id: string`

145236

145237 - `kid_hash: string`

145238

145239 - `ip_address: optional string or null`

145240

145241 - `user_agent: optional string or null`

145242

145243 - `id: optional string`

145244

145245 Unique identifier for the activity e.g. 'activity_abcd1234'

145246

145247 - `created_at: optional string`

145248

145249 When this activity occurred.

145250

145251 format: date-time

145252

145253 - `migrated_user_email: optional string or null`

145254

145255 Email address of the user whose personal account was migrated, when known.

145256

145257 - `migrated_user_id: optional string or null`

145258

145259 Tagged ID of the user whose personal account was migrated, e.g. "user_...", when known.

145260

145261 - `organization_id: optional string or null`

145262

145263 Organization ID this activity is associated with

145264

145265 - `organization_uuid: optional string or null`

145266

145267 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

145268

145269 - `AccountMigrationFailed object`

145270

145271 A personal Claude account's migration into the organization did not complete.

145272

145273 - `type: optional "account_migration_failed"`

145274

145275 default: account_migration_failed

145276

145277 - `account_migration_id: string`

145278

145279 Tagged ID of the migration, e.g. "amig_...", matching the account_migration_started activity that opened it, if one was recorded; a later retry is a new migration with its own ID.

145280

145281 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

145282

145283 - `APIActor object`

145284

145285 - `type: optional "api_actor"`

145286

145287 default: api_actor

145288

145289 - `api_key_id: string`

145290

145291 - `ip_address: string`

145292

145293 - `user_agent: string`

145294

145295 - `UserActor object`

145296

145297 - `type: optional "user_actor"`

145298

145299 default: user_actor

145300

145301 - `email_address: string`

145302

145303 format: email

145304

145305 - `ip_address: string`

145306

145307 - `user_agent: string`

145308

145309 - `user_id: string`

145310

145311 - `UnauthenticatedUserActor object`

145312

145313 - `type: optional "unauthenticated_user_actor"`

145314

145315 default: unauthenticated_user_actor

145316

145317 - `ip_address: string`

145318

145319 - `user_agent: string`

145320

145321 - `unauthenticated_email_address: optional string or null`

145322

145323 format: email

145324

145325 - `AnthropicActor object`

145326

145327 - `type: optional "anthropic_actor"`

145328

145329 default: anthropic_actor

145330

145331 - `email_address: optional string or null`

145332

145333 format: email

145334

145335 - `SystemActor object`

145336

145337 Automated background processing performed by Anthropic systems, acting

145338 without a user or customer credential.

145339

145340 - `type: optional "system_actor"`

145341

145342 default: system_actor

145343

145344 - `service: optional string or null`

145345

145346 Name of the automated process that performed the action, when known.

145347

145348 - `AdminAPIKeyActor object`

145349

145350 - `type: optional "admin_api_key_actor"`

145351

145352 default: admin_api_key_actor

145353

145354 - `admin_api_key_id: string`

145355

145356 - `ip_address: string`

145357

145358 - `user_agent: string`

145359

145360 - `ServiceAccountActor object`

145361

145362 - `type: optional "service_account_actor"`

145363

145364 default: service_account_actor

145365

145366 - `ip_address: string`

145367

145368 - `service_account_id: string`

145369

145370 - `user_agent: string`

145371

145372 - `ScimDirectorySyncActor object`

145373

145374 - `type: optional "scim_directory_sync_actor"`

145375

145376 default: scim_directory_sync_actor

145377

145378 - `directory_id: string`

145379

145380 - `workos_event_id: string`

145381

145382 - `idp_connection_type: optional string or null`

145383

145384 - `FederatedIdentityActor object`

145385

145386 A federated external workload authenticated via a verified OIDC token.

145387

145388 Carries the verified issuer, subject, and audience claims from the

145389 presented JWT.

145390

145391 - `type: optional "federated_identity_actor"`

145392

145393 default: federated_identity_actor

145394

145395 - `issuer: string`

145396

145397 - `subject: string`

145398

145399 - `audience: optional array of string`

145400

145401 - `ip_address: optional string or null`

145402

145403 - `user_agent: optional string or null`

145404

145405 - `FederatedActor object`

145406

145407 An external identity asserted by a trusted provider — a cloud-provider

145408 gateway or a customer-registered federation issuer — acting without an

145409 Anthropic-provisioned account or service account.

145410

145411 - `type: optional "federated_actor"`

145412

145413 default: federated_actor

145414

145415 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

145416

145417 - `FederatedActorAwsProvider object`

145418

145419 Asserting party: the AWS account the organization is bound to.

145420

145421 - `type: optional "aws"`

145422

145423 default: aws

145424

145425 - `account_id: string`

145426

145427 - `signed_principal: string`

145428

145429 The AWS-signed ARN of the IAM principal that requested the token.

145430

145431 - `FederatedActorAzureProvider object`

145432

145433 Asserting party: the Azure subscription the organization is bound to.

145434

145435 - `type: optional "azure"`

145436

145437 default: azure

145438

145439 - `subscription_id: string`

145440

145441 - `FederatedActorGcpProvider object`

145442

145443 Asserting party: the GCP project the organization is bound to.

145444

145445 - `type: optional "gcp"`

145446

145447 default: gcp

145448

145449 - `project_number: string`

145450

145451 - `FederatedActorOidcProvider object`

145452

145453 Asserting party: a customer-registered OIDC federation issuer.

145454

145455 - `type: optional "oidc"`

145456

145457 default: oidc

145458

145459 - `issuer: optional string or null`

145460

145461 The federation issuer's URL. Null when the presented credential failed verification.

145462

145463 - `ip_address: optional string or null`

145464

145465 - `subject: optional string or null`

145466

145467 The provider's verified identifier for the caller; its form depends on the provider.

145468

145469 - `user_agent: optional string or null`

145470

145471 - `AttestedDeviceActor object`

145472

145473 An attested mobile device authenticated via Apple App Attest.

145474

145475 - `type: optional "attested_device_actor"`

145476

145477 default: attested_device_actor

145478

145479 - `external_client_id: string`

145480

145481 - `kid_hash: string`

145482

145483 - `ip_address: optional string or null`

145484

145485 - `user_agent: optional string or null`

145486

145487 - `id: optional string`

145488

145489 Unique identifier for the activity e.g. 'activity_abcd1234'

145490

145491 - `created_at: optional string`

145492

145493 When this activity occurred.

145494

145495 format: date-time

145496

145497 - `failure_reasons: optional array of "already_member_of_target" or "already_migrating" or "anthropic_staff_action" or 12 more`

145498

145499 Why the migration did not complete, each reason listed once. In these values "source" is the member's personal account and "target" is this organization. "source_equals_target", "source_not_personal_org", "user_not_member_of_source" and "user_not_sole_member_of_source": the account is not a single-member personal account that can be migrated. "target_not_enterprise_org": this organization's plan does not accept the migration. "already_member_of_target": the migration already happened. "target_membership_not_provisioned" and "target_membership_unassigned_no_seats": the member has no usable seat in this organization. "already_migrating": another migration of the same account is in progress. "source_too_large": the personal account holds more data than a migration can move. "target_became_inactive": this organization became inactive before the migration finished. "migration_failed": an error stopped the migration. "anthropic_staff_action": Anthropic staff stopped the migration. "migration_blocked_redacted": stands in for every reason that is not shared with the organization. Values may be added over time; treat an unrecognized value as a generic failure. "unspecified" is never emitted.

145500

145501 - `"already_member_of_target"`

145502

145503 - `"already_migrating"`

145504

145505 - `"anthropic_staff_action"`

145506

145507 - `"migration_blocked_redacted"`

145508

145509 - `"migration_failed"`

145510

145511 - `"source_equals_target"`

145512

145513 - `"source_not_personal_org"`

145514

145515 - `"source_too_large"`

145516

145517 - `"target_became_inactive"`

145518

145519 - `"target_membership_not_provisioned"`

145520

145521 - `"target_membership_unassigned_no_seats"`

145522

145523 - `"target_not_enterprise_org"`

145524

145525 - `"unspecified"`

145526

145527 - `"user_not_member_of_source"`

145528

145529 - `"user_not_sole_member_of_source"`

145530

145531 - `migrated_user_email: optional string or null`

145532

145533 Email address of the user whose personal account was being migrated, when known.

145534

145535 - `migrated_user_id: optional string or null`

145536

145537 Tagged ID of the user whose personal account was being migrated, e.g. "user_...", when known.

145538

145539 - `organization_id: optional string or null`

145540

145541 Organization ID this activity is associated with

145542

145543 - `organization_uuid: optional string or null`

145544

145545 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

145546

145547 - `AccountMigrationStarted object`

145548

145549 A personal Claude account began migrating into the organization: its data, including conversations, projects and files, is being moved from the member's personal account into this organization.

145550

145551 - `type: optional "account_migration_started"`

145552

145553 default: account_migration_started

145554

145555 - `account_migration_id: string`

145556

145557 Tagged ID of the migration, e.g. "amig_...". The same ID appears on the completed or failed activity that closes the migration, when one is recorded.

145558

145559 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

145560

145561 - `APIActor object`

145562

145563 - `type: optional "api_actor"`

145564

145565 default: api_actor

145566

145567 - `api_key_id: string`

145568

145569 - `ip_address: string`

145570

145571 - `user_agent: string`

145572

145573 - `UserActor object`

145574

145575 - `type: optional "user_actor"`

145576

145577 default: user_actor

145578

145579 - `email_address: string`

145580

145581 format: email

145582

145583 - `ip_address: string`

145584

145585 - `user_agent: string`

145586

145587 - `user_id: string`

145588

145589 - `UnauthenticatedUserActor object`

145590

145591 - `type: optional "unauthenticated_user_actor"`

145592

145593 default: unauthenticated_user_actor

145594

145595 - `ip_address: string`

145596

145597 - `user_agent: string`

145598

145599 - `unauthenticated_email_address: optional string or null`

145600

145601 format: email

145602

145603 - `AnthropicActor object`

145604

145605 - `type: optional "anthropic_actor"`

145606

145607 default: anthropic_actor

145608

145609 - `email_address: optional string or null`

145610

145611 format: email

145612

145613 - `SystemActor object`

145614

145615 Automated background processing performed by Anthropic systems, acting

145616 without a user or customer credential.

145617

145618 - `type: optional "system_actor"`

145619

145620 default: system_actor

145621

145622 - `service: optional string or null`

145623

145624 Name of the automated process that performed the action, when known.

145625

145626 - `AdminAPIKeyActor object`

145627

145628 - `type: optional "admin_api_key_actor"`

145629

145630 default: admin_api_key_actor

145631

145632 - `admin_api_key_id: string`

145633

145634 - `ip_address: string`

145635

145636 - `user_agent: string`

145637

145638 - `ServiceAccountActor object`

145639

145640 - `type: optional "service_account_actor"`

145641

145642 default: service_account_actor

145643

145644 - `ip_address: string`

145645

145646 - `service_account_id: string`

145647

145648 - `user_agent: string`

145649

145650 - `ScimDirectorySyncActor object`

145651

145652 - `type: optional "scim_directory_sync_actor"`

145653

145654 default: scim_directory_sync_actor

145655

145656 - `directory_id: string`

145657

145658 - `workos_event_id: string`

145659

145660 - `idp_connection_type: optional string or null`

145661

145662 - `FederatedIdentityActor object`

145663

145664 A federated external workload authenticated via a verified OIDC token.

145665

145666 Carries the verified issuer, subject, and audience claims from the

145667 presented JWT.

145668

145669 - `type: optional "federated_identity_actor"`

145670

145671 default: federated_identity_actor

145672

145673 - `issuer: string`

145674

145675 - `subject: string`

145676

145677 - `audience: optional array of string`

145678

145679 - `ip_address: optional string or null`

145680

145681 - `user_agent: optional string or null`

145682

145683 - `FederatedActor object`

145684

145685 An external identity asserted by a trusted provider — a cloud-provider

145686 gateway or a customer-registered federation issuer — acting without an

145687 Anthropic-provisioned account or service account.

145688

145689 - `type: optional "federated_actor"`

145690

145691 default: federated_actor

145692

145693 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

145694

145695 - `FederatedActorAwsProvider object`

145696

145697 Asserting party: the AWS account the organization is bound to.

145698

145699 - `type: optional "aws"`

145700

145701 default: aws

145702

145703 - `account_id: string`

145704

145705 - `signed_principal: string`

145706

145707 The AWS-signed ARN of the IAM principal that requested the token.

145708

145709 - `FederatedActorAzureProvider object`

145710

145711 Asserting party: the Azure subscription the organization is bound to.

145712

145713 - `type: optional "azure"`

145714

145715 default: azure

145716

145717 - `subscription_id: string`

145718

145719 - `FederatedActorGcpProvider object`

145720

145721 Asserting party: the GCP project the organization is bound to.

145722

145723 - `type: optional "gcp"`

145724

145725 default: gcp

145726

145727 - `project_number: string`

145728

145729 - `FederatedActorOidcProvider object`

145730

145731 Asserting party: a customer-registered OIDC federation issuer.

145732

145733 - `type: optional "oidc"`

145734

145735 default: oidc

145736

145737 - `issuer: optional string or null`

145738

145739 The federation issuer's URL. Null when the presented credential failed verification.

145740

145741 - `ip_address: optional string or null`

145742

145743 - `subject: optional string or null`

145744

145745 The provider's verified identifier for the caller; its form depends on the provider.

145746

145747 - `user_agent: optional string or null`

145748

145749 - `AttestedDeviceActor object`

145750

145751 An attested mobile device authenticated via Apple App Attest.

145752

145753 - `type: optional "attested_device_actor"`

145754

145755 default: attested_device_actor

145756

145757 - `external_client_id: string`

145758

145759 - `kid_hash: string`

145760

145761 - `ip_address: optional string or null`

145762

145763 - `user_agent: optional string or null`

145764

145765 - `migrated_user_email: string`

145766

145767 Email address of the user whose personal account is being migrated.

145768

145769 - `migrated_user_id: string`

145770

145771 Tagged ID of the user whose personal account is being migrated, e.g. "user_...".

145772

145773 - `id: optional string`

145774

145775 Unique identifier for the activity e.g. 'activity_abcd1234'

145776

145777 - `created_at: optional string`

145778

145779 When this activity occurred.

145780

145781 format: date-time

145782

145783 - `organization_id: optional string or null`

145784

145785 Organization ID this activity is associated with

145786

145787 - `organization_uuid: optional string or null`

145788

145789 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

145790

141337145791 - `AdminAPIKeyCreated object`

141338145792

141339145793 An admin API key was created.

from line 166276

161822166276

161823166277 Per-review spend limit in USD before the change. Absent when no configuration existed before this update or no limit was set.

161824166278

166279 - `previous_review_level: optional string or null`

166280

166281 Review level set for the organization's code reviews before the change: "low" (Quick), "medium" (Standard) or "high" (Deep). Absent when no configuration existed before this update or no level was set.

166282

161825166283 - `previous_show_tips: optional boolean or null`

161826166284

161827166285 Whether tip-style pull-request comments were enabled before the change. Absent when no configuration existed before this update.

from line 166288

161830166288

161831166289 Whether the verification stage of code review was enabled for the organization before the change. Absent when no configuration existed before this update or no preference was set.

161832166290

166291 - `review_level: optional string or null`

166292

166293 Review level now set for the organization's code reviews: "low" (Quick), "medium" (Standard) or "high" (Deep). Repositories without their own level use this one. Absent when no level is set; the default level, Standard, then applies.

166294

161833166295 - `show_tips: optional boolean or null`

161834166296

161835166297 Whether tip-style pull-request comments are now enabled

from line 166300

161838166300

161839166301 Whether the verification stage of code review is now enabled for the organization. Absent when the organization has not set a preference and the default applies.

161840166302

166303 - `ClaudeCodeReviewPromoEnrolled object`

166304

166305 An organization admin enrolled the organization in a Claude Code Review promotion, for example by claiming promotional credits.

166306

166307 - `type: optional "claude_code_review_promo_enrolled"`

166308

166309 default: claude_code_review_promo_enrolled

166310

166311 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

166312

166313 - `APIActor object`

166314

166315 - `type: optional "api_actor"`

166316

166317 default: api_actor

166318

166319 - `api_key_id: string`

166320

166321 - `ip_address: string`

166322

166323 - `user_agent: string`

166324

166325 - `UserActor object`

166326

166327 - `type: optional "user_actor"`

166328

166329 default: user_actor

166330

166331 - `email_address: string`

166332

166333 format: email

166334

166335 - `ip_address: string`

166336

166337 - `user_agent: string`

166338

166339 - `user_id: string`

166340

166341 - `UnauthenticatedUserActor object`

166342

166343 - `type: optional "unauthenticated_user_actor"`

166344

166345 default: unauthenticated_user_actor

166346

166347 - `ip_address: string`

166348

166349 - `user_agent: string`

166350

166351 - `unauthenticated_email_address: optional string or null`

166352

166353 format: email

166354

166355 - `AnthropicActor object`

166356

166357 - `type: optional "anthropic_actor"`

166358

166359 default: anthropic_actor

166360

166361 - `email_address: optional string or null`

166362

166363 format: email

166364

166365 - `SystemActor object`

166366

166367 Automated background processing performed by Anthropic systems, acting

166368 without a user or customer credential.

166369

166370 - `type: optional "system_actor"`

166371

166372 default: system_actor

166373

166374 - `service: optional string or null`

166375

166376 Name of the automated process that performed the action, when known.

166377

166378 - `AdminAPIKeyActor object`

166379

166380 - `type: optional "admin_api_key_actor"`

166381

166382 default: admin_api_key_actor

166383

166384 - `admin_api_key_id: string`

166385

166386 - `ip_address: string`

166387

166388 - `user_agent: string`

166389

166390 - `ServiceAccountActor object`

166391

166392 - `type: optional "service_account_actor"`

166393

166394 default: service_account_actor

166395

166396 - `ip_address: string`

166397

166398 - `service_account_id: string`

166399

166400 - `user_agent: string`

166401

166402 - `ScimDirectorySyncActor object`

166403

166404 - `type: optional "scim_directory_sync_actor"`

166405

166406 default: scim_directory_sync_actor

166407

166408 - `directory_id: string`

166409

166410 - `workos_event_id: string`

166411

166412 - `idp_connection_type: optional string or null`

166413

166414 - `FederatedIdentityActor object`

166415

166416 A federated external workload authenticated via a verified OIDC token.

166417

166418 Carries the verified issuer, subject, and audience claims from the

166419 presented JWT.

166420

166421 - `type: optional "federated_identity_actor"`

166422

166423 default: federated_identity_actor

166424

166425 - `issuer: string`

166426

166427 - `subject: string`

166428

166429 - `audience: optional array of string`

166430

166431 - `ip_address: optional string or null`

166432

166433 - `user_agent: optional string or null`

166434

166435 - `FederatedActor object`

166436

166437 An external identity asserted by a trusted provider — a cloud-provider

166438 gateway or a customer-registered federation issuer — acting without an

166439 Anthropic-provisioned account or service account.

166440

166441 - `type: optional "federated_actor"`

166442

166443 default: federated_actor

166444

166445 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

166446

166447 - `FederatedActorAwsProvider object`

166448

166449 Asserting party: the AWS account the organization is bound to.

166450

166451 - `type: optional "aws"`

166452

166453 default: aws

166454

166455 - `account_id: string`

166456

166457 - `signed_principal: string`

166458

166459 The AWS-signed ARN of the IAM principal that requested the token.

166460

166461 - `FederatedActorAzureProvider object`

166462

166463 Asserting party: the Azure subscription the organization is bound to.

166464

166465 - `type: optional "azure"`

166466

166467 default: azure

166468

166469 - `subscription_id: string`

166470

166471 - `FederatedActorGcpProvider object`

166472

166473 Asserting party: the GCP project the organization is bound to.

166474

166475 - `type: optional "gcp"`

166476

166477 default: gcp

166478

166479 - `project_number: string`

166480

166481 - `FederatedActorOidcProvider object`

166482

166483 Asserting party: a customer-registered OIDC federation issuer.

166484

166485 - `type: optional "oidc"`

166486

166487 default: oidc

166488

166489 - `issuer: optional string or null`

166490

166491 The federation issuer's URL. Null when the presented credential failed verification.

166492

166493 - `ip_address: optional string or null`

166494

166495 - `subject: optional string or null`

166496

166497 The provider's verified identifier for the caller; its form depends on the provider.

166498

166499 - `user_agent: optional string or null`

166500

166501 - `AttestedDeviceActor object`

166502

166503 An attested mobile device authenticated via Apple App Attest.

166504

166505 - `type: optional "attested_device_actor"`

166506

166507 default: attested_device_actor

166508

166509 - `external_client_id: string`

166510

166511 - `kid_hash: string`

166512

166513 - `ip_address: optional string or null`

166514

166515 - `user_agent: optional string or null`

166516

166517 - `promo_id: string`

166518

166519 Identifier of the promotion the organization enrolled in.

166520

166521 - `id: optional string`

166522

166523 Unique identifier for the activity e.g. 'activity_abcd1234'

166524

166525 - `created_at: optional string`

166526

166527 When this activity occurred.

166528

166529 format: date-time

166530

166531 - `expires_at: optional string or null`

166532

166533 When the organization's promotional access or credits expire.

166534

166535 format: date-time

166536

166537 - `organization_id: optional string or null`

166538

166539 Organization ID this activity is associated with

166540

166541 - `organization_uuid: optional string or null`

166542

166543 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

166544

161841166545 - `ClaudeCodeReviewRepositoryAdded object`

161842166546

161843166547 A repository was added to org-level Claude Code Review configuration.

from line 167278

162574167278

162575167279 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

162576167280

167281 - `previous_review_level: optional string or null`

167282

167283 Review level set for this repository's code reviews before the change: "low" (Quick), "medium" (Standard) or "high" (Deep). Absent when no level was set.

167284

167285 - `review_level: optional string or null`

167286

167287 Review level now set for this repository's code reviews: "low" (Quick), "medium" (Standard) or "high" (Deep). Absent when no level is set; the repository then uses the organization-wide level (review_level on claude_code_review_config_updated), or Standard if none is set.

167288

162577167289 - `status: optional string or null`

162578167290

162579167291 Updated status (ACTIVE/INACTIVE)

from line 169754

165042169754

165043169755 - `ClaudeCodeSecurityScanProjectUpdated object`

165044169756

165045 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience.

169757 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience, or a user paused the project's scheduled scanning, unpaused it, or lifted a billing pause on it.

165046169758

165047169759 - `type: optional "claude_code_security_scan_project_updated"`

165048169760

165049169761 default: claude_code_security_scan_project_updated

165050169762

165051 - `action: "archived" or "created" or "migrated" or 3 more`

169763 - `action: "archived" or "billing_pause_lifted" or "created" or 6 more`

165052169764

165053169765 The state change applied to the scan project.

165054169766

165055169767 - `"archived"`

165056169768

169769 - `"billing_pause_lifted"`

169770

165057169771 - `"created"`

165058169772

165059169773 - `"migrated"`

165060169774

169775 - `"paused"`

169776

165061169777 - `"resumed"`

165062169778

165063169779 - `"unarchived"`

165064169780

169781 - `"unpaused"`

169782

165065169783 - `"unspecified"`

165066169784

165067169785 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

from line 180038

175320180038

175321180039 A short provider-specific identifier for the external resource after the update, e.g. `owner/repo` for GitHub or a file ID for Google Drive.

175322180040

180041 - `ClaudeSkillAutoDisabled object`

180042

180043 A skill that had been turned on for a member automatically was turned off for them automatically, not by the member; reason says why. A member turning a skill off themselves is recorded as claude_skill_disabled.

180044

180045 - `type: optional "claude_skill_auto_disabled"`

180046

180047 default: claude_skill_auto_disabled

180048

180049 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

180050

180051 - `APIActor object`

180052

180053 - `type: optional "api_actor"`

180054

180055 default: api_actor

180056

180057 - `api_key_id: string`

180058

180059 - `ip_address: string`

180060

180061 - `user_agent: string`

180062

180063 - `UserActor object`

180064

180065 - `type: optional "user_actor"`

180066

180067 default: user_actor

180068

180069 - `email_address: string`

180070

180071 format: email

180072

180073 - `ip_address: string`

180074

180075 - `user_agent: string`

180076

180077 - `user_id: string`

180078

180079 - `UnauthenticatedUserActor object`

180080

180081 - `type: optional "unauthenticated_user_actor"`

180082

180083 default: unauthenticated_user_actor

180084

180085 - `ip_address: string`

180086

180087 - `user_agent: string`

180088

180089 - `unauthenticated_email_address: optional string or null`

180090

180091 format: email

180092

180093 - `AnthropicActor object`

180094

180095 - `type: optional "anthropic_actor"`

180096

180097 default: anthropic_actor

180098

180099 - `email_address: optional string or null`

180100

180101 format: email

180102

180103 - `SystemActor object`

180104

180105 Automated background processing performed by Anthropic systems, acting

180106 without a user or customer credential.

180107

180108 - `type: optional "system_actor"`

180109

180110 default: system_actor

180111

180112 - `service: optional string or null`

180113

180114 Name of the automated process that performed the action, when known.

180115

180116 - `AdminAPIKeyActor object`

180117

180118 - `type: optional "admin_api_key_actor"`

180119

180120 default: admin_api_key_actor

180121

180122 - `admin_api_key_id: string`

180123

180124 - `ip_address: string`

180125

180126 - `user_agent: string`

180127

180128 - `ServiceAccountActor object`

180129

180130 - `type: optional "service_account_actor"`

180131

180132 default: service_account_actor

180133

180134 - `ip_address: string`

180135

180136 - `service_account_id: string`

180137

180138 - `user_agent: string`

180139

180140 - `ScimDirectorySyncActor object`

180141

180142 - `type: optional "scim_directory_sync_actor"`

180143

180144 default: scim_directory_sync_actor

180145

180146 - `directory_id: string`

180147

180148 - `workos_event_id: string`

180149

180150 - `idp_connection_type: optional string or null`

180151

180152 - `FederatedIdentityActor object`

180153

180154 A federated external workload authenticated via a verified OIDC token.

180155

180156 Carries the verified issuer, subject, and audience claims from the

180157 presented JWT.

