One read of Claude Developer Platformapi-20261027T185806Z
260 pages moved out of 821 read.
Pages moved
260
significant first
Pages read
821
in this capture
Captured
18:58 UTC
Corpus hash
23cb04cc4921
corpus-hash
What this read moved
126-150 of 260, page 6 of 11This capture is too large to show at once. Changes 126-150 of 260 are below, significant first; the rest are on the following screens.
cli-sdks-libraries/sdks/ruby Changed · +6 / -6 lines
from line 4
44description: Install and configure the Anthropic Ruby SDK with Sorbet types, streaming helpers, and connection pooling
55---
66
7The Anthropic Ruby library provides convenient access to the Claude API from any Ruby 3.2.0+ application. It ships with comprehensive types and docstrings in YARD, RBS, and RBI. The standard library's `net/http` is used as the HTTP transport, with connection pooling through the `connection_pool` gem.
7The Anthropic Ruby library provides convenient access to the Claude API from any Ruby 3.2.0+ application. It ships with comprehensive types and docstrings in YARD, RBS, and RBI. The standard library’s `net/http` is used as the HTTP transport, with connection pooling through the `connection_pool` gem.
88
99<Info>
1010 For API feature documentation with code examples, see the [API reference](https://platform.claude.com/docs/en/api/overview). This page covers Ruby-specific SDK features and configuration.
from line 12
1212
1313## Installation
1414
15Add the gem to your application's `Gemfile` with Bundler:
15Add the gem to your application’s `Gemfile` with Bundler:
1616
1717```bash
1818bundle add anthropic
from line 40
4040end
4141```
4242
43For authentication options including Workload Identity Federation, see [Authentication](https://platform.claude.com/docs/en/manage-claude/authentication). If your API key is a [personal or service account key](https://platform.claude.com/docs/en/manage-claude/authentication#key-types) that isn't scoped to a workspace, set the workspace ID in the `anthropic-workspace-id` request header; [Select a workspace](https://platform.claude.com/docs/en/manage-claude/authentication#select-a-workspace) shows the per-request option for this SDK.
43For authentication options including Workload Identity Federation, see [Authentication](https://platform.claude.com/docs/en/manage-claude/authentication). If your API key is a [personal or service account key](https://platform.claude.com/docs/en/manage-claude/authentication#key-types) that isn’t scoped to a workspace, set the workspace ID in the `anthropic-workspace-id` request header; [Select a workspace](https://platform.claude.com/docs/en/manage-claude/authentication#select-a-workspace) shows the per-request option for this SDK.
4444
4545## Streaming
4646
from line 249
249249puts(file_metadata.id)
250250```
251251
252Note that you can also pass a raw `IO` descriptor, but this disables retries, as the library can't determine whether the descriptor is a file or pipe (which cannot be rewound).
252Note that you can also pass a raw `IO` descriptor, but this disables retries, as the library can’t determine whether the descriptor is a file or pipe (which cannot be rewound).
253253
254254## Sorbet
255255
from line 288
288288
289289### Enums
290290
291Because this library does not depend on `sorbet-runtime`, it cannot provide [`T::Enum`](https://sorbet.org/docs/tenum) instances. Instead, the SDK provides "tagged symbols," which are always primitives at runtime:
291Because this library does not depend on `sorbet-runtime`, it cannot provide [`T::Enum`](https://sorbet.org/docs/tenum) instances. Instead, the SDK provides “tagged symbols,” which are always primitives at runtime:
292292
293293```ruby
294294# :auto
from line 298
298298T.reveal_type(Anthropic::MessageCreateParams::ServiceTier::AUTO)
299299```
300300
301Enum parameters have a "relaxed" type, so you can either pass in enum constants or their literal value:
301Enum parameters have a “relaxed” type, so you can either pass in enum constants or their literal value:
302302
303303```ruby
304304anthropic = Anthropic::Client.new
cli-sdks-libraries/sdks/typescript Changed · +8 / -8 lines
from line 55
5555}
5656```
5757
58For authentication options including Workload Identity Federation, see [Authentication](https://platform.claude.com/docs/en/manage-claude/authentication). If your API key is a [personal or service account key](https://platform.claude.com/docs/en/manage-claude/authentication#key-types) that isn't scoped to a workspace, set the workspace ID in the `anthropic-workspace-id` request header; [Select a workspace](https://platform.claude.com/docs/en/manage-claude/authentication#select-a-workspace) shows the per-request option for this SDK.
58For authentication options including Workload Identity Federation, see [Authentication](https://platform.claude.com/docs/en/manage-claude/authentication). If your API key is a [personal or service account key](https://platform.claude.com/docs/en/manage-claude/authentication#key-types) that isn’t scoped to a workspace, set the workspace ID in the `anthropic-workspace-id` request header; [Select a workspace](https://platform.claude.com/docs/en/manage-claude/authentication#select-a-workspace) shows the per-request option for this SDK.
5959
6060## Request and response types
6161
from line 279
279279
280280### MCP error handling
281281
282The conversion functions throw `UnsupportedMCPValueError` if an MCP value isn't supported by the Claude API (for example, unsupported content type, unsupported MIME type, non-HTTP/HTTPS resource link).
282The conversion functions throw `UnsupportedMCPValueError` if an MCP value isn’t supported by the Claude API (for example, unsupported content type, unsupported MIME type, non-HTTP/HTTPS resource link).
283283
284284## Message batches
285285
from line 545
545545
546546### Accessing raw Response data (for example, headers)
547547
548The "raw" `Response` returned by `fetch()` can be accessed through the `.asResponse()` method on the `APIPromise` type that all methods return. This method returns as soon as the headers for a successful response are received and does not consume the response body, so you are free to write custom parsing or streaming logic.
548The “raw” `Response` returned by `fetch()` can be accessed through the `.asResponse()` method on the `APIPromise` type that all methods return. This method returns as soon as the headers for a successful response are received and does not consume the response body, so you are free to write custom parsing or streaming logic.
549549
550550You can also use the `.withResponse()` method to get the raw `Response` along with the parsed data. Unlike `.asResponse()`, this method consumes the body, returning once it is parsed.
551551
from line 604
604604
605605#### Custom logger
606606
607By default, this library logs to `globalThis.console`. You can also provide a custom logger. Most logging libraries are supported, including [pino](https://www.npmjs.com/package/pino), [winston](https://www.npmjs.com/package/winston), [bunyan](https://www.npmjs.com/package/bunyan), [consola](https://www.npmjs.com/package/consola), [signale](https://www.npmjs.com/package/signale), and [@std/log](https://jsr.io/@std/log). If your logger doesn't work, open an issue.
607By default, this library logs to `globalThis.console`. You can also provide a custom logger. Most logging libraries are supported, including [pino](https://www.npmjs.com/package/pino), [winston](https://www.npmjs.com/package/winston), [bunyan](https://www.npmjs.com/package/bunyan), [consola](https://www.npmjs.com/package/consola), [signale](https://www.npmjs.com/package/signale), and [@std/log](https://jsr.io/@std/log). If your logger doesn’t work, open an issue.
608608
609609When providing a custom logger, the `logLevel` option still controls which messages are emitted; messages below the configured level are not sent to your logger.
610610
from line 640
640640
641641#### Undocumented request parameters
642642
643To make requests using undocumented parameters, you can use `// @ts-expect-error` on the undocumented parameter. This library doesn't validate at runtime that the request matches the type, so any extra values you send are sent as-is.
643To make requests using undocumented parameters, you can use `// @ts-expect-error` on the undocumented parameter. This library doesn’t validate at runtime that the request matches the type, so any extra values you send are sent as-is.
644644
645645```typescript
646646client.messages.create({
from line 734
734734
735735## Beta features
736736
737Beta features are available before general release to get early feedback and test new functionality. You can check the availability of all of Claude's capabilities and tools in the [Features overview](https://platform.claude.com/docs/en/build-with-claude/overview).
737Beta features are available before general release to get early feedback and test new functionality. You can check the availability of all of Claude’s capabilities and tools in the [Features overview](https://platform.claude.com/docs/en/build-with-claude/overview).
738738
739739You can access most beta API features through the `beta` property of the client. To enable a particular beta feature, you need to add the appropriate [beta header](https://platform.claude.com/docs/en/api/beta-headers) to the `betas` field when creating a message.
740740
from line 760
760760 In certain scenarios where enabling browser support might not pose significant risks:
761761
762762 * **Internal tools:** If the application is used solely within a controlled internal environment where the users are trusted, the risk of credential exposure can be mitigated.
763 * **Development or debugging purpose:** Enabling this feature temporarily might be acceptable, provided the credentials are short-lived, aren't also used in production environments, or are frequently rotated.
763 * **Development or debugging purpose:** Enabling this feature temporarily might be acceptable, provided the credentials are short-lived, aren’t also used in production environments, or are frequently rotated.
764764</Accordion>
765765
766766## Platform integrations
from line 796
796796
7977971. Changes that only affect static types, without breaking runtime behavior.
7987982. Changes to library internals that are technically public but not intended or documented for external use.
7993. Changes that aren't expected to impact the vast majority of users in practice.
7993. Changes that aren’t expected to impact the vast majority of users in practice.
800800
801801Backward compatibility is taken seriously to ensure you can rely on a smooth upgrade experience.
802802
get-api-key Changed · +5 / -5 lines
from line 16
1616
1717<Steps>
1818 <Step title="Sign in to the Claude Console">
19 Go to the Claude Console at [platform.claude.com](https://platform.claude.com/) and sign in, or create an account if you don't have one yet.
19 Go to the Claude Console at [platform.claude.com](https://platform.claude.com/) and sign in, or create an account if you don’t have one yet.
2020 </Step>
2121
2222 <Step title="Open the API keys page">
from line 28
2828 </Step>
2929
3030 <Step title="Copy and store the key">
31 The Console shows the full key, which starts with `sk-ant-`, only once, at creation. Copy it and store it somewhere safe, such as a secrets manager. If you lose a key, you can't view it again in the Console. Create a new key instead.
31 The Console shows the full key, which starts with `sk-ant-`, only once, at creation. Copy it and store it somewhere safe, such as a secrets manager. If you lose a key, you can’t view it again in the Console. Create a new key instead.
3232 </Step>
3333</Steps>
3434
from line 42
4242export ANTHROPIC_API_KEY="sk-ant-api03-..."
4343```
4444
45The [client SDK](https://platform.claude.com/docs/en/cli-sdks-libraries/overview) reads `ANTHROPIC_API_KEY` automatically. Direct HTTP requests send the key as `Authorization: Bearer <key>`. If your API key isn't scoped to a workspace, you must also send the `anthropic-workspace-id` header on each Claude API request, as shown in [Select a workspace](https://platform.claude.com/docs/en/manage-claude/authentication#select-a-workspace). For the Admin API, see [API keys and the Admin API](https://platform.claude.com/docs/en/get-api-key#api-keys-and-the-admin-api).
45The [client SDK](https://platform.claude.com/docs/en/cli-sdks-libraries/overview) reads `ANTHROPIC_API_KEY` automatically. Direct HTTP requests send the key as `Authorization: Bearer <key>`. If your API key isn’t scoped to a workspace, you must also send the `anthropic-workspace-id` header on each Claude API request, as shown in [Select a workspace](https://platform.claude.com/docs/en/manage-claude/authentication#select-a-workspace). For the Admin API, see [API keys and the Admin API](https://platform.claude.com/docs/en/get-api-key#api-keys-and-the-admin-api).
4646
4747To make your first request, follow the [Quickstart](https://platform.claude.com/docs/en/get-started), and see [Authentication](https://platform.claude.com/docs/en/manage-claude/authentication) for complete details, including short-lived credentials with Workload Identity Federation.
4848
4949## API keys and the Admin API
5050
51The [Admin API](https://platform.claude.com/docs/en/api/organization) includes endpoints for managing your organization's API keys programmatically, such as [Retrieve API Key](https://platform.claude.com/docs/en/api/organization/api_keys/retrieve) and [List API Keys](https://platform.claude.com/docs/en/api/organization/api_keys/list). These endpoints are for organization admins automating key management. They accept an [Admin API key](https://platform.claude.com/docs/en/manage-claude/admin-api-keys), an OAuth token with the `org:admin` scope, or a personal or service account key that isn't scoped to a specific workspace; workspace keys don't work there. They never return a key's secret value, only a partially redacted hint.
51The [Admin API](https://platform.claude.com/docs/en/api/organization) includes endpoints for managing your organization’s API keys programmatically, such as [Retrieve API Key](https://platform.claude.com/docs/en/api/organization/api_keys/retrieve) and [List API Keys](https://platform.claude.com/docs/en/api/organization/api_keys/list). These endpoints are for organization admins automating key management. They accept an [Admin API key](https://platform.claude.com/docs/en/manage-claude/admin-api-keys), an OAuth token with the `org:admin` scope, or a personal or service account key that isn’t scoped to a specific workspace; workspace keys don’t work there. They never return a key’s secret value, only a partially redacted hint.
5252
5353<Note>
54 The Admin API can't recover a lost key or give you a key to call the Claude API with. To get a usable API key, create one on the [API keys](https://platform.claude.com/settings/keys) page (`platform.claude.com/settings/keys`) in the Claude Console.
54 The Admin API can’t recover a lost key or give you a key to call the Claude API with. To get a usable API key, create one on the [API keys](https://platform.claude.com/settings/keys) page (`platform.claude.com/settings/keys`) in the Claude Console.
5555</Note>
5656
get-started Changed · +4 / -4 lines
from line 42
4242 }'
4343 ```
4444
45 Claude returns a JSON response containing the assistant's message:
45 Claude returns a JSON response containing the assistant’s message:
4646
4747 ```json Output
4848 {
from line 471
471471 </Step>
472472
473473 <Step title="Create your code">
474 Save this as `QuickStart.java` in your project's Java source directory (usually `src/main/java/`):
474 Save this as `QuickStart.java` in your project’s Java source directory (usually `src/main/java/`):
475475
476476 ```java Java
477477 import com.anthropic.client.okhttp.AnthropicOkHttpClient;
from line 651
651651
652652## Next steps
653653
654You made your first API call. Next, learn the Messages API patterns you'll use in every Claude integration.
654You made your first API call. Next, learn the Messages API patterns you’ll use in every Claude integration.
655655
656656<Card title="Working with the Messages API" icon="messages" href="https://platform.claude.com/docs/en/build-with-claude/working-with-messages">
657657 Learn multi-turn conversations, system prompts, stop reasons, and other core patterns.
658658</Card>
659659
660Once you're comfortable with the basics, explore further:
660Once you’re comfortable with the basics, explore further:
661661
662662<CardGroup cols={2}>
663663 <Card title="Models overview" icon="brain" href="https://platform.claude.com/docs/en/models/overview">
manage-claude/access-transparency Changed · +15 / -15 lines
from line 4
44description: Receive an audit record of human access to your organization's data by Anthropic personnel through the Compliance API.
55---
66
7Learn how Access Transparency creates a record of human access to your organization's data by Anthropic personnel, what it covers, and how to receive events through the Compliance API.
7Learn how Access Transparency creates a record of human access to your organization’s data by Anthropic personnel, what it covers, and how to receive events through the Compliance API.
88
99<Note>
1010 When Access Transparency is enabled for your organization:
from line 20
2020Anthropic personnel access customer content only under defined conditions. Access Transparency is designed to make such access visible to you. The design rests on the following principles:
2121
2222* **Human access occurs only under a published reason code.**
23* **Human views of your covered content are recorded.** Anthropic's internal tooling that can reach your covered content is instrumented to emit an event on each view.
24* **Events represent human access, not automated processing.** Anthropic's automated safety systems process your content in a secured pipeline with no interactive human access; that processing does not generate `anthropic_access` events. The one event automated processing can initiate is a `cmek_preserve` preservation record (see [CMEK content preservation](https://platform.claude.com/docs/en/manage-claude/access-transparency#cmek-content-preservation)).
23* **Human views of your covered content are recorded.** Anthropic’s internal tooling that can reach your covered content is instrumented to emit an event on each view.
24* **Events represent human access, not automated processing.** Anthropic’s automated safety systems process your content in a secured pipeline with no interactive human access; that processing does not generate `anthropic_access` events. The one event automated processing can initiate is a `cmek_preserve` preservation record (see [CMEK content preservation](https://platform.claude.com/docs/en/manage-claude/access-transparency#cmek-content-preservation)).
2525* **Events arrive on your existing feed.** Activities are accessible through your [Compliance API Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed). Existing credentials, audit, export, and SIEM integrations for the Compliance API still apply.
26* **Events are tamper-evident.** Each event recorded after your organization's [transparency log](https://platform.claude.com/docs/en/manage-claude/access-transparency-log) (beta) is created is also committed to that log. The log is an append-only, signed record that you can verify independently of Anthropic's serving systems.
26* **Events are tamper-evident.** Each event recorded after your organization’s [transparency log](https://platform.claude.com/docs/en/manage-claude/access-transparency-log) (beta) is created is also committed to that log. The log is an append-only, signed record that you can verify independently of Anthropic’s serving systems.
2727
2828## What Access Transparency covers
2929
from line 33
3333## What Access Transparency does not cover
3434
3535* **Automated processing:** Model serving, safety classifiers, and abuse-detection pipelines process your content as part of normal operation and do not generate `anthropic_access` events. Preservation initiated by automated processing does generate a `cmek_preserve` event (see [CMEK content preservation](https://platform.claude.com/docs/en/manage-claude/access-transparency#cmek-content-preservation)).
36* **Your own organization's activity:** Your API calls, admin actions, and Compliance API reads are covered by standard [Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed) event types.
36* **Your own organization’s activity:** Your API calls, admin actions, and Compliance API reads are covered by standard [Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed) event types.
3737* **Claude for Enterprise and Claude Apps:** claude.ai Enterprise seats, Claude for Work, Cowork, and Claude in Chrome are not covered.
3838* **Claude consumer products:** Claude Free, Pro, or Max plans.
39* **Partner-operated platforms:** Amazon Bedrock and Claude Models on Google Cloud (Google managed). Refer to those platforms' transparency controls.
39* **Partner-operated platforms:** Amazon Bedrock and Claude Models on Google Cloud (Google managed). Refer to those platforms’ transparency controls.
4040* **Anything ZDR does not cover:** Products that are not covered by ZDR (for example, the Files API, Anthropic-hosted stateful applications, and the Batch API) are not covered by Access Transparency. See [Zero data retention (ZDR)](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#zero-data-retention-zdr-scope) for additional details.
4141
4242## Getting started
from line 88
8888| `reason_code` | enum | See [Reason codes](https://platform.claude.com/docs/en/manage-claude/access-transparency#reason-codes) |
8989| `resource_details.type` | enum | A resource type, currently only `message`. Extensible for future resource types |
9090| `resource_details.id` | string or null | Identifier of the content accessed |
91| `resource_details.parent` | string or null | Identifier of the content's parent, for example the conversation ID containing a message. Currently `null` or omitted until resources with parents are supported |
91| `resource_details.parent` | string or null | Identifier of the content’s parent, for example the conversation ID containing a message. Currently `null` or omitted until resources with parents are supported |
9292| `organization_id` | string | The organization the content belongs to. Tagged ID format (`org_...`) |
9393| `organization_uuid` | string | The organization the content belongs to. UUID format |
9494| `workspace_id` | string or null | The workspace the content belongs to |
95| `workspace_uuid` | string | The workspace the content belongs to. UUID format. Present when the access was scoped to a workspace, and absent otherwise. Not one of the transparency log's [leaf fields](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#how-an-event-becomes-a-leaf), so an inclusion proof does not cover it |
96| `transparency_log_leaf_index` | integer | The event's zero-based position in your organization's transparency log (beta). Present whenever the event has a leaf, and absent otherwise. See [Verify Access Transparency events with the transparency log](https://platform.claude.com/docs/en/manage-claude/access-transparency-log) |
95| `workspace_uuid` | string | The workspace the content belongs to. UUID format. Present when the access was scoped to a workspace, and absent otherwise. Not one of the transparency log’s [leaf fields](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#how-an-event-becomes-a-leaf), so an inclusion proof does not cover it |
96| `transparency_log_leaf_index` | integer | The event’s zero-based position in your organization’s transparency log (beta). Present whenever the event has a leaf, and absent otherwise. See [Verify Access Transparency events with the transparency log](https://platform.claude.com/docs/en/manage-claude/access-transparency-log) |
9797
9898Example JSON message:
9999
from line 118
118118In rare cases, Anthropic preserves specific content beyond the standard retention window (for example, when a safety review confirms severely harmful content that must be retained for an ongoing investigation). Preservation is itself a logged, customer-visible action:
119119
120120* **A preservation event is written to your feed.** When content is preserved, an event with type `cmek_preserve` is written to your Compliance API Activity Feed. Preservation events carry the same fields as an `anthropic_access` event; only the event type differs, so a parser that handles one handles both. See [Reason codes](https://platform.claude.com/docs/en/manage-claude/access-transparency#reason-codes).
121* **A preservation event is written regardless of how the preservation was initiated.** Preservation ordinarily follows human review of the content, but the event is written whether the preservation was initiated by a human reviewer or by an automated safety pipeline: the record reflects that your content's retention state changed, independent of who changed it.
121* **A preservation event is written regardless of how the preservation was initiated.** Preservation ordinarily follows human review of the content, but the event is written whether the preservation was initiated by a human reviewer or by an automated safety pipeline: the record reflects that your content’s retention state changed, independent of who changed it.
122122* **For CMEK organizations, preservation is a visible key movement.** Preserved content is re-encrypted outside your customer-managed key so that the investigation can continue independent of your key. The preservation event is your record that this occurred. All other retained content remains under your key.
123123
124124Filter for preservation events the same way as access events:
from line 178
178178| Claude Free, Pro, Max | No | Consumer plans are not eligible |
179179| Playground (Claude Console) | No | Not covered |
180180| Microsoft Foundry | No | Not available |
181| Amazon Bedrock, Claude Models on Google Cloud (Google managed) | No | Partner-operated platforms; refer to those platforms' transparency controls |
181| Amazon Bedrock, Claude Models on Google Cloud (Google managed) | No | Partner-operated platforms; refer to those platforms’ transparency controls |
182182
183183## Limitations and exclusions
184184
from line 188
188188
189189### Notification timing
190190
191`anthropic_access` and `cmek_preserve` events are delivered to your Compliance API feed within 2 business days of the access or preservation they record. Do not treat this feed as a real-time alerting channel. The `accessed_at` timestamp reflects when the access occurred, which might be up to 2 business days before the activity becomes visible in your feed. The `created_at` field reflects the time Anthropic recorded the event, and the event usually becomes visible in your feed shortly after that time. These events do not follow the Activity Feed's usual 1-minute [indexing lag](https://platform.claude.com/docs/en/manage-claude/compliance-integration-patterns#window-polling): an event can become visible up to 2 business days after its `created_at`. If you poll the feed by `created_at` window, overlap consecutive windows by at least 2 business days for `anthropic_access` and `cmek_preserve` events so that a late-indexed event is not dropped.
191`anthropic_access` and `cmek_preserve` events are delivered to your Compliance API feed within 2 business days of the access or preservation they record. Do not treat this feed as a real-time alerting channel. The `accessed_at` timestamp reflects when the access occurred, which might be up to 2 business days before the activity becomes visible in your feed. The `created_at` field reflects the time Anthropic recorded the event, and the event usually becomes visible in your feed shortly after that time. These events do not follow the Activity Feed’s usual 1-minute [indexing lag](https://platform.claude.com/docs/en/manage-claude/compliance-integration-patterns#window-polling): an event can become visible up to 2 business days after its `created_at`. If you poll the feed by `created_at` window, overlap consecutive windows by at least 2 business days for `anthropic_access` and `cmek_preserve` events so that a late-indexed event is not dropped.
192192
193193### Automated processing does not generate access events
194194
195`anthropic_access` events record human access only. Anthropic's automated safety systems and classifiers continue to process your content as part of normal operation, and that processing does not generate `anthropic_access` events. The one event automated processing can initiate is a `cmek_preserve` preservation record (see [CMEK content preservation](https://platform.claude.com/docs/en/manage-claude/access-transparency#cmek-content-preservation)). An empty feed means no human at Anthropic has viewed your content; it does not mean your content was not processed by automated systems.
195`anthropic_access` events record human access only. Anthropic’s automated safety systems and classifiers continue to process your content as part of normal operation, and that processing does not generate `anthropic_access` events. The one event automated processing can initiate is a `cmek_preserve` preservation record (see [CMEK content preservation](https://platform.claude.com/docs/en/manage-claude/access-transparency#cmek-content-preservation)). An empty feed means no human at Anthropic has viewed your content; it does not mean your content was not processed by automated systems.
196196
197197### Access Transparency does not change what Anthropic can access
198198
from line 200
200200
201201### CMEK key-use logs are not a per-read record
202202
203For organizations that also enable CMEK, your cloud KMS audit log (CloudTrail, Cloud Audit Logs, or Azure Monitor) records Anthropic's use of your key. Because keys are cached for short periods during operation, an individual human read does not necessarily produce a distinct KMS decryption entry. Use the Access Transparency feed as the per-access record; your KMS log independently confirms key usage patterns.
203For organizations that also enable CMEK, your cloud KMS audit log (CloudTrail, Cloud Audit Logs, or Azure Monitor) records Anthropic’s use of your key. Because keys are cached for short periods during operation, an individual human read does not necessarily produce a distinct KMS decryption entry. Use the Access Transparency feed as the per-access record; your KMS log independently confirms key usage patterns.
204204
205205## Frequently asked questions
206206
from line 238
238238 </Accordion>
239239
240240 <Accordion title="How can I tell that my Access Transparency record has not been altered?">
241 Verify your organization's transparency log (beta): an append-only, signed record of your Access Transparency events, with inclusion and consistency proofs you check on your own infrastructure. See [Verify Access Transparency events with the transparency log](https://platform.claude.com/docs/en/manage-claude/access-transparency-log).
241 Verify your organization’s transparency log (beta): an append-only, signed record of your Access Transparency events, with inclusion and consistency proofs you check on your own infrastructure. See [Verify Access Transparency events with the transparency log](https://platform.claude.com/docs/en/manage-claude/access-transparency-log).
242242 </Accordion>
243243
244244 <Accordion title="How do I request Access Transparency?">
manage-claude/access-transparency-log Changed · +61 / -61 lines
from line 6
66 status: beta
77---
88
9Learn how to cryptographically verify that no [Access Transparency](https://platform.claude.com/docs/en/manage-claude/access-transparency) event was removed or altered after it was committed to your organization's transparency log.
9Learn how to cryptographically verify that no [Access Transparency](https://platform.claude.com/docs/en/manage-claude/access-transparency) event was removed or altered after it was committed to your organization’s transparency log.
1010
1111<Note>
1212 The transparency log is in beta, and its endpoints and response shapes may change during the beta. It is part of Access Transparency, which is available to eligible customers on request and is not self-serve (see [Access Transparency](https://platform.claude.com/docs/en/manage-claude/access-transparency)). Anthropic maintains one for your organization once Access Transparency is enabled. You read it through the Compliance API with the same key and scope you use for the [Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed).
from line 24
2424
2525When Access Transparency is enabled, Anthropic maintains a transparency log for your organization. It is an append-only, cryptographically signed record of Access Transparency events (`anthropic_access` and `cmek_preserve`). Each such event recorded for your organization after the log was created is appended to it. The log follows the C2SP tlog-tiles format, so tooling built for that standard can parse its checkpoints, tiles, and proofs.
2626
27* **One log for each organization.** Each organization's log has a fixed origin string: `axt.anthropic.com/<your organization UUID>`. The origin never changes for the life of the organization.
28* **Every new event becomes a leaf.** When an Access Transparency event becomes eligible to appear on your Activity Feed, it is first appended to your log as a leaf, and only then served on the feed. A leaf is a deterministic serialization of the event's documented fields. The event on your feed carries `transparency_log_leaf_index`, its zero-based position in your log.
29* **Checkpoints commit to the whole history.** The log is a Merkle tree. Whenever it grows, Anthropic publishes a signed checkpoint: a short text document stating the log's origin, its current size, and the root hash that commits to every leaf. Each checkpoint carries exactly one signature from the log's signing key.
27* **One log for each organization.** Each organization’s log has a fixed origin string: `axt.anthropic.com/<your organization UUID>`. The origin never changes for the life of the organization.
28* **Every new event becomes a leaf.** When an Access Transparency event becomes eligible to appear on your Activity Feed, it is first appended to your log as a leaf, and only then served on the feed. A leaf is a deterministic serialization of the event’s documented fields. The event on your feed carries `transparency_log_leaf_index`, its zero-based position in your log.
29* **Checkpoints commit to the whole history.** The log is a Merkle tree. Whenever it grows, Anthropic publishes a signed checkpoint: a short text document stating the log’s origin, its current size, and the root hash that commits to every leaf. Each checkpoint carries exactly one signature from the log’s signing key.
3030* **Two proofs follow.** An inclusion proof shows that a specific event is present at its position under a checkpoint. A consistency proof shows that a later checkpoint is an append-only extension of an earlier one you saved, so nothing between them was removed or changed.
3131* **Verification keys are served in-band.** The [verifier keys endpoint](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#read-the-verifier-keys) returns the public keys that sign checkpoints. In a planned key rotation, the new key is added to that list before it starts signing, and earlier keys stay listed. Checkpoints you already hold therefore keep verifying.
3232
from line 41
4141* It does not prove that every access was recorded, or that a recorded event accurately describes the access. It proves only that what Anthropic committed to the log has not changed since.
4242* It does not change [what Access Transparency covers](https://platform.claude.com/docs/en/manage-claude/access-transparency#what-access-transparency-covers) or when events arrive.
4343* Served fields that no [leaf version](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#how-an-event-becomes-a-leaf) includes, such as `workspace_uuid`, are not covered by the proof. A field added to events later is covered only once a leaf version includes it.
44* An inclusion proof speaks for an event you were served. It does not by itself prove that the feed listed every leaf the log holds. The log's [entry bundles](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#read-an-entry-bundle) contain every leaf, so you can read the complete set of committed events directly when you need it.
44* An inclusion proof speaks for an event you were served. It does not by itself prove that the feed listed every leaf the log holds. The log’s [entry bundles](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#read-an-entry-bundle) contain every leaf, so you can read the complete set of committed events directly when you need it.
4545* The presence of `transparency_log_leaf_index` on an event is a pointer, not a proof. Always verify inclusion before treating an event as committed in the log.
46* The protection against a rewritten history comes from the checkpoints you keep. A checkpoint's signature by a key listed in [Published key fingerprints](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#published-key-fingerprints) proves that it came from Anthropic's log. A consistency proof from the checkpoint you saved last time proves that the history you already observed only grew.
46* The protection against a rewritten history comes from the checkpoints you keep. A checkpoint’s signature by a key listed in [Published key fingerprints](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#published-key-fingerprints) proves that it came from Anthropic’s log. A consistency proof from the checkpoint you saved last time proves that the history you already observed only grew.
4747
4848## Before you start
4949
5050You need:
5151
52* A Compliance Access Key with the `read:compliance_activities` scope, the same key and scope you use for the [Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed). A parent-organization key can read each enrolled child organization's log by naming the child organization on every request.
