One read of Claude Developer Platformapi-20261110T043707Z
343 pages moved out of 893 read.
Pages moved
343
significant first
Pages read
893
in this capture
Captured
04:37 UTC
Corpus hash
9b50913f24d5
corpus-hash
What this read moved
101-125 of 343, page 5 of 14This capture is too large to show at once. Changes 101-125 of 343 are below, significant first; the rest are on the following screens.
api/beta/sessions/threads/events/list Changed · +6 / -0 lines
from line 141
141141
142142 - `"webhooks-2026-10-07"`
143143
144 - `"admin-user-sign-out-2026-10-08"`
145
144146 - `"message-threads-2026-08-12"`
145147
146148 - `"analytics-usage-cost-2026-08-24"`
from line 1940
19381940 The model that will power your agent.
19391941
19401942 See [models](https://docs.anthropic.com/en/docs/models-overview) for additional details and options.
1943
1944 - `"claude-fable-5-2"`
1945
1946 Built for the most ambitious work in coding, enterprise workflows, and the sciences
19411947
19421948 - `"claude-haiku-5-5"`
19431949
api/beta/sessions/threads/events/stream Changed · +6 / -0 lines
from line 143
143143
144144 - `"webhooks-2026-10-07"`
145145
146 - `"admin-user-sign-out-2026-10-08"`
147
146148 - `"message-threads-2026-08-12"`
147149
148150 - `"analytics-usage-cost-2026-08-24"`
from line 1942
19401942 The model that will power your agent.
19411943
19421944 See [models](https://docs.anthropic.com/en/docs/models-overview) for additional details and options.
1945
1946 - `"claude-fable-5-2"`
1947
1948 Built for the most ambitious work in coding, enterprise workflows, and the sciences
19431949
19441950 - `"claude-haiku-5-5"`
19451951
api/beta/sessions/threads/list Changed · +6 / -0 lines
from line 157
157157
158158 - `"webhooks-2026-10-07"`
159159
160 - `"admin-user-sign-out-2026-10-08"`
161
160162 - `"message-threads-2026-08-12"`
161163
162164 - `"analytics-usage-cost-2026-08-24"`
from line 234
232234 The model that will power your agent.
233235
234236 See [models](https://docs.anthropic.com/en/docs/models-overview) for additional details and options.
237
238 - `"claude-fable-5-2"`
239
240 Built for the most ambitious work in coding, enterprise workflows, and the sciences
235241
236242 - `"claude-haiku-5-5"`
237243
api/beta/sessions/threads/retrieve Changed · +6 / -0 lines
from line 133
133133
134134 - `"webhooks-2026-10-07"`
135135
136 - `"admin-user-sign-out-2026-10-08"`
137
136138 - `"message-threads-2026-08-12"`
137139
138140 - `"analytics-usage-cost-2026-08-24"`
from line 210
208210 The model that will power your agent.
209211
210212 See [models](https://docs.anthropic.com/en/docs/models-overview) for additional details and options.
213
214 - `"claude-fable-5-2"`
215
216 Built for the most ambitious work in coding, enterprise workflows, and the sciences
211217
212218 - `"claude-haiku-5-5"`
213219
api/beta/sessions/update Changed · +6 / -0 lines
from line 131
131131
132132 - `"webhooks-2026-10-07"`
133133
134 - `"admin-user-sign-out-2026-10-08"`
135
134136 - `"message-threads-2026-08-12"`
135137
136138 - `"analytics-usage-cost-2026-08-24"`
from line 788
786788 The model that will power your agent.
787789
788790 See [models](https://docs.anthropic.com/en/docs/models-overview) for additional details and options.
791
792 - `"claude-fable-5-2"`
793
794 Built for the most ambitious work in coding, enterprise workflows, and the sciences
789795
790796 - `"claude-haiku-5-5"`
791797
api/beta/skills Changed · +18 / -0 lines
from line 129
129129
130130 - `"webhooks-2026-10-07"`
131131
132 - `"admin-user-sign-out-2026-10-08"`
133
132134 - `"message-threads-2026-08-12"`
133135
134136 - `"analytics-usage-cost-2026-08-24"`
from line 402
400402
401403 - `"webhooks-2026-10-07"`
402404
405 - `"admin-user-sign-out-2026-10-08"`
406
403407 - `"message-threads-2026-08-12"`
404408
405409 - `"analytics-usage-cost-2026-08-24"`
from line 655
651655
652656 - `"webhooks-2026-10-07"`
653657
658 - `"admin-user-sign-out-2026-10-08"`
659
654660 - `"message-threads-2026-08-12"`
655661
656662 - `"analytics-usage-cost-2026-08-24"`
from line 895
889895
890896 - `"webhooks-2026-10-07"`
891897
898 - `"admin-user-sign-out-2026-10-08"`
899
892900 - `"message-threads-2026-08-12"`
893901
894902 - `"analytics-usage-cost-2026-08-24"`
from line 1192
11841192
11851193 - `"webhooks-2026-10-07"`
11861194
1195 - `"admin-user-sign-out-2026-10-08"`
1196
11871197 - `"message-threads-2026-08-12"`
11881198
11891199 - `"analytics-usage-cost-2026-08-24"`
from line 1425
14151425
14161426 - `"webhooks-2026-10-07"`
14171427
1428 - `"admin-user-sign-out-2026-10-08"`
1429
14181430 - `"message-threads-2026-08-12"`
14191431
14201432 - `"analytics-usage-cost-2026-08-24"`
from line 1653
16411653
16421654 - `"webhooks-2026-10-07"`
16431655
1656 - `"admin-user-sign-out-2026-10-08"`
1657
16441658 - `"message-threads-2026-08-12"`
16451659
16461660 - `"analytics-usage-cost-2026-08-24"`
from line 1813
17991813
18001814 - `"webhooks-2026-10-07"`
18011815
1816 - `"admin-user-sign-out-2026-10-08"`
1817
18021818 - `"message-threads-2026-08-12"`
18031819
18041820 - `"analytics-usage-cost-2026-08-24"`
from line 2027
20112027 - `"telemetry-destinations-2026-08-11"`
20122028
20132029 - `"webhooks-2026-10-07"`
2030
2031 - `"admin-user-sign-out-2026-10-08"`
20142032
20152033 - `"message-threads-2026-08-12"`
20162034
api/beta/skills/versions Changed · +10 / -0 lines
from line 137
137137
138138 - `"webhooks-2026-10-07"`
139139
140 - `"admin-user-sign-out-2026-10-08"`
141
140142 - `"message-threads-2026-08-12"`
141143
142144 - `"analytics-usage-cost-2026-08-24"`
from line 370
368370
369371 - `"webhooks-2026-10-07"`
370372
373 - `"admin-user-sign-out-2026-10-08"`
374
371375 - `"message-threads-2026-08-12"`
372376
373377 - `"analytics-usage-cost-2026-08-24"`
from line 598
594598
595599 - `"webhooks-2026-10-07"`
596600
601 - `"admin-user-sign-out-2026-10-08"`
602
597603 - `"message-threads-2026-08-12"`
598604
599605 - `"analytics-usage-cost-2026-08-24"`
from line 758
752758
753759 - `"webhooks-2026-10-07"`
754760
761 - `"admin-user-sign-out-2026-10-08"`
762
755763 - `"message-threads-2026-08-12"`
756764
757765 - `"analytics-usage-cost-2026-08-24"`
from line 972
964972 - `"telemetry-destinations-2026-08-11"`
965973
966974 - `"webhooks-2026-10-07"`
975
976 - `"admin-user-sign-out-2026-10-08"`
967977
968978 - `"message-threads-2026-08-12"`
969979
api/beta/tunnels Changed · +20 / -0 lines
from line 131
131131
132132 - `"webhooks-2026-10-07"`
133133
134 - `"admin-user-sign-out-2026-10-08"`
135
134136 - `"message-threads-2026-08-12"`
135137
136138 - `"analytics-usage-cost-2026-08-24"`
from line 341
339341
340342 - `"webhooks-2026-10-07"`
341343
344 - `"admin-user-sign-out-2026-10-08"`
345
342346 - `"message-threads-2026-08-12"`
343347
344348 - `"analytics-usage-cost-2026-08-24"`
from line 551
547551
548552 - `"webhooks-2026-10-07"`
549553
554 - `"admin-user-sign-out-2026-10-08"`
555
550556 - `"message-threads-2026-08-12"`
551557
552558 - `"analytics-usage-cost-2026-08-24"`
from line 760
754760
755761 - `"webhooks-2026-10-07"`
756762
763 - `"admin-user-sign-out-2026-10-08"`
764
757765 - `"message-threads-2026-08-12"`
758766
759767 - `"analytics-usage-cost-2026-08-24"`
from line 961
953961
954962 - `"webhooks-2026-10-07"`
955963
964 - `"admin-user-sign-out-2026-10-08"`
965
956966 - `"message-threads-2026-08-12"`
957967
958968 - `"analytics-usage-cost-2026-08-24"`
from line 1143
11331143
11341144 - `"webhooks-2026-10-07"`
11351145
1146 - `"admin-user-sign-out-2026-10-08"`
1147
11361148 - `"message-threads-2026-08-12"`
11371149
11381150 - `"analytics-usage-cost-2026-08-24"`
from line 1386
13741386
13751387 - `"webhooks-2026-10-07"`
13761388
1389 - `"admin-user-sign-out-2026-10-08"`
1390
13771391 - `"message-threads-2026-08-12"`
13781392
13791393 - `"analytics-usage-cost-2026-08-24"`
from line 1609
15951609
15961610 - `"webhooks-2026-10-07"`
15971611
1612 - `"admin-user-sign-out-2026-10-08"`
1613
15981614 - `"message-threads-2026-08-12"`
15991615
16001616 - `"analytics-usage-cost-2026-08-24"`
from line 1832
18161832
18171833 - `"webhooks-2026-10-07"`
18181834
1835 - `"admin-user-sign-out-2026-10-08"`
1836
18191837 - `"message-threads-2026-08-12"`
18201838
18211839 - `"analytics-usage-cost-2026-08-24"`
from line 2051
20332051 - `"telemetry-destinations-2026-08-11"`
20342052
20352053 - `"webhooks-2026-10-07"`
2054
2055 - `"admin-user-sign-out-2026-10-08"`
20362056
20372057 - `"message-threads-2026-08-12"`
20382058
api/beta/tunnels/certificates Changed · +8 / -0 lines
from line 137
137137
138138 - `"webhooks-2026-10-07"`
139139
140 - `"admin-user-sign-out-2026-10-08"`
141
140142 - `"message-threads-2026-08-12"`
141143
142144 - `"analytics-usage-cost-2026-08-24"`
from line 360
358360
359361 - `"webhooks-2026-10-07"`
360362
363 - `"admin-user-sign-out-2026-10-08"`
364
361365 - `"message-threads-2026-08-12"`
362366
363367 - `"analytics-usage-cost-2026-08-24"`
from line 583
579583
580584 - `"webhooks-2026-10-07"`
581585
586 - `"admin-user-sign-out-2026-10-08"`
587
582588 - `"message-threads-2026-08-12"`
583589
584590 - `"analytics-usage-cost-2026-08-24"`
from line 802
796802 - `"telemetry-destinations-2026-08-11"`
797803
798804 - `"webhooks-2026-10-07"`
805
806 - `"admin-user-sign-out-2026-10-08"`
799807
800808 - `"message-threads-2026-08-12"`
801809
api/beta/user_profiles Changed · +14 / -0 lines
from line 129
129129
130130 - `"webhooks-2026-10-07"`
131131
132 - `"admin-user-sign-out-2026-10-08"`
133
132134 - `"message-threads-2026-08-12"`
133135
134136 - `"analytics-usage-cost-2026-08-24"`
from line 580
578580
579581 - `"webhooks-2026-10-07"`
580582
583 - `"admin-user-sign-out-2026-10-08"`
584
581585 - `"message-threads-2026-08-12"`
582586
583587 - `"analytics-usage-cost-2026-08-24"`
from line 896
892896
893897 - `"webhooks-2026-10-07"`
894898
899 - `"admin-user-sign-out-2026-10-08"`
900
895901 - `"message-threads-2026-08-12"`
896902
897903 - `"analytics-usage-cost-2026-08-24"`
from line 1205
11991205
12001206 - `"webhooks-2026-10-07"`
12011207
1208 - `"admin-user-sign-out-2026-10-08"`
1209
12021210 - `"message-threads-2026-08-12"`
12031211
12041212 - `"analytics-usage-cost-2026-08-24"`
from line 1618
16101618
16111619 - `"webhooks-2026-10-07"`
16121620
1621 - `"admin-user-sign-out-2026-10-08"`
1622
16131623 - `"message-threads-2026-08-12"`
16141624
16151625 - `"analytics-usage-cost-2026-08-24"`
from line 1793
17831793
17841794 - `"webhooks-2026-10-07"`
17851795
1796 - `"admin-user-sign-out-2026-10-08"`
1797
17861798 - `"message-threads-2026-08-12"`
17871799
17881800 - `"analytics-usage-cost-2026-08-24"`
from line 2272
22602272 - `"telemetry-destinations-2026-08-11"`
22612273
22622274 - `"webhooks-2026-10-07"`
2275
2276 - `"admin-user-sign-out-2026-10-08"`
22632277
22642278 - `"message-threads-2026-08-12"`
22652279
api/beta/vaults Changed · +26 / -0 lines
from line 129
129129
130130 - `"webhooks-2026-10-07"`
131131
132 - `"admin-user-sign-out-2026-10-08"`
133
132134 - `"message-threads-2026-08-12"`
133135
134136 - `"analytics-usage-cost-2026-08-24"`
from line 365
363365
364366 - `"webhooks-2026-10-07"`
365367
368 - `"admin-user-sign-out-2026-10-08"`
369
366370 - `"message-threads-2026-08-12"`
367371
368372 - `"analytics-usage-cost-2026-08-24"`
from line 581
577581
578582 - `"webhooks-2026-10-07"`
579583
584 - `"admin-user-sign-out-2026-10-08"`
585
580586 - `"message-threads-2026-08-12"`
581587
582588 - `"analytics-usage-cost-2026-08-24"`
from line 788
782788
783789 - `"webhooks-2026-10-07"`
784790
791 - `"admin-user-sign-out-2026-10-08"`
792
785793 - `"message-threads-2026-08-12"`
786794
787795 - `"analytics-usage-cost-2026-08-24"`
from line 1014
10061014
10071015 - `"webhooks-2026-10-07"`
10081016
1017 - `"admin-user-sign-out-2026-10-08"`
1018
10091019 - `"message-threads-2026-08-12"`
10101020
10111021 - `"analytics-usage-cost-2026-08-24"`
from line 1189
11791189
11801190 - `"webhooks-2026-10-07"`
11811191
1192 - `"admin-user-sign-out-2026-10-08"`
1193
11821194 - `"message-threads-2026-08-12"`
11831195
11841196 - `"analytics-usage-cost-2026-08-24"`
from line 1451
14391451
14401452 - `"webhooks-2026-10-07"`
14411453
1454 - `"admin-user-sign-out-2026-10-08"`
1455
14421456 - `"message-threads-2026-08-12"`
14431457
14441458 - `"analytics-usage-cost-2026-08-24"`
from line 1987
19731987
19741988 - `"webhooks-2026-10-07"`
19751989
1990 - `"admin-user-sign-out-2026-10-08"`
1991
19761992 - `"message-threads-2026-08-12"`
19771993
19781994 - `"analytics-usage-cost-2026-08-24"`
from line 2330
23142330
23152331 - `"webhooks-2026-10-07"`
23162332
2333 - `"admin-user-sign-out-2026-10-08"`
2334
23172335 - `"message-threads-2026-08-12"`
23182336
23192337 - `"analytics-usage-cost-2026-08-24"`
from line 2664
26462664
26472665 - `"webhooks-2026-10-07"`
26482666
2667 - `"admin-user-sign-out-2026-10-08"`
2668
26492669 - `"message-threads-2026-08-12"`
26502670
26512671 - `"analytics-usage-cost-2026-08-24"`
from line 3147
31273147
31283148 - `"webhooks-2026-10-07"`
31293149
3150 - `"admin-user-sign-out-2026-10-08"`
3151
31303152 - `"message-threads-2026-08-12"`
31313153
31323154 - `"analytics-usage-cost-2026-08-24"`
from line 3326
33043326
33053327 - `"webhooks-2026-10-07"`
33063328
3329 - `"admin-user-sign-out-2026-10-08"`
3330
33073331 - `"message-threads-2026-08-12"`
33083332
33093333 - `"analytics-usage-cost-2026-08-24"`
from line 3660
36363660 - `"telemetry-destinations-2026-08-11"`
36373661
36383662 - `"webhooks-2026-10-07"`
3663
3664 - `"admin-user-sign-out-2026-10-08"`
36393665
36403666 - `"message-threads-2026-08-12"`
36413667
api/beta/vaults/credentials Changed · +14 / -0 lines
from line 135
135135
136136 - `"webhooks-2026-10-07"`
137137
138 - `"admin-user-sign-out-2026-10-08"`
139
138140 - `"message-threads-2026-08-12"`
139141
140142 - `"analytics-usage-cost-2026-08-24"`
from line 671
669671
670672 - `"webhooks-2026-10-07"`
671673
674 - `"admin-user-sign-out-2026-10-08"`
675
672676 - `"message-threads-2026-08-12"`
673677
674678 - `"analytics-usage-cost-2026-08-24"`
from line 1014
10101014
10111015 - `"webhooks-2026-10-07"`
10121016
1017 - `"admin-user-sign-out-2026-10-08"`
1018
10131019 - `"message-threads-2026-08-12"`
10141020
10151021 - `"analytics-usage-cost-2026-08-24"`
from line 1348
13421348
13431349 - `"webhooks-2026-10-07"`
13441350
1351 - `"admin-user-sign-out-2026-10-08"`
1352
13451353 - `"message-threads-2026-08-12"`
13461354
13471355 - `"analytics-usage-cost-2026-08-24"`
from line 1831
18231831
18241832 - `"webhooks-2026-10-07"`
18251833
1834 - `"admin-user-sign-out-2026-10-08"`
1835
18261836 - `"message-threads-2026-08-12"`
18271837
18281838 - `"analytics-usage-cost-2026-08-24"`
from line 2010
20002010
20012011 - `"webhooks-2026-10-07"`
20022012
2013 - `"admin-user-sign-out-2026-10-08"`
2014
20032015 - `"message-threads-2026-08-12"`
20042016
20052017 - `"analytics-usage-cost-2026-08-24"`
from line 2344
23322344 - `"telemetry-destinations-2026-08-11"`
23332345
23342346 - `"webhooks-2026-10-07"`
2347
2348 - `"admin-user-sign-out-2026-10-08"`
23352349
23362350 - `"message-threads-2026-08-12"`
23372351
api/beta/webhooks Changed · +33 / -1 lines
### Beta Webhook User Profile Program Status Updated Event Data
from line 849
849849
850850 - `organization_id: string`
851851
852 - `BetaWebhookUserProfileProgramStatusUpdatedEventData object`
853
854 - `type: "user_profile.program_status_updated"`
855
856 - `id: string`
857
858 ID of the user profile that triggered the event.
859
860 - `organization_id: string`
861
852862### Beta Webhook Event Data
853863
854- `BetaWebhookEventData = BetaWebhookSessionCreatedEventData or BetaWebhookSessionPendingEventData or BetaWebhookSessionRunningEventData or 43 more`
864- `BetaWebhookEventData = BetaWebhookSessionCreatedEventData or BetaWebhookSessionPendingEventData or BetaWebhookSessionRunningEventData or 44 more`
855865
856866 - `BetaWebhookSessionCreatedEventData object`
857867
from line 1447
14371447
14381448 - `organization_id: string`
14391449
1450 - `BetaWebhookUserProfileProgramStatusUpdatedEventData object`
1451
1452 - `type: "user_profile.program_status_updated"`
1453
1454 - `id: string`
1455
1456 ID of the user profile that triggered the event.
1457
1458 - `organization_id: string`
1459
14401460### Beta Webhook Memory Store Archived Event Data
14411461
14421462- `BetaWebhookMemoryStoreArchivedEventData object`
from line 1778
17581778 - `enforcement_action_id: string`
17591779
17601780 ID (`enac_...`) of the enforcement action that was opened or resolved.
1781
1782 - `organization_id: string`
1783
1784### Beta Webhook User Profile Program Status Updated Event Data
1785
1786- `BetaWebhookUserProfileProgramStatusUpdatedEventData object`
1787
1788 - `type: "user_profile.program_status_updated"`
1789
1790 - `id: string`
1791
1792 ID of the user profile that triggered the event.
17611793
17621794 - `organization_id: string`
17631795
api/compliance Changed · +5291 / -17 lines
## Compliance API › Organizations › Security Posture ### Get an organization's security posture
This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.
The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.
from line 19
1919
2020#### Query parameters
2121
22- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "account_migration_completed" or 571 more`
22- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "account_migration_completed" or 589 more`
2323
2424 Filter activities by type. See the response `data` schema for the additional fields each type returns. Cannot be combined with `exclude_activity_types[]`.
2525
from line 266
266266
267267 An organization admin allowed one artifact to be shared outside the organization by link while the organization-wide external sharing setting was off, or revoked that permission.
268268
269 - `"claude_artifact_folder_created"`
270
271 A folder for artifacts was created, inside another folder or in none.
272
273 - `"claude_artifact_folder_moved"`
274
275 A folder for artifacts was moved into, out of or between other folders, by its owner or by someone else, whether or not a folder is shared; the artifacts and folders inside it moved with it and were not recorded as moves of their own.
276
269277 - `"claude_artifact_invite_accepted"`
270278
271279 Someone outside the organization signed in with a verified account for the invited address and accepted an invitation to an artifact, and can now open it; recorded in the artifact owner's organization. The person who accepted is identified by `invitee_email` and `invitee_user_id`.
from line 290
282290
283291 A member changed the access level of an email invitation to an artifact for someone outside the organization, whether the invitation was still pending or had been accepted; recorded in the artifact owner's organization with that member as the actor.
284292
293 - `"claude_artifact_moved"`
294
295 An artifact was moved into, out of or between folders, by its owner or by someone else, whether or not a folder is shared; an artifact that leaves its folder as part of another event, such as its own deletion or the erasure of an account, might not be recorded as a move.
296
285297 - `"claude_artifact_published"`
286298
287 A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded when the artifact is saved, including saves of private artifacts, except that automatic saves made while a person keeps editing may be recorded periodically for that person rather than once per save; changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
299 A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded when the artifact is saved, including saves of private artifacts and, for some artifacts, edits to stored content that make no new version, except that such edits, and automatic saves made while a person keeps editing, may be recorded periodically for that person rather than once per save; changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
288300
289301 - `"claude_artifact_sent_to_partner"`
290302
from line 838
826838
827839 An administrator allowed a skill version despite its security scan's verdict, or that allowance was revoked.
828840
841 - `"claude_skill_served_version_updated"`
842
843 A skill's served version, the version that members get, was updated: an administrator or the owner chose a version, a saved version became the served version, or an accepted library submission was published into the skill. A new version that is served as soon as it is saved may appear only as claude_skill_version_created.
844
845 - `"claude_skill_version_created"`
846
847 A new version of a skill was created.
848
829849 - `"claude_survey_closed"`
830850
831851 An organization admin closed an in-app survey before its end date, ending the collection of responses; a survey that reaches its end date records no event.
from line 1414
13941414
13951415 Organization domain was removed.
13961416
1417 - `"org_domain_sso_enforcement_updated"`
1418
1419 A verified domain's single sign-on requirement changed, per surface.
1420
1421 - `"org_domain_sso_routing_updated"`
1422
1423 A verified domain's single sign-on routing was saved or changed. Lists the identity provider connections the domain's users sign in through before and after; the two lists are the same when a save changed nothing.
1424
13971425 - `"org_domain_verified"`
13981426
13991427 Organization domain was verified.
from line 1458
14301458
14311459 A primary owner accepted the Business Associate Agreement and enabled the HIPAA configuration for the organization through the self-serve flow.
14321460
1461 - `"org_idp_connection_created"`
1462
1463 An identity provider connection was added to the parent organization.
1464
1465 - `"org_idp_connection_deleted"`
1466
1467 An identity provider connection was removed from the parent organization, along with the settings that referenced it.
1468
1469 - `"org_idp_connection_updated"`
1470
1471 An identity provider connection's settings were changed.
1472
14331473 - `"org_invite_link_disabled"`
14341474
14351475 Organization invite link was disabled.
from line 1570
15301570
15311571 Organization parent search was performed.
15321572
1573 - `"org_security_control_attestation_updated"`
1574
1575 The organization's attestation for a security control was recorded, changed, renewed or cleared by an administrator, or was ended automatically.
1576
15331577 - `"org_sso_add_initiated"`
15341578
15351579 Organization SSO setup was initiated.
from line 1698
16541698
16551699 Access to owned projects was restored.
16561700
1701 - `"parent_organization_centralized_management_enrolled"`
1702
1703 A parent organization was enrolled in centralized management.
1704
1705 - `"parent_organization_centralized_management_organization_updated"`
1706
1707 An organization's approval of its parent organization's Centralized Management setup changed, or its administrators were reminded to approve.
1708
1709 - `"parent_organization_centralized_management_setup_updated"`
1710
1711 The Centralized Management setup of a parent organization changed: it was started or abandoned, its proposed administrators changed, its remaining organizations were force approved, or it completed.
1712
1713 - `"parent_organization_centralized_management_unenrolled"`
1714
1715 A parent organization was unenrolled from centralized management.
1716
1717 - `"parent_organization_member_removed"`
1718
1719 A parent-organization admin role was removed from a user.
1720
1721 - `"parent_organization_member_updated"`
1722
1723 A parent-organization admin role was granted or changed for a user.
1724
1725 - `"parent_organization_settings_updated"`
1726
1727 Parent organization settings were updated.
1728
16571729 - `"payment_method_updated"`
16581730
16591731 The organization's default payment method was updated.
from line 2449
23772449
23782450 format: date-time
23792451
2380- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "account_migration_completed" or 571 more`
2452- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "account_migration_completed" or 589 more`
23812453
23822454 Exclude activities of these types. Cannot be combined with `activity_types[]`.
23832455
from line 2696
26242696
26252697 An organization admin allowed one artifact to be shared outside the organization by link while the organization-wide external sharing setting was off, or revoked that permission.
26262698
2699 - `"claude_artifact_folder_created"`
2700
2701 A folder for artifacts was created, inside another folder or in none.
2702
2703 - `"claude_artifact_folder_moved"`
2704
2705 A folder for artifacts was moved into, out of or between other folders, by its owner or by someone else, whether or not a folder is shared; the artifacts and folders inside it moved with it and were not recorded as moves of their own.
2706
26272707 - `"claude_artifact_invite_accepted"`
26282708
26292709 Someone outside the organization signed in with a verified account for the invited address and accepted an invitation to an artifact, and can now open it; recorded in the artifact owner's organization. The person who accepted is identified by `invitee_email` and `invitee_user_id`.
from line 2720
26402720
26412721 A member changed the access level of an email invitation to an artifact for someone outside the organization, whether the invitation was still pending or had been accepted; recorded in the artifact owner's organization with that member as the actor.
26422722
2723 - `"claude_artifact_moved"`
2724
2725 An artifact was moved into, out of or between folders, by its owner or by someone else, whether or not a folder is shared; an artifact that leaves its folder as part of another event, such as its own deletion or the erasure of an account, might not be recorded as a move.
2726
26432727 - `"claude_artifact_published"`
26442728
2645 A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded when the artifact is saved, including saves of private artifacts, except that automatic saves made while a person keeps editing may be recorded periodically for that person rather than once per save; changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
2729 A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded when the artifact is saved, including saves of private artifacts and, for some artifacts, edits to stored content that make no new version, except that such edits, and automatic saves made while a person keeps editing, may be recorded periodically for that person rather than once per save; changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
26462730
26472731 - `"claude_artifact_sent_to_partner"`
26482732
from line 3268
31843268
31853269 An administrator allowed a skill version despite its security scan's verdict, or that allowance was revoked.
31863270
3271 - `"claude_skill_served_version_updated"`
3272
3273 A skill's served version, the version that members get, was updated: an administrator or the owner chose a version, a saved version became the served version, or an accepted library submission was published into the skill. A new version that is served as soon as it is saved may appear only as claude_skill_version_created.
3274
3275 - `"claude_skill_version_created"`
3276
3277 A new version of a skill was created.
3278
31873279 - `"claude_survey_closed"`
31883280
31893281 An organization admin closed an in-app survey before its end date, ending the collection of responses; a survey that reaches its end date records no event.
from line 3844
37523844
37533845 Organization domain was removed.
37543846
3847 - `"org_domain_sso_enforcement_updated"`
3848
3849 A verified domain's single sign-on requirement changed, per surface.
3850
3851 - `"org_domain_sso_routing_updated"`
3852
3853 A verified domain's single sign-on routing was saved or changed. Lists the identity provider connections the domain's users sign in through before and after; the two lists are the same when a save changed nothing.