180158

180159 - `type: optional "federated_identity_actor"`

180160

180161 default: federated_identity_actor

180162

180163 - `issuer: string`

180164

180165 - `subject: string`

180166

180167 - `audience: optional array of string`

180168

180169 - `ip_address: optional string or null`

180170

180171 - `user_agent: optional string or null`

180172

180173 - `FederatedActor object`

180174

180175 An external identity asserted by a trusted provider — a cloud-provider

180176 gateway or a customer-registered federation issuer — acting without an

180177 Anthropic-provisioned account or service account.

180178

180179 - `type: optional "federated_actor"`

180180

180181 default: federated_actor

180182

180183 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

180184

180185 - `FederatedActorAwsProvider object`

180186

180187 Asserting party: the AWS account the organization is bound to.

180188

180189 - `type: optional "aws"`

180190

180191 default: aws

180192

180193 - `account_id: string`

180194

180195 - `signed_principal: string`

180196

180197 The AWS-signed ARN of the IAM principal that requested the token.

180198

180199 - `FederatedActorAzureProvider object`

180200

180201 Asserting party: the Azure subscription the organization is bound to.

180202

180203 - `type: optional "azure"`

180204

180205 default: azure

180206

180207 - `subscription_id: string`

180208

180209 - `FederatedActorGcpProvider object`

180210

180211 Asserting party: the GCP project the organization is bound to.

180212

180213 - `type: optional "gcp"`

180214

180215 default: gcp

180216

180217 - `project_number: string`

180218

180219 - `FederatedActorOidcProvider object`

180220

180221 Asserting party: a customer-registered OIDC federation issuer.

180222

180223 - `type: optional "oidc"`

180224

180225 default: oidc

180226

180227 - `issuer: optional string or null`

180228

180229 The federation issuer's URL. Null when the presented credential failed verification.

180230

180231 - `ip_address: optional string or null`

180232

180233 - `subject: optional string or null`

180234

180235 The provider's verified identifier for the caller; its form depends on the provider.

180236

180237 - `user_agent: optional string or null`

180238

180239 - `AttestedDeviceActor object`

180240

180241 An attested mobile device authenticated via Apple App Attest.

180242

180243 - `type: optional "attested_device_actor"`

180244

180245 default: attested_device_actor

180246

180247 - `external_client_id: string`

180248

180249 - `kid_hash: string`

180250

180251 - `ip_address: optional string or null`

180252

180253 - `user_agent: optional string or null`

180254

180255 - `reason: "auto_enable_reverted" or "content_changed" or "unspecified"`

180256

180257 Why the skill was turned off automatically: "content_changed" (a change to the skill was saved or attempted, or the skill was scanned again, and it could not be confirmed as still eligible to be on automatically) or "auto_enable_reverted" (Anthropic turned off skills that had been turned on automatically; not in response to a change to this skill).

180258

180259 - `"auto_enable_reverted"`

180260

180261 - `"content_changed"`

180262

180263 - `"unspecified"`

180264

180265 - `user_id: string`

180266

180267 The member the skill was turned off for.

180268

180269 - `id: optional string`

180270

180271 Unique identifier for the activity e.g. 'activity_abcd1234'

180272

180273 - `created_at: optional string`

180274

180275 When this activity occurred.

180276

180277 format: date-time

180278

180279 - `organization_id: optional string or null`

180280

180281 Organization ID this activity is associated with

180282

180283 - `organization_uuid: optional string or null`

180284

180285 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

180286

180287 - `shared_by_user_id: optional string or null`

180288

180289 For a skill that had been turned on because it was shared: the member who shared it.

180290

180291 - `skill_id: optional string or null`

180292

180293 The skill that was turned off.

180294

180295 - `skill_name: optional string or null`

180296

180297 The name of the skill that was turned off.

180298

180299 - `skill_version: optional string or null`

180300

180301 The version of the skill the member had just before it was turned off. Absent when not known.

180302

180303 - `ClaudeSkillAutoEnabled object`

180304

180305 A skill was turned on for a member automatically, not by the member; trigger gives the cause, such as another member sharing an eligible skill with them. A member turning a skill on themselves is recorded as claude_skill_enabled.

180306

180307 - `type: optional "claude_skill_auto_enabled"`

180308

180309 default: claude_skill_auto_enabled

180310

180311 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

180312

180313 - `APIActor object`

180314

180315 - `type: optional "api_actor"`

180316

180317 default: api_actor

180318

180319 - `api_key_id: string`

180320

180321 - `ip_address: string`

180322

180323 - `user_agent: string`

180324

180325 - `UserActor object`

180326

180327 - `type: optional "user_actor"`

180328

180329 default: user_actor

180330

180331 - `email_address: string`

180332

180333 format: email

180334

180335 - `ip_address: string`

180336

180337 - `user_agent: string`

180338

180339 - `user_id: string`

180340

180341 - `UnauthenticatedUserActor object`

180342

180343 - `type: optional "unauthenticated_user_actor"`

180344

180345 default: unauthenticated_user_actor

180346

180347 - `ip_address: string`

180348

180349 - `user_agent: string`

180350

180351 - `unauthenticated_email_address: optional string or null`

180352

180353 format: email

180354

180355 - `AnthropicActor object`

180356

180357 - `type: optional "anthropic_actor"`

180358

180359 default: anthropic_actor

180360

180361 - `email_address: optional string or null`

180362

180363 format: email

180364

180365 - `SystemActor object`

180366

180367 Automated background processing performed by Anthropic systems, acting

180368 without a user or customer credential.

180369

180370 - `type: optional "system_actor"`

180371

180372 default: system_actor

180373

180374 - `service: optional string or null`

180375

180376 Name of the automated process that performed the action, when known.

180377

180378 - `AdminAPIKeyActor object`

180379

180380 - `type: optional "admin_api_key_actor"`

180381

180382 default: admin_api_key_actor

180383

180384 - `admin_api_key_id: string`

180385

180386 - `ip_address: string`

180387

180388 - `user_agent: string`

180389

180390 - `ServiceAccountActor object`

180391

180392 - `type: optional "service_account_actor"`

180393

180394 default: service_account_actor

180395

180396 - `ip_address: string`

180397

180398 - `service_account_id: string`

180399

180400 - `user_agent: string`

180401

180402 - `ScimDirectorySyncActor object`

180403

180404 - `type: optional "scim_directory_sync_actor"`

180405

180406 default: scim_directory_sync_actor

180407

180408 - `directory_id: string`

180409

180410 - `workos_event_id: string`

180411

180412 - `idp_connection_type: optional string or null`

180413

180414 - `FederatedIdentityActor object`

180415

180416 A federated external workload authenticated via a verified OIDC token.

180417

180418 Carries the verified issuer, subject, and audience claims from the

180419 presented JWT.

180420

180421 - `type: optional "federated_identity_actor"`

180422

180423 default: federated_identity_actor

180424

180425 - `issuer: string`

180426

180427 - `subject: string`

180428

180429 - `audience: optional array of string`

180430

180431 - `ip_address: optional string or null`

180432

180433 - `user_agent: optional string or null`

180434

180435 - `FederatedActor object`

180436

180437 An external identity asserted by a trusted provider — a cloud-provider

180438 gateway or a customer-registered federation issuer — acting without an

180439 Anthropic-provisioned account or service account.

180440

180441 - `type: optional "federated_actor"`

180442

180443 default: federated_actor

180444

180445 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

180446

180447 - `FederatedActorAwsProvider object`

180448

180449 Asserting party: the AWS account the organization is bound to.

180450

180451 - `type: optional "aws"`

180452

180453 default: aws

180454

180455 - `account_id: string`

180456

180457 - `signed_principal: string`

180458

180459 The AWS-signed ARN of the IAM principal that requested the token.

180460

180461 - `FederatedActorAzureProvider object`

180462

180463 Asserting party: the Azure subscription the organization is bound to.

180464

180465 - `type: optional "azure"`

180466

180467 default: azure

180468

180469 - `subscription_id: string`

180470

180471 - `FederatedActorGcpProvider object`

180472

180473 Asserting party: the GCP project the organization is bound to.

180474

180475 - `type: optional "gcp"`

180476

180477 default: gcp

180478

180479 - `project_number: string`

180480

180481 - `FederatedActorOidcProvider object`

180482

180483 Asserting party: a customer-registered OIDC federation issuer.

180484

180485 - `type: optional "oidc"`

180486

180487 default: oidc

180488

180489 - `issuer: optional string or null`

180490

180491 The federation issuer's URL. Null when the presented credential failed verification.

180492

180493 - `ip_address: optional string or null`

180494

180495 - `subject: optional string or null`

180496

180497 The provider's verified identifier for the caller; its form depends on the provider.

180498

180499 - `user_agent: optional string or null`

180500

180501 - `AttestedDeviceActor object`

180502

180503 An attested mobile device authenticated via Apple App Attest.

180504

180505 - `type: optional "attested_device_actor"`

180506

180507 default: attested_device_actor

180508

180509 - `external_client_id: string`

180510

180511 - `kid_hash: string`

180512

180513 - `ip_address: optional string or null`

180514

180515 - `user_agent: optional string or null`

180516

180517 - `trigger: "share" or "unspecified"`

180518

180519 What caused the skill to be turned on automatically: "share" (another member shared it with the member, directly or through a group).

180520

180521 - `"share"`

180522

180523 - `"unspecified"`

180524

180525 - `user_id: string`

180526

180527 The member the skill was turned on for.

180528

180529 - `id: optional string`

180530

180531 Unique identifier for the activity e.g. 'activity_abcd1234'

180532

180533 - `created_at: optional string`

180534

180535 When this activity occurred.

180536

180537 format: date-time

180538

180539 - `organization_id: optional string or null`

180540

180541 Organization ID this activity is associated with

180542

180543 - `organization_uuid: optional string or null`

180544

180545 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

180546

180547 - `shared_at: optional string or null`

180548

180549 For a skill turned on because it was shared: when it was shared with the member or with their group.

180550

180551 format: date-time

180552

180553 - `shared_by_user_id: optional string or null`

180554

180555 For a skill turned on because it was shared: the member who shared it.

180556

180557 - `shared_via: optional "direct" or "group" or "unspecified" or null`

180558

180559 For a skill turned on because it was shared: "direct" if shared with the member themselves, "group" if shared with a group they belong to.

180560

180561 - `"direct"`

180562

180563 - `"group"`

180564

180565 - `"unspecified"`

180566

180567 - `skill_id: optional string or null`

180568

180569 The skill that was turned on.

180570

180571 - `skill_name: optional string or null`

180572

180573 The name of the skill that was turned on.

180574

180575 - `skill_version: optional string or null`

180576

180577 The version of the skill that was turned on.

180578

175323180579 - `ClaudeSkillDownloaded object`

175324180580

175325180581 A member explicitly downloaded a skill's files to their device: the Download action in Claude, a single file saved from the skill viewer, or an install they asked one of their Claude apps for. Background syncs to the Claude apps, viewing a skill in the app and services reading a skill on the member's behalf are not recorded.

from line 189188

183932189188

183933189189 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

183934189190

189191 - `DomainClaimCancelled object`

189192

189193 A pending domain claim was cancelled before it took effect, so the personal accounts on the claimed domains will no longer be migrated or deactivated at its deadline.

189194

189195 - `type: optional "domain_claim_cancelled"`

189196

189197 default: domain_claim_cancelled

189198

189199 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

189200

189201 - `APIActor object`

189202

189203 - `type: optional "api_actor"`

189204

189205 default: api_actor

189206

189207 - `api_key_id: string`

189208

189209 - `ip_address: string`

189210

189211 - `user_agent: string`

189212

189213 - `UserActor object`

189214

189215 - `type: optional "user_actor"`

189216

189217 default: user_actor

189218

189219 - `email_address: string`

189220

189221 format: email

189222

189223 - `ip_address: string`

189224

189225 - `user_agent: string`

189226

189227 - `user_id: string`

189228

189229 - `UnauthenticatedUserActor object`

189230

189231 - `type: optional "unauthenticated_user_actor"`

189232

189233 default: unauthenticated_user_actor

189234

189235 - `ip_address: string`

189236

189237 - `user_agent: string`

189238

189239 - `unauthenticated_email_address: optional string or null`

189240

189241 format: email

189242

189243 - `AnthropicActor object`

189244

189245 - `type: optional "anthropic_actor"`

189246

189247 default: anthropic_actor

189248

189249 - `email_address: optional string or null`

189250

189251 format: email

189252

189253 - `SystemActor object`

189254

189255 Automated background processing performed by Anthropic systems, acting

189256 without a user or customer credential.

189257

189258 - `type: optional "system_actor"`

189259

189260 default: system_actor

189261

189262 - `service: optional string or null`

189263

189264 Name of the automated process that performed the action, when known.

189265

189266 - `AdminAPIKeyActor object`

189267

189268 - `type: optional "admin_api_key_actor"`

189269

189270 default: admin_api_key_actor

189271

189272 - `admin_api_key_id: string`

189273

189274 - `ip_address: string`

189275

189276 - `user_agent: string`

189277

189278 - `ServiceAccountActor object`

189279

189280 - `type: optional "service_account_actor"`

189281

189282 default: service_account_actor

189283

189284 - `ip_address: string`

189285

189286 - `service_account_id: string`

189287

189288 - `user_agent: string`

189289

189290 - `ScimDirectorySyncActor object`

189291

189292 - `type: optional "scim_directory_sync_actor"`

189293

189294 default: scim_directory_sync_actor

189295

189296 - `directory_id: string`

189297

189298 - `workos_event_id: string`

189299

189300 - `idp_connection_type: optional string or null`

189301

189302 - `FederatedIdentityActor object`

189303

189304 A federated external workload authenticated via a verified OIDC token.

189305

189306 Carries the verified issuer, subject, and audience claims from the

189307 presented JWT.

189308

189309 - `type: optional "federated_identity_actor"`

189310

189311 default: federated_identity_actor

189312

189313 - `issuer: string`

189314

189315 - `subject: string`

189316

189317 - `audience: optional array of string`

189318

189319 - `ip_address: optional string or null`

189320

189321 - `user_agent: optional string or null`

189322

189323 - `FederatedActor object`

189324

189325 An external identity asserted by a trusted provider — a cloud-provider

189326 gateway or a customer-registered federation issuer — acting without an

189327 Anthropic-provisioned account or service account.

189328

189329 - `type: optional "federated_actor"`

189330

189331 default: federated_actor

189332

189333 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

189334

189335 - `FederatedActorAwsProvider object`

189336

189337 Asserting party: the AWS account the organization is bound to.

189338

189339 - `type: optional "aws"`

189340

189341 default: aws

189342

189343 - `account_id: string`

189344

189345 - `signed_principal: string`

189346

189347 The AWS-signed ARN of the IAM principal that requested the token.

189348

189349 - `FederatedActorAzureProvider object`

189350

189351 Asserting party: the Azure subscription the organization is bound to.

189352

189353 - `type: optional "azure"`

189354

189355 default: azure

189356

189357 - `subscription_id: string`

189358

189359 - `FederatedActorGcpProvider object`

189360

189361 Asserting party: the GCP project the organization is bound to.

189362

189363 - `type: optional "gcp"`

189364

189365 default: gcp

189366

189367 - `project_number: string`

189368

189369 - `FederatedActorOidcProvider object`

189370

189371 Asserting party: a customer-registered OIDC federation issuer.

189372

189373 - `type: optional "oidc"`

189374

189375 default: oidc

189376

189377 - `issuer: optional string or null`

189378

189379 The federation issuer's URL. Null when the presented credential failed verification.

189380

189381 - `ip_address: optional string or null`

189382

189383 - `subject: optional string or null`

189384

189385 The provider's verified identifier for the caller; its form depends on the provider.

189386

189387 - `user_agent: optional string or null`

189388

189389 - `AttestedDeviceActor object`

189390

189391 An attested mobile device authenticated via Apple App Attest.

189392

189393 - `type: optional "attested_device_actor"`

189394

189395 default: attested_device_actor

189396

189397 - `external_client_id: string`

189398

189399 - `kid_hash: string`

189400

189401 - `ip_address: optional string or null`

189402

189403 - `user_agent: optional string or null`

189404

189405 - `domain_claim_id: string`

189406

189407 The domain claim that was cancelled, e.g. "dclm_01Ab...".

189408

189409 - `id: optional string`

189410

189411 Unique identifier for the activity e.g. 'activity_abcd1234'

189412

189413 - `created_at: optional string`

189414

189415 When this activity occurred.

189416

189417 format: date-time

189418

189419 - `organization_id: optional string or null`

189420

189421 Organization ID this activity is associated with

189422

189423 - `organization_uuid: optional string or null`

189424

189425 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

189426

189427 - `DomainClaimDeadlineUpdated object`

189428

189429 The migration deadline of a pending domain claim was moved to a later or an earlier date by Anthropic staff or an automated process.

189430

189431 - `type: optional "domain_claim_deadline_updated"`

189432

189433 default: domain_claim_deadline_updated

189434

189435 - `action: "extended" or "shortened" or "unspecified"`

189436

189437 Whether the deadline was extended (moved later) or shortened (moved earlier).

189438

189439 - `"extended"`

189440

189441 - `"shortened"`

189442

189443 - `"unspecified"`

189444

189445 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

189446

189447 - `APIActor object`

189448

189449 - `type: optional "api_actor"`

189450

189451 default: api_actor

189452

189453 - `api_key_id: string`

189454

189455 - `ip_address: string`

189456

189457 - `user_agent: string`

189458

189459 - `UserActor object`

189460

189461 - `type: optional "user_actor"`

189462

189463 default: user_actor

189464

189465 - `email_address: string`

189466

189467 format: email

189468

189469 - `ip_address: string`

189470

189471 - `user_agent: string`

189472

189473 - `user_id: string`

189474

189475 - `UnauthenticatedUserActor object`

189476

189477 - `type: optional "unauthenticated_user_actor"`

189478

189479 default: unauthenticated_user_actor

189480

189481 - `ip_address: string`

189482

189483 - `user_agent: string`

189484

189485 - `unauthenticated_email_address: optional string or null`

189486

189487 format: email

189488

189489 - `AnthropicActor object`

189490

189491 - `type: optional "anthropic_actor"`

189492

189493 default: anthropic_actor

189494

189495 - `email_address: optional string or null`

189496

189497 format: email

189498

189499 - `SystemActor object`

189500

189501 Automated background processing performed by Anthropic systems, acting

189502 without a user or customer credential.

189503

189504 - `type: optional "system_actor"`

189505

189506 default: system_actor

189507

189508 - `service: optional string or null`

189509

189510 Name of the automated process that performed the action, when known.

189511

189512 - `AdminAPIKeyActor object`

189513

189514 - `type: optional "admin_api_key_actor"`

189515

189516 default: admin_api_key_actor

189517

189518 - `admin_api_key_id: string`

189519

189520 - `ip_address: string`

189521

189522 - `user_agent: string`

189523

189524 - `ServiceAccountActor object`

189525

189526 - `type: optional "service_account_actor"`

189527

189528 default: service_account_actor

189529

189530 - `ip_address: string`

189531

189532 - `service_account_id: string`

189533

189534 - `user_agent: string`

189535

189536 - `ScimDirectorySyncActor object`

189537

189538 - `type: optional "scim_directory_sync_actor"`

189539

189540 default: scim_directory_sync_actor

189541

189542 - `directory_id: string`

189543

189544 - `workos_event_id: string`

189545

189546 - `idp_connection_type: optional string or null`

189547

189548 - `FederatedIdentityActor object`

189549

189550 A federated external workload authenticated via a verified OIDC token.

189551

189552 Carries the verified issuer, subject, and audience claims from the

189553 presented JWT.

189554

189555 - `type: optional "federated_identity_actor"`

189556

189557 default: federated_identity_actor

189558

189559 - `issuer: string`

189560

189561 - `subject: string`

189562

189563 - `audience: optional array of string`

189564

189565 - `ip_address: optional string or null`

189566

189567 - `user_agent: optional string or null`

189568

189569 - `FederatedActor object`

189570

189571 An external identity asserted by a trusted provider — a cloud-provider

189572 gateway or a customer-registered federation issuer — acting without an

189573 Anthropic-provisioned account or service account.

189574

189575 - `type: optional "federated_actor"`

189576

189577 default: federated_actor

189578

189579 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

189580

189581 - `FederatedActorAwsProvider object`

189582

189583 Asserting party: the AWS account the organization is bound to.

189584

189585 - `type: optional "aws"`

189586

189587 default: aws

189588

189589 - `account_id: string`

189590

189591 - `signed_principal: string`

189592

189593 The AWS-signed ARN of the IAM principal that requested the token.

189594

189595 - `FederatedActorAzureProvider object`

189596

189597 Asserting party: the Azure subscription the organization is bound to.

189598

189599 - `type: optional "azure"`

189600

189601 default: azure

189602

189603 - `subscription_id: string`

189604

189605 - `FederatedActorGcpProvider object`

189606

189607 Asserting party: the GCP project the organization is bound to.

189608

189609 - `type: optional "gcp"`

189610

189611 default: gcp

189612

189613 - `project_number: string`

189614

189615 - `FederatedActorOidcProvider object`

189616

189617 Asserting party: a customer-registered OIDC federation issuer.

189618

189619 - `type: optional "oidc"`

189620

189621 default: oidc

189622

189623 - `issuer: optional string or null`

189624

189625 The federation issuer's URL. Null when the presented credential failed verification.

189626

189627 - `ip_address: optional string or null`

189628

189629 - `subject: optional string or null`

189630

189631 The provider's verified identifier for the caller; its form depends on the provider.

189632

189633 - `user_agent: optional string or null`

189634

189635 - `AttestedDeviceActor object`

189636

189637 An attested mobile device authenticated via Apple App Attest.

189638

189639 - `type: optional "attested_device_actor"`

189640

189641 default: attested_device_actor

189642

189643 - `external_client_id: string`

189644

189645 - `kid_hash: string`

189646

189647 - `ip_address: optional string or null`

189648

189649 - `user_agent: optional string or null`

189650

189651 - `domain_claim_id: string`

189652

189653 The domain claim whose deadline was moved, e.g. "dclm_01Ab...".

189654

189655 - `id: optional string`

189656

189657 Unique identifier for the activity e.g. 'activity_abcd1234'

189658

189659 - `created_at: optional string`

189660

189661 When this activity occurred.

189662

189663 format: date-time

189664

189665 - `deadline_at: optional string or null`

189666

189667 The deadline after the change.

189668

189669 format: date-time

189670

189671 - `organization_id: optional string or null`

189672

189673 Organization ID this activity is associated with

189674

189675 - `organization_uuid: optional string or null`

189676

189677 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

189678

189679 - `previous_deadline_at: optional string or null`

189680

189681 The deadline before the change.

189682

189683 format: date-time

189684

183935189685 - `DomainClaimInitiated object`

183936189686

183937189687 Domain capture claim initiated over personal accounts on verified domains.

from line 195360

189610195360

189611195361 - `token_fingerprint_sha256: optional string or null`

189612195362

189613 Org-scoped SHA-256 of the submitted token: `sha256(org_uuid || 0x00 || token)`, lowercase-hex-encoded, where `org_uuid` is the organization's UUID as a dashed lowercase string, `0x00` is a single zero byte, and `token` is the submitted value's raw bytes. Per-org correlation only — the same token in two orgs produces distinct fingerprints. Set only when the submitted value carries a known GitHub PAT prefix (a high-entropy token format); unset for all other submissions, including rejected non-PAT input.

195363 Not populated.

189614195364

189615195365 - `GitlabConfigurationCreated object`

189616195366

from line 233194

227444233194

227445233195 - `user_agent: optional string or null`

227446233196

227447 - `updates: array of Name or Capabilities or RedactContent or 104 more`

233197 - `updates: array of Name or Capabilities or RedactContent or 105 more`

227448233198

227449233199 - `Name object`

227450233200

from line 235113

229363235113

229364235114 Setting value immediately before this change. Null means the setting was not set, so its default applied.

229365235115

235116 - `ConnectorRequestsOptedIn object`

235117

235118 The organization's opt-in to connector requests, which lets members ask the organization's owners to add a connector, was changed. The "Let members request connectors" switch sets it the first time it is turned on; turning that switch off, or on again, is recorded as a `disabled_admin_request_types` change (`enable_connector` joins or leaves the list).

235119

235120 - `type: optional "connector_requests_opted_in"`

235121

235122 default: connector_requests_opted_in

235123

235124 - `current_value: optional boolean or null`

235125

235126 Setting value immediately after this change

235127

235128 - `previous_value: optional boolean or null`

235129

235130 Setting value immediately before this change. Null means the organization had never opted in or out.

235131

229366235132 - `id: optional string`

229367235133

229368235134 Unique identifier for the activity e.g. 'activity_abcd1234'

from line 254219

248453254219

248454254220 UUID of the spend limit.

248455254221

254222 - `PlatformTelemetryDestinationAutoDisabled object`

254223

254224 A telemetry destination was disabled automatically after deliveries to it failed, so no telemetry is sent to it until an administrator enables it again.

254225

254226 - `type: optional "platform_telemetry_destination_auto_disabled"`

254227

254228 default: platform_telemetry_destination_auto_disabled

254229

254230 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

254231

254232 - `APIActor object`

254233

254234 - `type: optional "api_actor"`

254235

254236 default: api_actor

254237

254238 - `api_key_id: string`

254239

254240 - `ip_address: string`

254241

254242 - `user_agent: string`

254243

254244 - `UserActor object`

254245

254246 - `type: optional "user_actor"`

254247

254248 default: user_actor

254249

254250 - `email_address: string`

254251

254252 format: email

254253

254254 - `ip_address: string`

254255

254256 - `user_agent: string`

254257

254258 - `user_id: string`

254259

254260 - `UnauthenticatedUserActor object`

254261

254262 - `type: optional "unauthenticated_user_actor"`

254263

254264 default: unauthenticated_user_actor

254265

254266 - `ip_address: string`

254267

254268 - `user_agent: string`

254269

254270 - `unauthenticated_email_address: optional string or null`

254271

254272 format: email

254273

254274 - `AnthropicActor object`

254275

254276 - `type: optional "anthropic_actor"`

254277

254278 default: anthropic_actor

254279

254280 - `email_address: optional string or null`

254281

254282 format: email

254283

254284 - `SystemActor object`

254285

254286 Automated background processing performed by Anthropic systems, acting

254287 without a user or customer credential.