53* Your organization's UUID. Find it on the [Organization](https://platform.claude.com/settings/organization) page (`platform.claude.com/settings/organization`) in the Claude Console. It is the same value the Activity Feed serves as `organization_uuid`, but take it from the Console. This value is what makes a checkpoint yours, so it must not come from the API you are verifying. You derive your log's origin from it as `axt.anthropic.com/<organization UUID>`. Derive this string yourself. Do not read it from an API response.
54* Somewhere durable to keep the last checkpoint you verified. That saved checkpoint is what turns "the log is consistent today" into "the log has been consistent since you started watching."
52* A Compliance Access Key with the `read:compliance_activities` scope, the same key and scope you use for the [Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed). A parent-organization key can read each enrolled child organization’s log by naming the child organization on every request.
53* Your organization’s UUID. Find it on the [Organization](https://platform.claude.com/settings/organization) page (`platform.claude.com/settings/organization`) in the Claude Console. It is the same value the Activity Feed serves as `organization_uuid`, but take it from the Console. This value is what makes a checkpoint yours, so it must not come from the API you are verifying. You derive your log’s origin from it as `axt.anthropic.com/<organization UUID>`. Derive this string yourself. Do not read it from an API response.
54* Somewhere durable to keep the last checkpoint you verified. That saved checkpoint is what turns “the log is consistent today” into “the log has been consistent since you started watching.”
5555
5656## Timing
5757
5858* **Events:** Access Transparency events appear on your Activity Feed within 2 business days of the access. An event enters the log only once it is eligible to be served, so the log never reveals an event early. Because the log is written before the feed serves the event, an entry can briefly appear in the log before its event appears on your feed. That gap is not a discrepancy.
5959* **Checkpoints:** A new checkpoint is published whenever your log grows.
60* **Inclusion proofs:** A proof for a newly served event is available once a checkpoint covering the event's position is published, normally very shortly after the event appears. If you request one sooner, you receive a `404` and retry after a short delay.
60* **Inclusion proofs:** A proof for a newly served event is available once a checkpoint covering the event’s position is published, normally very shortly after the event appears. If you request one sooner, you receive a `404` and retry after a short delay.
6161* **Verification cadence:** Run your verification at least daily. Hourly is reasonable.
6262* **Disenrollment:** If your organization stops using Access Transparency, nothing is deleted. Your log stays readable through the same endpoints. If Access Transparency is enabled again later, the same log continues.
6363
from line 64
6464## Retention and deletion
6565
6666* **Transparency log:** Anthropic does not delete entries from your log, and the log has no expiry. It is kept if your organization stops using Access Transparency and after your organization is deleted, because removing entries is the change the log exists to detect. [Entry bundles](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#read-an-entry-bundle) hold the [leaf fields](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#how-an-event-becomes-a-leaf) of each event, so those fields are kept for as long as the log is.
67* **Activity Feed:** Access Transparency events on the Activity Feed follow the feed's retention. Activities are retained for 6 years. See [Query the Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed).
67* **Activity Feed:** Access Transparency events on the Activity Feed follow the feed’s retention. Activities are retained for 6 years. See [Query the Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed).
6868* **No deletion by you:** The transparency log endpoints are read-only. There is no way to delete or amend an entry.
6969
7070## Transparency log endpoints
from line 80
8080| [`GET /tile/{level}/{index}`](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#read-a-hash-tile) | A Merkle hash tile |
8181| [`GET /tile/entries/{index}`](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#read-an-entry-bundle) | An entry bundle of leaf bytes |
8282
83Checkpoints, tiles, and entry bundles follow the C2SP tlog-tiles wire format exactly. The two proof endpoints are conveniences: every proof is also computable from tiles, so you never have to trust a proof endpoint's output. You verify the hashes it returns against a signed checkpoint.
83Checkpoints, tiles, and entry bundles follow the C2SP tlog-tiles wire format exactly. The two proof endpoints are conveniences: every proof is also computable from tiles, so you never have to trust a proof endpoint’s output. You verify the hashes it returns against a signed checkpoint.
8484
8585### Authentication and scoping
8686
8787Send your Compliance Access Key in the `x-api-key` header and the `anthropic-version` header, as for every Compliance API request (see [Versioning](https://platform.claude.com/docs/en/manage-claude/compliance-api#versioning)). The Compliance API must be enabled for your organization.
8888
89There is no separate transparency log permission. Any key that can read your organization's Activity Feed, for your organization or its parent, can read your whole log, including the event fields in its entry bundles.
89There is no separate transparency log permission. Any key that can read your organization’s Activity Feed, for your organization or its parent, can read your whole log, including the event fields in its entry bundles.
9090
91Every request reads exactly one organization's log:
91Every request reads exactly one organization’s log:
9292
93* An organization-level key reads its own organization's log. The `organization_id` query parameter is optional. If present, it must name the key's own organization.
93* An organization-level key reads its own organization’s log. The `organization_id` query parameter is optional. If present, it must name the key’s own organization.
9494* A parent-organization-level key must pass `organization_id`, naming one child organization.
9595* `organization_id` accepts the `org_...` tagged ID or the organization UUID.
9696
97A `404` means there is no log this key can read. An organization outside the key's scope, a nonexistent organization, and an organization whose log has not been created yet are deliberately indistinguishable. The log of an organization that has since stopped using Access Transparency is not this case: it continues to be served.
97A `404` means there is no log this key can read. An organization outside the key’s scope, a nonexistent organization, and an organization whose log has not been created yet are deliberately indistinguishable. The log of an organization that has since stopped using Access Transparency is not this case: it continues to be served.
9898
9999### Errors
100100
from line 105
105105| `400` | `organization_id` is malformed or is omitted with a parent-organization key, the Compliance API is not enabled, a query parameter is unknown, or a per-endpoint validation failed |
106106| `401` | The API key is missing or not valid |
107107| `403` | The key lacks the required scope |
108| `404` | No log readable by this key, or the per-endpoint "not covered" and "beyond the tree" cases |
109| `429` | Rate limited. These endpoints share the Compliance API's per-parent-organization [rate limit](https://platform.claude.com/docs/en/manage-claude/compliance-api). Honor `retry-after` |
108| `404` | No log readable by this key, or the per-endpoint “not covered” and “beyond the tree” cases |
109| `429` | Rate limited. These endpoints share the Compliance API’s per-parent-organization [rate limit](https://platform.claude.com/docs/en/manage-claude/compliance-api). Honor `retry-after` |
110110| `503` | The log is temporarily unavailable. Retry with backoff |
111111
112112### Caching
from line 134
134134— axt.anthropic.com/25f6429a-3293-49bf-afed-cb312911554b q83vATBFAiEAvL8m…(base64)…
135135```
136136
137* The first 4 bytes of the decoded signature value are the signing key's `key_hash`, which tells you which entry in the [verifier key set](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#read-the-verifier-keys) to verify with. The remaining bytes are an ASN.1 DER ECDSA P-256 signature over the SHA-256 of the note body: every byte before the blank line, including the body's trailing newline.
137* The first 4 bytes of the decoded signature value are the signing key’s `key_hash`, which tells you which entry in the [verifier key set](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#read-the-verifier-keys) to verify with. The remaining bytes are an ASN.1 DER ECDSA P-256 signature over the SHA-256 of the note body: every byte before the blank line, including the body’s trailing newline.
138138* A checkpoint can carry additional lines after the root hash. Ignore lines you do not understand. They are covered by the signature.
139139* Ignore a signature line whose name is not your origin or whose key hash you do not hold.
140* Never cache a checkpoint. A stale one hides the log's current size, so newly served events look uncovered.
140* Never cache a checkpoint. A stale one hides the log’s current size, so newly served events look uncovered.
141141
142142### Read the verifier keys
143143
from line 172
172172| `origin` | string | The origin line every checkpoint of this log carries. Informational: compare checkpoints against the origin you derive yourself, not against this field |
173173| `log_keys` | array | The key that signs new checkpoints first, then every other key the log serves, newest first. Never empty |
174174| `log_keys[].verifier_key` | string | The key as a C2SP note-verifier string, `<origin>+<key_hash>+<base64 key>`, accepted by tlog-tiles tooling that supports ECDSA note keys (for example, the Go `github.com/transparency-dev/formats` module). The base64 part decodes to the algorithm byte `0x02` followed by the DER-encoded public key |
175| `log_keys[].key_hash` | string | Eight lowercase hex digits. The 4-byte selector that matches this key to a checkpoint's signature line. It is the first 4 bytes of `fingerprint` and is not an identity |
175| `log_keys[].key_hash` | string | Eight lowercase hex digits. The 4-byte selector that matches this key to a checkpoint’s signature line. It is the first 4 bytes of `fingerprint` and is not an identity |
176176| `log_keys[].fingerprint` | string | 64 lowercase hex digits: the SHA-256 of the DER `SubjectPublicKeyInfo` |
177177| `log_keys[].algorithm` | string | The key type, currently `ecdsa_p256_sha256`. Values may be added. Skip a key whose algorithm you do not support |
178178| `log_keys[].public_key` | string | The public key as base64 DER `SubjectPublicKeyInfo` |
179179
180The `key_hash` covers only the key bytes: it is the first 4 bytes of SHA-256 over the DER `SubjectPublicKeyInfo`, which is the rule the ECDSA note-verifier encoding uses. It is not the name-dependent key ID that the base signed-note format defines for Ed25519 keys, so it does not change with the origin. A valid signature by a key listed in [Published key fingerprints](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#published-key-fingerprints) proves the checkpoint came from Anthropic's transparency log service. The origin line inside the signed checkpoint is what binds it to your organization. That is why you compare that line against the origin you derive yourself.
180The `key_hash` covers only the key bytes: it is the first 4 bytes of SHA-256 over the DER `SubjectPublicKeyInfo`, which is the rule the ECDSA note-verifier encoding uses. It is not the name-dependent key ID that the base signed-note format defines for Ed25519 keys, so it does not change with the origin. A valid signature by a key listed in [Published key fingerprints](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#published-key-fingerprints) proves the checkpoint came from Anthropic’s transparency log service. The origin line inside the signed checkpoint is what binds it to your organization. That is why you compare that line against the origin you derive yourself.
181181
182182Keys can rotate:
183183
from line 195
195195
196196A planned rotation is announced on this page at least 30 days before the new key signs its first checkpoint. During that notice period the new key is listed in `log_keys` and in this table with its switch date. Retired keys stay listed with their service dates. A key that does not appear in this table is not legitimate, whatever `GET /keys` returns. Treat a checkpoint that verifies under no listed key as a verification failure, and report it to your Anthropic account representative or [Anthropic support](https://support.claude.com).
197197
198`axt-verify` carries the current key in each release and never reads a key from the API (see [Verify with axt-verify](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#verify-with-axt-verify)). Each release carries exactly one key. On the switch date, Anthropic starts signing with the new key and publishes the `axt-verify` release that carries it. On the same date Anthropic re-issues every organization's latest checkpoint under the new key, even for a log that has not grown. Upgrade on the switch date. Running the old release after the switch fails with exit status `1`, and so does running the new release before it. Either failure clears once you run the matching release. A verifier you maintain yourself needs the new fingerprint, with its switch date, added before that date.
198`axt-verify` carries the current key in each release and never reads a key from the API (see [Verify with axt-verify](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#verify-with-axt-verify)). Each release carries exactly one key. On the switch date, Anthropic starts signing with the new key and publishes the `axt-verify` release that carries it. On the same date Anthropic re-issues every organization’s latest checkpoint under the new key, even for a log that has not grown. Upgrade on the switch date. Running the old release after the switch fails with exit status `1`, and so does running the new release before it. Either failure clears once you run the matching release. A verifier you maintain yourself needs the new fingerprint, with its switch date, added before that date.
199199
200200### Fetch an inclusion proof
201201
from line 203
203203
204204| Parameter | Type | Description |
205205| ----------------- | ----------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
206| `leaf_index` | integer, required | The event's position in the log: the `transparency_log_leaf_index` the Activity Feed served on the event. Must be zero or greater |
206| `leaf_index` | integer, required | The event’s position in the log: the `transparency_log_leaf_index` the Activity Feed served on the event. Must be zero or greater |
207207| `organization_id` | string, optional | See [Authentication and scoping](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#authentication-and-scoping) |
208208
209209```bash
from line 230
230230| Field | Type | Description |
231231| ------------ | ---------------- | ------------------------------------------------------------------------------------------ |
232232| `type` | string | Always `transparency_log_inclusion_proof` |
233| `leaf_index` | integer | The event's position in the log, echoed from the request |
233| `leaf_index` | integer | The event’s position in the log, echoed from the request |
234234| `hashes` | array of strings | The base64 sibling hashes of the audit path, ordered from the leaf up to the root |
235235| `checkpoint` | string | The latest signed checkpoint, the one the proof verifies against. It carries the tree size |
236236
from line 249
249249
250250| Parameter | Type | Description |
251251| ----------------- | ----------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
252| `from` | integer, required | The tree size of the earlier checkpoint you hold. Must be at least 1 and at most the latest checkpoint's tree size |
252| `from` | integer, required | The tree size of the earlier checkpoint you hold. Must be at least 1 and at most the latest checkpoint’s tree size |
253253| `organization_id` | string, optional | See [Authentication and scoping](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#authentication-and-scoping) |
254254
255255```bash
from line 279
279279| `checkpoint` | string | The latest signed checkpoint, the one the proof extends to. It carries the tree size |
280280
281281* The proof always extends to the latest published checkpoint. This API never serves historical checkpoints: you keep the ones you are served.
282* A `from` equal to the latest checkpoint's tree size returns the empty proof.
282* A `from` equal to the latest checkpoint’s tree size returns the empty proof.
283283* A held checkpoint of tree size 0 needs no consistency proof, because every log extends the empty log. Adopt the latest checkpoint directly in that case.
284* A `from` less than 1, or greater than the latest checkpoint's tree size, returns `400`.
284* A `from` less than 1, or greater than the latest checkpoint’s tree size, returns `400`.
285285* If the log can no longer prove that it extends a checkpoint it once signed for you, treat that as a verification failure, not a usage error.
286286
287287### Read a hash tile
from line 291
291291Returns `application/octet-stream`: concatenated 32-byte SHA-256 hashes, as tlog-tiles specifies. Tile addressing follows tlog-tiles exactly, including the `{level}` and `{index}` path grammar, the `x001/234` index form for large trees, and the partial-tile suffix `.p/{width}`. Hash tiles are the unit from which tlog-tiles clients compute proofs themselves.
292292
293293* Full tiles are immutable and are served with `Cache-Control: private, max-age=604800, immutable`.
294* Partial tiles are superseded as the tree grows and are served with `Cache-Control: private, no-store`. Once a tile fills, a request for its earlier partial form can return `404` even though the full tile exists. Falling back from the partial tile to the full tile is the client's job, as tlog-tiles specifies, and standard clients already do it.
294* Partial tiles are superseded as the tree grows and are served with `Cache-Control: private, no-store`. Once a tile fills, a request for its earlier partial form can return `404` even though the full tile exists. Falling back from the partial tile to the full tile is the client’s job, as tlog-tiles specifies, and standard clients already do it.
295295* A malformed `level`, `index`, or partial-tile width returns `400`. A tile position beyond the current tree size returns `404`.
296296
297297### Read an entry bundle
from line 298
298298
299299`GET /v1/compliance/transparency_log/tile/entries/{index}`
300300
301Returns `application/octet-stream`: consecutive leaf entries, each prefixed with its big-endian `uint16` length, as tlog-tiles specifies. Entry bundles contain event plaintext: the [canonical bytes](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#how-an-event-becomes-a-leaf) of each Access Transparency event. That is why the whole surface requires the Activity Feed's scope. Addressing, the partial form, caching, and errors are identical to hash tiles.
301Returns `application/octet-stream`: consecutive leaf entries, each prefixed with its big-endian `uint16` length, as tlog-tiles specifies. Entry bundles contain event plaintext: the [canonical bytes](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#how-an-event-becomes-a-leaf) of each Access Transparency event. That is why the whole surface requires the Activity Feed’s scope. Addressing, the partial form, caching, and errors are identical to hash tiles.
302302
303303## The `transparency_log_leaf_index` field on Activity Feed events
304304
from line 305
305305`anthropic_access` and `cmek_preserve` events on `GET /v1/compliance/activities` carry `transparency_log_leaf_index`, an integer, whenever the event has a leaf. Other activity types never carry it.
306306
307307* **The key is absent, not `null`, when the event has no leaf.** A robust verifier treats an absent key and a `null` value the same way.
308* **An event is served without `transparency_log_leaf_index` in only two cases.** The first is while your organization is not enrolled in Access Transparency, that is, before enrollment or between an un-enrollment and a re-enrollment. The second is when the event was recorded before your organization's log was created. For an organization enrolled before the transparency log was introduced, that includes its earlier history. Once your log exists and while you are enrolled, every event is appended to the log before the feed serves it. If a fault prevents the feed from obtaining the index, the feed delays the event rather than serving it without one. The event is not lost: it is already in the log and appears on the feed, index included, once the fault is remediated. An index-less event is not expected when it is dated after your log was created and falls inside a period when you were enrolled.
308* **An event is served without `transparency_log_leaf_index` in only two cases.** The first is while your organization is not enrolled in Access Transparency, that is, before enrollment or between an un-enrollment and a re-enrollment. The second is when the event was recorded before your organization’s log was created. For an organization enrolled before the transparency log was introduced, that includes its earlier history. Once your log exists and while you are enrolled, every event is appended to the log before the feed serves it. If a fault prevents the feed from obtaining the index, the feed delays the event rather than serving it without one. The event is not lost: it is already in the log and appears on the feed, index included, once the fault is remediated. An index-less event is not expected when it is dated after your log was created and falls inside a period when you were enrolled.
309309* **A present index is a pointer, not a proof.** Verify inclusion before treating the event as committed in the log. The anomaly worth escalating is a present index whose inclusion proof still cannot be fetched long after a covering checkpoint should have been published.
310310* The index is assigned when the event is appended to the log and is not one of the fields that make up the leaf.
311311
312312## How an event becomes a leaf
313313
314A leaf entry is one schema-version byte followed by canonical JSON of that version's fields. The JSON follows [RFC 8785](https://www.rfc-editor.org/rfc/rfc8785) (JSON Canonicalization Scheme), and the fields are taken from the event exactly as the Activity Feed serves it.
314A leaf entry is one schema-version byte followed by canonical JSON of that version’s fields. The JSON follows [RFC 8785](https://www.rfc-editor.org/rfc/rfc8785) (JSON Canonicalization Scheme), and the fields are taken from the event exactly as the Activity Feed serves it.
315315
316316A leaf version is a fixed set of fields, and each field is either required or optional.
317317
from line 325
325325
326326* `user_profile_id`, the ID of the [user profile](https://platform.claude.com/docs/en/api/beta/user_profiles) the accessed or preserved data was created under
327327
328Once your log starts writing a version, it writes every new leaf under that version until it starts writing the next one, even when the event has none of the version's optional fields. [Upgrade for a new leaf version](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#upgrade-for-a-new-leaf-version) says when your log can start writing a new version. A leaf never changes once it is written, so it keeps its version for good. One log can therefore hold leaves of more than one version. Nothing the Activity Feed or the proof endpoints serve says which version a leaf has (only the leaf's own bytes in an [entry bundle](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#read-an-entry-bundle) do), and you do not need to know: the last of the following rules says which entries to rebuild for an event.
328Once your log starts writing a version, it writes every new leaf under that version until it starts writing the next one, even when the event has none of the version’s optional fields. [Upgrade for a new leaf version](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#upgrade-for-a-new-leaf-version) says when your log can start writing a new version. A leaf never changes once it is written, so it keeps its version for good. One log can therefore hold leaves of more than one version. Nothing the Activity Feed or the proof endpoints serve says which version a leaf has (only the leaf’s own bytes in an [entry bundle](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#read-an-entry-bundle) do), and you do not need to know: the last of the following rules says which entries to rebuild for an event.
329329
330330The rules:
331331
332* Served fields outside a version's set, such as `workspace_uuid` and `transparency_log_leaf_index` itself, are ignored.
332* Served fields outside a version’s set, such as `workspace_uuid` and `transparency_log_leaf_index` itself, are ignored.
333333
334334* A required field that the served event omits, or serves as `null`, enters the leaf as `null`. An empty string is distinct from `null`.
335335
from line 345
345345
346346* Canonical JSON means object keys sorted, no insignificant whitespace, and minimal string escaping. No numbers appear anywhere in the leaf.
347347
348* The leaf hash is RFC 6962's `SHA-256(0x00 || entry)`. Interior nodes hash as `SHA-256(0x01 || left || right)`.
348* The leaf hash is RFC 6962’s `SHA-256(0x00 || entry)`. Interior nodes hash as `SHA-256(0x01 || left || right)`.
349349
350350* A verifier that reads leaf entries, for example from an [entry bundle](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#read-an-entry-bundle), rejects an unknown version byte, and a leaf whose `type` is not one of the two Access Transparency types. New fields, new event types, and rule changes ship under a new version byte. Existing leaves never re-hash.
351351
352* Rebuild a served event's entry under each leaf version whose fields include every optional field the served event has as a string (every version, when it has none), and under no other version. The event verifies if its inclusion proof matches the leaf hash of any one of them. If an optional field is removed from, added to, or changed in the event you are served, the event fails verification on any verifier that rebuilds a leaf version with that field, whichever leaf the log holds.
352* Rebuild a served event’s entry under each leaf version whose fields include every optional field the served event has as a string (every version, when it has none), and under no other version. The event verifies if its inclusion proof matches the leaf hash of any one of them. If an optional field is removed from, added to, or changed in the event you are served, the event fails verification on any verifier that rebuilds a leaf version with that field, whichever leaf the log holds.
353353
354354For example, this access event as the Activity Feed serves it:
355355
from line 391
391391
392392Verification runs on your own infrastructure. Everything the API returns is untrusted until it verifies against two things you hold yourself. The first is the origin you derive from your organization UUID. The second is the checkpoint you saved on your last run. A complete verification run does the following, in order:
393393
3941. Fetch the [verifier key set](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#read-the-verifier-keys). Compute each key's fingerprint yourself as the SHA-256 of its base64-decoded `public_key`. Keep only the keys whose fingerprint appears in [Published key fingerprints](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#published-key-fingerprints), together with each key's status there. Verify a newly fetched checkpoint only under a key that table lists as current on that date. Accept a retired key only for a checkpoint you saved before its retirement date.
3941. Fetch the [verifier key set](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#read-the-verifier-keys). Compute each key’s fingerprint yourself as the SHA-256 of its base64-decoded `public_key`. Keep only the keys whose fingerprint appears in [Published key fingerprints](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#published-key-fingerprints), together with each key’s status there. Verify a newly fetched checkpoint only under a key that table lists as current on that date. Accept a retired key only for a checkpoint you saved before its retirement date.
3953952. Establish the latest checkpoint. On the first run, fetch it from the [checkpoint endpoint](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#read-the-latest-checkpoint). On every later run, request a [consistency proof](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#fetch-a-consistency-proof) from the tree size you saved. The response carries the latest checkpoint together with the proof.
3963. Check the checkpoint's origin line first. Compare its first line, byte for byte, with the origin you derived. Reject any checkpoint whose origin differs, before doing anything else.
3974. Verify the checkpoint's signature. Find the signature line named for your origin whose first four decoded bytes equal the `key_hash` of a currently valid key you kept. Verify the remaining bytes as an ECDSA P-256 signature over the SHA-256 of the note body, using that key's `public_key`. If no signature line matches such a key, or the signature does not verify, reject the checkpoint.
3963. Check the checkpoint’s origin line first. Compare its first line, byte for byte, with the origin you derived. Reject any checkpoint whose origin differs, before doing anything else.
3974. Verify the checkpoint’s signature. Find the signature line named for your origin whose first four decoded bytes equal the `key_hash` of a currently valid key you kept. Verify the remaining bytes as an ECDSA P-256 signature over the SHA-256 of the note body, using that key’s `public_key`. If no signature line matches such a key, or the signature does not verify, reject the checkpoint.
3983985. Prove append-only. If the new tree size is smaller than the one you saved, fail. If it is equal, the root hashes must match. If it is larger, verify the RFC 9162 consistency proof from your saved size and root hash to the new size and root hash.
3996. Prove each event is included. Read every Access Transparency event the Activity Feed serves. For each new one, rebuild each [leaf to rebuild for it](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#how-an-event-becomes-a-leaf), hash each, and fetch its [inclusion proof](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#fetch-an-inclusion-proof). Walk the audit path from each leaf hash at the event's index up to the checkpoint's root hash. The event verifies if one of them reproduces the root hash. If none does, the event you were served is not the event the log committed. The proof response can carry a different checkpoint from the one you hold. Check its origin line and signature (steps 3 and 4), and link it into your history with a consistency proof (step 5), before you verify anything against it.
3996. Prove each event is included. Read every Access Transparency event the Activity Feed serves. For each new one, rebuild each [leaf to rebuild for it](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#how-an-event-becomes-a-leaf), hash each, and fetch its [inclusion proof](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#fetch-an-inclusion-proof). Walk the audit path from each leaf hash at the event’s index up to the checkpoint’s root hash. The event verifies if one of them reproduces the root hash. If none does, the event you were served is not the event the log committed. The proof response can carry a different checkpoint from the one you hold. Check its origin line and signature (steps 3 and 4), and link it into your history with a consistency proof (step 5), before you verify anything against it.
4004007. Re-check what you saw before. Whenever you read an event again, it must be served with the same index and the same leaf bytes as when you verified it. No event may lose the index it had, and while you are enrolled no event may newly appear without one. The events served without an index on your first run are your pre-log history. A run that re-reads only recent events re-checks only those. To re-check older ones, verify the copies you kept (step 8) again.
4014018. Save the checkpoint you verified and a record of each event you verified. They are your evidence and your starting point for the next run.
402402
from line 409
409409| `0x01` | Every release |
410410| `0x02` | `v0.2.0` and later |
411411
412`axt-verify version` prints the release you run. A new installation gets the newest release. If the table's last row does not include your release, upgrade to a release in that row. If none is published yet, upgrade as soon as one is:
412`axt-verify version` prints the release you run. A new installation gets the newest release. If the table’s last row does not include your release, upgrade to a release in that row. If none is published yet, upgrade as soon as one is:
413413
4144141. Install the newest release the way you installed before (the `go install` line in [Verify with axt-verify](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#verify-with-axt-verify)).
4154152. Keep running it as before: same `--org`, same `--state` file, same schedule.
from line 417
417417What to expect:
418418
419419* **Before your log starts writing the new version.** The newer release verifies your log as before, because it also rebuilds the earlier leaf versions.
420* **After your log starts writing the new version, on a release that does not rebuild it.** The release reports every event whose leaf has that version as a verification failure, with exit status `1`, even when the event has none of the version's optional fields. Leaves of the versions your release rebuilds are not affected. They verify as they did before. The failures clear once you run a release that rebuilds the version on the same `--state` file, and the append-only check continues from where your last run ended.
420* **After your log starts writing the new version, on a release that does not rebuild it.** The release reports every event whose leaf has that version as a verification failure, with exit status `1`, even when the event has none of the version’s optional fields. Leaves of the versions your release rebuilds are not affected. They verify as they did before. The failures clear once you run a release that rebuilds the version on the same `--state` file, and the append-only check continues from where your last run ended.
421421* **If you return to an earlier release.** Do not give an earlier release a state file that a newer release has saved. The earlier release reports every event that was waiting for a checkpoint as a verification failure. If you may need to return to the earlier release, copy the state file before the first run of the newer one, and give the earlier release that copy.
422422
423A verifier you maintain yourself needs a new version's fields, and the rule for which entries to rebuild, from [How an event becomes a leaf](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#how-an-event-becomes-a-leaf) before your log starts writing that version.
423A verifier you maintain yourself needs a new version’s fields, and the rule for which entries to rebuild, from [How an event becomes a leaf](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#how-an-event-becomes-a-leaf) before your log starts writing that version.
424424
425425### Verify with axt-verify
426426
427427If you already run `axt-verify` on a schedule, read [Upgrade for a new leaf version](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#upgrade-for-a-new-leaf-version) first.
428428
429[`axt-verify`](https://github.com/anthropics/axt-verify) is Anthropic's open-source verifier for this log. It is a single Go binary that you run on your own infrastructure. Each release has exactly one log signing key from [Published key fingerprints](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#published-key-fingerprints) built in, so it never asks the API which key to trust. When Anthropic rotates the key, you upgrade to the release that carries the new one on the switch date. `axt-verify` derives your origin from the organization UUID you pass with `--org`, which is the one you took from the Console in [Before you start](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#before-you-begin). It rejects any checkpoint whose origin line differs.
429[`axt-verify`](https://github.com/anthropics/axt-verify) is Anthropic’s open-source verifier for this log. It is a single Go binary that you run on your own infrastructure. Each release has exactly one log signing key from [Published key fingerprints](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#published-key-fingerprints) built in, so it never asks the API which key to trust. When Anthropic rotates the key, you upgrade to the release that carries the new one on the switch date. `axt-verify` derives your origin from the organization UUID you pass with `--org`, which is the one you took from the Console in [Before you start](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#before-you-begin). It rejects any checkpoint whose origin line differs.
430430
431431Install it with Go 1.26 or newer. It reads your Compliance Access Key from the `ANTHROPIC_COMPLIANCE_ACCESS_KEY` environment variable, never from a flag or a file. The `run` command is the one to schedule:
432432
from line 439
439439 run
440440```
441441
442Each `run` fetches the latest checkpoint and verifies its signature and origin line. It then proves the log is an append-only extension of the checkpoint the previous run saved. Next it pages through the Access Transparency events on your Activity Feed. It starts 7 days (by `created_at`) before the newest event the previous run read, so that events listed late or out of order are still picked up. It rebuilds each [leaf to rebuild for the event](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#how-an-event-becomes-a-leaf), verifies an inclusion proof against them, and compares any event it verified before against what it recorded then. Finally, it saves the new checkpoint and its progress to the `--state` file, which the next run starts from. Run it at least daily. Hourly is reasonable. With a parent-organization key, run one copy for each child organization, each with its own `--org` and `--state` file. Each child organization's UUID also comes from the Claude Console, not from the Compliance API responses you are verifying. To find it, switch to the child organization in the account menu at the bottom of the Console sidebar, then open the [Organization](https://platform.claude.com/settings/organization) page (`platform.claude.com/settings/organization`). You can also find it in your parent organization's list of organizations in the Console. `axt-verify checkpoint` does only the checkpoint and append-only steps. `axt-verify events FILE` verifies events you already hold, such as an auditor's sample or your own export. It proves that each event in the file is still committed in the log under the current checkpoint. It does not read the feed or touch the state file.