3854
37553855 - `"org_domain_verified"`
37563856
37573857 Organization domain was verified.
from line 3888
37883888
37893889 A primary owner accepted the Business Associate Agreement and enabled the HIPAA configuration for the organization through the self-serve flow.
37903890
3891 - `"org_idp_connection_created"`
3892
3893 An identity provider connection was added to the parent organization.
3894
3895 - `"org_idp_connection_deleted"`
3896
3897 An identity provider connection was removed from the parent organization, along with the settings that referenced it.
3898
3899 - `"org_idp_connection_updated"`
3900
3901 An identity provider connection's settings were changed.
3902
37913903 - `"org_invite_link_disabled"`
37923904
37933905 Organization invite link was disabled.
from line 4000
38884000
38894001 Organization parent search was performed.
38904002
4003 - `"org_security_control_attestation_updated"`
4004
4005 The organization's attestation for a security control was recorded, changed, renewed or cleared by an administrator, or was ended automatically.
4006
38914007 - `"org_sso_add_initiated"`
38924008
38934009 Organization SSO setup was initiated.
from line 4128
40124128
40134129 Access to owned projects was restored.
40144130
4131 - `"parent_organization_centralized_management_enrolled"`
4132
4133 A parent organization was enrolled in centralized management.
4134
4135 - `"parent_organization_centralized_management_organization_updated"`
4136
4137 An organization's approval of its parent organization's Centralized Management setup changed, or its administrators were reminded to approve.
4138
4139 - `"parent_organization_centralized_management_setup_updated"`
4140
4141 The Centralized Management setup of a parent organization changed: it was started or abandoned, its proposed administrators changed, its remaining organizations were force approved, or it completed.
4142
4143 - `"parent_organization_centralized_management_unenrolled"`
4144
4145 A parent organization was unenrolled from centralized management.
4146
4147 - `"parent_organization_member_removed"`
4148
4149 A parent-organization admin role was removed from a user.
4150
4151 - `"parent_organization_member_updated"`
4152
4153 A parent-organization admin role was granted or changed for a user.
4154
4155 - `"parent_organization_settings_updated"`
4156
4157 Parent organization settings were updated.
4158
40154159 - `"payment_method_updated"`
40164160
40174161 The organization's default payment method was updated.
from line 4859
47154859
47164860- `organization_ids: optional array of string`
47174861
4718 Filter activities by organization IDs (accepts `org_...` or organization UUID). Enumerate IDs via `GET /v1/compliance/organizations`.
4862 Filter activities by organization IDs (accepts `org_...` or organization UUID, up to 20). Enumerate IDs via `GET /v1/compliance/organizations`.
47194863
47204864- `user_ids: optional array of string`
47214865
from line 4877
47334877
47344878#### Returns
47354879
4736- `data: optional array of AbuseDecisionReceived or AccountDeleted or AccountMigrationCompleted or 571 more`
4880- `data: optional array of AbuseDecisionReceived or AccountDeleted or AccountMigrationCompleted or 589 more`
47374881
47384882 List of activity records. Each element's `type` field identifies which activity it is and which additional fields are present.
47394883
from line 9766
96229766
96239767 - `ClaudeArtifactPublished object`
96249768
9625 A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded when the artifact is saved, including saves of private artifacts, except that automatic saves made while a person keeps editing may be recorded periodically for that person rather than once per save; changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
9769 A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded when the artifact is saved, including saves of private artifacts and, for some artifacts, edits to stored content that make no new version, except that such edits, and automatic saves made while a person keeps editing, may be recorded periodically for that person rather than once per save; changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
96269770
96279771 - `type: optional "claude_artifact_published"`
96289772
from line 10242
1009810242
1009910243 - `audience: array of Organization or Users or AnyoneWithLink`
1010010244
10101 The artifact's sharing audience after the change. If empty, the artifact is visible only to its owner.
10245 The artifact's own sharing audience after the change. If empty, the artifact itself is not shared with named users, its organization or anyone with the link, but people can still have access in other ways, such as through a folder it is in or a folder above that one. Changes people make to a folder's sharing are recorded as `role_assignment_granted` and `role_assignment_revoked` activities on the folder, and moves as `claude_artifact_moved` and `claude_artifact_folder_moved`.
1010210246
1010310247 - `Organization object`
1010410248
from line 22142
2199822142
2199922143 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
2200022144
22145 - `ClaudeArtifactFolderCreated object`
22146
22147 A folder for artifacts was created, inside another folder or in none.
22148
22149 - `type: optional "claude_artifact_folder_created"`
22150
22151 default: claude_artifact_folder_created
22152
22153 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
22154
22155 - `APIActor object`
22156
22157 - `type: optional "api_actor"`
22158
22159 default: api_actor
22160
22161 - `api_key_id: string`
22162
22163 - `ip_address: string`
22164
22165 - `user_agent: string`
22166
22167 - `UserActor object`
22168
22169 - `type: optional "user_actor"`
22170
22171 default: user_actor
22172
22173 - `email_address: string`
22174
22175 format: email
22176
22177 - `ip_address: string`
22178
22179 - `user_agent: string`
22180
22181 - `user_id: string`
22182
22183 - `UnauthenticatedUserActor object`
22184
22185 - `type: optional "unauthenticated_user_actor"`
22186
22187 default: unauthenticated_user_actor
22188
22189 - `ip_address: string`
22190
22191 - `user_agent: string`
22192
22193 - `unauthenticated_email_address: optional string or null`
22194
22195 format: email
22196
22197 - `AnthropicActor object`
22198
22199 - `type: optional "anthropic_actor"`
22200
22201 default: anthropic_actor
22202
22203 - `email_address: optional string or null`
22204
22205 format: email
22206
22207 - `SystemActor object`
22208
22209 Automated background processing performed by Anthropic systems, acting
22210 without a user or customer credential.
22211
22212 - `type: optional "system_actor"`
22213
22214 default: system_actor
22215
22216 - `service: optional string or null`
22217
22218 Name of the automated process that performed the action, when known.
22219
22220 - `AdminAPIKeyActor object`
22221
22222 - `type: optional "admin_api_key_actor"`
22223
22224 default: admin_api_key_actor
22225
22226 - `admin_api_key_id: string`
22227
22228 - `ip_address: string`
22229
22230 - `user_agent: string`
22231
22232 - `ServiceAccountActor object`
22233
22234 - `type: optional "service_account_actor"`
22235
22236 default: service_account_actor
22237
22238 - `ip_address: string`
22239
22240 - `service_account_id: string`
22241
22242 - `user_agent: string`
22243
22244 - `ScimDirectorySyncActor object`
22245
22246 - `type: optional "scim_directory_sync_actor"`
22247
22248 default: scim_directory_sync_actor
22249
22250 - `directory_id: string`
22251
22252 - `workos_event_id: string`
22253
22254 - `idp_connection_type: optional string or null`
22255
22256 - `FederatedIdentityActor object`
22257
22258 A federated external workload authenticated via a verified OIDC token.
22259
22260 Carries the verified issuer, subject, and audience claims from the
22261 presented JWT.
22262
22263 - `type: optional "federated_identity_actor"`
22264
22265 default: federated_identity_actor
22266
22267 - `issuer: string`
22268
22269 - `subject: string`
22270
22271 - `audience: optional array of string`
22272
22273 - `ip_address: optional string or null`
22274
22275 - `user_agent: optional string or null`
22276
22277 - `FederatedActor object`
22278
22279 An external identity asserted by a trusted provider — a cloud-provider
22280 gateway or a customer-registered federation issuer — acting without an
22281 Anthropic-provisioned account or service account.
22282
22283 - `type: optional "federated_actor"`
22284
22285 default: federated_actor
22286
22287 - `provider: Aws or Azure or Gcp or Oidc`
22288
22289 - `Aws object`
22290
22291 Asserting party: the AWS account the organization is bound to.
22292
22293 - `type: optional "aws"`
22294
22295 default: aws
22296
22297 - `account_id: string`
22298
22299 - `signed_principal: string`
22300
22301 The AWS-signed ARN of the IAM principal that requested the token.
22302
22303 - `Azure object`
22304
22305 Asserting party: the Azure subscription the organization is bound to.
22306
22307 - `type: optional "azure"`
22308
22309 default: azure
22310
22311 - `subscription_id: string`
22312
22313 - `Gcp object`
22314
22315 Asserting party: the GCP project the organization is bound to.
22316
22317 - `type: optional "gcp"`
22318
22319 default: gcp
22320
22321 - `project_number: string`
22322
22323 - `Oidc object`
22324
22325 Asserting party: a customer-registered OIDC federation issuer.
22326
22327 - `type: optional "oidc"`
22328
22329 default: oidc
22330
22331 - `issuer: optional string or null`
22332
22333 The federation issuer's URL. Null when the presented credential failed verification.
22334
22335 - `ip_address: optional string or null`
22336
22337 - `subject: optional string or null`
22338
22339 The provider's verified identifier for the caller; its form depends on the provider.
22340
22341 - `user_agent: optional string or null`
22342
22343 - `AttestedDeviceActor object`
22344
22345 An attested mobile device authenticated via Apple App Attest.
22346
22347 - `type: optional "attested_device_actor"`
22348
22349 default: attested_device_actor
22350
22351 - `external_client_id: string`
22352
22353 - `kid_hash: string`
22354
22355 - `ip_address: optional string or null`
22356
22357 - `user_agent: optional string or null`
22358
22359 - `claude_artifact_folder_id: string`
22360
22361 Tagged ID ("cfld_...") of the folder that was created.
22362
22363 - `id: optional string`
22364
22365 Unique identifier for the activity e.g. 'activity_abcd1234'
22366
22367 - `created_at: optional string`
22368
22369 When this activity occurred.
22370
22371 format: date-time
22372
22373 - `organization_id: optional string or null`
22374
22375 Organization ID this activity is associated with
22376
22377 - `organization_uuid: optional string or null`
22378
22379 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
22380
22381 - `parent_claude_artifact_folder_id: optional string or null`
22382
22383 Tagged ID ("cfld_...") of the folder that the new folder was created directly inside; absent when it was created in no other folder.
22384
22385 - `ClaudeArtifactFolderMoved object`
22386
22387 A folder for artifacts was moved into, out of or between other folders, by its owner or by someone else, whether or not a folder is shared; the artifacts and folders inside it moved with it and were not recorded as moves of their own.
22388
22389 - `type: optional "claude_artifact_folder_moved"`
22390
22391 default: claude_artifact_folder_moved
22392
22393 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
22394
22395 - `APIActor object`
22396
22397 - `type: optional "api_actor"`
22398
22399 default: api_actor
22400
22401 - `api_key_id: string`
22402
22403 - `ip_address: string`
22404
22405 - `user_agent: string`
22406
22407 - `UserActor object`
22408
22409 - `type: optional "user_actor"`
22410
22411 default: user_actor
22412
22413 - `email_address: string`
22414
22415 format: email
22416
22417 - `ip_address: string`
22418
22419 - `user_agent: string`
22420
22421 - `user_id: string`
22422
22423 - `UnauthenticatedUserActor object`
22424
22425 - `type: optional "unauthenticated_user_actor"`
22426
22427 default: unauthenticated_user_actor
22428
22429 - `ip_address: string`
22430
22431 - `user_agent: string`
22432
22433 - `unauthenticated_email_address: optional string or null`
22434
22435 format: email
22436
22437 - `AnthropicActor object`
22438
22439 - `type: optional "anthropic_actor"`
22440
22441 default: anthropic_actor
22442
22443 - `email_address: optional string or null`
22444
22445 format: email
22446
22447 - `SystemActor object`
22448
22449 Automated background processing performed by Anthropic systems, acting
22450 without a user or customer credential.
22451
22452 - `type: optional "system_actor"`
22453
22454 default: system_actor
22455
22456 - `service: optional string or null`
22457
22458 Name of the automated process that performed the action, when known.
22459
22460 - `AdminAPIKeyActor object`
22461
22462 - `type: optional "admin_api_key_actor"`
22463
22464 default: admin_api_key_actor
22465
22466 - `admin_api_key_id: string`
22467
22468 - `ip_address: string`
22469
22470 - `user_agent: string`
22471
22472 - `ServiceAccountActor object`
22473
22474 - `type: optional "service_account_actor"`
22475
22476 default: service_account_actor
22477
22478 - `ip_address: string`
22479
22480 - `service_account_id: string`
22481
22482 - `user_agent: string`
22483
22484 - `ScimDirectorySyncActor object`
22485
22486 - `type: optional "scim_directory_sync_actor"`
22487
22488 default: scim_directory_sync_actor
22489
22490 - `directory_id: string`
22491
22492 - `workos_event_id: string`
22493
22494 - `idp_connection_type: optional string or null`
22495
22496 - `FederatedIdentityActor object`
22497
22498 A federated external workload authenticated via a verified OIDC token.
22499
22500 Carries the verified issuer, subject, and audience claims from the
22501 presented JWT.
22502
22503 - `type: optional "federated_identity_actor"`
22504
22505 default: federated_identity_actor
22506
22507 - `issuer: string`
22508
22509 - `subject: string`
22510
22511 - `audience: optional array of string`
22512
22513 - `ip_address: optional string or null`
22514
22515 - `user_agent: optional string or null`
22516
22517 - `FederatedActor object`
22518
22519 An external identity asserted by a trusted provider — a cloud-provider
22520 gateway or a customer-registered federation issuer — acting without an
22521 Anthropic-provisioned account or service account.
22522
22523 - `type: optional "federated_actor"`
22524
22525 default: federated_actor
22526
22527 - `provider: Aws or Azure or Gcp or Oidc`
22528
22529 - `Aws object`
22530
22531 Asserting party: the AWS account the organization is bound to.
22532
22533 - `type: optional "aws"`
22534
22535 default: aws
22536
22537 - `account_id: string`
22538
22539 - `signed_principal: string`
22540
22541 The AWS-signed ARN of the IAM principal that requested the token.
22542
22543 - `Azure object`
22544
22545 Asserting party: the Azure subscription the organization is bound to.
22546
22547 - `type: optional "azure"`
22548
22549 default: azure
22550
22551 - `subscription_id: string`
22552
22553 - `Gcp object`
22554
22555 Asserting party: the GCP project the organization is bound to.
22556
22557 - `type: optional "gcp"`
22558
22559 default: gcp
22560
22561 - `project_number: string`
22562
22563 - `Oidc object`
22564
22565 Asserting party: a customer-registered OIDC federation issuer.
22566
22567 - `type: optional "oidc"`
22568
22569 default: oidc
22570
22571 - `issuer: optional string or null`
22572
22573 The federation issuer's URL. Null when the presented credential failed verification.
22574
22575 - `ip_address: optional string or null`
22576
22577 - `subject: optional string or null`
22578
22579 The provider's verified identifier for the caller; its form depends on the provider.
22580
22581 - `user_agent: optional string or null`
22582
22583 - `AttestedDeviceActor object`
22584
22585 An attested mobile device authenticated via Apple App Attest.
22586
22587 - `type: optional "attested_device_actor"`
22588
22589 default: attested_device_actor
22590
22591 - `external_client_id: string`
22592
22593 - `kid_hash: string`
22594
22595 - `ip_address: optional string or null`
22596
22597 - `user_agent: optional string or null`
22598
22599 - `claude_artifact_folder_id: string`
22600
22601 Tagged ID ("cfld_...") of the folder that was moved.
22602
22603 - `id: optional string`
22604
22605 Unique identifier for the activity e.g. 'activity_abcd1234'
22606
22607 - `created_at: optional string`
22608
22609 When this activity occurred.
22610
22611 format: date-time
22612
22613 - `member_gained_count: optional number or null`
22614
22615 The number of people with whom a folder containing the moved folder, directly or through other folders, was individually shared after the move and none was before; people who gained access only another way, such as through a group or organization-wide sharing, are not counted, so zero does not mean that nobody gained access, and those counted can already have had access another way, for example through the moved folder's own sharing; absent when it could not be determined.
22616
22617 - `member_lost_count: optional number or null`
22618
22619 The number of people with whom a folder containing the moved folder, directly or through other folders, was individually shared before the move and none was after; people who had access only another way, such as through a group or organization-wide sharing, are not counted, so zero does not mean that nobody lost access, and those counted can still have access another way, for example through the moved folder's own sharing; absent when it could not be determined.
22620
22621 - `member_lowered_count: optional number or null`
22622
22623 The number of people with whom a folder containing the moved folder, directly or through other folders, was individually shared both before and after the move, at a lower access level after than before; a person's level is the highest that any of those folders gave them, and the moved folder's own sharing is not compared; absent when it could not be determined.
22624
22625 - `member_raised_count: optional number or null`
22626
22627 The number of people with whom a folder containing the moved folder, directly or through other folders, was individually shared both before and after the move, at a higher access level after than before; a person's level is the highest that any of those folders gave them, and the moved folder's own sharing is not compared; absent when it could not be determined.
22628
22629 - `moved_by_owner: optional boolean or null`
22630
22631 True when the person who moved the folder was its owner, false when it was someone else.
22632
22633 - `organization_id: optional string or null`
22634
22635 Organization ID this activity is associated with
22636
22637 - `organization_sharing_change: optional "gained" or "lost" or "lowered" or 3 more or null`
22638
22639 How the move changed the sharing with the whole organization of the folders containing the moved folder, directly or through other folders, by the highest access level that any of them gave the whole organization before and after the move: `gained` when none gave any before and one did after, `lost` when one did before and none did after, `raised` or `lowered` when that level was higher or lower after the move, `unchanged` when it was the same or none gave any; this follows the sharing saved on those folders, which can differ from who can open them, for example while sharing with the whole organization is turned off; the moved folder's own sharing is not compared; absent when it could not be determined.
22640
22641 - `"gained"`
22642
22643 - `"lost"`
22644
22645 - `"lowered"`
22646
22647 - `"raised"`
22648
22649 - `"unchanged"`
22650
22651 - `"unspecified"`
22652
22653 - `organization_uuid: optional string or null`
22654
22655 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
22656
22657 - `parent_claude_artifact_folder_id: optional string or null`
22658
22659 Tagged ID ("cfld_...") of the folder that directly contained the moved folder after the move; absent when the moved folder was left in no other folder.
22660
22661 - `previous_parent_claude_artifact_folder_id: optional string or null`
22662
22663 Tagged ID ("cfld_...") of the folder that directly contained the moved folder before the move; absent when the moved folder was in no other folder, or when that could not be determined.
22664
2200122665 - `ClaudeArtifactInviteAccepted object`
2200222666
2200322667 Someone outside the organization signed in with a verified account for the invited address and accepted an invitation to an artifact, and can now open it; recorded in the artifact owner's organization. The person who accepted is identified by `invitee_email` and `invitee_user_id`.
from line 23670
2300623670
2300723671 The access level the invitation granted before the change, for example `commenter`.
2300823672
23673 - `ClaudeArtifactMoved object`
23674
23675 An artifact was moved into, out of or between folders, by its owner or by someone else, whether or not a folder is shared; an artifact that leaves its folder as part of another event, such as its own deletion or the erasure of an account, might not be recorded as a move.
23676
23677 - `type: optional "claude_artifact_moved"`
23678
23679 default: claude_artifact_moved
23680
23681 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
23682
23683 - `APIActor object`
23684
23685 - `type: optional "api_actor"`
23686
23687 default: api_actor
23688
23689 - `api_key_id: string`
23690
23691 - `ip_address: string`
23692
23693 - `user_agent: string`
23694
23695 - `UserActor object`
23696
23697 - `type: optional "user_actor"`
23698
23699 default: user_actor
23700
23701 - `email_address: string`
23702
23703 format: email
23704
23705 - `ip_address: string`
23706
23707 - `user_agent: string`
23708
23709 - `user_id: string`
23710
23711 - `UnauthenticatedUserActor object`
23712
23713 - `type: optional "unauthenticated_user_actor"`
23714
23715 default: unauthenticated_user_actor
23716
23717 - `ip_address: string`
23718
23719 - `user_agent: string`
23720
23721 - `unauthenticated_email_address: optional string or null`
23722
23723 format: email
23724
23725 - `AnthropicActor object`
23726
23727 - `type: optional "anthropic_actor"`
23728
23729 default: anthropic_actor
23730
23731 - `email_address: optional string or null`
23732
23733 format: email
23734
23735 - `SystemActor object`
23736
23737 Automated background processing performed by Anthropic systems, acting
23738 without a user or customer credential.
23739
23740 - `type: optional "system_actor"`
23741
23742 default: system_actor
23743
23744 - `service: optional string or null`
23745
23746 Name of the automated process that performed the action, when known.
23747
23748 - `AdminAPIKeyActor object`
23749
23750 - `type: optional "admin_api_key_actor"`
23751
23752 default: admin_api_key_actor
23753
23754 - `admin_api_key_id: string`
23755
23756 - `ip_address: string`
23757
23758 - `user_agent: string`
23759
23760 - `ServiceAccountActor object`
23761
23762 - `type: optional "service_account_actor"`
23763
23764 default: service_account_actor
23765
23766 - `ip_address: string`
23767
23768 - `service_account_id: string`
23769
23770 - `user_agent: string`
23771
23772 - `ScimDirectorySyncActor object`
23773
23774 - `type: optional "scim_directory_sync_actor"`
23775
23776 default: scim_directory_sync_actor
23777
23778 - `directory_id: string`
23779
23780 - `workos_event_id: string`
23781
23782 - `idp_connection_type: optional string or null`
23783
23784 - `FederatedIdentityActor object`
23785
23786 A federated external workload authenticated via a verified OIDC token.
23787
23788 Carries the verified issuer, subject, and audience claims from the
23789 presented JWT.
23790
23791 - `type: optional "federated_identity_actor"`
23792
23793 default: federated_identity_actor
23794
23795 - `issuer: string`
23796
23797 - `subject: string`
23798
23799 - `audience: optional array of string`
23800
23801 - `ip_address: optional string or null`
23802
23803 - `user_agent: optional string or null`
23804
23805 - `FederatedActor object`
23806
23807 An external identity asserted by a trusted provider — a cloud-provider
23808 gateway or a customer-registered federation issuer — acting without an
23809 Anthropic-provisioned account or service account.
23810
23811 - `type: optional "federated_actor"`
23812
23813 default: federated_actor
23814
23815 - `provider: Aws or Azure or Gcp or Oidc`
23816
23817 - `Aws object`
23818
23819 Asserting party: the AWS account the organization is bound to.
23820
23821 - `type: optional "aws"`
23822
23823 default: aws
23824
23825 - `account_id: string`
23826
23827 - `signed_principal: string`
23828
23829 The AWS-signed ARN of the IAM principal that requested the token.
23830
23831 - `Azure object`
23832
23833 Asserting party: the Azure subscription the organization is bound to.
23834
23835 - `type: optional "azure"`
23836
23837 default: azure
23838
23839 - `subscription_id: string`
23840
23841 - `Gcp object`
23842
23843 Asserting party: the GCP project the organization is bound to.
23844
23845 - `type: optional "gcp"`
23846
23847 default: gcp
23848
23849 - `project_number: string`
23850
23851 - `Oidc object`
23852
23853 Asserting party: a customer-registered OIDC federation issuer.
23854
23855 - `type: optional "oidc"`
23856
23857 default: oidc
23858
23859 - `issuer: optional string or null`
23860
23861 The federation issuer's URL. Null when the presented credential failed verification.
23862
23863 - `ip_address: optional string or null`
23864
23865 - `subject: optional string or null`
23866
23867 The provider's verified identifier for the caller; its form depends on the provider.
23868
23869 - `user_agent: optional string or null`
23870
23871 - `AttestedDeviceActor object`
23872
23873 An attested mobile device authenticated via Apple App Attest.
23874
23875 - `type: optional "attested_device_actor"`
23876
23877 default: attested_device_actor
23878
23879 - `external_client_id: string`
23880
23881 - `kid_hash: string`
23882
23883 - `ip_address: optional string or null`
23884
23885 - `user_agent: optional string or null`
23886
23887 - `claude_artifact_id: string`
23888
23889 Tagged ID of the artifact that was moved.
23890
23891 - `id: optional string`
23892
23893 Unique identifier for the activity e.g. 'activity_abcd1234'
23894
23895 - `created_at: optional string`
23896
23897 When this activity occurred.
23898
23899 format: date-time
23900
23901 - `member_gained_count: optional number or null`
23902
23903 The number of people with whom the folder holding the artifact, or a folder containing that folder, was individually shared after the move and none was before; people reached only through a group or organization-wide sharing are not counted, so zero does not mean that nobody gained access, and all four counts are absent when they could not be determined.
23904
23905 - `member_lost_count: optional number or null`
23906
23907 The number of people with whom the folder holding the artifact, or a folder containing that folder, was individually shared before the move and none was after; people who had access only through a group or organization-wide sharing are not counted, so zero does not mean that nobody lost access, and those counted may still have access to the artifact another way.
23908
23909 - `member_lowered_count: optional number or null`
23910
23911 The number of people whose individually shared access level, through the folder holding the artifact and the folders containing that folder, was lower after the move than before.
23912
23913 - `member_raised_count: optional number or null`
23914
23915 The number of people whose individually shared access level, through the folder holding the artifact and the folders containing that folder, was higher after the move than before.
23916
23917 - `moved_by_owner: optional boolean or null`
23918
23919 True when the person who moved the artifact was its owner, false when it was someone else.
23920
23921 - `organization_id: optional string or null`
23922
23923 Organization ID this activity is associated with
23924
23925 - `organization_uuid: optional string or null`
23926
23927 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
23928
23929 - `parent_claude_artifact_folder_id: optional string or null`
23930
23931 Tagged ID ("cfld_...") of the folder the artifact was in after the move; absent when it was left in no folder.
23932
23933 - `previous_parent_claude_artifact_folder_id: optional string or null`
23934
23935 Tagged ID ("cfld_...") of the folder the artifact was in before the move; absent when it was in no folder, or when that could not be determined.
23936
2300923937 - `ClaudeArtifactSentToPartner object`
2301023938
2301123939 A member sent an export of an artifact to a partner application ("Send to …" on the artifact; a partner is a third-party application listed in Claude's connector directory): a file exported from the artifact was made available over a temporary link for the chosen partner to fetch. One activity is recorded per send, in the artifact owner's organization with the sending member as actor, whether or not the partner then retrieved the file; the partner's own import of the file is not part of this record. The file's name and contents are not recorded.
from line 32630
3170232630
3170332631 format: date-time
3170432632
32633 - `finding_id: optional string or null`
32634
32635 Tagged ID of the finding the session was created for, omitted from some events, such as those recorded before this field was introduced.
32636
3170532637 - `organization_id: optional string or null`
3170632638
3170732639 Organization ID this activity is associated with
from line 32642
3171032642
3171132643 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
3171232644
32645 - `scan_project_id: optional string or null`
32646
32647 Tagged ID of the scan project the finding belongs to, omitted from some events, such as those recorded before this field was introduced.
32648
3171332649 - `ClaudeCodeSecurityVulnerabilityUpdated object`
3171432650
3171532651 A Claude Code Security vulnerability finding was dismissed, restored, marked fixed, or reopened.
from line 44920
4398444920
4398544921 - `marketplace_id: optional string or null`
4398644922
43987 The marketplace of the plugin that carries the skill; unset for a standalone skill.
44923 The marketplace of the plugin that carries the skill, if any.
4398844924
4398944925 - `organization_id: optional string or null`
4399044926
from line 44936
4400044936
4400144937 - `plugin_id: optional string or null`
4400244938
44003 The plugin that carries the skill; unset for a standalone skill.
44939 The plugin that carries the skill, if any.
4400444940
4400544941 - `scope: optional "organization" or "personal" or "unspecified" or null`
4400644942
from line 45282
4434645282
4434745283 Name of the skill (its SKILL.md name, as on the other skill activities).
4434845284
45285 - `ClaudeSkillServedVersionUpdated object`
45286
45287 A skill's served version, the version that members get, was updated: an administrator or the owner chose a version, a saved version became the served version, or an accepted library submission was published into the skill. A new version that is served as soon as it is saved may appear only as claude_skill_version_created.