254288

254289 - `type: optional "system_actor"`

254290

254291 default: system_actor

254292

254293 - `service: optional string or null`

254294

254295 Name of the automated process that performed the action, when known.

254296

254297 - `AdminAPIKeyActor object`

254298

254299 - `type: optional "admin_api_key_actor"`

254300

254301 default: admin_api_key_actor

254302

254303 - `admin_api_key_id: string`

254304

254305 - `ip_address: string`

254306

254307 - `user_agent: string`

254308

254309 - `ServiceAccountActor object`

254310

254311 - `type: optional "service_account_actor"`

254312

254313 default: service_account_actor

254314

254315 - `ip_address: string`

254316

254317 - `service_account_id: string`

254318

254319 - `user_agent: string`

254320

254321 - `ScimDirectorySyncActor object`

254322

254323 - `type: optional "scim_directory_sync_actor"`

254324

254325 default: scim_directory_sync_actor

254326

254327 - `directory_id: string`

254328

254329 - `workos_event_id: string`

254330

254331 - `idp_connection_type: optional string or null`

254332

254333 - `FederatedIdentityActor object`

254334

254335 A federated external workload authenticated via a verified OIDC token.

254336

254337 Carries the verified issuer, subject, and audience claims from the

254338 presented JWT.

254339

254340 - `type: optional "federated_identity_actor"`

254341

254342 default: federated_identity_actor

254343

254344 - `issuer: string`

254345

254346 - `subject: string`

254347

254348 - `audience: optional array of string`

254349

254350 - `ip_address: optional string or null`

254351

254352 - `user_agent: optional string or null`

254353

254354 - `FederatedActor object`

254355

254356 An external identity asserted by a trusted provider — a cloud-provider

254357 gateway or a customer-registered federation issuer — acting without an

254358 Anthropic-provisioned account or service account.

254359

254360 - `type: optional "federated_actor"`

254361

254362 default: federated_actor

254363

254364 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

254365

254366 - `FederatedActorAwsProvider object`

254367

254368 Asserting party: the AWS account the organization is bound to.

254369

254370 - `type: optional "aws"`

254371

254372 default: aws

254373

254374 - `account_id: string`

254375

254376 - `signed_principal: string`

254377

254378 The AWS-signed ARN of the IAM principal that requested the token.

254379

254380 - `FederatedActorAzureProvider object`

254381

254382 Asserting party: the Azure subscription the organization is bound to.

254383

254384 - `type: optional "azure"`

254385

254386 default: azure

254387

254388 - `subscription_id: string`

254389

254390 - `FederatedActorGcpProvider object`

254391

254392 Asserting party: the GCP project the organization is bound to.

254393

254394 - `type: optional "gcp"`

254395

254396 default: gcp

254397

254398 - `project_number: string`

254399

254400 - `FederatedActorOidcProvider object`

254401

254402 Asserting party: a customer-registered OIDC federation issuer.

254403

254404 - `type: optional "oidc"`

254405

254406 default: oidc

254407

254408 - `issuer: optional string or null`

254409

254410 The federation issuer's URL. Null when the presented credential failed verification.

254411

254412 - `ip_address: optional string or null`

254413

254414 - `subject: optional string or null`

254415

254416 The provider's verified identifier for the caller; its form depends on the provider.

254417

254418 - `user_agent: optional string or null`

254419

254420 - `AttestedDeviceActor object`

254421

254422 An attested mobile device authenticated via Apple App Attest.

254423

254424 - `type: optional "attested_device_actor"`

254425

254426 default: attested_device_actor

254427

254428 - `external_client_id: string`

254429

254430 - `kid_hash: string`

254431

254432 - `ip_address: optional string or null`

254433

254434 - `user_agent: optional string or null`

254435

254436 - `telemetry_destination_id: string`

254437

254438 Tagged telemetry destination ID, e.g. "tdst_01HX...".

254439

254440 - `trigger: "invalid_address" or "redirect" or "sustained_failure" or "unspecified"`

254441

254442 Why the destination was disabled: deliveries failed for longer than Anthropic allows ("sustained_failure"), they failed that long and the hostname does not resolve to a public address ("invalid_address"), or the endpoint answered with an HTTP redirect ("redirect").

254443

254444 - `"invalid_address"`

254445

254446 - `"redirect"`

254447

254448 - `"sustained_failure"`

254449

254450 - `"unspecified"`

254451

254452 - `id: optional string`

254453

254454 Unique identifier for the activity e.g. 'activity_abcd1234'

254455

254456 - `created_at: optional string`

254457

254458 When this activity occurred.

254459

254460 format: date-time

254461

254462 - `organization_id: optional string or null`

254463

254464 Organization ID this activity is associated with

254465

254466 - `organization_uuid: optional string or null`

254467

254468 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

254469

254470 - `PlatformTelemetryDestinationCreated object`

254471

254472 A telemetry destination was registered for the organization.

254473

254474 - `type: optional "platform_telemetry_destination_created"`

254475

254476 default: platform_telemetry_destination_created

254477

254478 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

254479

254480 - `APIActor object`

254481

254482 - `type: optional "api_actor"`

254483

254484 default: api_actor

254485

254486 - `api_key_id: string`

254487

254488 - `ip_address: string`

254489

254490 - `user_agent: string`

254491

254492 - `UserActor object`

254493

254494 - `type: optional "user_actor"`

254495

254496 default: user_actor

254497

254498 - `email_address: string`

254499

254500 format: email

254501

254502 - `ip_address: string`

254503

254504 - `user_agent: string`

254505

254506 - `user_id: string`

254507

254508 - `UnauthenticatedUserActor object`

254509

254510 - `type: optional "unauthenticated_user_actor"`

254511

254512 default: unauthenticated_user_actor

254513

254514 - `ip_address: string`

254515

254516 - `user_agent: string`

254517

254518 - `unauthenticated_email_address: optional string or null`

254519

254520 format: email

254521

254522 - `AnthropicActor object`

254523

254524 - `type: optional "anthropic_actor"`

254525

254526 default: anthropic_actor

254527

254528 - `email_address: optional string or null`

254529

254530 format: email

254531

254532 - `SystemActor object`

254533

254534 Automated background processing performed by Anthropic systems, acting

254535 without a user or customer credential.

254536

254537 - `type: optional "system_actor"`

254538

254539 default: system_actor

254540

254541 - `service: optional string or null`

254542

254543 Name of the automated process that performed the action, when known.

254544

254545 - `AdminAPIKeyActor object`

254546

254547 - `type: optional "admin_api_key_actor"`

254548

254549 default: admin_api_key_actor

254550

254551 - `admin_api_key_id: string`

254552

254553 - `ip_address: string`

254554

254555 - `user_agent: string`

254556

254557 - `ServiceAccountActor object`

254558

254559 - `type: optional "service_account_actor"`

254560

254561 default: service_account_actor

254562

254563 - `ip_address: string`

254564

254565 - `service_account_id: string`

254566

254567 - `user_agent: string`

254568

254569 - `ScimDirectorySyncActor object`

254570

254571 - `type: optional "scim_directory_sync_actor"`

254572

254573 default: scim_directory_sync_actor

254574

254575 - `directory_id: string`

254576

254577 - `workos_event_id: string`

254578

254579 - `idp_connection_type: optional string or null`

254580

254581 - `FederatedIdentityActor object`

254582

254583 A federated external workload authenticated via a verified OIDC token.

254584

254585 Carries the verified issuer, subject, and audience claims from the

254586 presented JWT.

254587

254588 - `type: optional "federated_identity_actor"`

254589

254590 default: federated_identity_actor

254591

254592 - `issuer: string`

254593

254594 - `subject: string`

254595

254596 - `audience: optional array of string`

254597

254598 - `ip_address: optional string or null`

254599

254600 - `user_agent: optional string or null`

254601

254602 - `FederatedActor object`

254603

254604 An external identity asserted by a trusted provider — a cloud-provider

254605 gateway or a customer-registered federation issuer — acting without an

254606 Anthropic-provisioned account or service account.

254607

254608 - `type: optional "federated_actor"`

254609

254610 default: federated_actor

254611

254612 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

254613

254614 - `FederatedActorAwsProvider object`

254615

254616 Asserting party: the AWS account the organization is bound to.

254617

254618 - `type: optional "aws"`

254619

254620 default: aws

254621

254622 - `account_id: string`

254623

254624 - `signed_principal: string`

254625

254626 The AWS-signed ARN of the IAM principal that requested the token.

254627

254628 - `FederatedActorAzureProvider object`

254629

254630 Asserting party: the Azure subscription the organization is bound to.

254631

254632 - `type: optional "azure"`

254633

254634 default: azure

254635

254636 - `subscription_id: string`

254637

254638 - `FederatedActorGcpProvider object`

254639

254640 Asserting party: the GCP project the organization is bound to.

254641

254642 - `type: optional "gcp"`

254643

254644 default: gcp

254645

254646 - `project_number: string`

254647

254648 - `FederatedActorOidcProvider object`

254649

254650 Asserting party: a customer-registered OIDC federation issuer.

254651

254652 - `type: optional "oidc"`

254653

254654 default: oidc

254655

254656 - `issuer: optional string or null`

254657

254658 The federation issuer's URL. Null when the presented credential failed verification.

254659

254660 - `ip_address: optional string or null`

254661

254662 - `subject: optional string or null`

254663

254664 The provider's verified identifier for the caller; its form depends on the provider.

254665

254666 - `user_agent: optional string or null`

254667

254668 - `AttestedDeviceActor object`

254669

254670 An attested mobile device authenticated via Apple App Attest.

254671

254672 - `type: optional "attested_device_actor"`

254673

254674 default: attested_device_actor

254675

254676 - `external_client_id: string`

254677

254678 - `kid_hash: string`

254679

254680 - `ip_address: optional string or null`

254681

254682 - `user_agent: optional string or null`

254683

254684 - `telemetry_destination_id: string`

254685

254686 Tagged telemetry destination ID, e.g. "tdst_01HX...".

254687

254688 - `id: optional string`

254689

254690 Unique identifier for the activity e.g. 'activity_abcd1234'

254691

254692 - `created_at: optional string`

254693

254694 When this activity occurred.

254695

254696 format: date-time

254697

254698 - `endpoint_url: optional string or null`

254699

254700 The destination's endpoint URL as stored, e.g. "https://collector.example.com/otlp"; the API refuses credentials, query strings and fragments in this URL.

254701

254702 - `organization_id: optional string or null`

254703

254704 Organization ID this activity is associated with

254705

254706 - `organization_uuid: optional string or null`

254707

254708 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

254709

254710 - `traces: optional object or null`

254711

254712 The destination's settings for traces, as the API returns them.

254713

254714 - `content_mode: string`

254715

254716 What the exported spans contain: "metadata_only", or "content" when they also carry message and tool content.

254717

254718 - `enabled: boolean`

254719

254720 Whether the destination receives traces.

254721

254722 - `endpoint_url: optional string or null`

254723

254724 The destination's separate traces URL as stored, e.g. "https://collector.example.com/v2/trace/otlp"; like the endpoint URL it never contains credentials, a query string or a fragment. Omitted when the destination has none; traces then go to the endpoint URL plus "/v1/traces".

254725

254726 - `max_content_bytes: optional number or null`

254727

254728 The most bytes of content that one exported span keeps; omitted when the destination sets no bound and only Anthropic's maximum applies.

254729

254730 - `workspaces: optional object or null`

254731

254732 Which workspaces the destination covers, as the API returns it: its type only, "all", "include" or "exclude". The workspaces put on its list by the same request are recorded as workspace_added activities.

254733

254734 - `type: string`

254735

254736 "all": every workspace of the organization; "include": the workspaces on the destination's list; "exclude": every workspace but those on its list.

254737

254738 - `PlatformTelemetryDestinationDeleted object`

254739

254740 A telemetry destination was deleted.

254741

254742 - `type: optional "platform_telemetry_destination_deleted"`

254743

254744 default: platform_telemetry_destination_deleted

254745

254746 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

254747

254748 - `APIActor object`

254749

254750 - `type: optional "api_actor"`

254751

254752 default: api_actor

254753

254754 - `api_key_id: string`

254755

254756 - `ip_address: string`

254757

254758 - `user_agent: string`

254759

254760 - `UserActor object`

254761

254762 - `type: optional "user_actor"`

254763

254764 default: user_actor

254765

254766 - `email_address: string`

254767

254768 format: email

254769

254770 - `ip_address: string`

254771

254772 - `user_agent: string`

254773

254774 - `user_id: string`

254775

254776 - `UnauthenticatedUserActor object`

254777

254778 - `type: optional "unauthenticated_user_actor"`

254779

254780 default: unauthenticated_user_actor

254781

254782 - `ip_address: string`

254783

254784 - `user_agent: string`

254785

254786 - `unauthenticated_email_address: optional string or null`

254787

254788 format: email

254789

254790 - `AnthropicActor object`

254791

254792 - `type: optional "anthropic_actor"`

254793

254794 default: anthropic_actor

254795

254796 - `email_address: optional string or null`

254797

254798 format: email

254799

254800 - `SystemActor object`

254801

254802 Automated background processing performed by Anthropic systems, acting

254803 without a user or customer credential.

254804

254805 - `type: optional "system_actor"`

254806

254807 default: system_actor

254808

254809 - `service: optional string or null`

254810

254811 Name of the automated process that performed the action, when known.

254812

254813 - `AdminAPIKeyActor object`

254814

254815 - `type: optional "admin_api_key_actor"`

254816

254817 default: admin_api_key_actor

254818

254819 - `admin_api_key_id: string`

254820

254821 - `ip_address: string`

254822

254823 - `user_agent: string`

254824

254825 - `ServiceAccountActor object`

254826

254827 - `type: optional "service_account_actor"`

254828

254829 default: service_account_actor

254830

254831 - `ip_address: string`

254832

254833 - `service_account_id: string`

254834

254835 - `user_agent: string`

254836

254837 - `ScimDirectorySyncActor object`

254838

254839 - `type: optional "scim_directory_sync_actor"`

254840

254841 default: scim_directory_sync_actor

254842

254843 - `directory_id: string`

254844

254845 - `workos_event_id: string`

254846

254847 - `idp_connection_type: optional string or null`

254848

254849 - `FederatedIdentityActor object`

254850

254851 A federated external workload authenticated via a verified OIDC token.

254852

254853 Carries the verified issuer, subject, and audience claims from the

254854 presented JWT.

254855

254856 - `type: optional "federated_identity_actor"`

254857

254858 default: federated_identity_actor

254859

254860 - `issuer: string`

254861

254862 - `subject: string`

254863

254864 - `audience: optional array of string`

254865

254866 - `ip_address: optional string or null`

254867

254868 - `user_agent: optional string or null`

254869

254870 - `FederatedActor object`

254871

254872 An external identity asserted by a trusted provider — a cloud-provider

254873 gateway or a customer-registered federation issuer — acting without an

254874 Anthropic-provisioned account or service account.

254875

254876 - `type: optional "federated_actor"`

254877

254878 default: federated_actor

254879

254880 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

254881

254882 - `FederatedActorAwsProvider object`

254883

254884 Asserting party: the AWS account the organization is bound to.

254885

254886 - `type: optional "aws"`

254887

254888 default: aws

254889

254890 - `account_id: string`

254891

254892 - `signed_principal: string`

254893

254894 The AWS-signed ARN of the IAM principal that requested the token.

254895

254896 - `FederatedActorAzureProvider object`

254897

254898 Asserting party: the Azure subscription the organization is bound to.

254899

254900 - `type: optional "azure"`

254901

254902 default: azure

254903

254904 - `subscription_id: string`

254905

254906 - `FederatedActorGcpProvider object`

254907

254908 Asserting party: the GCP project the organization is bound to.

254909

254910 - `type: optional "gcp"`

254911

254912 default: gcp

254913

254914 - `project_number: string`

254915

254916 - `FederatedActorOidcProvider object`

254917

254918 Asserting party: a customer-registered OIDC federation issuer.

254919

254920 - `type: optional "oidc"`

254921

254922 default: oidc

254923

254924 - `issuer: optional string or null`

254925

254926 The federation issuer's URL. Null when the presented credential failed verification.

254927

254928 - `ip_address: optional string or null`

254929

254930 - `subject: optional string or null`

254931

254932 The provider's verified identifier for the caller; its form depends on the provider.

254933

254934 - `user_agent: optional string or null`

254935

254936 - `AttestedDeviceActor object`

254937

254938 An attested mobile device authenticated via Apple App Attest.

254939

254940 - `type: optional "attested_device_actor"`

254941

254942 default: attested_device_actor

254943

254944 - `external_client_id: string`

254945

254946 - `kid_hash: string`

254947

254948 - `ip_address: optional string or null`

254949

254950 - `user_agent: optional string or null`

254951

254952 - `telemetry_destination_id: string`

254953

254954 Tagged telemetry destination ID, e.g. "tdst_01HX...".

254955

254956 - `id: optional string`

254957

254958 Unique identifier for the activity e.g. 'activity_abcd1234'

254959

254960 - `created_at: optional string`

254961

254962 When this activity occurred.

254963

254964 format: date-time

254965

254966 - `organization_id: optional string or null`

254967

254968 Organization ID this activity is associated with

254969

254970 - `organization_uuid: optional string or null`

254971

254972 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

254973

254974 - `PlatformTelemetryDestinationUpdated object`

254975

254976 A telemetry destination's configuration was updated. State changes and changes of its workspace scope (the type, or the list through an update's workspace_ids) are included; the workspaces an update took off or put on the list are also recorded as workspace_removed and workspace_added activities. Previous and current values are recorded only for the endpoint URL, the traces URL, the content mode and the workspaces type.

254977

254978 - `type: optional "platform_telemetry_destination_updated"`

254979

254980 default: platform_telemetry_destination_updated

254981

254982 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

254983

254984 - `APIActor object`

254985

254986 - `type: optional "api_actor"`

254987

254988 default: api_actor

254989

254990 - `api_key_id: string`

254991

254992 - `ip_address: string`

254993

254994 - `user_agent: string`

254995

254996 - `UserActor object`

254997

254998 - `type: optional "user_actor"`

254999

255000 default: user_actor

255001

255002 - `email_address: string`

255003

255004 format: email

255005

255006 - `ip_address: string`

255007

255008 - `user_agent: string`

255009

255010 - `user_id: string`

255011

255012 - `UnauthenticatedUserActor object`

255013

255014 - `type: optional "unauthenticated_user_actor"`

255015

255016 default: unauthenticated_user_actor

255017

255018 - `ip_address: string`

255019

255020 - `user_agent: string`

255021

255022 - `unauthenticated_email_address: optional string or null`

255023

255024 format: email

255025

255026 - `AnthropicActor object`

255027

255028 - `type: optional "anthropic_actor"`

255029

255030 default: anthropic_actor

255031

255032 - `email_address: optional string or null`

255033

255034 format: email

255035

255036 - `SystemActor object`

255037

255038 Automated background processing performed by Anthropic systems, acting

255039 without a user or customer credential.

255040

255041 - `type: optional "system_actor"`

255042

255043 default: system_actor

255044

255045 - `service: optional string or null`

255046

255047 Name of the automated process that performed the action, when known.

255048

255049 - `AdminAPIKeyActor object`

255050

255051 - `type: optional "admin_api_key_actor"`

255052

255053 default: admin_api_key_actor

255054

255055 - `admin_api_key_id: string`

255056

255057 - `ip_address: string`

255058

255059 - `user_agent: string`

255060

255061 - `ServiceAccountActor object`

255062

255063 - `type: optional "service_account_actor"`

255064

255065 default: service_account_actor

255066

255067 - `ip_address: string`

255068

255069 - `service_account_id: string`

255070

255071 - `user_agent: string`

255072

255073 - `ScimDirectorySyncActor object`

255074

255075 - `type: optional "scim_directory_sync_actor"`

255076

255077 default: scim_directory_sync_actor

255078

255079 - `directory_id: string`

255080

255081 - `workos_event_id: string`

255082

255083 - `idp_connection_type: optional string or null`

255084

255085 - `FederatedIdentityActor object`

255086

255087 A federated external workload authenticated via a verified OIDC token.

255088

255089 Carries the verified issuer, subject, and audience claims from the

255090 presented JWT.

255091

255092 - `type: optional "federated_identity_actor"`

255093

255094 default: federated_identity_actor

255095

255096 - `issuer: string`

255097

255098 - `subject: string`

255099

255100 - `audience: optional array of string`

255101

255102 - `ip_address: optional string or null`

255103

255104 - `user_agent: optional string or null`

255105

255106 - `FederatedActor object`

255107

255108 An external identity asserted by a trusted provider — a cloud-provider

255109 gateway or a customer-registered federation issuer — acting without an

255110 Anthropic-provisioned account or service account.

255111

255112 - `type: optional "federated_actor"`

255113

255114 default: federated_actor

255115

255116 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

255117

255118 - `FederatedActorAwsProvider object`

255119

255120 Asserting party: the AWS account the organization is bound to.

255121

255122 - `type: optional "aws"`

255123

255124 default: aws

255125

255126 - `account_id: string`

255127

255128 - `signed_principal: string`

255129

255130 The AWS-signed ARN of the IAM principal that requested the token.

255131

255132 - `FederatedActorAzureProvider object`

255133

255134 Asserting party: the Azure subscription the organization is bound to.

255135

255136 - `type: optional "azure"`

255137

255138 default: azure

255139

255140 - `subscription_id: string`

255141

255142 - `FederatedActorGcpProvider object`

255143

255144 Asserting party: the GCP project the organization is bound to.

255145

255146 - `type: optional "gcp"`

255147

255148 default: gcp

255149

255150 - `project_number: string`

255151

255152 - `FederatedActorOidcProvider object`

255153

255154 Asserting party: a customer-registered OIDC federation issuer.

255155

255156 - `type: optional "oidc"`

255157

255158 default: oidc

255159

255160 - `issuer: optional string or null`

255161

255162 The federation issuer's URL. Null when the presented credential failed verification.

255163

255164 - `ip_address: optional string or null`

255165

255166 - `subject: optional string or null`

255167

255168 The provider's verified identifier for the caller; its form depends on the provider.

255169

255170 - `user_agent: optional string or null`

255171

255172 - `AttestedDeviceActor object`

255173

255174 An attested mobile device authenticated via Apple App Attest.

255175

255176 - `type: optional "attested_device_actor"`

255177

255178 default: attested_device_actor

255179

255180 - `external_client_id: string`

255181

255182 - `kid_hash: string`

255183

255184 - `ip_address: optional string or null`

255185

255186 - `user_agent: optional string or null`

255187

255188 - `telemetry_destination_id: string`

255189

255190 Tagged telemetry destination ID, e.g. "tdst_01HX...".

255191

255192 - `id: optional string`

255193

255194 Unique identifier for the activity e.g. 'activity_abcd1234'

255195

255196 - `created_at: optional string`

255197

255198 When this activity occurred.

255199

255200 format: date-time

255201

255202 - `organization_id: optional string or null`

255203

255204 Organization ID this activity is associated with

255205

255206 - `organization_uuid: optional string or null`

255207

255208 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

255209

255210 - `updated_fields: optional array of string`

255211

255212 Names of the configuration fields whose value changed, e.g. "endpoint_url", "headers", "state"; "traces" when any setting for traces changed. Header names and values are never included.

255213

255214 - `updates: optional array of object`

255215

255216 The field-level value changes in this update, in this order: an "endpoint_url" entry when the endpoint URL changed, a "traces_endpoint_url" entry when the traces URL changed, a "traces_content_mode" entry when the content mode changed, and a "workspaces" entry ("all", "include" or "exclude") when the workspaces type changed; empty otherwise.

255217

255218 - `type: "endpoint_url" or "traces_content_mode" or "traces_endpoint_url" or 2 more`

255219

255220 The destination field that changed

255221

255222 - `"endpoint_url"`

255223

255224 - `"traces_content_mode"`

255225

255226 - `"traces_endpoint_url"`

255227

255228 - `"unspecified"`

255229

255230 - `"workspaces"`

255231

255232 - `current_value: string`

255233

255234 Field value immediately after this change

255235

255236 - `previous_value: string`

255237

255238 Field value immediately before this change

255239

255240 - `PlatformTelemetryDestinationWorkspaceAdded object`

255241

255242 A workspace was added to the workspace list of a telemetry destination. When the list type is "include", the destination starts to receive the spans of that workspace; when it is "exclude", the destination stops receiving them.

255243

255244 - `type: optional "platform_telemetry_destination_workspace_added"`

255245

255246 default: platform_telemetry_destination_workspace_added

255247

255248 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

255249

255250 - `APIActor object`

255251

255252 - `type: optional "api_actor"`

255253

255254 default: api_actor

255255

255256 - `api_key_id: string`

255257

255258 - `ip_address: string`

255259

255260 - `user_agent: string`

255261

255262 - `UserActor object`

255263

255264 - `type: optional "user_actor"`

255265

255266 default: user_actor

255267

255268 - `email_address: string`

255269

255270 format: email

255271

255272 - `ip_address: string`

255273

255274 - `user_agent: string`

255275

255276 - `user_id: string`

255277

255278 - `UnauthenticatedUserActor object`

255279

255280 - `type: optional "unauthenticated_user_actor"`

255281

255282 default: unauthenticated_user_actor

255283

255284 - `ip_address: string`

255285

255286 - `user_agent: string`

255287

255288 - `unauthenticated_email_address: optional string or null`

255289

255290 format: email

255291

255292 - `AnthropicActor object`

255293

255294 - `type: optional "anthropic_actor"`

255295

255296 default: anthropic_actor

255297

255298 - `email_address: optional string or null`

255299

255300 format: email

255301

255302 - `SystemActor object`

255303

255304 Automated background processing performed by Anthropic systems, acting

255305 without a user or customer credential.