442Each `run` fetches the latest checkpoint and verifies its signature and origin line. It then proves the log is an append-only extension of the checkpoint the previous run saved. Next it pages through the Access Transparency events on your Activity Feed. It starts 7 days (by `created_at`) before the newest event the previous run read, so that events listed late or out of order are still picked up. It rebuilds each [leaf to rebuild for the event](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#how-an-event-becomes-a-leaf), verifies an inclusion proof against them, and compares any event it verified before against what it recorded then. Finally, it saves the new checkpoint and its progress to the `--state` file, which the next run starts from. Run it at least daily. Hourly is reasonable. With a parent-organization key, run one copy for each child organization, each with its own `--org` and `--state` file. Each child organization’s UUID also comes from the Claude Console, not from the Compliance API responses you are verifying. To find it, switch to the child organization in the account menu at the bottom of the Console sidebar, then open the [Organization](https://platform.claude.com/settings/organization) page (`platform.claude.com/settings/organization`). You can also find it in your parent organization’s list of organizations in the Console. `axt-verify checkpoint` does only the checkpoint and append-only steps. `axt-verify events FILE` verifies events you already hold, such as an auditor’s sample or your own export. It proves that each event in the file is still committed in the log under the current checkpoint. It does not read the feed or touch the state file.
443443
444One limit follows from that window: `run` re-reads only the last 7 days of events, so it re-checks recently served events (step 7), not your whole history. Keep the events you export (see [Keep your own checkpoint archive](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#keep-your-own-checkpoint-archive)). `axt-verify events FILE` proves at any later date that those copies are still committed in the log, but it does not re-read the feed. To detect an older event removed from or rewritten on the feed, re-export that range from the Activity Feed and compare it with the copies you kept. You can also verify the re-export itself with `axt-verify events FILE`. The 7-day overlap is longer than the feed's 2-business-day delivery time, so a late-arriving event still falls inside a later run's window. `--overlap` changes the duration if you need to.
444One limit follows from that window: `run` re-reads only the last 7 days of events, so it re-checks recently served events (step 7), not your whole history. Keep the events you export (see [Keep your own checkpoint archive](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#keep-your-own-checkpoint-archive)). `axt-verify events FILE` proves at any later date that those copies are still committed in the log, but it does not re-read the feed. To detect an older event removed from or rewritten on the feed, re-export that range from the Activity Feed and compare it with the copies you kept. You can also verify the re-export itself with `axt-verify events FILE`. The 7-day overlap is longer than the feed’s 2-business-day delivery time, so a late-arriving event still falls inside a later run’s window. `--overlap` changes the duration if you need to.
445445
446446If you need your own implementation instead, follow the preceding checklist with a tlog-tiles library that supports ECDSA note keys.
447447
from line 449
449449
450450`axt-verify` prints your origin, the tree size and root hash of the checkpoint it verified, the tree size the append-only check started from, and a count of events by outcome. Pass `--json` to get the same report as one JSON object on each line. Each event has one of four outcomes:
451451
452* **Verified:** a leaf rebuilt from the served event is committed at the event's index in the signed log.
453* **Pending:** the event's index is beyond the latest published checkpoint. This is normal for a short time after an event appears. In `run`, `axt-verify` records the event, verifies it on a later run once a checkpoint covers it, and fails it if that takes longer than 24 hours. `events FILE` has no later run to settle it, so it waits up to a minute for a covering checkpoint to be published. If none arrives, it reports the event as not yet covered and ends with exit status `3`. Run it again later. If `events FILE` reports the same event as not yet covered on two runs at least a day apart, treat it as a verification failure and escalate as for exit status `1`.
454* **Not logged:** the event was served without an index. An event is served without `transparency_log_leaf_index` only while your organization is not enrolled in Access Transparency, or when it was recorded before your organization's log was created (see [The `transparency_log_leaf_index` field on Activity Feed events](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#the-transparency-log-leaf-index-field-on-activity-feed-events)). `axt-verify` reports such events as not logged and does not fail the run on them. An index-less event is not expected when it is dated after your log was created and falls inside a period when you were enrolled. Review the not-logged list in the run's summary or `--json` output rather than relying on the exit status alone.
452* **Verified:** a leaf rebuilt from the served event is committed at the event’s index in the signed log.
453* **Pending:** the event’s index is beyond the latest published checkpoint. This is normal for a short time after an event appears. In `run`, `axt-verify` records the event, verifies it on a later run once a checkpoint covers it, and fails it if that takes longer than 24 hours. `events FILE` has no later run to settle it, so it waits up to a minute for a covering checkpoint to be published. If none arrives, it reports the event as not yet covered and ends with exit status `3`. Run it again later. If `events FILE` reports the same event as not yet covered on two runs at least a day apart, treat it as a verification failure and escalate as for exit status `1`.
454* **Not logged:** the event was served without an index. An event is served without `transparency_log_leaf_index` only while your organization is not enrolled in Access Transparency, or when it was recorded before your organization’s log was created (see [The `transparency_log_leaf_index` field on Activity Feed events](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#the-transparency-log-leaf-index-field-on-activity-feed-events)). `axt-verify` reports such events as not logged and does not fail the run on them. An index-less event is not expected when it is dated after your log was created and falls inside a period when you were enrolled. Review the not-logged list in the run’s summary or `--json` output rather than relying on the exit status alone.
455455* **Failed:** see exit status `1`.
456456
457457The exit status tells your scheduler what occurred:
from line 458
458458
459459* **`0`:** Nothing failed. Not-logged events are reported, not failed, and so are pending events in `run`.
460460
461* **`1`:** A verification failure. If every new event fails because its inclusion proof does not reproduce the signed root hash, first rule out a release that does not rebuild your log's newest leaf version, as that item in this list describes. If that is not the cause, and for any other failure, treat it as a security finding, not a transient error. Keep the state file and the output, and report it to your Anthropic account representative or [Anthropic support](https://support.claude.com). The causes are:
461* **`1`:** A verification failure. If every new event fails because its inclusion proof does not reproduce the signed root hash, first rule out a release that does not rebuild your log’s newest leaf version, as that item in this list describes. If that is not the cause, and for any other failure, treat it as a security finding, not a transient error. Keep the state file and the output, and report it to your Anthropic account representative or [Anthropic support](https://support.claude.com). The causes are:
462462
463 * A checkpoint with the wrong origin, or a signature that does not verify under the key built into your `axt-verify` release. Compare the `key_hash` on the failing checkpoint's signature line with [Published key fingerprints](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#published-key-fingerprints). A key listed there with a switch date you have not upgraded for means you need the matching release. A key not listed there is a security finding, whatever release you run. On this failure `axt-verify` prints the key hash of every signature on the served checkpoint and the key hash of the key it trusts, as eight hex digits each. That output is enough to make the comparison.
463 * A checkpoint with the wrong origin, or a signature that does not verify under the key built into your `axt-verify` release. Compare the `key_hash` on the failing checkpoint’s signature line with [Published key fingerprints](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#published-key-fingerprints). A key listed there with a switch date you have not upgraded for means you need the matching release. A key not listed there is a security finding, whatever release you run. On this failure `axt-verify` prints the key hash of every signature on the served checkpoint and the key hash of the key it trusts, as eight hex digits each. That output is enough to make the comparison.
464464 * A checkpoint that is not a well-formed signed note, for example one whose root hash is not 32 bytes.
465465 * A log that shrank, or that cannot prove it extends the checkpoint you saved. The output then carries both checkpoints and the proof, so the evidence stands on its own.
466466 * Two signed checkpoints for the same tree size with different root hashes. The output carries both checkpoints.
467467 * A checkpoint file passed with `--from` whose signature does not verify under the key built into your `axt-verify` release, or a `--from` or `--from-trusted` file whose origin is not yours. For an archive signed before a key rotation, see [Keep your own checkpoint archive](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#keep-your-own-checkpoint-archive).
468468 * An inclusion proof that does not reproduce the signed root hash for the event you were served. A release that does not rebuild a leaf version reports this for every event whose leaf has that version. If every new event fails this way at once, check first that you run the newest `axt-verify` release (see [Upgrade for a new leaf version](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#upgrade-for-a-new-leaf-version)). If you do not, copy the state file, keep the copy and the output, and run the newest release on the original `--state` file. The failures clear once you run a release that rebuilds the version. If you already run the newest release, or the failures remain after you upgrade, it is a security finding.
469 * An event inside the run's window served differently from how an earlier run recorded it: different leaf bytes, a different index, or no index where it had one.
469 * An event inside the run’s window served differently from how an earlier run recorded it: different leaf bytes, a different index, or no index where it had one.
470470 * An event still pending 24 hours after the run first saw it.
471471 * A refused inclusion proof (`400`, `401`, or `403`) for an event the feed served you.
472472 * An inclusion proof returned for a different `leaf_index` from the one requested.
473473 * In `events FILE`, an event at an index the latest checkpoint already covered when the check started, for which no inclusion proof is served before the wait runs out.
474 * An event whose `organization_uuid` is not the organization UUID you passed with `--org`. When a parent organization runs `events FILE` on an export that covers several child organizations, every other organization's event fails this way, so split the export by organization first and verify each part with its own `--org`.
474 * An event whose `organization_uuid` is not the organization UUID you passed with `--org`. When a parent organization runs `events FILE` on an export that covers several child organizations, every other organization’s event fails this way, so split the export by organization first and verify each part with its own `--org`.
475475 * The same activity `id` at two different indices, or twice at one index with different content, within one run or one `events FILE` input.
476476 * An event whose leaf cannot be rebuilt: for example, a documented field that is not a string, a field name that appears twice, or a `type` that is missing or is an unrecognized variant of an Access Transparency type. `events FILE` skips rows of other activity types and does not fail them.
477477
from line 493
493493
494494### Keep your own checkpoint archive
495495
496The strongest evidence you can hold is your own record of what the log said on a given day. `axt-verify --save FILE` writes the checkpoint a run verified, verbatim, and `--from FILE` on a later run makes the log prove it still extends that checkpoint. Archive a saved checkpoint in storage you control, for example daily. Months later, a [consistency proof](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#fetch-a-consistency-proof) from that archived checkpoint's tree size must still lead to whatever checkpoint the log serves, or verification fails. Earlier keys stay listed in the [verifier key set](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#read-the-verifier-keys) after a planned rotation, so an archived checkpoint keeps verifying. With `axt-verify`, if the key that signed an archived checkpoint has since rotated out, pass that archive with `--from-trusted` instead of `--from`. Keep the events too. The Access Transparency events you export from the feed are valid input to `axt-verify events FILE`, which proves at any later date that those copies are still committed in the log under its current checkpoint. Because `events FILE` does not re-read the feed, your kept export is also the reference you compare a later re-export of the same range against.
496The strongest evidence you can hold is your own record of what the log said on a given day. `axt-verify --save FILE` writes the checkpoint a run verified, verbatim, and `--from FILE` on a later run makes the log prove it still extends that checkpoint. Archive a saved checkpoint in storage you control, for example daily. Months later, a [consistency proof](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#fetch-a-consistency-proof) from that archived checkpoint’s tree size must still lead to whatever checkpoint the log serves, or verification fails. Earlier keys stay listed in the [verifier key set](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#read-the-verifier-keys) after a planned rotation, so an archived checkpoint keeps verifying. With `axt-verify`, if the key that signed an archived checkpoint has since rotated out, pass that archive with `--from-trusted` instead of `--from`. Keep the events too. The Access Transparency events you export from the feed are valid input to `axt-verify events FILE`, which proves at any later date that those copies are still committed in the log under its current checkpoint. Because `events FILE` does not re-read the feed, your kept export is also the reference you compare a later re-export of the same range against.
497497
498498## Frequently asked questions
499499
from line 507
507507 </Accordion>
508508
509509 <Accordion title="What happens when Anthropic rotates the signing key?">
510 Planned rotations are announced in [Published key fingerprints](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#published-key-fingerprints) at least 30 days ahead, with a switch date. On the switch date Anthropic starts signing with the new key and publishes the `axt-verify` release that carries it. On the same date Anthropic re-issues every organization's latest checkpoint under the new key, even for a log that has not grown. Each `axt-verify` release carries one key, so upgrade on the switch date. Running the old release after the switch fails with exit status `1`, and so does running the new release before it. Either failure clears once you run the matching release. Checkpoints you saved under the old key stay valid starting points, because the append-only proof from a saved checkpoint to a new one does not depend on which key signed the old one. The new key appears at the front of the [verifier key set](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#read-the-verifier-keys) and earlier keys stay listed. Checkpoints you already verified or archived therefore keep verifying against that set. A verifier of your own that pins the published fingerprints needs the new fingerprint, with its switch date, added before that date. A verifier that holds the key set locally re-fetches it when it meets a signature whose key hash it does not hold. A checkpoint commits to the whole history. Once one checkpoint signed by the new key verifies, and a consistency proof from your saved checkpoint leads to it, every earlier entry is re-established as well.
510 Planned rotations are announced in [Published key fingerprints](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#published-key-fingerprints) at least 30 days ahead, with a switch date. On the switch date Anthropic starts signing with the new key and publishes the `axt-verify` release that carries it. On the same date Anthropic re-issues every organization’s latest checkpoint under the new key, even for a log that has not grown. Each `axt-verify` release carries one key, so upgrade on the switch date. Running the old release after the switch fails with exit status `1`, and so does running the new release before it. Either failure clears once you run the matching release. Checkpoints you saved under the old key stay valid starting points, because the append-only proof from a saved checkpoint to a new one does not depend on which key signed the old one. The new key appears at the front of the [verifier key set](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#read-the-verifier-keys) and earlier keys stay listed. Checkpoints you already verified or archived therefore keep verifying against that set. A verifier of your own that pins the published fingerprints needs the new fingerprint, with its switch date, added before that date. A verifier that holds the key set locally re-fetches it when it meets a signature whose key hash it does not hold. A checkpoint commits to the whole history. Once one checkpoint signed by the new key verifies, and a consistency proof from your saved checkpoint leads to it, every earlier entry is re-established as well.
511511 </Accordion>
512512
513513 <Accordion title="What is a leaf version, and do I need to track which one a leaf has?">
from line 523
523523 </Accordion>
524524
525525 <Accordion title="Can I verify all of my child organizations with one key?">
526 Yes. A parent-organization key reads any enrolled child organization's log by passing `organization_id`. Each child organization has its own log, origin, and saved checkpoint. Run a separate verification, with its own state, for each child organization.
526 Yes. A parent-organization key reads any enrolled child organization’s log by passing `organization_id`. Each child organization has its own log, origin, and saved checkpoint. Run a separate verification, with its own state, for each child organization.
527527 </Accordion>
528528</AccordionGroup>
529529
from line 533
533533* [Query the Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed)
534534* [Compliance API overview](https://platform.claude.com/docs/en/manage-claude/compliance-api)
535535* [Handle Compliance API errors](https://platform.claude.com/docs/en/manage-claude/compliance-errors)
536* [axt-verify](https://github.com/anthropics/axt-verify), Anthropic's open-source verifier for the transparency log
536* [axt-verify](https://github.com/anthropics/axt-verify), Anthropic’s open-source verifier for the transparency log
537537* [C2SP tlog-tiles](https://c2sp.org/tlog-tiles) and [C2SP signed note](https://c2sp.org/signed-note), the wire formats for tiles, entry bundles, and checkpoints
538538* [RFC 9162](https://www.rfc-editor.org/rfc/rfc9162), the Merkle tree, inclusion proof, and consistency proof algorithms
539539* [RFC 8785](https://www.rfc-editor.org/rfc/rfc8785), the JSON Canonicalization Scheme used for leaves
manage-claude/admin-api Changed · +14 / -14 lines
from line 4
44description: Manage organization members, workspaces, invites, and API keys programmatically with the Admin API, using an Admin API key, an `org:admin` OAuth token, or a personal or service account key.
55---
66
7The [Admin API](https://platform.claude.com/docs/en/api/organization) lets you manage your organization's members, workspaces, invites, and API keys programmatically instead of by hand in the [Claude Console](https://platform.claude.com/).
7The [Admin API](https://platform.claude.com/docs/en/api/organization) lets you manage your organization’s members, workspaces, invites, and API keys programmatically instead of by hand in the [Claude Console](https://platform.claude.com/).
88
99## Availability
1010
from line 18
1818* The external key endpoints, for [CMEK](https://platform.claude.com/docs/en/manage-claude/cmek-claude-platform-on-aws): register, get, list, update, and delete on `/v1/organizations/external_keys`. There is no validate endpoint, because keys are validated when attached to a workspace.
1919* The [telemetry destination endpoints](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#telemetry-destinations).
2020
21Organization members, workspace members, invites, API keys, and the usage, cost, and rate limit reports aren't available on Claude Platform on AWS.
21Organization members, workspace members, invites, API keys, and the usage, cost, and rate limit reports aren’t available on Claude Platform on AWS.
2222
2323## Authentication
2424
from line 26
2626
2727* An **Admin API key** (starting with `sk-ant-admin...`) sent in the `x-api-key` header. Only organization members with the admin role can provision one. See [Create an Admin API key](https://platform.claude.com/docs/en/manage-claude/admin-api-keys).
2828* An **OAuth bearer token** with the `org:admin` scope sent in the `authorization: Bearer` header. Only members with the admin, owner, or primary owner role can obtain one. See [Obtain an OAuth bearer token](https://platform.claude.com/docs/en/manage-claude/admin-api#oauth-bearer-token).
29* A **personal key** or **service account key** that isn't scoped to a specific workspace, sent in the `x-api-key` header. The key has the same permissions as the linked account. See [Key types](https://platform.claude.com/docs/en/manage-claude/authentication#key-types).
29* A **personal key** or **service account key** that isn’t scoped to a specific workspace, sent in the `x-api-key` header. The key has the same permissions as the linked account. See [Key types](https://platform.claude.com/docs/en/manage-claude/authentication#key-types).
3030
3131An Admin API key covers most endpoints. The service-account, federation-issuer, and federation-rule endpoints accept only an `org:admin` OAuth token. Send a personal key or service account key in the `x-api-key` header, as you would an Admin API key. The following examples call the [organization info endpoint](https://platform.claude.com/docs/en/manage-claude/admin-api#accessing-organization-info) with an OAuth token and with an Admin API key.
3232
33In Python, TypeScript, C#, Go, Java, PHP, and Ruby, the SDK exposes the endpoints on this page under `client.organization` (csharp, go: `client.Organization`; java: `client.organization()`; php: `$client->organization`), and the `ant` CLI under `ant organization`. The examples on this page use the default client, which reads an Admin API key from `ANTHROPIC_API_KEY` or an OAuth bearer token from `ANTHROPIC_AUTH_TOKEN`. SDK list methods in Python, TypeScript, C#, Go, and Java return an iterator that fetches more pages on demand, so `limit` sets the page size, not the total. The PHP, Ruby, and curl examples return one page. In the CLI, `--limit` caps the results on the member, invite, workspace, workspace-member, and API-key lists. For each endpoint's parameters and responses, see the [Admin API reference](https://platform.claude.com/docs/en/api/organization).
33In Python, TypeScript, C#, Go, Java, PHP, and Ruby, the SDK exposes the endpoints on this page under `client.organization` (csharp, go: `client.Organization`; java: `client.organization()`; php: `$client->organization`), and the `ant` CLI under `ant organization`. The examples on this page use the default client, which reads an Admin API key from `ANTHROPIC_API_KEY` or an OAuth bearer token from `ANTHROPIC_AUTH_TOKEN`. SDK list methods in Python, TypeScript, C#, Go, and Java return an iterator that fetches more pages on demand, so `limit` sets the page size, not the total. The PHP, Ruby, and curl examples return one page. In the CLI, `--limit` caps the results on the member, invite, workspace, workspace-member, and API-key lists. For each endpoint’s parameters and responses, see the [Admin API reference](https://platform.claude.com/docs/en/api/organization).
3434
3535### OAuth bearer token
3636
37Log in with the [`ant` CLI](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/quickstart) under a dedicated profile with the `org:admin` scope (see [Admin access](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/authentication#admin-access)), then export the bearer token. `--profile admin` stores the `org:admin` credential under its own profile and makes it the CLI's active profile. The exported variable applies to every SDK and CLI call in that shell. Use a shell you reserve for administration, unset the variable when you're done, and switch the CLI back with `ant profile activate default`:
37Log in with the [`ant` CLI](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/quickstart) under a dedicated profile with the `org:admin` scope (see [Admin access](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/authentication#admin-access)), then export the bearer token. `--profile admin` stores the `org:admin` credential under its own profile and makes it the CLI’s active profile. The exported variable applies to every SDK and CLI call in that shell. Use a shell you reserve for administration, unset the variable when you’re done, and switch the CLI back with `ant profile activate default`:
3838
3939```bash CLI
4040ant auth login --profile admin --scope "org:admin"
from line 341
341341 ```
342342</CodeGroup>
343343
344Update a member's role:
344Update a member’s role:
345345
346346<CodeGroup>
347347 ```bash cURL
from line 1103
11031103 ```
11041104</CodeGroup>
11051105
1106Update a workspace member's role:
1106Update a workspace member’s role:
11071107
11081108<CodeGroup>
11091109 ```bash cURL
from line 1342
13421342
13431343### API keys
13441344
1345Monitor and manage [API keys](https://platform.claude.com/docs/en/api/organization/api_keys/list). Each key in the response includes its `expires_at` timestamp (`null` for keys without an [expiration](https://platform.claude.com/docs/en/manage-claude/authentication#key-expiration)) and `principal`, the identity it acts as (see [Key types](https://platform.claude.com/docs/en/manage-claude/authentication#key-types)). For a personal key, `principal` is `{"type": "user_actor", "user_id": "user_..."}`. For a service account key, it is `{"type": "service_account_actor", "service_account_id": "svac_..."}`. For a workspace key, it is `null`. Each key also has a `scope` object: `{"type": "workspace", "workspace_id": "wrkspc_..."}` for a key bound to one workspace, or `{"type": "organization"}` for a key that can work across any workspace the account has access to. Filtering the list by `workspace_id` with the Default Workspace's ID returns only keys bound to the Default Workspace; keys without a workspace scope aren't returned under any `workspace_id` filter.
1345Monitor and manage [API keys](https://platform.claude.com/docs/en/api/organization/api_keys/list). Each key in the response includes its `expires_at` timestamp (`null` for keys without an [expiration](https://platform.claude.com/docs/en/manage-claude/authentication#key-expiration)) and `principal`, the identity it acts as (see [Key types](https://platform.claude.com/docs/en/manage-claude/authentication#key-types)). For a personal key, `principal` is `{"type": "user_actor", "user_id": "user_..."}`. For a service account key, it is `{"type": "service_account_actor", "service_account_id": "svac_..."}`. For a workspace key, it is `null`. Each key also has a `scope` object: `{"type": "workspace", "workspace_id": "wrkspc_..."}` for a key bound to one workspace, or `{"type": "organization"}` for a key that can work across any workspace the account has access to. Filtering the list by `workspace_id` with the Default Workspace’s ID returns only keys bound to the Default Workspace; keys without a workspace scope aren’t returned under any `workspace_id` filter.
13461346
13471347List the active API keys in a workspace:
13481348
from line 1716
17161716
17171717## Usage and cost reports
17181718
1719Track your organization's usage and costs with the [Usage and Cost API](https://platform.claude.com/docs/en/manage-claude/usage-cost-api).
1719Track your organization’s usage and costs with the [Usage and Cost API](https://platform.claude.com/docs/en/manage-claude/usage-cost-api).
17201720
17211721## Claude Code analytics
17221722
from line 1732
17321732
17331733## Organization webhooks
17341734
1735Register webhook endpoints for events about enforcement actions on your organization's user profiles with [organization webhooks](https://platform.claude.com/docs/en/manage-claude/organization-webhooks).
1735Register webhook endpoints for events about enforcement actions on your organization’s user profiles with [organization webhooks](https://platform.claude.com/docs/en/manage-claude/organization-webhooks).
17361736
17371737## Best practices
17381738
from line 1740
17401740* Handle errors from failed operations
17411741* Regularly audit member roles and permissions
17421742* Clean up unused workspaces and expired invites
1743* Monitor API key usage, audit each key's [`expires_at`](https://platform.claude.com/docs/en/manage-claude/authentication#key-expiration), and rotate keys periodically
1743* Monitor API key usage, audit each key’s [`expires_at`](https://platform.claude.com/docs/en/manage-claude/authentication#key-expiration), and rotate keys periodically
17441744
17451745## FAQ
17461746
17471747<AccordionGroup>
17481748 <Accordion title="What permissions are needed to use the Admin API?">
1749 The Admin API accepts an Admin API key (starting with `sk-ant-admin`), an OAuth bearer token with the `org:admin` scope, or a personal key or service account key that isn't scoped to a specific workspace. Only organization members with the admin role can provision Admin API keys, and only members with the admin, owner, or primary owner role can obtain `org:admin` tokens. A personal key or service account key has the same permissions as the linked account. See [Authentication](https://platform.claude.com/docs/en/manage-claude/admin-api#authentication).
1749 The Admin API accepts an Admin API key (starting with `sk-ant-admin`), an OAuth bearer token with the `org:admin` scope, or a personal key or service account key that isn’t scoped to a specific workspace. Only organization members with the admin role can provision Admin API keys, and only members with the admin, owner, or primary owner role can obtain `org:admin` tokens. A personal key or service account key has the same permissions as the linked account. See [Authentication](https://platform.claude.com/docs/en/manage-claude/admin-api#authentication).
17501750 </Accordion>
17511751
17521752 <Accordion title="Can I create new API keys through the Admin API?">
from line 1760
17601760 </Accordion>
17611761
17621762 <Accordion title="Can organization admins be removed through the API?">
1763 No. The API can't remove members with the admin role.
1763 No. The API can’t remove members with the admin role.
17641764 </Accordion>
17651765
17661766 <Accordion title="How long do organization invites last?">
1767 Invites expire after 21 days. The expiration period isn't configurable.
1767 Invites expire after 21 days. The expiration period isn’t configurable.
17681768 </Accordion>
17691769</AccordionGroup>
17701770
manage-claude/admin-api-keys Changed · +9 / -9 lines
from line 4
44description: Create an Admin API key for your Claude Console or Claude Enterprise organization.
55---
66
7An Admin API key authenticates every API in the **Admin** section of this guide: the [Admin API](https://platform.claude.com/docs/en/manage-claude/admin-api), [Analytics APIs](https://platform.claude.com/docs/en/manage-claude/analytics-api), [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api), [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api), [Claude Tag API](https://platform.claude.com/docs/en/manage-claude/claude-tag-api), [Spend Limits API](https://platform.claude.com/docs/en/manage-claude/spend-limits-api), [Usage and Cost API](https://platform.claude.com/docs/en/manage-claude/usage-cost-api), and [Rate Limits API](https://platform.claude.com/docs/en/manage-claude/rate-limits-api). You do not need a separate key for each API. The one exception is the Admin API's service-account, federation-issuer, and federation-rule endpoints, which accept only an OAuth bearer token with the `org:admin` scope. See [Obtain an OAuth bearer token](https://platform.claude.com/docs/en/manage-claude/admin-api#oauth-bearer-token).
7An Admin API key authenticates every API in the **Admin** section of this guide: the [Admin API](https://platform.claude.com/docs/en/manage-claude/admin-api), [Analytics APIs](https://platform.claude.com/docs/en/manage-claude/analytics-api), [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api), [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api), [Claude Tag API](https://platform.claude.com/docs/en/manage-claude/claude-tag-api), [Spend Limits API](https://platform.claude.com/docs/en/manage-claude/spend-limits-api), [Usage and Cost API](https://platform.claude.com/docs/en/manage-claude/usage-cost-api), and [Rate Limits API](https://platform.claude.com/docs/en/manage-claude/rate-limits-api). You do not need a separate key for each API. The one exception is the Admin API’s service-account, federation-issuer, and federation-rule endpoints, which accept only an OAuth bearer token with the `org:admin` scope. See [Obtain an OAuth bearer token](https://platform.claude.com/docs/en/manage-claude/admin-api#oauth-bearer-token).
88
99Where you create the key depends on which Claude product your organization uses.
1010
from line 13
1313| Your organization | Create the key in | Key prefix | Who can create it | Works with |
1414| ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
1515| **Claude Console** (Claude Platform, `platform.claude.com`) | [Admin keys](https://platform.claude.com/settings/admin-keys) page (`platform.claude.com/settings/admin-keys`) in the Claude Console | `sk-ant-admin01-...` | Organization members with the **admin** role | [Admin API](https://platform.claude.com/docs/en/manage-claude/admin-api), [Usage and Cost API](https://platform.claude.com/docs/en/manage-claude/usage-cost-api), [Rate Limits API](https://platform.claude.com/docs/en/manage-claude/rate-limits-api), [Claude Code Analytics API](https://platform.claude.com/docs/en/manage-claude/claude-code-analytics-api), and the Compliance API [Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed) |
16| **Claude Enterprise** (`claude.ai`) | [claude.ai > Organization settings > API](https://claude.ai/admin-settings/api-access) | `sk-ant-api01-...` | The parent organization's **primary owner** (all linked organizations). An **organization owner** can create one carrying Compliance API scopes only, restricted to their own organization | [User management](https://platform.claude.com/docs/en/manage-claude/user-management) (the Admin API's member, invite, and group endpoints), [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api), [Claude Tag API](https://platform.claude.com/docs/en/manage-claude/claude-tag-api), [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api), [Claude Enterprise Analytics API](https://platform.claude.com/docs/en/manage-claude/analytics-api), and [Spend Limits API](https://platform.claude.com/docs/en/manage-claude/spend-limits-api), according to the [scopes](https://platform.claude.com/docs/en/manage-claude/admin-api-keys#choose-scopes-for-a-claude-enterprise-key) you select |
16| **Claude Enterprise** (`claude.ai`) | [claude.ai > Organization settings > API](https://claude.ai/admin-settings/api-access) | `sk-ant-api01-...` | The parent organization’s **primary owner** (all linked organizations). An **organization owner** can create one carrying Compliance API scopes only, restricted to their own organization | [User management](https://platform.claude.com/docs/en/manage-claude/user-management) (the Admin API’s member, invite, and group endpoints), [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api), [Claude Tag API](https://platform.claude.com/docs/en/manage-claude/claude-tag-api), [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api), [Claude Enterprise Analytics API](https://platform.claude.com/docs/en/manage-claude/analytics-api), and [Spend Limits API](https://platform.claude.com/docs/en/manage-claude/spend-limits-api), according to the [scopes](https://platform.claude.com/docs/en/manage-claude/admin-api-keys#choose-scopes-for-a-claude-enterprise-key) you select |
1717
1818A key created in one organization cannot be used to manage a different organization. If your company uses both Claude Console and Claude Enterprise, create one key in each.