45288
45289 - `type: optional "claude_skill_served_version_updated"`
45290
45291 default: claude_skill_served_version_updated
45292
45293 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
45294
45295 - `APIActor object`
45296
45297 - `type: optional "api_actor"`
45298
45299 default: api_actor
45300
45301 - `api_key_id: string`
45302
45303 - `ip_address: string`
45304
45305 - `user_agent: string`
45306
45307 - `UserActor object`
45308
45309 - `type: optional "user_actor"`
45310
45311 default: user_actor
45312
45313 - `email_address: string`
45314
45315 format: email
45316
45317 - `ip_address: string`
45318
45319 - `user_agent: string`
45320
45321 - `user_id: string`
45322
45323 - `UnauthenticatedUserActor object`
45324
45325 - `type: optional "unauthenticated_user_actor"`
45326
45327 default: unauthenticated_user_actor
45328
45329 - `ip_address: string`
45330
45331 - `user_agent: string`
45332
45333 - `unauthenticated_email_address: optional string or null`
45334
45335 format: email
45336
45337 - `AnthropicActor object`
45338
45339 - `type: optional "anthropic_actor"`
45340
45341 default: anthropic_actor
45342
45343 - `email_address: optional string or null`
45344
45345 format: email
45346
45347 - `SystemActor object`
45348
45349 Automated background processing performed by Anthropic systems, acting
45350 without a user or customer credential.
45351
45352 - `type: optional "system_actor"`
45353
45354 default: system_actor
45355
45356 - `service: optional string or null`
45357
45358 Name of the automated process that performed the action, when known.
45359
45360 - `AdminAPIKeyActor object`
45361
45362 - `type: optional "admin_api_key_actor"`
45363
45364 default: admin_api_key_actor
45365
45366 - `admin_api_key_id: string`
45367
45368 - `ip_address: string`
45369
45370 - `user_agent: string`
45371
45372 - `ServiceAccountActor object`
45373
45374 - `type: optional "service_account_actor"`
45375
45376 default: service_account_actor
45377
45378 - `ip_address: string`
45379
45380 - `service_account_id: string`
45381
45382 - `user_agent: string`
45383
45384 - `ScimDirectorySyncActor object`
45385
45386 - `type: optional "scim_directory_sync_actor"`
45387
45388 default: scim_directory_sync_actor
45389
45390 - `directory_id: string`
45391
45392 - `workos_event_id: string`
45393
45394 - `idp_connection_type: optional string or null`
45395
45396 - `FederatedIdentityActor object`
45397
45398 A federated external workload authenticated via a verified OIDC token.
45399
45400 Carries the verified issuer, subject, and audience claims from the
45401 presented JWT.
45402
45403 - `type: optional "federated_identity_actor"`
45404
45405 default: federated_identity_actor
45406
45407 - `issuer: string`
45408
45409 - `subject: string`
45410
45411 - `audience: optional array of string`
45412
45413 - `ip_address: optional string or null`
45414
45415 - `user_agent: optional string or null`
45416
45417 - `FederatedActor object`
45418
45419 An external identity asserted by a trusted provider — a cloud-provider
45420 gateway or a customer-registered federation issuer — acting without an
45421 Anthropic-provisioned account or service account.
45422
45423 - `type: optional "federated_actor"`
45424
45425 default: federated_actor
45426
45427 - `provider: Aws or Azure or Gcp or Oidc`
45428
45429 - `Aws object`
45430
45431 Asserting party: the AWS account the organization is bound to.
45432
45433 - `type: optional "aws"`
45434
45435 default: aws
45436
45437 - `account_id: string`
45438
45439 - `signed_principal: string`
45440
45441 The AWS-signed ARN of the IAM principal that requested the token.
45442
45443 - `Azure object`
45444
45445 Asserting party: the Azure subscription the organization is bound to.
45446
45447 - `type: optional "azure"`
45448
45449 default: azure
45450
45451 - `subscription_id: string`
45452
45453 - `Gcp object`
45454
45455 Asserting party: the GCP project the organization is bound to.
45456
45457 - `type: optional "gcp"`
45458
45459 default: gcp
45460
45461 - `project_number: string`
45462
45463 - `Oidc object`
45464
45465 Asserting party: a customer-registered OIDC federation issuer.
45466
45467 - `type: optional "oidc"`
45468
45469 default: oidc
45470
45471 - `issuer: optional string or null`
45472
45473 The federation issuer's URL. Null when the presented credential failed verification.
45474
45475 - `ip_address: optional string or null`
45476
45477 - `subject: optional string or null`
45478
45479 The provider's verified identifier for the caller; its form depends on the provider.
45480
45481 - `user_agent: optional string or null`
45482
45483 - `AttestedDeviceActor object`
45484
45485 An attested mobile device authenticated via Apple App Attest.
45486
45487 - `type: optional "attested_device_actor"`
45488
45489 default: attested_device_actor
45490
45491 - `external_client_id: string`
45492
45493 - `kid_hash: string`
45494
45495 - `ip_address: optional string or null`
45496
45497 - `user_agent: optional string or null`
45498
45499 - `scope: "organization" or "personal" or "unspecified"`
45500
45501 Whether the skill is the member's own or the organization's.
45502
45503 - `"organization"`
45504
45505 - `"personal"`
45506
45507 - `"unspecified"`
45508
45509 - `to_skill_version: string`
45510
45511 The number of the served version after the update.
45512
45513 - `trigger: "library_publish" or "manual" or "save" or "unspecified"`
45514
45515 What caused the update.
45516
45517 - `"library_publish"`
45518
45519 - `"manual"`
45520
45521 - `"save"`
45522
45523 - `"unspecified"`
45524
45525 - `id: optional string`
45526
45527 Unique identifier for the activity e.g. 'activity_abcd1234'
45528
45529 - `created_at: optional string`
45530
45531 When this activity occurred.
45532
45533 format: date-time
45534
45535 - `from_skill_version: optional string or null`
45536
45537 The number of the served version before the update; the same as to_skill_version when that version was already being served. Unset when the skill had no served version or the number could not be read.
45538
45539 - `organization_id: optional string or null`
45540
45541 Organization ID this activity is associated with
45542
45543 - `organization_uuid: optional string or null`
45544
45545 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
45546
45547 - `owner_user_id: optional string or null`
45548
45549 The member who owns the skill; unset for an organization-owned skill.
45550
45551 - `skill_id: optional string or null`
45552
45553 The skill whose served version was updated.
45554
45555 - `skill_name: optional string or null`
45556
45557 The name of the skill whose served version was updated.
45558
45559 - `ClaudeSkillVersionCreated object`
45560
45561 A new version of a skill was created.
45562
45563 - `type: optional "claude_skill_version_created"`
45564
45565 default: claude_skill_version_created
45566
45567 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
45568
45569 - `APIActor object`
45570
45571 - `type: optional "api_actor"`
45572
45573 default: api_actor
45574
45575 - `api_key_id: string`
45576
45577 - `ip_address: string`
45578
45579 - `user_agent: string`
45580
45581 - `UserActor object`
45582
45583 - `type: optional "user_actor"`
45584
45585 default: user_actor
45586
45587 - `email_address: string`
45588
45589 format: email
45590
45591 - `ip_address: string`
45592
45593 - `user_agent: string`
45594
45595 - `user_id: string`
45596
45597 - `UnauthenticatedUserActor object`
45598
45599 - `type: optional "unauthenticated_user_actor"`
45600
45601 default: unauthenticated_user_actor
45602
45603 - `ip_address: string`
45604
45605 - `user_agent: string`
45606
45607 - `unauthenticated_email_address: optional string or null`
45608
45609 format: email
45610
45611 - `AnthropicActor object`
45612
45613 - `type: optional "anthropic_actor"`
45614
45615 default: anthropic_actor
45616
45617 - `email_address: optional string or null`
45618
45619 format: email
45620
45621 - `SystemActor object`
45622
45623 Automated background processing performed by Anthropic systems, acting
45624 without a user or customer credential.
45625
45626 - `type: optional "system_actor"`
45627
45628 default: system_actor
45629
45630 - `service: optional string or null`
45631
45632 Name of the automated process that performed the action, when known.
45633
45634 - `AdminAPIKeyActor object`
45635
45636 - `type: optional "admin_api_key_actor"`
45637
45638 default: admin_api_key_actor
45639
45640 - `admin_api_key_id: string`
45641
45642 - `ip_address: string`
45643
45644 - `user_agent: string`
45645
45646 - `ServiceAccountActor object`
45647
45648 - `type: optional "service_account_actor"`
45649
45650 default: service_account_actor
45651
45652 - `ip_address: string`
45653
45654 - `service_account_id: string`
45655
45656 - `user_agent: string`
45657
45658 - `ScimDirectorySyncActor object`
45659
45660 - `type: optional "scim_directory_sync_actor"`
45661
45662 default: scim_directory_sync_actor
45663
45664 - `directory_id: string`
45665
45666 - `workos_event_id: string`
45667
45668 - `idp_connection_type: optional string or null`
45669
45670 - `FederatedIdentityActor object`
45671
45672 A federated external workload authenticated via a verified OIDC token.
45673
45674 Carries the verified issuer, subject, and audience claims from the
45675 presented JWT.
45676
45677 - `type: optional "federated_identity_actor"`
45678
45679 default: federated_identity_actor
45680
45681 - `issuer: string`
45682
45683 - `subject: string`
45684
45685 - `audience: optional array of string`
45686
45687 - `ip_address: optional string or null`
45688
45689 - `user_agent: optional string or null`
45690
45691 - `FederatedActor object`
45692
45693 An external identity asserted by a trusted provider — a cloud-provider
45694 gateway or a customer-registered federation issuer — acting without an
45695 Anthropic-provisioned account or service account.
45696
45697 - `type: optional "federated_actor"`
45698
45699 default: federated_actor
45700
45701 - `provider: Aws or Azure or Gcp or Oidc`
45702
45703 - `Aws object`
45704
45705 Asserting party: the AWS account the organization is bound to.
45706
45707 - `type: optional "aws"`
45708
45709 default: aws
45710
45711 - `account_id: string`
45712
45713 - `signed_principal: string`
45714
45715 The AWS-signed ARN of the IAM principal that requested the token.
45716
45717 - `Azure object`
45718
45719 Asserting party: the Azure subscription the organization is bound to.
45720
45721 - `type: optional "azure"`
45722
45723 default: azure
45724
45725 - `subscription_id: string`
45726
45727 - `Gcp object`
45728
45729 Asserting party: the GCP project the organization is bound to.
45730
45731 - `type: optional "gcp"`
45732
45733 default: gcp
45734
45735 - `project_number: string`
45736
45737 - `Oidc object`
45738
45739 Asserting party: a customer-registered OIDC federation issuer.
45740
45741 - `type: optional "oidc"`
45742
45743 default: oidc
45744
45745 - `issuer: optional string or null`
45746
45747 The federation issuer's URL. Null when the presented credential failed verification.
45748
45749 - `ip_address: optional string or null`
45750
45751 - `subject: optional string or null`
45752
45753 The provider's verified identifier for the caller; its form depends on the provider.
45754
45755 - `user_agent: optional string or null`
45756
45757 - `AttestedDeviceActor object`
45758
45759 An attested mobile device authenticated via Apple App Attest.
45760
45761 - `type: optional "attested_device_actor"`
45762
45763 default: attested_device_actor
45764
45765 - `external_client_id: string`
45766
45767 - `kid_hash: string`
45768
45769 - `ip_address: optional string or null`
45770
45771 - `user_agent: optional string or null`
45772
45773 - `scope: "organization" or "personal" or "unspecified"`
45774
45775 Whether the skill is the member's own or the organization's.
45776
45777 - `"organization"`
45778
45779 - `"personal"`
45780
45781 - `"unspecified"`
45782
45783 - `skill_version: string`
45784
45785 The number of the new version.
45786
45787 - `id: optional string`
45788
45789 Unique identifier for the activity e.g. 'activity_abcd1234'
45790
45791 - `created_at: optional string`
45792
45793 When this activity occurred.
45794
45795 format: date-time
45796
45797 - `organization_id: optional string or null`
45798
45799 Organization ID this activity is associated with
45800
45801 - `organization_uuid: optional string or null`
45802
45803 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
45804
45805 - `owner_user_id: optional string or null`
45806
45807 The member who owns the skill; unset for an organization-owned skill.
45808
45809 - `skill_id: optional string or null`
45810
45811 The skill that gained a version.
45812
45813 - `skill_name: optional string or null`
45814
45815 The name of the skill that gained a version.
45816
4434945817 - `ClaudeSurveyClosed object`
4435045818
4435145819 An organization admin closed an in-app survey before its end date, ending the collection of responses; a survey that reaches its end date records no event.
from line 53900
5243253900
5243353901 - `rbac_inclusion_enabled: optional boolean or null`
5243453902
52435 Whether Inference hooks apply only to members whose role grants the Inference hooks inspection permission, as configured after this change. Null means the setting is off: either nothing has been saved for it, or it is not available to the organization. When on, requests from members whose roles do not grant that permission are not sent to the organization's endpoint. Only a custom role that this permission was added to grants it; a role set to grant all capabilities, or all generally available capabilities, does not grant it. Members on one of the organization's built-in roles (such as User, Admin, or Owner) rather than a custom role never have this permission. Requests not tied to a member, such as those made with an API key, are not sent either, and neither are requests from Claude in Slack conversations.
53903 Whether Inference hooks apply only to members whose role grants the Inference hooks inspection permission, as configured after this change. Null means the setting is off: either nothing has been saved for it, or it is not available to the organization. When on, requests from members whose roles do not grant that permission are not sent to the organization's endpoint. Only a custom role that this permission was added to grants it; setting a role's "Capability access" to "All capabilities" or "All generally available" does not grant it. Members on one of the organization's built-in roles (such as User, Admin, or Owner) rather than a custom role never have this permission. Requests not tied to a member, such as those made with an API key, are not sent either, and neither are requests from Claude in Slack conversations.
5243653904
5243753905 - `reset_circuit_breaker: optional boolean or null`
5243853906
from line 82570
8110282570
8110382571 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
8110482572
82573 - `OrgDomainSSOEnforcementUpdated object`
82574
82575 A verified domain's single sign-on requirement changed, per surface.
82576
82577 - `type: optional "org_domain_sso_enforcement_updated"`
82578
82579 default: org_domain_sso_enforcement_updated
82580
82581 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
82582
82583 - `APIActor object`
82584
82585 - `type: optional "api_actor"`
82586
82587 default: api_actor
82588
82589 - `api_key_id: string`
82590
82591 - `ip_address: string`
82592
82593 - `user_agent: string`
82594
82595 - `UserActor object`
82596
82597 - `type: optional "user_actor"`
82598
82599 default: user_actor
82600
82601 - `email_address: string`
82602
82603 format: email
82604
82605 - `ip_address: string`
82606
82607 - `user_agent: string`
82608
82609 - `user_id: string`
82610
82611 - `UnauthenticatedUserActor object`
82612
82613 - `type: optional "unauthenticated_user_actor"`
82614
82615 default: unauthenticated_user_actor
82616
82617 - `ip_address: string`
82618
82619 - `user_agent: string`
82620
82621 - `unauthenticated_email_address: optional string or null`
82622
82623 format: email
82624
82625 - `AnthropicActor object`
82626
82627 - `type: optional "anthropic_actor"`
82628
82629 default: anthropic_actor
82630
82631 - `email_address: optional string or null`
82632
82633 format: email
82634
82635 - `SystemActor object`
82636
82637 Automated background processing performed by Anthropic systems, acting
82638 without a user or customer credential.
82639
82640 - `type: optional "system_actor"`
82641
82642 default: system_actor
82643
82644 - `service: optional string or null`
82645
82646 Name of the automated process that performed the action, when known.
82647
82648 - `AdminAPIKeyActor object`
82649
82650 - `type: optional "admin_api_key_actor"`
82651
82652 default: admin_api_key_actor
82653
82654 - `admin_api_key_id: string`
82655
82656 - `ip_address: string`
82657
82658 - `user_agent: string`
82659
82660 - `ServiceAccountActor object`
82661
82662 - `type: optional "service_account_actor"`
82663
82664 default: service_account_actor
82665
82666 - `ip_address: string`
82667
82668 - `service_account_id: string`
82669
82670 - `user_agent: string`
82671
82672 - `ScimDirectorySyncActor object`
82673
82674 - `type: optional "scim_directory_sync_actor"`
82675
82676 default: scim_directory_sync_actor
82677
82678 - `directory_id: string`
82679
82680 - `workos_event_id: string`
82681
82682 - `idp_connection_type: optional string or null`
82683
82684 - `FederatedIdentityActor object`
82685
82686 A federated external workload authenticated via a verified OIDC token.
82687
82688 Carries the verified issuer, subject, and audience claims from the
82689 presented JWT.
82690
82691 - `type: optional "federated_identity_actor"`
82692
82693 default: federated_identity_actor
82694
82695 - `issuer: string`
82696
82697 - `subject: string`
82698
82699 - `audience: optional array of string`
82700
82701 - `ip_address: optional string or null`
82702
82703 - `user_agent: optional string or null`
82704
82705 - `FederatedActor object`
82706
82707 An external identity asserted by a trusted provider — a cloud-provider
82708 gateway or a customer-registered federation issuer — acting without an
82709 Anthropic-provisioned account or service account.
82710
82711 - `type: optional "federated_actor"`
82712
82713 default: federated_actor
82714
82715 - `provider: Aws or Azure or Gcp or Oidc`
82716
82717 - `Aws object`
82718
82719 Asserting party: the AWS account the organization is bound to.
82720
82721 - `type: optional "aws"`
82722
82723 default: aws
82724
82725 - `account_id: string`
82726
82727 - `signed_principal: string`
82728
82729 The AWS-signed ARN of the IAM principal that requested the token.
82730
82731 - `Azure object`
82732
82733 Asserting party: the Azure subscription the organization is bound to.
82734
82735 - `type: optional "azure"`
82736
82737 default: azure
82738
82739 - `subscription_id: string`
82740
82741 - `Gcp object`
82742
82743 Asserting party: the GCP project the organization is bound to.
82744
82745 - `type: optional "gcp"`
82746
82747 default: gcp
82748
82749 - `project_number: string`
82750
82751 - `Oidc object`
82752
82753 Asserting party: a customer-registered OIDC federation issuer.
82754
82755 - `type: optional "oidc"`
82756
82757 default: oidc
82758
82759 - `issuer: optional string or null`
82760
82761 The federation issuer's URL. Null when the presented credential failed verification.
82762
82763 - `ip_address: optional string or null`
82764
82765 - `subject: optional string or null`
82766
82767 The provider's verified identifier for the caller; its form depends on the provider.
82768
82769 - `user_agent: optional string or null`
82770
82771 - `AttestedDeviceActor object`
82772
82773 An attested mobile device authenticated via Apple App Attest.
82774
82775 - `type: optional "attested_device_actor"`
82776
82777 default: attested_device_actor
82778
82779 - `external_client_id: string`
82780
82781 - `kid_hash: string`
82782
82783 - `ip_address: optional string or null`
82784
82785 - `user_agent: optional string or null`
82786
82787 - `claudeai_sso_enforced: boolean`
82788
82789 Whether single sign-on is required on claude.ai after the change.
82790
82791 - `console_sso_enforced: boolean`
82792
82793 Whether single sign-on is required on the Console after the change.
82794
82795 - `domain: string`
82796
82797 The verified domain whose requirement changed.
82798
82799 - `previous_claudeai_sso_enforced: boolean`
82800
82801 Whether single sign-on was required on claude.ai before the change.
82802
82803 - `previous_console_sso_enforced: boolean`
82804
82805 Whether single sign-on was required on the Console before the change.
82806
82807 - `id: optional string`
82808
82809 Unique identifier for the activity e.g. 'activity_abcd1234'
82810
82811 - `created_at: optional string`
82812
82813 When this activity occurred.
82814
82815 format: date-time
82816
82817 - `idp_connection_ids: optional array of string`
82818
82819 The identity provider connections (e.g. "idpc_01Ab...") the domain routes to at the time of the change, in the order they were added to the domain. Empty if it routes to none.
82820
82821 - `organization_id: optional string or null`
82822
82823 Organization ID this activity is associated with
82824
82825 - `organization_uuid: optional string or null`
82826
82827 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
82828
82829 - `OrgDomainSSORoutingUpdated object`
82830
82831 A verified domain's single sign-on routing was saved or changed. Lists the identity provider connections the domain's users sign in through before and after; the two lists are the same when a save changed nothing.
82832
82833 - `type: optional "org_domain_sso_routing_updated"`
82834
82835 default: org_domain_sso_routing_updated
82836
82837 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
82838
82839 - `APIActor object`
82840
82841 - `type: optional "api_actor"`
82842
82843 default: api_actor
82844
82845 - `api_key_id: string`
82846
82847 - `ip_address: string`
82848
82849 - `user_agent: string`
82850
82851 - `UserActor object`
82852
82853 - `type: optional "user_actor"`
82854
82855 default: user_actor
82856
82857 - `email_address: string`
82858
82859 format: email
82860
82861 - `ip_address: string`
82862
82863 - `user_agent: string`
82864
82865 - `user_id: string`
82866
82867 - `UnauthenticatedUserActor object`
82868
82869 - `type: optional "unauthenticated_user_actor"`
82870
82871 default: unauthenticated_user_actor
82872
82873 - `ip_address: string`
82874
82875 - `user_agent: string`
82876
82877 - `unauthenticated_email_address: optional string or null`
82878
82879 format: email
82880
82881 - `AnthropicActor object`
82882
82883 - `type: optional "anthropic_actor"`
82884
82885 default: anthropic_actor
82886
82887 - `email_address: optional string or null`
82888
82889 format: email
82890
82891 - `SystemActor object`
82892
82893 Automated background processing performed by Anthropic systems, acting
82894 without a user or customer credential.
82895
82896 - `type: optional "system_actor"`
82897
82898 default: system_actor
82899
82900 - `service: optional string or null`
82901
82902 Name of the automated process that performed the action, when known.
82903
82904 - `AdminAPIKeyActor object`
82905
82906 - `type: optional "admin_api_key_actor"`
82907
82908 default: admin_api_key_actor
82909
82910 - `admin_api_key_id: string`
82911
82912 - `ip_address: string`
82913
82914 - `user_agent: string`
82915
82916 - `ServiceAccountActor object`
82917
82918 - `type: optional "service_account_actor"`
82919
82920 default: service_account_actor
82921
82922 - `ip_address: string`
82923
82924 - `service_account_id: string`
82925
82926 - `user_agent: string`
82927
82928 - `ScimDirectorySyncActor object`
82929
82930 - `type: optional "scim_directory_sync_actor"`
82931
82932 default: scim_directory_sync_actor
82933
82934 - `directory_id: string`
82935
82936 - `workos_event_id: string`
82937
82938 - `idp_connection_type: optional string or null`
82939
82940 - `FederatedIdentityActor object`
82941
82942 A federated external workload authenticated via a verified OIDC token.
82943
82944 Carries the verified issuer, subject, and audience claims from the
82945 presented JWT.
82946
82947 - `type: optional "federated_identity_actor"`
82948
82949 default: federated_identity_actor
82950
82951 - `issuer: string`
82952
82953 - `subject: string`
82954
82955 - `audience: optional array of string`
82956
82957 - `ip_address: optional string or null`
82958
82959 - `user_agent: optional string or null`
82960
82961 - `FederatedActor object`
82962
82963 An external identity asserted by a trusted provider — a cloud-provider
82964 gateway or a customer-registered federation issuer — acting without an
82965 Anthropic-provisioned account or service account.
82966
82967 - `type: optional "federated_actor"`
82968
82969 default: federated_actor
82970
82971 - `provider: Aws or Azure or Gcp or Oidc`
82972
82973 - `Aws object`
82974
82975 Asserting party: the AWS account the organization is bound to.
82976
82977 - `type: optional "aws"`
82978
82979 default: aws
82980
82981 - `account_id: string`
82982
82983 - `signed_principal: string`
82984
82985 The AWS-signed ARN of the IAM principal that requested the token.
82986
82987 - `Azure object`
82988
82989 Asserting party: the Azure subscription the organization is bound to.
82990
82991 - `type: optional "azure"`
82992
82993 default: azure
82994
82995 - `subscription_id: string`
82996
82997 - `Gcp object`
82998
82999 Asserting party: the GCP project the organization is bound to.
83000
83001 - `type: optional "gcp"`
83002
83003 default: gcp
83004
83005 - `project_number: string`
83006
83007 - `Oidc object`
83008
83009 Asserting party: a customer-registered OIDC federation issuer.
83010
83011 - `type: optional "oidc"`
83012
83013 default: oidc
83014
83015 - `issuer: optional string or null`
83016
83017 The federation issuer's URL. Null when the presented credential failed verification.
83018
83019 - `ip_address: optional string or null`
83020
83021 - `subject: optional string or null`
83022
83023 The provider's verified identifier for the caller; its form depends on the provider.
83024
83025 - `user_agent: optional string or null`
83026
83027 - `AttestedDeviceActor object`
83028
83029 An attested mobile device authenticated via Apple App Attest.
83030
83031 - `type: optional "attested_device_actor"`
83032
83033 default: attested_device_actor
83034
83035 - `external_client_id: string`
83036
83037 - `kid_hash: string`
83038
83039 - `ip_address: optional string or null`
83040
83041 - `user_agent: optional string or null`
83042
83043 - `domain: string`
83044
83045 The verified domain whose routing changed.
83046
83047 - `id: optional string`
83048
83049 Unique identifier for the activity e.g. 'activity_abcd1234'
83050
83051 - `created_at: optional string`
83052
83053 When this activity occurred.
83054
83055 format: date-time
83056
83057 - `idp_connection_ids: optional array of string`
83058
83059 The identity provider connections (e.g. "idpc_01Ab...") the domain routes to after, in the order they were added to the domain. Empty if it routes to none.
83060
83061 - `organization_id: optional string or null`
83062
83063 Organization ID this activity is associated with
83064
83065 - `organization_uuid: optional string or null`
83066
83067 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
83068
83069 - `previous_idp_connection_ids: optional array of string`
83070
83071 The identity provider connections (e.g. "idpc_01Ab...") the domain routed to before, in the order they were added to the domain. Empty if it routed to none.
83072
8110583073 - `OrgDomainVerified object`
8110683074
8110783075 Organization domain was verified.
from line 85986
8401885986
8401985987 The IP range before this change; absent unless the range itself was changed.
8402085988
85989 - `OrgIdpConnectionCreated object`
85990
85991 An identity provider connection was added to the parent organization.
85992
85993 - `type: optional "org_idp_connection_created"`
85994
85995 default: org_idp_connection_created
85996
85997 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
85998
85999 - `APIActor object`
86000
86001 - `type: optional "api_actor"`
86002
86003 default: api_actor
86004
86005 - `api_key_id: string`
86006
86007 - `ip_address: string`
86008
86009 - `user_agent: string`
86010
86011 - `UserActor object`
86012
86013 - `type: optional "user_actor"`
86014
86015 default: user_actor
86016
86017 - `email_address: string`
86018
86019 format: email
86020
86021 - `ip_address: string`
86022
86023 - `user_agent: string`
86024
86025 - `user_id: string`
86026
86027 - `UnauthenticatedUserActor object`
86028
86029 - `type: optional "unauthenticated_user_actor"`
86030
86031 default: unauthenticated_user_actor
86032
86033 - `ip_address: string`
86034
86035 - `user_agent: string`
86036
86037 - `unauthenticated_email_address: optional string or null`
86038
86039 format: email
86040
86041 - `AnthropicActor object`
86042
86043 - `type: optional "anthropic_actor"`
86044
86045 default: anthropic_actor
86046
86047 - `email_address: optional string or null`
86048
86049 format: email
86050
86051 - `SystemActor object`
86052
86053 Automated background processing performed by Anthropic systems, acting
86054 without a user or customer credential.
86055
86056 - `type: optional "system_actor"`
86057
86058 default: system_actor
86059
86060 - `service: optional string or null`
86061
86062 Name of the automated process that performed the action, when known.
86063
86064 - `AdminAPIKeyActor object`
86065
86066 - `type: optional "admin_api_key_actor"`
86067
86068 default: admin_api_key_actor
86069
86070 - `admin_api_key_id: string`
86071
86072 - `ip_address: string`
86073
86074 - `user_agent: string`
86075
86076 - `ServiceAccountActor object`
86077
86078 - `type: optional "service_account_actor"`
86079
86080 default: service_account_actor
86081
86082 - `ip_address: string`
86083
86084 - `service_account_id: string`
86085
86086 - `user_agent: string`
86087
86088 - `ScimDirectorySyncActor object`
86089
86090 - `type: optional "scim_directory_sync_actor"`
86091
86092 default: scim_directory_sync_actor
86093
86094 - `directory_id: string`
86095
86096 - `workos_event_id: string`
86097
86098 - `idp_connection_type: optional string or null`
86099
86100 - `FederatedIdentityActor object`
86101
86102 A federated external workload authenticated via a verified OIDC token.
86103
86104 Carries the verified issuer, subject, and audience claims from the
86105 presented JWT.