255306

255307 - `type: optional "system_actor"`

255308

255309 default: system_actor

255310

255311 - `service: optional string or null`

255312

255313 Name of the automated process that performed the action, when known.

255314

255315 - `AdminAPIKeyActor object`

255316

255317 - `type: optional "admin_api_key_actor"`

255318

255319 default: admin_api_key_actor

255320

255321 - `admin_api_key_id: string`

255322

255323 - `ip_address: string`

255324

255325 - `user_agent: string`

255326

255327 - `ServiceAccountActor object`

255328

255329 - `type: optional "service_account_actor"`

255330

255331 default: service_account_actor

255332

255333 - `ip_address: string`

255334

255335 - `service_account_id: string`

255336

255337 - `user_agent: string`

255338

255339 - `ScimDirectorySyncActor object`

255340

255341 - `type: optional "scim_directory_sync_actor"`

255342

255343 default: scim_directory_sync_actor

255344

255345 - `directory_id: string`

255346

255347 - `workos_event_id: string`

255348

255349 - `idp_connection_type: optional string or null`

255350

255351 - `FederatedIdentityActor object`

255352

255353 A federated external workload authenticated via a verified OIDC token.

255354

255355 Carries the verified issuer, subject, and audience claims from the

255356 presented JWT.

255357

255358 - `type: optional "federated_identity_actor"`

255359

255360 default: federated_identity_actor

255361

255362 - `issuer: string`

255363

255364 - `subject: string`

255365

255366 - `audience: optional array of string`

255367

255368 - `ip_address: optional string or null`

255369

255370 - `user_agent: optional string or null`

255371

255372 - `FederatedActor object`

255373

255374 An external identity asserted by a trusted provider — a cloud-provider

255375 gateway or a customer-registered federation issuer — acting without an

255376 Anthropic-provisioned account or service account.

255377

255378 - `type: optional "federated_actor"`

255379

255380 default: federated_actor

255381

255382 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

255383

255384 - `FederatedActorAwsProvider object`

255385

255386 Asserting party: the AWS account the organization is bound to.

255387

255388 - `type: optional "aws"`

255389

255390 default: aws

255391

255392 - `account_id: string`

255393

255394 - `signed_principal: string`

255395

255396 The AWS-signed ARN of the IAM principal that requested the token.

255397

255398 - `FederatedActorAzureProvider object`

255399

255400 Asserting party: the Azure subscription the organization is bound to.

255401

255402 - `type: optional "azure"`

255403

255404 default: azure

255405

255406 - `subscription_id: string`

255407

255408 - `FederatedActorGcpProvider object`

255409

255410 Asserting party: the GCP project the organization is bound to.

255411

255412 - `type: optional "gcp"`

255413

255414 default: gcp

255415

255416 - `project_number: string`

255417

255418 - `FederatedActorOidcProvider object`

255419

255420 Asserting party: a customer-registered OIDC federation issuer.

255421

255422 - `type: optional "oidc"`

255423

255424 default: oidc

255425

255426 - `issuer: optional string or null`

255427

255428 The federation issuer's URL. Null when the presented credential failed verification.

255429

255430 - `ip_address: optional string or null`

255431

255432 - `subject: optional string or null`

255433

255434 The provider's verified identifier for the caller; its form depends on the provider.

255435

255436 - `user_agent: optional string or null`

255437

255438 - `AttestedDeviceActor object`

255439

255440 An attested mobile device authenticated via Apple App Attest.

255441

255442 - `type: optional "attested_device_actor"`

255443

255444 default: attested_device_actor

255445

255446 - `external_client_id: string`

255447

255448 - `kid_hash: string`

255449

255450 - `ip_address: optional string or null`

255451

255452 - `user_agent: optional string or null`

255453

255454 - `telemetry_destination_id: string`

255455

255456 Tagged telemetry destination ID, e.g. "tdst_01HX...".

255457

255458 - `workspace_id: string`

255459

255460 Tagged ID of the workspace put on the list, e.g. "wrkspc_01HX...".

255461

255462 - `id: optional string`

255463

255464 Unique identifier for the activity e.g. 'activity_abcd1234'

255465

255466 - `created_at: optional string`

255467

255468 When this activity occurred.

255469

255470 format: date-time

255471

255472 - `organization_id: optional string or null`

255473

255474 Organization ID this activity is associated with

255475

255476 - `organization_uuid: optional string or null`

255477

255478 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

255479

255480 - `PlatformTelemetryDestinationWorkspaceRemoved object`

255481

255482 A workspace was removed from the workspace list of a telemetry destination, by a change to the list or because the destination was deleted. When the list type is "include", the destination stops receiving the spans of that workspace; when it is "exclude", the destination receives them again unless the destination was deleted.

255483

255484 - `type: optional "platform_telemetry_destination_workspace_removed"`

255485

255486 default: platform_telemetry_destination_workspace_removed

255487

255488 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

255489

255490 - `APIActor object`

255491

255492 - `type: optional "api_actor"`

255493

255494 default: api_actor

255495

255496 - `api_key_id: string`

255497

255498 - `ip_address: string`

255499

255500 - `user_agent: string`

255501

255502 - `UserActor object`

255503

255504 - `type: optional "user_actor"`

255505

255506 default: user_actor

255507

255508 - `email_address: string`

255509

255510 format: email

255511

255512 - `ip_address: string`

255513

255514 - `user_agent: string`

255515

255516 - `user_id: string`

255517

255518 - `UnauthenticatedUserActor object`

255519

255520 - `type: optional "unauthenticated_user_actor"`

255521

255522 default: unauthenticated_user_actor

255523

255524 - `ip_address: string`

255525

255526 - `user_agent: string`

255527

255528 - `unauthenticated_email_address: optional string or null`

255529

255530 format: email

255531

255532 - `AnthropicActor object`

255533

255534 - `type: optional "anthropic_actor"`

255535

255536 default: anthropic_actor

255537

255538 - `email_address: optional string or null`

255539

255540 format: email

255541

255542 - `SystemActor object`

255543

255544 Automated background processing performed by Anthropic systems, acting

255545 without a user or customer credential.

255546

255547 - `type: optional "system_actor"`

255548

255549 default: system_actor

255550

255551 - `service: optional string or null`

255552

255553 Name of the automated process that performed the action, when known.

255554

255555 - `AdminAPIKeyActor object`

255556

255557 - `type: optional "admin_api_key_actor"`

255558

255559 default: admin_api_key_actor

255560

255561 - `admin_api_key_id: string`

255562

255563 - `ip_address: string`

255564

255565 - `user_agent: string`

255566

255567 - `ServiceAccountActor object`

255568

255569 - `type: optional "service_account_actor"`

255570

255571 default: service_account_actor

255572

255573 - `ip_address: string`

255574

255575 - `service_account_id: string`

255576

255577 - `user_agent: string`

255578

255579 - `ScimDirectorySyncActor object`

255580

255581 - `type: optional "scim_directory_sync_actor"`

255582

255583 default: scim_directory_sync_actor

255584

255585 - `directory_id: string`

255586

255587 - `workos_event_id: string`

255588

255589 - `idp_connection_type: optional string or null`

255590

255591 - `FederatedIdentityActor object`

255592

255593 A federated external workload authenticated via a verified OIDC token.

255594

255595 Carries the verified issuer, subject, and audience claims from the

255596 presented JWT.

255597

255598 - `type: optional "federated_identity_actor"`

255599

255600 default: federated_identity_actor

255601

255602 - `issuer: string`

255603

255604 - `subject: string`

255605

255606 - `audience: optional array of string`

255607

255608 - `ip_address: optional string or null`

255609

255610 - `user_agent: optional string or null`

255611

255612 - `FederatedActor object`

255613

255614 An external identity asserted by a trusted provider — a cloud-provider

255615 gateway or a customer-registered federation issuer — acting without an

255616 Anthropic-provisioned account or service account.

255617

255618 - `type: optional "federated_actor"`

255619

255620 default: federated_actor

255621

255622 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

255623

255624 - `FederatedActorAwsProvider object`

255625

255626 Asserting party: the AWS account the organization is bound to.

255627

255628 - `type: optional "aws"`

255629

255630 default: aws

255631

255632 - `account_id: string`

255633

255634 - `signed_principal: string`

255635

255636 The AWS-signed ARN of the IAM principal that requested the token.

255637

255638 - `FederatedActorAzureProvider object`

255639

255640 Asserting party: the Azure subscription the organization is bound to.

255641

255642 - `type: optional "azure"`

255643

255644 default: azure

255645

255646 - `subscription_id: string`

255647

255648 - `FederatedActorGcpProvider object`

255649

255650 Asserting party: the GCP project the organization is bound to.

255651

255652 - `type: optional "gcp"`

255653

255654 default: gcp

255655

255656 - `project_number: string`

255657

255658 - `FederatedActorOidcProvider object`

255659

255660 Asserting party: a customer-registered OIDC federation issuer.

255661

255662 - `type: optional "oidc"`

255663

255664 default: oidc

255665

255666 - `issuer: optional string or null`

255667

255668 The federation issuer's URL. Null when the presented credential failed verification.

255669

255670 - `ip_address: optional string or null`

255671

255672 - `subject: optional string or null`

255673

255674 The provider's verified identifier for the caller; its form depends on the provider.

255675

255676 - `user_agent: optional string or null`

255677

255678 - `AttestedDeviceActor object`

255679

255680 An attested mobile device authenticated via Apple App Attest.

255681

255682 - `type: optional "attested_device_actor"`

255683

255684 default: attested_device_actor

255685

255686 - `external_client_id: string`

255687

255688 - `kid_hash: string`

255689

255690 - `ip_address: optional string or null`

255691

255692 - `user_agent: optional string or null`

255693

255694 - `telemetry_destination_id: string`

255695

255696 Tagged telemetry destination ID, e.g. "tdst_01HX...".

255697

255698 - `workspace_id: string`

255699

255700 Tagged ID of the workspace taken off the list, e.g. "wrkspc_01HX...".

255701

255702 - `id: optional string`

255703

255704 Unique identifier for the activity e.g. 'activity_abcd1234'

255705

255706 - `created_at: optional string`

255707

255708 When this activity occurred.

255709

255710 format: date-time

255711

255712 - `organization_id: optional string or null`

255713

255714 Organization ID this activity is associated with

255715

255716 - `organization_uuid: optional string or null`

255717

255718 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

255719

248456255720 - `PlatformUsageReportClaudeCodeViewed object`

248457255721

248458255722 The Claude Code usage report was viewed.

248459255723

api/compliance/activities/list Changed · +3697 / -9 lines

This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.

The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.

from line 15

1515

1616## Query parameters

1717

18- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 544 more`

18- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "account_migration_completed" or 558 more`

1919

2020 Filter activities by type. See the response `data` schema for the additional fields each type returns. Cannot be combined with `exclude_activity_types[]`.

2121

from line 27

2727

2828 User-initiated self-service account deletion.

2929

30 - `"account_migration_completed"`

32 A personal Claude account's migration into the organization finished: the migrated data is now part of the organization.

34 - `"account_migration_failed"`

36 A personal Claude account's migration into the organization did not complete.

38 - `"account_migration_started"`

40 A personal Claude account began migrating into the organization: its data, including conversations, projects and files, is being moved from the member's personal account into this organization.

3042 - `"admin_api_key_created"`

3143

3244 An admin API key was created.

from line 359

347359

348360 Claude Code Review configuration was enabled/disabled for an org.

349361

362 - `"claude_code_review_promo_enrolled"`

363

364 An organization admin enrolled the organization in a Claude Code Review promotion, for example by claiming promotional credits.

365

350366 - `"claude_code_review_repository_added"`

351367

352368 A repository was added to org-level Claude Code Review configuration.

from line 417

401417

402418 - `"claude_code_security_scan_project_updated"`

403419

404 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience.

420 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience, or a user paused the project's scheduled scanning, unpaused it, or lifted a billing pause on it.

405421

406422 - `"claude_code_security_scan_project_visibility_updated"`

407423

from line 735

719735

720736 SAML IdP configuration updated for a public sector organization.

721737

738 - `"claude_skill_auto_disabled"`

739

740 A skill that had been turned on for a member automatically was turned off for them automatically, not by the member; reason says why. A member turning a skill off themselves is recorded as claude_skill_disabled.

741

742 - `"claude_skill_auto_enabled"`

743

744 A skill was turned on for a member automatically, not by the member; trigger gives the cause, such as another member sharing an eligible skill with them. A member turning a skill on themselves is recorded as claude_skill_enabled.

745

722746 - `"claude_skill_created"`

723747

724748 Skill was created.

from line 895

871895

872896 A new version of an existing org-owned desktop extension was uploaded.

873897

898 - `"domain_claim_cancelled"`

899

900 A pending domain claim was cancelled before it took effect, so the personal accounts on the claimed domains will no longer be migrated or deactivated at its deadline.

901

902 - `"domain_claim_deadline_updated"`

903

904 The migration deadline of a pending domain claim was moved to a later or an earlier date by Anthropic staff or an automated process.

905

874906 - `"domain_claim_initiated"`

875907

876908 Domain capture claim initiated over personal accounts on verified domains.

from line 1907

18751907

18761908 An org-level spend limit snooze/ignore state was changed.

18771909

1910 - `"platform_telemetry_destination_auto_disabled"`

1911

1912 A telemetry destination was disabled automatically after deliveries to it failed, so no telemetry is sent to it until an administrator enables it again.

1913

1914 - `"platform_telemetry_destination_created"`

1915

1916 A telemetry destination was registered for the organization.

1917

1918 - `"platform_telemetry_destination_deleted"`

1919

1920 A telemetry destination was deleted.

1921

1922 - `"platform_telemetry_destination_updated"`

1923

1924 A telemetry destination's configuration was updated. State changes and changes of its workspace scope (the type, or the list through an update's workspace_ids) are included; the workspaces an update took off or put on the list are also recorded as workspace_removed and workspace_added activities. Previous and current values are recorded only for the endpoint URL, the traces URL, the content mode and the workspaces type.

1925

1926 - `"platform_telemetry_destination_workspace_added"`

1927

1928 A workspace was added to the workspace list of a telemetry destination. When the list type is "include", the destination starts to receive the spans of that workspace; when it is "exclude", the destination stops receiving them.

1929

1930 - `"platform_telemetry_destination_workspace_removed"`

1931

1932 A workspace was removed from the workspace list of a telemetry destination, by a change to the list or because the destination was deleted. When the list type is "include", the destination stops receiving the spans of that workspace; when it is "exclude", the destination receives them again unless the destination was deleted.

1933

18781934 - `"platform_usage_report_claude_code_viewed"`

18791935

18801936 The Claude Code usage report was viewed.

from line 2318

22622318

22632319 format: date-time

22642320

2265- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 544 more`

2321- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "account_migration_completed" or 558 more`

22662322

22672323 Exclude activities of these types. Cannot be combined with `activity_types[]`.

22682324

from line 2330

22742330

22752331 User-initiated self-service account deletion.

22762332

2333 - `"account_migration_completed"`

2334

2335 A personal Claude account's migration into the organization finished: the migrated data is now part of the organization.

2336

2337 - `"account_migration_failed"`

2338

2339 A personal Claude account's migration into the organization did not complete.

2340

2341 - `"account_migration_started"`

2342

2343 A personal Claude account began migrating into the organization: its data, including conversations, projects and files, is being moved from the member's personal account into this organization.

2344

22772345 - `"admin_api_key_created"`

22782346

22792347 An admin API key was created.

from line 2662

25942662

25952663 Claude Code Review configuration was enabled/disabled for an org.

25962664

2665 - `"claude_code_review_promo_enrolled"`

2666

2667 An organization admin enrolled the organization in a Claude Code Review promotion, for example by claiming promotional credits.

2668

25972669 - `"claude_code_review_repository_added"`

25982670

25992671 A repository was added to org-level Claude Code Review configuration.

from line 2720

26482720

26492721 - `"claude_code_security_scan_project_updated"`

26502722

2651 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience.

2723 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience, or a user paused the project's scheduled scanning, unpaused it, or lifted a billing pause on it.

26522724

26532725 - `"claude_code_security_scan_project_visibility_updated"`

26542726

from line 3038

29663038

29673039 SAML IdP configuration updated for a public sector organization.

29683040

3041 - `"claude_skill_auto_disabled"`

3042

3043 A skill that had been turned on for a member automatically was turned off for them automatically, not by the member; reason says why. A member turning a skill off themselves is recorded as claude_skill_disabled.

3044

3045 - `"claude_skill_auto_enabled"`

3046

3047 A skill was turned on for a member automatically, not by the member; trigger gives the cause, such as another member sharing an eligible skill with them. A member turning a skill on themselves is recorded as claude_skill_enabled.

3048

29693049 - `"claude_skill_created"`

29703050

29713051 Skill was created.

from line 3198

31183198

31193199 A new version of an existing org-owned desktop extension was uploaded.

31203200

3201 - `"domain_claim_cancelled"`

3202

3203 A pending domain claim was cancelled before it took effect, so the personal accounts on the claimed domains will no longer be migrated or deactivated at its deadline.

3204

3205 - `"domain_claim_deadline_updated"`

3206

3207 The migration deadline of a pending domain claim was moved to a later or an earlier date by Anthropic staff or an automated process.

3208

31213209 - `"domain_claim_initiated"`

31223210

31233211 Domain capture claim initiated over personal accounts on verified domains.

from line 4210

41224210

41234211 An org-level spend limit snooze/ignore state was changed.

41244212

4213 - `"platform_telemetry_destination_auto_disabled"`

4214

4215 A telemetry destination was disabled automatically after deliveries to it failed, so no telemetry is sent to it until an administrator enables it again.

4216

4217 - `"platform_telemetry_destination_created"`

4218

4219 A telemetry destination was registered for the organization.

4220

4221 - `"platform_telemetry_destination_deleted"`

4222

4223 A telemetry destination was deleted.

4224

4225 - `"platform_telemetry_destination_updated"`

4226

4227 A telemetry destination's configuration was updated. State changes and changes of its workspace scope (the type, or the list through an update's workspace_ids) are included; the workspaces an update took off or put on the list are also recorded as workspace_removed and workspace_added activities. Previous and current values are recorded only for the endpoint URL, the traces URL, the content mode and the workspaces type.

4228

4229 - `"platform_telemetry_destination_workspace_added"`

4230

4231 A workspace was added to the workspace list of a telemetry destination. When the list type is "include", the destination starts to receive the spans of that workspace; when it is "exclude", the destination stops receiving them.

4232

4233 - `"platform_telemetry_destination_workspace_removed"`

4234

4235 A workspace was removed from the workspace list of a telemetry destination, by a change to the list or because the destination was deleted. When the list type is "include", the destination stops receiving the spans of that workspace; when it is "exclude", the destination receives them again unless the destination was deleted.

4236

41254237 - `"platform_usage_report_claude_code_viewed"`

41264238

41274239 The Claude Code usage report was viewed.

from line 4619

45074619

45084620## Returns

45094621

4510- `data: optional array of AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 544 more`

4622- `data: optional array of AbuseDecisionReceived or AccountDeleted or AccountMigrationCompleted or 558 more`

45114623

45124624 List of activity records. Each element's `type` field identifies which activity it is and which additional fields are present.

45134625

from line 5099

49875099

49885100 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

49895101

5102 - `AccountMigrationCompleted object`

5103

5104 A personal Claude account's migration into the organization finished: the migrated data is now part of the organization.

5105

5106 - `type: optional "account_migration_completed"`

5107

5108 default: account_migration_completed

5109

5110 - `account_migration_id: string`

5111

5112 Tagged ID of the migration, e.g. "amig_...", matching the account_migration_started activity that opened it.

5113

5114 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

5115

5116 - `APIActor object`

5117

5118 - `type: optional "api_actor"`

5119

5120 default: api_actor

5121

5122 - `api_key_id: string`

5123

5124 - `ip_address: string`

5125

5126 - `user_agent: string`

5127

5128 - `UserActor object`

5129

5130 - `type: optional "user_actor"`

5131

5132 default: user_actor

5133

5134 - `email_address: string`

5135

5136 format: email

5137

5138 - `ip_address: string`

5139

5140 - `user_agent: string`

5141

5142 - `user_id: string`

5143

5144 - `UnauthenticatedUserActor object`

5145

5146 - `type: optional "unauthenticated_user_actor"`

5147

5148 default: unauthenticated_user_actor

5149

5150 - `ip_address: string`

5151

5152 - `user_agent: string`

5153

5154 - `unauthenticated_email_address: optional string or null`

5155

5156 format: email

5157

5158 - `AnthropicActor object`

5159

5160 - `type: optional "anthropic_actor"`

5161

5162 default: anthropic_actor

5163

5164 - `email_address: optional string or null`

5165

5166 format: email

5167

5168 - `SystemActor object`

5169

5170 Automated background processing performed by Anthropic systems, acting

5171 without a user or customer credential.

5172

5173 - `type: optional "system_actor"`

5174

5175 default: system_actor

5176

5177 - `service: optional string or null`

5178

5179 Name of the automated process that performed the action, when known.

5180

5181 - `AdminAPIKeyActor object`

5182

5183 - `type: optional "admin_api_key_actor"`

5184

5185 default: admin_api_key_actor

5186

5187 - `admin_api_key_id: string`

5188

5189 - `ip_address: string`

5190

5191 - `user_agent: string`

5192

5193 - `ServiceAccountActor object`

5194

5195 - `type: optional "service_account_actor"`

5196

5197 default: service_account_actor

5198

5199 - `ip_address: string`

5200

5201 - `service_account_id: string`

5202

5203 - `user_agent: string`

5204

5205 - `ScimDirectorySyncActor object`

5206

5207 - `type: optional "scim_directory_sync_actor"`

5208

5209 default: scim_directory_sync_actor

5210

5211 - `directory_id: string`

5212

5213 - `workos_event_id: string`

5214

5215 - `idp_connection_type: optional string or null`

5216

5217 - `FederatedIdentityActor object`

5218

5219 A federated external workload authenticated via a verified OIDC token.

5220

5221 Carries the verified issuer, subject, and audience claims from the

5222 presented JWT.

5223

5224 - `type: optional "federated_identity_actor"`

5225

5226 default: federated_identity_actor

5227

5228 - `issuer: string`

5229

5230 - `subject: string`

5231

5232 - `audience: optional array of string`

5233

5234 - `ip_address: optional string or null`

5235

5236 - `user_agent: optional string or null`

5237

5238 - `FederatedActor object`

5239

5240 An external identity asserted by a trusted provider — a cloud-provider

5241 gateway or a customer-registered federation issuer — acting without an

5242 Anthropic-provisioned account or service account.

5243

5244 - `type: optional "federated_actor"`

5245

5246 default: federated_actor

5247

5248 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

5249

5250 - `FederatedActorAwsProvider object`

5251

5252 Asserting party: the AWS account the organization is bound to.

5253

5254 - `type: optional "aws"`

5255

5256 default: aws

5257

5258 - `account_id: string`

5259

5260 - `signed_principal: string`

5261

5262 The AWS-signed ARN of the IAM principal that requested the token.

5263

5264 - `FederatedActorAzureProvider object`

5265

5266 Asserting party: the Azure subscription the organization is bound to.

5267

5268 - `type: optional "azure"`

5269

5270 default: azure

5271

5272 - `subscription_id: string`

5273

5274 - `FederatedActorGcpProvider object`

5275

5276 Asserting party: the GCP project the organization is bound to.

5277

5278 - `type: optional "gcp"`

5279

5280 default: gcp

5281

5282 - `project_number: string`

5283

5284 - `FederatedActorOidcProvider object`

5285

5286 Asserting party: a customer-registered OIDC federation issuer.

5287

5288 - `type: optional "oidc"`

5289

5290 default: oidc

5291

5292 - `issuer: optional string or null`

5293

5294 The federation issuer's URL. Null when the presented credential failed verification.

5295

5296 - `ip_address: optional string or null`

5297

5298 - `subject: optional string or null`

5299

5300 The provider's verified identifier for the caller; its form depends on the provider.

5301

5302 - `user_agent: optional string or null`

5303

5304 - `AttestedDeviceActor object`

5305

5306 An attested mobile device authenticated via Apple App Attest.

5307

5308 - `type: optional "attested_device_actor"`

5309

5310 default: attested_device_actor

5311

5312 - `external_client_id: string`

5313

5314 - `kid_hash: string`

5315

5316 - `ip_address: optional string or null`

5317

5318 - `user_agent: optional string or null`

5319

5320 - `id: optional string`

5321

5322 Unique identifier for the activity e.g. 'activity_abcd1234'

5323

5324 - `created_at: optional string`

5325

5326 When this activity occurred.

5327

5328 format: date-time

5329

5330 - `migrated_user_email: optional string or null`

5331

5332 Email address of the user whose personal account was migrated, when known.

5333

5334 - `migrated_user_id: optional string or null`

5335

5336 Tagged ID of the user whose personal account was migrated, e.g. "user_...", when known.

5337

5338 - `organization_id: optional string or null`

5339

5340 Organization ID this activity is associated with

5341

5342 - `organization_uuid: optional string or null`

5343

5344 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

5345

5346 - `AccountMigrationFailed object`

5347

5348 A personal Claude account's migration into the organization did not complete.

5349

5350 - `type: optional "account_migration_failed"`

5351

5352 default: account_migration_failed

5353

5354 - `account_migration_id: string`

5355

5356 Tagged ID of the migration, e.g. "amig_...", matching the account_migration_started activity that opened it, if one was recorded; a later retry is a new migration with its own ID.