1919
from line 67
6767| Admin API [user management](https://platform.claude.com/docs/en/manage-claude/user-management): change member roles, remove members, and create and withdraw invites (to assign the `managed` role on a role change or an invite, also select `write:rbac_groups`) | `write:members` |
6868| Admin API [user management](https://platform.claude.com/docs/en/manage-claude/user-management): read groups and their members | `read:rbac_groups` |
6969| Admin API [user management](https://platform.claude.com/docs/en/manage-claude/user-management): create, rename, and delete groups; add and remove group members; with `write:members`, assign the `managed` role (on an invite or a role change) or assign groups on an invite | `write:rbac_groups` |
70| [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api): read plugins, versions, installation settings, shares, and marketplaces; download plugin files, including the files of members' personal plugins; validate a marketplace before you connect it | `read:plugins` |
71| [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api): upload plugins and versions; choose which version members are served; delete plugins, including members' personal plugins; set and remove installation settings; set a marketplace's default installation setting; validate a marketplace before you connect it (to read plugins, also select `read:plugins`) | `write:plugins` |
72| [Claude Tag API](https://platform.claude.com/docs/en/manage-claude/claude-tag-api): read Claude Tag's settings on Slack channels and Slack workspaces; list Access bundles and where they are attached (no other scope grants access to the Claude Tag API) | `read:claude_tag` |
70| [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api): read plugins, versions, installation settings, shares, and marketplaces; download plugin files, including the files of members’ personal plugins; validate a marketplace before you connect it | `read:plugins` |
71| [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api): upload plugins and versions; choose which version members are served; delete plugins, including members’ personal plugins; set and remove installation settings; set a marketplace’s default installation setting; validate a marketplace before you connect it (to read plugins, also select `read:plugins`) | `write:plugins` |
72| [Claude Tag API](https://platform.claude.com/docs/en/manage-claude/claude-tag-api): read Claude Tag’s settings on Slack channels and Slack workspaces; list Access bundles and where they are attached (no other scope grants access to the Claude Tag API) | `read:claude_tag` |
7373| [Claude Tag API](https://platform.claude.com/docs/en/manage-claude/claude-tag-api): set up and remove channels; change settings; attach and detach Access bundles (to read as well, also select `read:claude_tag`) | `write:claude_tag` |
74| [Spend Limits API](https://platform.claude.com/docs/en/manage-claude/spend-limits-api): read members' effective spend limits and increase requests | `read:spend_limits` |
74| [Spend Limits API](https://platform.claude.com/docs/en/manage-claude/spend-limits-api): read members’ effective spend limits and increase requests | `read:spend_limits` |
7575| [Spend Limits API](https://platform.claude.com/docs/en/manage-claude/spend-limits-api): set or clear per-user spend limits; approve or deny increase requests | `write:spend_limits` |
7676| [Claude Enterprise Analytics API](https://platform.claude.com/docs/en/manage-claude/analytics-api): engagement, adoption, cost, and usage reports | `read:analytics` |
7777| [Compliance API Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed): organization-wide activity events | `read:compliance_activities` |
from line 82
8282
8383The Compliance and Analytics APIs must be enabled for your organization before keys with those scopes can be used. See [Set up the Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api-access#set-up-the-compliance-api) and [Get access to the Claude Enterprise Analytics API](https://platform.claude.com/docs/en/manage-claude/analytics-api#get-access-to-the-claude-enterprise-analytics-api).
8484
85You can create and use keys with `read:plugins` or `write:plugins` only if your organization can use the Plugins API. The [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api) guide says which organizations can use it. In those organizations, keys with `read:org_audit` or `read:compliance_org_data` can also call the Plugins API's read endpoints, including file downloads, but not marketplace validation. The `read:plugins` and `write:plugins` scopes act only on the organization the key was created in. See [Plugins API scopes](https://platform.claude.com/docs/en/manage-claude/plugins-api#scopes) and [Reading another organization under the same parent](https://platform.claude.com/docs/en/manage-claude/plugins-api#reading-another-organization-under-the-same-parent).
85You can create and use keys with `read:plugins` or `write:plugins` only if your organization can use the Plugins API. The [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api) guide says which organizations can use it. In those organizations, keys with `read:org_audit` or `read:compliance_org_data` can also call the Plugins API’s read endpoints, including file downloads, but not marketplace validation. The `read:plugins` and `write:plugins` scopes act only on the organization the key was created in. See [Plugins API scopes](https://platform.claude.com/docs/en/manage-claude/plugins-api#scopes) and [Reading another organization under the same parent](https://platform.claude.com/docs/en/manage-claude/plugins-api#reading-another-organization-under-the-same-parent).
8686
8787## Use the key
8888
89Pass the key in the `x-api-key` header on every request. See each API's documentation for complete request examples.
89Pass the key in the `x-api-key` header on every request. See each API’s documentation for complete request examples.
9090
91A call that exceeds the key's scopes returns `403 Forbidden` with a message listing the scopes the key has and the scopes the endpoint needs.
91A call that exceeds the key’s scopes returns `403 Forbidden` with a message listing the scopes the key has and the scopes the endpoint needs.
9292
9393## Next steps
9494
manage-claude/analytics-api Changed · +4 / -4 lines
from line 85
8585
8686Claude Enterprise Analytics API data is available for dates on or after January 1, 2026.
8787
88**Engagement and adoption endpoints** (user activity, summaries, projects, skills, connectors) return a per-day snapshot for the date you specify. Data for a given day is typically available by about 13:00–13:30 UTC the following day (a 1-day lag); until then, the most recent available day is usually 2 days before the current UTC date. Data arrives later on days when an upstream data pipeline runs late, and exact freshness varies by query, so rather than assuming a fixed time, check the error response: requesting a date that is not yet available returns a 400 error naming the most recent available day. If data is not available well past the typical lag, it usually indicates a data pipeline failure on Anthropic's side; contact support if the gap persists.
88**Engagement and adoption endpoints** (user activity, summaries, projects, skills, connectors) return a per-day snapshot for the date you specify. Data for a given day is typically available by about 13:00–13:30 UTC the following day (a 1-day lag); until then, the most recent available day is usually 2 days before the current UTC date. Data arrives later on days when an upstream data pipeline runs late, and exact freshness varies by query, so rather than assuming a fixed time, check the error response: requesting a date that is not yet available returns a 400 error naming the most recent available day. If data is not available well past the typical lag, it usually indicates a data pipeline failure on Anthropic’s side; contact support if the gap persists.
8989
9090**Cost and usage endpoints** follow a different freshness model. Data is typically available within 4 hours of the underlying usage but might take up to 24 hours. Values can be revised as late events arrive and reconciliation runs, until about 7 days after the end of the calendar month. For example, values for October 1 can change until about November 7. For invoicing-grade totals, query only months that ended at least 7 days ago.
9191
from line 101
101101* They had at least one Claude Code session (local or remote) associated with your Claude Enterprise organization that included tool use or git activity.
102102* They had at least one Cowork session with tool use or message activity.
103103
104**Chat and Cowork unified.** Chat and Cowork unified brings Cowork's features into claude.ai chat. Most activity in Chat and Cowork unified is reported under the `chat_cowork_unified` product value, not `chat` or `cowork`.
104**Chat and Cowork unified.** Chat and Cowork unified brings Cowork’s features into claude.ai chat. Most activity in Chat and Cowork unified is reported under the `chat_cowork_unified` product value, not `chat` or `cowork`.
105105
106106In user activity and in skill, connector, and plugin usage, this usage appears in the `chat_cowork_unified_metrics` object. In activity summaries, it is counted in `chat_cowork_unified_daily_active_user_count`, `chat_cowork_unified_weekly_active_user_count`, and `chat_cowork_unified_monthly_active_user_count`.
107107
108108As more users start using Chat and Cowork unified, usage moves out of your chat and Cowork figures and into these new ones. Usage from days before a user starts using Chat and Cowork unified stays under chat or Cowork. Organization-wide figures, such as total token usage, total cost, and overall active user counts, do not change. Cost and usage reports filtered by product leave Chat and Cowork unified usage out unless `products[]` includes `chat_cowork_unified`.
109109
110Some activity from users of Chat and Cowork unified, such as voice mode, can still be reported under chat or Cowork. A user's activity can also be split between products on the day they start using Chat and Cowork unified. The same is true on the day it is turned off for them. How the activity splits is not guaranteed.
110Some activity from users of Chat and Cowork unified, such as voice mode, can still be reported under chat or Cowork. A user’s activity can also be split between products on the day they start using Chat and Cowork unified. The same is true on the day it is turned off for them. How the activity splits is not guaranteed.
111111
112112A user can appear in both the chat or Cowork counts and the Chat and Cowork unified counts. This can occur on a day when they use Chat and Cowork unified and some of their activity is still reported under chat or Cowork. Weekly and monthly counts can include them in both when the window has activity of both kinds, even on different days. For example, the window might cover days before and after they started using Chat and Cowork unified.
113113
114When you filter user activity by project, each day's project activity is counted in one place only. If a user sent a chat message in Chat and Cowork unified that day, all their project activity is counted in `chat_cowork_unified_metrics.chat`. Otherwise, it is counted in `chat_metrics`.
114When you filter user activity by project, each day’s project activity is counted in one place only. If a user sent a chat message in Chat and Cowork unified that day, all their project activity is counted in `chat_cowork_unified_metrics.chat`. Otherwise, it is counted in `chat_metrics`.
115115
116116**Per-product metric blocks.** Per-product metric objects (for example, Office Agent or Cowork metrics on a user-activity record) are always present on every record. Organizations without usage of that product see all-zero values rather than `null`. The exception is Chat and Cowork unified: on deployments that do not offer it, its fields are left out of the response.
117117
manage-claude/api-and-data-retention Changed · +35 / -35 lines
from line 4
44description: Learn about how Anthropic's APIs and associated features retain data, including information about zero data retention (ZDR) and HIPAA-ready API access.
55---
66
7This page covers the Claude API (`api.anthropic.com`), Claude Platform on AWS, [Claude in Microsoft Foundry](https://platform.claude.com/docs/en/build-with-claude/claude-in-microsoft-foundry), and [Claude Models on Google Cloud (Anthropic managed)](https://platform.claude.com/docs/en/build-with-claude/claude-models-on-google-cloud/anthropic-managed), where Anthropic is the data processor. On Amazon Bedrock and Claude Models on Google Cloud (Google managed), the cloud provider is the data processor; refer to those platforms' data retention and compliance documentation for their equivalent controls.
7This page covers the Claude API (`api.anthropic.com`), Claude Platform on AWS, [Claude in Microsoft Foundry](https://platform.claude.com/docs/en/build-with-claude/claude-in-microsoft-foundry), and [Claude Models on Google Cloud (Anthropic managed)](https://platform.claude.com/docs/en/build-with-claude/claude-models-on-google-cloud/anthropic-managed), where Anthropic is the data processor. On Amazon Bedrock and Claude Models on Google Cloud (Google managed), the cloud provider is the data processor; refer to those platforms’ data retention and compliance documentation for their equivalent controls.
88
9Anthropic offers two data handling arrangements for the Claude API: [zero data retention (ZDR)](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#zero-data-retention-zdr-scope) and [HIPAA readiness](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#hipaa-readiness). The [feature eligibility table](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#feature-eligibility) lists which API features each arrangement covers. For Anthropic's standard retention policies outside these arrangements, see the [commercial data retention policy](https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data) and the [consumer data retention policy](https://privacy.claude.com/en/articles/10023548-how-long-do-you-store-my-data).
9Anthropic offers two data handling arrangements for the Claude API: [zero data retention (ZDR)](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#zero-data-retention-zdr-scope) and [HIPAA readiness](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#hipaa-readiness). The [feature eligibility table](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#feature-eligibility) lists which API features each arrangement covers. For Anthropic’s standard retention policies outside these arrangements, see the [commercial data retention policy](https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data) and the [consumer data retention policy](https://privacy.claude.com/en/articles/10023548-how-long-do-you-store-my-data).
1010
1111## How Anthropic approaches data retention
1212
from line 13
1313Different APIs and features have different storage needs. Where a feature does not require storage of customer prompts or responses, it might be eligible for ZDR. Where a feature necessarily requires storage, Anthropic designs for the smallest possible retention footprint under the following commitments:
1414
1515* Retained data is never used for model training without your express permission.
16* Only what is technically necessary for the feature to work is retained. Conversation content (your prompts and Claude's outputs) is not retained by default; the exception is [Covered Models](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#model-specific-data-retention-requirements), which require 30-day retention.
17* Retained data is purged on the shortest practical time to live (TTL), and Anthropic aims to give customers control over how long data is retained. What is held, and the retention duration where a specific TTL applies, is documented on each feature's page.
16* Only what is technically necessary for the feature to work is retained. Conversation content (your prompts and Claude’s outputs) is not retained by default; the exception is [Covered Models](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#model-specific-data-retention-requirements), which require 30-day retention.
17* Retained data is purged on the shortest practical time to live (TTL), and Anthropic aims to give customers control over how long data is retained. What is held, and the retention duration where a specific TTL applies, is documented on each feature’s page.
1818
19Several retention models sit outside the ZDR and HIPAA arrangements described on this page. Data accessible through the [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api) follows its own retention model. The [Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed) retains data for 6 years. Chat, file, and project content from claude.ai follows your organization's retention policy set in [claude.ai > Organization settings > Data and privacy](https://claude.ai/admin-settings/data-privacy-controls), unless a user deletes it sooner. [Local session transcripts](https://platform.claude.com/docs/en/manage-claude/compliance-sessions#retrieve-local-sessions) (from sessions on users' machines, in apps such as Cowork and Claude Code) are stored for 6 years by default, or for your organization's custom conversation retention period when a finite one is set (the same claude.ai setting). [Remote session transcripts](https://platform.claude.com/docs/en/manage-claude/compliance-sessions#retrieve-remote-sessions) (Cowork in the cloud) are retained for 6 years, unless a user deletes the session sooner. The Compliance API does not capture local sessions for which ZDR is in effect. For organizations with HIPAA readiness enabled, it captures Cowork and Claude Code local sessions only and stores their transcripts for 30 days.
19Several retention models sit outside the ZDR and HIPAA arrangements described on this page. Data accessible through the [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api) follows its own retention model. The [Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed) retains data for 6 years. Chat, file, and project content from claude.ai follows your organization’s retention policy set in [claude.ai > Organization settings > Data and privacy](https://claude.ai/admin-settings/data-privacy-controls), unless a user deletes it sooner. [Local session transcripts](https://platform.claude.com/docs/en/manage-claude/compliance-sessions#retrieve-local-sessions) (from sessions on users’ machines, in apps such as Cowork and Claude Code) are stored for 6 years by default, or for your organization’s custom conversation retention period when a finite one is set (the same claude.ai setting). [Remote session transcripts](https://platform.claude.com/docs/en/manage-claude/compliance-sessions#retrieve-remote-sessions) (Cowork in the cloud) are retained for 6 years, unless a user deletes the session sooner. The Compliance API does not capture local sessions for which ZDR is in effect. For organizations with HIPAA readiness enabled, it captures Cowork and Claude Code local sessions only and stores their transcripts for 30 days.
2020
2121## Zero data retention (ZDR)
2222
from line 24
2424
2525### What ZDR covers
2626
27* **Claude Messages and Token Counting APIs:** ZDR applies to these endpoints for eligible features listed in the [feature eligibility table](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#feature-eligibility). Features that use `/v1/messages` but are marked "No" in the table (such as code execution) are not covered.
28* **Claude Code with API keys:** ZDR applies when Claude Code is used with API keys from a Commercial organization (an organization under Anthropic's Commercial Terms of Service, as distinct from a consumer Claude account). If metrics logging is enabled in Claude Code, productivity data such as usage statistics is exempted from ZDR and may be retained. Claude Code on Claude Enterprise is not covered by this arrangement and has a separate ZDR offering; see [What ZDR does not cover](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#what-zdr-does-not-cover).
27* **Claude Messages and Token Counting APIs:** ZDR applies to these endpoints for eligible features listed in the [feature eligibility table](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#feature-eligibility). Features that use `/v1/messages` but are marked “No” in the table (such as code execution) are not covered.
28* **Claude Code with API keys:** ZDR applies when Claude Code is used with API keys from a Commercial organization (an organization under Anthropic’s Commercial Terms of Service, as distinct from a consumer Claude account). If metrics logging is enabled in Claude Code, productivity data such as usage statistics is exempted from ZDR and may be retained. Claude Code on Claude Enterprise is not covered by this arrangement and has a separate ZDR offering; see [What ZDR does not cover](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#what-zdr-does-not-cover).
2929* **Claude Platform on AWS:** [Claude Platform on AWS](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws) follows the same data retention policy as the first-party Claude API. ZDR is available on request; contact your Anthropic account representative to enable it.
3030* **Claude Models on Google Cloud (Anthropic managed):** [Claude Models on Google Cloud (Anthropic managed)](https://platform.claude.com/docs/en/build-with-claude/claude-models-on-google-cloud/anthropic-managed) follows the same data retention policy as the first-party Claude API. ZDR is available on request; contact your Anthropic account representative to enable it.
3131
from line 37
3737* **Claude Teams and Claude Enterprise product interfaces:** These interfaces are not ZDR-eligible. The one exception is Claude Code on Claude Enterprise, which has its own ZDR offering, separate from the ZDR arrangement described on this page. That offering is available only to qualified accounts on Claude Enterprise and requires separate enablement by Anthropic. See the [Claude Code ZDR documentation](https://code.claude.com/docs/en/zero-data-retention), which applies to Claude Enterprise organizations only.
3838* **Claude for Excel:** Not currently ZDR-eligible.
3939* **Claude Fable 5.1, Claude Mythos 5.1, Claude Fable 5, and Claude Mythos 5:** These models require 30-day data retention and are not available under ZDR unless expressly authorized by Anthropic. See [Model-specific data retention requirements](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#model-specific-data-retention-requirements).
40* **Third-party integrations:** Data processed by third-party websites, tools, or other integrations is not covered, though some may have similar offerings. Review each service's data handling practices.
40* **Third-party integrations:** Data processed by third-party websites, tools, or other integrations is not covered, though some may have similar offerings. Review each service’s data handling practices.
4141* **Cross-Origin Resource Sharing (CORS):** CORS is not supported for organizations with ZDR arrangements. To make API calls from browser-based applications, route requests through a backend proxy server. See the [API security guidance](https://platform.claude.com/docs/en/api/overview) for proxy patterns and API-key handling.
4242* **Flagged content and legal holds:** See [Retention regardless of arrangement](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#retention-regardless-of-arrangement).
4343
from line 47
4747
4848## HIPAA readiness
4949
50The Claude API supports HIPAA-ready integrations for organizations that handle protected health information (PHI). With a signed BAA and a HIPAA-enabled organization, you can use supported API features to process PHI while supporting your organization's HIPAA compliance. Eligible organizations can review and execute the BAA and enable HIPAA readiness directly from the Claude Console. HIPAA readiness applies a broader set of privacy and security safeguards than ZDR (encryption, access controls, and audit logging that protect PHI throughout its lifecycle) rather than requiring immediate deletion. If your organization handles PHI, HIPAA readiness is the arrangement to use; you do not also need ZDR. See the [feature eligibility table](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#feature-eligibility) for which features each arrangement covers.
50The Claude API supports HIPAA-ready integrations for organizations that handle protected health information (PHI). With a signed BAA and a HIPAA-enabled organization, you can use supported API features to process PHI while supporting your organization’s HIPAA compliance. Eligible organizations can review and execute the BAA and enable HIPAA readiness directly from the Claude Console. HIPAA readiness applies a broader set of privacy and security safeguards than ZDR (encryption, access controls, and audit logging that protect PHI throughout its lifecycle) rather than requiring immediate deletion. If your organization handles PHI, HIPAA readiness is the arrangement to use; you do not also need ZDR. See the [feature eligibility table](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#feature-eligibility) for which features each arrangement covers.
5151
5252<Note>
5353 This page covers HIPAA readiness for the Claude API. For the full HIPAA Implementation Guide covering Claude Enterprise and configuration requirements, see the [Anthropic Trust Center](https://trust.anthropic.com/resources).
from line 62
6262
6363* **Claude consumer products:** Claude Free, Pro, and Max plans.
6464* **Claude Console:** Usage through the Claude Console interface (enabling HIPAA readiness from Console settings is supported; processing PHI through the Console is not covered).
65* **Partner-operated platforms:** Amazon Bedrock and Google Cloud's Agent Platform. Refer to those platforms' compliance documentation.
65* **Partner-operated platforms:** Amazon Bedrock and Google Cloud’s Agent Platform. Refer to those platforms’ compliance documentation.
6666* **Claude Platform on AWS:** HIPAA readiness is not available on Claude Platform on AWS.
6767* **Third-party integrations:** Data processed by external tools or services connected to your application.
6868* **Claude Code:** Claude Code is not covered under HIPAA readiness.
from line 71
7171
7272### PHI handling guidelines
7373
74Protected health information (PHI) includes any individually identifiable health information. In the context of the Claude API, PHI typically appears in message content (prompts and Claude's responses), attached files (images, PDFs), and file names or metadata associated with message content. The following fields are not expected to contain PHI under the BAA: workspace names, user information (name, email, phone number), billing data, and support tickets.
74Protected health information (PHI) includes any individually identifiable health information. In the context of the Claude API, PHI typically appears in message content (prompts and Claude’s responses), attached files (images, PDFs), and file names or metadata associated with message content. The following fields are not expected to contain PHI under the BAA: workspace names, user information (name, email, phone number), billing data, and support tickets.
7575
7676When using [structured outputs](https://platform.claude.com/docs/en/build-with-claude/structured-outputs) or tools with `strict: true`, the API compiles JSON schemas into grammars that are cached separately from message content. These cached schemas do not receive the same PHI protections as prompts and responses. **Do not include PHI in JSON schema definitions.** This restriction applies to schema property names, `enum` values, `const` values, and `pattern` regular expressions. Patient-specific information should appear only in message content, where it is protected under HIPAA safeguards.
7777
from line 89
8989}
9090```
9191
92The error message lists the non-eligible features detected in the request; remove them and retry. The phrase "without Zero Data Retention" is the API's own wording and does not change the resolution. Client-side tools whose Details column in the [feature eligibility table](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#feature-eligibility) says they are not blocked are accepted but remain outside HIPAA readiness.
92The error message lists the non-eligible features detected in the request; remove them and retry. The phrase “without Zero Data Retention” is the API’s own wording and does not change the resolution. Client-side tools whose Details column in the [feature eligibility table](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#feature-eligibility) says they are not blocked are accepted but remain outside HIPAA readiness.
9393
9494### Getting started with HIPAA readiness
9595
96There are two ways to set up HIPAA-ready API access. Most organizations can enable it directly in the Claude Console with Anthropic's standard BAA; organizations that require a negotiated BAA should work with their account team.
96There are two ways to set up HIPAA-ready API access. Most organizations can enable it directly in the Claude Console with Anthropic’s standard BAA; organizations that require a negotiated BAA should work with their account team.
9797
9898#### Enable in the Console (standard BAA)
9999
100100<Steps>
101 <Step title="Open your organization's data retention settings">
102 In the Claude Console, go to the [Data retention](https://platform.claude.com/settings/privacy) page (`platform.claude.com/settings/privacy`). Organization admins with the HIPAA management permission see a **HIPAA compliance** card there. If you don't see the card, select **Organization** from the dropdown menu at the top of the page. If your organization is eligible but you still don't see the option to enable, ask an organization admin to complete these steps.
101 <Step title="Open your organization’s data retention settings">
102 In the Claude Console, go to the [Data retention](https://platform.claude.com/settings/privacy) page (`platform.claude.com/settings/privacy`). Organization admins with the HIPAA management permission see a **HIPAA compliance** card there. If you don’t see the card, select **Organization** from the dropdown menu at the top of the page. If your organization is eligible but you still don’t see the option to enable, ask an organization admin to complete these steps.
103103 </Step>
104104
105105 <Step title="Review and execute the BAA">
from line 113
113113
114114#### Contact sales (custom BAA)
115115
116If your organization requires a negotiated or custom BAA, or if self-serve enablement isn't available for your organization, contact the [Anthropic sales team](https://claude.com/contact-sales). Anthropic will execute the BAA and enable HIPAA readiness for your organization.
116If your organization requires a negotiated or custom BAA, or if self-serve enablement isn’t available for your organization, contact the [Anthropic sales team](https://claude.com/contact-sales). Anthropic will execute the BAA and enable HIPAA readiness for your organization.
117117
118118#### Build with eligible features
119119
from line 137
137137}
138138```
139139
140The 30-day data retention requirement applies wherever Covered Models are offered. On the Claude API (including Claude Platform on AWS), Anthropic handles retained data. On Amazon Bedrock and Google Cloud's Agent Platform, retained data stays within your cloud provider's environment; review each platform's documentation for enablement steps.
140The 30-day data retention requirement applies wherever Covered Models are offered. On the Claude API (including Claude Platform on AWS), Anthropic handles retained data. On Amazon Bedrock and Google Cloud’s Agent Platform, retained data stays within your cloud provider’s environment; review each platform’s documentation for enablement steps.
141141
142142### Enable 30-day retention for a workspace
143143
144Organizations with a ZDR arrangement can make these models available in a specific workspace by enabling 30-day retention for that workspace only. Other workspaces in the organization keep zero data retention. The Default Workspace always follows the organization's setting, so use another workspace.
144Organizations with a ZDR arrangement can make these models available in a specific workspace by enabling 30-day retention for that workspace only. Other workspaces in the organization keep zero data retention. The Default Workspace always follows the organization’s setting, so use another workspace.
145145
146146<Steps>
147 <Step title="Open the workspace's data retention settings">
147 <Step title="Open the workspace’s data retention settings">
148148 In the Claude Console, go to the [Data retention](https://platform.claude.com/settings/privacy) page (`platform.claude.com/settings/privacy`) and select the workspace from the dropdown menu at the top of the page.
149149 </Step>
150150
from line 163
163163
164164Each eligibility column uses three values:
165165
166* **Yes:** The feature is fully eligible under the arrangement. For ZDR, "Yes" also assumes you are using a model that does not require 30-day data retention; [Covered Models](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#model-specific-data-retention-requirements) are not available under ZDR regardless of feature eligibility.
167* **Yes (qualified):** Your prompts and Claude's outputs are not stored, but a bounded technical artifact (named in the Details column) is retained briefly for the feature to function. See [How Anthropic approaches data retention](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#how-anthropic-approaches-data-retention) for the commitments that govern these features.
168* **No:** The feature is not eligible. Under HIPAA readiness, the API blocks requests that include a "No" feature and returns a `400` error, unless the feature's Details column says otherwise. Under ZDR, the API does **not** block these features; using one is a choice to step outside your ZDR arrangement for that specific data, and the feature's own documented retention policy applies. Features marked "No" for ZDR are typically stateful (they store jobs, files, or container state), which is why they cannot be zero-retention.
166* **Yes:** The feature is fully eligible under the arrangement. For ZDR, “Yes” also assumes you are using a model that does not require 30-day data retention; [Covered Models](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#model-specific-data-retention-requirements) are not available under ZDR regardless of feature eligibility.
167* **Yes (qualified):** Your prompts and Claude’s outputs are not stored, but a bounded technical artifact (named in the Details column) is retained briefly for the feature to function. See [How Anthropic approaches data retention](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#how-anthropic-approaches-data-retention) for the commitments that govern these features.
168* **No:** The feature is not eligible. Under HIPAA readiness, the API blocks requests that include a “No” feature and returns a `400` error, unless the feature’s Details column says otherwise. Under ZDR, the API does **not** block these features; using one is a choice to step outside your ZDR arrangement for that specific data, and the feature’s own documented retention policy applies. Features marked “No” for ZDR are typically stateful (they store jobs, files, or container state), which is why they cannot be zero-retention.