86106
86107 - `type: optional "federated_identity_actor"`
86108
86109 default: federated_identity_actor
86110
86111 - `issuer: string`
86112
86113 - `subject: string`
86114
86115 - `audience: optional array of string`
86116
86117 - `ip_address: optional string or null`
86118
86119 - `user_agent: optional string or null`
86120
86121 - `FederatedActor object`
86122
86123 An external identity asserted by a trusted provider — a cloud-provider
86124 gateway or a customer-registered federation issuer — acting without an
86125 Anthropic-provisioned account or service account.
86126
86127 - `type: optional "federated_actor"`
86128
86129 default: federated_actor
86130
86131 - `provider: Aws or Azure or Gcp or Oidc`
86132
86133 - `Aws object`
86134
86135 Asserting party: the AWS account the organization is bound to.
86136
86137 - `type: optional "aws"`
86138
86139 default: aws
86140
86141 - `account_id: string`
86142
86143 - `signed_principal: string`
86144
86145 The AWS-signed ARN of the IAM principal that requested the token.
86146
86147 - `Azure object`
86148
86149 Asserting party: the Azure subscription the organization is bound to.
86150
86151 - `type: optional "azure"`
86152
86153 default: azure
86154
86155 - `subscription_id: string`
86156
86157 - `Gcp object`
86158
86159 Asserting party: the GCP project the organization is bound to.
86160
86161 - `type: optional "gcp"`
86162
86163 default: gcp
86164
86165 - `project_number: string`
86166
86167 - `Oidc object`
86168
86169 Asserting party: a customer-registered OIDC federation issuer.
86170
86171 - `type: optional "oidc"`
86172
86173 default: oidc
86174
86175 - `issuer: optional string or null`
86176
86177 The federation issuer's URL. Null when the presented credential failed verification.
86178
86179 - `ip_address: optional string or null`
86180
86181 - `subject: optional string or null`
86182
86183 The provider's verified identifier for the caller; its form depends on the provider.
86184
86185 - `user_agent: optional string or null`
86186
86187 - `AttestedDeviceActor object`
86188
86189 An attested mobile device authenticated via Apple App Attest.
86190
86191 - `type: optional "attested_device_actor"`
86192
86193 default: attested_device_actor
86194
86195 - `external_client_id: string`
86196
86197 - `kid_hash: string`
86198
86199 - `ip_address: optional string or null`
86200
86201 - `user_agent: optional string or null`
86202
86203 - `display_name: string`
86204
86205 The display name the administrator gave the connection.
86206
86207 - `idp_connection_id: string`
86208
86209 The identity provider connection that was created, e.g. "idpc_01Ab...".
86210
86211 - `id: optional string`
86212
86213 Unique identifier for the activity e.g. 'activity_abcd1234'
86214
86215 - `created_at: optional string`
86216
86217 When this activity occurred.
86218
86219 format: date-time
86220
86221 - `organization_id: optional string or null`
86222
86223 Organization ID this activity is associated with
86224
86225 - `organization_uuid: optional string or null`
86226
86227 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
86228
86229 - `OrgIdpConnectionDeleted object`
86230
86231 An identity provider connection was removed from the parent organization, along with the settings that referenced it.
86232
86233 - `type: optional "org_idp_connection_deleted"`
86234
86235 default: org_idp_connection_deleted
86236
86237 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
86238
86239 - `APIActor object`
86240
86241 - `type: optional "api_actor"`
86242
86243 default: api_actor
86244
86245 - `api_key_id: string`
86246
86247 - `ip_address: string`
86248
86249 - `user_agent: string`
86250
86251 - `UserActor object`
86252
86253 - `type: optional "user_actor"`
86254
86255 default: user_actor
86256
86257 - `email_address: string`
86258
86259 format: email
86260
86261 - `ip_address: string`
86262
86263 - `user_agent: string`
86264
86265 - `user_id: string`
86266
86267 - `UnauthenticatedUserActor object`
86268
86269 - `type: optional "unauthenticated_user_actor"`
86270
86271 default: unauthenticated_user_actor
86272
86273 - `ip_address: string`
86274
86275 - `user_agent: string`
86276
86277 - `unauthenticated_email_address: optional string or null`
86278
86279 format: email
86280
86281 - `AnthropicActor object`
86282
86283 - `type: optional "anthropic_actor"`
86284
86285 default: anthropic_actor
86286
86287 - `email_address: optional string or null`
86288
86289 format: email
86290
86291 - `SystemActor object`
86292
86293 Automated background processing performed by Anthropic systems, acting
86294 without a user or customer credential.
86295
86296 - `type: optional "system_actor"`
86297
86298 default: system_actor
86299
86300 - `service: optional string or null`
86301
86302 Name of the automated process that performed the action, when known.
86303
86304 - `AdminAPIKeyActor object`
86305
86306 - `type: optional "admin_api_key_actor"`
86307
86308 default: admin_api_key_actor
86309
86310 - `admin_api_key_id: string`
86311
86312 - `ip_address: string`
86313
86314 - `user_agent: string`
86315
86316 - `ServiceAccountActor object`
86317
86318 - `type: optional "service_account_actor"`
86319
86320 default: service_account_actor
86321
86322 - `ip_address: string`
86323
86324 - `service_account_id: string`
86325
86326 - `user_agent: string`
86327
86328 - `ScimDirectorySyncActor object`
86329
86330 - `type: optional "scim_directory_sync_actor"`
86331
86332 default: scim_directory_sync_actor
86333
86334 - `directory_id: string`
86335
86336 - `workos_event_id: string`
86337
86338 - `idp_connection_type: optional string or null`
86339
86340 - `FederatedIdentityActor object`
86341
86342 A federated external workload authenticated via a verified OIDC token.
86343
86344 Carries the verified issuer, subject, and audience claims from the
86345 presented JWT.
86346
86347 - `type: optional "federated_identity_actor"`
86348
86349 default: federated_identity_actor
86350
86351 - `issuer: string`
86352
86353 - `subject: string`
86354
86355 - `audience: optional array of string`
86356
86357 - `ip_address: optional string or null`
86358
86359 - `user_agent: optional string or null`
86360
86361 - `FederatedActor object`
86362
86363 An external identity asserted by a trusted provider — a cloud-provider
86364 gateway or a customer-registered federation issuer — acting without an
86365 Anthropic-provisioned account or service account.
86366
86367 - `type: optional "federated_actor"`
86368
86369 default: federated_actor
86370
86371 - `provider: Aws or Azure or Gcp or Oidc`
86372
86373 - `Aws object`
86374
86375 Asserting party: the AWS account the organization is bound to.
86376
86377 - `type: optional "aws"`
86378
86379 default: aws
86380
86381 - `account_id: string`
86382
86383 - `signed_principal: string`
86384
86385 The AWS-signed ARN of the IAM principal that requested the token.
86386
86387 - `Azure object`
86388
86389 Asserting party: the Azure subscription the organization is bound to.
86390
86391 - `type: optional "azure"`
86392
86393 default: azure
86394
86395 - `subscription_id: string`
86396
86397 - `Gcp object`
86398
86399 Asserting party: the GCP project the organization is bound to.
86400
86401 - `type: optional "gcp"`
86402
86403 default: gcp
86404
86405 - `project_number: string`
86406
86407 - `Oidc object`
86408
86409 Asserting party: a customer-registered OIDC federation issuer.
86410
86411 - `type: optional "oidc"`
86412
86413 default: oidc
86414
86415 - `issuer: optional string or null`
86416
86417 The federation issuer's URL. Null when the presented credential failed verification.
86418
86419 - `ip_address: optional string or null`
86420
86421 - `subject: optional string or null`
86422
86423 The provider's verified identifier for the caller; its form depends on the provider.
86424
86425 - `user_agent: optional string or null`
86426
86427 - `AttestedDeviceActor object`
86428
86429 An attested mobile device authenticated via Apple App Attest.
86430
86431 - `type: optional "attested_device_actor"`
86432
86433 default: attested_device_actor
86434
86435 - `external_client_id: string`
86436
86437 - `kid_hash: string`
86438
86439 - `ip_address: optional string or null`
86440
86441 - `user_agent: optional string or null`
86442
86443 - `directory_removed: boolean`
86444
86445 Whether a directory sync connection was removed with the connection.
86446
86447 - `display_name: string`
86448
86449 The connection's display name at the time of deletion.
86450
86451 - `idp_connection_id: string`
86452
86453 The identity provider connection that was deleted, e.g. "idpc_01Ab...".
86454
86455 - `id: optional string`
86456
86457 Unique identifier for the activity e.g. 'activity_abcd1234'
86458
86459 - `created_at: optional string`
86460
86461 When this activity occurred.
86462
86463 format: date-time
86464
86465 - `organization_id: optional string or null`
86466
86467 Organization ID this activity is associated with
86468
86469 - `organization_uuid: optional string or null`
86470
86471 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
86472
86473 - `role_mappings_removed: optional array of object`
86474
86475 Group-to-role mappings that were removed with the connection.
86476
86477 - `idp_group_name: string`
86478
86479 Name of the identity provider group the mapping matched.
86480
86481 - `organization_id: string`
86482
86483 The organization the mapping belonged to, e.g. "org_01Ab...".
86484
86485 - `role: string`
86486
86487 The role members of the group were given.
86488
86489 - `seat_tier_mappings_removed: optional array of object`
86490
86491 Group-to-seat-tier mappings that were removed with the connection.
86492
86493 - `idp_group_name: string`
86494
86495 Name of the identity provider group the mapping matched.
86496
86497 - `organization_id: string`
86498
86499 The organization the mapping belonged to, e.g. "org_01Ab...".
86500
86501 - `seat_tier: string`
86502
86503 The seat tier members of the group were given.
86504
86505 - `unrouted_domains: optional array of string`
86506
86507 Verified domains whose single sign-on was routed through this connection; they no longer route anywhere.
86508
86509 - `OrgIdpConnectionUpdated object`
86510
86511 An identity provider connection's settings were changed.
86512
86513 - `type: optional "org_idp_connection_updated"`
86514
86515 default: org_idp_connection_updated
86516
86517 - `action: "renamed" or "shown_at_sign_in_changed" or "sso_restricted_to_scim_directory_members_changed" or "unspecified"`
86518
86519 Which setting was changed.
86520
86521 - `"renamed"`
86522
86523 - `"shown_at_sign_in_changed"`
86524
86525 - `"sso_restricted_to_scim_directory_members_changed"`
86526
86527 - `"unspecified"`
86528
86529 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
86530
86531 - `APIActor object`
86532
86533 - `type: optional "api_actor"`
86534
86535 default: api_actor
86536
86537 - `api_key_id: string`
86538
86539 - `ip_address: string`
86540
86541 - `user_agent: string`
86542
86543 - `UserActor object`
86544
86545 - `type: optional "user_actor"`
86546
86547 default: user_actor
86548
86549 - `email_address: string`
86550
86551 format: email
86552
86553 - `ip_address: string`
86554
86555 - `user_agent: string`
86556
86557 - `user_id: string`
86558
86559 - `UnauthenticatedUserActor object`
86560
86561 - `type: optional "unauthenticated_user_actor"`
86562
86563 default: unauthenticated_user_actor
86564
86565 - `ip_address: string`
86566
86567 - `user_agent: string`
86568
86569 - `unauthenticated_email_address: optional string or null`
86570
86571 format: email
86572
86573 - `AnthropicActor object`
86574
86575 - `type: optional "anthropic_actor"`
86576
86577 default: anthropic_actor
86578
86579 - `email_address: optional string or null`
86580
86581 format: email
86582
86583 - `SystemActor object`
86584
86585 Automated background processing performed by Anthropic systems, acting
86586 without a user or customer credential.
86587
86588 - `type: optional "system_actor"`
86589
86590 default: system_actor
86591
86592 - `service: optional string or null`
86593
86594 Name of the automated process that performed the action, when known.
86595
86596 - `AdminAPIKeyActor object`
86597
86598 - `type: optional "admin_api_key_actor"`
86599
86600 default: admin_api_key_actor
86601
86602 - `admin_api_key_id: string`
86603
86604 - `ip_address: string`
86605
86606 - `user_agent: string`
86607
86608 - `ServiceAccountActor object`
86609
86610 - `type: optional "service_account_actor"`
86611
86612 default: service_account_actor
86613
86614 - `ip_address: string`
86615
86616 - `service_account_id: string`
86617
86618 - `user_agent: string`
86619
86620 - `ScimDirectorySyncActor object`
86621
86622 - `type: optional "scim_directory_sync_actor"`
86623
86624 default: scim_directory_sync_actor
86625
86626 - `directory_id: string`
86627
86628 - `workos_event_id: string`
86629
86630 - `idp_connection_type: optional string or null`
86631
86632 - `FederatedIdentityActor object`
86633
86634 A federated external workload authenticated via a verified OIDC token.
86635
86636 Carries the verified issuer, subject, and audience claims from the
86637 presented JWT.
86638
86639 - `type: optional "federated_identity_actor"`
86640
86641 default: federated_identity_actor
86642
86643 - `issuer: string`
86644
86645 - `subject: string`
86646
86647 - `audience: optional array of string`
86648
86649 - `ip_address: optional string or null`
86650
86651 - `user_agent: optional string or null`
86652
86653 - `FederatedActor object`
86654
86655 An external identity asserted by a trusted provider — a cloud-provider
86656 gateway or a customer-registered federation issuer — acting without an
86657 Anthropic-provisioned account or service account.
86658
86659 - `type: optional "federated_actor"`
86660
86661 default: federated_actor
86662
86663 - `provider: Aws or Azure or Gcp or Oidc`
86664
86665 - `Aws object`
86666
86667 Asserting party: the AWS account the organization is bound to.
86668
86669 - `type: optional "aws"`
86670
86671 default: aws
86672
86673 - `account_id: string`
86674
86675 - `signed_principal: string`
86676
86677 The AWS-signed ARN of the IAM principal that requested the token.
86678
86679 - `Azure object`
86680
86681 Asserting party: the Azure subscription the organization is bound to.
86682
86683 - `type: optional "azure"`
86684
86685 default: azure
86686
86687 - `subscription_id: string`
86688
86689 - `Gcp object`
86690
86691 Asserting party: the GCP project the organization is bound to.
86692
86693 - `type: optional "gcp"`
86694
86695 default: gcp
86696
86697 - `project_number: string`
86698
86699 - `Oidc object`
86700
86701 Asserting party: a customer-registered OIDC federation issuer.
86702
86703 - `type: optional "oidc"`
86704
86705 default: oidc
86706
86707 - `issuer: optional string or null`
86708
86709 The federation issuer's URL. Null when the presented credential failed verification.
86710
86711 - `ip_address: optional string or null`
86712
86713 - `subject: optional string or null`
86714
86715 The provider's verified identifier for the caller; its form depends on the provider.
86716
86717 - `user_agent: optional string or null`
86718
86719 - `AttestedDeviceActor object`
86720
86721 An attested mobile device authenticated via Apple App Attest.
86722
86723 - `type: optional "attested_device_actor"`
86724
86725 default: attested_device_actor
86726
86727 - `external_client_id: string`
86728
86729 - `kid_hash: string`
86730
86731 - `ip_address: optional string or null`
86732
86733 - `user_agent: optional string or null`
86734
86735 - `display_name: string`
86736
86737 The connection's display name after the change.
86738
86739 - `idp_connection_id: string`
86740
86741 The identity provider connection that was changed, e.g. "idpc_01Ab...".
86742
86743 - `id: optional string`
86744
86745 Unique identifier for the activity e.g. 'activity_abcd1234'
86746
86747 - `created_at: optional string`
86748
86749 When this activity occurred.
86750
86751 format: date-time
86752
86753 - `organization_id: optional string or null`
86754
86755 Organization ID this activity is associated with
86756
86757 - `organization_uuid: optional string or null`
86758
86759 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
86760
86761 - `shown_at_sign_in: optional boolean or null`
86762
86763 After the change, whether the sign-in page offers the connection. Set only when action is shown_at_sign_in_changed.
86764
86765 - `sso_restricted_to_scim_directory_members: optional boolean or null`
86766
86767 After the change, whether sign-in with the connection is limited to the people its SCIM directory lists as active, apart from primary owners and parent organization owners. Set only when action is sso_restricted_to_scim_directory_members_changed.
86768
8402186769 - `OrgInviteLinkDisabled object`
8402286770
8402386771 Organization invite link was disabled.
from line 94470
9172294470
9172394471 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
9172494472
94473 - `OrgSecurityControlAttestationUpdated object`
94474
94475 The organization's attestation for a security control was recorded, changed, renewed or cleared by an administrator, or was ended automatically.
94476
94477 - `type: optional "org_security_control_attestation_updated"`
94478
94479 default: org_security_control_attestation_updated
94480
94481 - `action: "attested" or "changed" or "cleared" or 3 more`
94482
94483 What happened to the attestation.
94484
94485 - `"attested"`
94486
94487 An administrator recorded an attestation for a control that had none.
94488
94489 - `"changed"`
94490
94491 An administrator replaced the attestation, either with another status or, when `status` and `previous_status` are equal, with the same status, as with `renewed`.
94492
94493 - `"cleared"`
94494
94495 An administrator removed the attestation.
94496
94497 - `"lapsed"`
94498
94499 The attestation was ended automatically, not by an administrator. This activity can be later than the change that ended the attestation, and a change that could end an attestation was not always followed by this activity.
94500
94501 - `"renewed"`
94502
94503 An administrator saved the attestation again with the same status. Such a save can also be recorded as `changed`.
94504
94505 - `"unspecified"`
94506
94507 Not used. No activity is recorded with this value.
94508
94509 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
94510
94511 - `APIActor object`
94512
94513 - `type: optional "api_actor"`
94514
94515 default: api_actor
94516
94517 - `api_key_id: string`
94518
94519 - `ip_address: string`
94520
94521 - `user_agent: string`
94522
94523 - `UserActor object`
94524
94525 - `type: optional "user_actor"`
94526
94527 default: user_actor
94528
94529 - `email_address: string`
94530
94531 format: email
94532
94533 - `ip_address: string`
94534
94535 - `user_agent: string`
94536
94537 - `user_id: string`
94538
94539 - `UnauthenticatedUserActor object`
94540
94541 - `type: optional "unauthenticated_user_actor"`
94542
94543 default: unauthenticated_user_actor
94544
94545 - `ip_address: string`
94546
94547 - `user_agent: string`
94548
94549 - `unauthenticated_email_address: optional string or null`
94550
94551 format: email
94552
94553 - `AnthropicActor object`
94554
94555 - `type: optional "anthropic_actor"`
94556
94557 default: anthropic_actor
94558
94559 - `email_address: optional string or null`
94560
94561 format: email
94562
94563 - `SystemActor object`
94564
94565 Automated background processing performed by Anthropic systems, acting
94566 without a user or customer credential.
94567
94568 - `type: optional "system_actor"`
94569
94570 default: system_actor
94571
94572 - `service: optional string or null`
94573
94574 Name of the automated process that performed the action, when known.
94575
94576 - `AdminAPIKeyActor object`
94577
94578 - `type: optional "admin_api_key_actor"`
94579
94580 default: admin_api_key_actor
94581
94582 - `admin_api_key_id: string`
94583
94584 - `ip_address: string`
94585
94586 - `user_agent: string`
94587
94588 - `ServiceAccountActor object`
94589
94590 - `type: optional "service_account_actor"`
94591
94592 default: service_account_actor
94593
94594 - `ip_address: string`
94595
94596 - `service_account_id: string`
94597
94598 - `user_agent: string`
94599
94600 - `ScimDirectorySyncActor object`
94601
94602 - `type: optional "scim_directory_sync_actor"`
94603
94604 default: scim_directory_sync_actor
94605
94606 - `directory_id: string`
94607
94608 - `workos_event_id: string`
94609
94610 - `idp_connection_type: optional string or null`
94611
94612 - `FederatedIdentityActor object`
94613
94614 A federated external workload authenticated via a verified OIDC token.
94615
94616 Carries the verified issuer, subject, and audience claims from the
94617 presented JWT.
94618
94619 - `type: optional "federated_identity_actor"`
94620
94621 default: federated_identity_actor
94622
94623 - `issuer: string`
94624
94625 - `subject: string`
94626
94627 - `audience: optional array of string`
94628
94629 - `ip_address: optional string or null`
94630
94631 - `user_agent: optional string or null`
94632
94633 - `FederatedActor object`
94634
94635 An external identity asserted by a trusted provider — a cloud-provider
94636 gateway or a customer-registered federation issuer — acting without an
94637 Anthropic-provisioned account or service account.
94638
94639 - `type: optional "federated_actor"`
94640
94641 default: federated_actor
94642
94643 - `provider: Aws or Azure or Gcp or Oidc`
94644
94645 - `Aws object`
94646
94647 Asserting party: the AWS account the organization is bound to.
94648
94649 - `type: optional "aws"`
94650
94651 default: aws
94652
94653 - `account_id: string`
94654
94655 - `signed_principal: string`
94656
94657 The AWS-signed ARN of the IAM principal that requested the token.
94658
94659 - `Azure object`
94660
94661 Asserting party: the Azure subscription the organization is bound to.
94662
94663 - `type: optional "azure"`
94664
94665 default: azure
94666
94667 - `subscription_id: string`
94668
94669 - `Gcp object`
94670
94671 Asserting party: the GCP project the organization is bound to.
94672
94673 - `type: optional "gcp"`
94674
94675 default: gcp
94676
94677 - `project_number: string`
94678
94679 - `Oidc object`
94680
94681 Asserting party: a customer-registered OIDC federation issuer.
94682
94683 - `type: optional "oidc"`
94684
94685 default: oidc
94686
94687 - `issuer: optional string or null`
94688
94689 The federation issuer's URL. Null when the presented credential failed verification.
94690
94691 - `ip_address: optional string or null`
94692
94693 - `subject: optional string or null`
94694
94695 The provider's verified identifier for the caller; its form depends on the provider.
94696
94697 - `user_agent: optional string or null`
94698
94699 - `AttestedDeviceActor object`
94700
94701 An attested mobile device authenticated via Apple App Attest.
94702
94703 - `type: optional "attested_device_actor"`
94704
94705 default: attested_device_actor
94706
94707 - `external_client_id: string`
94708
94709 - `kid_hash: string`
94710
94711 - `ip_address: optional string or null`
94712
94713 - `user_agent: optional string or null`
94714
94715 - `control: string`
94716
94717 The identifier of the security control the attestation applies to, for example "oauth_conditional_access".
94718
94719 - `id: optional string`
94720
94721 Unique identifier for the activity e.g. 'activity_abcd1234'
94722
94723 - `created_at: optional string`
94724
94725 When this activity occurred.
94726
94727 format: date-time
94728
94729 - `organization_id: optional string or null`
94730
94731 Organization ID this activity is associated with
94732
94733 - `organization_uuid: optional string or null`
94734
94735 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
94736
94737 - `previous_status: optional "accepted_risk" or "completed" or "unspecified" or null`
94738
94739 The status before this change; absent when action is "attested".
94740
94741 - `"accepted_risk"`
94742
94743 An administrator attested that the organization accepts the risk of not meeting the control.
94744
94745 - `"completed"`
94746
94747 An administrator attested that the organization meets the control.
94748
94749 - `"unspecified"`
94750
94751 Not used. No activity is recorded with this value.
94752
94753 - `review_date: optional string or null`
94754
94755 The UTC day (ISO 8601 date) on which the attestation was due to stop taking effect; absent when it had no end date or was cleared.
94756
94757 - `status: optional "accepted_risk" or "completed" or "unspecified" or null`
94758
94759 The attested status; absent when the attestation was cleared.
94760
94761 - `"accepted_risk"`
94762
94763 An administrator attested that the organization accepts the risk of not meeting the control.
94764
94765 - `"completed"`
94766
94767 An administrator attested that the organization meets the control.
94768
94769 - `"unspecified"`
94770
94771 Not used. No activity is recorded with this value.
94772
9172594773 - `OrgSyncDeletingSynchronizedFilesStarted object`
9172694774
9172794775 Organization started deleting synchronized files.
from line 99776
9672899776
9672999777 - `user_agent: optional string or null`
9673099778
96731 - `updates: array of Name or Capabilities or RedactContent or 112 more`
99779 - `updates: array of Name or Capabilities or RedactContent or 114 more`
9673299780
9673399781 - `Name object`
9673499782
from line 100210
97162100210
97163100211 Setting value immediately before this change
97164100212
100213 - `ClaudeAIChatExternalSharingEnabled object`
100214
100215 The Claude.ai external chat sharing setting (inviting addresses outside the organization) was changed for the organization.
100216
100217 - `type: optional "claude_ai_chat_external_sharing_enabled"`
100218
100219 default: claude_ai_chat_external_sharing_enabled
100220
100221 - `current_value: optional boolean or null`
100222
100223 Setting value immediately after this change
100224
100225 - `previous_value: optional boolean or null`
100226
100227 Setting value immediately before this change
100228
97165100229 - `ClaudeAICcrSharingEnabled object`
97166100230
97167100231 The Claude.ai remote Claude Code session sharing setting was changed for the organization.
from line 101743
98679101743
98680101744 Setting value immediately before this change. Null means the setting had not been set for the organization, so the plan default applied.
98681101745
101746 - `ClaudeAIChatOrgSharingEnabled object`
101747
101748 The Claude.ai setting that lets members share a chat with everyone in the organization was changed for the organization.
101749
101750 - `type: optional "claude_ai_chat_org_sharing_enabled"`
101751
101752 default: claude_ai_chat_org_sharing_enabled
101753
101754 - `current_value: optional boolean or null`
101755
101756 Setting value immediately after this change
101757
101758 - `previous_value: optional boolean or null`
101759
101760 Setting value immediately before this change. Null means the setting had not been set for the organization, so the default (on) applied.
101761
98682101762 - `ArtifactTypeDashboardsEnabled object`
98683101763
98684101764 The setting that lets members create Dashboards, one of Anthropic's built-in Artifact types, was changed for the organization.
from line 102121
99041102121
99042102122 Tagged ID of the member whose access to their owned projects was restored, when known.
99043102123
102124 - `ParentOrganizationCentralizedManagementEnrolled object`
102125
102126 A parent organization was enrolled in centralized management.
102127
102128 - `type: optional "parent_organization_centralized_management_enrolled"`
102129
102130 default: parent_organization_centralized_management_enrolled
102131
102132 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
102133
102134 - `APIActor object`
102135
102136 - `type: optional "api_actor"`
102137
102138 default: api_actor
102139
102140 - `api_key_id: string`
102141
102142 - `ip_address: string`
102143
102144 - `user_agent: string`
102145
102146 - `UserActor object`
102147
102148 - `type: optional "user_actor"`
102149
102150 default: user_actor
102151
102152 - `email_address: string`
102153
102154 format: email
102155
102156 - `ip_address: string`
102157
102158 - `user_agent: string`
102159
102160 - `user_id: string`
102161
102162 - `UnauthenticatedUserActor object`
102163
102164 - `type: optional "unauthenticated_user_actor"`
102165
102166 default: unauthenticated_user_actor
102167
102168 - `ip_address: string`
102169
102170 - `user_agent: string`
102171
102172 - `unauthenticated_email_address: optional string or null`
102173
102174 format: email
102175
102176 - `AnthropicActor object`
102177
102178 - `type: optional "anthropic_actor"`
102179
102180 default: anthropic_actor
102181
102182 - `email_address: optional string or null`
102183
102184 format: email
102185
102186 - `SystemActor object`
102187
102188 Automated background processing performed by Anthropic systems, acting
102189 without a user or customer credential.
102190
102191 - `type: optional "system_actor"`
102192
102193 default: system_actor
102194
102195 - `service: optional string or null`
102196
102197 Name of the automated process that performed the action, when known.
102198
102199 - `AdminAPIKeyActor object`
102200
102201 - `type: optional "admin_api_key_actor"`
102202
102203 default: admin_api_key_actor
102204
102205 - `admin_api_key_id: string`
102206
102207 - `ip_address: string`
102208
102209 - `user_agent: string`
102210
102211 - `ServiceAccountActor object`
102212
102213 - `type: optional "service_account_actor"`
102214
102215 default: service_account_actor
102216
102217 - `ip_address: string`
102218
102219 - `service_account_id: string`
102220
102221 - `user_agent: string`
102222
102223 - `ScimDirectorySyncActor object`
102224
102225 - `type: optional "scim_directory_sync_actor"`
102226
102227 default: scim_directory_sync_actor
102228
102229 - `directory_id: string`
102230
102231 - `workos_event_id: string`
102232
102233 - `idp_connection_type: optional string or null`
102234
102235 - `FederatedIdentityActor object`
102236
102237 A federated external workload authenticated via a verified OIDC token.
102238
102239 Carries the verified issuer, subject, and audience claims from the
102240 presented JWT.