5357

5358 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

5359

5360 - `APIActor object`

5361

5362 - `type: optional "api_actor"`

5363

5364 default: api_actor

5365

5366 - `api_key_id: string`

5367

5368 - `ip_address: string`

5369

5370 - `user_agent: string`

5371

5372 - `UserActor object`

5373

5374 - `type: optional "user_actor"`

5375

5376 default: user_actor

5377

5378 - `email_address: string`

5379

5380 format: email

5381

5382 - `ip_address: string`

5383

5384 - `user_agent: string`

5385

5386 - `user_id: string`

5387

5388 - `UnauthenticatedUserActor object`

5389

5390 - `type: optional "unauthenticated_user_actor"`

5391

5392 default: unauthenticated_user_actor

5393

5394 - `ip_address: string`

5395

5396 - `user_agent: string`

5397

5398 - `unauthenticated_email_address: optional string or null`

5399

5400 format: email

5401

5402 - `AnthropicActor object`

5403

5404 - `type: optional "anthropic_actor"`

5405

5406 default: anthropic_actor

5407

5408 - `email_address: optional string or null`

5409

5410 format: email

5411

5412 - `SystemActor object`

5413

5414 Automated background processing performed by Anthropic systems, acting

5415 without a user or customer credential.

5416

5417 - `type: optional "system_actor"`

5418

5419 default: system_actor

5420

5421 - `service: optional string or null`

5422

5423 Name of the automated process that performed the action, when known.

5424

5425 - `AdminAPIKeyActor object`

5426

5427 - `type: optional "admin_api_key_actor"`

5428

5429 default: admin_api_key_actor

5430

5431 - `admin_api_key_id: string`

5432

5433 - `ip_address: string`

5434

5435 - `user_agent: string`

5436

5437 - `ServiceAccountActor object`

5438

5439 - `type: optional "service_account_actor"`

5440

5441 default: service_account_actor

5442

5443 - `ip_address: string`

5444

5445 - `service_account_id: string`

5446

5447 - `user_agent: string`

5448

5449 - `ScimDirectorySyncActor object`

5450

5451 - `type: optional "scim_directory_sync_actor"`

5452

5453 default: scim_directory_sync_actor

5454

5455 - `directory_id: string`

5456

5457 - `workos_event_id: string`

5458

5459 - `idp_connection_type: optional string or null`

5460

5461 - `FederatedIdentityActor object`

5462

5463 A federated external workload authenticated via a verified OIDC token.

5464

5465 Carries the verified issuer, subject, and audience claims from the

5466 presented JWT.

5467

5468 - `type: optional "federated_identity_actor"`

5469

5470 default: federated_identity_actor

5471

5472 - `issuer: string`

5473

5474 - `subject: string`

5475

5476 - `audience: optional array of string`

5477

5478 - `ip_address: optional string or null`

5479

5480 - `user_agent: optional string or null`

5481

5482 - `FederatedActor object`

5483

5484 An external identity asserted by a trusted provider — a cloud-provider

5485 gateway or a customer-registered federation issuer — acting without an

5486 Anthropic-provisioned account or service account.

5487

5488 - `type: optional "federated_actor"`

5489

5490 default: federated_actor

5491

5492 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

5493

5494 - `FederatedActorAwsProvider object`

5495

5496 Asserting party: the AWS account the organization is bound to.

5497

5498 - `type: optional "aws"`

5499

5500 default: aws

5501

5502 - `account_id: string`

5503

5504 - `signed_principal: string`

5505

5506 The AWS-signed ARN of the IAM principal that requested the token.

5507

5508 - `FederatedActorAzureProvider object`

5509

5510 Asserting party: the Azure subscription the organization is bound to.

5511

5512 - `type: optional "azure"`

5513

5514 default: azure

5515

5516 - `subscription_id: string`

5517

5518 - `FederatedActorGcpProvider object`

5519

5520 Asserting party: the GCP project the organization is bound to.

5521

5522 - `type: optional "gcp"`

5523

5524 default: gcp

5525

5526 - `project_number: string`

5527

5528 - `FederatedActorOidcProvider object`

5529

5530 Asserting party: a customer-registered OIDC federation issuer.

5531

5532 - `type: optional "oidc"`

5533

5534 default: oidc

5535

5536 - `issuer: optional string or null`

5537

5538 The federation issuer's URL. Null when the presented credential failed verification.

5539

5540 - `ip_address: optional string or null`

5541

5542 - `subject: optional string or null`

5543

5544 The provider's verified identifier for the caller; its form depends on the provider.

5545

5546 - `user_agent: optional string or null`

5547

5548 - `AttestedDeviceActor object`

5549

5550 An attested mobile device authenticated via Apple App Attest.

5551

5552 - `type: optional "attested_device_actor"`

5553

5554 default: attested_device_actor

5555

5556 - `external_client_id: string`

5557

5558 - `kid_hash: string`

5559

5560 - `ip_address: optional string or null`

5561

5562 - `user_agent: optional string or null`

5563

5564 - `id: optional string`

5565

5566 Unique identifier for the activity e.g. 'activity_abcd1234'

5567

5568 - `created_at: optional string`

5569

5570 When this activity occurred.

5571

5572 format: date-time

5573

5574 - `failure_reasons: optional array of "already_member_of_target" or "already_migrating" or "anthropic_staff_action" or 12 more`

5575

5576 Why the migration did not complete, each reason listed once. In these values "source" is the member's personal account and "target" is this organization. "source_equals_target", "source_not_personal_org", "user_not_member_of_source" and "user_not_sole_member_of_source": the account is not a single-member personal account that can be migrated. "target_not_enterprise_org": this organization's plan does not accept the migration. "already_member_of_target": the migration already happened. "target_membership_not_provisioned" and "target_membership_unassigned_no_seats": the member has no usable seat in this organization. "already_migrating": another migration of the same account is in progress. "source_too_large": the personal account holds more data than a migration can move. "target_became_inactive": this organization became inactive before the migration finished. "migration_failed": an error stopped the migration. "anthropic_staff_action": Anthropic staff stopped the migration. "migration_blocked_redacted": stands in for every reason that is not shared with the organization. Values may be added over time; treat an unrecognized value as a generic failure. "unspecified" is never emitted.

5577

5578 - `"already_member_of_target"`

5579

5580 - `"already_migrating"`

5581

5582 - `"anthropic_staff_action"`

5583

5584 - `"migration_blocked_redacted"`

5585

5586 - `"migration_failed"`

5587

5588 - `"source_equals_target"`

5589

5590 - `"source_not_personal_org"`

5591

5592 - `"source_too_large"`

5593

5594 - `"target_became_inactive"`

5595

5596 - `"target_membership_not_provisioned"`

5597

5598 - `"target_membership_unassigned_no_seats"`

5599

5600 - `"target_not_enterprise_org"`

5601

5602 - `"unspecified"`

5603

5604 - `"user_not_member_of_source"`

5605

5606 - `"user_not_sole_member_of_source"`

5607

5608 - `migrated_user_email: optional string or null`

5609

5610 Email address of the user whose personal account was being migrated, when known.

5611

5612 - `migrated_user_id: optional string or null`

5613

5614 Tagged ID of the user whose personal account was being migrated, e.g. "user_...", when known.

5615

5616 - `organization_id: optional string or null`

5617

5618 Organization ID this activity is associated with

5619

5620 - `organization_uuid: optional string or null`

5621

5622 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

5623

5624 - `AccountMigrationStarted object`

5625

5626 A personal Claude account began migrating into the organization: its data, including conversations, projects and files, is being moved from the member's personal account into this organization.

5627

5628 - `type: optional "account_migration_started"`

5629

5630 default: account_migration_started

5631

5632 - `account_migration_id: string`

5633

5634 Tagged ID of the migration, e.g. "amig_...". The same ID appears on the completed or failed activity that closes the migration, when one is recorded.

5635

5636 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

5637

5638 - `APIActor object`

5639

5640 - `type: optional "api_actor"`

5641

5642 default: api_actor

5643

5644 - `api_key_id: string`

5645

5646 - `ip_address: string`

5647

5648 - `user_agent: string`

5649

5650 - `UserActor object`

5651

5652 - `type: optional "user_actor"`

5653

5654 default: user_actor

5655

5656 - `email_address: string`

5657

5658 format: email

5659

5660 - `ip_address: string`

5661

5662 - `user_agent: string`

5663

5664 - `user_id: string`

5665

5666 - `UnauthenticatedUserActor object`

5667

5668 - `type: optional "unauthenticated_user_actor"`

5669

5670 default: unauthenticated_user_actor

5671

5672 - `ip_address: string`

5673

5674 - `user_agent: string`

5675

5676 - `unauthenticated_email_address: optional string or null`

5677

5678 format: email

5679

5680 - `AnthropicActor object`

5681

5682 - `type: optional "anthropic_actor"`

5683

5684 default: anthropic_actor

5685

5686 - `email_address: optional string or null`

5687

5688 format: email

5689

5690 - `SystemActor object`

5691

5692 Automated background processing performed by Anthropic systems, acting

5693 without a user or customer credential.

5694

5695 - `type: optional "system_actor"`

5696

5697 default: system_actor

5698

5699 - `service: optional string or null`

5700

5701 Name of the automated process that performed the action, when known.

5702

5703 - `AdminAPIKeyActor object`

5704

5705 - `type: optional "admin_api_key_actor"`

5706

5707 default: admin_api_key_actor

5708

5709 - `admin_api_key_id: string`

5710

5711 - `ip_address: string`

5712

5713 - `user_agent: string`

5714

5715 - `ServiceAccountActor object`

5716

5717 - `type: optional "service_account_actor"`

5718

5719 default: service_account_actor

5720

5721 - `ip_address: string`

5722

5723 - `service_account_id: string`

5724

5725 - `user_agent: string`

5726

5727 - `ScimDirectorySyncActor object`

5728

5729 - `type: optional "scim_directory_sync_actor"`

5730

5731 default: scim_directory_sync_actor

5732

5733 - `directory_id: string`

5734

5735 - `workos_event_id: string`

5736

5737 - `idp_connection_type: optional string or null`

5738

5739 - `FederatedIdentityActor object`

5740

5741 A federated external workload authenticated via a verified OIDC token.

5742

5743 Carries the verified issuer, subject, and audience claims from the

5744 presented JWT.

5745

5746 - `type: optional "federated_identity_actor"`

5747

5748 default: federated_identity_actor

5749

5750 - `issuer: string`

5751

5752 - `subject: string`

5753

5754 - `audience: optional array of string`

5755

5756 - `ip_address: optional string or null`

5757

5758 - `user_agent: optional string or null`

5759

5760 - `FederatedActor object`

5761

5762 An external identity asserted by a trusted provider — a cloud-provider

5763 gateway or a customer-registered federation issuer — acting without an

5764 Anthropic-provisioned account or service account.

5765

5766 - `type: optional "federated_actor"`

5767

5768 default: federated_actor

5769

5770 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

5771

5772 - `FederatedActorAwsProvider object`

5773

5774 Asserting party: the AWS account the organization is bound to.

5775

5776 - `type: optional "aws"`

5777

5778 default: aws

5779

5780 - `account_id: string`

5781

5782 - `signed_principal: string`

5783

5784 The AWS-signed ARN of the IAM principal that requested the token.

5785

5786 - `FederatedActorAzureProvider object`

5787

5788 Asserting party: the Azure subscription the organization is bound to.

5789

5790 - `type: optional "azure"`

5791

5792 default: azure

5793

5794 - `subscription_id: string`

5795

5796 - `FederatedActorGcpProvider object`

5797

5798 Asserting party: the GCP project the organization is bound to.

5799

5800 - `type: optional "gcp"`

5801

5802 default: gcp

5803

5804 - `project_number: string`

5805

5806 - `FederatedActorOidcProvider object`

5807

5808 Asserting party: a customer-registered OIDC federation issuer.

5809

5810 - `type: optional "oidc"`

5811

5812 default: oidc

5813

5814 - `issuer: optional string or null`

5815

5816 The federation issuer's URL. Null when the presented credential failed verification.

5817

5818 - `ip_address: optional string or null`

5819

5820 - `subject: optional string or null`

5821

5822 The provider's verified identifier for the caller; its form depends on the provider.

5823

5824 - `user_agent: optional string or null`

5825

5826 - `AttestedDeviceActor object`

5827

5828 An attested mobile device authenticated via Apple App Attest.

5829

5830 - `type: optional "attested_device_actor"`

5831

5832 default: attested_device_actor

5833

5834 - `external_client_id: string`

5835

5836 - `kid_hash: string`

5837

5838 - `ip_address: optional string or null`

5839

5840 - `user_agent: optional string or null`

5841

5842 - `migrated_user_email: string`

5843

5844 Email address of the user whose personal account is being migrated.

5845

5846 - `migrated_user_id: string`

5847

5848 Tagged ID of the user whose personal account is being migrated, e.g. "user_...".

5849

5850 - `id: optional string`

5851

5852 Unique identifier for the activity e.g. 'activity_abcd1234'

5853

5854 - `created_at: optional string`

5855

5856 When this activity occurred.

5857

5858 format: date-time

5859

5860 - `organization_id: optional string or null`

5861

5862 Organization ID this activity is associated with

5863

5864 - `organization_uuid: optional string or null`

5865

5866 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

5867

49905868 - `AdminAPIKeyCreated object`

49915869

49925870 An admin API key was created.

from line 26353

2547526353

2547626354 Per-review spend limit in USD before the change. Absent when no configuration existed before this update or no limit was set.

2547726355

26356 - `previous_review_level: optional string or null`

26357

26358 Review level set for the organization's code reviews before the change: "low" (Quick), "medium" (Standard) or "high" (Deep). Absent when no configuration existed before this update or no level was set.

26359

2547826360 - `previous_show_tips: optional boolean or null`

2547926361

2548026362 Whether tip-style pull-request comments were enabled before the change. Absent when no configuration existed before this update.

from line 26365

2548326365

2548426366 Whether the verification stage of code review was enabled for the organization before the change. Absent when no configuration existed before this update or no preference was set.

2548526367

26368 - `review_level: optional string or null`

26369

26370 Review level now set for the organization's code reviews: "low" (Quick), "medium" (Standard) or "high" (Deep). Repositories without their own level use this one. Absent when no level is set; the default level, Standard, then applies.

26371

2548626372 - `show_tips: optional boolean or null`

2548726373

2548826374 Whether tip-style pull-request comments are now enabled

from line 26377

2549126377

2549226378 Whether the verification stage of code review is now enabled for the organization. Absent when the organization has not set a preference and the default applies.

2549326379

26380 - `ClaudeCodeReviewPromoEnrolled object`

26381

26382 An organization admin enrolled the organization in a Claude Code Review promotion, for example by claiming promotional credits.

26383

26384 - `type: optional "claude_code_review_promo_enrolled"`

26385

26386 default: claude_code_review_promo_enrolled

26387

26388 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

26389

26390 - `APIActor object`

26391

26392 - `type: optional "api_actor"`

26393

26394 default: api_actor

26395

26396 - `api_key_id: string`

26397

26398 - `ip_address: string`

26399

26400 - `user_agent: string`

26401

26402 - `UserActor object`

26403

26404 - `type: optional "user_actor"`

26405

26406 default: user_actor

26407

26408 - `email_address: string`

26409

26410 format: email

26411

26412 - `ip_address: string`

26413

26414 - `user_agent: string`

26415

26416 - `user_id: string`

26417

26418 - `UnauthenticatedUserActor object`

26419

26420 - `type: optional "unauthenticated_user_actor"`

26421

26422 default: unauthenticated_user_actor

26423

26424 - `ip_address: string`

26425

26426 - `user_agent: string`

26427

26428 - `unauthenticated_email_address: optional string or null`

26429

26430 format: email

26431

26432 - `AnthropicActor object`

26433

26434 - `type: optional "anthropic_actor"`

26435

26436 default: anthropic_actor

26437

26438 - `email_address: optional string or null`

26439

26440 format: email

26441

26442 - `SystemActor object`

26443

26444 Automated background processing performed by Anthropic systems, acting

26445 without a user or customer credential.

26446

26447 - `type: optional "system_actor"`

26448

26449 default: system_actor

26450

26451 - `service: optional string or null`

26452

26453 Name of the automated process that performed the action, when known.

26454

26455 - `AdminAPIKeyActor object`

26456

26457 - `type: optional "admin_api_key_actor"`

26458

26459 default: admin_api_key_actor

26460

26461 - `admin_api_key_id: string`

26462

26463 - `ip_address: string`

26464

26465 - `user_agent: string`

26466

26467 - `ServiceAccountActor object`

26468

26469 - `type: optional "service_account_actor"`

26470

26471 default: service_account_actor

26472

26473 - `ip_address: string`

26474

26475 - `service_account_id: string`

26476

26477 - `user_agent: string`

26478

26479 - `ScimDirectorySyncActor object`

26480

26481 - `type: optional "scim_directory_sync_actor"`

26482

26483 default: scim_directory_sync_actor

26484

26485 - `directory_id: string`

26486

26487 - `workos_event_id: string`

26488

26489 - `idp_connection_type: optional string or null`

26490

26491 - `FederatedIdentityActor object`

26492

26493 A federated external workload authenticated via a verified OIDC token.

26494

26495 Carries the verified issuer, subject, and audience claims from the

26496 presented JWT.

26497

26498 - `type: optional "federated_identity_actor"`

26499

26500 default: federated_identity_actor

26501

26502 - `issuer: string`

26503

26504 - `subject: string`

26505

26506 - `audience: optional array of string`

26507

26508 - `ip_address: optional string or null`

26509

26510 - `user_agent: optional string or null`

26511

26512 - `FederatedActor object`

26513

26514 An external identity asserted by a trusted provider — a cloud-provider

26515 gateway or a customer-registered federation issuer — acting without an

26516 Anthropic-provisioned account or service account.

26517

26518 - `type: optional "federated_actor"`

26519

26520 default: federated_actor

26521

26522 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

26523

26524 - `FederatedActorAwsProvider object`

26525

26526 Asserting party: the AWS account the organization is bound to.

26527

26528 - `type: optional "aws"`

26529

26530 default: aws

26531

26532 - `account_id: string`

26533

26534 - `signed_principal: string`

26535

26536 The AWS-signed ARN of the IAM principal that requested the token.

26537

26538 - `FederatedActorAzureProvider object`

26539

26540 Asserting party: the Azure subscription the organization is bound to.

26541

26542 - `type: optional "azure"`

26543

26544 default: azure

26545

26546 - `subscription_id: string`

26547

26548 - `FederatedActorGcpProvider object`

26549

26550 Asserting party: the GCP project the organization is bound to.

26551

26552 - `type: optional "gcp"`

26553

26554 default: gcp

26555

26556 - `project_number: string`

26557

26558 - `FederatedActorOidcProvider object`

26559

26560 Asserting party: a customer-registered OIDC federation issuer.

26561

26562 - `type: optional "oidc"`

26563

26564 default: oidc

26565

26566 - `issuer: optional string or null`

26567

26568 The federation issuer's URL. Null when the presented credential failed verification.

26569

26570 - `ip_address: optional string or null`

26571

26572 - `subject: optional string or null`

26573

26574 The provider's verified identifier for the caller; its form depends on the provider.

26575

26576 - `user_agent: optional string or null`

26577

26578 - `AttestedDeviceActor object`

26579

26580 An attested mobile device authenticated via Apple App Attest.

26581

26582 - `type: optional "attested_device_actor"`

26583

26584 default: attested_device_actor

26585

26586 - `external_client_id: string`

26587

26588 - `kid_hash: string`

26589

26590 - `ip_address: optional string or null`

26591

26592 - `user_agent: optional string or null`

26593

26594 - `promo_id: string`

26595

26596 Identifier of the promotion the organization enrolled in.

26597

26598 - `id: optional string`

26599

26600 Unique identifier for the activity e.g. 'activity_abcd1234'

26601

26602 - `created_at: optional string`

26603

26604 When this activity occurred.

26605

26606 format: date-time

26607

26608 - `expires_at: optional string or null`

26609

26610 When the organization's promotional access or credits expire.

26611

26612 format: date-time

26613

26614 - `organization_id: optional string or null`

26615

26616 Organization ID this activity is associated with

26617

26618 - `organization_uuid: optional string or null`

26619

26620 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

26621

2549426622 - `ClaudeCodeReviewRepositoryAdded object`

2549526623

2549626624 A repository was added to org-level Claude Code Review configuration.

from line 27355

2622727355

2622827356 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

2622927357

27358 - `previous_review_level: optional string or null`

27359

27360 Review level set for this repository's code reviews before the change: "low" (Quick), "medium" (Standard) or "high" (Deep). Absent when no level was set.

27361

27362 - `review_level: optional string or null`

27363

27364 Review level now set for this repository's code reviews: "low" (Quick), "medium" (Standard) or "high" (Deep). Absent when no level is set; the repository then uses the organization-wide level (review_level on claude_code_review_config_updated), or Standard if none is set.

27365

2623027366 - `status: optional string or null`

2623127367

2623227368 Updated status (ACTIVE/INACTIVE)

from line 29831

2869529831

2869629832 - `ClaudeCodeSecurityScanProjectUpdated object`

2869729833

28698 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience.

29834 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience, or a user paused the project's scheduled scanning, unpaused it, or lifted a billing pause on it.

2869929835

2870029836 - `type: optional "claude_code_security_scan_project_updated"`

2870129837

2870229838 default: claude_code_security_scan_project_updated

2870329839

28704 - `action: "archived" or "created" or "migrated" or 3 more`

29840 - `action: "archived" or "billing_pause_lifted" or "created" or 6 more`

2870529841

2870629842 The state change applied to the scan project.

2870729843

2870829844 - `"archived"`

2870929845

29846 - `"billing_pause_lifted"`

29847

2871029848 - `"created"`

2871129849

2871229850 - `"migrated"`

2871329851

29852 - `"paused"`

29853

2871429854 - `"resumed"`

2871529855

2871629856 - `"unarchived"`

2871729857

29858 - `"unpaused"`

29859

2871829860 - `"unspecified"`

2871929861

2872029862 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

from line 40115

3897340115

3897440116 A short provider-specific identifier for the external resource after the update, e.g. `owner/repo` for GitHub or a file ID for Google Drive.

3897540117

40118 - `ClaudeSkillAutoDisabled object`

40119

40120 A skill that had been turned on for a member automatically was turned off for them automatically, not by the member; reason says why. A member turning a skill off themselves is recorded as claude_skill_disabled.

40121

40122 - `type: optional "claude_skill_auto_disabled"`

40123

40124 default: claude_skill_auto_disabled

40125

40126 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

40127

40128 - `APIActor object`

40129

40130 - `type: optional "api_actor"`

40131

40132 default: api_actor

40133

40134 - `api_key_id: string`

40135

40136 - `ip_address: string`

40137

40138 - `user_agent: string`

40139

40140 - `UserActor object`

40141

40142 - `type: optional "user_actor"`

40143

40144 default: user_actor

40145

40146 - `email_address: string`

40147

40148 format: email

40149

40150 - `ip_address: string`

40151

40152 - `user_agent: string`

40153

40154 - `user_id: string`

40155

40156 - `UnauthenticatedUserActor object`

40157

40158 - `type: optional "unauthenticated_user_actor"`

40159

40160 default: unauthenticated_user_actor

40161

40162 - `ip_address: string`

40163

40164 - `user_agent: string`

40165

40166 - `unauthenticated_email_address: optional string or null`

40167

40168 format: email

40169

40170 - `AnthropicActor object`

40171

40172 - `type: optional "anthropic_actor"`

40173

40174 default: anthropic_actor

40175

40176 - `email_address: optional string or null`

40177

40178 format: email

40179

40180 - `SystemActor object`

40181

40182 Automated background processing performed by Anthropic systems, acting

40183 without a user or customer credential.

40184

40185 - `type: optional "system_actor"`

40186

40187 default: system_actor

40188

40189 - `service: optional string or null`

40190

40191 Name of the automated process that performed the action, when known.

40192

40193 - `AdminAPIKeyActor object`

40194

40195 - `type: optional "admin_api_key_actor"`

40196

40197 default: admin_api_key_actor

40198

40199 - `admin_api_key_id: string`

40200

40201 - `ip_address: string`

40202

40203 - `user_agent: string`

40204

40205 - `ServiceAccountActor object`

40206

40207 - `type: optional "service_account_actor"`

40208

40209 default: service_account_actor

40210

40211 - `ip_address: string`

40212

40213 - `service_account_id: string`

40214

40215 - `user_agent: string`

40216

40217 - `ScimDirectorySyncActor object`

40218

40219 - `type: optional "scim_directory_sync_actor"`

40220

40221 default: scim_directory_sync_actor

40222

40223 - `directory_id: string`

40224

40225 - `workos_event_id: string`

40226

40227 - `idp_connection_type: optional string or null`

40228

40229 - `FederatedIdentityActor object`

40230

40231 A federated external workload authenticated via a verified OIDC token.

40232

40233 Carries the verified issuer, subject, and audience claims from the

40234 presented JWT.

40235

40236 - `type: optional "federated_identity_actor"`

40237

40238 default: federated_identity_actor

40239

40240 - `issuer: string`

40241

40242 - `subject: string`

40243

40244 - `audience: optional array of string`

40245

40246 - `ip_address: optional string or null`

40247

40248 - `user_agent: optional string or null`

40249

40250 - `FederatedActor object`

40251

40252 An external identity asserted by a trusted provider — a cloud-provider

40253 gateway or a customer-registered federation issuer — acting without an

40254 Anthropic-provisioned account or service account.

40255

40256 - `type: optional "federated_actor"`

40257

40258 default: federated_actor

40259

40260 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

40261

40262 - `FederatedActorAwsProvider object`

40263

40264 Asserting party: the AWS account the organization is bound to.

40265

40266 - `type: optional "aws"`

40267

40268 default: aws

40269

40270 - `account_id: string`

40271

40272 - `signed_principal: string`

40273

40274 The AWS-signed ARN of the IAM principal that requested the token.

40275

40276 - `FederatedActorAzureProvider object`

40277

40278 Asserting party: the Azure subscription the organization is bound to.

40279

40280 - `type: optional "azure"`

40281

40282 default: azure

40283

40284 - `subscription_id: string`

40285

40286 - `FederatedActorGcpProvider object`

40287

40288 Asserting party: the GCP project the organization is bound to.

40289

40290 - `type: optional "gcp"`

40291

40292 default: gcp

40293

40294 - `project_number: string`

40295

40296 - `FederatedActorOidcProvider object`

40297

40298 Asserting party: a customer-registered OIDC federation issuer.

40299

40300 - `type: optional "oidc"`

40301

40302 default: oidc

40303

40304 - `issuer: optional string or null`

40305

40306 The federation issuer's URL. Null when the presented credential failed verification.

40307

40308 - `ip_address: optional string or null`

40309

40310 - `subject: optional string or null`

40311

40312 The provider's verified identifier for the caller; its form depends on the provider.

40313

40314 - `user_agent: optional string or null`

40315

40316 - `AttestedDeviceActor object`

40317

40318 An attested mobile device authenticated via Apple App Attest.

40319

40320 - `type: optional "attested_device_actor"`

40321

40322 default: attested_device_actor

40323

40324 - `external_client_id: string`

40325

40326 - `kid_hash: string`

40327

40328 - `ip_address: optional string or null`

40329

40330 - `user_agent: optional string or null`

40331

40332 - `reason: "auto_enable_reverted" or "content_changed" or "unspecified"`

40333

40334 Why the skill was turned off automatically: "content_changed" (a change to the skill was saved or attempted, or the skill was scanned again, and it could not be confirmed as still eligible to be on automatically) or "auto_enable_reverted" (Anthropic turned off skills that had been turned on automatically; not in response to a change to this skill).