169169
170170| Feature | Endpoint | ZDR eligible | HIPAA eligible | Details |
171171| -------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------- | ------------------------------------------------------- | ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
from line 176
176176| [Bash tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/bash-tool) | `/v1/messages`<br />with `bash` tool | <Eligible>Yes</Eligible> | <Eligible>Yes</Eligible> | Client-side tool run in your environment. |
177177| [Batch processing](https://platform.claude.com/docs/en/build-with-claude/batch-processing) | `/v1/messages/batches` | <Eligible status="no">No</Eligible> | <Eligible status="no">No</Eligible> | 29-day retention; async storage required. See [Batch processing data retention](https://platform.claude.com/docs/en/build-with-claude/batch-processing#data-retention). |
178178| [Browser use](https://platform.claude.com/docs/en/agents-and-tools/tool-use/browser-use-tool) | `/v1/messages`<br />with `browser` toolset | <Eligible>Yes</Eligible> | <Eligible status="no">No</Eligible> | Client-side tool. Anthropic does not run browser actions or retain page content beyond standard API handling. Not covered under HIPAA readiness; requests that include the browser use tool are not blocked. See [Browser use data retention](https://platform.claude.com/docs/en/agents-and-tools/tool-use/browser-use-tool#data-retention). |
179| [Cache diagnostics](https://platform.claude.com/docs/en/build-with-claude/cache-diagnostics) | `/v1/messages`<br />with `diagnostics` | <Eligible status="qualified">Yes (qualified)</Eligible> | <Eligible status="no">No</Eligible> | Your prompts and Claude's outputs are not stored. A fingerprint of cryptographic hashes and token-count estimates is retained briefly to allow comparison against the next request. See [Cache diagnostics data retention](https://platform.claude.com/docs/en/build-with-claude/cache-diagnostics#data-retention). |
179| [Cache diagnostics](https://platform.claude.com/docs/en/build-with-claude/cache-diagnostics) | `/v1/messages`<br />with `diagnostics` | <Eligible status="qualified">Yes (qualified)</Eligible> | <Eligible status="no">No</Eligible> | Your prompts and Claude’s outputs are not stored. A fingerprint of cryptographic hashes and token-count estimates is retained briefly to allow comparison against the next request. See [Cache diagnostics data retention](https://platform.claude.com/docs/en/build-with-claude/cache-diagnostics#data-retention). |
180180| [Citations](https://platform.claude.com/docs/en/build-with-claude/citations) | `/v1/messages` | <Eligible>Yes</Eligible> | <Eligible>Yes</Eligible> | |
181181| [Claude Managed Agents](https://platform.claude.com/docs/en/managed-agents/overview) | `/v1/agents`<br />`/v1/sessions`<br />`/v1/environments` | <Eligible status="no">No</Eligible> | <Eligible status="no">No</Eligible> | Sessions are stateful resources; transcripts persist until you delete them. Applies to all Managed Agents sub-features, including [Self-hosted sandboxes](https://platform.claude.com/docs/en/managed-agents/self-hosted-sandboxes). |
182182| [Code execution](https://platform.claude.com/docs/en/agents-and-tools/tool-use/code-execution-tool) | `/v1/messages`<br />with `code_execution` tool | <Eligible status="no">No</Eligible> | <Eligible status="no">No</Eligible> | Container data retained up to 30 days. See [Code execution data retention](https://platform.claude.com/docs/en/agents-and-tools/tool-use/code-execution-tool#data-retention). |
from line 193
193193| [Memory tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/memory-tool) | `/v1/messages`<br />with `memory` tool | <Eligible>Yes</Eligible> | <Eligible>Yes</Eligible> | Client-side memory storage where you control data retention. |
194194| [Messages API](https://platform.claude.com/docs/en/build-with-claude/working-with-messages) | `/v1/messages` | <Eligible>Yes</Eligible> | <Eligible>Yes</Eligible> | Standard API calls for generating Claude responses. |
195195| [Mid-conversation system messages](https://platform.claude.com/docs/en/build-with-claude/mid-conversation-system-messages) | `/v1/messages`<br />with `role: "system"` messages | <Eligible>Yes</Eligible> | <Eligible>Yes</Eligible> | Request-shape capability of the Messages API; mid-conversation system messages flow through the standard inference path and nothing is stored server-side after the response. |
196| [OpenTelemetry export](https://platform.claude.com/docs/en/manage-claude/opentelemetry) | `/v1/organizations/telemetry_destinations` | <Eligible>Yes</Eligible> | <Eligible status="no">No</Eligible> | Beta. Spans have the same ZDR eligibility as the feature that produces them. HIPAA organizations can export metadata. SDK spans go directly from your environment to your exporter. After delivery, the data is held by the service that you chose, outside Anthropic, under that service's retention and access controls. |
196| [OpenTelemetry export](https://platform.claude.com/docs/en/manage-claude/opentelemetry) | `/v1/organizations/telemetry_destinations` | <Eligible>Yes</Eligible> | <Eligible status="no">No</Eligible> | Beta. Spans have the same ZDR eligibility as the feature that produces them. HIPAA organizations can export metadata. SDK spans go directly from your environment to your exporter. After delivery, the data is held by the service that you chose, outside Anthropic, under that service’s retention and access controls. |
197197| [PDF support](https://platform.claude.com/docs/en/build-with-claude/pdf-support) | `/v1/messages` | <Eligible>Yes</Eligible> | <Eligible>Yes</Eligible> | HIPAA eligibility applies to PDFs sent inline through the Messages API, not through the Files API. |
198198| [Programmatic tool calling](https://platform.claude.com/docs/en/agents-and-tools/tool-use/programmatic-tool-calling) | `/v1/messages`<br />with `code_execution` tool | <Eligible status="no">No</Eligible> | <Eligible status="no">No</Eligible> | Built on code execution containers; data retained up to 30 days. See [Programmatic tool calling data retention](https://platform.claude.com/docs/en/agents-and-tools/tool-use/programmatic-tool-calling#data-retention). |
199| [Prompt caching](https://platform.claude.com/docs/en/build-with-claude/prompt-caching) | `/v1/messages` | <Eligible>Yes</Eligible> | <Eligible>Yes</Eligible> | Your prompts and Claude's outputs are not stored. KV cache representations and cryptographic hashes are held in memory for the cache TTL and promptly deleted after expiry. See [Prompt caching](https://platform.claude.com/docs/en/build-with-claude/prompt-caching#data-retention). |
199| [Prompt caching](https://platform.claude.com/docs/en/build-with-claude/prompt-caching) | `/v1/messages` | <Eligible>Yes</Eligible> | <Eligible>Yes</Eligible> | Your prompts and Claude’s outputs are not stored. KV cache representations and cryptographic hashes are held in memory for the cache TTL and promptly deleted after expiry. See [Prompt caching](https://platform.claude.com/docs/en/build-with-claude/prompt-caching#data-retention). |
200200| [Search results](https://platform.claude.com/docs/en/build-with-claude/search-results) | `/v1/messages`<br />with `search_results` source | <Eligible>Yes</Eligible> | <Eligible>Yes</Eligible> | |
201| [Structured outputs](https://platform.claude.com/docs/en/build-with-claude/structured-outputs) | `/v1/messages` | <Eligible status="qualified">Yes (qualified)</Eligible> | <Eligible>Yes</Eligible> | Your prompts and Claude's outputs are not stored. Only the JSON schema is cached, for up to 24 hours since last use. This also covers [strict tool use](https://platform.claude.com/docs/en/agents-and-tools/tool-use/strict-tool-use) (`strict: true` on tools), which uses the same grammar pipeline. PHI must not be included in JSON schema definitions; see [PHI handling guidelines](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#phi-handling-guidelines). See [Structured outputs data retention](https://platform.claude.com/docs/en/build-with-claude/structured-outputs#data-retention). |
201| [Structured outputs](https://platform.claude.com/docs/en/build-with-claude/structured-outputs) | `/v1/messages` | <Eligible status="qualified">Yes (qualified)</Eligible> | <Eligible>Yes</Eligible> | Your prompts and Claude’s outputs are not stored. Only the JSON schema is cached, for up to 24 hours since last use. This also covers [strict tool use](https://platform.claude.com/docs/en/agents-and-tools/tool-use/strict-tool-use) (`strict: true` on tools), which uses the same grammar pipeline. PHI must not be included in JSON schema definitions; see [PHI handling guidelines](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#phi-handling-guidelines). See [Structured outputs data retention](https://platform.claude.com/docs/en/build-with-claude/structured-outputs#data-retention). |
202202| [Text editor tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/text-editor-tool) | `/v1/messages`<br />with `text_editor` tool | <Eligible>Yes</Eligible> | <Eligible>Yes</Eligible> | Client-side tool run in your environment. |
203203| [Thinking](https://platform.claude.com/docs/en/build-with-claude/thinking) | `/v1/messages`<br />with `thinking` | <Eligible>Yes</Eligible> | <Eligible>Yes</Eligible> | |
204204| [Token counting](https://platform.claude.com/docs/en/build-with-claude/token-counting) | `/v1/messages/count_tokens` | <Eligible>Yes</Eligible> | <Eligible>Yes</Eligible> | Count tokens before sending requests. |
205205| [Tool search](https://platform.claude.com/docs/en/agents-and-tools/tool-use/tool-search-tool) | `/v1/messages`<br />with `tool_search` tool | <Eligible>Yes</Eligible> | <Eligible status="no">No</Eligible> | Server-side tool run by Anthropic; the tool definitions in the request are searched in memory per call and nothing is stored after the response. |
206| [User profiles](https://platform.claude.com/docs/en/manage-claude/user-profiles) | `/v1/user_profiles` | <Eligible status="no">No</Eligible> | <Eligible status="no">No</Eligible> | Profiles are metadata about your end customers and don't contain prompts or outputs. The profile data you send is retained according to standard policy until you delete the profile. HIPAA-enabled organizations can use user profiles, but the user profiles API is not a HIPAA-eligible service and PHI must not be included in the profile data you send. See [What a profile contains and how Anthropic uses it](https://platform.claude.com/docs/en/manage-claude/user-profiles#what-a-profile-contains-and-how-anthropic-uses-it). |
206| [User profiles](https://platform.claude.com/docs/en/manage-claude/user-profiles) | `/v1/user_profiles` | <Eligible status="no">No</Eligible> | <Eligible status="no">No</Eligible> | Profiles are metadata about your end customers and don’t contain prompts or outputs. The profile data you send is retained according to standard policy until you delete the profile. HIPAA-enabled organizations can use user profiles, but the user profiles API is not a HIPAA-eligible service and PHI must not be included in the profile data you send. See [What a profile contains and how Anthropic uses it](https://platform.claude.com/docs/en/manage-claude/user-profiles#what-a-profile-contains-and-how-anthropic-uses-it). |
207207| [Web fetch](https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-fetch-tool) | `/v1/messages`<br />with `web_fetch` tool | <Eligible>Yes</Eligible> | <Eligible status="no">No</Eligible> | Fetched web content returned in the API response. [Dynamic filtering for web fetch](https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-fetch-tool#dynamic-filtering) is not eligible for ZDR or HIPAA. Website publishers might retain request data (such as fetched URLs and request metadata) according to their own policies. |
208208| [Web search](https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-search-tool) | `/v1/messages`<br />with `web_search` tool | <Eligible>Yes</Eligible> | <Eligible>Yes</Eligible> | Real-time web search results returned in the API response. [Dynamic filtering for web search](https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-search-tool#dynamic-filtering) is not eligible for ZDR or HIPAA. |
209209
210210## Retention regardless of arrangement
211211
212Even with ZDR or HIPAA arrangements in place, Anthropic may retain data where required by law or where it has been flagged by Anthropic's automated trust and safety systems. As a result, if a chat or session is flagged, Anthropic may retain inputs and outputs for up to 2 years.
212Even with ZDR or HIPAA arrangements in place, Anthropic may retain data where required by law or where it has been flagged by Anthropic’s automated trust and safety systems. As a result, if a chat or session is flagged, Anthropic may retain inputs and outputs for up to 2 years.
213213
214214## Frequently asked questions
215215
from line 219
219219 </Accordion>
220220
221221 <Accordion title="Can I use ZDR-eligible (qualified) features under my ZDR arrangement?">
222 Yes. These features retain a minimal, documented set of technical data, not your prompts or Claude's outputs. See the [feature eligibility table](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#feature-eligibility) legend for what "Yes (qualified)" means and [How Anthropic approaches data retention](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#how-anthropic-approaches-data-retention) for the commitments that govern these features.
222 Yes. These features retain a minimal, documented set of technical data, not your prompts or Claude’s outputs. See the [feature eligibility table](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#feature-eligibility) legend for what “Yes (qualified)” means and [How Anthropic approaches data retention](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#how-anthropic-approaches-data-retention) for the commitments that govern these features.
223223 </Accordion>
224224
225225 <Accordion title="What happens if I use a feature marked "No" under ZDR?">
226 Nothing blocks the request. Features marked "No" for ZDR are fundamentally stateful: the Batch API stores your jobs, the Files API stores your files, and code execution runs in persistent containers. Data for these features is retained per the feature's documented policy. Using them is a choice to step outside your ZDR arrangement for that specific data.
226 Nothing blocks the request. Features marked “No” for ZDR are fundamentally stateful: the Batch API stores your jobs, the Files API stores your files, and code execution runs in persistent containers. Data for these features is retained per the feature’s documented policy. Using them is a choice to step outside your ZDR arrangement for that specific data.
227227 </Accordion>
228228
229229 <Accordion title="Can I request deletion of data from features that are not ZDR-eligible?">
from line 243
243243 </Accordion>
244244
245245 <Accordion title="Can I use the same organization for HIPAA and non-HIPAA workloads?">
246 No. HIPAA readiness is enforced at the organization level and automatically blocks non-eligible features (client-side tools noted in the table's Details column are the exception: they are not blocked, but they are still outside HIPAA readiness). Use a separate organization for workloads that do not require HIPAA readiness.
246 No. HIPAA readiness is enforced at the organization level and automatically blocks non-eligible features (client-side tools noted in the table’s Details column are the exception: they are not blocked, but they are still outside HIPAA readiness). Use a separate organization for workloads that do not require HIPAA readiness.
247247 </Accordion>
248248
249249 <Accordion title="How do I request HIPAA-ready API access?">
250 Eligible organizations can enable HIPAA readiness directly on the [Data retention](https://platform.claude.com/settings/privacy) page (`platform.claude.com/settings/privacy`) in the Claude Console by reviewing and executing Anthropic's standard BAA; see [Getting started with HIPAA readiness](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#getting-started-with-hipaa-readiness). If your organization requires a negotiated BAA, or self-serve enablement isn't available for your organization, contact the [Anthropic sales team](https://claude.com/contact-sales).
250 Eligible organizations can enable HIPAA readiness directly on the [Data retention](https://platform.claude.com/settings/privacy) page (`platform.claude.com/settings/privacy`) in the Claude Console by reviewing and executing Anthropic’s standard BAA; see [Getting started with HIPAA readiness](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#getting-started-with-hipaa-readiness). If your organization requires a negotiated BAA, or self-serve enablement isn’t available for your organization, contact the [Anthropic sales team](https://claude.com/contact-sales).
251251 </Accordion>
252252
253253 <Accordion title="Does this apply to Amazon Bedrock or Google Cloud?">
254 [Claude Models on Google Cloud (Anthropic managed)](https://platform.claude.com/docs/en/build-with-claude/claude-models-on-google-cloud/anthropic-managed) follows the same data retention policy as the first-party Claude API, and Anthropic is the data processor. ZDR is available there on request. On Amazon Bedrock and Claude Models on Google Cloud (Google managed), the cloud provider is the data processor; refer to those platforms' data retention and compliance policies for their equivalent controls.
254 [Claude Models on Google Cloud (Anthropic managed)](https://platform.claude.com/docs/en/build-with-claude/claude-models-on-google-cloud/anthropic-managed) follows the same data retention policy as the first-party Claude API, and Anthropic is the data processor. ZDR is available there on request. On Amazon Bedrock and Claude Models on Google Cloud (Google managed), the cloud provider is the data processor; refer to those platforms’ data retention and compliance policies for their equivalent controls.
255255 </Accordion>
256256
257257 <Accordion title="Is Claude Platform on AWS eligible for ZDR or HIPAA readiness?">
manage-claude/app-attest Changed · +3 / -3 lines
from line 10
1010
1111## How App Attest works
1212
13Each installation of your app uses Apple's [App Attest](https://developer.apple.com/documentation/devicecheck/establishing-your-app-s-integrity) service to prove that it is a genuine, unmodified build of the app you registered. Anthropic then issues the device a short-lived access token that bills usage to your workspace. The app ships no API key, and there is no proxy for you to operate.
13Each installation of your app uses Apple’s [App Attest](https://developer.apple.com/documentation/devicecheck/establishing-your-app-s-integrity) service to prove that it is a genuine, unmodified build of the app you registered. Anthropic then issues the device a short-lived access token that bills usage to your workspace. The app ships no API key, and there is no proxy for you to operate.
1414
1515App Attest authentication is available only when your app calls the Claude API directly. It is not available through Amazon Bedrock, Google Cloud, or Microsoft Foundry.
1616
17The first time your app uses Claude on a device, the app requests a challenge from Anthropic, attests the device with Apple's `DCAppAttestService`, and exchanges the verified attestation for an access token. The Claude for Foundation Models package runs this flow automatically and requests new tokens as they expire; there is no attestation code for you to write.
17The first time your app uses Claude on a device, the app requests a challenge from Anthropic, attests the device with Apple’s `DCAppAttestService`, and exchanges the verified attestation for an access token. The Claude for Foundation Models package runs this flow automatically and requests new tokens as they expire; there is no attestation code for you to write.
1818
1919Tokens are scoped to your workspace, expire after 1 hour, and authorize only [Messages API](https://platform.claude.com/docs/en/api/messages/create) calls. They carry no end-user identity: App Attest identifies your app, not the person using it, so handle any per-user logic in your app.
2020
from line 29
29291. In Xcode, add the **App Attest** capability to your app target under **Signing & Capabilities**.
30302. In the Claude Console, go to the [App integrations](https://platform.claude.com/settings/workspaces/default/app-integrations) page (`platform.claude.com/settings/workspaces/default/app-integrations`). Each app integration belongs to one workspace. Select the workspace you want in the workspace picker in the sidebar.
31313. Click **Create app integration** and enter a name, your Apple Developer Team ID, and one or more bundle IDs (up to 32).
324. Copy the client ID (`clid_...`) from the integration's **Overview** tab and pass it to your app's Claude configuration.
324. Copy the client ID (`clid_...`) from the integration’s **Overview** tab and pass it to your app’s Claude configuration.
3333
3434## Revoke an app integration
3535
manage-claude/authentication Changed · +16 / -16 lines
from line 9
99| Method | Credential | Best for |
1010| ----------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
1111| [API key](https://platform.claude.com/docs/en/manage-claude/authentication#api-keys) | Static `sk-ant-api...` secret sent as a bearer token in the `Authorization` header | Local development, prototyping, scripts, and servers where you control secret storage |
12| [Workload Identity Federation](https://platform.claude.com/docs/en/manage-claude/authentication#workload-identity-federation) | Short-lived bearer token exchanged from your identity provider's identity token | Production workloads on cloud platforms (AWS, Google Cloud, Azure), CI/CD pipelines, and Kubernetes, where you want to eliminate static secrets |
12| [Workload Identity Federation](https://platform.claude.com/docs/en/manage-claude/authentication#workload-identity-federation) | Short-lived bearer token exchanged from your identity provider’s identity token | Production workloads on cloud platforms (AWS, Google Cloud, Azure), CI/CD pipelines, and Kubernetes, where you want to eliminate static secrets |
1313| [App Attest](https://platform.claude.com/docs/en/manage-claude/authentication#app-attest) | Short-lived access token issued to a genuine, attested installation of your registered iOS or macOS app | iOS and macOS apps distributed to end users, where the app calls the Claude API directly with no back end or proxy |
1414
1515API keys and Workload Identity Federation grant the same access to Claude API endpoints. Choose API keys to get started quickly: a personal key for your own development, or a service account key for anything shared. Move to Workload Identity Federation when your workload already has a platform-issued identity you can federate. Use App Attest for iOS and macOS apps you distribute to end users.
from line 28
2828| **Service account key** | A [service account](https://platform.claude.com/docs/en/manage-claude/workload-identity-federation#service-accounts) | Either a single workspace or anything the service account has access to, chosen when the key is created. A service account has access to the Default Workspace and to workspaces it has been added to | The service account is archived. A single-workspace key also stops working when the service account is removed from that workspace or that workspace is archived |
2929| **Workspace key** (legacy) | No one: it belongs to the workspace it was created in | That workspace | It expires, is disabled or deleted, or its workspace is archived, regardless of whether its creator leaves the organization |
3030
31Personal keys and service account keys are identity-backed: each belongs to a user or service account your organization already manages, and every request acts as that identity. When that identity is removed from the organization, the key stops working. This means that keys don't accidentally outlive the people or workloads that own them. Prefer them over workspace keys for new integrations.
31Personal keys and service account keys are identity-backed: each belongs to a user or service account your organization already manages, and every request acts as that identity. When that identity is removed from the organization, the key stops working. This means that keys don’t accidentally outlive the people or workloads that own them. Prefer them over workspace keys for new integrations.
3232
3333Use a personal key for your own development and scripts. A shared personal key acts as one person and breaks when they leave. For shared or automated workloads (CI, production services), have an organization admin create a service account so the workload has its own identity.
3434
from line 48
4848
4949The legacy `x-api-key: YOUR_API_KEY` header is still supported in place of `Authorization`.
5050
51Store API keys in a secrets manager, rotate them periodically, and disable or delete any key you suspect has leaked. On the [API keys](https://platform.claude.com/settings/keys) page in the Claude Console, **Disable** is reversible (the Admin API reports the key's `status` as `"inactive"`, and **Re-enable** returns it to `"active"`), whereas **Delete** is permanent: the key is archived and still appears in [List API Keys](https://platform.claude.com/docs/en/api/organization/api_keys/list) with `status: "archived"`. Expired keys can only be deleted. You can also set an [expiration](https://platform.claude.com/docs/en/manage-claude/authentication#key-expiration) when you create a key to limit how long a leaked credential stays usable.
51Store API keys in a secrets manager, rotate them periodically, and disable or delete any key you suspect has leaked. On the [API keys](https://platform.claude.com/settings/keys) page in the Claude Console, **Disable** is reversible (the Admin API reports the key’s `status` as `"inactive"`, and **Re-enable** returns it to `"active"`), whereas **Delete** is permanent: the key is archived and still appears in [List API Keys](https://platform.claude.com/docs/en/api/organization/api_keys/list) with `status: "archived"`. Expired keys can only be deleted. You can also set an [expiration](https://platform.claude.com/docs/en/manage-claude/authentication#key-expiration) when you create a key to limit how long a leaked credential stays usable.
5252
5353<CodeGroup>
5454 ```bash cURL
from line 125
125125
126126API keys that are created for a specific workspace only work in that workspace, and API requests using these keys can omit the workspace ID.
127127
128If your API key isn't scoped to a workspace, you must specify the workspace ID in the `anthropic-workspace-id` header for each request. See the following example for how to set this header in a request or in the SDK.
128If your API key isn’t scoped to a workspace, you must specify the workspace ID in the `anthropic-workspace-id` header for each request. See the following example for how to set this header in a request or in the SDK.
129129
130The [Admin API](https://platform.claude.com/docs/en/manage-claude/admin-api) accepts a personal key or service account key only if the key isn't scoped to a specific workspace.
130The [Admin API](https://platform.claude.com/docs/en/manage-claude/admin-api) accepts a personal key or service account key only if the key isn’t scoped to a specific workspace.
131131
132You can find a workspace's ID in the **ID** column on the [Workspaces](https://platform.claude.com/settings/workspaces) page (`platform.claude.com/settings/workspaces`) in the Claude Console, or by calling the [List Workspaces](https://platform.claude.com/docs/en/api/organization/workspaces/list) endpoint. List Workspaces includes the Default Workspace only when you pass `include_default=true`; its ID is also in the `anthropic-workspace-id` [response header](https://platform.claude.com/docs/en/manage-claude/workspaces#identify-the-workspace-behind-an-api-response) of any request that runs there.
132You can find a workspace’s ID in the **ID** column on the [Workspaces](https://platform.claude.com/settings/workspaces) page (`platform.claude.com/settings/workspaces`) in the Claude Console, or by calling the [List Workspaces](https://platform.claude.com/docs/en/api/organization/workspaces/list) endpoint. List Workspaces includes the Default Workspace only when you pass `include_default=true`; its ID is also in the `anthropic-workspace-id` [response header](https://platform.claude.com/docs/en/manage-claude/workspaces#identify-the-workspace-behind-an-api-response) of any request that runs there.
133133
134134<CodeGroup>
135135 ```bash cURL
from line 309
309309 ```
310310</CodeGroup>
311311
312If a request made with a key that isn't scoped to a workspace omits the header, the API returns a 400 `invalid_request_error`:
312If a request made with a key that isn’t scoped to a workspace omits the header, the API returns a 400 `invalid_request_error`:
313313
314314```json JSON
315315{
from line 322
322322}
323323```
324324
325A header value that isn't a valid workspace ID returns a 400 `invalid_request_error` with the message `anthropic-workspace-id header must be a valid workspace ID.` If the workspace doesn't exist, or the key's user or service account doesn't have access to it, the API returns a 404 `not_found_error` with the message ``Workspace `<id>` not found.``, the same response as for any unknown workspace.
325A header value that isn’t a valid workspace ID returns a 400 `invalid_request_error` with the message `anthropic-workspace-id header must be a valid workspace ID.` If the workspace doesn’t exist, or the key’s user or service account doesn’t have access to it, the API returns a 404 `not_found_error` with the message ``Workspace `<id>` not found.``, the same response as for any unknown workspace.
326326
327327Workload Identity Federation selects a workspace at token exchange instead; see the [WIF reference](https://platform.claude.com/docs/en/manage-claude/wif-reference) for details.
328328
from line 330
330330
331331When you create an API key from the [API keys](https://platform.claude.com/settings/keys) page in the Claude Console, you choose an expiration: a preset (3 hours, 1 day, 7 days, or 30 days), a custom duration, or **Never** for keys you store in a secrets manager and rotate yourself. If your organization has a maximum expiration policy, the Console limits presets and custom durations to the policy maximum, and **Never** is unavailable. Existing keys keep their current behavior; expiration is set at creation time and cannot be changed afterward. The same expiration choice applies when you [create an Admin API key](https://platform.claude.com/docs/en/manage-claude/admin-api-keys) in the Claude Console.
332332
333Anthropic emails the key's creator as the expiration approaches: 7 days before expiration for keys created with a lifetime of at least 14 days, and 1 day before for keys with a lifetime of at least 7 days. Keys with shorter lifetimes expire without a warning email.
333Anthropic emails the key’s creator as the expiration approaches: 7 days before expiration for keys created with a lifetime of at least 14 days, and 1 day before for keys with a lifetime of at least 7 days. Keys with shorter lifetimes expire without a warning email.
334334
335335After a key expires, requests made with it return a `401 authentication_error`. Create a new key to restore access; expired keys cannot be reactivated.
336336
337The Console API keys table shows each key's expiration, and the Admin API reports each key's `expires_at` timestamp on the [List API Keys](https://platform.claude.com/docs/en/api/organization/api_keys/list) and [Retrieve API Key](https://platform.claude.com/docs/en/api/organization/api_keys/retrieve) endpoints, so you can audit and rotate keys before they expire. The field is `null` for keys without an expiration.
337The Console API keys table shows each key’s expiration, and the Admin API reports each key’s `expires_at` timestamp on the [List API Keys](https://platform.claude.com/docs/en/api/organization/api_keys/list) and [Retrieve API Key](https://platform.claude.com/docs/en/api/organization/api_keys/retrieve) endpoints, so you can audit and rotate keys before they expire. The field is `null` for keys without an expiration.
338338
339339Expiration limits the lifetime of a leaked credential, but it is not a substitute for secret hygiene. Regardless of expiration, store keys in a secrets manager and disable or delete any key you suspect has leaked.
340340
from line 348
348348
3493491. **Decide the key type.** Your own tooling should use a personal key. A shared or unattended workload should use a service account key.
3503502. **Create a service account** if necessary. You might have to ask an organization admin to create one on the [Service accounts](https://platform.claude.com/settings/service-accounts) page (`platform.claude.com/settings/service-accounts`) in the Claude Console and add it to the relevant workspace.
3513. **Create the new key.** Create it specifically for the integration's workspace unless the integration needs multiple workspaces.
3524. **Deploy the new key.** Replace the old key wherever the integration reads it, typically the `ANTHROPIC_API_KEY` environment variable or a secrets manager entry. For a key that isn't scoped to a workspace, also send the `anthropic-workspace-id` header as shown in [Select a workspace](https://platform.claude.com/docs/en/manage-claude/authentication#select-a-workspace).
3513. **Create the new key.** Create it specifically for the integration’s workspace unless the integration needs multiple workspaces.
3524. **Deploy the new key.** Replace the old key wherever the integration reads it, typically the `ANTHROPIC_API_KEY` environment variable or a secrets manager entry. For a key that isn’t scoped to a workspace, also send the `anthropic-workspace-id` header as shown in [Select a workspace](https://platform.claude.com/docs/en/manage-claude/authentication#select-a-workspace).
3533535. **Delete the old key.** Confirm that requests succeed, then delete the workspace key on the [API keys page](https://platform.claude.com/settings/keys) in the Claude Console.
354354
355355## Workload Identity Federation
from line 356
356356
357357Workload Identity Federation (WIF) lets a workload authenticate with a short-lived identity token issued by an identity provider (IdP) you already trust. Such IdPs include AWS IAM, Google Cloud, and any standards-compliant OIDC issuer (such as GitHub Actions, Kubernetes service accounts, SPIFFE, Microsoft Entra ID, or Okta). The workload exchanges its IdP-issued JWT at `POST /v1/oauth/token` for a short-lived Claude API access token, and the SDK refreshes that token automatically before it expires. There is no `sk-ant-api...` string to mint, distribute, or rotate.
358358
359Federation removes long-lived Claude API keys from your environment, which limits the damage that a leaked credential can cause and lets you manage access with the same IdP controls you already use for cloud resources. It does not, on its own, guarantee end-to-end security: the trust chain is only as strong as your identity provider's configuration, and a long-lived secret one step earlier in that chain (for example, a static cloud credential that can mint IdP tokens) can still undermine it. Pair federation with your provider's controls, such as IP allowlists, MFA, and audit logging.
359Federation removes long-lived Claude API keys from your environment, which limits the damage that a leaked credential can cause and lets you manage access with the same IdP controls you already use for cloud resources. It does not, on its own, guarantee end-to-end security: the trust chain is only as strong as your identity provider’s configuration, and a long-lived secret one step earlier in that chain (for example, a static cloud credential that can mint IdP tokens) can still undermine it. Pair federation with your provider’s controls, such as IP allowlists, MFA, and audit logging.
360360
361361To configure federation, you create three resources in the Claude Console (a service account, a federation issuer, and a federation rule) and then point your SDK at the rule. See [Workload Identity Federation](https://platform.claude.com/docs/en/manage-claude/workload-identity-federation) for the full setup walkthrough.
362362
363363## App Attest
364364
365App Attest authenticates iOS and macOS apps that call the Claude API directly from the device. Each installation proves that it is a genuine, unmodified build of an app you registered in the Claude Console, using Apple's App Attest service. Anthropic then issues the device a short-lived access token that bills usage to your workspace. Tokens are scoped to your workspace, expire after 1 hour, and authorize only [Messages API](https://platform.claude.com/docs/en/api/messages/create) calls.
365App Attest authenticates iOS and macOS apps that call the Claude API directly from the device. Each installation proves that it is a genuine, unmodified build of an app you registered in the Claude Console, using Apple’s App Attest service. Anthropic then issues the device a short-lived access token that bills usage to your workspace. Tokens are scoped to your workspace, expire after 1 hour, and authorize only [Messages API](https://platform.claude.com/docs/en/api/messages/create) calls.
366366
367367To register your app and get a client ID, see [App Attest for iOS and macOS apps](https://platform.claude.com/docs/en/manage-claude/app-attest).
368368
manage-claude/claude-code-analytics-api Changed · +12 / -12 lines
### What’s the data retention period? ### What's the data retention period?
from line 19
1919* **Usage justification:** Provide metrics to justify and expand Claude Code adoption internally
2020
2121<Check>
22 **Admin API credentials required.** These endpoints are part of the Admin API. You can access them using an [Admin API key](https://platform.claude.com/docs/en/manage-claude/admin-api-keys), an OAuth token with the `org:admin` scope, or a personal or service account key that isn't scoped to a workspace; workspace API keys don't work. See [Authentication](https://platform.claude.com/docs/en/manage-claude/admin-api#authentication) for details.
22 **Admin API credentials required.** These endpoints are part of the Admin API. You can access them using an [Admin API key](https://platform.claude.com/docs/en/manage-claude/admin-api-keys), an OAuth token with the `org:admin` scope, or a personal or service account key that isn’t scoped to a workspace; workspace API keys don’t work. See [Authentication](https://platform.claude.com/docs/en/manage-claude/admin-api#authentication) for details.
2323</Check>
2424
2525<Note>
from line 32
3232
3333## Quick start
3434
35Get your organization's Claude Code analytics for a specific day:
35Get your organization’s Claude Code analytics for a specific day:
3636
3737```bash cURL
3838curl "https://api.anthropic.com/v1/organizations/usage_report/claude_code?\
from line 45
4545<Tip>
4646 **Set a User-Agent header for integrations**
4747
48 If you're building an integration, set your User-Agent header to help Anthropic understand usage patterns:
48 If you’re building an integration, set your User-Agent header to help Anthropic understand usage patterns:
4949
5050 ```text wrap
5151 User-Agent: YourApp/1.0.0 (https://yourapp.com)
from line 59
5959### Key concepts
6060
6161* **Daily aggregation:** Returns metrics for a single day specified by the `starting_at` parameter
62* **User-level data:** Each record represents one user's activity for the specified day
62* **User-level data:** Each record represents one user’s activity for the specified day
6363* **Productivity metrics:** Track sessions, lines of code, commits, pull requests, and tool usage
6464* **Token and cost data:** Monitor usage and estimated costs broken down by Claude model
6565* **Cursor-based pagination:** Handle large datasets with stable pagination using opaque cursors
from line 102
102102| ------------- | ------- | -------- | ----------------------------------------------------------------------- |
103103| `starting_at` | string | Yes | UTC date in YYYY-MM-DD format; returns metrics for this single day only |
104104| `limit` | integer | No | Number of records per page (default: 20, max: 1000) |
105| `page` | string | No | Opaque cursor token from previous response's `next_page` field |
105| `page` | string | No | Opaque cursor token from previous response’s `next_page` field |
106106
107107### Available metrics
108108
from line 121
121121* **num\_sessions:** Number of distinct Claude Code sessions initiated by this actor
122122* **lines\_of\_code.added:** Total number of lines of code added across all files by Claude Code
123123* **lines\_of\_code.removed:** Total number of lines of code removed across all files by Claude Code
124* **commits\_by\_claude\_code:** Number of git commits created through Claude Code's commit functionality
125* **pull\_requests\_by\_claude\_code:** Number of pull requests created through Claude Code's PR functionality
124* **commits\_by\_claude\_code:** Number of git commits created through Claude Code’s commit functionality
125* **pull\_requests\_by\_claude\_code:** Number of pull requests created through Claude Code’s PR functionality
126126
127127#### Tool action metrics
128128
from line 216
2162162. If `has_more` is `true` in the response, use the `next_page` value in your next request.
2172173. Continue until `has_more` is `false`.
218218
219The cursor encodes the position of the last record and ensures stable pagination even as new data arrives. Each pagination session maintains a consistent data boundary to ensure you don't miss or duplicate records.