102241
102242 - `type: optional "federated_identity_actor"`
102243
102244 default: federated_identity_actor
102245
102246 - `issuer: string`
102247
102248 - `subject: string`
102249
102250 - `audience: optional array of string`
102251
102252 - `ip_address: optional string or null`
102253
102254 - `user_agent: optional string or null`
102255
102256 - `FederatedActor object`
102257
102258 An external identity asserted by a trusted provider — a cloud-provider
102259 gateway or a customer-registered federation issuer — acting without an
102260 Anthropic-provisioned account or service account.
102261
102262 - `type: optional "federated_actor"`
102263
102264 default: federated_actor
102265
102266 - `provider: Aws or Azure or Gcp or Oidc`
102267
102268 - `Aws object`
102269
102270 Asserting party: the AWS account the organization is bound to.
102271
102272 - `type: optional "aws"`
102273
102274 default: aws
102275
102276 - `account_id: string`
102277
102278 - `signed_principal: string`
102279
102280 The AWS-signed ARN of the IAM principal that requested the token.
102281
102282 - `Azure object`
102283
102284 Asserting party: the Azure subscription the organization is bound to.
102285
102286 - `type: optional "azure"`
102287
102288 default: azure
102289
102290 - `subscription_id: string`
102291
102292 - `Gcp object`
102293
102294 Asserting party: the GCP project the organization is bound to.
102295
102296 - `type: optional "gcp"`
102297
102298 default: gcp
102299
102300 - `project_number: string`
102301
102302 - `Oidc object`
102303
102304 Asserting party: a customer-registered OIDC federation issuer.
102305
102306 - `type: optional "oidc"`
102307
102308 default: oidc
102309
102310 - `issuer: optional string or null`
102311
102312 The federation issuer's URL. Null when the presented credential failed verification.
102313
102314 - `ip_address: optional string or null`
102315
102316 - `subject: optional string or null`
102317
102318 The provider's verified identifier for the caller; its form depends on the provider.
102319
102320 - `user_agent: optional string or null`
102321
102322 - `AttestedDeviceActor object`
102323
102324 An attested mobile device authenticated via Apple App Attest.
102325
102326 - `type: optional "attested_device_actor"`
102327
102328 default: attested_device_actor
102329
102330 - `external_client_id: string`
102331
102332 - `kid_hash: string`
102333
102334 - `ip_address: optional string or null`
102335
102336 - `user_agent: optional string or null`
102337
102338 - `parent_organization_id: string`
102339
102340 The parent organization that was enrolled in centralized management.
102341
102342 - `id: optional string`
102343
102344 Unique identifier for the activity e.g. 'activity_abcd1234'
102345
102346 - `created_at: optional string`
102347
102348 When this activity occurred.
102349
102350 format: date-time
102351
102352 - `members: optional array of object`
102353
102354 The members granted parent-organization roles at enrollment.
102355
102356 - `role: "admin" or "owner" or "unspecified"`
102357
102358 The parent-organization role held.
102359
102360 - `"admin"`
102361
102362 - `"owner"`
102363
102364 - `"unspecified"`
102365
102366 - `user_id: string`
102367
102368 Tagged ID of the member's account.
102369
102370 - `organization_id: optional string or null`
102371
102372 Organization ID this activity is associated with
102373
102374 - `organization_uuid: optional string or null`
102375
102376 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
102377
102378 - `ParentOrganizationCentralizedManagementOrganizationUpdated object`
102379
102380 An organization's approval of its parent organization's Centralized Management setup changed, or its administrators were reminded to approve.
102381
102382 - `type: optional "parent_organization_centralized_management_organization_updated"`
102383
102384 default: parent_organization_centralized_management_organization_updated
102385
102386 - `action: "approval_withdrawn" or "approved" or "force_included" or 3 more`
102387
102388 How the organization's approval changed.
102389
102390 - `"approval_withdrawn"`
102391
102392 - `"approved"`
102393
102394 - `"force_included"`
102395
102396 - `"joined"`
102397
102398 - `"reminder_sent"`
102399
102400 - `"unspecified"`
102401
102402 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
102403
102404 - `APIActor object`
102405
102406 - `type: optional "api_actor"`
102407
102408 default: api_actor
102409
102410 - `api_key_id: string`
102411
102412 - `ip_address: string`
102413
102414 - `user_agent: string`
102415
102416 - `UserActor object`
102417
102418 - `type: optional "user_actor"`
102419
102420 default: user_actor
102421
102422 - `email_address: string`
102423
102424 format: email
102425
102426 - `ip_address: string`
102427
102428 - `user_agent: string`
102429
102430 - `user_id: string`
102431
102432 - `UnauthenticatedUserActor object`
102433
102434 - `type: optional "unauthenticated_user_actor"`
102435
102436 default: unauthenticated_user_actor
102437
102438 - `ip_address: string`
102439
102440 - `user_agent: string`
102441
102442 - `unauthenticated_email_address: optional string or null`
102443
102444 format: email
102445
102446 - `AnthropicActor object`
102447
102448 - `type: optional "anthropic_actor"`
102449
102450 default: anthropic_actor
102451
102452 - `email_address: optional string or null`
102453
102454 format: email
102455
102456 - `SystemActor object`
102457
102458 Automated background processing performed by Anthropic systems, acting
102459 without a user or customer credential.
102460
102461 - `type: optional "system_actor"`
102462
102463 default: system_actor
102464
102465 - `service: optional string or null`
102466
102467 Name of the automated process that performed the action, when known.
102468
102469 - `AdminAPIKeyActor object`
102470
102471 - `type: optional "admin_api_key_actor"`
102472
102473 default: admin_api_key_actor
102474
102475 - `admin_api_key_id: string`
102476
102477 - `ip_address: string`
102478
102479 - `user_agent: string`
102480
102481 - `ServiceAccountActor object`
102482
102483 - `type: optional "service_account_actor"`
102484
102485 default: service_account_actor
102486
102487 - `ip_address: string`
102488
102489 - `service_account_id: string`
102490
102491 - `user_agent: string`
102492
102493 - `ScimDirectorySyncActor object`
102494
102495 - `type: optional "scim_directory_sync_actor"`
102496
102497 default: scim_directory_sync_actor
102498
102499 - `directory_id: string`
102500
102501 - `workos_event_id: string`
102502
102503 - `idp_connection_type: optional string or null`
102504
102505 - `FederatedIdentityActor object`
102506
102507 A federated external workload authenticated via a verified OIDC token.
102508
102509 Carries the verified issuer, subject, and audience claims from the
102510 presented JWT.
102511
102512 - `type: optional "federated_identity_actor"`
102513
102514 default: federated_identity_actor
102515
102516 - `issuer: string`
102517
102518 - `subject: string`
102519
102520 - `audience: optional array of string`
102521
102522 - `ip_address: optional string or null`
102523
102524 - `user_agent: optional string or null`
102525
102526 - `FederatedActor object`
102527
102528 An external identity asserted by a trusted provider — a cloud-provider
102529 gateway or a customer-registered federation issuer — acting without an
102530 Anthropic-provisioned account or service account.
102531
102532 - `type: optional "federated_actor"`
102533
102534 default: federated_actor
102535
102536 - `provider: Aws or Azure or Gcp or Oidc`
102537
102538 - `Aws object`
102539
102540 Asserting party: the AWS account the organization is bound to.
102541
102542 - `type: optional "aws"`
102543
102544 default: aws
102545
102546 - `account_id: string`
102547
102548 - `signed_principal: string`
102549
102550 The AWS-signed ARN of the IAM principal that requested the token.
102551
102552 - `Azure object`
102553
102554 Asserting party: the Azure subscription the organization is bound to.
102555
102556 - `type: optional "azure"`
102557
102558 default: azure
102559
102560 - `subscription_id: string`
102561
102562 - `Gcp object`
102563
102564 Asserting party: the GCP project the organization is bound to.
102565
102566 - `type: optional "gcp"`
102567
102568 default: gcp
102569
102570 - `project_number: string`
102571
102572 - `Oidc object`
102573
102574 Asserting party: a customer-registered OIDC federation issuer.
102575
102576 - `type: optional "oidc"`
102577
102578 default: oidc
102579
102580 - `issuer: optional string or null`
102581
102582 The federation issuer's URL. Null when the presented credential failed verification.
102583
102584 - `ip_address: optional string or null`
102585
102586 - `subject: optional string or null`
102587
102588 The provider's verified identifier for the caller; its form depends on the provider.
102589
102590 - `user_agent: optional string or null`
102591
102592 - `AttestedDeviceActor object`
102593
102594 An attested mobile device authenticated via Apple App Attest.
102595
102596 - `type: optional "attested_device_actor"`
102597
102598 default: attested_device_actor
102599
102600 - `external_client_id: string`
102601
102602 - `kid_hash: string`
102603
102604 - `ip_address: optional string or null`
102605
102606 - `user_agent: optional string or null`
102607
102608 - `parent_organization_id: string`
102609
102610 The parent organization running the setup, e.g. "parent_org_01HX...".
102611
102612 - `target_organization_id: string`
102613
102614 The organization whose approval changed, e.g. "org_01HX...".
102615
102616 - `id: optional string`
102617
102618 Unique identifier for the activity e.g. 'activity_abcd1234'
102619
102620 - `created_at: optional string`
102621
102622 When this activity occurred.
102623
102624 format: date-time
102625
102626 - `organization_id: optional string or null`
102627
102628 Organization ID this activity is associated with
102629
102630 - `organization_uuid: optional string or null`
102631
102632 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
102633
102634 - `set_changed_at: optional string or null`
102635
102636 The version of the proposed administrators the approval, withdrawal or inclusion applied to (absent for reminders).
102637
102638 format: date-time
102639
102640 - `ParentOrganizationCentralizedManagementSetupUpdated object`
102641
102642 The Centralized Management setup of a parent organization changed: it was started or abandoned, its proposed administrators changed, its remaining organizations were force approved, or it completed.
102643
102644 - `type: optional "parent_organization_centralized_management_setup_updated"`
102645
102646 default: parent_organization_centralized_management_setup_updated
102647
102648 - `action: "abandoned" or "child_joined" or "completed" or 6 more`
102649
102650 How the setup changed.
102651
102652 - `"abandoned"`
102653
102654 - `"child_joined"`
102655
102656 - `"completed"`
102657
102658 - `"force_approved"`
102659
102660 - `"nominee_added"`
102661
102662 - `"nominee_removed"`
102663
102664 - `"restarted"`
102665
102666 - `"started"`
102667
102668 - `"unspecified"`
102669
102670 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
102671
102672 - `APIActor object`
102673
102674 - `type: optional "api_actor"`
102675
102676 default: api_actor
102677
102678 - `api_key_id: string`
102679
102680 - `ip_address: string`
102681
102682 - `user_agent: string`
102683
102684 - `UserActor object`
102685
102686 - `type: optional "user_actor"`
102687
102688 default: user_actor
102689
102690 - `email_address: string`
102691
102692 format: email
102693
102694 - `ip_address: string`
102695
102696 - `user_agent: string`
102697
102698 - `user_id: string`
102699
102700 - `UnauthenticatedUserActor object`
102701
102702 - `type: optional "unauthenticated_user_actor"`
102703
102704 default: unauthenticated_user_actor
102705
102706 - `ip_address: string`
102707
102708 - `user_agent: string`
102709
102710 - `unauthenticated_email_address: optional string or null`
102711
102712 format: email
102713
102714 - `AnthropicActor object`
102715
102716 - `type: optional "anthropic_actor"`
102717
102718 default: anthropic_actor
102719
102720 - `email_address: optional string or null`
102721
102722 format: email
102723
102724 - `SystemActor object`
102725
102726 Automated background processing performed by Anthropic systems, acting
102727 without a user or customer credential.
102728
102729 - `type: optional "system_actor"`
102730
102731 default: system_actor
102732
102733 - `service: optional string or null`
102734
102735 Name of the automated process that performed the action, when known.
102736
102737 - `AdminAPIKeyActor object`
102738
102739 - `type: optional "admin_api_key_actor"`
102740
102741 default: admin_api_key_actor
102742
102743 - `admin_api_key_id: string`
102744
102745 - `ip_address: string`
102746
102747 - `user_agent: string`
102748
102749 - `ServiceAccountActor object`
102750
102751 - `type: optional "service_account_actor"`
102752
102753 default: service_account_actor
102754
102755 - `ip_address: string`
102756
102757 - `service_account_id: string`
102758
102759 - `user_agent: string`
102760
102761 - `ScimDirectorySyncActor object`
102762
102763 - `type: optional "scim_directory_sync_actor"`
102764
102765 default: scim_directory_sync_actor
102766
102767 - `directory_id: string`
102768
102769 - `workos_event_id: string`
102770
102771 - `idp_connection_type: optional string or null`
102772
102773 - `FederatedIdentityActor object`
102774
102775 A federated external workload authenticated via a verified OIDC token.
102776
102777 Carries the verified issuer, subject, and audience claims from the
102778 presented JWT.
102779
102780 - `type: optional "federated_identity_actor"`
102781
102782 default: federated_identity_actor
102783
102784 - `issuer: string`
102785
102786 - `subject: string`
102787
102788 - `audience: optional array of string`
102789
102790 - `ip_address: optional string or null`
102791
102792 - `user_agent: optional string or null`
102793
102794 - `FederatedActor object`
102795
102796 An external identity asserted by a trusted provider — a cloud-provider
102797 gateway or a customer-registered federation issuer — acting without an
102798 Anthropic-provisioned account or service account.
102799
102800 - `type: optional "federated_actor"`
102801
102802 default: federated_actor
102803
102804 - `provider: Aws or Azure or Gcp or Oidc`
102805
102806 - `Aws object`
102807
102808 Asserting party: the AWS account the organization is bound to.
102809
102810 - `type: optional "aws"`
102811
102812 default: aws
102813
102814 - `account_id: string`
102815
102816 - `signed_principal: string`
102817
102818 The AWS-signed ARN of the IAM principal that requested the token.
102819
102820 - `Azure object`
102821
102822 Asserting party: the Azure subscription the organization is bound to.
102823
102824 - `type: optional "azure"`
102825
102826 default: azure
102827
102828 - `subscription_id: string`
102829
102830 - `Gcp object`
102831
102832 Asserting party: the GCP project the organization is bound to.
102833
102834 - `type: optional "gcp"`
102835
102836 default: gcp
102837
102838 - `project_number: string`
102839
102840 - `Oidc object`
102841
102842 Asserting party: a customer-registered OIDC federation issuer.
102843
102844 - `type: optional "oidc"`
102845
102846 default: oidc
102847
102848 - `issuer: optional string or null`
102849
102850 The federation issuer's URL. Null when the presented credential failed verification.
102851
102852 - `ip_address: optional string or null`
102853
102854 - `subject: optional string or null`
102855
102856 The provider's verified identifier for the caller; its form depends on the provider.
102857
102858 - `user_agent: optional string or null`
102859
102860 - `AttestedDeviceActor object`
102861
102862 An attested mobile device authenticated via Apple App Attest.
102863
102864 - `type: optional "attested_device_actor"`
102865
102866 default: attested_device_actor
102867
102868 - `external_client_id: string`
102869
102870 - `kid_hash: string`
102871
102872 - `ip_address: optional string or null`
102873
102874 - `user_agent: optional string or null`
102875
102876 - `parent_organization_id: string`
102877
102878 The parent organization whose setup changed, e.g. "parent_org_01HX...".
102879
102880 - `id: optional string`
102881
102882 Unique identifier for the activity e.g. 'activity_abcd1234'
102883
102884 - `created_at: optional string`
102885
102886 When this activity occurred.
102887
102888 format: date-time
102889
102890 - `nominated_via_organization_id: optional string or null`
102891
102892 The organization the administrator was proposed through (nominee_added), e.g. "org_01HX...".
102893
102894 - `nominee_account_id: optional string or null`
102895
102896 The administrator added to or removed from the proposed administrators (nominee_added, nominee_removed), e.g. "user_01HX...".
102897
102898 - `organization_id: optional string or null`
102899
102900 Organization ID this activity is associated with
102901
102902 - `organization_uuid: optional string or null`
102903
102904 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
102905
102906 - `set_changed_at: optional string or null`
102907
102908 When the proposed administrators last changed as of this event; events sharing this value belong to the same version of the proposed administrators.
102909
102910 format: date-time
102911
102912 - `ParentOrganizationCentralizedManagementUnenrolled object`
102913
102914 A parent organization was unenrolled from centralized management.
102915
102916 - `type: optional "parent_organization_centralized_management_unenrolled"`
102917
102918 default: parent_organization_centralized_management_unenrolled
102919
102920 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
102921
102922 - `APIActor object`
102923
102924 - `type: optional "api_actor"`
102925
102926 default: api_actor
102927
102928 - `api_key_id: string`
102929
102930 - `ip_address: string`
102931
102932 - `user_agent: string`
102933
102934 - `UserActor object`
102935
102936 - `type: optional "user_actor"`
102937
102938 default: user_actor
102939
102940 - `email_address: string`
102941
102942 format: email
102943
102944 - `ip_address: string`
102945
102946 - `user_agent: string`
102947
102948 - `user_id: string`
102949
102950 - `UnauthenticatedUserActor object`
102951
102952 - `type: optional "unauthenticated_user_actor"`
102953
102954 default: unauthenticated_user_actor
102955
102956 - `ip_address: string`
102957
102958 - `user_agent: string`
102959
102960 - `unauthenticated_email_address: optional string or null`
102961
102962 format: email
102963
102964 - `AnthropicActor object`
102965
102966 - `type: optional "anthropic_actor"`
102967
102968 default: anthropic_actor
102969
102970 - `email_address: optional string or null`
102971
102972 format: email
102973
102974 - `SystemActor object`
102975
102976 Automated background processing performed by Anthropic systems, acting
102977 without a user or customer credential.
102978
102979 - `type: optional "system_actor"`
102980
102981 default: system_actor
102982
102983 - `service: optional string or null`
102984
102985 Name of the automated process that performed the action, when known.
102986
102987 - `AdminAPIKeyActor object`
102988
102989 - `type: optional "admin_api_key_actor"`
102990
102991 default: admin_api_key_actor
102992
102993 - `admin_api_key_id: string`
102994
102995 - `ip_address: string`
102996
102997 - `user_agent: string`
102998
102999 - `ServiceAccountActor object`
103000
103001 - `type: optional "service_account_actor"`
103002
103003 default: service_account_actor
103004
103005 - `ip_address: string`
103006
103007 - `service_account_id: string`
103008
103009 - `user_agent: string`
103010
103011 - `ScimDirectorySyncActor object`
103012
103013 - `type: optional "scim_directory_sync_actor"`
103014
103015 default: scim_directory_sync_actor
103016
103017 - `directory_id: string`
103018
103019 - `workos_event_id: string`
103020
103021 - `idp_connection_type: optional string or null`
103022
103023 - `FederatedIdentityActor object`
103024
103025 A federated external workload authenticated via a verified OIDC token.
103026
103027 Carries the verified issuer, subject, and audience claims from the
103028 presented JWT.
103029
103030 - `type: optional "federated_identity_actor"`
103031
103032 default: federated_identity_actor
103033
103034 - `issuer: string`
103035
103036 - `subject: string`
103037
103038 - `audience: optional array of string`
103039
103040 - `ip_address: optional string or null`
103041
103042 - `user_agent: optional string or null`
103043
103044 - `FederatedActor object`
103045
103046 An external identity asserted by a trusted provider — a cloud-provider
103047 gateway or a customer-registered federation issuer — acting without an
103048 Anthropic-provisioned account or service account.
103049
103050 - `type: optional "federated_actor"`
103051
103052 default: federated_actor
103053
103054 - `provider: Aws or Azure or Gcp or Oidc`
103055
103056 - `Aws object`
103057
103058 Asserting party: the AWS account the organization is bound to.
103059
103060 - `type: optional "aws"`
103061
103062 default: aws
103063
103064 - `account_id: string`
103065
103066 - `signed_principal: string`
103067
103068 The AWS-signed ARN of the IAM principal that requested the token.
103069
103070 - `Azure object`
103071
103072 Asserting party: the Azure subscription the organization is bound to.
103073
103074 - `type: optional "azure"`
103075
103076 default: azure
103077
103078 - `subscription_id: string`
103079
103080 - `Gcp object`
103081
103082 Asserting party: the GCP project the organization is bound to.
103083
103084 - `type: optional "gcp"`
103085
103086 default: gcp
103087
103088 - `project_number: string`
103089
103090 - `Oidc object`
103091
103092 Asserting party: a customer-registered OIDC federation issuer.
103093
103094 - `type: optional "oidc"`
103095
103096 default: oidc
103097
103098 - `issuer: optional string or null`
103099
103100 The federation issuer's URL. Null when the presented credential failed verification.
103101
103102 - `ip_address: optional string or null`
103103
103104 - `subject: optional string or null`
103105
103106 The provider's verified identifier for the caller; its form depends on the provider.
103107
103108 - `user_agent: optional string or null`
103109
103110 - `AttestedDeviceActor object`
103111
103112 An attested mobile device authenticated via Apple App Attest.
103113
103114 - `type: optional "attested_device_actor"`
103115
103116 default: attested_device_actor
103117
103118 - `external_client_id: string`
103119
103120 - `kid_hash: string`
103121
103122 - `ip_address: optional string or null`
103123
103124 - `user_agent: optional string or null`
103125
103126 - `parent_organization_id: string`
103127
103128 The parent organization that was unenrolled from centralized management.
103129
103130 - `id: optional string`
103131
103132 Unique identifier for the activity e.g. 'activity_abcd1234'
103133
103134 - `created_at: optional string`
103135
103136 When this activity occurred.
103137
103138 format: date-time
103139
103140 - `members: optional array of object`
103141
103142 The members whose parent-organization roles were revoked at unenrollment.
103143
103144 - `role: "admin" or "owner" or "unspecified"`
103145
103146 The parent-organization role held.
103147
103148 - `"admin"`
103149
103150 - `"owner"`
103151
103152 - `"unspecified"`
103153
103154 - `user_id: string`
103155
103156 Tagged ID of the member's account.
103157
103158 - `organization_id: optional string or null`
103159
103160 Organization ID this activity is associated with
103161
103162 - `organization_uuid: optional string or null`
103163
103164 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
103165
103166 - `ParentOrganizationMemberRemoved object`
103167
103168 A parent-organization admin role was removed from a user.
103169
103170 - `type: optional "parent_organization_member_removed"`
103171
103172 default: parent_organization_member_removed
103173
103174 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
103175
103176 - `APIActor object`
103177
103178 - `type: optional "api_actor"`
103179
103180 default: api_actor
103181
103182 - `api_key_id: string`
103183
103184 - `ip_address: string`
103185
103186 - `user_agent: string`
103187
103188 - `UserActor object`
103189
103190 - `type: optional "user_actor"`
103191
103192 default: user_actor
103193
103194 - `email_address: string`
103195
103196 format: email
103197
103198 - `ip_address: string`
103199
103200 - `user_agent: string`
103201
103202 - `user_id: string`
103203
103204 - `UnauthenticatedUserActor object`
103205
103206 - `type: optional "unauthenticated_user_actor"`
103207
103208 default: unauthenticated_user_actor
103209
103210 - `ip_address: string`
103211
103212 - `user_agent: string`
103213
103214 - `unauthenticated_email_address: optional string or null`
103215
103216 format: email
103217
103218 - `AnthropicActor object`
103219
103220 - `type: optional "anthropic_actor"`
103221
103222 default: anthropic_actor
103223
103224 - `email_address: optional string or null`
103225
103226 format: email
103227
103228 - `SystemActor object`
103229
103230 Automated background processing performed by Anthropic systems, acting
103231 without a user or customer credential.
103232
103233 - `type: optional "system_actor"`
103234
103235 default: system_actor
103236
103237 - `service: optional string or null`
103238
103239 Name of the automated process that performed the action, when known.
103240
103241 - `AdminAPIKeyActor object`
103242
103243 - `type: optional "admin_api_key_actor"`
103244
103245 default: admin_api_key_actor
103246
103247 - `admin_api_key_id: string`
103248
103249 - `ip_address: string`
103250
103251 - `user_agent: string`
103252
103253 - `ServiceAccountActor object`
103254
103255 - `type: optional "service_account_actor"`
103256
103257 default: service_account_actor
103258
103259 - `ip_address: string`
103260
103261 - `service_account_id: string`
103262
103263 - `user_agent: string`
103264
103265 - `ScimDirectorySyncActor object`
103266
103267 - `type: optional "scim_directory_sync_actor"`
103268
103269 default: scim_directory_sync_actor
103270
103271 - `directory_id: string`
103272
103273 - `workos_event_id: string`
103274
103275 - `idp_connection_type: optional string or null`
103276
103277 - `FederatedIdentityActor object`
103278
103279 A federated external workload authenticated via a verified OIDC token.
103280
103281 Carries the verified issuer, subject, and audience claims from the
103282 presented JWT.
103283
103284 - `type: optional "federated_identity_actor"`
103285
103286 default: federated_identity_actor
103287
103288 - `issuer: string`
103289
103290 - `subject: string`
103291
103292 - `audience: optional array of string`
103293
103294 - `ip_address: optional string or null`
103295
103296 - `user_agent: optional string or null`
103297
103298 - `FederatedActor object`
103299
103300 An external identity asserted by a trusted provider — a cloud-provider
103301 gateway or a customer-registered federation issuer — acting without an
103302 Anthropic-provisioned account or service account.
103303
103304 - `type: optional "federated_actor"`
103305
103306 default: federated_actor
103307
103308 - `provider: Aws or Azure or Gcp or Oidc`
103309
103310 - `Aws object`
103311
103312 Asserting party: the AWS account the organization is bound to.
103313
103314 - `type: optional "aws"`
103315
103316 default: aws
103317
103318 - `account_id: string`
103319
103320 - `signed_principal: string`
103321
103322 The AWS-signed ARN of the IAM principal that requested the token.
103323
103324 - `Azure object`
103325
103326 Asserting party: the Azure subscription the organization is bound to.
103327
103328 - `type: optional "azure"`
103329
103330 default: azure
103331
103332 - `subscription_id: string`
103333
103334 - `Gcp object`
103335
103336 Asserting party: the GCP project the organization is bound to.
103337
103338 - `type: optional "gcp"`
103339
103340 default: gcp
103341
103342 - `project_number: string`
103343
103344 - `Oidc object`
103345
103346 Asserting party: a customer-registered OIDC federation issuer.
103347
103348 - `type: optional "oidc"`
103349
103350 default: oidc
103351
103352 - `issuer: optional string or null`
103353
103354 The federation issuer's URL. Null when the presented credential failed verification.
103355
103356 - `ip_address: optional string or null`
103357
103358 - `subject: optional string or null`
103359
103360 The provider's verified identifier for the caller; its form depends on the provider.
103361
103362 - `user_agent: optional string or null`
103363
103364 - `AttestedDeviceActor object`
103365
103366 An attested mobile device authenticated via Apple App Attest.
103367
103368 - `type: optional "attested_device_actor"`
103369
103370 default: attested_device_actor
103371
103372 - `external_client_id: string`
103373
103374 - `kid_hash: string`
103375
103376 - `ip_address: optional string or null`
103377
103378 - `user_agent: optional string or null`
103379
103380 - `parent_organization_id: string`
103381
103382 The parent organization whose admin roster was changed.
103383
103384 - `role: string`
103385
103386 The role the user held on the parent organization at the time of removal.
103387
103388 - `user_id: string`
103389
103390 The user whose parent-organization admin role was removed.
103391
103392 - `id: optional string`
103393
103394 Unique identifier for the activity e.g. 'activity_abcd1234'
103395
103396 - `created_at: optional string`
103397
103398 When this activity occurred.
103399
103400 format: date-time
103401
103402 - `organization_id: optional string or null`
103403
103404 Organization ID this activity is associated with
103405
103406 - `organization_uuid: optional string or null`
103407
103408 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
103409
103410 - `ParentOrganizationMemberUpdated object`
103411
103412 A parent-organization admin role was granted or changed for a user.
103413
103414 - `type: optional "parent_organization_member_updated"`
103415
103416 default: parent_organization_member_updated
103417
103418 - `action: "added" or "role_changed" or "unspecified"`
103419
103420 Whether the user was newly granted the role or had an existing role changed.
103421
103422 - `"added"`
103423
103424 - `"role_changed"`
103425
103426 - `"unspecified"`
103427
103428 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
103429
103430 - `APIActor object`
103431
103432 - `type: optional "api_actor"`
103433
103434 default: api_actor
103435
103436 - `api_key_id: string`
103437
103438 - `ip_address: string`
103439
103440 - `user_agent: string`
103441
103442 - `UserActor object`
103443
103444 - `type: optional "user_actor"`
103445
103446 default: user_actor
103447
103448 - `email_address: string`
103449
103450 format: email
103451
103452 - `ip_address: string`
103453
103454 - `user_agent: string`
103455
103456 - `user_id: string`
103457
103458 - `UnauthenticatedUserActor object`
103459
103460 - `type: optional "unauthenticated_user_actor"`
103461
103462 default: unauthenticated_user_actor
103463
103464 - `ip_address: string`
103465
103466 - `user_agent: string`
103467
103468 - `unauthenticated_email_address: optional string or null`
103469
103470 format: email
103471
103472 - `AnthropicActor object`
103473
103474 - `type: optional "anthropic_actor"`
103475
103476 default: anthropic_actor
103477
103478 - `email_address: optional string or null`
103479
103480 format: email
103481
103482 - `SystemActor object`
103483
103484 Automated background processing performed by Anthropic systems, acting
103485 without a user or customer credential.