40335

40336 - `"auto_enable_reverted"`

40337

40338 - `"content_changed"`

40339

40340 - `"unspecified"`

40341

40342 - `user_id: string`

40343

40344 The member the skill was turned off for.

40345

40346 - `id: optional string`

40347

40348 Unique identifier for the activity e.g. 'activity_abcd1234'

40349

40350 - `created_at: optional string`

40351

40352 When this activity occurred.

40353

40354 format: date-time

40355

40356 - `organization_id: optional string or null`

40357

40358 Organization ID this activity is associated with

40359

40360 - `organization_uuid: optional string or null`

40361

40362 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

40363

40364 - `shared_by_user_id: optional string or null`

40365

40366 For a skill that had been turned on because it was shared: the member who shared it.

40367

40368 - `skill_id: optional string or null`

40369

40370 The skill that was turned off.

40371

40372 - `skill_name: optional string or null`

40373

40374 The name of the skill that was turned off.

40375

40376 - `skill_version: optional string or null`

40377

40378 The version of the skill the member had just before it was turned off. Absent when not known.

40379

40380 - `ClaudeSkillAutoEnabled object`

40381

40382 A skill was turned on for a member automatically, not by the member; trigger gives the cause, such as another member sharing an eligible skill with them. A member turning a skill on themselves is recorded as claude_skill_enabled.

40383

40384 - `type: optional "claude_skill_auto_enabled"`

40385

40386 default: claude_skill_auto_enabled

40387

40388 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

40389

40390 - `APIActor object`

40391

40392 - `type: optional "api_actor"`

40393

40394 default: api_actor

40395

40396 - `api_key_id: string`

40397

40398 - `ip_address: string`

40399

40400 - `user_agent: string`

40401

40402 - `UserActor object`

40403

40404 - `type: optional "user_actor"`

40405

40406 default: user_actor

40407

40408 - `email_address: string`

40409

40410 format: email

40411

40412 - `ip_address: string`

40413

40414 - `user_agent: string`

40415

40416 - `user_id: string`

40417

40418 - `UnauthenticatedUserActor object`

40419

40420 - `type: optional "unauthenticated_user_actor"`

40421

40422 default: unauthenticated_user_actor

40423

40424 - `ip_address: string`

40425

40426 - `user_agent: string`

40427

40428 - `unauthenticated_email_address: optional string or null`

40429

40430 format: email

40431

40432 - `AnthropicActor object`

40433

40434 - `type: optional "anthropic_actor"`

40435

40436 default: anthropic_actor

40437

40438 - `email_address: optional string or null`

40439

40440 format: email

40441

40442 - `SystemActor object`

40443

40444 Automated background processing performed by Anthropic systems, acting

40445 without a user or customer credential.

40446

40447 - `type: optional "system_actor"`

40448

40449 default: system_actor

40450

40451 - `service: optional string or null`

40452

40453 Name of the automated process that performed the action, when known.

40454

40455 - `AdminAPIKeyActor object`

40456

40457 - `type: optional "admin_api_key_actor"`

40458

40459 default: admin_api_key_actor

40460

40461 - `admin_api_key_id: string`

40462

40463 - `ip_address: string`

40464

40465 - `user_agent: string`

40466

40467 - `ServiceAccountActor object`

40468

40469 - `type: optional "service_account_actor"`

40470

40471 default: service_account_actor

40472

40473 - `ip_address: string`

40474

40475 - `service_account_id: string`

40476

40477 - `user_agent: string`

40478

40479 - `ScimDirectorySyncActor object`

40480

40481 - `type: optional "scim_directory_sync_actor"`

40482

40483 default: scim_directory_sync_actor

40484

40485 - `directory_id: string`

40486

40487 - `workos_event_id: string`

40488

40489 - `idp_connection_type: optional string or null`

40490

40491 - `FederatedIdentityActor object`

40492

40493 A federated external workload authenticated via a verified OIDC token.

40494

40495 Carries the verified issuer, subject, and audience claims from the

40496 presented JWT.

40497

40498 - `type: optional "federated_identity_actor"`

40499

40500 default: federated_identity_actor

40501

40502 - `issuer: string`

40503

40504 - `subject: string`

40505

40506 - `audience: optional array of string`

40507

40508 - `ip_address: optional string or null`

40509

40510 - `user_agent: optional string or null`

40511

40512 - `FederatedActor object`

40513

40514 An external identity asserted by a trusted provider — a cloud-provider

40515 gateway or a customer-registered federation issuer — acting without an

40516 Anthropic-provisioned account or service account.

40517

40518 - `type: optional "federated_actor"`

40519

40520 default: federated_actor

40521

40522 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

40523

40524 - `FederatedActorAwsProvider object`

40525

40526 Asserting party: the AWS account the organization is bound to.

40527

40528 - `type: optional "aws"`

40529

40530 default: aws

40531

40532 - `account_id: string`

40533

40534 - `signed_principal: string`

40535

40536 The AWS-signed ARN of the IAM principal that requested the token.

40537

40538 - `FederatedActorAzureProvider object`

40539

40540 Asserting party: the Azure subscription the organization is bound to.

40541

40542 - `type: optional "azure"`

40543

40544 default: azure

40545

40546 - `subscription_id: string`

40547

40548 - `FederatedActorGcpProvider object`

40549

40550 Asserting party: the GCP project the organization is bound to.

40551

40552 - `type: optional "gcp"`

40553

40554 default: gcp

40555

40556 - `project_number: string`

40557

40558 - `FederatedActorOidcProvider object`

40559

40560 Asserting party: a customer-registered OIDC federation issuer.

40561

40562 - `type: optional "oidc"`

40563

40564 default: oidc

40565

40566 - `issuer: optional string or null`

40567

40568 The federation issuer's URL. Null when the presented credential failed verification.

40569

40570 - `ip_address: optional string or null`

40571

40572 - `subject: optional string or null`

40573

40574 The provider's verified identifier for the caller; its form depends on the provider.

40575

40576 - `user_agent: optional string or null`

40577

40578 - `AttestedDeviceActor object`

40579

40580 An attested mobile device authenticated via Apple App Attest.

40581

40582 - `type: optional "attested_device_actor"`

40583

40584 default: attested_device_actor

40585

40586 - `external_client_id: string`

40587

40588 - `kid_hash: string`

40589

40590 - `ip_address: optional string or null`

40591

40592 - `user_agent: optional string or null`

40593

40594 - `trigger: "share" or "unspecified"`

40595

40596 What caused the skill to be turned on automatically: "share" (another member shared it with the member, directly or through a group).

40597

40598 - `"share"`

40599

40600 - `"unspecified"`

40601

40602 - `user_id: string`

40603

40604 The member the skill was turned on for.

40605

40606 - `id: optional string`

40607

40608 Unique identifier for the activity e.g. 'activity_abcd1234'

40609

40610 - `created_at: optional string`

40611

40612 When this activity occurred.

40613

40614 format: date-time

40615

40616 - `organization_id: optional string or null`

40617

40618 Organization ID this activity is associated with

40619

40620 - `organization_uuid: optional string or null`

40621

40622 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

40623

40624 - `shared_at: optional string or null`

40625

40626 For a skill turned on because it was shared: when it was shared with the member or with their group.

40627

40628 format: date-time

40629

40630 - `shared_by_user_id: optional string or null`

40631

40632 For a skill turned on because it was shared: the member who shared it.

40633

40634 - `shared_via: optional "direct" or "group" or "unspecified" or null`

40635

40636 For a skill turned on because it was shared: "direct" if shared with the member themselves, "group" if shared with a group they belong to.

40637

40638 - `"direct"`

40639

40640 - `"group"`

40641

40642 - `"unspecified"`

40643

40644 - `skill_id: optional string or null`

40645

40646 The skill that was turned on.

40647

40648 - `skill_name: optional string or null`

40649

40650 The name of the skill that was turned on.

40651

40652 - `skill_version: optional string or null`

40653

40654 The version of the skill that was turned on.

40655

3897640656 - `ClaudeSkillDownloaded object`

3897740657

3897840658 A member explicitly downloaded a skill's files to their device: the Download action in Claude, a single file saved from the skill viewer, or an install they asked one of their Claude apps for. Background syncs to the Claude apps, viewing a skill in the app and services reading a skill on the member's behalf are not recorded.

from line 49265

4758549265

4758649266 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

4758749267

49268 - `DomainClaimCancelled object`

49269

49270 A pending domain claim was cancelled before it took effect, so the personal accounts on the claimed domains will no longer be migrated or deactivated at its deadline.

49271

49272 - `type: optional "domain_claim_cancelled"`

49273

49274 default: domain_claim_cancelled

49275

49276 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

49277

49278 - `APIActor object`

49279

49280 - `type: optional "api_actor"`

49281

49282 default: api_actor

49283

49284 - `api_key_id: string`

49285

49286 - `ip_address: string`

49287

49288 - `user_agent: string`

49289

49290 - `UserActor object`

49291

49292 - `type: optional "user_actor"`

49293

49294 default: user_actor

49295

49296 - `email_address: string`

49297

49298 format: email

49299

49300 - `ip_address: string`

49301

49302 - `user_agent: string`

49303

49304 - `user_id: string`

49305

49306 - `UnauthenticatedUserActor object`

49307

49308 - `type: optional "unauthenticated_user_actor"`

49309

49310 default: unauthenticated_user_actor

49311

49312 - `ip_address: string`

49313

49314 - `user_agent: string`

49315

49316 - `unauthenticated_email_address: optional string or null`

49317

49318 format: email

49319

49320 - `AnthropicActor object`

49321

49322 - `type: optional "anthropic_actor"`

49323

49324 default: anthropic_actor

49325

49326 - `email_address: optional string or null`

49327

49328 format: email

49329

49330 - `SystemActor object`

49331

49332 Automated background processing performed by Anthropic systems, acting

49333 without a user or customer credential.

49334

49335 - `type: optional "system_actor"`

49336

49337 default: system_actor

49338

49339 - `service: optional string or null`

49340

49341 Name of the automated process that performed the action, when known.

49342

49343 - `AdminAPIKeyActor object`

49344

49345 - `type: optional "admin_api_key_actor"`

49346

49347 default: admin_api_key_actor

49348

49349 - `admin_api_key_id: string`

49350

49351 - `ip_address: string`

49352

49353 - `user_agent: string`

49354

49355 - `ServiceAccountActor object`

49356

49357 - `type: optional "service_account_actor"`

49358

49359 default: service_account_actor

49360

49361 - `ip_address: string`

49362

49363 - `service_account_id: string`

49364

49365 - `user_agent: string`

49366

49367 - `ScimDirectorySyncActor object`

49368

49369 - `type: optional "scim_directory_sync_actor"`

49370

49371 default: scim_directory_sync_actor

49372

49373 - `directory_id: string`

49374

49375 - `workos_event_id: string`

49376

49377 - `idp_connection_type: optional string or null`

49378

49379 - `FederatedIdentityActor object`

49380

49381 A federated external workload authenticated via a verified OIDC token.

49382

49383 Carries the verified issuer, subject, and audience claims from the

49384 presented JWT.

49385

49386 - `type: optional "federated_identity_actor"`

49387

49388 default: federated_identity_actor

49389

49390 - `issuer: string`

49391

49392 - `subject: string`

49393

49394 - `audience: optional array of string`

49395

49396 - `ip_address: optional string or null`

49397

49398 - `user_agent: optional string or null`

49399

49400 - `FederatedActor object`

49401

49402 An external identity asserted by a trusted provider — a cloud-provider

49403 gateway or a customer-registered federation issuer — acting without an

49404 Anthropic-provisioned account or service account.

49405

49406 - `type: optional "federated_actor"`

49407

49408 default: federated_actor

49409

49410 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

49411

49412 - `FederatedActorAwsProvider object`

49413

49414 Asserting party: the AWS account the organization is bound to.

49415

49416 - `type: optional "aws"`

49417

49418 default: aws

49419

49420 - `account_id: string`

49421

49422 - `signed_principal: string`

49423

49424 The AWS-signed ARN of the IAM principal that requested the token.

49425

49426 - `FederatedActorAzureProvider object`

49427

49428 Asserting party: the Azure subscription the organization is bound to.

49429

49430 - `type: optional "azure"`

49431

49432 default: azure

49433

49434 - `subscription_id: string`

49435

49436 - `FederatedActorGcpProvider object`

49437

49438 Asserting party: the GCP project the organization is bound to.

49439

49440 - `type: optional "gcp"`

49441

49442 default: gcp

49443

49444 - `project_number: string`

49445

49446 - `FederatedActorOidcProvider object`

49447

49448 Asserting party: a customer-registered OIDC federation issuer.

49449

49450 - `type: optional "oidc"`

49451

49452 default: oidc

49453

49454 - `issuer: optional string or null`

49455

49456 The federation issuer's URL. Null when the presented credential failed verification.

49457

49458 - `ip_address: optional string or null`

49459

49460 - `subject: optional string or null`

49461

49462 The provider's verified identifier for the caller; its form depends on the provider.

49463

49464 - `user_agent: optional string or null`

49465

49466 - `AttestedDeviceActor object`

49467

49468 An attested mobile device authenticated via Apple App Attest.

49469

49470 - `type: optional "attested_device_actor"`

49471

49472 default: attested_device_actor

49473

49474 - `external_client_id: string`

49475

49476 - `kid_hash: string`

49477

49478 - `ip_address: optional string or null`

49479

49480 - `user_agent: optional string or null`

49481

49482 - `domain_claim_id: string`

49483

49484 The domain claim that was cancelled, e.g. "dclm_01Ab...".

49485

49486 - `id: optional string`

49487

49488 Unique identifier for the activity e.g. 'activity_abcd1234'

49489

49490 - `created_at: optional string`

49491

49492 When this activity occurred.

49493

49494 format: date-time

49495

49496 - `organization_id: optional string or null`

49497

49498 Organization ID this activity is associated with

49499

49500 - `organization_uuid: optional string or null`

49501

49502 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

49503

49504 - `DomainClaimDeadlineUpdated object`

49505

49506 The migration deadline of a pending domain claim was moved to a later or an earlier date by Anthropic staff or an automated process.

49507

49508 - `type: optional "domain_claim_deadline_updated"`

49509

49510 default: domain_claim_deadline_updated

49511

49512 - `action: "extended" or "shortened" or "unspecified"`

49513

49514 Whether the deadline was extended (moved later) or shortened (moved earlier).

49515

49516 - `"extended"`

49517

49518 - `"shortened"`

49519

49520 - `"unspecified"`

49521

49522 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

49523

49524 - `APIActor object`

49525

49526 - `type: optional "api_actor"`

49527

49528 default: api_actor

49529

49530 - `api_key_id: string`

49531

49532 - `ip_address: string`

49533

49534 - `user_agent: string`

49535

49536 - `UserActor object`

49537

49538 - `type: optional "user_actor"`

49539

49540 default: user_actor

49541

49542 - `email_address: string`

49543

49544 format: email

49545

49546 - `ip_address: string`

49547

49548 - `user_agent: string`

49549

49550 - `user_id: string`

49551

49552 - `UnauthenticatedUserActor object`

49553

49554 - `type: optional "unauthenticated_user_actor"`

49555

49556 default: unauthenticated_user_actor

49557

49558 - `ip_address: string`

49559

49560 - `user_agent: string`

49561

49562 - `unauthenticated_email_address: optional string or null`

49563

49564 format: email

49565

49566 - `AnthropicActor object`

49567

49568 - `type: optional "anthropic_actor"`

49569

49570 default: anthropic_actor

49571

49572 - `email_address: optional string or null`

49573

49574 format: email

49575

49576 - `SystemActor object`

49577

49578 Automated background processing performed by Anthropic systems, acting

49579 without a user or customer credential.

49580

49581 - `type: optional "system_actor"`

49582

49583 default: system_actor

49584

49585 - `service: optional string or null`

49586

49587 Name of the automated process that performed the action, when known.

49588

49589 - `AdminAPIKeyActor object`

49590

49591 - `type: optional "admin_api_key_actor"`

49592

49593 default: admin_api_key_actor

49594

49595 - `admin_api_key_id: string`

49596

49597 - `ip_address: string`

49598

49599 - `user_agent: string`

49600

49601 - `ServiceAccountActor object`

49602

49603 - `type: optional "service_account_actor"`

49604

49605 default: service_account_actor

49606

49607 - `ip_address: string`

49608

49609 - `service_account_id: string`

49610

49611 - `user_agent: string`

49612

49613 - `ScimDirectorySyncActor object`

49614

49615 - `type: optional "scim_directory_sync_actor"`

49616

49617 default: scim_directory_sync_actor

49618

49619 - `directory_id: string`

49620

49621 - `workos_event_id: string`

49622

49623 - `idp_connection_type: optional string or null`

49624

49625 - `FederatedIdentityActor object`

49626

49627 A federated external workload authenticated via a verified OIDC token.

49628

49629 Carries the verified issuer, subject, and audience claims from the

49630 presented JWT.

49631

49632 - `type: optional "federated_identity_actor"`

49633

49634 default: federated_identity_actor

49635

49636 - `issuer: string`

49637

49638 - `subject: string`

49639

49640 - `audience: optional array of string`

49641

49642 - `ip_address: optional string or null`

49643

49644 - `user_agent: optional string or null`

49645

49646 - `FederatedActor object`

49647

49648 An external identity asserted by a trusted provider — a cloud-provider

49649 gateway or a customer-registered federation issuer — acting without an

49650 Anthropic-provisioned account or service account.

49651

49652 - `type: optional "federated_actor"`

49653

49654 default: federated_actor

49655

49656 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

49657

49658 - `FederatedActorAwsProvider object`

49659

49660 Asserting party: the AWS account the organization is bound to.

49661

49662 - `type: optional "aws"`

49663

49664 default: aws

49665

49666 - `account_id: string`

49667

49668 - `signed_principal: string`

49669

49670 The AWS-signed ARN of the IAM principal that requested the token.

49671

49672 - `FederatedActorAzureProvider object`

49673

49674 Asserting party: the Azure subscription the organization is bound to.

49675

49676 - `type: optional "azure"`

49677

49678 default: azure

49679

49680 - `subscription_id: string`

49681

49682 - `FederatedActorGcpProvider object`

49683

49684 Asserting party: the GCP project the organization is bound to.

49685

49686 - `type: optional "gcp"`

49687

49688 default: gcp

49689

49690 - `project_number: string`

49691

49692 - `FederatedActorOidcProvider object`

49693

49694 Asserting party: a customer-registered OIDC federation issuer.

49695

49696 - `type: optional "oidc"`

49697

49698 default: oidc

49699

49700 - `issuer: optional string or null`

49701

49702 The federation issuer's URL. Null when the presented credential failed verification.

49703

49704 - `ip_address: optional string or null`

49705

49706 - `subject: optional string or null`

49707

49708 The provider's verified identifier for the caller; its form depends on the provider.

49709

49710 - `user_agent: optional string or null`

49711

49712 - `AttestedDeviceActor object`

49713

49714 An attested mobile device authenticated via Apple App Attest.

49715

49716 - `type: optional "attested_device_actor"`

49717

49718 default: attested_device_actor

49719

49720 - `external_client_id: string`

49721

49722 - `kid_hash: string`

49723

49724 - `ip_address: optional string or null`

49725

49726 - `user_agent: optional string or null`

49727

49728 - `domain_claim_id: string`

49729

49730 The domain claim whose deadline was moved, e.g. "dclm_01Ab...".

49731

49732 - `id: optional string`

49733

49734 Unique identifier for the activity e.g. 'activity_abcd1234'

49735

49736 - `created_at: optional string`

49737

49738 When this activity occurred.

49739

49740 format: date-time

49741

49742 - `deadline_at: optional string or null`

49743

49744 The deadline after the change.

49745

49746 format: date-time

49747

49748 - `organization_id: optional string or null`

49749

49750 Organization ID this activity is associated with

49751

49752 - `organization_uuid: optional string or null`

49753

49754 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

49755

49756 - `previous_deadline_at: optional string or null`

49757

49758 The deadline before the change.

49759

49760 format: date-time

49761

4758849762 - `DomainClaimInitiated object`

4758949763

4759049764 Domain capture claim initiated over personal accounts on verified domains.

from line 55437

5326355437

5326455438 - `token_fingerprint_sha256: optional string or null`

5326555439

53266 Org-scoped SHA-256 of the submitted token: `sha256(org_uuid || 0x00 || token)`, lowercase-hex-encoded, where `org_uuid` is the organization's UUID as a dashed lowercase string, `0x00` is a single zero byte, and `token` is the submitted value's raw bytes. Per-org correlation only — the same token in two orgs produces distinct fingerprints. Set only when the submitted value carries a known GitHub PAT prefix (a high-entropy token format); unset for all other submissions, including rejected non-PAT input.

55440 Not populated.

5326755441

5326855442 - `GitlabConfigurationCreated object`

5326955443

from line 93271

9109793271

9109893272 - `user_agent: optional string or null`

9109993273

91100 - `updates: array of Name or Capabilities or RedactContent or 104 more`

93274 - `updates: array of Name or Capabilities or RedactContent or 105 more`

9110193275

9110293276 - `Name object`

9110393277

from line 95190

9301695190

9301795191 Setting value immediately before this change. Null means the setting was not set, so its default applied.

9301895192

95193 - `ConnectorRequestsOptedIn object`

95194

95195 The organization's opt-in to connector requests, which lets members ask the organization's owners to add a connector, was changed. The "Let members request connectors" switch sets it the first time it is turned on; turning that switch off, or on again, is recorded as a `disabled_admin_request_types` change (`enable_connector` joins or leaves the list).

95196

95197 - `type: optional "connector_requests_opted_in"`

95198

95199 default: connector_requests_opted_in

95200

95201 - `current_value: optional boolean or null`

95202

95203 Setting value immediately after this change

95204

95205 - `previous_value: optional boolean or null`

95206

95207 Setting value immediately before this change. Null means the organization had never opted in or out.

95208

9301995209 - `id: optional string`

9302095210

9302195211 Unique identifier for the activity e.g. 'activity_abcd1234'

from line 114296

112106114296

112107114297 UUID of the spend limit.

112108114298

114299 - `PlatformTelemetryDestinationAutoDisabled object`

114300

114301 A telemetry destination was disabled automatically after deliveries to it failed, so no telemetry is sent to it until an administrator enables it again.

114302

114303 - `type: optional "platform_telemetry_destination_auto_disabled"`

114304

114305 default: platform_telemetry_destination_auto_disabled

114306

114307 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

114308

114309 - `APIActor object`

114310

114311 - `type: optional "api_actor"`

114312

114313 default: api_actor

114314

114315 - `api_key_id: string`

114316

114317 - `ip_address: string`

114318

114319 - `user_agent: string`

114320

114321 - `UserActor object`

114322

114323 - `type: optional "user_actor"`

114324

114325 default: user_actor

114326

114327 - `email_address: string`

114328

114329 format: email

114330

114331 - `ip_address: string`

114332

114333 - `user_agent: string`

114334

114335 - `user_id: string`

114336

114337 - `UnauthenticatedUserActor object`

114338

114339 - `type: optional "unauthenticated_user_actor"`

114340

114341 default: unauthenticated_user_actor

114342

114343 - `ip_address: string`

114344

114345 - `user_agent: string`

114346

114347 - `unauthenticated_email_address: optional string or null`

114348

114349 format: email

114350

114351 - `AnthropicActor object`

114352

114353 - `type: optional "anthropic_actor"`

114354

114355 default: anthropic_actor

114356

114357 - `email_address: optional string or null`

114358

114359 format: email

114360

114361 - `SystemActor object`

114362

114363 Automated background processing performed by Anthropic systems, acting

114364 without a user or customer credential.

114365

114366 - `type: optional "system_actor"`

114367

114368 default: system_actor

114369

114370 - `service: optional string or null`

114371

114372 Name of the automated process that performed the action, when known.

114373

114374 - `AdminAPIKeyActor object`

114375

114376 - `type: optional "admin_api_key_actor"`

114377

114378 default: admin_api_key_actor

114379

114380 - `admin_api_key_id: string`

114381

114382 - `ip_address: string`

114383

114384 - `user_agent: string`

114385

114386 - `ServiceAccountActor object`

114387

114388 - `type: optional "service_account_actor"`

114389

114390 default: service_account_actor

114391

114392 - `ip_address: string`

114393

114394 - `service_account_id: string`

114395

114396 - `user_agent: string`

114397

114398 - `ScimDirectorySyncActor object`

114399

114400 - `type: optional "scim_directory_sync_actor"`

114401

114402 default: scim_directory_sync_actor

114403

114404 - `directory_id: string`

114405

114406 - `workos_event_id: string`

114407

114408 - `idp_connection_type: optional string or null`

114409

114410 - `FederatedIdentityActor object`

114411

114412 A federated external workload authenticated via a verified OIDC token.

114413

114414 Carries the verified issuer, subject, and audience claims from the

114415 presented JWT.