219The cursor encodes the position of the last record and ensures stable pagination even as new data arrives. Each pagination session maintains a consistent data boundary to ensure you don’t miss or duplicate records.
220220
221221## Common use cases
222222
from line 248
248248
249249### Does this API include usage from Claude subscription plans?
250250
251No. When someone signs in to Claude Code with a Claude subscription plan, such as Pro, Max, Team, or Enterprise, their usage is attributed to their claude.ai organization, and this API doesn't return it.
251No. When someone signs in to Claude Code with a Claude subscription plan, such as Pro, Max, Team, or Enterprise, their usage is attributed to their claude.ai organization, and this API doesn’t return it.
252252
253253To track that usage, use one of these options:
254254
255* **Claude Enterprise Analytics API:** Reports Claude Code activity for Claude Enterprise organizations and isn't available on other plans. See [Analytics APIs](https://platform.claude.com/docs/en/manage-claude/analytics-api).
255* **Claude Enterprise Analytics API:** Reports Claude Code activity for Claude Enterprise organizations and isn’t available on other plans. See [Analytics APIs](https://platform.claude.com/docs/en/manage-claude/analytics-api).
256256* **Analytics dashboard in claude.ai:** Available on Team and Enterprise plans. See [Track team usage with analytics](https://code.claude.com/docs/en/analytics).
257257* **OpenTelemetry export:** Works on any plan. See [Monitoring usage with OpenTelemetry](https://code.claude.com/docs/en/monitoring-usage).
258258
259### What's the data retention period?
259### What’s the data retention period?
260260
261261Historical Claude Code analytics data is retained and accessible through the API. There is no specified deletion period for this data.
262262
from line 278
278278
279279## See also
280280
281The Claude Code Analytics API helps you understand and optimize your team's development workflow. Learn more about related features:
281The Claude Code Analytics API helps you understand and optimize your team’s development workflow. Learn more about related features:
282282
283283* [Admin API](https://platform.claude.com/docs/en/manage-claude/admin-api)
284284* [Admin API reference](https://platform.claude.com/docs/en/api/beta/organization)
manage-claude/claude-tag-api Changed · +64 / -64 lines
### List a Bundle’s targets ### List a Bundle's targets
from line 28
2828| --------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
2929| **Slack channels:** set a channel up, list the channels of a workspace or find one by its Slack IDs, read one, change its settings, remove it | `POST /v1/organizations/claude_tag/slack_channels`<br />`GET /v1/organizations/claude_tag/slack_channels`<br />`GET /v1/organizations/claude_tag/slack_channels/{id}`<br />`POST /v1/organizations/claude_tag/slack_channels/{id}`<br />`DELETE /v1/organizations/claude_tag/slack_channels/{id}` |
3030| **Slack workspaces:** list your workspaces or find one by its Slack ID, read one, change its settings | `GET /v1/organizations/claude_tag/slack_workspaces`<br />`GET /v1/organizations/claude_tag/slack_workspaces/{id}`<br />`POST /v1/organizations/claude_tag/slack_workspaces/{id}` |
31| **Bundles:** list your organization's Access bundles, read one (read-only) | `GET /v1/organizations/claude_tag/bundles`<br />`GET /v1/organizations/claude_tag/bundles/{bundle_id}` |
31| **Bundles:** list your organization’s Access bundles, read one (read-only) | `GET /v1/organizations/claude_tag/bundles`<br />`GET /v1/organizations/claude_tag/bundles/{bundle_id}` |
3232| **Bundle targets:** list where a Bundle is attached, attach it to a channel or workspace, read one attachment, detach it | `GET /v1/organizations/claude_tag/bundles/{bundle_id}/targets`<br />`POST /v1/organizations/claude_tag/bundles/{bundle_id}/targets`<br />`GET /v1/organizations/claude_tag/bundles/{bundle_id}/targets/{target_id}`<br />`DELETE /v1/organizations/claude_tag/bundles/{bundle_id}/targets/{target_id}` |
3333
34This release covers Slack. Connecting and disconnecting a Slack workspace or Enterprise Grid, your organization's Slack defaults, creating and editing Access bundles, spend limits, and every Claude Tag setting other than the five in [Settings](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#settings) stay in claude.ai.
34This release covers Slack. Connecting and disconnecting a Slack workspace or Enterprise Grid, your organization’s Slack defaults, creating and editing Access bundles, spend limits, and every Claude Tag setting other than the five in [Settings](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#settings) stay in claude.ai.
3535
3636## Prerequisites
3737
from line 45
4545
4646## Quick start
4747
48List your organization's Slack workspaces in Claude Tag:
48List your organization’s Slack workspaces in Claude Tag:
4949
5050<CodeGroup>
5151 ```bash cURL
from line 194
194194
195195| This API | claude.ai and Slack |
196196| ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
197| Slack workspace | A Slack workspace. Slack's own API calls it a team, so Slack's own workspace ID on this page is the team ID there. It is unrelated to a Claude Platform workspace, whose IDs start with `wrkspc_`. |
197| Slack workspace | A Slack workspace. Slack’s own API calls it a team, so Slack’s own workspace ID on this page is the team ID there. It is unrelated to a Claude Platform workspace, whose IDs start with `wrkspc_`. |
198198| Slack defaults | **Default Slack access**: the settings that apply to every workspace and channel. An organization owner changes them in claude.ai; this API shows where a channel or workspace inherits from them. |
199199| Settings level | A [scope](https://claude.com/docs/claude-tag/admins/customize): a channel, a workspace, or the Slack defaults |
200200| Bundle | An Access bundle ([Claude Tag glossary](https://claude.com/docs/claude-tag/concepts/glossary#access-bundle)) |
from line 206
206206
207207### Set-up channels and workspaces
208208
209A channel or workspace is **set up** when Claude Tag holds a settings record for it. Only a set-up channel or workspace has an `id`, and only those are listed: Slack, not this API, holds the full list of a workspace's channels.
209A channel or workspace is **set up** when Claude Tag holds a settings record for it. Only a set-up channel or workspace has an `id`, and only those are listed: Slack, not this API, holds the full list of a workspace’s channels.
210210
211* A **workspace** is set up when an organization owner connects it in claude.ai. When an owner connects a Slack Enterprise Grid, the Grid's workspaces are set up shortly afterward. Claude's first use in a workspace, or the first channel you [set up](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#set-up-a-channel) in it, sets up any that was not. No other endpoint sets up a workspace, and none removes one.
212* A **channel** is set up in claude.ai, by Claude's first use in it, or with [Set up a channel](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#set-up-a-channel).
211* A **workspace** is set up when an organization owner connects it in claude.ai. When an owner connects a Slack Enterprise Grid, the Grid’s workspaces are set up shortly afterward. Claude’s first use in a workspace, or the first channel you [set up](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#set-up-a-channel) in it, sets up any that was not. No other endpoint sets up a workspace, and none removes one.
212* A **channel** is set up in claude.ai, by Claude’s first use in it, or with [Set up a channel](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#set-up-a-channel).
213213
214Your organization owns a workspace while its connection to that workspace is active, and owns the channels in it. A Slack Enterprise Grid groups several workspaces under one company. While your organization's connection to a Grid is active, it also owns every workspace in the Grid that no other organization has connected. Such a workspace is a workspace like any other: once it is set up, it has an `id`, is listed, and can be read, changed, and given Bundles, and its channels can be listed. The Grid itself is not a resource of this API and has no `id`. A channel or workspace you do not own returns the same `404` as one that does not exist.
214Your organization owns a workspace while its connection to that workspace is active, and owns the channels in it. A Slack Enterprise Grid groups several workspaces under one company. While your organization’s connection to a Grid is active, it also owns every workspace in the Grid that no other organization has connected. Such a workspace is a workspace like any other: once it is set up, it has an `id`, is listed, and can be read, changed, and given Bundles, and its channels can be listed. The Grid itself is not a resource of this API and has no `id`. A channel or workspace you do not own returns the same `404` as one that does not exist.
215215
216A workspace your organization owns only through a Grid returns that `404` until it is set up, wherever a request names it by Slack's own ID: when you find the workspace, list its channels, or look up a channel in it that is not set up. You can still [set up a channel](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#set-up-a-channel) in it, which also sets the workspace up, with no settings stored.
216A workspace your organization owns only through a Grid returns that `404` until it is set up, wherever a request names it by Slack’s own ID: when you find the workspace, list its channels, or look up a channel in it that is not set up. You can still [set up a channel](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#set-up-a-channel) in it, which also sets the workspace up, with no settings stored.
217217
218A channel that is shared with a whole Grid can be stored under the Grid's own Slack ID, which starts with `E`, in place of a workspace's. That ID is then the channel's `slack.workspace_id`, and [listing channels](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#list-channels) with it as `slack_workspace_id` returns those channels. No workspace object has it: if an owner stored settings on the Grid itself in claude.ai, `sources` can name them as a `slack_workspace` whose `id` returns `404` when you read it.
218A channel that is shared with a whole Grid can be stored under the Grid’s own Slack ID, which starts with `E`, in place of a workspace’s. That ID is then the channel’s `slack.workspace_id`, and [listing channels](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#list-channels) with it as `slack_workspace_id` returns those channels. No workspace object has it: if an owner stored settings on the Grid itself in claude.ai, `sources` can name them as a `slack_workspace` whose `id` returns `404` when you read it.
219219
220220### IDs
221221
from line 227
227227| Slack workspace resource | `slws_` | `id` on a workspace; `slack_workspace_id` in request bodies and responses |
228228| Bundle | `capp_` | `id` on a Bundle; `{bundle_id}` in paths |
229229| Bundle target | `btgt_` | `id` on a Bundle target; `{target_id}` in paths |
230| Slack's own workspace ID | `T`, or `E` for a Grid's own ID (see [Set-up channels and workspaces](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#set-up-channels-and-workspaces)) | `slack.workspace_id`; the `slack_workspace_id` query parameter |
231| Slack's own channel ID | `C` or `G` | `slack.channel_id`; the `slack_channel_id` query parameter |
230| Slack’s own workspace ID | `T`, or `E` for a Grid’s own ID (see [Set-up channels and workspaces](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#set-up-channels-and-workspaces)) | `slack.workspace_id`; the `slack_workspace_id` query parameter |
231| Slack’s own channel ID | `C` or `G` | `slack.channel_id`; the `slack_channel_id` query parameter |
232232
233233<Warning>
234 `slack_channel_id` and `slack_workspace_id` each mean two things. In a **query parameter** each is Slack's own ID (`C05HJKL6MNP`, `T01ABCD2EFG`). In a **request body or a response** each is the `id` this API issues (`slch_...`, `slws_...`). Slack's own IDs in a body or a response are always under `slack`.
234 `slack_channel_id` and `slack_workspace_id` each mean two things. In a **query parameter** each is Slack’s own ID (`C05HJKL6MNP`, `T01ABCD2EFG`). In a **request body or a response** each is the `id` this API issues (`slch_...`, `slws_...`). Slack’s own IDs in a body or a response are always under `slack`.
235235</Warning>
236236
237237A Slack channel ID in a query parameter or a request body that does not start with `C` or `G` returns `400`, and so does any Slack ID that has anything but capital letters and digits after its first letter or is longer than 32 characters.
from line 252
252252
253253`model` and `environment_id` are checked when you write them and not again: if the model or environment later changes, responses keep returning the stored value.
254254
255If an organization owner has put a settings level on a self-hosted runner pool in claude.ai, its `environment_id` returns the pool's ID, which starts with `ccpool_`. This API cannot set a runner pool, and returns `400` for a request that changes or clears `environment_id` on a settings level that stores one.
255If an organization owner has put a settings level on a self-hosted runner pool in claude.ai, its `environment_id` returns the pool’s ID, which starts with `ccpool_`. This API cannot set a runner pool, and returns `400` for a request that changes or clears `environment_id` on a settings level that stores one.
256256
257257### Stored and inherited values
258258
259Settings exist at three levels: the channel, the workspace the channel is in, and your organization's Slack defaults, which an organization owner sets in claude.ai. Each level stores only what was set on it. The `settings` of a channel or workspace object can hold either of two things:
259Settings exist at three levels: the channel, the workspace the channel is in, and your organization’s Slack defaults, which an organization owner sets in claude.ai. Each level stores only what was set on it. The `settings` of a channel or workspace object can hold either of two things:
260260
261261* **What it stores.** This is what a response holds unless you ask otherwise. A setting that is not set on the channel or workspace is `null`. Use it to compare against configuration you keep elsewhere.
262262* **What applies in it**, once every level is taken into account. To get this, add the query parameter `include_inherited=true` to any `GET` request that returns a channel or a workspace, the two lists included. Use it to audit, or to find out why Claude behaves as it does in one channel. The parameter defaults to `false`, and a value that is not a Boolean returns `400`. A request that sets a channel up or changes settings does not take the parameter and returns `400` if you send it; its response holds what is stored.
from line 269
269269| ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------- |
270270| `enabled` | The nearest level that sets it determines the value, so `true` on a channel turns Claude on there even when its workspace stores `false`. | `true` |
271271| `instructions` | Additive. The text of every level that sets it is joined, broadest first, with a blank line between. | `null` |
272| `model` | The nearest level that sets it determines the value. | `null`: Claude uses the product's default model |
272| `model` | The nearest level that sets it determines the value. | `null`: Claude uses the product’s default model |
273273| `environment_id` | The nearest level that sets it determines the value. | `null` |
274274| `guest_policy` | The nearest level that sets it determines the value. | `restrict` |
275275
from line 317
317317| `slack_channel` | The channel, named in `slack_channel_id`. |
318318| `slack_workspace` | The workspace, named in `slack_workspace_id`. |
319319| `slack_parent_channel` | The parent of a code channel, named in `slack_channel_id`. A code channel is one that was started from another channel. While the parent is a public channel in the same workspace, it sits between the channel and the workspace and contributes `instructions` and `environment_id` only. |
320| `slack_grid_channel` | The same Slack channel as set up under another workspace of its Slack Enterprise Grid, named by Slack's own IDs under `slack`. It contributes `enabled` only: when neither the channel nor its workspace sets `enabled`, a `true` stored for the channel under another workspace of the Grid applies. |
321| `slack_default` | Your organization's Slack defaults, which have no ID. |
320| `slack_grid_channel` | The same Slack channel as set up under another workspace of its Slack Enterprise Grid, named by Slack’s own IDs under `slack`. It contributes `enabled` only: when neither the channel nor its workspace sets `enabled`, a `true` stored for the channel under another workspace of the Grid applies. |
321| `slack_default` | Your organization’s Slack defaults, which have no ID. |
322322| `default` | No level sets a value, so the built-in default applies. |
323323
324`sources.instructions` lists every level that contributes text, broadest first, which is the order of their text in `settings.instructions`, and is empty when none does. It says whose text comes first, not where one level's text ends: to get one level's own text, read that channel or workspace without `include_inherited`, or, for the Slack defaults, look in claude.ai. A source that names a channel or workspace always carries its ID, which is never `null`: an `id` of this API in `slack_channel_id` or `slack_workspace_id`, or, on `slack_grid_channel`, Slack's own IDs under `slack` as on a channel object.
324`sources.instructions` lists every level that contributes text, broadest first, which is the order of their text in `settings.instructions`, and is empty when none does. It says whose text comes first, not where one level’s text ends: to get one level’s own text, read that channel or workspace without `include_inherited`, or, for the Slack defaults, look in claude.ai. A source that names a channel or workspace always carries its ID, which is never `null`: an `id` of this API in `slack_channel_id` or `slack_workspace_id`, or, on `slack_grid_channel`, Slack’s own IDs under `slack` as on a channel object.
325325
326326With `include_inherited=true`, a request fails with `503` if a level cannot be read, rather than answer without it.
327327
from line 339
339339
340340### Read-only mode
341341
342**API / Terraform read-only mode** is a setting that an organization owner turns on and off in claude.ai's Claude Tag settings. The name describes claude.ai and Slack: while the mode is on, they refuse a person's changes to what this API manages, so only keys make those changes. They also refuse a few related changes that no key makes, such as changing a setting on the Slack defaults, so nobody makes those until an owner turns the mode off. It does not make this API read-only. Every endpoint on this page answers the same whether the mode is on or off, and no endpoint reads or changes it.
342**API / Terraform read-only mode** is a setting that an organization owner turns on and off in claude.ai’s Claude Tag settings. The name describes claude.ai and Slack: while the mode is on, they refuse a person’s changes to what this API manages, so only keys make those changes. They also refuse a few related changes that no key makes, such as changing a setting on the Slack defaults, so nobody makes those until an owner turns the mode off. It does not make this API read-only. Every endpoint on this page answers the same whether the mode is on or off, and no endpoint reads or changes it.
343343
344344While the mode is off, people and keys change the same settings and attach and detach the same Bundles, and each change replaces what is stored. Turn it on if your pipeline should be the only source of changes.
345345
from line 349
349349* Setting a channel up, removing a channel, adding a workspace of a connected Enterprise Grid, or disconnecting a workspace or a Grid in claude.ai
350350* Attaching a Bundle to a channel or workspace, detaching one, or deleting a Bundle that is attached to one
351351
352Some things stay possible either way: an owner can still connect a new workspace or Grid, create and edit Bundles, and change Claude Tag settings this API does not manage. Claude's first use still sets up a channel, or a Grid workspace that was not set up, deleting a channel in Slack still removes it, and uninstalling Claude's Slack app still disconnects that workspace or Grid.
352Some things stay possible either way: an owner can still connect a new workspace or Grid, create and edit Bundles, and change Claude Tag settings this API does not manage. Claude’s first use still sets up a channel, or a Grid workspace that was not set up, deleting a channel in Slack still removes it, and uninstalling Claude’s Slack app still disconnects that workspace or Grid.
353353
354While the mode is off, setting up in claude.ai a channel that is already set up can replace the channel's record, but only a channel that holds nothing yet: one that Claude's first use set up, or that this API set up with no `settings`, and on which nobody has since stored a setting or attached a Bundle. The channel then has a new `id`, and the old one returns `404`. Any other channel keeps its `id` until it is removed.
354While the mode is off, setting up in claude.ai a channel that is already set up can replace the channel’s record, but only a channel that holds nothing yet: one that Claude’s first use set up, or that this API set up with no `settings`, and on which nobody has since stored a setting or attached a Bundle. The channel then has a new `id`, and the old one returns `404`. Any other channel keeps its `id` until it is removed.
355355
356356### Group direct messages
357357
358A Slack group direct message has an ID in a channel's form, so Claude's use in one sets it up like a channel: it has an `id`, is listed, and can be read. Setting one up through this API, changing a setting on one, attaching a Bundle to one, and removing one each return `400`, except that a setup request that omits `settings` for one that is already set up returns it with `200`, as a read does. Detaching a Bundle from one is allowed.
358A Slack group direct message has an ID in a channel’s form, so Claude’s use in one sets it up like a channel: it has an `id`, is listed, and can be read. Setting one up through this API, changing a setting on one, attaching a Bundle to one, and removing one each return `400`, except that a setup request that omits `settings` for one that is already set up returns it with `200`, as a read does. Detaching a Bundle from one is allowed.
359359
360360## Example workflows
361361
from line 363
363363
364364Any member can invite Claude to a public channel. To keep Claude on only where you have approved it:
365365
3661. Ask an organization owner to turn Claude off everywhere in claude.ai, with the **Enable Claude Tag in Slack** toggle under **Default Slack access**, which stores `enabled` as `false` on your organization's Slack defaults. [Read-only mode](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#read-only-mode) must be off while they do.
3672. When your approval system approves a channel, [set the channel up](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#set-up-a-channel) with `"settings": {"enabled": true}`. The request takes Slack's own IDs and returns the channel even if it was already set up, so it is safe to repeat.
3683. In the same run, [attach](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#attach-a-bundle) the Bundles the team was approved for, so the channel's first session already has its tools.
3661. Ask an organization owner to turn Claude off everywhere in claude.ai, with the **Enable Claude Tag in Slack** toggle under **Default Slack access**, which stores `enabled` as `false` on your organization’s Slack defaults. [Read-only mode](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#read-only-mode) must be off while they do.
3672. When your approval system approves a channel, [set the channel up](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#set-up-a-channel) with `"settings": {"enabled": true}`. The request takes Slack’s own IDs and returns the channel even if it was already set up, so it is safe to repeat.
3683. In the same run, [attach](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#attach-a-bundle) the Bundles the team was approved for, so the channel’s first session already has its tools.
369369
370370### Keep configuration in version control
371371
from line 376
376376
377377### Audit what applies everywhere
378378
3791. [List your workspaces](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#list-workspaces), then [list each workspace's channels](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#list-channels), both with `include_inherited=true` so that each item holds what applies in it. If your organization connected an Enterprise Grid, also list the channels stored under the Grid's own Slack ID. See [Set-up channels and workspaces](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#set-up-channels-and-workspaces).
3791. [List your workspaces](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#list-workspaces), then [list each workspace’s channels](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#list-channels), both with `include_inherited=true` so that each item holds what applies in it. If your organization connected an Enterprise Grid, also list the channels stored under the Grid’s own Slack ID. See [Set-up channels and workspaces](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#set-up-channels-and-workspaces).
3803802. Flag what your policy forbids, such as a channel where `enabled` is `true` without an approval on file, or where `guest_policy` is `allow`.
3813. [List your Bundles](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#list-bundles), then [each Bundle's targets](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#list-a-bundles-targets), to see where access to sensitive systems is attached.
3813. [List your Bundles](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#list-bundles), then [each Bundle’s targets](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#list-a-bundles-targets), to see where access to sensitive systems is attached.
382382
383383## Slack channels
384384
from line 388
388388| ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
389389| `type` | `slack_channel`. |
390390| `id` | Prefixed `slch_`. See [IDs](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#ids). |
391| `slack` | Slack's own IDs: `workspace_id` for the workspace the channel is in, and `channel_id` for the channel. |
391| `slack` | Slack’s own IDs: `workspace_id` for the workspace the channel is in, and `channel_id` for the channel. |
392392| `settings` | What the channel itself stores, or, with `include_inherited=true`, what applies in it. Always present, with all five [settings](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#settings); one that is not set is `null`. See [Stored and inherited values](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#stored-and-inherited-values). |
393393| `sources` | For each setting, the level that the value in `settings` comes from. Always present. |
394394| `created_at` | When the channel was set up. |
395| `updated_at` | When Claude Tag's record of the channel last changed. It moves on every change to a setting, here, in claude.ai, or in Slack, and can also move for a change that no response here shows. Treat a later value as a reason to read the channel again, not as proof that a setting changed. Attaching or detaching a Bundle does not by itself move it. |
395| `updated_at` | When Claude Tag’s record of the channel last changed. It moves on every change to a setting, here, in claude.ai, or in Slack, and can also move for a change that no response here shows. Treat a later value as a reason to read the channel again, not as proof that a setting changed. Attaching or detaching a Bundle does not by itself move it. |
396396
397397An `id` that is not a valid `slch_` identifier returns `400`. A valid one that names no channel of your organization returns `404`.
398398
399399### Set up a channel
400400
401`POST /v1/organizations/claude_tag/slack_channels` sets a Slack channel up and returns it. `slack.workspace_id` and `slack.channel_id` are required and are Slack's own IDs. `settings` is optional and follows [Changing settings](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#changing-settings). If the channel is already set up, the request returns the existing channel and applies `settings`; the response is `200` in both cases. Requires the `write:claude_tag` scope.
401`POST /v1/organizations/claude_tag/slack_channels` sets a Slack channel up and returns it. `slack.workspace_id` and `slack.channel_id` are required and are Slack’s own IDs. `settings` is optional and follows [Changing settings](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#changing-settings). If the channel is already set up, the request returns the existing channel and applies `settings`; the response is `200` in both cases. Requires the `write:claude_tag` scope.
402402
403403<CodeGroup>
404404 ```bash cURL
from line 555
555555}
556556```
557557
558Before a channel is set up, Claude's Slack app confirms with Slack that the channel is in the workspace, is not archived, and is visible to the app. A channel that fails that check returns `404`, as does a workspace that does not have Claude's Slack app installed. For a workspace your organization owns through an Enterprise Grid, the app must be installed on the Grid.
558Before a channel is set up, Claude’s Slack app confirms with Slack that the channel is in the workspace, is not archived, and is visible to the app. A channel that fails that check returns `404`, as does a workspace that does not have Claude’s Slack app installed. For a workspace your organization owns through an Enterprise Grid, the app must be installed on the Grid.
559559
560Setting the channel up and applying `settings` are two steps. When this request sets the channel up and `settings` is then refused with a `400`, `404`, or `409`, the response is the refusal and the channel stays set up with nothing stored (after a `409`, unless the overlapping change removed or replaced it). That refusal carries an `error_code` that starts with `slack_channel_set_up_` and the new channel's `id` in `error.details.slack_channel_id` (see [Error responses](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#error-responses)). Correct `settings` and send it in an [update](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#update-a-channel) to that `id`, or send the setup request again. If the channel was already set up, a refused `settings` returns the same error as an [update](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#update-a-channel) would, and the channel keeps what it stored. A `500` or `503` in either case carries no `error_code` and does not say whether the channel was set up or `settings` stored: send the setup request again.
560Setting the channel up and applying `settings` are two steps. When this request sets the channel up and `settings` is then refused with a `400`, `404`, or `409`, the response is the refusal and the channel stays set up with nothing stored (after a `409`, unless the overlapping change removed or replaced it). That refusal carries an `error_code` that starts with `slack_channel_set_up_` and the new channel’s `id` in `error.details.slack_channel_id` (see [Error responses](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#error-responses)). Correct `settings` and send it in an [update](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#update-a-channel) to that `id`, or send the setup request again. If the channel was already set up, a refused `settings` returns the same error as an [update](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#update-a-channel) would, and the channel keeps what it stored. A `500` or `503` in either case carries no `error_code` and does not say whether the channel was set up or `settings` stored: send the setup request again.
561561
562562### List channels
563563
564`GET /v1/organizations/claude_tag/slack_channels` lists the set-up channels of one workspace, newest first by `created_at`. `slack_workspace_id` is required and is Slack's own ID for the workspace. Add `include_inherited=true` to have each channel hold what applies in it (see [Stored and inherited values](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#stored-and-inherited-values)). A page can hold fewer than `limit` channels, or none, while `next_page` is still set, so keep requesting pages until `next_page` is `null` (see [Pagination](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#pagination)). Requires the `read:claude_tag` scope.
564`GET /v1/organizations/claude_tag/slack_channels` lists the set-up channels of one workspace, newest first by `created_at`. `slack_workspace_id` is required and is Slack’s own ID for the workspace. Add `include_inherited=true` to have each channel hold what applies in it (see [Stored and inherited values](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#stored-and-inherited-values)). A page can hold fewer than `limit` channels, or none, while `next_page` is still set, so keep requesting pages until `next_page` is `null` (see [Pagination](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#pagination)). Requires the `read:claude_tag` scope.
565565
566566<CodeGroup>
567567 ```bash cURL
from line 676
676676
677677### Find a channel by its Slack IDs
678678
679Add `slack_channel_id`, Slack's own ID for the channel, to look one channel up. `data` holds that channel, or is empty when the channel is not set up. In a workspace that is not set up and that your organization owns only through an Enterprise Grid, a channel that is not set up returns `404` instead. A lookup does not page: it ignores `page` and any `limit` from 1 to 100 (a `limit` outside that range still returns `400`), and its `next_page` is `null`. This is how you find a channel's `id`.
679Add `slack_channel_id`, Slack’s own ID for the channel, to look one channel up. `data` holds that channel, or is empty when the channel is not set up. In a workspace that is not set up and that your organization owns only through an Enterprise Grid, a channel that is not set up returns `404` instead. A lookup does not page: it ignores `page` and any `limit` from 1 to 100 (a `limit` outside that range still returns `400`), and its `next_page` is `null`. This is how you find a channel’s `id`.
680680
681681<CodeGroup>
682682 ```bash cURL
from line 994
994994
995995### Update a channel
996996
997`POST /v1/organizations/claude_tag/slack_channels/{id}` changes the channel's settings and returns the channel object. `settings` is required and follows [Changing settings](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#changing-settings). Requires the `write:claude_tag` scope.
997`POST /v1/organizations/claude_tag/slack_channels/{id}` changes the channel’s settings and returns the channel object. `settings` is required and follows [Changing settings](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#changing-settings). Requires the `write:claude_tag` scope.
998998
999999Turn Claude off in one channel and leave its other settings as they are:
10001000
from line 1109
11091109 ```
11101110</CodeGroup>
11111111
1112Clear the channel's instructions, so that only the inherited ones apply:
1112Clear the channel’s instructions, so that only the inherited ones apply:
11131113
11141114<CodeGroup>
11151115 ```bash cURL
from line 1241
12411241
12421242**A channel can be removed only while Claude is off in it.** While `enabled` resolves to `true` for the channel, as [Read what applies in a channel](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#read-what-applies-in-a-channel) returns it, the request returns `400` with `error_code: "slack_channel_enabled"`. Set `enabled` to `false` on the channel first, then send the request again. The one exception is an organization with a [restricted compliance configuration](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#error-responses): it cannot make that change, so its request removes the channel whether or not Claude is on in it. If a level that this check needs cannot be read, the request returns `503` and removes nothing.
12431243
1244The check guards against mistakenly removing a channel that is in use. It does not keep Claude out of the channel afterward. Removal deletes the channel's own settings, including an `enabled` of `false`, so from then on only what the channel inherits determines whether Claude is on there. If that turns Claude on, Claude answers in the channel again on its next mention, and that use sets the channel up anew: a new `id`, no settings of its own, and none of the removed channel's memory.
1244The check guards against mistakenly removing a channel that is in use. It does not keep Claude out of the channel afterward. Removal deletes the channel’s own settings, including an `enabled` of `false`, so from then on only what the channel inherits determines whether Claude is on there. If that turns Claude on, Claude answers in the channel again on its next mention, and that use sets the channel up anew: a new `id`, no settings of its own, and none of the removed channel’s memory.
12451245
12461246* To keep Claude out of a channel, keep it set up with `enabled` set to `false` rather than remove it, or make sure that what it would inherit, which removal does not touch, keeps Claude off.