103486
103487 - `type: optional "system_actor"`
103488
103489 default: system_actor
103490
103491 - `service: optional string or null`
103492
103493 Name of the automated process that performed the action, when known.
103494
103495 - `AdminAPIKeyActor object`
103496
103497 - `type: optional "admin_api_key_actor"`
103498
103499 default: admin_api_key_actor
103500
103501 - `admin_api_key_id: string`
103502
103503 - `ip_address: string`
103504
103505 - `user_agent: string`
103506
103507 - `ServiceAccountActor object`
103508
103509 - `type: optional "service_account_actor"`
103510
103511 default: service_account_actor
103512
103513 - `ip_address: string`
103514
103515 - `service_account_id: string`
103516
103517 - `user_agent: string`
103518
103519 - `ScimDirectorySyncActor object`
103520
103521 - `type: optional "scim_directory_sync_actor"`
103522
103523 default: scim_directory_sync_actor
103524
103525 - `directory_id: string`
103526
103527 - `workos_event_id: string`
103528
103529 - `idp_connection_type: optional string or null`
103530
103531 - `FederatedIdentityActor object`
103532
103533 A federated external workload authenticated via a verified OIDC token.
103534
103535 Carries the verified issuer, subject, and audience claims from the
103536 presented JWT.
103537
103538 - `type: optional "federated_identity_actor"`
103539
103540 default: federated_identity_actor
103541
103542 - `issuer: string`
103543
103544 - `subject: string`
103545
103546 - `audience: optional array of string`
103547
103548 - `ip_address: optional string or null`
103549
103550 - `user_agent: optional string or null`
103551
103552 - `FederatedActor object`
103553
103554 An external identity asserted by a trusted provider — a cloud-provider
103555 gateway or a customer-registered federation issuer — acting without an
103556 Anthropic-provisioned account or service account.
103557
103558 - `type: optional "federated_actor"`
103559
103560 default: federated_actor
103561
103562 - `provider: Aws or Azure or Gcp or Oidc`
103563
103564 - `Aws object`
103565
103566 Asserting party: the AWS account the organization is bound to.
103567
103568 - `type: optional "aws"`
103569
103570 default: aws
103571
103572 - `account_id: string`
103573
103574 - `signed_principal: string`
103575
103576 The AWS-signed ARN of the IAM principal that requested the token.
103577
103578 - `Azure object`
103579
103580 Asserting party: the Azure subscription the organization is bound to.
103581
103582 - `type: optional "azure"`
103583
103584 default: azure
103585
103586 - `subscription_id: string`
103587
103588 - `Gcp object`
103589
103590 Asserting party: the GCP project the organization is bound to.
103591
103592 - `type: optional "gcp"`
103593
103594 default: gcp
103595
103596 - `project_number: string`
103597
103598 - `Oidc object`
103599
103600 Asserting party: a customer-registered OIDC federation issuer.
103601
103602 - `type: optional "oidc"`
103603
103604 default: oidc
103605
103606 - `issuer: optional string or null`
103607
103608 The federation issuer's URL. Null when the presented credential failed verification.
103609
103610 - `ip_address: optional string or null`
103611
103612 - `subject: optional string or null`
103613
103614 The provider's verified identifier for the caller; its form depends on the provider.
103615
103616 - `user_agent: optional string or null`
103617
103618 - `AttestedDeviceActor object`
103619
103620 An attested mobile device authenticated via Apple App Attest.
103621
103622 - `type: optional "attested_device_actor"`
103623
103624 default: attested_device_actor
103625
103626 - `external_client_id: string`
103627
103628 - `kid_hash: string`
103629
103630 - `ip_address: optional string or null`
103631
103632 - `user_agent: optional string or null`
103633
103634 - `parent_organization_id: string`
103635
103636 The parent organization whose admin roster was changed.
103637
103638 - `role: string`
103639
103640 The role the user now holds on the parent organization.
103641
103642 - `user_id: string`
103643
103644 The user whose parent-organization admin role was set.
103645
103646 - `id: optional string`
103647
103648 Unique identifier for the activity e.g. 'activity_abcd1234'
103649
103650 - `created_at: optional string`
103651
103652 When this activity occurred.
103653
103654 format: date-time
103655
103656 - `organization_id: optional string or null`
103657
103658 Organization ID this activity is associated with
103659
103660 - `organization_uuid: optional string or null`
103661
103662 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
103663
103664 - `ParentOrganizationSettingsUpdated object`
103665
103666 Parent organization settings were updated.
103667
103668 - `type: optional "parent_organization_settings_updated"`
103669
103670 default: parent_organization_settings_updated
103671
103672 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
103673
103674 - `APIActor object`
103675
103676 - `type: optional "api_actor"`
103677
103678 default: api_actor
103679
103680 - `api_key_id: string`
103681
103682 - `ip_address: string`
103683
103684 - `user_agent: string`
103685
103686 - `UserActor object`
103687
103688 - `type: optional "user_actor"`
103689
103690 default: user_actor
103691
103692 - `email_address: string`
103693
103694 format: email
103695
103696 - `ip_address: string`
103697
103698 - `user_agent: string`
103699
103700 - `user_id: string`
103701
103702 - `UnauthenticatedUserActor object`
103703
103704 - `type: optional "unauthenticated_user_actor"`
103705
103706 default: unauthenticated_user_actor
103707
103708 - `ip_address: string`
103709
103710 - `user_agent: string`
103711
103712 - `unauthenticated_email_address: optional string or null`
103713
103714 format: email
103715
103716 - `AnthropicActor object`
103717
103718 - `type: optional "anthropic_actor"`
103719
103720 default: anthropic_actor
103721
103722 - `email_address: optional string or null`
103723
103724 format: email
103725
103726 - `SystemActor object`
103727
103728 Automated background processing performed by Anthropic systems, acting
103729 without a user or customer credential.
103730
103731 - `type: optional "system_actor"`
103732
103733 default: system_actor
103734
103735 - `service: optional string or null`
103736
103737 Name of the automated process that performed the action, when known.
103738
103739 - `AdminAPIKeyActor object`
103740
103741 - `type: optional "admin_api_key_actor"`
103742
103743 default: admin_api_key_actor
103744
103745 - `admin_api_key_id: string`
103746
103747 - `ip_address: string`
103748
103749 - `user_agent: string`
103750
103751 - `ServiceAccountActor object`
103752
103753 - `type: optional "service_account_actor"`
103754
103755 default: service_account_actor
103756
103757 - `ip_address: string`
103758
103759 - `service_account_id: string`
103760
103761 - `user_agent: string`
103762
103763 - `ScimDirectorySyncActor object`
103764
103765 - `type: optional "scim_directory_sync_actor"`
103766
103767 default: scim_directory_sync_actor
103768
103769 - `directory_id: string`
103770
103771 - `workos_event_id: string`
103772
103773 - `idp_connection_type: optional string or null`
103774
103775 - `FederatedIdentityActor object`
103776
103777 A federated external workload authenticated via a verified OIDC token.
103778
103779 Carries the verified issuer, subject, and audience claims from the
103780 presented JWT.
103781
103782 - `type: optional "federated_identity_actor"`
103783
103784 default: federated_identity_actor
103785
103786 - `issuer: string`
103787
103788 - `subject: string`
103789
103790 - `audience: optional array of string`
103791
103792 - `ip_address: optional string or null`
103793
103794 - `user_agent: optional string or null`
103795
103796 - `FederatedActor object`
103797
103798 An external identity asserted by a trusted provider — a cloud-provider
103799 gateway or a customer-registered federation issuer — acting without an
103800 Anthropic-provisioned account or service account.
103801
103802 - `type: optional "federated_actor"`
103803
103804 default: federated_actor
103805
103806 - `provider: Aws or Azure or Gcp or Oidc`
103807
103808 - `Aws object`
103809
103810 Asserting party: the AWS account the organization is bound to.
103811
103812 - `type: optional "aws"`
103813
103814 default: aws
103815
103816 - `account_id: string`
103817
103818 - `signed_principal: string`
103819
103820 The AWS-signed ARN of the IAM principal that requested the token.
103821
103822 - `Azure object`
103823
103824 Asserting party: the Azure subscription the organization is bound to.
103825
103826 - `type: optional "azure"`
103827
103828 default: azure
103829
103830 - `subscription_id: string`
103831
103832 - `Gcp object`
103833
103834 Asserting party: the GCP project the organization is bound to.
103835
103836 - `type: optional "gcp"`
103837
103838 default: gcp
103839
103840 - `project_number: string`
103841
103842 - `Oidc object`
103843
103844 Asserting party: a customer-registered OIDC federation issuer.
103845
103846 - `type: optional "oidc"`
103847
103848 default: oidc
103849
103850 - `issuer: optional string or null`
103851
103852 The federation issuer's URL. Null when the presented credential failed verification.
103853
103854 - `ip_address: optional string or null`
103855
103856 - `subject: optional string or null`
103857
103858 The provider's verified identifier for the caller; its form depends on the provider.
103859
103860 - `user_agent: optional string or null`
103861
103862 - `AttestedDeviceActor object`
103863
103864 An attested mobile device authenticated via Apple App Attest.
103865
103866 - `type: optional "attested_device_actor"`
103867
103868 default: attested_device_actor
103869
103870 - `external_client_id: string`
103871
103872 - `kid_hash: string`
103873
103874 - `ip_address: optional string or null`
103875
103876 - `user_agent: optional string or null`
103877
103878 - `parent_organization_id: string`
103879
103880 The parent organization whose settings were updated.
103881
103882 - `updates: array of object`
103883
103884 The setting changes applied in this update.
103885
103886 - `type: optional "name"`
103887
103888 default: name
103889
103890 - `current_value: string`
103891
103892 Setting value immediately after this change
103893
103894 - `previous_value: string`
103895
103896 Setting value immediately before this change
103897
103898 - `id: optional string`
103899
103900 Unique identifier for the activity e.g. 'activity_abcd1234'
103901
103902 - `created_at: optional string`
103903
103904 When this activity occurred.
103905
103906 format: date-time
103907
103908 - `organization_id: optional string or null`
103909
103910 Organization ID this activity is associated with
103911
103912 - `organization_uuid: optional string or null`
103913
103914 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
103915
99044103916 - `PaymentMethodUpdated object`
99045103917
99046103918 The organization's default payment method was updated.
from line 138563
133691138563
133692138564 format: date-time
133693138565
138566 - `idp_connection_id: optional string or null`
138567
138568 Identifies the identity provider connection the sign-in came through. `null` or absent when the sign-in was not matched to one of the parent organization's identity provider connections. Absent on activities recorded before this field was introduced.
138569
133694138570 - `organization_id: optional string or null`
133695138571
133696138572 Organization ID this activity is associated with
from line 138799
133923138799
133924138800 format: date-time
133925138801
138802 - `idp_connection_id: optional string or null`
138803
138804 Identifies the identity provider connection the user was sent to. `null` or absent when the user was not sent to a single connection, for example when they choose one on the next page. Absent on activities recorded before this field was introduced.
138805
133926138806 - `organization_id: optional string or null`
133927138807
133928138808 Organization ID this activity is associated with
from line 139043
134163139043
134164139044 format: date-time
134165139045
139046 - `idp_connection_id: optional string or null`
139047
139048 Identifies the identity provider connection the user signed in through. `null` or absent when the sign-in was not matched to one of the parent organization's identity provider connections. Absent on activities recorded before this field was introduced.
139049
134166139050 - `mfa_method: optional "not_used" or "unspecified" or null`
134167139051
134168139052 The second authentication factor performed during this login, if any. `null` when the second-factor status is not recorded on this event — for example, when authentication was delegated to an external identity provider and any second factor is not visible to Anthropic, or when this event is one step of a multistep login whose MFA is reported on another activity. May be absent on activities recorded before this field was introduced.
from line 153839
148955153839
148956153840The organization must belong to the API key's organization hierarchy;
148957153841unknown organizations and organizations outside the hierarchy return 404.
153842The verified_domains and identity_providers settings describe the whole
153843parent organization and are returned only to API keys that are not
153844restricted to a single organization.
148958153845
148959153846#### Path parameters
148960153847
from line 153907
149020153907
149021153908- `organization_id: string`
149022153909
149023- `settings: array of Boolean or Integer or String or 3 more`
153910- `settings: array of Boolean or Integer or String or 5 more`
149024153911
149025153912 - `Boolean object`
149026153913
from line 153917
149030153917
149031153918 default: boolean
149032153919
149033 - `name: "access_transparency_enabled" or "ai_powered_artifacts_enabled" or "api_workbench_feedback_collection_enabled" or 61 more`
153920 - `name: "access_transparency_enabled" or "ai_powered_artifacts_enabled" or "api_workbench_feedback_collection_enabled" or 64 more`
149034153921
149035153922 - `"access_transparency_enabled"`
149036153923
from line 153939
149052153939
149053153940 - `"claude_ai_ccr_support_sharing_enabled"`
149054153941
153942 - `"claude_ai_chat_external_sharing_enabled"`
153943
153944 - `"claude_ai_chat_org_sharing_enabled"`
153945
149055153946 - `"claude_ai_chat_sharing_enabled"`
149056153947
149057153948 - `"claude_ai_feedback_collection_enabled"`
from line 153979
149088153979
149089153980 - `"claude_in_slack_enabled"`
149090153981
153982 - `"claude_science_auto_mode_enabled"`
153983
149091153984 - `"claude_science_custom_connectors_enabled"`
149092153985
149093153986 - `"claude_science_custom_skills_enabled"`
from line 154178
149285154178
149286154179 default: data_retention_periods
149287154180
154181 - `VerifiedDomains object`
154182
154183 The domains verified for the organization's parent organization. The
154184 same for every organization under that parent, and returned only to API
154185 keys that are not restricted to a single organization.
154186
154187 - `type: optional "verified_domains"`
154188
154189 default: verified_domains
154190
154191 - `value: array of object`
154192
154193 - `domain: string`
154194
154195 The verified domain name.
154196
154197 - `sso_claude_ai_enforced: boolean`
154198
154199 Whether single sign-on is required to sign in to Claude.ai with an email address on this domain.
154200
154201 - `sso_console_enforced: boolean`
154202
154203 Whether single sign-on is required to sign in to the Claude Console with an email address on this domain.
154204
154205 - `name: optional "verified_domains"`
154206
154207 default: verified_domains
154208
154209 - `IdentityProviders object`
154210
154211 The IdP connections of the organization's parent organization, oldest
154212 first. The same for every organization under that parent, and returned
154213 only to API keys that are not restricted to a single organization.
154214
154215 - `type: optional "identity_providers"`
154216
154217 default: identity_providers
154218
154219 - `value: array of object`
154220
154221 - `id: string`
154222
154223 Unique identifier for the IdP connection.
154224
154225 - `directory_sync_enabled: boolean`
154226
154227 Whether directory sync through this IdP connection is enabled.
154228
154229 - `sso_enabled: boolean`
154230
154231 Whether single sign-on through this IdP connection is enabled.
154232
154233 - `name: optional "identity_providers"`
154234
154235 default: identity_providers
154236
149288154237#### Example
149289154238
149290154239```bash
from line 154272
149323154272}
149324154273```
149325154274
154275## Compliance API › Organizations › Security Posture
154276
154277### Get an organization's security posture
154278
154279**GET** `/v1/compliance/organizations/{organization_id}/security_posture`
154280
154281Get an organization's security controls and their current results.
154282
154283Returns the organization's security controls, evaluated at the time of the
154284request, each with its attestation when this endpoint returns one. The controls come
154285in one `controls` list, which is not paginated. A control can have no entry, for
154286example when it is about a feature that the organization cannot have, so a missing
154287control is not a pass.
154288
154289The `anthropic-version` header is required: a request without it returns 400.
154290The endpoint takes no query parameters, so there is no filter, and a request with
154291any query parameter also returns 400. A request also returns 400 when the Compliance
154292API is not enabled for the API key's parent organization.
154293The request returns 404 when `organization_id` names no organization, names one
154294that the API key cannot read, or names one whose security controls are not
154295available. A request over a rate limit returns 429.
154296
154297One error has an `error_code` in `error.details`. A 503 with
154298`posture_evaluation_failed` means that the evaluation could not be completed.
154299Wait for the time in the `Retry-After` header before trying again. A 504 means
154300that the evaluation did not finish in time, and the request can be tried again.
154301
154302#### Path parameters
154303
154304- `organization_id: string`
154305
154306 The organization's UUID
154307
154308#### Headers
154309
154310- `"anthropic-version": optional string`
154311
154312 The version of the Claude API you want to use.
154313
154314 Read more about versioning and our version history [here](https://platform.claude.com/docs/en/api/versioning?sdk_languages=http).
154315
154316- `"x-api-key": optional string`
154317
154318#### Returns
154319
154320- `type: "security_posture"`
154321
154322 Always `security_posture`.
154323
154324- `comments_status: "available" or "not_enabled" or "not_permitted" or 2 more`
154325
154326 Whether attestation comments were read. More values can be added; read an unknown one as `unavailable`.
154327
154328 - `"available"`
154329
154330 Comments were read, so a null `comment` means that there is none, or that the attestation was saved moments ago.
154331
154332 - `"not_enabled"`
154333
154334 This endpoint does not return comments for the organization, so every `comment` is null.
154335
154336 - `"not_permitted"`
154337
154338 The API key holds neither `read:compliance_user_data` nor `read:org_audit`, so every `comment` and every `attested_by` is null.
154339
154340 - `"requires_organization_key"`
154341
154342 The API key was not created in the organization, for example because it was created for the parent organization, so no comment is read and every `comment` is null. `attested_by` is returned as it is to a key created in the organization. This value does not say whether this endpoint returns comments for the organization. Retrying does not help: only a key created in the organization can read its comments.
154343
154344 - `"unavailable"`
154345
154346 Comments could not be read for this response. A later request may succeed, but some causes persist, for example when the organization's customer-managed encryption key cannot be used.
154347
154348- `controls: array of object`
154349
154350 The organization's controls, never empty. A control can have no entry, for example when it is about a feature that the organization cannot have, so a missing control is not a pass.
154351
154352 - `id: string`
154353
154354 The control's identifier, which is the same for every organization and never changes.
154355
154356 - `attestation: object or null`
154357
154358 The attestation of this control. It is still returned after it stops being in effect; see its `state`. Null when nobody has attested, when attestations of this kind are not enabled for the organization, and while the status is `descriptive`, `not_applicable` or `not_evaluated`. It is also null when the attestation stored for the control is of a kind that this endpoint does not return, so null does not prove that nobody has attested.
154359
154360 - `attested_at: string`
154361
154362 When the attestation was made.
154363
154364 format: date-time
154365
154366 - `attested_by: object or null`
154367
154368 Who made the attestation. Null when the response's `comments_status` is `not_permitted`, when showing who attested is not enabled for the organization, when the person's account has been deleted, or while Anthropic holds back who attested for every organization.
154369
154370 - `type: "user_actor"`
154371
154372 Always `user_actor`.
154373
154374 - `user_id: string`
154375
154376 User identifier (tagged ID, prefixed `user_`).
154377
154378 - `comment: string or null`
154379
154380 The comment saved with the attestation, of at most 2,000 characters. It is the text of the last save, which can keep words that an earlier administrator wrote. Null if there is none, or if the response's `comments_status` is not `available`.
154381
154382 - `state: "check_passing" or "in_force" or "review_due" or "setting_changed" or null`
154383
154384 Whether the attestation is still in effect. Null only on a manual control, and only when end dates do not apply to the organization; the attestation is then in effect. More values can be added; read an unknown one as not in effect.
154385
154386 - `"check_passing"`
154387
154388 Not in effect: the automatic check passes.
154389
154390 - `"in_force"`
154391
154392 The attestation is in effect.
154393
154394 - `"review_due"`
154395
154396 Not in effect: the attestation's end date, also called its review date, has come, so it is due for review.
154397
154398 - `"setting_changed"`
154399
154400 Not in effect: the automatic check fails, either on a different value from the one whose risk was accepted, or after the accepted risk was recorded as ended.
154401
154402 - `current_value: string or null`
154403
154404 The value read for the control, as display text whose wording can change. It is in English, apart from values taken from the organization's settings, such as its allowed email domains. A list names only the entries that this endpoint recognizes, followed by the number of other entries, if any. Null on a manual control, while the status is `not_evaluated`, and while the status is `not_applicable` because the control applies only when another setting has a certain value.
154405
154406 - `desired_state: string or null`
154407
154408 The recommended value, as display text whose wording can change. It is in English, apart from values such as the organization's ID. Null when there is none for this organization.
154409
154410 - `display_name: string`
154411
154412 The control's display name, in English.
154413
154414 - `rating: "descriptive" or "failed" or "not_attested" or "passed"`
154415
154416 The control's overall result, which follows from `status`. More values can be added; read an unknown one as not passed.
154417
154418 - `"descriptive"`
154419
154420 Descriptive: not rated, which includes controls that do not apply or could not be read.
154421
154422 - `"failed"`
154423
154424 Failed. Because of an attestation that this endpoint does not return, a control can have this rating while the Security posture page shows it as Passed.
154425
154426 - `"not_attested"`
154427
154428 Not attested: a manual control with no attestation in effect.
154429
154430 - `"passed"`
154431
154432 Passed. This includes a control with an accepted risk in effect, whether automatic or manual.
154433
154434 - `section: "capabilities" or "chats_desktop_mdm" or "claude_code_admin_console" or 7 more`
154435
154436 The section that this control belongs to. More values can be added; treat an unknown one as a section of its own.
154437
154438 - `"capabilities"`
154439
154440 Capabilities
154441
154442 - `"chats_desktop_mdm"`
154443
154444 Chats: desktop device management
154445
154446 - `"claude_code_admin_console"`
154447
154448 Claude Code: admin console
154449
154450 - `"claude_code_managed_settings"`
154451
154452 Claude Code: managed settings
154453
154454 - `"connectors_integrations"`
154455
154456 Connectors and integrations
154457
154458 - `"cowork_admin_console"`
154459
154460 Cowork: admin console
154461
154462 - `"cowork_desktop_mdm"`
154463
154464 Cowork: desktop device management
154465
154466 - `"data_privacy"`
154467
154468 Data and privacy
154469
154470 - `"healthy_adoption"`
154471
154472 Healthy adoption
154473
154474 - `"identity_access"`
154475
154476 Identity and access
154477
154478 - `setting_name: string or null`
154479
154480 The `name` of the entry in the organization's effective settings that this control reads. Null when it reads no such entry.
154481
154482 - `status: "attestation_not_enabled" or "attested_accepted_risk" or "attested_completed" or 10 more`
154483
154484 Why the control has its rating. A manual control is one that only a person can check. An automatic control reads a value from the organization, usually one of its settings, and some are checked against a recommended value. The recommended values are those of the standard profile, which every organization is rated under. More values can be added; count a control with an unknown one by its `rating`.
154485
154486 - `"attestation_not_enabled"`
154487
154488 A manual control that nobody in the organization can attest to.
154489
154490 - `"attested_accepted_risk"`
154491
154492 A manual control attested as Accepted risk, with the attestation in effect.
154493
154494 - `"attested_completed"`
154495
154496 A manual control attested as Completed, with the attestation in effect.
154497
154498 - `"descriptive"`
154499
154500 The control is reported for information only.
154501
154502 - `"exceeds_baseline"`
154503
154504 The current value is stricter than the recommended value.
154505
154506 - `"failed"`
154507
154508 The current value does not meet the recommended value. An attestation that this endpoint does not return can also give a control this status.
154509
154510 - `"failed_check_accepted_risk"`
154511
154512 The automatic check fails, and an accepted risk is in effect.
154513
154514 - `"matches_profile"`
154515
154516 The current value equals the recommended value.
154517
154518 - `"not_applicable"`
154519
154520 The control does not apply to the organization.
154521
154522 - `"not_attested"`
154523
154524 A manual control that can be attested to, with no attestation in effect.
154525
154526 - `"not_evaluated"`
154527
154528 The setting behind the control, or another setting that decides whether the control applies, could not be read.
154529
154530 - `"passed"`
154531
154532 The current value meets the recommended value.
154533
154534 - `"review"`
154535
154536 The current value is looser than the recommended value.
154537
154538- `evaluated_at: string`
154539
154540 The time at which every control was evaluated.
154541
154542 format: date-time
154543
154544- `organization_id: string`
154545
154546 The organization's UUID.
154547
154548#### Example
154549
154550```bash
154551curl https://api.anthropic.com/v1/compliance/organizations/$ORGANIZATION_ID/security_posture \
154552 -H 'anthropic-version: 2023-06-01' \
154553 -H "Authorization: Bearer $ANTHROPIC_COMPLIANCE_API_KEY"
154554```
154555
154556##### Response (200)
154557
154558```json
154559{
154560 "comments_status": "not_enabled",
154561 "controls": [
154562 {
154563 "id": "sso_enabled",
154564 "attestation": {
154565 "attested_at": "2025-03-12T18:22:41.123456Z",
154566 "attested_by": {
154567 "type": "user_actor",
154568 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
154569 },
154570 "comment": null,
154571 "state": "in_force"
154572 },
154573 "current_value": "On",
154574 "desired_state": "On",
154575 "display_name": "Single sign-on (SSO)",
154576 "rating": "passed",
154577 "section": "identity_access",
154578 "setting_name": "sso_enabled",
154579 "status": "passed"
154580 }
154581 ],
154582 "evaluated_at": "2025-03-12T18:22:41.123456Z",
154583 "organization_id": "a1b2c3d4-e5f6-4789-a012-3456789abcde",
154584 "type": "security_posture"
154585}
154586```
154587
149326154588## Compliance API › Groups
149327154589
149328154590### List Compliance Groups
from line 157713
152451157713forward-only: pass the response's `next_page` value back as `page` to
152452157714retrieve the next page, and stop when `next_page` is null.
152453157715
157716Returns 403 with the `error_code` `organization_compliance_restricted` in
157717`error.details` when an organization the request covers, or the key's own
157718organization, has compliance settings that do not allow its remote
157719sessions to be listed through the Compliance API. No sessions are
157720returned, and the error does not say which organization it is.
157721
152454157722#### Query parameters
152455157723
152456157724- `created_at: optional object`
from line 157807
152539157807
152540157808 - `product_surface: string or null`
152541157809
152542 The Claude product the session was created from. Currently `cowork_remote`, for Cowork sessions started on claude.ai web or mobile. More values will appear as other surfaces launch, so treat any unrecognized value as an unclassified surface rather than an error. Null for sessions created before this field was recorded, for surfaces that do not stamp it, and for unrecognized tag values.
157810 The Claude product the session was created from. Currently `cowork_remote`, for Cowork sessions started on claude.ai web or mobile, and `claude_tag`, for Claude Tag sessions started in Slack. More values will appear as other surfaces launch, so treat any unrecognized value as an unclassified surface rather than an error. Null for sessions created before this field was recorded, for surfaces that do not stamp it, and for unrecognized tag values.
152543157811
152544157812 - `started_by_user: object or null`
152545157813
from line 157905
152637157905and for sessions outside the organizations the key may read. A
152638157906malformed session identifier returns 400.
152639157907
157908Returns 403 with the `error_code` `organization_compliance_restricted` in
157909`error.details` when the session's organization, or the key's own
157910organization, has compliance settings that do not allow its remote
157911sessions to be read through the Compliance API. A retry does not help
157912until those settings change.
157913
152640157914#### Path parameters
152641157915
152642157916- `claude_remote_session_id: string`
from line 158113
152839158113
152840158114 - `product_surface: string or null`
152841158115
152842 The Claude product the session was created from. Currently `cowork_remote`, for Cowork sessions started on claude.ai web or mobile. More values will appear as other surfaces launch, so treat any unrecognized value as an unclassified surface rather than an error. Null for sessions created before this field was recorded, for surfaces that do not stamp it, and for unrecognized tag values.
158116 The Claude product the session was created from. Currently `cowork_remote`, for Cowork sessions started on claude.ai web or mobile, and `claude_tag`, for Claude Tag sessions started in Slack. More values will appear as other surfaces launch, so treat any unrecognized value as an unclassified surface rather than an error. Null for sessions created before this field was recorded, for surfaces that do not stamp it, and for unrecognized tag values.
152843158117
152844158118 - `started_by_user: object or null`
152845158119
from line 158246
152972158246
152973158247 - `gte: optional string`
152974158248
152975 Return only Artifacts updated at or after this time (RFC 3339 format). Time filters match an eventually-consistent index and Artifacts published before this field was recorded never match — omit the time filter for compliance-complete enumeration. For incremental export, apply a generous overlap margin between windows and dedupe by `id`: adjacent tiling silently misses items whose index update lagged their publish.