114416

114417 - `type: optional "federated_identity_actor"`

114418

114419 default: federated_identity_actor

114420

114421 - `issuer: string`

114422

114423 - `subject: string`

114424

114425 - `audience: optional array of string`

114426

114427 - `ip_address: optional string or null`

114428

114429 - `user_agent: optional string or null`

114430

114431 - `FederatedActor object`

114432

114433 An external identity asserted by a trusted provider — a cloud-provider

114434 gateway or a customer-registered federation issuer — acting without an

114435 Anthropic-provisioned account or service account.

114436

114437 - `type: optional "federated_actor"`

114438

114439 default: federated_actor

114440

114441 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

114442

114443 - `FederatedActorAwsProvider object`

114444

114445 Asserting party: the AWS account the organization is bound to.

114446

114447 - `type: optional "aws"`

114448

114449 default: aws

114450

114451 - `account_id: string`

114452

114453 - `signed_principal: string`

114454

114455 The AWS-signed ARN of the IAM principal that requested the token.

114456

114457 - `FederatedActorAzureProvider object`

114458

114459 Asserting party: the Azure subscription the organization is bound to.

114460

114461 - `type: optional "azure"`

114462

114463 default: azure

114464

114465 - `subscription_id: string`

114466

114467 - `FederatedActorGcpProvider object`

114468

114469 Asserting party: the GCP project the organization is bound to.

114470

114471 - `type: optional "gcp"`

114472

114473 default: gcp

114474

114475 - `project_number: string`

114476

114477 - `FederatedActorOidcProvider object`

114478

114479 Asserting party: a customer-registered OIDC federation issuer.

114480

114481 - `type: optional "oidc"`

114482

114483 default: oidc

114484

114485 - `issuer: optional string or null`

114486

114487 The federation issuer's URL. Null when the presented credential failed verification.

114488

114489 - `ip_address: optional string or null`

114490

114491 - `subject: optional string or null`

114492

114493 The provider's verified identifier for the caller; its form depends on the provider.

114494

114495 - `user_agent: optional string or null`

114496

114497 - `AttestedDeviceActor object`

114498

114499 An attested mobile device authenticated via Apple App Attest.

114500

114501 - `type: optional "attested_device_actor"`

114502

114503 default: attested_device_actor

114504

114505 - `external_client_id: string`

114506

114507 - `kid_hash: string`

114508

114509 - `ip_address: optional string or null`

114510

114511 - `user_agent: optional string or null`

114512

114513 - `telemetry_destination_id: string`

114514

114515 Tagged telemetry destination ID, e.g. "tdst_01HX...".

114516

114517 - `trigger: "invalid_address" or "redirect" or "sustained_failure" or "unspecified"`

114518

114519 Why the destination was disabled: deliveries failed for longer than Anthropic allows ("sustained_failure"), they failed that long and the hostname does not resolve to a public address ("invalid_address"), or the endpoint answered with an HTTP redirect ("redirect").

114520

114521 - `"invalid_address"`

114522

114523 - `"redirect"`

114524

114525 - `"sustained_failure"`

114526

114527 - `"unspecified"`

114528

114529 - `id: optional string`

114530

114531 Unique identifier for the activity e.g. 'activity_abcd1234'

114532

114533 - `created_at: optional string`

114534

114535 When this activity occurred.

114536

114537 format: date-time

114538

114539 - `organization_id: optional string or null`

114540

114541 Organization ID this activity is associated with

114542

114543 - `organization_uuid: optional string or null`

114544

114545 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

114546

114547 - `PlatformTelemetryDestinationCreated object`

114548

114549 A telemetry destination was registered for the organization.

114550

114551 - `type: optional "platform_telemetry_destination_created"`

114552

114553 default: platform_telemetry_destination_created

114554

114555 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

114556

114557 - `APIActor object`

114558

114559 - `type: optional "api_actor"`

114560

114561 default: api_actor

114562

114563 - `api_key_id: string`

114564

114565 - `ip_address: string`

114566

114567 - `user_agent: string`

114568

114569 - `UserActor object`

114570

114571 - `type: optional "user_actor"`

114572

114573 default: user_actor

114574

114575 - `email_address: string`

114576

114577 format: email

114578

114579 - `ip_address: string`

114580

114581 - `user_agent: string`

114582

114583 - `user_id: string`

114584

114585 - `UnauthenticatedUserActor object`

114586

114587 - `type: optional "unauthenticated_user_actor"`

114588

114589 default: unauthenticated_user_actor

114590

114591 - `ip_address: string`

114592

114593 - `user_agent: string`

114594

114595 - `unauthenticated_email_address: optional string or null`

114596

114597 format: email

114598

114599 - `AnthropicActor object`

114600

114601 - `type: optional "anthropic_actor"`

114602

114603 default: anthropic_actor

114604

114605 - `email_address: optional string or null`

114606

114607 format: email

114608

114609 - `SystemActor object`

114610

114611 Automated background processing performed by Anthropic systems, acting

114612 without a user or customer credential.

114613

114614 - `type: optional "system_actor"`

114615

114616 default: system_actor

114617

114618 - `service: optional string or null`

114619

114620 Name of the automated process that performed the action, when known.

114621

114622 - `AdminAPIKeyActor object`

114623

114624 - `type: optional "admin_api_key_actor"`

114625

114626 default: admin_api_key_actor

114627

114628 - `admin_api_key_id: string`

114629

114630 - `ip_address: string`

114631

114632 - `user_agent: string`

114633

114634 - `ServiceAccountActor object`

114635

114636 - `type: optional "service_account_actor"`

114637

114638 default: service_account_actor

114639

114640 - `ip_address: string`

114641

114642 - `service_account_id: string`

114643

114644 - `user_agent: string`

114645

114646 - `ScimDirectorySyncActor object`

114647

114648 - `type: optional "scim_directory_sync_actor"`

114649

114650 default: scim_directory_sync_actor

114651

114652 - `directory_id: string`

114653

114654 - `workos_event_id: string`

114655

114656 - `idp_connection_type: optional string or null`

114657

114658 - `FederatedIdentityActor object`

114659

114660 A federated external workload authenticated via a verified OIDC token.

114661

114662 Carries the verified issuer, subject, and audience claims from the

114663 presented JWT.

114664

114665 - `type: optional "federated_identity_actor"`

114666

114667 default: federated_identity_actor

114668

114669 - `issuer: string`

114670

114671 - `subject: string`

114672

114673 - `audience: optional array of string`

114674

114675 - `ip_address: optional string or null`

114676

114677 - `user_agent: optional string or null`

114678

114679 - `FederatedActor object`

114680

114681 An external identity asserted by a trusted provider — a cloud-provider

114682 gateway or a customer-registered federation issuer — acting without an

114683 Anthropic-provisioned account or service account.

114684

114685 - `type: optional "federated_actor"`

114686

114687 default: federated_actor

114688

114689 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

114690

114691 - `FederatedActorAwsProvider object`

114692

114693 Asserting party: the AWS account the organization is bound to.

114694

114695 - `type: optional "aws"`

114696

114697 default: aws

114698

114699 - `account_id: string`

114700

114701 - `signed_principal: string`

114702

114703 The AWS-signed ARN of the IAM principal that requested the token.

114704

114705 - `FederatedActorAzureProvider object`

114706

114707 Asserting party: the Azure subscription the organization is bound to.

114708

114709 - `type: optional "azure"`

114710

114711 default: azure

114712

114713 - `subscription_id: string`

114714

114715 - `FederatedActorGcpProvider object`

114716

114717 Asserting party: the GCP project the organization is bound to.

114718

114719 - `type: optional "gcp"`

114720

114721 default: gcp

114722

114723 - `project_number: string`

114724

114725 - `FederatedActorOidcProvider object`

114726

114727 Asserting party: a customer-registered OIDC federation issuer.

114728

114729 - `type: optional "oidc"`

114730

114731 default: oidc

114732

114733 - `issuer: optional string or null`

114734

114735 The federation issuer's URL. Null when the presented credential failed verification.

114736

114737 - `ip_address: optional string or null`

114738

114739 - `subject: optional string or null`

114740

114741 The provider's verified identifier for the caller; its form depends on the provider.

114742

114743 - `user_agent: optional string or null`

114744

114745 - `AttestedDeviceActor object`

114746

114747 An attested mobile device authenticated via Apple App Attest.

114748

114749 - `type: optional "attested_device_actor"`

114750

114751 default: attested_device_actor

114752

114753 - `external_client_id: string`

114754

114755 - `kid_hash: string`

114756

114757 - `ip_address: optional string or null`

114758

114759 - `user_agent: optional string or null`

114760

114761 - `telemetry_destination_id: string`

114762

114763 Tagged telemetry destination ID, e.g. "tdst_01HX...".

114764

114765 - `id: optional string`

114766

114767 Unique identifier for the activity e.g. 'activity_abcd1234'

114768

114769 - `created_at: optional string`

114770

114771 When this activity occurred.

114772

114773 format: date-time

114774

114775 - `endpoint_url: optional string or null`

114776

114777 The destination's endpoint URL as stored, e.g. "https://collector.example.com/otlp"; the API refuses credentials, query strings and fragments in this URL.

114778

114779 - `organization_id: optional string or null`

114780

114781 Organization ID this activity is associated with

114782

114783 - `organization_uuid: optional string or null`

114784

114785 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

114786

114787 - `traces: optional object or null`

114788

114789 The destination's settings for traces, as the API returns them.

114790

114791 - `content_mode: string`

114792

114793 What the exported spans contain: "metadata_only", or "content" when they also carry message and tool content.

114794

114795 - `enabled: boolean`

114796

114797 Whether the destination receives traces.

114798

114799 - `endpoint_url: optional string or null`

114800

114801 The destination's separate traces URL as stored, e.g. "https://collector.example.com/v2/trace/otlp"; like the endpoint URL it never contains credentials, a query string or a fragment. Omitted when the destination has none; traces then go to the endpoint URL plus "/v1/traces".

114802

114803 - `max_content_bytes: optional number or null`

114804

114805 The most bytes of content that one exported span keeps; omitted when the destination sets no bound and only Anthropic's maximum applies.

114806

114807 - `workspaces: optional object or null`

114808

114809 Which workspaces the destination covers, as the API returns it: its type only, "all", "include" or "exclude". The workspaces put on its list by the same request are recorded as workspace_added activities.

114810

114811 - `type: string`

114812

114813 "all": every workspace of the organization; "include": the workspaces on the destination's list; "exclude": every workspace but those on its list.

114814

114815 - `PlatformTelemetryDestinationDeleted object`

114816

114817 A telemetry destination was deleted.

114818

114819 - `type: optional "platform_telemetry_destination_deleted"`

114820

114821 default: platform_telemetry_destination_deleted

114822

114823 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

114824

114825 - `APIActor object`

114826

114827 - `type: optional "api_actor"`

114828

114829 default: api_actor

114830

114831 - `api_key_id: string`

114832

114833 - `ip_address: string`

114834

114835 - `user_agent: string`

114836

114837 - `UserActor object`

114838

114839 - `type: optional "user_actor"`

114840

114841 default: user_actor

114842

114843 - `email_address: string`

114844

114845 format: email

114846

114847 - `ip_address: string`

114848

114849 - `user_agent: string`

114850

114851 - `user_id: string`

114852

114853 - `UnauthenticatedUserActor object`

114854

114855 - `type: optional "unauthenticated_user_actor"`

114856

114857 default: unauthenticated_user_actor

114858

114859 - `ip_address: string`

114860

114861 - `user_agent: string`

114862

114863 - `unauthenticated_email_address: optional string or null`

114864

114865 format: email

114866

114867 - `AnthropicActor object`

114868

114869 - `type: optional "anthropic_actor"`

114870

114871 default: anthropic_actor

114872

114873 - `email_address: optional string or null`

114874

114875 format: email

114876

114877 - `SystemActor object`

114878

114879 Automated background processing performed by Anthropic systems, acting

114880 without a user or customer credential.

114881

114882 - `type: optional "system_actor"`

114883

114884 default: system_actor

114885

114886 - `service: optional string or null`

114887

114888 Name of the automated process that performed the action, when known.

114889

114890 - `AdminAPIKeyActor object`

114891

114892 - `type: optional "admin_api_key_actor"`

114893

114894 default: admin_api_key_actor

114895

114896 - `admin_api_key_id: string`

114897

114898 - `ip_address: string`

114899

114900 - `user_agent: string`

114901

114902 - `ServiceAccountActor object`

114903

114904 - `type: optional "service_account_actor"`

114905

114906 default: service_account_actor

114907

114908 - `ip_address: string`

114909

114910 - `service_account_id: string`

114911

114912 - `user_agent: string`

114913

114914 - `ScimDirectorySyncActor object`

114915

114916 - `type: optional "scim_directory_sync_actor"`

114917

114918 default: scim_directory_sync_actor

114919

114920 - `directory_id: string`

114921

114922 - `workos_event_id: string`

114923

114924 - `idp_connection_type: optional string or null`

114925

114926 - `FederatedIdentityActor object`

114927

114928 A federated external workload authenticated via a verified OIDC token.

114929

114930 Carries the verified issuer, subject, and audience claims from the

114931 presented JWT.

114932

114933 - `type: optional "federated_identity_actor"`

114934

114935 default: federated_identity_actor

114936

114937 - `issuer: string`

114938

114939 - `subject: string`

114940

114941 - `audience: optional array of string`

114942

114943 - `ip_address: optional string or null`

114944

114945 - `user_agent: optional string or null`

114946

114947 - `FederatedActor object`

114948

114949 An external identity asserted by a trusted provider — a cloud-provider

114950 gateway or a customer-registered federation issuer — acting without an

114951 Anthropic-provisioned account or service account.

114952

114953 - `type: optional "federated_actor"`

114954

114955 default: federated_actor

114956

114957 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

114958

114959 - `FederatedActorAwsProvider object`

114960

114961 Asserting party: the AWS account the organization is bound to.

114962

114963 - `type: optional "aws"`

114964

114965 default: aws

114966

114967 - `account_id: string`

114968

114969 - `signed_principal: string`

114970

114971 The AWS-signed ARN of the IAM principal that requested the token.

114972

114973 - `FederatedActorAzureProvider object`

114974

114975 Asserting party: the Azure subscription the organization is bound to.

114976

114977 - `type: optional "azure"`

114978

114979 default: azure

114980

114981 - `subscription_id: string`

114982

114983 - `FederatedActorGcpProvider object`

114984

114985 Asserting party: the GCP project the organization is bound to.

114986

114987 - `type: optional "gcp"`

114988

114989 default: gcp

114990

114991 - `project_number: string`

114992

114993 - `FederatedActorOidcProvider object`

114994

114995 Asserting party: a customer-registered OIDC federation issuer.

114996

114997 - `type: optional "oidc"`

114998

114999 default: oidc

115000

115001 - `issuer: optional string or null`

115002

115003 The federation issuer's URL. Null when the presented credential failed verification.

115004

115005 - `ip_address: optional string or null`

115006

115007 - `subject: optional string or null`

115008

115009 The provider's verified identifier for the caller; its form depends on the provider.

115010

115011 - `user_agent: optional string or null`

115012

115013 - `AttestedDeviceActor object`

115014

115015 An attested mobile device authenticated via Apple App Attest.

115016

115017 - `type: optional "attested_device_actor"`

115018

115019 default: attested_device_actor

115020

115021 - `external_client_id: string`

115022

115023 - `kid_hash: string`

115024

115025 - `ip_address: optional string or null`

115026

115027 - `user_agent: optional string or null`

115028

115029 - `telemetry_destination_id: string`

115030

115031 Tagged telemetry destination ID, e.g. "tdst_01HX...".

115032

115033 - `id: optional string`

115034

115035 Unique identifier for the activity e.g. 'activity_abcd1234'

115036

115037 - `created_at: optional string`

115038

115039 When this activity occurred.

115040

115041 format: date-time

115042

115043 - `organization_id: optional string or null`

115044

115045 Organization ID this activity is associated with

115046

115047 - `organization_uuid: optional string or null`

115048

115049 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

115050

115051 - `PlatformTelemetryDestinationUpdated object`

115052

115053 A telemetry destination's configuration was updated. State changes and changes of its workspace scope (the type, or the list through an update's workspace_ids) are included; the workspaces an update took off or put on the list are also recorded as workspace_removed and workspace_added activities. Previous and current values are recorded only for the endpoint URL, the traces URL, the content mode and the workspaces type.

115054

115055 - `type: optional "platform_telemetry_destination_updated"`

115056

115057 default: platform_telemetry_destination_updated

115058

115059 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

115060

115061 - `APIActor object`

115062

115063 - `type: optional "api_actor"`

115064

115065 default: api_actor

115066

115067 - `api_key_id: string`

115068

115069 - `ip_address: string`

115070

115071 - `user_agent: string`

115072

115073 - `UserActor object`

115074

115075 - `type: optional "user_actor"`

115076

115077 default: user_actor

115078

115079 - `email_address: string`

115080

115081 format: email

115082

115083 - `ip_address: string`

115084

115085 - `user_agent: string`

115086

115087 - `user_id: string`

115088

115089 - `UnauthenticatedUserActor object`

115090

115091 - `type: optional "unauthenticated_user_actor"`

115092

115093 default: unauthenticated_user_actor

115094

115095 - `ip_address: string`

115096

115097 - `user_agent: string`

115098

115099 - `unauthenticated_email_address: optional string or null`

115100

115101 format: email

115102

115103 - `AnthropicActor object`

115104

115105 - `type: optional "anthropic_actor"`

115106

115107 default: anthropic_actor

115108

115109 - `email_address: optional string or null`

115110

115111 format: email

115112

115113 - `SystemActor object`

115114

115115 Automated background processing performed by Anthropic systems, acting

115116 without a user or customer credential.

115117

115118 - `type: optional "system_actor"`

115119

115120 default: system_actor

115121

115122 - `service: optional string or null`

115123

115124 Name of the automated process that performed the action, when known.

115125

115126 - `AdminAPIKeyActor object`

115127

115128 - `type: optional "admin_api_key_actor"`

115129

115130 default: admin_api_key_actor

115131

115132 - `admin_api_key_id: string`

115133

115134 - `ip_address: string`

115135

115136 - `user_agent: string`

115137

115138 - `ServiceAccountActor object`

115139

115140 - `type: optional "service_account_actor"`

115141

115142 default: service_account_actor

115143

115144 - `ip_address: string`

115145

115146 - `service_account_id: string`

115147

115148 - `user_agent: string`

115149

115150 - `ScimDirectorySyncActor object`

115151

115152 - `type: optional "scim_directory_sync_actor"`

115153

115154 default: scim_directory_sync_actor

115155

115156 - `directory_id: string`

115157

115158 - `workos_event_id: string`

115159

115160 - `idp_connection_type: optional string or null`

115161

115162 - `FederatedIdentityActor object`

115163

115164 A federated external workload authenticated via a verified OIDC token.

115165

115166 Carries the verified issuer, subject, and audience claims from the

115167 presented JWT.

115168

115169 - `type: optional "federated_identity_actor"`

115170

115171 default: federated_identity_actor

115172

115173 - `issuer: string`

115174

115175 - `subject: string`

115176

115177 - `audience: optional array of string`

115178

115179 - `ip_address: optional string or null`

115180

115181 - `user_agent: optional string or null`

115182

115183 - `FederatedActor object`

115184

115185 An external identity asserted by a trusted provider — a cloud-provider

115186 gateway or a customer-registered federation issuer — acting without an

115187 Anthropic-provisioned account or service account.

115188

115189 - `type: optional "federated_actor"`

115190

115191 default: federated_actor

115192

115193 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

115194

115195 - `FederatedActorAwsProvider object`

115196

115197 Asserting party: the AWS account the organization is bound to.

115198

115199 - `type: optional "aws"`

115200

115201 default: aws

115202

115203 - `account_id: string`

115204

115205 - `signed_principal: string`

115206

115207 The AWS-signed ARN of the IAM principal that requested the token.

115208

115209 - `FederatedActorAzureProvider object`

115210

115211 Asserting party: the Azure subscription the organization is bound to.

115212

115213 - `type: optional "azure"`

115214

115215 default: azure

115216

115217 - `subscription_id: string`

115218

115219 - `FederatedActorGcpProvider object`

115220

115221 Asserting party: the GCP project the organization is bound to.

115222

115223 - `type: optional "gcp"`

115224

115225 default: gcp

115226

115227 - `project_number: string`

115228

115229 - `FederatedActorOidcProvider object`

115230

115231 Asserting party: a customer-registered OIDC federation issuer.

115232

115233 - `type: optional "oidc"`

115234

115235 default: oidc

115236

115237 - `issuer: optional string or null`

115238

115239 The federation issuer's URL. Null when the presented credential failed verification.

115240

115241 - `ip_address: optional string or null`

115242

115243 - `subject: optional string or null`

115244

115245 The provider's verified identifier for the caller; its form depends on the provider.

115246

115247 - `user_agent: optional string or null`

115248

115249 - `AttestedDeviceActor object`

115250

115251 An attested mobile device authenticated via Apple App Attest.

115252

115253 - `type: optional "attested_device_actor"`

115254

115255 default: attested_device_actor

115256

115257 - `external_client_id: string`

115258

115259 - `kid_hash: string`

115260

115261 - `ip_address: optional string or null`

115262

115263 - `user_agent: optional string or null`

115264

115265 - `telemetry_destination_id: string`

115266

115267 Tagged telemetry destination ID, e.g. "tdst_01HX...".

115268

115269 - `id: optional string`

115270

115271 Unique identifier for the activity e.g. 'activity_abcd1234'

115272

115273 - `created_at: optional string`

115274

115275 When this activity occurred.

115276

115277 format: date-time

115278

115279 - `organization_id: optional string or null`

115280

115281 Organization ID this activity is associated with

115282

115283 - `organization_uuid: optional string or null`

115284

115285 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

115286

115287 - `updated_fields: optional array of string`

115288

115289 Names of the configuration fields whose value changed, e.g. "endpoint_url", "headers", "state"; "traces" when any setting for traces changed. Header names and values are never included.

115290

115291 - `updates: optional array of object`

115292

115293 The field-level value changes in this update, in this order: an "endpoint_url" entry when the endpoint URL changed, a "traces_endpoint_url" entry when the traces URL changed, a "traces_content_mode" entry when the content mode changed, and a "workspaces" entry ("all", "include" or "exclude") when the workspaces type changed; empty otherwise.

115294

115295 - `type: "endpoint_url" or "traces_content_mode" or "traces_endpoint_url" or 2 more`

115296

115297 The destination field that changed

115298

115299 - `"endpoint_url"`

115300

115301 - `"traces_content_mode"`

115302

115303 - `"traces_endpoint_url"`

115304

115305 - `"unspecified"`

115306

115307 - `"workspaces"`

115308

115309 - `current_value: string`

115310

115311 Field value immediately after this change

115312

115313 - `previous_value: string`

115314

115315 Field value immediately before this change

115316

115317 - `PlatformTelemetryDestinationWorkspaceAdded object`

115318

115319 A workspace was added to the workspace list of a telemetry destination. When the list type is "include", the destination starts to receive the spans of that workspace; when it is "exclude", the destination stops receiving them.

115320

115321 - `type: optional "platform_telemetry_destination_workspace_added"`

115322

115323 default: platform_telemetry_destination_workspace_added

115324

115325 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

115326

115327 - `APIActor object`

115328

115329 - `type: optional "api_actor"`

115330

115331 default: api_actor

115332

115333 - `api_key_id: string`

115334

115335 - `ip_address: string`

115336

115337 - `user_agent: string`

115338

115339 - `UserActor object`

115340

115341 - `type: optional "user_actor"`

115342

115343 default: user_actor

115344

115345 - `email_address: string`

115346

115347 format: email

115348

115349 - `ip_address: string`

115350

115351 - `user_agent: string`

115352

115353 - `user_id: string`

115354

115355 - `UnauthenticatedUserActor object`

115356

115357 - `type: optional "unauthenticated_user_actor"`

115358

115359 default: unauthenticated_user_actor

115360

115361 - `ip_address: string`

115362

115363 - `user_agent: string`

115364

115365 - `unauthenticated_email_address: optional string or null`

115366

115367 format: email

115368

115369 - `AnthropicActor object`

115370

115371 - `type: optional "anthropic_actor"`

115372

115373 default: anthropic_actor

115374

115375 - `email_address: optional string or null`

115376

115377 format: email

115378

115379 - `SystemActor object`

115380

115381 Automated background processing performed by Anthropic systems, acting

115382 without a user or customer credential.

115383

115384 - `type: optional "system_actor"`

115385

115386 default: system_actor

115387

115388 - `service: optional string or null`

115389

115390 Name of the automated process that performed the action, when known.

115391

115392 - `AdminAPIKeyActor object`

115393

115394 - `type: optional "admin_api_key_actor"`

115395

115396 default: admin_api_key_actor

115397

115398 - `admin_api_key_id: string`

115399

115400 - `ip_address: string`

115401

115402 - `user_agent: string`

115403

115404 - `ServiceAccountActor object`

115405

115406 - `type: optional "service_account_actor"`

115407

115408 default: service_account_actor

115409

115410 - `ip_address: string`

115411

115412 - `service_account_id: string`

115413

115414 - `user_agent: string`

115415

115416 - `ScimDirectorySyncActor object`

115417

115418 - `type: optional "scim_directory_sync_actor"`

115419

115420 default: scim_directory_sync_actor

115421

115422 - `directory_id: string`

115423

115424 - `workos_event_id: string`

115425

115426 - `idp_connection_type: optional string or null`

115427

115428 - `FederatedIdentityActor object`

115429

115430 A federated external workload authenticated via a verified OIDC token.

115431

115432 Carries the verified issuer, subject, and audience claims from the

115433 presented JWT.