12471247* To have a channel store nothing and keep its sessions and memory, clear each setting and detach each Bundle instead.
from line 1352
13521352
13531353### List workspaces
13541354
1355`GET /v1/organizations/claude_tag/slack_workspaces` lists the set-up workspaces your organization owns, newest first by `created_at`. The [Quick start](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#quick-start) shows the request and the response. To find one workspace by Slack's own ID, add `slack_workspace_id`: `data` holds that workspace, or is empty when it is not set up, and a workspace your organization does not own returns `404`. A workspace it owns only through an Enterprise Grid also returns `404` until it is set up. Add `include_inherited=true` to have each workspace hold what applies in it (see [Stored and inherited values](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#stored-and-inherited-values)). Requires the `read:claude_tag` scope.
1355`GET /v1/organizations/claude_tag/slack_workspaces` lists the set-up workspaces your organization owns, newest first by `created_at`. The [Quick start](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#quick-start) shows the request and the response. To find one workspace by Slack’s own ID, add `slack_workspace_id`: `data` holds that workspace, or is empty when it is not set up, and a workspace your organization does not own returns `404`. A workspace it owns only through an Enterprise Grid also returns `404` until it is set up. Add `include_inherited=true` to have each workspace hold what applies in it (see [Stored and inherited values](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#stored-and-inherited-values)). Requires the `read:claude_tag` scope.
13561356
13571357### Get a workspace
13581358
from line 1447
14471447
14481448### Update a workspace
14491449
1450`POST /v1/organizations/claude_tag/slack_workspaces/{id}` changes the workspace's settings and returns the workspace object. `settings` is required and follows [Changing settings](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#changing-settings). What you set here applies in every channel of the workspace that does not set its own value, except `instructions`, which every channel adds its own to rather than replaces. Requires the `write:claude_tag` scope.
1450`POST /v1/organizations/claude_tag/slack_workspaces/{id}` changes the workspace’s settings and returns the workspace object. `settings` is required and follows [Changing settings](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#changing-settings). What you set here applies in every channel of the workspace that does not set its own value, except `instructions`, which every channel adds its own to rather than replaces. Requires the `write:claude_tag` scope.
14511451
14521452<CodeGroup>
14531453 ```bash cURL
from line 1567
15671567
15681568## Bundles
15691569
1570A Bundle is what claude.ai calls an [Access bundle](https://claude.com/docs/claude-tag/admins/add-connections): a named set of access, such as connectors, repositories, and credentials, that Claude can use in a channel or workspace. Organization owners create, edit, and delete Bundles in claude.ai. This API lists them and attaches them. It returns a Bundle's name and description and never what the Bundle grants.
1570A Bundle is what claude.ai calls an [Access bundle](https://claude.com/docs/claude-tag/admins/add-connections): a named set of access, such as connectors, repositories, and credentials, that Claude can use in a channel or workspace. Organization owners create, edit, and delete Bundles in claude.ai. This API lists them and attaches them. It returns a Bundle’s name and description and never what the Bundle grants.
15711571
15721572| Field | Description |
15731573| -------------------------- | ------------------------------------------------ |
15741574| `type` | `bundle`. |
15751575| `id` | Prefixed `capp_`. |
1576| `display_name` | The Bundle's name. |
1576| `display_name` | The Bundle’s name. |
15771577| `description` | What the Bundle is for. `null` when it has none. |
15781578| `created_at`, `updated_at` | When the Bundle was created and last changed. |
15791579
from line 1581
15811581
15821582### List Bundles
15831583
1584`GET /v1/organizations/claude_tag/bundles` lists your organization's Bundles, newest first by `created_at`. Requires the `read:claude_tag` scope.
1584`GET /v1/organizations/claude_tag/bundles` lists your organization’s Bundles, newest first by `created_at`. Requires the `read:claude_tag` scope.
15851585
15861586<CodeGroup>
15871587 ```bash cURL
from line 1789
17891789| Field | Description |
17901790| -------------------- | ------------------------------------------------------------------------------------------------------- |
17911791| `type` | `slack_channel` or `slack_workspace`. |
1792| `id` | Prefixed `btgt_`. It is the `{target_id}` in paths, and is never the channel's or workspace's own `id`. |
1793| `slack_channel_id` | On a `slack_channel` target: the channel's `id`, prefixed `slch_`. |
1794| `slack_workspace_id` | On a `slack_workspace` target: the workspace's `id`, prefixed `slws_`. |
1792| `id` | Prefixed `btgt_`. It is the `{target_id}` in paths, and is never the channel’s or workspace’s own `id`. |
1793| `slack_channel_id` | On a `slack_channel` target: the channel’s `id`, prefixed `slch_`. |
1794| `slack_workspace_id` | On a `slack_workspace` target: the workspace’s `id`, prefixed `slws_`. |
17951795| `created_at` | When the Bundle was attached. |
17961796
1797A Bundle is attached to a channel or workspace at most once, and the same pair always has the same `id`, also after a detach and a new attach. The `id` is opaque: get it from the response to an attach or from the list. A Bundle target does not hold its Bundle's `id`, which its paths also need, so keep the two together.
1797A Bundle is attached to a channel or workspace at most once, and the same pair always has the same `id`, also after a detach and a new attach. The `id` is opaque: get it from the response to an attach or from the list. A Bundle target does not hold its Bundle’s `id`, which its paths also need, so keep the two together.
17981798
17991799Attaching or detaching changes no stored setting. Sessions that are running in the channel or workspace are told that its access changed.
18001800
18011801The Bundle that claude.ai attaches as part of an on-call setup is listed and can be read, but cannot be attached or detached here, and nothing can be attached to or detached from a channel or workspace that an on-call setup manages. Each of those requests returns `400`.
18021802
1803### List a Bundle's targets
1803### List a Bundle’s targets
18041804
18051805`GET /v1/organizations/claude_tag/bundles/{bundle_id}/targets` lists the channels and workspaces the Bundle is attached to, newest first by `created_at`. Requires the `read:claude_tag` scope.
18061806
from line 2436
24362436
24372437## Unrecognized values
24382438
2439`guest_policy.type`, a source's `type`, a Bundle target's `type`, and error codes may gain new values at any time. Treat a value you do not recognize as you would any unknown string rather than failing.
2439`guest_policy.type`, a source’s `type`, a Bundle target’s `type`, and error codes may gain new values at any time. Treat a value you do not recognize as you would any unknown string rather than failing.
24402440
24412441## Rate limiting
24422442
2443Requests are limited for each organization, in two budgets that all of your organization's keys share and that are separate from your organization's other Admin API limits. Each budget allows a burst and then refills at a steady rate:
2443Requests are limited for each organization, in two budgets that all of your organization’s keys share and that are separate from your organization’s other Admin API limits. Each budget allows a burst and then refills at a steady rate:
24442444
24452445| Budget | Requests | Burst | Refill |
24462446| ------- | ------------------------- | ----- | ------------ |
from line 2451
24512451
24522452## Pagination
24532453
2454List endpoints use an **opaque cursor**. The first request returns up to `limit` rows plus a `next_page` cursor; pass the cursor unchanged as the `page` parameter on the next request, with the other query parameters unchanged, and repeat until `next_page` is `null`. A cursor sent with the other value of `include_inherited` than the request that returned it returns `400`. Treat the cursor string as opaque: don't parse, modify, or construct it yourself. [List channels](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#list-channels) can return a page with fewer than `limit` channels, or none, while `next_page` is still set, so keep requesting pages until `next_page` is `null`. The Python, TypeScript, C#, Go, Java, and Ruby SDKs' list iterators and the CLI (except with `--format raw`) do that for you. In PHP and curl, request each page yourself and pass its `next_page` as `page`.
2454List endpoints use an **opaque cursor**. The first request returns up to `limit` rows plus a `next_page` cursor; pass the cursor unchanged as the `page` parameter on the next request, with the other query parameters unchanged, and repeat until `next_page` is `null`. A cursor sent with the other value of `include_inherited` than the request that returned it returns `400`. Treat the cursor string as opaque: don’t parse, modify, or construct it yourself. [List channels](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#list-channels) can return a page with fewer than `limit` channels, or none, while `next_page` is still set, so keep requesting pages until `next_page` is `null`. The Python, TypeScript, C#, Go, Java, and Ruby SDKs’ list iterators and the CLI (except with `--format raw`) do that for you. In PHP and curl, request each page yourself and pass its `next_page` as `page`.
24552455
24562456`limit` defaults to 20, with a minimum of 1 and a maximum of 100; a value outside that range returns `400` on every list. Every list is ordered newest first by `created_at`, and takes no other order.
24572457
from line 2461
24612461
24622462| Status | Meaning |
24632463| ------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
2464| 400 | Invalid input, or the operation does not apply to this channel, workspace, or Bundle (see each endpoint's section). |
2464| 400 | Invalid input, or the operation does not apply to this channel, workspace, or Bundle (see each endpoint’s section). |
24652465| 401 | Missing `x-api-key` header, or the key is not recognized. |
24662466| 403 | The key is not an organization-level scoped key, is missing the required scope, or your organization cannot make this change. |
2467| 404 | Resource not found, or not your organization's. Also returned when the request omits the `anthropic-beta` value, or the API is not enabled for your organization, so that the endpoints read as nonexistent. |
2467| 404 | Resource not found, or not your organization’s. Also returned when the request omits the `anthropic-beta` value, or the API is not enabled for your organization, so that the endpoints read as nonexistent. |
24682468| 409 | Something else changed or removed the resource while the request ran. Nothing the request asked for was done: no setting stored, nothing attached, detached, or removed. The one exception is a setup request, which can have set the channel up before its `settings` met the conflict (`slack_channel_set_up_settings_conflict`). Read the resource again and resend the request if it is still needed. |
24692469| 429 | Rate limit exceeded. See [Rate limiting](https://platform.claude.com/docs/en/manage-claude/claude-tag-api#rate-limiting). |
24702470| 500 | Internal error. |
from line 2504
25042504
25052505## Activity Feed events
25062506
2507Every change through this API is recorded on your organization's [Compliance API Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed), attributed to the API key as an `api_actor` carrying its `apikey_` ID. The events are the ones the feed records when the same change is made in claude.ai, so one query finds a change whichever way it was made.
2507Every change through this API is recorded on your organization’s [Compliance API Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed), attributed to the API key as an `api_actor` carrying its `apikey_` ID. The events are the ones the feed records when the same change is made in claude.ai, so one query finds a change whichever way it was made.
25082508
25092509| Event | Emitted when |
25102510| --------------------------------- | ----------------------------------------------------------------------------------- |
from line 2514
25142514| `ccr_agent_proxy_profile_bound` | A Bundle is attached. |
25152515| `ccr_agent_proxy_profile_unbound` | A Bundle is detached. |
25162516
2517The events name a channel or workspace by an identifier of the feed's own, `agent_id` (prefixed `cagt_`), which no response of this API holds, so you cannot yet match an event to a channel's or workspace's `id`. The two Bundle events name the Bundle in `profile_id` and the channel or workspace, by the same `agent_id`, in `scope_id`.
2517The events name a channel or workspace by an identifier of the feed’s own, `agent_id` (prefixed `cagt_`), which no response of this API holds, so you cannot yet match an event to a channel’s or workspace’s `id`. The two Bundle events name the Bundle in `profile_id` and the channel or workspace, by the same `agent_id`, in `scope_id`.
25182518
2519A `ccr_agent_updated` event lists what changed in `updated_fields`, under the feed's own names:
2519A `ccr_agent_updated` event lists what changed in `updated_fields`, under the feed’s own names:
25202520
25212521| Setting | Name in `updated_fields` |
25222522| ---------------- | ------------------------ |
from line 2526
25262526| `environment_id` | `default_environment_id` |
25272527| `guest_policy` | `guest_policy` |
25282528
2529`updated_fields` can also hold `is_virtual`, which names no setting. It appears beside the names of the changed settings in the event for a change through this API that is the first thing anyone stores on the channel or workspace: a channel that Claude's first use set up, or that this API set up with no `settings`, or a workspace in which Claude was never used, and on which nobody has yet stored a setting or attached a Bundle, here or in claude.ai. The `model` a code channel starts with does not count as stored. Attaching a Bundle records only `ccr_agent_proxy_profile_bound`.
2529`updated_fields` can also hold `is_virtual`, which names no setting. It appears beside the names of the changed settings in the event for a change through this API that is the first thing anyone stores on the channel or workspace: a channel that Claude’s first use set up, or that this API set up with no `settings`, or a workspace in which Claude was never used, and on which nobody has yet stored a setting or attached a Bundle, here or in claude.ai. The `model` a code channel starts with does not count as stored. Attaching a Bundle records only `ccr_agent_proxy_profile_bound`.
25302530
25312531Reads, requests that change nothing, and requests that are refused before anything is stored record nothing. A setup request that sets a channel up and whose `settings` is then refused records `ccr_agent_created`.
25322532
manage-claude/cmek-admin-api Changed · +5 / -5 lines
from line 12
1212
1313* Customer-managed encryption keys (CMEK) are [turned on for your organization](https://platform.claude.com/docs/en/manage-claude/cmek#availability).
1414* You have an [Admin API key](https://platform.claude.com/docs/en/manage-claude/admin-api-keys). The samples read it from `ANTHROPIC_API_KEY`.
15* You've created your key in [AWS KMS](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#encryption-key-setup), [Google Cloud KMS](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#encryption-key-setup), or [Azure Key Vault](https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault#encryption-key-setup), and kept the values the setup steps tell you to copy.
16* You have a workspace that [retains data](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#data-retention), ideally a new one, because [existing data stays under Anthropic's key](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect).
15* You’ve created your key in [AWS KMS](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#encryption-key-setup), [Google Cloud KMS](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#encryption-key-setup), or [Azure Key Vault](https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault#encryption-key-setup), and kept the values the setup steps tell you to copy.
16* You have a workspace that [retains data](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#data-retention), ideally a new one, because [existing data stays under Anthropic’s key](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect).
1717
1818## Create, validate, and attach the key
1919
from line 337
337337 * `<friendly-name>`: a display name
338338 * `https://<your-vault-name>.vault.azure.net/`: the vault URI
339339 * `<your-key-name>`: the key name
340 * `<your-tenant-id>`: the vault's tenant ID
340 * `<your-tenant-id>`: the vault’s tenant ID
341341
342342 <CodeGroup>
343343 ```bash cURL
from line 619
619619
620620 <Step title="Attach the key to a workspace">
621621 <Warning>
622 Attaching a key [can't be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). If the key is deleted, Anthropic can't recover the data it protects.
622 Attaching a key [can’t be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). If the key is deleted, Anthropic can’t recover the data it protects.
623623 </Warning>
624624
625625 Replace `<workspace-id>` with the workspace ID, which starts with `wrkspc_`, and `ekey_<id>` with the external key ID.
from line 735
735735 ```
736736 </CodeGroup>
737737
738 The response shows the attached key's ID in `external_key_id`. If the request is refused, [look up the error](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#refused).
738 The response shows the attached key’s ID in `external_key_id`. If the request is refused, [look up the error](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#refused).
739739 </Step>
740740</Steps>
741741
manage-claude/cmek-aws-kms Changed · +12 / -12 lines
from line 18
1818
1919* Customer-managed encryption keys (CMEK) are [turned on for your organization](https://platform.claude.com/docs/en/manage-claude/cmek#availability).
2020* You have your Anthropic organization ID, the UUID without the `org_` prefix. Copy it from [Organization](https://platform.claude.com/settings/organization) in the Claude Console, or from **Organization settings > Organization and access** on claude.ai. Whoever creates the key needs it.
21* You're an Organization Admin on Claude Platform, or an Owner or Primary Owner on Claude Enterprise.
22* On Claude Platform, you have a workspace that [retains data](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#data-retention), ideally a new one, because [existing data stays under Anthropic's key](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect).
21* You’re an Organization Admin on Claude Platform, or an Owner or Primary Owner on Claude Enterprise.
22* On Claude Platform, you have a workspace that [retains data](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#data-retention), ideally a new one, because [existing data stays under Anthropic’s key](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect).
2323* On Claude Enterprise, you know [which features turn off or change](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#turned-off-or-changed).
2424
2525In AWS:
2626
2727* You can create AWS KMS keys and set their key policies (`kms:CreateKey` and `kms:PutKeyPolicy`).
28* Any IP restriction on AWS KMS access allows [Anthropic's outbound IP addresses](https://platform.claude.com/docs/en/api/ip-addresses#outbound-ip-addresses).
28* Any IP restriction on AWS KMS access allows [Anthropic’s outbound IP addresses](https://platform.claude.com/docs/en/api/ip-addresses#outbound-ip-addresses).
2929
3030## In AWS: create the key
3131
from line 33
3333
3434### Write the key policy
3535
36This policy gives Anthropic's IAM role access to your key. Use only the role ARN published on this page, never one sent by email or chat. Copy the policy into a text editor:
36This policy gives Anthropic’s IAM role access to your key. Use only the role ARN published on this page, never one sent by email or chat. Copy the policy into a text editor:
3737
3838```json key-policy.json
3939{
from line 77
7777
7878Replace `<AWS_ACCOUNT_ID>` with your [AWS account ID](https://docs.aws.amazon.com/IAM/latest/UserGuide/console-account-id.html) and `<ORGANIZATION_UUID>` with your [Anthropic organization ID](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#prerequisites). Keep the `kms:EncryptionContext:anthropic:org_uuid` condition, or verification fails.
7979
80You can also [limit the key to specific workspaces](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms-workspaces) by listing their compartment IDs. If you're replacing the policy on a key that already protects Claude data, [add one more statement](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#existing-data).
80You can also [limit the key to specific workspaces](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms-workspaces) by listing their compartment IDs. If you’re replacing the policy on a key that already protects Claude data, [add one more statement](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#existing-data).
8181
8282### Create the key
8383
from line 116
116116 </Step>
117117
118118 <Step title="Define key administrative permissions">
119 Don't select any key administrators. Your key policy already gives your AWS account full admin control. Click **Next**.
119 Don’t select any key administrators. Your key policy already gives your AWS account full admin control. Click **Next**.
120120
121121 <Frame caption="Leave key administrators empty.">
122122 
from line 124
124124 </Step>
125125
126126 <Step title="Define key usage permissions">
127 Don't select any key users, and don't add anything under **Other AWS accounts**. Your key policy already grants the access that's needed. Click **Next**.
127 Don’t select any key users, and don’t add anything under **Other AWS accounts**. Your key policy already grants the access that’s needed. Click **Next**.
128128 </Step>
129129
130130 <Step title="Edit key policy">
from line 142
142142 </Tab>
143143
144144 <Tab title="AWS CLI">
145 Save your key policy as `key-policy.json`, then create the key. Replace `<REGION>` with the key's region.
145 Save your key policy as `key-policy.json`, then create the key. Replace `<REGION>` with the key’s region.
146146
147147 ```bash
148148 aws kms create-key \
from line 166
166166 <Tab title="Claude Platform">
167167 <Steps>
168168 <Step title="Open the encryption key settings">
169 In the Claude Console, open [Encryption keys](https://platform.claude.com/settings/privacy#encryption-keys) on the Data retention page. If the section isn't there, select **Organization** from the dropdown menu at the top.
169 In the Claude Console, open [Encryption keys](https://platform.claude.com/settings/privacy#encryption-keys) on the Data retention page. If the section isn’t there, select **Organization** from the dropdown menu at the top.
170170 </Step>
171171
172172 <Step title="Add the key">
from line 183
183183
184184 <Step title="Attach the key to a workspace">
185185 <Warning>
186 Attaching a key [can't be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). You can't remove it from the workspace or replace it. If the key is deleted, Anthropic can't recover the data it protects.
186 Attaching a key [can’t be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). You can’t remove it from the workspace or replace it. If the key is deleted, Anthropic can’t recover the data it protects.
187187 </Warning>
188188
189189 1. At the top of the Data retention page, select the workspace from the dropdown menu.
from line 190
190190 2. Under **Encryption key**, select the key and click **Save**.
191191 3. Select the checkbox to confirm that you have read the CMEK documentation, then click **Confirm**.
192192
193 You see **Workspace settings updated.** Once the key [takes effect](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect), your cloud provider's audit log shows Anthropic's calls to the key.
193 You see **Workspace settings updated.** Once the key [takes effect](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect), your cloud provider’s audit log shows Anthropic’s calls to the key.
194194
195195 In a [ZDR organization](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#zdr-organizations), after you select the workspace, select **Standard data retention** so that **Encryption key** appears. After you click **Save**, click **Accept** on the data retention terms.
196196 </Step>
from line 201
201201 On Claude Enterprise, CMEK applies to the whole organization, and you can add only one key.
202202
203203 <Warning>
204 Adding a key [can't be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). You can't remove it from the organization or replace it. If the key is deleted, Anthropic can't recover the data it protects.
204 Adding a key [can’t be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). You can’t remove it from the organization or replace it. If the key is deleted, Anthropic can’t recover the data it protects.
205205 </Warning>
206206
207207 Adding the key [turns off or changes some features](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#turned-off-or-changed) for every user. To try CMEK first, use a separate organization.
manage-claude/cmek-aws-kms-workspaces Changed · +3 / -3 lines
## Copy the workspace’s compartment ID ## Copy the workspace's compartment ID
from line 4
44description: Add a key policy condition that names the workspaces allowed to use your AWS KMS key.
55---
66
7The [key policy from setup](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#key-policy) lets every workspace in your organization use the key. With this optional condition, a workspace that isn't listed can't use it.
7The [key policy from setup](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#key-policy) lets every workspace in your organization use the key. With this optional condition, a workspace that isn’t listed can’t use it.
88
9Add a workspace's [compartment ID](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#what-one-key-protects) to the policy before you [attach the key](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#register-the-key-with-anthropic) to that workspace. For a new workspace, that means creating it without the key.
9Add a workspace’s [compartment ID](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#what-one-key-protects) to the policy before you [attach the key](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#register-the-key-with-anthropic) to that workspace. For a new workspace, that means creating it without the key.
1010
11## Copy the workspace's compartment ID
11## Copy the workspace’s compartment ID
1212
1313In the Claude Console, open the [Data retention](https://platform.claude.com/settings/privacy) page and select the workspace from the dropdown menu at the top. Copy the **Compartment ID** under **Encryption key**. The [Get Workspace](https://platform.claude.com/docs/en/api/organization/workspaces/retrieve) endpoint returns it as `compartment_id`.
1414
manage-claude/cmek-azure-key-vault Changed · +18 / -18 lines
from line 16
1616
1717* Customer-managed encryption keys (CMEK) are [turned on for your organization](https://platform.claude.com/docs/en/manage-claude/cmek#availability).
1818* You have your Anthropic organization ID, the UUID without the `org_` prefix. Copy it from [Organization](https://platform.claude.com/settings/organization) in the Claude Console, or from **Organization settings > Organization and access** on claude.ai. Whoever creates the key needs it.
19* You're an Organization Admin on Claude Platform, or an Owner or Primary Owner on Claude Enterprise.
20* On Claude Platform, you have a workspace that [retains data](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#data-retention), ideally a new one, because [existing data stays under Anthropic's key](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect).
19* You’re an Organization Admin on Claude Platform, or an Owner or Primary Owner on Claude Enterprise.
20* On Claude Platform, you have a workspace that [retains data](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#data-retention), ideally a new one, because [existing data stays under Anthropic’s key](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect).
2121* On Claude Enterprise, you know [which features turn off or change](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#turned-off-or-changed).
2222
2323In Azure:
from line 24
2424
2525* You can create keys in your key vault and assign RBAC roles on it.
2626* You can create service principals in your Entra tenant (Application Administrator, Cloud Application Administrator, or an equivalent custom role).
27* The vault has a diagnostic setting for the `AuditEvent` log category. Without one, Anthropic's key operations leave no audit trail.
27* The vault has a diagnostic setting for the `AuditEvent` log category. Without one, Anthropic’s key operations leave no audit trail.
2828
2929## In Azure: create the key
3030
3131After a failed **Verify** or **Add**, see the [fixes for Azure Key Vault](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#azure-key-vault).
3232
33These steps give Anthropic's multitenant application access to your key:
33These steps give Anthropic’s multitenant application access to your key:
3434
3535* **Name:** `anthropic-cmek-client-us`
3636* **Client ID:** `8635ae1a-3e5d-44e8-a4ed-e0f614466f87`
from line 49
4949| Field | Must be |
5050| ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
5151| `rbac` | `true` |
52| `purge` | `true`. If it's `false` or `null`, turn on purge protection first. You can't turn it off again. |
53| `pub` | `"Enabled"`. Private endpoints aren't supported. |
54| `net` | `"Allow"`, or `"Deny"` with [Anthropic's outbound IP addresses](https://platform.claude.com/docs/en/api/ip-addresses#outbound-ip-addresses) in `ipRules` |
52| `purge` | `true`. If it’s `false` or `null`, turn on purge protection first. You can’t turn it off again. |
53| `pub` | `"Enabled"`. Private endpoints aren’t supported. |
54| `net` | `"Allow"`, or `"Deny"` with [Anthropic’s outbound IP addresses](https://platform.claude.com/docs/en/api/ip-addresses#outbound-ip-addresses) in `ipRules` |
5555
5656Copy `uri` (the vault URI) and `tenantId`.
5757
from line 62
6262<Tabs>
6363 <Tab title="Azure portal">
6464 <Steps>
65 <Step title="Create Anthropic's service principal">
66 Open Cloud Shell from the portal's top navigation bar. Run this command:
65 <Step title="Create Anthropic’s service principal">
66 Open Cloud Shell from the portal’s top navigation bar. Run this command:
6767
6868 ```bash
6969 az ad sp create --id 8635ae1a-3e5d-44e8-a4ed-e0f614466f87
from line 115
115115 </Frame>
116116 </Step>
117117
118 <Step title="Open the key's access control">
118 <Step title="Open the key’s access control">
119119 Open the key itself, not the vault. Select its **Access control (IAM)** tab and click **Add > Add role assignment**.
120120 </Step>
121121
from line 123
123123 On the **Role** tab, select **Key Vault Crypto User**. Click **Next**.
124124 </Step>
125125
126 <Step title="Add Anthropic's service principal">
126 <Step title="Add Anthropic’s service principal">
127127 On the **Members** tab, click **Select members**. Search for `anthropic-cmek-client-us` and select it. Click **Select**, then click **Next**.
128128 </Step>
129129
from line 135
135135
136136 <Tab title="Azure CLI">
137137 <Steps>
138 <Step title="Create Anthropic's service principal">
138 <Step title="Create Anthropic’s service principal">
139139 ```bash
140140 az ad sp create --id 8635ae1a-3e5d-44e8-a4ed-e0f614466f87
141141 ```
from line 142
142142
143143 Copy the `id` field from the output.
144144
145 If the command exits with an "already exists" error, get the `id` with this command instead:
145 If the command exits with an “already exists” error, get the `id` with this command instead:
146146
147147 ```bash
148148 az ad sp show --id 8635ae1a-3e5d-44e8-a4ed-e0f614466f87 --query id -o tsv
from line 195
195195
196196Verification fails without the organization tag. The key must be RSA, 3072-bit or larger.
197197
198Instead of creating a key, run this command in the Azure CLI or Cloud Shell. It limits the key to `wrapKey` and `unwrapKey`. It also replaces the current version's tags, so list any you want to keep in `--tags` as `name=value`.
198Instead of creating a key, run this command in the Azure CLI or Cloud Shell. It limits the key to `wrapKey` and `unwrapKey`. It also replaces the current version’s tags, so list any you want to keep in `--tags` as `name=value`.
199199
200200```bash
201201az keyvault key set-attributes \
from line 215
215215 <Tab title="Claude Platform">
216216 <Steps>
217217 <Step title="Open the encryption key settings">
218 In the Claude Console, open [Encryption keys](https://platform.claude.com/settings/privacy#encryption-keys) on the Data retention page. If the section isn't there, select **Organization** from the dropdown menu at the top.
218 In the Claude Console, open [Encryption keys](https://platform.claude.com/settings/privacy#encryption-keys) on the Data retention page. If the section isn’t there, select **Organization** from the dropdown menu at the top.
219219 </Step>
220220
221221 <Step title="Add the key">
from line 232
232232
233233 <Step title="Attach the key to a workspace">
234234 <Warning>
235 Attaching a key [can't be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). You can't remove it from the workspace or replace it. If the key is deleted, Anthropic can't recover the data it protects.
235 Attaching a key [can’t be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). You can’t remove it from the workspace or replace it. If the key is deleted, Anthropic can’t recover the data it protects.
236236 </Warning>
237237
238238 1. At the top of the Data retention page, select the workspace from the dropdown menu.
from line 239
239239 2. Under **Encryption key**, select the key and click **Save**.
240240 3. Select the checkbox to confirm that you have read the CMEK documentation, then click **Confirm**.
241241
242 You see **Workspace settings updated.** Once the key [takes effect](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect), your cloud provider's audit log shows Anthropic's calls to the key.
242 You see **Workspace settings updated.** Once the key [takes effect](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect), your cloud provider’s audit log shows Anthropic’s calls to the key.
243243
244244 In a [ZDR organization](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#zdr-organizations), after you select the workspace, select **Standard data retention** so that **Encryption key** appears. After you click **Save**, click **Accept** on the data retention terms.
245245 </Step>
from line 250
250250 On Claude Enterprise, CMEK applies to the whole organization, and you can add only one key.
251251
252252 <Warning>
253 Adding a key [can't be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). You can't remove it from the organization or replace it. If the key is deleted, Anthropic can't recover the data it protects.
253 Adding a key [can’t be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). You can’t remove it from the organization or replace it. If the key is deleted, Anthropic can’t recover the data it protects.
254254 </Warning>
255255
256256 Adding the key [turns off or changes some features](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#turned-off-or-changed) for every user. To try CMEK first, use a separate organization.
manage-claude/cmek-claude-platform-on-aws Changed · +9 / -9 lines
from line 4
44description: Create an AWS KMS key in your AWS account and attach it to a workspace on Claude Platform on AWS.
55---
66
7If your Claude Console sidebar doesn't show **Account managed by AWS**, follow [Set up CMEK with AWS KMS](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms) instead.
7If your Claude Console sidebar doesn’t show **Account managed by AWS**, follow [Set up CMEK with AWS KMS](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms) instead.
88
99## Before you start
1010
from line 24
2424
2525 To scope them, see [IAM actions](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#encryption-keys).
2626
27* You have a workspace with no key attached, ideally a new one, because [existing data stays under Anthropic's key](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect). The key policy lists its compartment ID.
27* You have a workspace with no key attached, ideally a new one, because [existing data stays under Anthropic’s key](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect). The key policy lists its compartment ID.
2828
2929In the Claude Console, open the [Data retention](https://platform.claude.com/settings/privacy) page and select the workspace from the dropdown menu at the top. Copy the **Compartment ID** under **Encryption key**. The [Get Workspace](https://platform.claude.com/docs/en/api/organization/workspaces/retrieve) endpoint returns it as `compartment_id`.
3030
from line 76
7676
7777Replace `<AWS_ACCOUNT_ID>` with your [AWS account ID](https://docs.aws.amazon.com/IAM/latest/UserGuide/console-account-id.html) and `<COMPARTMENT_UUID>` with the [compartment ID](https://platform.claude.com/docs/en/manage-claude/cmek-claude-platform-on-aws#prerequisites).