158249 Return only Artifacts updated at or after this time (RFC 3339 format). Time filters match an eventually-consistent index and Artifacts published before this field was recorded never match — omit the time filter for compliance-complete enumeration. For incremental export, apply a generous overlap margin between windows and dedupe by `id`: adjacent tiling silently misses items whose index update lagged their publish. Folder changes, such as sharing or unsharing a folder or moving an Artifact or folder, can change `read_mode` without changing `updated_at`, so time filters do not pick up those changes. To see an Artifact's current `read_mode`, omit the time filter.
152976158250
152977158251 format: date-time
152978158252
152979158253
api/compliance/activities Changed · +9834 / -210 lines
This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.
Nothing in the body moved in this read. What changed is above.
api/compliance/activities/list Changed · +4896 / -12 lines
This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.
The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.
from line 15
1515
1616## Query parameters
1717
18- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "account_migration_completed" or 571 more`
18- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "account_migration_completed" or 589 more`
1919
2020 Filter activities by type. See the response `data` schema for the additional fields each type returns. Cannot be combined with `exclude_activity_types[]`.
2121
from line 262
262262
263263 An organization admin allowed one artifact to be shared outside the organization by link while the organization-wide external sharing setting was off, or revoked that permission.
264264
265 - `"claude_artifact_folder_created"`
266
267 A folder for artifacts was created, inside another folder or in none.
268
269 - `"claude_artifact_folder_moved"`
270
271 A folder for artifacts was moved into, out of or between other folders, by its owner or by someone else, whether or not a folder is shared; the artifacts and folders inside it moved with it and were not recorded as moves of their own.
272
265273 - `"claude_artifact_invite_accepted"`
266274
267275 Someone outside the organization signed in with a verified account for the invited address and accepted an invitation to an artifact, and can now open it; recorded in the artifact owner's organization. The person who accepted is identified by `invitee_email` and `invitee_user_id`.
from line 286
278286
279287 A member changed the access level of an email invitation to an artifact for someone outside the organization, whether the invitation was still pending or had been accepted; recorded in the artifact owner's organization with that member as the actor.
280288
289 - `"claude_artifact_moved"`
290
291 An artifact was moved into, out of or between folders, by its owner or by someone else, whether or not a folder is shared; an artifact that leaves its folder as part of another event, such as its own deletion or the erasure of an account, might not be recorded as a move.
292
281293 - `"claude_artifact_published"`
282294
283 A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded when the artifact is saved, including saves of private artifacts, except that automatic saves made while a person keeps editing may be recorded periodically for that person rather than once per save; changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
295 A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded when the artifact is saved, including saves of private artifacts and, for some artifacts, edits to stored content that make no new version, except that such edits, and automatic saves made while a person keeps editing, may be recorded periodically for that person rather than once per save; changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
284296
285297 - `"claude_artifact_sent_to_partner"`
286298
from line 834
822834
823835 An administrator allowed a skill version despite its security scan's verdict, or that allowance was revoked.
824836
837 - `"claude_skill_served_version_updated"`
838
839 A skill's served version, the version that members get, was updated: an administrator or the owner chose a version, a saved version became the served version, or an accepted library submission was published into the skill. A new version that is served as soon as it is saved may appear only as claude_skill_version_created.
840
841 - `"claude_skill_version_created"`
842
843 A new version of a skill was created.
844
825845 - `"claude_survey_closed"`
826846
827847 An organization admin closed an in-app survey before its end date, ending the collection of responses; a survey that reaches its end date records no event.
from line 1410
13901410
13911411 Organization domain was removed.
13921412
1413 - `"org_domain_sso_enforcement_updated"`
1414
1415 A verified domain's single sign-on requirement changed, per surface.
1416
1417 - `"org_domain_sso_routing_updated"`
1418
1419 A verified domain's single sign-on routing was saved or changed. Lists the identity provider connections the domain's users sign in through before and after; the two lists are the same when a save changed nothing.
1420
13931421 - `"org_domain_verified"`
13941422
13951423 Organization domain was verified.
from line 1454
14261454
14271455 A primary owner accepted the Business Associate Agreement and enabled the HIPAA configuration for the organization through the self-serve flow.
14281456
1457 - `"org_idp_connection_created"`
1458
1459 An identity provider connection was added to the parent organization.
1460
1461 - `"org_idp_connection_deleted"`
1462
1463 An identity provider connection was removed from the parent organization, along with the settings that referenced it.
1464
1465 - `"org_idp_connection_updated"`
1466
1467 An identity provider connection's settings were changed.
1468
14291469 - `"org_invite_link_disabled"`
14301470
14311471 Organization invite link was disabled.
from line 1566
15261566
15271567 Organization parent search was performed.
15281568
1569 - `"org_security_control_attestation_updated"`
1570
1571 The organization's attestation for a security control was recorded, changed, renewed or cleared by an administrator, or was ended automatically.
1572
15291573 - `"org_sso_add_initiated"`
15301574
15311575 Organization SSO setup was initiated.
from line 1694
16501694
16511695 Access to owned projects was restored.
16521696
1697 - `"parent_organization_centralized_management_enrolled"`
1698
1699 A parent organization was enrolled in centralized management.
1700
1701 - `"parent_organization_centralized_management_organization_updated"`
1702
1703 An organization's approval of its parent organization's Centralized Management setup changed, or its administrators were reminded to approve.
1704
1705 - `"parent_organization_centralized_management_setup_updated"`
1706
1707 The Centralized Management setup of a parent organization changed: it was started or abandoned, its proposed administrators changed, its remaining organizations were force approved, or it completed.
1708
1709 - `"parent_organization_centralized_management_unenrolled"`
1710
1711 A parent organization was unenrolled from centralized management.
1712
1713 - `"parent_organization_member_removed"`
1714
1715 A parent-organization admin role was removed from a user.
1716
1717 - `"parent_organization_member_updated"`
1718
1719 A parent-organization admin role was granted or changed for a user.
1720
1721 - `"parent_organization_settings_updated"`
1722
1723 Parent organization settings were updated.
1724
16531725 - `"payment_method_updated"`
16541726
16551727 The organization's default payment method was updated.
from line 2445
23732445
23742446 format: date-time
23752447
2376- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "account_migration_completed" or 571 more`
2448- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "account_migration_completed" or 589 more`
23772449
23782450 Exclude activities of these types. Cannot be combined with `activity_types[]`.
23792451
from line 2692
26202692
26212693 An organization admin allowed one artifact to be shared outside the organization by link while the organization-wide external sharing setting was off, or revoked that permission.
26222694
2695 - `"claude_artifact_folder_created"`
2696
2697 A folder for artifacts was created, inside another folder or in none.
2698
2699 - `"claude_artifact_folder_moved"`
2700
2701 A folder for artifacts was moved into, out of or between other folders, by its owner or by someone else, whether or not a folder is shared; the artifacts and folders inside it moved with it and were not recorded as moves of their own.
2702
26232703 - `"claude_artifact_invite_accepted"`
26242704
26252705 Someone outside the organization signed in with a verified account for the invited address and accepted an invitation to an artifact, and can now open it; recorded in the artifact owner's organization. The person who accepted is identified by `invitee_email` and `invitee_user_id`.
from line 2716
26362716
26372717 A member changed the access level of an email invitation to an artifact for someone outside the organization, whether the invitation was still pending or had been accepted; recorded in the artifact owner's organization with that member as the actor.
26382718
2719 - `"claude_artifact_moved"`
2720
2721 An artifact was moved into, out of or between folders, by its owner or by someone else, whether or not a folder is shared; an artifact that leaves its folder as part of another event, such as its own deletion or the erasure of an account, might not be recorded as a move.
2722
26392723 - `"claude_artifact_published"`
26402724
2641 A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded when the artifact is saved, including saves of private artifacts, except that automatic saves made while a person keeps editing may be recorded periodically for that person rather than once per save; changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
2725 A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded when the artifact is saved, including saves of private artifacts and, for some artifacts, edits to stored content that make no new version, except that such edits, and automatic saves made while a person keeps editing, may be recorded periodically for that person rather than once per save; changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
26422726
26432727 - `"claude_artifact_sent_to_partner"`
26442728
from line 3264
31803264
31813265 An administrator allowed a skill version despite its security scan's verdict, or that allowance was revoked.
31823266
3267 - `"claude_skill_served_version_updated"`
3268
3269 A skill's served version, the version that members get, was updated: an administrator or the owner chose a version, a saved version became the served version, or an accepted library submission was published into the skill. A new version that is served as soon as it is saved may appear only as claude_skill_version_created.
3270
3271 - `"claude_skill_version_created"`
3272
3273 A new version of a skill was created.
3274
31833275 - `"claude_survey_closed"`
31843276
31853277 An organization admin closed an in-app survey before its end date, ending the collection of responses; a survey that reaches its end date records no event.
from line 3840
37483840
37493841 Organization domain was removed.
37503842
3843 - `"org_domain_sso_enforcement_updated"`
3844
3845 A verified domain's single sign-on requirement changed, per surface.
3846
3847 - `"org_domain_sso_routing_updated"`
3848
3849 A verified domain's single sign-on routing was saved or changed. Lists the identity provider connections the domain's users sign in through before and after; the two lists are the same when a save changed nothing.
3850
37513851 - `"org_domain_verified"`
37523852
37533853 Organization domain was verified.
from line 3884
37843884
37853885 A primary owner accepted the Business Associate Agreement and enabled the HIPAA configuration for the organization through the self-serve flow.
37863886
3887 - `"org_idp_connection_created"`
3888
3889 An identity provider connection was added to the parent organization.
3890
3891 - `"org_idp_connection_deleted"`
3892
3893 An identity provider connection was removed from the parent organization, along with the settings that referenced it.
3894
3895 - `"org_idp_connection_updated"`
3896
3897 An identity provider connection's settings were changed.
3898
37873899 - `"org_invite_link_disabled"`
37883900
37893901 Organization invite link was disabled.
from line 3996
38843996
38853997 Organization parent search was performed.
38863998
3999 - `"org_security_control_attestation_updated"`
4000
4001 The organization's attestation for a security control was recorded, changed, renewed or cleared by an administrator, or was ended automatically.
4002
38874003 - `"org_sso_add_initiated"`
38884004
38894005 Organization SSO setup was initiated.
from line 4124
40084124
40094125 Access to owned projects was restored.
40104126
4127 - `"parent_organization_centralized_management_enrolled"`
4128
4129 A parent organization was enrolled in centralized management.
4130
4131 - `"parent_organization_centralized_management_organization_updated"`
4132
4133 An organization's approval of its parent organization's Centralized Management setup changed, or its administrators were reminded to approve.
4134
4135 - `"parent_organization_centralized_management_setup_updated"`
4136
4137 The Centralized Management setup of a parent organization changed: it was started or abandoned, its proposed administrators changed, its remaining organizations were force approved, or it completed.
4138
4139 - `"parent_organization_centralized_management_unenrolled"`
4140
4141 A parent organization was unenrolled from centralized management.
4142
4143 - `"parent_organization_member_removed"`
4144
4145 A parent-organization admin role was removed from a user.
4146
4147 - `"parent_organization_member_updated"`
4148
4149 A parent-organization admin role was granted or changed for a user.
4150
4151 - `"parent_organization_settings_updated"`
4152
4153 Parent organization settings were updated.
4154
40114155 - `"payment_method_updated"`
40124156
40134157 The organization's default payment method was updated.
from line 4855
47114855
47124856- `organization_ids: optional array of string`
47134857
4714 Filter activities by organization IDs (accepts `org_...` or organization UUID). Enumerate IDs via `GET /v1/compliance/organizations`.
4858 Filter activities by organization IDs (accepts `org_...` or organization UUID, up to 20). Enumerate IDs via `GET /v1/compliance/organizations`.
47154859
47164860- `user_ids: optional array of string`
47174861
from line 4873
47294873
47304874## Returns
47314875
4732- `data: optional array of AbuseDecisionReceived or AccountDeleted or AccountMigrationCompleted or 571 more`
4876- `data: optional array of AbuseDecisionReceived or AccountDeleted or AccountMigrationCompleted or 589 more`
47334877
47344878 List of activity records. Each element's `type` field identifies which activity it is and which additional fields are present.
47354879
from line 9762
96189762
96199763 - `ClaudeArtifactPublished object`
96209764
9621 A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded when the artifact is saved, including saves of private artifacts, except that automatic saves made while a person keeps editing may be recorded periodically for that person rather than once per save; changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
9765 A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded when the artifact is saved, including saves of private artifacts and, for some artifacts, edits to stored content that make no new version, except that such edits, and automatic saves made while a person keeps editing, may be recorded periodically for that person rather than once per save; changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
96229766
96239767 - `type: optional "claude_artifact_published"`
96249768
from line 10238
1009410238
1009510239 - `audience: array of Organization or Users or AnyoneWithLink`
1009610240
10097 The artifact's sharing audience after the change. If empty, the artifact is visible only to its owner.
10241 The artifact's own sharing audience after the change. If empty, the artifact itself is not shared with named users, its organization or anyone with the link, but people can still have access in other ways, such as through a folder it is in or a folder above that one. Changes people make to a folder's sharing are recorded as `role_assignment_granted` and `role_assignment_revoked` activities on the folder, and moves as `claude_artifact_moved` and `claude_artifact_folder_moved`.
1009810242
1009910243 - `Organization object`
1010010244
from line 22138
2199422138
2199522139 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
2199622140
22141 - `ClaudeArtifactFolderCreated object`
22142
22143 A folder for artifacts was created, inside another folder or in none.
22144
22145 - `type: optional "claude_artifact_folder_created"`
22146
22147 default: claude_artifact_folder_created
22148
22149 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
22150
22151 - `APIActor object`
22152
22153 - `type: optional "api_actor"`
22154
22155 default: api_actor
22156
22157 - `api_key_id: string`
22158
22159 - `ip_address: string`
22160
22161 - `user_agent: string`
22162
22163 - `UserActor object`
22164
22165 - `type: optional "user_actor"`
22166
22167 default: user_actor
22168
22169 - `email_address: string`
22170
22171 format: email
22172
22173 - `ip_address: string`
22174
22175 - `user_agent: string`
22176
22177 - `user_id: string`
22178
22179 - `UnauthenticatedUserActor object`
22180
22181 - `type: optional "unauthenticated_user_actor"`
22182
22183 default: unauthenticated_user_actor
22184
22185 - `ip_address: string`
22186
22187 - `user_agent: string`
22188
22189 - `unauthenticated_email_address: optional string or null`
22190
22191 format: email
22192
22193 - `AnthropicActor object`
22194
22195 - `type: optional "anthropic_actor"`
22196
22197 default: anthropic_actor
22198
22199 - `email_address: optional string or null`
22200
22201 format: email
22202
22203 - `SystemActor object`
22204
22205 Automated background processing performed by Anthropic systems, acting
22206 without a user or customer credential.
22207
22208 - `type: optional "system_actor"`
22209
22210 default: system_actor
22211
22212 - `service: optional string or null`
22213
22214 Name of the automated process that performed the action, when known.
22215
22216 - `AdminAPIKeyActor object`
22217
22218 - `type: optional "admin_api_key_actor"`
22219
22220 default: admin_api_key_actor
22221
22222 - `admin_api_key_id: string`
22223
22224 - `ip_address: string`
22225
22226 - `user_agent: string`
22227
22228 - `ServiceAccountActor object`
22229
22230 - `type: optional "service_account_actor"`
22231
22232 default: service_account_actor
22233
22234 - `ip_address: string`
22235
22236 - `service_account_id: string`
22237
22238 - `user_agent: string`
22239
22240 - `ScimDirectorySyncActor object`
22241
22242 - `type: optional "scim_directory_sync_actor"`
22243
22244 default: scim_directory_sync_actor
22245
22246 - `directory_id: string`
22247
22248 - `workos_event_id: string`
22249
22250 - `idp_connection_type: optional string or null`
22251
22252 - `FederatedIdentityActor object`
22253
22254 A federated external workload authenticated via a verified OIDC token.
22255
22256 Carries the verified issuer, subject, and audience claims from the
22257 presented JWT.
22258
22259 - `type: optional "federated_identity_actor"`
22260
22261 default: federated_identity_actor
22262
22263 - `issuer: string`
22264
22265 - `subject: string`
22266
22267 - `audience: optional array of string`
22268
22269 - `ip_address: optional string or null`
22270
22271 - `user_agent: optional string or null`
22272
22273 - `FederatedActor object`
22274
22275 An external identity asserted by a trusted provider — a cloud-provider
22276 gateway or a customer-registered federation issuer — acting without an
22277 Anthropic-provisioned account or service account.
22278
22279 - `type: optional "federated_actor"`
22280
22281 default: federated_actor
22282
22283 - `provider: Aws or Azure or Gcp or Oidc`
22284
22285 - `Aws object`
22286
22287 Asserting party: the AWS account the organization is bound to.
22288
22289 - `type: optional "aws"`
22290
22291 default: aws
22292
22293 - `account_id: string`
22294
22295 - `signed_principal: string`
22296
22297 The AWS-signed ARN of the IAM principal that requested the token.
22298
22299 - `Azure object`
22300
22301 Asserting party: the Azure subscription the organization is bound to.
22302
22303 - `type: optional "azure"`
22304
22305 default: azure
22306
22307 - `subscription_id: string`
22308
22309 - `Gcp object`
22310
22311 Asserting party: the GCP project the organization is bound to.
22312
22313 - `type: optional "gcp"`
22314
22315 default: gcp
22316
22317 - `project_number: string`
22318
22319 - `Oidc object`
22320
22321 Asserting party: a customer-registered OIDC federation issuer.
22322
22323 - `type: optional "oidc"`
22324
22325 default: oidc
22326
22327 - `issuer: optional string or null`
22328
22329 The federation issuer's URL. Null when the presented credential failed verification.
22330
22331 - `ip_address: optional string or null`
22332
22333 - `subject: optional string or null`
22334
22335 The provider's verified identifier for the caller; its form depends on the provider.
22336
22337 - `user_agent: optional string or null`
22338
22339 - `AttestedDeviceActor object`
22340
22341 An attested mobile device authenticated via Apple App Attest.
22342
22343 - `type: optional "attested_device_actor"`
22344
22345 default: attested_device_actor
22346
22347 - `external_client_id: string`
22348
22349 - `kid_hash: string`
22350
22351 - `ip_address: optional string or null`
22352
22353 - `user_agent: optional string or null`
22354
22355 - `claude_artifact_folder_id: string`
22356
22357 Tagged ID ("cfld_...") of the folder that was created.
22358
22359 - `id: optional string`
22360
22361 Unique identifier for the activity e.g. 'activity_abcd1234'
22362
22363 - `created_at: optional string`
22364
22365 When this activity occurred.
22366
22367 format: date-time
22368
22369 - `organization_id: optional string or null`
22370
22371 Organization ID this activity is associated with
22372
22373 - `organization_uuid: optional string or null`
22374
22375 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
22376
22377 - `parent_claude_artifact_folder_id: optional string or null`
22378
22379 Tagged ID ("cfld_...") of the folder that the new folder was created directly inside; absent when it was created in no other folder.
22380
22381 - `ClaudeArtifactFolderMoved object`
22382
22383 A folder for artifacts was moved into, out of or between other folders, by its owner or by someone else, whether or not a folder is shared; the artifacts and folders inside it moved with it and were not recorded as moves of their own.
22384
22385 - `type: optional "claude_artifact_folder_moved"`
22386
22387 default: claude_artifact_folder_moved
22388
22389 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
22390
22391 - `APIActor object`
22392
22393 - `type: optional "api_actor"`
22394
22395 default: api_actor
22396
22397 - `api_key_id: string`
22398
22399 - `ip_address: string`
22400
22401 - `user_agent: string`
22402
22403 - `UserActor object`
22404
22405 - `type: optional "user_actor"`
22406
22407 default: user_actor
22408
22409 - `email_address: string`
22410
22411 format: email
22412
22413 - `ip_address: string`
22414
22415 - `user_agent: string`
22416
22417 - `user_id: string`
22418
22419 - `UnauthenticatedUserActor object`
22420
22421 - `type: optional "unauthenticated_user_actor"`
22422
22423 default: unauthenticated_user_actor
22424
22425 - `ip_address: string`
22426
22427 - `user_agent: string`
22428
22429 - `unauthenticated_email_address: optional string or null`
22430
22431 format: email
22432
22433 - `AnthropicActor object`
22434
22435 - `type: optional "anthropic_actor"`
22436
22437 default: anthropic_actor
22438
22439 - `email_address: optional string or null`
22440
22441 format: email
22442
22443 - `SystemActor object`
22444
22445 Automated background processing performed by Anthropic systems, acting
22446 without a user or customer credential.
22447
22448 - `type: optional "system_actor"`
22449
22450 default: system_actor
22451
22452 - `service: optional string or null`
22453
22454 Name of the automated process that performed the action, when known.
22455
22456 - `AdminAPIKeyActor object`
22457
22458 - `type: optional "admin_api_key_actor"`
22459
22460 default: admin_api_key_actor
22461
22462 - `admin_api_key_id: string`
22463
22464 - `ip_address: string`
22465
22466 - `user_agent: string`
22467
22468 - `ServiceAccountActor object`
22469
22470 - `type: optional "service_account_actor"`
22471
22472 default: service_account_actor
22473
22474 - `ip_address: string`
22475
22476 - `service_account_id: string`
22477
22478 - `user_agent: string`
22479
22480 - `ScimDirectorySyncActor object`
22481
22482 - `type: optional "scim_directory_sync_actor"`
22483
22484 default: scim_directory_sync_actor
22485
22486 - `directory_id: string`
22487
22488 - `workos_event_id: string`
22489
22490 - `idp_connection_type: optional string or null`
22491
22492 - `FederatedIdentityActor object`
22493
22494 A federated external workload authenticated via a verified OIDC token.
22495
22496 Carries the verified issuer, subject, and audience claims from the
22497 presented JWT.
22498
22499 - `type: optional "federated_identity_actor"`
22500
22501 default: federated_identity_actor
22502
22503 - `issuer: string`
22504
22505 - `subject: string`
22506
22507 - `audience: optional array of string`
22508
22509 - `ip_address: optional string or null`
22510
22511 - `user_agent: optional string or null`
22512
22513 - `FederatedActor object`
22514
22515 An external identity asserted by a trusted provider — a cloud-provider
22516 gateway or a customer-registered federation issuer — acting without an
22517 Anthropic-provisioned account or service account.
22518
22519 - `type: optional "federated_actor"`
22520
22521 default: federated_actor
22522
22523 - `provider: Aws or Azure or Gcp or Oidc`
22524
22525 - `Aws object`
22526
22527 Asserting party: the AWS account the organization is bound to.
22528
22529 - `type: optional "aws"`
22530
22531 default: aws
22532
22533 - `account_id: string`
22534
22535 - `signed_principal: string`
22536
22537 The AWS-signed ARN of the IAM principal that requested the token.
22538
22539 - `Azure object`
22540
22541 Asserting party: the Azure subscription the organization is bound to.
22542
22543 - `type: optional "azure"`
22544
22545 default: azure
22546
22547 - `subscription_id: string`
22548
22549 - `Gcp object`
22550
22551 Asserting party: the GCP project the organization is bound to.
22552
22553 - `type: optional "gcp"`
22554
22555 default: gcp
22556
22557 - `project_number: string`
22558
22559 - `Oidc object`
22560
22561 Asserting party: a customer-registered OIDC federation issuer.
22562
22563 - `type: optional "oidc"`
22564
22565 default: oidc
22566
22567 - `issuer: optional string or null`
22568
22569 The federation issuer's URL. Null when the presented credential failed verification.
22570
22571 - `ip_address: optional string or null`
22572
22573 - `subject: optional string or null`
22574
22575 The provider's verified identifier for the caller; its form depends on the provider.
22576
22577 - `user_agent: optional string or null`
22578
22579 - `AttestedDeviceActor object`
22580
22581 An attested mobile device authenticated via Apple App Attest.
22582
22583 - `type: optional "attested_device_actor"`
22584
22585 default: attested_device_actor
22586
22587 - `external_client_id: string`
22588
22589 - `kid_hash: string`
22590
22591 - `ip_address: optional string or null`
22592
22593 - `user_agent: optional string or null`
22594
22595 - `claude_artifact_folder_id: string`
22596
22597 Tagged ID ("cfld_...") of the folder that was moved.
22598
22599 - `id: optional string`
22600
22601 Unique identifier for the activity e.g. 'activity_abcd1234'
22602
22603 - `created_at: optional string`
22604
22605 When this activity occurred.
22606
22607 format: date-time
22608
22609 - `member_gained_count: optional number or null`
22610
22611 The number of people with whom a folder containing the moved folder, directly or through other folders, was individually shared after the move and none was before; people who gained access only another way, such as through a group or organization-wide sharing, are not counted, so zero does not mean that nobody gained access, and those counted can already have had access another way, for example through the moved folder's own sharing; absent when it could not be determined.
22612
22613 - `member_lost_count: optional number or null`
22614
22615 The number of people with whom a folder containing the moved folder, directly or through other folders, was individually shared before the move and none was after; people who had access only another way, such as through a group or organization-wide sharing, are not counted, so zero does not mean that nobody lost access, and those counted can still have access another way, for example through the moved folder's own sharing; absent when it could not be determined.
22616
22617 - `member_lowered_count: optional number or null`
22618
22619 The number of people with whom a folder containing the moved folder, directly or through other folders, was individually shared both before and after the move, at a lower access level after than before; a person's level is the highest that any of those folders gave them, and the moved folder's own sharing is not compared; absent when it could not be determined.
22620
22621 - `member_raised_count: optional number or null`
22622
22623 The number of people with whom a folder containing the moved folder, directly or through other folders, was individually shared both before and after the move, at a higher access level after than before; a person's level is the highest that any of those folders gave them, and the moved folder's own sharing is not compared; absent when it could not be determined.
22624
22625 - `moved_by_owner: optional boolean or null`
22626
22627 True when the person who moved the folder was its owner, false when it was someone else.
22628
22629 - `organization_id: optional string or null`
22630
22631 Organization ID this activity is associated with
22632
22633 - `organization_sharing_change: optional "gained" or "lost" or "lowered" or 3 more or null`
22634
22635 How the move changed the sharing with the whole organization of the folders containing the moved folder, directly or through other folders, by the highest access level that any of them gave the whole organization before and after the move: `gained` when none gave any before and one did after, `lost` when one did before and none did after, `raised` or `lowered` when that level was higher or lower after the move, `unchanged` when it was the same or none gave any; this follows the sharing saved on those folders, which can differ from who can open them, for example while sharing with the whole organization is turned off; the moved folder's own sharing is not compared; absent when it could not be determined.
22636
22637 - `"gained"`
22638
22639 - `"lost"`
22640
22641 - `"lowered"`
22642
22643 - `"raised"`
22644
22645 - `"unchanged"`
22646
22647 - `"unspecified"`
22648
22649 - `organization_uuid: optional string or null`
22650
22651 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
22652
22653 - `parent_claude_artifact_folder_id: optional string or null`
22654
22655 Tagged ID ("cfld_...") of the folder that directly contained the moved folder after the move; absent when the moved folder was left in no other folder.
22656
22657 - `previous_parent_claude_artifact_folder_id: optional string or null`
22658
22659 Tagged ID ("cfld_...") of the folder that directly contained the moved folder before the move; absent when the moved folder was in no other folder, or when that could not be determined.
22660
2199722661 - `ClaudeArtifactInviteAccepted object`
2199822662
2199922663 Someone outside the organization signed in with a verified account for the invited address and accepted an invitation to an artifact, and can now open it; recorded in the artifact owner's organization. The person who accepted is identified by `invitee_email` and `invitee_user_id`.
from line 23666
2300223666
2300323667 The access level the invitation granted before the change, for example `commenter`.
2300423668
23669 - `ClaudeArtifactMoved object`
23670
23671 An artifact was moved into, out of or between folders, by its owner or by someone else, whether or not a folder is shared; an artifact that leaves its folder as part of another event, such as its own deletion or the erasure of an account, might not be recorded as a move.
23672
23673 - `type: optional "claude_artifact_moved"`
23674
23675 default: claude_artifact_moved
23676
23677 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
23678
23679 - `APIActor object`
23680
23681 - `type: optional "api_actor"`
23682
23683 default: api_actor
23684
23685 - `api_key_id: string`
23686
23687 - `ip_address: string`
23688
23689 - `user_agent: string`
23690
23691 - `UserActor object`
23692
23693 - `type: optional "user_actor"`
23694
23695 default: user_actor
23696
23697 - `email_address: string`
23698
23699 format: email
23700
23701 - `ip_address: string`
23702
23703 - `user_agent: string`
23704
23705 - `user_id: string`
23706
23707 - `UnauthenticatedUserActor object`
23708
23709 - `type: optional "unauthenticated_user_actor"`
23710
23711 default: unauthenticated_user_actor
23712
23713 - `ip_address: string`
23714
23715 - `user_agent: string`
23716
23717 - `unauthenticated_email_address: optional string or null`
23718
23719 format: email
23720
23721 - `AnthropicActor object`
23722
23723 - `type: optional "anthropic_actor"`
23724
23725 default: anthropic_actor
23726
23727 - `email_address: optional string or null`
23728
23729 format: email
23730
23731 - `SystemActor object`
23732
23733 Automated background processing performed by Anthropic systems, acting
23734 without a user or customer credential.