115434

115435 - `type: optional "federated_identity_actor"`

115436

115437 default: federated_identity_actor

115438

115439 - `issuer: string`

115440

115441 - `subject: string`

115442

115443 - `audience: optional array of string`

115444

115445 - `ip_address: optional string or null`

115446

115447 - `user_agent: optional string or null`

115448

115449 - `FederatedActor object`

115450

115451 An external identity asserted by a trusted provider — a cloud-provider

115452 gateway or a customer-registered federation issuer — acting without an

115453 Anthropic-provisioned account or service account.

115454

115455 - `type: optional "federated_actor"`

115456

115457 default: federated_actor

115458

115459 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

115460

115461 - `FederatedActorAwsProvider object`

115462

115463 Asserting party: the AWS account the organization is bound to.

115464

115465 - `type: optional "aws"`

115466

115467 default: aws

115468

115469 - `account_id: string`

115470

115471 - `signed_principal: string`

115472

115473 The AWS-signed ARN of the IAM principal that requested the token.

115474

115475 - `FederatedActorAzureProvider object`

115476

115477 Asserting party: the Azure subscription the organization is bound to.

115478

115479 - `type: optional "azure"`

115480

115481 default: azure

115482

115483 - `subscription_id: string`

115484

115485 - `FederatedActorGcpProvider object`

115486

115487 Asserting party: the GCP project the organization is bound to.

115488

115489 - `type: optional "gcp"`

115490

115491 default: gcp

115492

115493 - `project_number: string`

115494

115495 - `FederatedActorOidcProvider object`

115496

115497 Asserting party: a customer-registered OIDC federation issuer.

115498

115499 - `type: optional "oidc"`

115500

115501 default: oidc

115502

115503 - `issuer: optional string or null`

115504

115505 The federation issuer's URL. Null when the presented credential failed verification.

115506

115507 - `ip_address: optional string or null`

115508

115509 - `subject: optional string or null`

115510

115511 The provider's verified identifier for the caller; its form depends on the provider.

115512

115513 - `user_agent: optional string or null`

115514

115515 - `AttestedDeviceActor object`

115516

115517 An attested mobile device authenticated via Apple App Attest.

115518

115519 - `type: optional "attested_device_actor"`

115520

115521 default: attested_device_actor

115522

115523 - `external_client_id: string`

115524

115525 - `kid_hash: string`

115526

115527 - `ip_address: optional string or null`

115528

115529 - `user_agent: optional string or null`

115530

115531 - `telemetry_destination_id: string`

115532

115533 Tagged telemetry destination ID, e.g. "tdst_01HX...".

115534

115535 - `workspace_id: string`

115536

115537 Tagged ID of the workspace put on the list, e.g. "wrkspc_01HX...".

115538

115539 - `id: optional string`

115540

115541 Unique identifier for the activity e.g. 'activity_abcd1234'

115542

115543 - `created_at: optional string`

115544

115545 When this activity occurred.

115546

115547 format: date-time

115548

115549 - `organization_id: optional string or null`

115550

115551 Organization ID this activity is associated with

115552

115553 - `organization_uuid: optional string or null`

115554

115555 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

115556

115557 - `PlatformTelemetryDestinationWorkspaceRemoved object`

115558

115559 A workspace was removed from the workspace list of a telemetry destination, by a change to the list or because the destination was deleted. When the list type is "include", the destination stops receiving the spans of that workspace; when it is "exclude", the destination receives them again unless the destination was deleted.

115560

115561 - `type: optional "platform_telemetry_destination_workspace_removed"`

115562

115563 default: platform_telemetry_destination_workspace_removed

115564

115565 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`

115566

115567 - `APIActor object`

115568

115569 - `type: optional "api_actor"`

115570

115571 default: api_actor

115572

115573 - `api_key_id: string`

115574

115575 - `ip_address: string`

115576

115577 - `user_agent: string`

115578

115579 - `UserActor object`

115580

115581 - `type: optional "user_actor"`

115582

115583 default: user_actor

115584

115585 - `email_address: string`

115586

115587 format: email

115588

115589 - `ip_address: string`

115590

115591 - `user_agent: string`

115592

115593 - `user_id: string`

115594

115595 - `UnauthenticatedUserActor object`

115596

115597 - `type: optional "unauthenticated_user_actor"`

115598

115599 default: unauthenticated_user_actor

115600

115601 - `ip_address: string`

115602

115603 - `user_agent: string`

115604

115605 - `unauthenticated_email_address: optional string or null`

115606

115607 format: email

115608

115609 - `AnthropicActor object`

115610

115611 - `type: optional "anthropic_actor"`

115612

115613 default: anthropic_actor

115614

115615 - `email_address: optional string or null`

115616

115617 format: email

115618

115619 - `SystemActor object`

115620

115621 Automated background processing performed by Anthropic systems, acting

115622 without a user or customer credential.

115623

115624 - `type: optional "system_actor"`

115625

115626 default: system_actor

115627

115628 - `service: optional string or null`

115629

115630 Name of the automated process that performed the action, when known.

115631

115632 - `AdminAPIKeyActor object`

115633

115634 - `type: optional "admin_api_key_actor"`

115635

115636 default: admin_api_key_actor

115637

115638 - `admin_api_key_id: string`

115639

115640 - `ip_address: string`

115641

115642 - `user_agent: string`

115643

115644 - `ServiceAccountActor object`

115645

115646 - `type: optional "service_account_actor"`

115647

115648 default: service_account_actor

115649

115650 - `ip_address: string`

115651

115652 - `service_account_id: string`

115653

115654 - `user_agent: string`

115655

115656 - `ScimDirectorySyncActor object`

115657

115658 - `type: optional "scim_directory_sync_actor"`

115659

115660 default: scim_directory_sync_actor

115661

115662 - `directory_id: string`

115663

115664 - `workos_event_id: string`

115665

115666 - `idp_connection_type: optional string or null`

115667

115668 - `FederatedIdentityActor object`

115669

115670 A federated external workload authenticated via a verified OIDC token.

115671

115672 Carries the verified issuer, subject, and audience claims from the

115673 presented JWT.

115674

115675 - `type: optional "federated_identity_actor"`

115676

115677 default: federated_identity_actor

115678

115679 - `issuer: string`

115680

115681 - `subject: string`

115682

115683 - `audience: optional array of string`

115684

115685 - `ip_address: optional string or null`

115686

115687 - `user_agent: optional string or null`

115688

115689 - `FederatedActor object`

115690

115691 An external identity asserted by a trusted provider — a cloud-provider

115692 gateway or a customer-registered federation issuer — acting without an

115693 Anthropic-provisioned account or service account.

115694

115695 - `type: optional "federated_actor"`

115696

115697 default: federated_actor

115698

115699 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`

115700

115701 - `FederatedActorAwsProvider object`

115702

115703 Asserting party: the AWS account the organization is bound to.

115704

115705 - `type: optional "aws"`

115706

115707 default: aws

115708

115709 - `account_id: string`

115710

115711 - `signed_principal: string`

115712

115713 The AWS-signed ARN of the IAM principal that requested the token.

115714

115715 - `FederatedActorAzureProvider object`

115716

115717 Asserting party: the Azure subscription the organization is bound to.

115718

115719 - `type: optional "azure"`

115720

115721 default: azure

115722

115723 - `subscription_id: string`

115724

115725 - `FederatedActorGcpProvider object`

115726

115727 Asserting party: the GCP project the organization is bound to.

115728

115729 - `type: optional "gcp"`

115730

115731 default: gcp

115732

115733 - `project_number: string`

115734

115735 - `FederatedActorOidcProvider object`

115736

115737 Asserting party: a customer-registered OIDC federation issuer.

115738

115739 - `type: optional "oidc"`

115740

115741 default: oidc

115742

115743 - `issuer: optional string or null`

115744

115745 The federation issuer's URL. Null when the presented credential failed verification.

115746

115747 - `ip_address: optional string or null`

115748

115749 - `subject: optional string or null`

115750

115751 The provider's verified identifier for the caller; its form depends on the provider.

115752

115753 - `user_agent: optional string or null`

115754

115755 - `AttestedDeviceActor object`

115756

115757 An attested mobile device authenticated via Apple App Attest.

115758

115759 - `type: optional "attested_device_actor"`

115760

115761 default: attested_device_actor

115762

115763 - `external_client_id: string`

115764

115765 - `kid_hash: string`

115766

115767 - `ip_address: optional string or null`

115768

115769 - `user_agent: optional string or null`

115770

115771 - `telemetry_destination_id: string`

115772

115773 Tagged telemetry destination ID, e.g. "tdst_01HX...".

115774

115775 - `workspace_id: string`

115776

115777 Tagged ID of the workspace taken off the list, e.g. "wrkspc_01HX...".

115778

115779 - `id: optional string`

115780

115781 Unique identifier for the activity e.g. 'activity_abcd1234'

115782

115783 - `created_at: optional string`

115784

115785 When this activity occurred.

115786

115787 format: date-time

115788

115789 - `organization_id: optional string or null`

115790

115791 Organization ID this activity is associated with

115792

115793 - `organization_uuid: optional string or null`

115794

115795 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

115796

112109115797 - `PlatformUsageReportClaudeCodeViewed object`

112110115798

112111115799 The Claude Code usage report was viewed.

112112115800

api/compliance/apps Changed · +20 / -8 lines

from line 462

462462

463463 default: text

464464

465 - `added_as_context: boolean`

466

467 True when this text block was added to a human message as context for the assistant: the user did not type it in the message box. The wording of the app's own notes for the assistant is not exported: such a block has an empty `text`. Other added text is exported and can include content that the user or their app chose. False does not mean that the user typed the text. Always false on the last text block of a message, on assistant messages, and on messages sent before 2026-10-09, whose notes are exported in full.

468

469 default: false

470

465471 - `text: string`

466472

467473 Text content from human or assistant

from line 474

468474

469475 - `thinking_redacted: boolean`

470476

471 True when content enclosed in the assistant's internal-reasoning tags (or the tag markup itself) was removed from `text` during export. Removal never occurs with this field false. Always false on human messages, whose text is exported verbatim.

477 True when content enclosed in the assistant's internal-reasoning tags (or the tag markup itself) was removed from `text` during export. Removal never occurs with this field false. Always false on human messages.

472478

473479 default: false

474480

from line 737

731737 "type": "text",

732738 "text": "Can you help me draft requirements for our new dashboard feature?",

733739 "truncated": false,

734 "thinking_redacted": false

740 "thinking_redacted": false,

741 "added_as_context": false

735742 }

736743 ],

737744 "files": [

from line 761

754761 "type": "text",

755762 "text": "I'd be happy to help you draft requirements for your dashboard feature...",

756763 "truncated": false,

757 "thinking_redacted": false

764 "thinking_redacted": false,

765 "added_as_context": false

758766 }

759767 ],

760768 "artifacts": [

from line 783

775783 "type": "text",

776784 "text": "Are there any open support tickets about the dashboard?",

777785 "truncated": false,

778 "thinking_redacted": false

786 "thinking_redacted": false,

787 "added_as_context": false

779788 }

780789 ]

781790 },

from line 821

812821 "type": "text",

813822 "text": "There are two open tickets: one about slow loading and one about a missing export button.",

814823 "truncated": false,

815 "thinking_redacted": false

824 "thinking_redacted": false,

825 "added_as_context": false

816826 }

817827 ]

818828 }

from line 3397

33873397

33883398 Artifact identifier (tagged ID)

33893399

3390 - `artifact_type: "claude_design" or "claude_design_systems" or "claude_docs" or 4 more`

3400 - `artifact_type: "claude_dashboards" or "claude_design" or "claude_design_systems" or 5 more`

33913401

3392 Which kind of Artifact this is: `code` for a site published from Claude Code, or the built-in Artifact type it was made from — `claude_docs` (Claude Docs), `claude_slides` (Slides), `claude_design` (Design), `claude_design_systems` (a design system) or `claude_motion` (Motion). `other` is an Artifact made from a built-in type this list does not name yet.

3402 Which kind of Artifact this is: `code` for a site published from Claude Code, or the built-in Artifact type it was made from — `claude_docs` (Claude Docs), `claude_slides` (Slides), `claude_design` (Design), `claude_design_systems` (a design system), `claude_motion` (Motion) or `claude_dashboards` (Dashboards). `other` is an Artifact made from a built-in type this list does not name yet.

3403

3404 - `"claude_dashboards"`

33933405

33943406 - `"claude_design"`

33953407

api/compliance/apps/chats Changed · +15 / -5 lines

from line 544

544544

545545 default: text

546546

547 - `added_as_context: boolean`

548

549 True when this text block was added to a human message as context for the assistant: the user did not type it in the message box. The wording of the app's own notes for the assistant is not exported: such a block has an empty `text`. Other added text is exported and can include content that the user or their app chose. False does not mean that the user typed the text. Always false on the last text block of a message, on assistant messages, and on messages sent before 2026-10-09, whose notes are exported in full.

550

551 default: false

552

547553 - `text: string`

548554

549555 Text content from human or assistant

from line 556

550556

551557 - `thinking_redacted: boolean`

552558

553 True when content enclosed in the assistant's internal-reasoning tags (or the tag markup itself) was removed from `text` during export. Removal never occurs with this field false. Always false on human messages, whose text is exported verbatim.

559 True when content enclosed in the assistant's internal-reasoning tags (or the tag markup itself) was removed from `text` during export. Removal never occurs with this field false. Always false on human messages.

554560

555561 default: false

556562

from line 819

813819 "type": "text",

814820 "text": "Can you help me draft requirements for our new dashboard feature?",

815821 "truncated": false,

816 "thinking_redacted": false

822 "thinking_redacted": false,

823 "added_as_context": false

817824 }

818825 ],

819826 "files": [

from line 843

836843 "type": "text",

837844 "text": "I'd be happy to help you draft requirements for your dashboard feature...",

838845 "truncated": false,

839 "thinking_redacted": false

846 "thinking_redacted": false,

847 "added_as_context": false

840848 }

841849 ],

842850 "artifacts": [

from line 865

857865 "type": "text",

858866 "text": "Are there any open support tickets about the dashboard?",

859867 "truncated": false,

860 "thinking_redacted": false

868 "thinking_redacted": false,

869 "added_as_context": false

861870 }

862871 ]

863872 },

from line 903

894903 "type": "text",

895904 "text": "There are two open tickets: one about slow loading and one about a missing export button.",

896905 "truncated": false,

897 "thinking_redacted": false

906 "thinking_redacted": false,

907 "added_as_context": false

898908 }

899909 ]

900910 }

api/compliance/apps/chats/messages Changed · +22 / -6 lines

from line 163

163163

164164 default: text

165165

166 - `added_as_context: boolean`

167

168 True when this text block was added to a human message as context for the assistant: the user did not type it in the message box. The wording of the app's own notes for the assistant is not exported: such a block has an empty `text`. Other added text is exported and can include content that the user or their app chose. False does not mean that the user typed the text. Always false on the last text block of a message, on assistant messages, and on messages sent before 2026-10-09, whose notes are exported in full.

169

170 default: false

171

166172 - `text: string`

167173

168174 Text content from human or assistant

from line 175

169175

170176 - `thinking_redacted: boolean`

171177

172 True when content enclosed in the assistant's internal-reasoning tags (or the tag markup itself) was removed from `text` during export. Removal never occurs with this field false. Always false on human messages, whose text is exported verbatim.

178 True when content enclosed in the assistant's internal-reasoning tags (or the tag markup itself) was removed from `text` during export. Removal never occurs with this field false. Always false on human messages.

173179

174180 default: false

175181

from line 438

432438 "type": "text",

433439 "text": "Can you help me draft requirements for our new dashboard feature?",

434440 "truncated": false,

435 "thinking_redacted": false

441 "thinking_redacted": false,

442 "added_as_context": false

436443 }

437444 ],

438445 "files": [

from line 462

455462 "type": "text",

456463 "text": "I'd be happy to help you draft requirements for your dashboard feature...",

457464 "truncated": false,

458 "thinking_redacted": false

465 "thinking_redacted": false,

466 "added_as_context": false

459467 }

460468 ],

461469 "artifacts": [

from line 484

476484 "type": "text",

477485 "text": "Are there any open support tickets about the dashboard?",

478486 "truncated": false,

479 "thinking_redacted": false

487 "thinking_redacted": false,

488 "added_as_context": false

480489 }

481490 ]

482491 },

from line 522

513522 "type": "text",

514523 "text": "There are two open tickets: one about slow loading and one about a missing export button.",

515524 "truncated": false,

516 "thinking_redacted": false

525 "thinking_redacted": false,

526 "added_as_context": false

517527 }

518528 ]

519529 }

from line 581

571581

572582 default: text

573583

584 - `added_as_context: boolean`

585

586 True when this text block was added to a human message as context for the assistant: the user did not type it in the message box. The wording of the app's own notes for the assistant is not exported: such a block has an empty `text`. Other added text is exported and can include content that the user or their app chose. False does not mean that the user typed the text. Always false on the last text block of a message, on assistant messages, and on messages sent before 2026-10-09, whose notes are exported in full.

587

588 default: false

589

574590 - `text: string`

575591

576592 Text content from human or assistant

from line 593

577593

578594 - `thinking_redacted: boolean`

579595

580 True when content enclosed in the assistant's internal-reasoning tags (or the tag markup itself) was removed from `text` during export. Removal never occurs with this field false. Always false on human messages, whose text is exported verbatim.

596 True when content enclosed in the assistant's internal-reasoning tags (or the tag markup itself) was removed from `text` during export. Removal never occurs with this field false. Always false on human messages.

581597

582598 default: false

583599

api/compliance/apps/chats/messages/list Changed · +15 / -5 lines

from line 161

161161

162162 default: text

163163

164 - `added_as_context: boolean`

165

166 True when this text block was added to a human message as context for the assistant: the user did not type it in the message box. The wording of the app's own notes for the assistant is not exported: such a block has an empty `text`. Other added text is exported and can include content that the user or their app chose. False does not mean that the user typed the text. Always false on the last text block of a message, on assistant messages, and on messages sent before 2026-10-09, whose notes are exported in full.

167

168 default: false

169

164170 - `text: string`

165171

166172 Text content from human or assistant

from line 173

167173

168174 - `thinking_redacted: boolean`

169175

170 True when content enclosed in the assistant's internal-reasoning tags (or the tag markup itself) was removed from `text` during export. Removal never occurs with this field false. Always false on human messages, whose text is exported verbatim.

176 True when content enclosed in the assistant's internal-reasoning tags (or the tag markup itself) was removed from `text` during export. Removal never occurs with this field false. Always false on human messages.

171177

172178 default: false

173179

from line 436

430436 "type": "text",

431437 "text": "Can you help me draft requirements for our new dashboard feature?",

432438 "truncated": false,

433 "thinking_redacted": false

439 "thinking_redacted": false,

440 "added_as_context": false

434441 }

435442 ],

436443 "files": [

from line 460

453460 "type": "text",

454461 "text": "I'd be happy to help you draft requirements for your dashboard feature...",

455462 "truncated": false,

456 "thinking_redacted": false

463 "thinking_redacted": false,

464 "added_as_context": false

457465 }

458466 ],

459467 "artifacts": [

from line 482

474482 "type": "text",

475483 "text": "Are there any open support tickets about the dashboard?",

476484 "truncated": false,

477 "thinking_redacted": false

485 "thinking_redacted": false,

486 "added_as_context": false

478487 }

479488 ]

480489 },

from line 520

511520 "type": "text",

512521 "text": "There are two open tickets: one about slow loading and one about a missing export button.",

513522 "truncated": false,

514 "thinking_redacted": false

523 "thinking_redacted": false,

524 "added_as_context": false

515525 }

516526 ]

517527 }

api/compliance/apps/code Changed · +5 / -3 lines

from line 94

9494

9595 Artifact identifier (tagged ID)

9696

97 - `artifact_type: "claude_design" or "claude_design_systems" or "claude_docs" or 4 more`

97 - `artifact_type: "claude_dashboards" or "claude_design" or "claude_design_systems" or 5 more`

9898

99 Which kind of Artifact this is: `code` for a site published from Claude Code, or the built-in Artifact type it was made from — `claude_docs` (Claude Docs), `claude_slides` (Slides), `claude_design` (Design), `claude_design_systems` (a design system) or `claude_motion` (Motion). `other` is an Artifact made from a built-in type this list does not name yet.

99 Which kind of Artifact this is: `code` for a site published from Claude Code, or the built-in Artifact type it was made from — `claude_docs` (Claude Docs), `claude_slides` (Slides), `claude_design` (Design), `claude_design_systems` (a design system), `claude_motion` (Motion) or `claude_dashboards` (Dashboards). `other` is an Artifact made from a built-in type this list does not name yet.

100

101 - `"claude_dashboards"`

100102

101103 - `"claude_design"`

102104

api/compliance/apps/code/artifacts Changed · +10 / -6 lines

from line 92

9292

9393 Artifact identifier (tagged ID)

9494

95 - `artifact_type: "claude_design" or "claude_design_systems" or "claude_docs" or 4 more`

95 - `artifact_type: "claude_dashboards" or "claude_design" or "claude_design_systems" or 5 more`

9696

97 Which kind of Artifact this is: `code` for a site published from Claude Code, or the built-in Artifact type it was made from — `claude_docs` (Claude Docs), `claude_slides` (Slides), `claude_design` (Design), `claude_design_systems` (a design system) or `claude_motion` (Motion). `other` is an Artifact made from a built-in type this list does not name yet.

97 Which kind of Artifact this is: `code` for a site published from Claude Code, or the built-in Artifact type it was made from — `claude_docs` (Claude Docs), `claude_slides` (Slides), `claude_design` (Design), `claude_design_systems` (a design system), `claude_motion` (Motion) or `claude_dashboards` (Dashboards). `other` is an Artifact made from a built-in type this list does not name yet.

9898

99 - `"claude_dashboards"`

100

99101 - `"claude_design"`

100102

101103 - `"claude_design_systems"`

from line 424

422424

423425 Artifact identifier (tagged ID)

424426

425 - `artifact_type: "claude_design" or "claude_design_systems" or "claude_docs" or 4 more`

427 - `artifact_type: "claude_dashboards" or "claude_design" or "claude_design_systems" or 5 more`

426428

427 Which kind of Artifact this is: `code` for a site published from Claude Code, or the built-in Artifact type it was made from — `claude_docs` (Claude Docs), `claude_slides` (Slides), `claude_design` (Design), `claude_design_systems` (a design system) or `claude_motion` (Motion). `other` is an Artifact made from a built-in type this list does not name yet.

429 Which kind of Artifact this is: `code` for a site published from Claude Code, or the built-in Artifact type it was made from — `claude_docs` (Claude Docs), `claude_slides` (Slides), `claude_design` (Design), `claude_design_systems` (a design system), `claude_motion` (Motion) or `claude_dashboards` (Dashboards). `other` is an Artifact made from a built-in type this list does not name yet.

430

431 - `"claude_dashboards"`

428432

429433 - `"claude_design"`

430434

api/compliance/apps/code/artifacts/list Changed · +5 / -3 lines

from line 90

9090

9191 Artifact identifier (tagged ID)

9292

93 - `artifact_type: "claude_design" or "claude_design_systems" or "claude_docs" or 4 more`

93 - `artifact_type: "claude_dashboards" or "claude_design" or "claude_design_systems" or 5 more`

9494

95 Which kind of Artifact this is: `code` for a site published from Claude Code, or the built-in Artifact type it was made from — `claude_docs` (Claude Docs), `claude_slides` (Slides), `claude_design` (Design), `claude_design_systems` (a design system) or `claude_motion` (Motion). `other` is an Artifact made from a built-in type this list does not name yet.

95 Which kind of Artifact this is: `code` for a site published from Claude Code, or the built-in Artifact type it was made from — `claude_docs` (Claude Docs), `claude_slides` (Slides), `claude_design` (Design), `claude_design_systems` (a design system), `claude_motion` (Motion) or `claude_dashboards` (Dashboards). `other` is an Artifact made from a built-in type this list does not name yet.

97 - `"claude_dashboards"`

9698

9799 - `"claude_design"`

98100

api/files Changed · +10 / -10 lines

from line 96

9696```bash

9797curl https://api.anthropic.com/v1/files \

9898 -H 'Content-Type: multipart/form-data' \

99 -H 'anthropic-version: 2023-06-01' \

100 -H "X-Api-Key: $ANTHROPIC_API_KEY" \

99 -H 'anthropic-version: 2026-10-21' \

100 -H "Authorization: Bearer $ANTHROPIC_API_KEY" \

101101 -F 'file=@/path/to/file'

102102```

103103

from line 216

216216

217217```bash

218218curl https://api.anthropic.com/v1/files \

219 -H 'anthropic-version: 2023-06-01' \

220 -H "X-Api-Key: $ANTHROPIC_API_KEY"

219 -H 'anthropic-version: 2026-10-21' \

220 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

221221```

222222

223223#### Response (200)

from line 270

270270

271271```bash

272272curl https://api.anthropic.com/v1/files/$FILE_ID/content \

273 -H 'anthropic-version: 2023-06-01' \

274 -H "X-Api-Key: $ANTHROPIC_API_KEY"

273 -H 'anthropic-version: 2026-10-21' \

274 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

275275```

276276

277277## Get File Metadata

from line 356

356356

357357```bash

358358curl https://api.anthropic.com/v1/files/$FILE_ID \

359 -H 'anthropic-version: 2023-06-01' \

360 -H "X-Api-Key: $ANTHROPIC_API_KEY"

359 -H 'anthropic-version: 2026-10-21' \

360 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

361361```

362362

363363#### Response (200)

from line 422

422422```bash

423423curl https://api.anthropic.com/v1/files/$FILE_ID \

424424 -X DELETE \

425 -H 'anthropic-version: 2023-06-01' \

426 -H "X-Api-Key: $ANTHROPIC_API_KEY"

425 -H 'anthropic-version: 2026-10-21' \

426 -H "Authorization: Bearer $ANTHROPIC_API_KEY"

427427```

428428

429429#### Response (200)

api/messages Changed · +5171 / -2068 lines

### Assistant Message Param ### Message Content Param ### System Message Param ### User Message Param

This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.

Nothing in the body moved in this read. What changed is above.