7878
79The optional `EncryptionContext` condition limits the key to the workspaces you list. Before you attach the key to another workspace, add that workspace's compartment ID and [replace the policy on the key](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms-workspaces#replace-the-key-policy). To do without the condition, delete the `Condition` block from the `AllowClaudePlatformOnAWSCrypto` statement. If you add the condition later, list every workspace the key is already attached to.
79The optional `EncryptionContext` condition limits the key to the workspaces you list. Before you attach the key to another workspace, add that workspace’s compartment ID and [replace the policy on the key](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms-workspaces#replace-the-key-policy). To do without the condition, delete the `Condition` block from the `AllowClaudePlatformOnAWSCrypto` statement. If you add the condition later, list every workspace the key is already attached to.
8080
8181To narrow access further, use the key policy, not IP-based restrictions. Add an `aws:SourceArn` condition to both service principal statements. This one allows every workspace in your AWS account:
8282
from line 125
125125 </Step>
126126
127127 <Step title="Define key administrative permissions">
128 Don't select any key administrators. Your key policy already gives your AWS account full admin control. Click **Next**.
128 Don’t select any key administrators. Your key policy already gives your AWS account full admin control. Click **Next**.
129129
130130 <Frame caption="Leave key administrators empty.">
131131 
from line 133
133133 </Step>
134134
135135 <Step title="Define key usage permissions">
136 Don't select any key users, and don't add anything under **Other AWS accounts**. Your key policy already grants the access that's needed. Click **Next**.
136 Don’t select any key users, and don’t add anything under **Other AWS accounts**. Your key policy already grants the access that’s needed. Click **Next**.
137137 </Step>
138138
139139 <Step title="Edit key policy">
from line 151
151151 </Tab>
152152
153153 <Tab title="AWS CLI">
154 Save your key policy as `key-policy.json`, then create the key. Replace `<REGION>` with the key's region.
154 Save your key policy as `key-policy.json`, then create the key. Replace `<REGION>` with the key’s region.
155155
156156 ```bash
157157 aws kms create-key \
from line 171
171171
172172<Steps>
173173 <Step title="Open the encryption key settings">
174 In the Claude Console, open [Encryption keys](https://platform.claude.com/settings/privacy#encryption-keys) on the Data retention page. If the section isn't there, select **Organization** from the dropdown menu at the top.
174 In the Claude Console, open [Encryption keys](https://platform.claude.com/settings/privacy#encryption-keys) on the Data retention page. If the section isn’t there, select **Organization** from the dropdown menu at the top.
175175 </Step>
176176
177177 <Step title="Add the key">
from line 179
179179 </Step>
180180
181181 <Step title="Enter the key ARN">
182 In **KMS key ARN**, select your key. If it isn't listed, click **Enter ARN manually** and paste the ARN. Anthropic rejects alias ARNs and multi-Region keys. Click **Add**.
182 In **KMS key ARN**, select your key. If it isn’t listed, click **Enter ARN manually** and paste the ARN. Anthropic rejects alias ARNs and multi-Region keys. Click **Add**.
183183 </Step>
184184
185185 <Step title="Attach the key to a workspace">
186186 <Warning>
187 Attaching a key [can't be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). You can't remove it from the workspace or replace it. If the key is deleted, Anthropic can't recover the data it protects.
187 Attaching a key [can’t be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). You can’t remove it from the workspace or replace it. If the key is deleted, Anthropic can’t recover the data it protects.
188188 </Warning>
189189
190190 1. At the top of the Data retention page, select the workspace from the dropdown menu.
manage-claude/cmek-coverage-claude-enterprise Changed · +11 / -11 lines
## Encrypted with Anthropic’s key ## Encrypted with Anthropic's key
from line 16
1616* Office agents.
1717* Claude in Chrome.
1818* Claude Science, which is in beta.
19* [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api#customer-managed-encryption-keys) (beta) plugin versions: each version's description, release notes, components, and files. That page lists which requests still work while your key can't be used.
20* Compliance API [local session transcripts](https://platform.claude.com/docs/en/manage-claude/compliance-sessions#retrieve-local-sessions) from sessions on users' machines. If your key can't be used, the messages endpoint returns [503 Service Unavailable](https://platform.claude.com/docs/en/manage-claude/compliance-errors#local-sessions-temporarily-unavailable) instead of transcript content. Session metadata is still listed.
19* [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api#customer-managed-encryption-keys) (beta) plugin versions: each version’s description, release notes, components, and files. That page lists which requests still work while your key can’t be used.
20* Compliance API [local session transcripts](https://platform.claude.com/docs/en/manage-claude/compliance-sessions#retrieve-local-sessions) from sessions on users’ machines. If your key can’t be used, the messages endpoint returns [503 Service Unavailable](https://platform.claude.com/docs/en/manage-claude/compliance-errors#local-sessions-temporarily-unavailable) instead of transcript content. Session metadata is still listed.
2121* Backups and snapshots, which inherit the key.
2222
2323## Turned off or changed
from line 26
2626
2727| Feature | What people see |
2828| ----------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
29| Claude Code on the web | Off. New sessions can't be started, even if an admin turns the product on. |
29| Claude Code on the web | Off. New sessions can’t be started, even if an admin turns the product on. |
3030| Claude in Slack | Off. Claude declines requests, even if an admin turns the product on. |
3131| Claude Code Desktop | Off until an admin turns it on. Available for local sessions once turned on under [claude.ai > Organization settings > Claude Code](https://claude.ai/admin-settings/claude-code). |
3232| Artifacts | Changed. Artifacts, including Claude Design, Claude Slides, and Claude Docs in conversations and the **Artifacts** tab, cannot be turned on in organizations that also use ZDR. In organizations with HIPAA readiness, an Owner must first accept the terms for using them. |
3333| Artifact publishing and sharing | Changed. Claude Code cannot [publish artifacts](https://code.claude.com/docs/en/artifacts#availability). However, artifacts made in chat or Cowork can be shared within your organization, but not publicly. |
34| Standalone Claude Design app | Not supported. See [Encrypted with Anthropic's key](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#encrypted-with-anthropics-key). |
34| Standalone Claude Design app | Not supported. See [Encrypted with Anthropic’s key](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#encrypted-with-anthropics-key). |
3535| Analytics: smart reports and contribution metrics | Off. Certain analytics are disabled, regardless of admin settings: Claude smart reports (beta, under claude.ai/analytics/insights) and Claude Code contribution metrics from GitHub (beta, under claude.ai/analytics/claude-code). |
36| Analytics: skills and connectors | Changed. Admin analytics for skills and connectors, in the claude.ai analytics dashboard and through the [Claude Enterprise Analytics API](https://platform.claude.com/docs/en/manage-claude/analytics-api), don't include usage in chat, and hide the names of custom skills, plugins, and connectors. |
37| Response ratings (thumbs up and thumbs down) | Off. Members can't rate Claude's responses. |
38| [Skill and plugin security scanning](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/enterprise#skill-content-scanning) | Off. The setting can't be turned on, and skills and plugins are installed without a scan. |
36| Analytics: skills and connectors | Changed. Admin analytics for skills and connectors, in the claude.ai analytics dashboard and through the [Claude Enterprise Analytics API](https://platform.claude.com/docs/en/manage-claude/analytics-api), don’t include usage in chat, and hide the names of custom skills, plugins, and connectors. |
37| Response ratings (thumbs up and thumbs down) | Off. Members can’t rate Claude’s responses. |
38| [Skill and plugin security scanning](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/enterprise#skill-content-scanning) | Off. The setting can’t be turned on, and skills and plugins are installed without a scan. |
3939| Claude Security and routines | Off. Beta and research preview features, turned off regardless of admin settings. |
4040
41## Encrypted with Anthropic's key
41## Encrypted with Anthropic’s key
4242
43The features that store this data stay available, but the data isn't encrypted with your key. You can turn off some of these features in **Settings**.
43The features that store this data stay available, but the data isn’t encrypted with your key. You can turn off some of these features in **Settings**.
4444
4545| Data | Details |
4646| --------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
4747| Existing data | Written before [your key takes effect](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect). |
4848| Standalone Claude Design app | The standalone Claude Design app at claude.ai/design is not supported with CMEK, and its data might not be encrypted under your key. The standalone app is closing. Claude Design in conversations and the **Artifacts** tab is encrypted under your key, as listed under [Encrypted with your key](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#encrypted-with-your-key). |
49| Personal preferences and Cowork Global instructions | [Personal preferences - Instructions for Claude section](https://claude.ai/new#settings/account) and Cowork Global instructions. These are set at the account level and shared across all of a user's organizations. |
49| Personal preferences and Cowork Global instructions | [Personal preferences - Instructions for Claude section](https://claude.ai/new#settings/account) and Cowork Global instructions. These are set at the account level and shared across all of a user’s organizations. |
5050| Account data for users in your organization | Includes names, email addresses, and profile pictures. |
5151| Preserved records | Anthropic can preserve specific records [in three narrow cases](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#limited-preservation-outside-your-key). |
5252
5353## Where CMEK does not apply: Claude Code telemetry
5454
55When Claude Code connects through an LLM gateway or proxy (a custom `ANTHROPIC_BASE_URL`), CMEK does not apply to Claude Code's operational telemetry. To turn this telemetry off, set the `DISABLE_TELEMETRY` environment variable to `1`, as described under [Telemetry services](https://code.claude.com/docs/en/data-usage#telemetry-services) in the Claude Code documentation.
55When Claude Code connects through an LLM gateway or proxy (a custom `ANTHROPIC_BASE_URL`), CMEK does not apply to Claude Code’s operational telemetry. To turn this telemetry off, set the `DISABLE_TELEMETRY` environment variable to `1`, as described under [Telemetry services](https://code.claude.com/docs/en/data-usage#telemetry-services) in the Claude Code documentation.
5656
manage-claude/cmek-coverage-claude-platform Changed · +7 / -7 lines
## Encrypted with Anthropic’s key ## Encrypted with Anthropic's key
from line 4
44description: Look up which Claude Platform data your key encrypts, what turns off or changes, and what stays under Anthropic's key.
55---
66
7For Claude Enterprise, see [What CMEK covers on Claude Enterprise](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise). Beta and research preview features that aren't listed here might not be covered by customer-managed encryption keys (CMEK).
7For Claude Enterprise, see [What CMEK covers on Claude Enterprise](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise). Beta and research preview features that aren’t listed here might not be covered by customer-managed encryption keys (CMEK).
88
99## Encrypted with your key
1010
from line 27
2727| [Organization webhooks](https://platform.claude.com/docs/en/manage-claude/organization-webhooks#errors) (beta) | Turned off for an organization whose default workspace uses a key. Requests return a 400 error. |
2828| Zero data retention (ZDR) | A workspace with your key retains data. See [CMEK, data retention, and ZDR](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention). |
2929
30## Encrypted with Anthropic's key
30## Encrypted with Anthropic’s key
3131
32The features that store this data stay available, but the data isn't encrypted with your key. You can turn off some of these features in **Settings**.
32The features that store this data stay available, but the data isn’t encrypted with your key. You can turn off some of these features in **Settings**.
3333
3434| Data | Details |
3535| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
3636| Existing data | Written before [your key takes effect](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect). |
37| Data that isn't at rest, and data with a TTL shorter than 24 hours | For example, cache. |
38| Activity Feed, audit logs, and telemetry network traffic such as OpenTelemetry | Kept under Anthropic's key so that you can maintain compliance even if your key can't be used. |
37| Data that isn’t at rest, and data with a TTL shorter than 24 hours | For example, cache. |
38| Activity Feed, audit logs, and telemetry network traffic such as OpenTelemetry | Kept under Anthropic’s key so that you can maintain compliance even if your key can’t be used. |
3939| Claude Managed Agents [vault credential](https://platform.claude.com/docs/en/managed-agents/vaults) values, such as OAuth tokens and client secrets | Write-only and never returned in API responses. |
40| [User profiles](https://platform.claude.com/docs/en/manage-claude/user-profiles) | Profile fields such as `name` and `metadata`. Don't store sensitive personal data in profile `metadata`. |
40| [User profiles](https://platform.claude.com/docs/en/manage-claude/user-profiles) | Profile fields such as `name` and `metadata`. Don’t store sensitive personal data in profile `metadata`. |
4141| Claude Console feedback | Ratings and comments that members choose to send with the **Feedback** option. No setting turns it off. |
4242| [OpenTelemetry destination](https://platform.claude.com/docs/en/manage-claude/opentelemetry/api#add-a-destination) request headers, such as the API key header of your observability platform | Write-only and never returned in API responses. |
4343| Account data for users in your organization | Includes names, email addresses, and profile pictures. |
from line 45
4545
4646## Where CMEK does not apply: Claude Code telemetry
4747
48When Claude Code connects through an LLM gateway or proxy (a custom `ANTHROPIC_BASE_URL`), CMEK does not apply to Claude Code's operational telemetry. To turn this telemetry off, set the `DISABLE_TELEMETRY` environment variable to `1`, as described under [Telemetry services](https://code.claude.com/docs/en/data-usage#telemetry-services) in the Claude Code documentation.
48When Claude Code connects through an LLM gateway or proxy (a custom `ANTHROPIC_BASE_URL`), CMEK does not apply to Claude Code’s operational telemetry. To turn this telemetry off, set the `DISABLE_TELEMETRY` environment variable to `1`, as described under [Telemetry services](https://code.claude.com/docs/en/data-usage#telemetry-services) in the Claude Code documentation.
4949
manage-claude/cmek-data-retention Changed · +6 / -6 lines
from line 4
44description: Why a workspace with a key retains data, what that means for ZDR, and what Anthropic can preserve outside your key.
55---
66
7On Claude Platform, customer-managed encryption keys (CMEK) and [zero data retention (ZDR)](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention) can't share a workspace. On Claude Enterprise, an organization can use CMEK and ZDR together, but it then [can't turn on artifacts](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#turned-off-or-changed).
7On Claude Platform, customer-managed encryption keys (CMEK) and [zero data retention (ZDR)](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention) can’t share a workspace. On Claude Enterprise, an organization can use CMEK and ZDR together, but it then [can’t turn on artifacts](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#turned-off-or-changed).
88
99## A key needs a workspace that retains data
1010
11CMEK encrypts stored data, and under ZDR on Claude Platform, Anthropic doesn't store your prompts or responses. So you can attach a key only to a workspace with **Standard data retention** (30 days).
11CMEK encrypts stored data, and under ZDR on Claude Platform, Anthropic doesn’t store your prompts or responses. So you can attach a key only to a workspace with **Standard data retention** (30 days).
1212
13After you attach a key, you can't turn off data retention for that workspace. To return to ZDR, create a new workspace and move your traffic to it.
13After you attach a key, you can’t turn off data retention for that workspace. To return to ZDR, create a new workspace and move your traffic to it.
1414
1515## In a ZDR organization
1616
17A ZDR organization on Claude Platform can use CMEK. You switch one workspace to **Standard data retention**, accept the data retention terms, and attach your key to it. The workspace you switch can't be the default workspace, whose retention follows the organization's. Your other workspaces keep ZDR.
17A ZDR organization on Claude Platform can use CMEK. You switch one workspace to **Standard data retention**, accept the data retention terms, and attach your key to it. The workspace you switch can’t be the default workspace, whose retention follows the organization’s. Your other workspaces keep ZDR.
1818
1919[Choose your setup page](https://platform.claude.com/docs/en/manage-claude/cmek#set-it-up) and follow its attach step.
2020
from line 24
2424
2525* Where Anthropic is required by law to retain records (for example, material reported to NCMEC under 18 U.S.C. § 2258A)
2626* Exigent risk of serious harm (for example, CBRNE weapons development, offensive cyberattacks, or imminent threats of violence)
27* Violations of Section D.4 of Anthropic's [Commercial Terms of Service](https://www.anthropic.com/legal/commercial-terms) or equivalent terms in a customer's other applicable agreement with Anthropic
27* Violations of Section D.4 of Anthropic’s [Commercial Terms of Service](https://www.anthropic.com/legal/commercial-terms) or equivalent terms in a customer’s other applicable agreement with Anthropic
2828
29Outside of [CSAM screening](https://support.claude.com/en/articles/9020328-csam-detection-and-reporting), preservation requires a human reviewer's explicit decision and follows Anthropic's [retention policy for commercial data](https://privacy.claude.com/en/articles/10023548-how-long-do-you-store-my-data). For every instance of preservation, a corresponding [Compliance API Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed) event is generated with a reason code conveying the purpose of the preservation. See [CMEK content preservation](https://platform.claude.com/docs/en/manage-claude/access-transparency#cmek-content-preservation) for details. Safety screening metadata is retained under Anthropic-managed encryption and remains readable after key revocation. These are records derived from Anthropic's automated safety scans, such as pattern identifiers and match indicators, not conversation content.
29Outside of [CSAM screening](https://support.claude.com/en/articles/9020328-csam-detection-and-reporting), preservation requires a human reviewer’s explicit decision and follows Anthropic’s [retention policy for commercial data](https://privacy.claude.com/en/articles/10023548-how-long-do-you-store-my-data). For every instance of preservation, a corresponding [Compliance API Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed) event is generated with a reason code conveying the purpose of the preservation. See [CMEK content preservation](https://platform.claude.com/docs/en/manage-claude/access-transparency#cmek-content-preservation) for details. Safety screening metadata is retained under Anthropic-managed encryption and remains readable after key revocation. These are records derived from Anthropic’s automated safety scans, such as pattern identifiers and match indicators, not conversation content.
3030
manage-claude/cmek-google-cloud-kms Changed · +19 / -19 lines
from line 16
1616
1717* Customer-managed encryption keys (CMEK) are [turned on for your organization](https://platform.claude.com/docs/en/manage-claude/cmek#availability).
1818* You have your Anthropic organization ID, the UUID without the `org_` prefix. Copy it from [Organization](https://platform.claude.com/settings/organization) in the Claude Console, or from **Organization settings > Organization and access** on claude.ai. Whoever creates the key needs it.
19* You're an Organization Admin on Claude Platform, or an Owner or Primary Owner on Claude Enterprise.
20* On Claude Platform, you have a workspace that [retains data](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#data-retention), ideally a new one, because [existing data stays under Anthropic's key](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect).
19* You’re an Organization Admin on Claude Platform, or an Owner or Primary Owner on Claude Enterprise.
20* On Claude Platform, you have a workspace that [retains data](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#data-retention), ideally a new one, because [existing data stays under Anthropic’s key](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect).
2121* On Claude Enterprise, you know [which features turn off or change](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#turned-off-or-changed).
2222
2323In Google Cloud:
from line 24
2424
2525* The Cloud KMS API is turned on.
2626* You can create key rings and keys, and set IAM policy on them (`roles/cloudkms.admin` or equivalent).
27* Cloud KMS [Data Access audit logs](https://docs.cloud.google.com/logging/docs/audit/configure-data-access) (Data Read and Data Write) are on, so Cloud Logging records Anthropic's use of your key. They're off by default.
28* If your Google Cloud organization enforces domain restricted sharing (`constraints/iam.allowedPolicyMemberDomains`), it blocks the grant to Anthropic's service account. Add a project-level exception, or allow Anthropic's Cloud Identity customer ID. Contact Anthropic for the ID.
27* Cloud KMS [Data Access audit logs](https://docs.cloud.google.com/logging/docs/audit/configure-data-access) (Data Read and Data Write) are on, so Cloud Logging records Anthropic’s use of your key. They’re off by default.
28* If your Google Cloud organization enforces domain restricted sharing (`constraints/iam.allowedPolicyMemberDomains`), it blocks the grant to Anthropic’s service account. Add a project-level exception, or allow Anthropic’s Cloud Identity customer ID. Contact Anthropic for the ID.
2929
3030## In Google Cloud: create the key
3131
3232After a failed **Verify** or **Add**, see the [fixes for Google Cloud KMS](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#google-cloud-kms).
3333
34These steps label the key with your Anthropic organization ID in lowercase (`<ORGANIZATION_UUID>`) and grant access to Anthropic's service account:
34These steps label the key with your Anthropic organization ID in lowercase (`<ORGANIZATION_UUID>`) and grant access to Anthropic’s service account:
3535
3636```text wrap
3737anthropic-cmek-client-us@gcp-anthropic-cmek-clients.iam.gserviceaccount.com
from line 72
7272 </Frame>
7373 </Step>
7474
75 <Step title="Open the key's permissions">
75 <Step title="Open the key’s permissions">
7676 On the key ring details page, select the checkbox next to the key. Open the **Permissions** panel and click **Grant access**.
7777 </Step>
7878
79 <Step title="Grant Anthropic's service account access to the key">
79 <Step title="Grant Anthropic’s service account access to the key">
8080 Check that **Resource** shows the key, not the key ring or project. Enter these values:
8181
8282 * **New principals:** `anthropic-cmek-client-us@gcp-anthropic-cmek-clients.iam.gserviceaccount.com`
from line 90
9090 </Step>
9191
9292 <Step title="Copy the full key resource name">
93 On the key ring details page, open the key's **Actions** menu and click **Copy resource name**.
93 On the key ring details page, open the key’s **Actions** menu and click **Copy resource name**.
9494
9595 <Frame caption="Copy the key's full resource name from the actions menu.">
9696 
from line 103
103103 In each command, replace these placeholders:
104104
105105 * **`<your-project-id>`:** your Google Cloud project ID
106 * **`<region>`:** the key's location, such as `us-east5`
107 * **`<your-keyring-name>`:** the key ring's name
108 * **`<your-key-name>`:** the key's name
106 * **`<region>`:** the key’s location, such as `us-east5`
107 * **`<your-keyring-name>`:** the key ring’s name
108 * **`<your-key-name>`:** the key’s name
109109 * **`<ORGANIZATION_UUID>`:** your Anthropic organization ID in lowercase
110110
111111 <Steps>
from line 133
133133 For software protection, omit `--protection-level=hsm`.
134134 </Step>
135135
136 <Step title="Grant Anthropic's service account access to the key">
136 <Step title="Grant Anthropic’s service account access to the key">
137137 Run both commands:
138138
139139 ```bash
from line 186
186186 --update-labels=anthropic-org-<ORGANIZATION_UUID>=true
187187```
188188
189The other values are in the key's full resource name, and the command keeps existing labels. Then skip to [the steps that grant access](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#encryption-key-setup).
189The other values are in the key’s full resource name, and the command keeps existing labels. Then skip to [the steps that grant access](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#encryption-key-setup).
190190
191191## In Claude: add and attach the key
192192
from line 196
196196 <Tab title="Claude Platform">
197197 <Steps>
198198 <Step title="Open the encryption key settings">
199 In the Claude Console, open [Encryption keys](https://platform.claude.com/settings/privacy#encryption-keys) on the Data retention page. If the section isn't there, select **Organization** from the dropdown menu at the top.
199 In the Claude Console, open [Encryption keys](https://platform.claude.com/settings/privacy#encryption-keys) on the Data retention page. If the section isn’t there, select **Organization** from the dropdown menu at the top.
200200 </Step>
201201
202202 <Step title="Add the key">
from line 204
204204 </Step>
205205
206206 <Step title="Enter the key resource name">
207 Check that your key has the **Organization label** shown in the dialog box. Paste the key's full resource name into **Key resource name** and click **Add**.
207 Check that your key has the **Organization label** shown in the dialog box. Paste the key’s full resource name into **Key resource name** and click **Add**.
208208 </Step>
209209
210210 <Step title="Verify the key">
from line 213
213213
214214 <Step title="Attach the key to a workspace">
215215 <Warning>
216 Attaching a key [can't be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). You can't remove it from the workspace or replace it. If the key is deleted, Anthropic can't recover the data it protects.
216 Attaching a key [can’t be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). You can’t remove it from the workspace or replace it. If the key is deleted, Anthropic can’t recover the data it protects.
217217 </Warning>
218218
219219 1. At the top of the Data retention page, select the workspace from the dropdown menu.
from line 220
220220 2. Under **Encryption key**, select the key and click **Save**.
221221 3. Select the checkbox to confirm that you have read the CMEK documentation, then click **Confirm**.
222222
223 You see **Workspace settings updated.** Once the key [takes effect](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect), your cloud provider's audit log shows Anthropic's calls to the key.
223 You see **Workspace settings updated.** Once the key [takes effect](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect), your cloud provider’s audit log shows Anthropic’s calls to the key.
224224
225225 In a [ZDR organization](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#zdr-organizations), after you select the workspace, select **Standard data retention** so that **Encryption key** appears. After you click **Save**, click **Accept** on the data retention terms.
226226 </Step>
from line 231
231231 On Claude Enterprise, CMEK applies to the whole organization, and you can add only one key.
232232
233233 <Warning>
234 Adding a key [can't be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). You can't remove it from the organization or replace it. If the key is deleted, Anthropic can't recover the data it protects.
234 Adding a key [can’t be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). You can’t remove it from the organization or replace it. If the key is deleted, Anthropic can’t recover the data it protects.
235235 </Warning>
236236
237237 Adding the key [turns off or changes some features](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#turned-off-or-changed) for every user. To try CMEK first, use a separate organization.
from line 246
246246 </Step>
247247
248248 <Step title="Enter the key resource name">
249 Check that your key has the **Organization label** shown in the dialog box. Paste the key's full resource name into **Key resource name** and click **Add**.
249 Check that your key has the **Organization label** shown in the dialog box. Paste the key’s full resource name into **Key resource name** and click **Add**.
250250 </Step>
251251
252252 <Step title="Confirm that the key was added">
manage-claude/cmek-how-it-works Changed · +5 / -5 lines
from line 14
1414 
1515</Frame>
1616
17Anthropic keeps no copy of your key, so without it, Claude [can't read the data it protects](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle).
17Anthropic keeps no copy of your key, so without it, Claude [can’t read the data it protects](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle).
1818
1919## What one key protects
2020
from line 32
3232
3333## When your key takes effect
3434
35Your key protects only data written after it takes effect. Existing data (prior chats, files, and sessions) stays under Anthropic's key and isn't re-encrypted.
35Your key protects only data written after it takes effect. Existing data (prior chats, files, and sessions) stays under Anthropic’s key and isn’t re-encrypted.
3636
37On Claude Platform and Claude Platform on AWS, a key attached to a workspace before its first request takes effect with that request. In a workspace in use, your key can take up to a day to take effect, and data written meanwhile stays under Anthropic's key. That's why Anthropic recommends a new workspace.
37On Claude Platform and Claude Platform on AWS, a key attached to a workspace before its first request takes effect with that request. In a workspace in use, your key can take up to a day to take effect, and data written meanwhile stays under Anthropic’s key. That’s why Anthropic recommends a new workspace.
3838
3939## What you can see
4040
41Your cloud's audit log can record every operation Anthropic performs with your key. Where you have to turn that logging on, your setup page lists it as a prerequisite. In AWS CloudTrail, some entries are [expected errors](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#cloudtrail).
41Your cloud’s audit log can record every operation Anthropic performs with your key. Where you have to turn that logging on, your setup page lists it as a prerequisite. In AWS CloudTrail, some entries are [expected errors](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#cloudtrail).
4242
43Changes to your CMEK configuration appear in the [Compliance API Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed). Key operations don't.
43Changes to your CMEK configuration appear in the [Compliance API Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed). Key operations don’t.
4444
4545## Latency and standards
4646
manage-claude/cmek-key-lifecycle Changed · +8 / -8 lines
## If Anthropic can’t reach your key ## If Anthropic can't reach your key
from line 14
1414
1515| Action | What happens | Can you undo it? |
1616| ----------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
17| Attach the key to a workspace (on Claude Enterprise, add it to the organization) | Your key protects data written [after it takes effect](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect). On Claude Platform, attaching also locks the workspace's [data retention setting](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#data-retention). | No. The key can't be removed or replaced. |
17| Attach the key to a workspace (on Claude Enterprise, add it to the organization) | Your key protects data written [after it takes effect](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect). On Claude Platform, attaching also locks the workspace’s [data retention setting](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#data-retention). | No. The key can’t be removed or replaced. |
1818| Rotate the key material within the same key | You rotate it in your KMS, on your own schedule. Rotation needs no action in Claude. | Nothing to undo. Keep earlier key versions enabled. |
19| Disable the key, or remove (revoke) Anthropic's access to it | The change can take up to 1 hour to apply, and requests in flight during that hour might still succeed. After that, Claude can't read or write the data the key protects, and requests fail. | Re-enable the key or restore Anthropic's access. [Two limits apply](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#restore-access). |
20| Delete the key in your KMS, schedule it for deletion, or destroy its key material | Anthropic can't recover the data the key protects. | Not by Anthropic. It keeps no copy of your key. |
21| Delete the key's record in Claude (**Delete encryption key** in the Claude Console) | You can do this only while no workspace, including an archived one, uses the key. | No. |
19| Disable the key, or remove (revoke) Anthropic’s access to it | The change can take up to 1 hour to apply, and requests in flight during that hour might still succeed. After that, Claude can’t read or write the data the key protects, and requests fail. | Re-enable the key or restore Anthropic’s access. [Two limits apply](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#restore-access). |
20| Delete the key in your KMS, schedule it for deletion, or destroy its key material | Anthropic can’t recover the data the key protects. | Not by Anthropic. It keeps no copy of your key. |
21| Delete the key’s record in Claude (**Delete encryption key** in the Claude Console) | You can do this only while no workspace, including an archived one, uses the key. | No. |
2222
2323## What disabling does, and what comes back
2424
2525While the key is disabled, Messages API requests in a workspace that uses it return [a 400 error with the code `cmek_key_disabled`](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#cmek-key-disabled).
2626
27Re-enabling the key, or restoring Anthropic's access to it, brings back access to the data the key protects. Two limits apply. Requests that failed while the key was disabled aren't retried. Disabling the key doesn't pause retention periods.
27Re-enabling the key, or restoring Anthropic’s access to it, brings back access to the data the key protects. Two limits apply. Requests that failed while the key was disabled aren’t retried. Disabling the key doesn’t pause retention periods.
2828
29## If Anthropic can't reach your key
29## If Anthropic can’t reach your key
3030
31Requests that store data under your key fail while Anthropic can't reach it, for example during an outage of your KMS. On Claude Enterprise, these requests include messages in chat and in voice mode.
31Requests that store data under your key fail while Anthropic can’t reach it, for example during an outage of your KMS. On Claude Enterprise, these requests include messages in chat and in voice mode.
3232
3333On the Messages API, these requests return a 503 error with the code `cmek_key_unreachable`, and you can retry them. The Message Batches API retries them for you until your key is available or the batch expires.
3434
3535## Change keys or stop using CMEK
3636
37A workspace or organization can't switch to a different key or go back to having none. On Claude Platform, you can create a new workspace with a different key, or with no key, and move your traffic to it. On Claude Enterprise, there's no way to change keys or stop using CMEK within the organization.
37A workspace or organization can’t switch to a different key or go back to having none. On Claude Platform, you can create a new workspace with a different key, or with no key, and move your traffic to it. On Claude Enterprise, there’s no way to change keys or stop using CMEK within the organization.
3838