23735
23736 - `type: optional "system_actor"`
23737
23738 default: system_actor
23739
23740 - `service: optional string or null`
23741
23742 Name of the automated process that performed the action, when known.
23743
23744 - `AdminAPIKeyActor object`
23745
23746 - `type: optional "admin_api_key_actor"`
23747
23748 default: admin_api_key_actor
23749
23750 - `admin_api_key_id: string`
23751
23752 - `ip_address: string`
23753
23754 - `user_agent: string`
23755
23756 - `ServiceAccountActor object`
23757
23758 - `type: optional "service_account_actor"`
23759
23760 default: service_account_actor
23761
23762 - `ip_address: string`
23763
23764 - `service_account_id: string`
23765
23766 - `user_agent: string`
23767
23768 - `ScimDirectorySyncActor object`
23769
23770 - `type: optional "scim_directory_sync_actor"`
23771
23772 default: scim_directory_sync_actor
23773
23774 - `directory_id: string`
23775
23776 - `workos_event_id: string`
23777
23778 - `idp_connection_type: optional string or null`
23779
23780 - `FederatedIdentityActor object`
23781
23782 A federated external workload authenticated via a verified OIDC token.
23783
23784 Carries the verified issuer, subject, and audience claims from the
23785 presented JWT.
23786
23787 - `type: optional "federated_identity_actor"`
23788
23789 default: federated_identity_actor
23790
23791 - `issuer: string`
23792
23793 - `subject: string`
23794
23795 - `audience: optional array of string`
23796
23797 - `ip_address: optional string or null`
23798
23799 - `user_agent: optional string or null`
23800
23801 - `FederatedActor object`
23802
23803 An external identity asserted by a trusted provider — a cloud-provider
23804 gateway or a customer-registered federation issuer — acting without an
23805 Anthropic-provisioned account or service account.
23806
23807 - `type: optional "federated_actor"`
23808
23809 default: federated_actor
23810
23811 - `provider: Aws or Azure or Gcp or Oidc`
23812
23813 - `Aws object`
23814
23815 Asserting party: the AWS account the organization is bound to.
23816
23817 - `type: optional "aws"`
23818
23819 default: aws
23820
23821 - `account_id: string`
23822
23823 - `signed_principal: string`
23824
23825 The AWS-signed ARN of the IAM principal that requested the token.
23826
23827 - `Azure object`
23828
23829 Asserting party: the Azure subscription the organization is bound to.
23830
23831 - `type: optional "azure"`
23832
23833 default: azure
23834
23835 - `subscription_id: string`
23836
23837 - `Gcp object`
23838
23839 Asserting party: the GCP project the organization is bound to.
23840
23841 - `type: optional "gcp"`
23842
23843 default: gcp
23844
23845 - `project_number: string`
23846
23847 - `Oidc object`
23848
23849 Asserting party: a customer-registered OIDC federation issuer.
23850
23851 - `type: optional "oidc"`
23852
23853 default: oidc
23854
23855 - `issuer: optional string or null`
23856
23857 The federation issuer's URL. Null when the presented credential failed verification.
23858
23859 - `ip_address: optional string or null`
23860
23861 - `subject: optional string or null`
23862
23863 The provider's verified identifier for the caller; its form depends on the provider.
23864
23865 - `user_agent: optional string or null`
23866
23867 - `AttestedDeviceActor object`
23868
23869 An attested mobile device authenticated via Apple App Attest.
23870
23871 - `type: optional "attested_device_actor"`
23872
23873 default: attested_device_actor
23874
23875 - `external_client_id: string`
23876
23877 - `kid_hash: string`
23878
23879 - `ip_address: optional string or null`
23880
23881 - `user_agent: optional string or null`
23882
23883 - `claude_artifact_id: string`
23884
23885 Tagged ID of the artifact that was moved.
23886
23887 - `id: optional string`
23888
23889 Unique identifier for the activity e.g. 'activity_abcd1234'
23890
23891 - `created_at: optional string`
23892
23893 When this activity occurred.
23894
23895 format: date-time
23896
23897 - `member_gained_count: optional number or null`
23898
23899 The number of people with whom the folder holding the artifact, or a folder containing that folder, was individually shared after the move and none was before; people reached only through a group or organization-wide sharing are not counted, so zero does not mean that nobody gained access, and all four counts are absent when they could not be determined.
23900
23901 - `member_lost_count: optional number or null`
23902
23903 The number of people with whom the folder holding the artifact, or a folder containing that folder, was individually shared before the move and none was after; people who had access only through a group or organization-wide sharing are not counted, so zero does not mean that nobody lost access, and those counted may still have access to the artifact another way.
23904
23905 - `member_lowered_count: optional number or null`
23906
23907 The number of people whose individually shared access level, through the folder holding the artifact and the folders containing that folder, was lower after the move than before.
23908
23909 - `member_raised_count: optional number or null`
23910
23911 The number of people whose individually shared access level, through the folder holding the artifact and the folders containing that folder, was higher after the move than before.
23912
23913 - `moved_by_owner: optional boolean or null`
23914
23915 True when the person who moved the artifact was its owner, false when it was someone else.
23916
23917 - `organization_id: optional string or null`
23918
23919 Organization ID this activity is associated with
23920
23921 - `organization_uuid: optional string or null`
23922
23923 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
23924
23925 - `parent_claude_artifact_folder_id: optional string or null`
23926
23927 Tagged ID ("cfld_...") of the folder the artifact was in after the move; absent when it was left in no folder.
23928
23929 - `previous_parent_claude_artifact_folder_id: optional string or null`
23930
23931 Tagged ID ("cfld_...") of the folder the artifact was in before the move; absent when it was in no folder, or when that could not be determined.
23932
2300523933 - `ClaudeArtifactSentToPartner object`
2300623934
2300723935 A member sent an export of an artifact to a partner application ("Send to …" on the artifact; a partner is a third-party application listed in Claude's connector directory): a file exported from the artifact was made available over a temporary link for the chosen partner to fetch. One activity is recorded per send, in the artifact owner's organization with the sending member as actor, whether or not the partner then retrieved the file; the partner's own import of the file is not part of this record. The file's name and contents are not recorded.
from line 32626
3169832626
3169932627 format: date-time
3170032628
32629 - `finding_id: optional string or null`
32630
32631 Tagged ID of the finding the session was created for, omitted from some events, such as those recorded before this field was introduced.
32632
3170132633 - `organization_id: optional string or null`
3170232634
3170332635 Organization ID this activity is associated with
from line 32638
3170632638
3170732639 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
3170832640
32641 - `scan_project_id: optional string or null`
32642
32643 Tagged ID of the scan project the finding belongs to, omitted from some events, such as those recorded before this field was introduced.
32644
3170932645 - `ClaudeCodeSecurityVulnerabilityUpdated object`
3171032646
3171132647 A Claude Code Security vulnerability finding was dismissed, restored, marked fixed, or reopened.
from line 44916
4398044916
4398144917 - `marketplace_id: optional string or null`
4398244918
43983 The marketplace of the plugin that carries the skill; unset for a standalone skill.
44919 The marketplace of the plugin that carries the skill, if any.
4398444920
4398544921 - `organization_id: optional string or null`
4398644922
from line 44932
4399644932
4399744933 - `plugin_id: optional string or null`
4399844934
43999 The plugin that carries the skill; unset for a standalone skill.
44935 The plugin that carries the skill, if any.
4400044936
4400144937 - `scope: optional "organization" or "personal" or "unspecified" or null`
4400244938
from line 45278
4434245278
4434345279 Name of the skill (its SKILL.md name, as on the other skill activities).
4434445280
45281 - `ClaudeSkillServedVersionUpdated object`
45282
45283 A skill's served version, the version that members get, was updated: an administrator or the owner chose a version, a saved version became the served version, or an accepted library submission was published into the skill. A new version that is served as soon as it is saved may appear only as claude_skill_version_created.
45284
45285 - `type: optional "claude_skill_served_version_updated"`
45286
45287 default: claude_skill_served_version_updated
45288
45289 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
45290
45291 - `APIActor object`
45292
45293 - `type: optional "api_actor"`
45294
45295 default: api_actor
45296
45297 - `api_key_id: string`
45298
45299 - `ip_address: string`
45300
45301 - `user_agent: string`
45302
45303 - `UserActor object`
45304
45305 - `type: optional "user_actor"`
45306
45307 default: user_actor
45308
45309 - `email_address: string`
45310
45311 format: email
45312
45313 - `ip_address: string`
45314
45315 - `user_agent: string`
45316
45317 - `user_id: string`
45318
45319 - `UnauthenticatedUserActor object`
45320
45321 - `type: optional "unauthenticated_user_actor"`
45322
45323 default: unauthenticated_user_actor
45324
45325 - `ip_address: string`
45326
45327 - `user_agent: string`
45328
45329 - `unauthenticated_email_address: optional string or null`
45330
45331 format: email
45332
45333 - `AnthropicActor object`
45334
45335 - `type: optional "anthropic_actor"`
45336
45337 default: anthropic_actor
45338
45339 - `email_address: optional string or null`
45340
45341 format: email
45342
45343 - `SystemActor object`
45344
45345 Automated background processing performed by Anthropic systems, acting
45346 without a user or customer credential.
45347
45348 - `type: optional "system_actor"`
45349
45350 default: system_actor
45351
45352 - `service: optional string or null`
45353
45354 Name of the automated process that performed the action, when known.
45355
45356 - `AdminAPIKeyActor object`
45357
45358 - `type: optional "admin_api_key_actor"`
45359
45360 default: admin_api_key_actor
45361
45362 - `admin_api_key_id: string`
45363
45364 - `ip_address: string`
45365
45366 - `user_agent: string`
45367
45368 - `ServiceAccountActor object`
45369
45370 - `type: optional "service_account_actor"`
45371
45372 default: service_account_actor
45373
45374 - `ip_address: string`
45375
45376 - `service_account_id: string`
45377
45378 - `user_agent: string`
45379
45380 - `ScimDirectorySyncActor object`
45381
45382 - `type: optional "scim_directory_sync_actor"`
45383
45384 default: scim_directory_sync_actor
45385
45386 - `directory_id: string`
45387
45388 - `workos_event_id: string`
45389
45390 - `idp_connection_type: optional string or null`
45391
45392 - `FederatedIdentityActor object`
45393
45394 A federated external workload authenticated via a verified OIDC token.
45395
45396 Carries the verified issuer, subject, and audience claims from the
45397 presented JWT.
45398
45399 - `type: optional "federated_identity_actor"`
45400
45401 default: federated_identity_actor
45402
45403 - `issuer: string`
45404
45405 - `subject: string`
45406
45407 - `audience: optional array of string`
45408
45409 - `ip_address: optional string or null`
45410
45411 - `user_agent: optional string or null`
45412
45413 - `FederatedActor object`
45414
45415 An external identity asserted by a trusted provider — a cloud-provider
45416 gateway or a customer-registered federation issuer — acting without an
45417 Anthropic-provisioned account or service account.
45418
45419 - `type: optional "federated_actor"`
45420
45421 default: federated_actor
45422
45423 - `provider: Aws or Azure or Gcp or Oidc`
45424
45425 - `Aws object`
45426
45427 Asserting party: the AWS account the organization is bound to.
45428
45429 - `type: optional "aws"`
45430
45431 default: aws
45432
45433 - `account_id: string`
45434
45435 - `signed_principal: string`
45436
45437 The AWS-signed ARN of the IAM principal that requested the token.
45438
45439 - `Azure object`
45440
45441 Asserting party: the Azure subscription the organization is bound to.
45442
45443 - `type: optional "azure"`
45444
45445 default: azure
45446
45447 - `subscription_id: string`
45448
45449 - `Gcp object`
45450
45451 Asserting party: the GCP project the organization is bound to.
45452
45453 - `type: optional "gcp"`
45454
45455 default: gcp
45456
45457 - `project_number: string`
45458
45459 - `Oidc object`
45460
45461 Asserting party: a customer-registered OIDC federation issuer.
45462
45463 - `type: optional "oidc"`
45464
45465 default: oidc
45466
45467 - `issuer: optional string or null`
45468
45469 The federation issuer's URL. Null when the presented credential failed verification.
45470
45471 - `ip_address: optional string or null`
45472
45473 - `subject: optional string or null`
45474
45475 The provider's verified identifier for the caller; its form depends on the provider.
45476
45477 - `user_agent: optional string or null`
45478
45479 - `AttestedDeviceActor object`
45480
45481 An attested mobile device authenticated via Apple App Attest.
45482
45483 - `type: optional "attested_device_actor"`
45484
45485 default: attested_device_actor
45486
45487 - `external_client_id: string`
45488
45489 - `kid_hash: string`
45490
45491 - `ip_address: optional string or null`
45492
45493 - `user_agent: optional string or null`
45494
45495 - `scope: "organization" or "personal" or "unspecified"`
45496
45497 Whether the skill is the member's own or the organization's.
45498
45499 - `"organization"`
45500
45501 - `"personal"`
45502
45503 - `"unspecified"`
45504
45505 - `to_skill_version: string`
45506
45507 The number of the served version after the update.
45508
45509 - `trigger: "library_publish" or "manual" or "save" or "unspecified"`
45510
45511 What caused the update.
45512
45513 - `"library_publish"`
45514
45515 - `"manual"`
45516
45517 - `"save"`
45518
45519 - `"unspecified"`
45520
45521 - `id: optional string`
45522
45523 Unique identifier for the activity e.g. 'activity_abcd1234'
45524
45525 - `created_at: optional string`
45526
45527 When this activity occurred.
45528
45529 format: date-time
45530
45531 - `from_skill_version: optional string or null`
45532
45533 The number of the served version before the update; the same as to_skill_version when that version was already being served. Unset when the skill had no served version or the number could not be read.
45534
45535 - `organization_id: optional string or null`
45536
45537 Organization ID this activity is associated with
45538
45539 - `organization_uuid: optional string or null`
45540
45541 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
45542
45543 - `owner_user_id: optional string or null`
45544
45545 The member who owns the skill; unset for an organization-owned skill.
45546
45547 - `skill_id: optional string or null`
45548
45549 The skill whose served version was updated.
45550
45551 - `skill_name: optional string or null`
45552
45553 The name of the skill whose served version was updated.
45554
45555 - `ClaudeSkillVersionCreated object`
45556
45557 A new version of a skill was created.
45558
45559 - `type: optional "claude_skill_version_created"`
45560
45561 default: claude_skill_version_created
45562
45563 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
45564
45565 - `APIActor object`
45566
45567 - `type: optional "api_actor"`
45568
45569 default: api_actor
45570
45571 - `api_key_id: string`
45572
45573 - `ip_address: string`
45574
45575 - `user_agent: string`
45576
45577 - `UserActor object`
45578
45579 - `type: optional "user_actor"`
45580
45581 default: user_actor
45582
45583 - `email_address: string`
45584
45585 format: email
45586
45587 - `ip_address: string`
45588
45589 - `user_agent: string`
45590
45591 - `user_id: string`
45592
45593 - `UnauthenticatedUserActor object`
45594
45595 - `type: optional "unauthenticated_user_actor"`
45596
45597 default: unauthenticated_user_actor
45598
45599 - `ip_address: string`
45600
45601 - `user_agent: string`
45602
45603 - `unauthenticated_email_address: optional string or null`
45604
45605 format: email
45606
45607 - `AnthropicActor object`
45608
45609 - `type: optional "anthropic_actor"`
45610
45611 default: anthropic_actor
45612
45613 - `email_address: optional string or null`
45614
45615 format: email
45616
45617 - `SystemActor object`
45618
45619 Automated background processing performed by Anthropic systems, acting
45620 without a user or customer credential.
45621
45622 - `type: optional "system_actor"`
45623
45624 default: system_actor
45625
45626 - `service: optional string or null`
45627
45628 Name of the automated process that performed the action, when known.
45629
45630 - `AdminAPIKeyActor object`
45631
45632 - `type: optional "admin_api_key_actor"`
45633
45634 default: admin_api_key_actor
45635
45636 - `admin_api_key_id: string`
45637
45638 - `ip_address: string`
45639
45640 - `user_agent: string`
45641
45642 - `ServiceAccountActor object`
45643
45644 - `type: optional "service_account_actor"`
45645
45646 default: service_account_actor
45647
45648 - `ip_address: string`
45649
45650 - `service_account_id: string`
45651
45652 - `user_agent: string`
45653
45654 - `ScimDirectorySyncActor object`
45655
45656 - `type: optional "scim_directory_sync_actor"`
45657
45658 default: scim_directory_sync_actor
45659
45660 - `directory_id: string`
45661
45662 - `workos_event_id: string`
45663
45664 - `idp_connection_type: optional string or null`
45665
45666 - `FederatedIdentityActor object`
45667
45668 A federated external workload authenticated via a verified OIDC token.
45669
45670 Carries the verified issuer, subject, and audience claims from the
45671 presented JWT.
45672
45673 - `type: optional "federated_identity_actor"`
45674
45675 default: federated_identity_actor
45676
45677 - `issuer: string`
45678
45679 - `subject: string`
45680
45681 - `audience: optional array of string`
45682
45683 - `ip_address: optional string or null`
45684
45685 - `user_agent: optional string or null`
45686
45687 - `FederatedActor object`
45688
45689 An external identity asserted by a trusted provider — a cloud-provider
45690 gateway or a customer-registered federation issuer — acting without an
45691 Anthropic-provisioned account or service account.
45692
45693 - `type: optional "federated_actor"`
45694
45695 default: federated_actor
45696
45697 - `provider: Aws or Azure or Gcp or Oidc`
45698
45699 - `Aws object`
45700
45701 Asserting party: the AWS account the organization is bound to.
45702
45703 - `type: optional "aws"`
45704
45705 default: aws
45706
45707 - `account_id: string`
45708
45709 - `signed_principal: string`
45710
45711 The AWS-signed ARN of the IAM principal that requested the token.
45712
45713 - `Azure object`
45714
45715 Asserting party: the Azure subscription the organization is bound to.
45716
45717 - `type: optional "azure"`
45718
45719 default: azure
45720
45721 - `subscription_id: string`
45722
45723 - `Gcp object`
45724
45725 Asserting party: the GCP project the organization is bound to.
45726
45727 - `type: optional "gcp"`
45728
45729 default: gcp
45730
45731 - `project_number: string`
45732
45733 - `Oidc object`
45734
45735 Asserting party: a customer-registered OIDC federation issuer.
45736
45737 - `type: optional "oidc"`
45738
45739 default: oidc
45740
45741 - `issuer: optional string or null`
45742
45743 The federation issuer's URL. Null when the presented credential failed verification.
45744
45745 - `ip_address: optional string or null`
45746
45747 - `subject: optional string or null`
45748
45749 The provider's verified identifier for the caller; its form depends on the provider.
45750
45751 - `user_agent: optional string or null`
45752
45753 - `AttestedDeviceActor object`
45754
45755 An attested mobile device authenticated via Apple App Attest.
45756
45757 - `type: optional "attested_device_actor"`
45758
45759 default: attested_device_actor
45760
45761 - `external_client_id: string`
45762
45763 - `kid_hash: string`
45764
45765 - `ip_address: optional string or null`
45766
45767 - `user_agent: optional string or null`
45768
45769 - `scope: "organization" or "personal" or "unspecified"`
45770
45771 Whether the skill is the member's own or the organization's.
45772
45773 - `"organization"`
45774
45775 - `"personal"`
45776
45777 - `"unspecified"`
45778
45779 - `skill_version: string`
45780
45781 The number of the new version.
45782
45783 - `id: optional string`
45784
45785 Unique identifier for the activity e.g. 'activity_abcd1234'
45786
45787 - `created_at: optional string`
45788
45789 When this activity occurred.
45790
45791 format: date-time
45792
45793 - `organization_id: optional string or null`
45794
45795 Organization ID this activity is associated with
45796
45797 - `organization_uuid: optional string or null`
45798
45799 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
45800
45801 - `owner_user_id: optional string or null`
45802
45803 The member who owns the skill; unset for an organization-owned skill.
45804
45805 - `skill_id: optional string or null`
45806
45807 The skill that gained a version.
45808
45809 - `skill_name: optional string or null`
45810
45811 The name of the skill that gained a version.
45812
4434545813 - `ClaudeSurveyClosed object`
4434645814
4434745815 An organization admin closed an in-app survey before its end date, ending the collection of responses; a survey that reaches its end date records no event.
from line 53896
5242853896
5242953897 - `rbac_inclusion_enabled: optional boolean or null`
5243053898
52431 Whether Inference hooks apply only to members whose role grants the Inference hooks inspection permission, as configured after this change. Null means the setting is off: either nothing has been saved for it, or it is not available to the organization. When on, requests from members whose roles do not grant that permission are not sent to the organization's endpoint. Only a custom role that this permission was added to grants it; a role set to grant all capabilities, or all generally available capabilities, does not grant it. Members on one of the organization's built-in roles (such as User, Admin, or Owner) rather than a custom role never have this permission. Requests not tied to a member, such as those made with an API key, are not sent either, and neither are requests from Claude in Slack conversations.
53899 Whether Inference hooks apply only to members whose role grants the Inference hooks inspection permission, as configured after this change. Null means the setting is off: either nothing has been saved for it, or it is not available to the organization. When on, requests from members whose roles do not grant that permission are not sent to the organization's endpoint. Only a custom role that this permission was added to grants it; setting a role's "Capability access" to "All capabilities" or "All generally available" does not grant it. Members on one of the organization's built-in roles (such as User, Admin, or Owner) rather than a custom role never have this permission. Requests not tied to a member, such as those made with an API key, are not sent either, and neither are requests from Claude in Slack conversations.
5243253900
5243353901 - `reset_circuit_breaker: optional boolean or null`
5243453902
from line 82566
8109882566
8109982567 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
8110082568
82569 - `OrgDomainSSOEnforcementUpdated object`
82570
82571 A verified domain's single sign-on requirement changed, per surface.
82572
82573 - `type: optional "org_domain_sso_enforcement_updated"`
82574
82575 default: org_domain_sso_enforcement_updated
82576
82577 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
82578
82579 - `APIActor object`
82580
82581 - `type: optional "api_actor"`
82582
82583 default: api_actor
82584
82585 - `api_key_id: string`
82586
82587 - `ip_address: string`
82588
82589 - `user_agent: string`
82590
82591 - `UserActor object`
82592
82593 - `type: optional "user_actor"`
82594
82595 default: user_actor
82596
82597 - `email_address: string`
82598
82599 format: email
82600
82601 - `ip_address: string`
82602
82603 - `user_agent: string`
82604
82605 - `user_id: string`
82606
82607 - `UnauthenticatedUserActor object`
82608
82609 - `type: optional "unauthenticated_user_actor"`
82610
82611 default: unauthenticated_user_actor
82612
82613 - `ip_address: string`
82614
82615 - `user_agent: string`
82616
82617 - `unauthenticated_email_address: optional string or null`
82618
82619 format: email
82620
82621 - `AnthropicActor object`
82622
82623 - `type: optional "anthropic_actor"`
82624
82625 default: anthropic_actor
82626
82627 - `email_address: optional string or null`
82628
82629 format: email
82630
82631 - `SystemActor object`
82632
82633 Automated background processing performed by Anthropic systems, acting
82634 without a user or customer credential.
82635
82636 - `type: optional "system_actor"`
82637
82638 default: system_actor
82639
82640 - `service: optional string or null`
82641
82642 Name of the automated process that performed the action, when known.
82643
82644 - `AdminAPIKeyActor object`
82645
82646 - `type: optional "admin_api_key_actor"`
82647
82648 default: admin_api_key_actor
82649
82650 - `admin_api_key_id: string`
82651
82652 - `ip_address: string`
82653
82654 - `user_agent: string`
82655
82656 - `ServiceAccountActor object`
82657
82658 - `type: optional "service_account_actor"`
82659
82660 default: service_account_actor
82661
82662 - `ip_address: string`
82663
82664 - `service_account_id: string`
82665
82666 - `user_agent: string`
82667
82668 - `ScimDirectorySyncActor object`
82669
82670 - `type: optional "scim_directory_sync_actor"`
82671
82672 default: scim_directory_sync_actor
82673
82674 - `directory_id: string`
82675
82676 - `workos_event_id: string`
82677
82678 - `idp_connection_type: optional string or null`
82679
82680 - `FederatedIdentityActor object`
82681
82682 A federated external workload authenticated via a verified OIDC token.
82683
82684 Carries the verified issuer, subject, and audience claims from the
82685 presented JWT.
82686
82687 - `type: optional "federated_identity_actor"`
82688
82689 default: federated_identity_actor
82690
82691 - `issuer: string`
82692
82693 - `subject: string`
82694
82695 - `audience: optional array of string`
82696
82697 - `ip_address: optional string or null`
82698
82699 - `user_agent: optional string or null`
82700
82701 - `FederatedActor object`
82702
82703 An external identity asserted by a trusted provider — a cloud-provider
82704 gateway or a customer-registered federation issuer — acting without an
82705 Anthropic-provisioned account or service account.
82706
82707 - `type: optional "federated_actor"`
82708
82709 default: federated_actor
82710
82711 - `provider: Aws or Azure or Gcp or Oidc`
82712
82713 - `Aws object`
82714
82715 Asserting party: the AWS account the organization is bound to.
82716
82717 - `type: optional "aws"`
82718
82719 default: aws
82720
82721 - `account_id: string`
82722
82723 - `signed_principal: string`
82724
82725 The AWS-signed ARN of the IAM principal that requested the token.
82726
82727 - `Azure object`
82728
82729 Asserting party: the Azure subscription the organization is bound to.
82730
82731 - `type: optional "azure"`
82732
82733 default: azure
82734
82735 - `subscription_id: string`
82736
82737 - `Gcp object`
82738
82739 Asserting party: the GCP project the organization is bound to.
82740
82741 - `type: optional "gcp"`
82742
82743 default: gcp
82744
82745 - `project_number: string`
82746
82747 - `Oidc object`
82748
82749 Asserting party: a customer-registered OIDC federation issuer.
82750
82751 - `type: optional "oidc"`
82752
82753 default: oidc
82754
82755 - `issuer: optional string or null`
82756
82757 The federation issuer's URL. Null when the presented credential failed verification.
82758
82759 - `ip_address: optional string or null`
82760
82761 - `subject: optional string or null`
82762
82763 The provider's verified identifier for the caller; its form depends on the provider.
82764
82765 - `user_agent: optional string or null`
82766
82767 - `AttestedDeviceActor object`
82768
82769 An attested mobile device authenticated via Apple App Attest.
82770
82771 - `type: optional "attested_device_actor"`
82772
82773 default: attested_device_actor
82774
82775 - `external_client_id: string`
82776
82777 - `kid_hash: string`
82778
82779 - `ip_address: optional string or null`
82780
82781 - `user_agent: optional string or null`
82782
82783 - `claudeai_sso_enforced: boolean`
82784
82785 Whether single sign-on is required on claude.ai after the change.
82786
82787 - `console_sso_enforced: boolean`
82788
82789 Whether single sign-on is required on the Console after the change.
82790
82791 - `domain: string`
82792
82793 The verified domain whose requirement changed.
82794
82795 - `previous_claudeai_sso_enforced: boolean`
82796
82797 Whether single sign-on was required on claude.ai before the change.
82798
82799 - `previous_console_sso_enforced: boolean`
82800
82801 Whether single sign-on was required on the Console before the change.
82802
82803 - `id: optional string`
82804
82805 Unique identifier for the activity e.g. 'activity_abcd1234'
82806
82807 - `created_at: optional string`
82808
82809 When this activity occurred.
82810
82811 format: date-time
82812
82813 - `idp_connection_ids: optional array of string`
82814
82815 The identity provider connections (e.g. "idpc_01Ab...") the domain routes to at the time of the change, in the order they were added to the domain. Empty if it routes to none.
82816
82817 - `organization_id: optional string or null`
82818
82819 Organization ID this activity is associated with
82820
82821 - `organization_uuid: optional string or null`
82822
82823 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
82824
82825 - `OrgDomainSSORoutingUpdated object`
82826
82827 A verified domain's single sign-on routing was saved or changed. Lists the identity provider connections the domain's users sign in through before and after; the two lists are the same when a save changed nothing.
82828
82829 - `type: optional "org_domain_sso_routing_updated"`
82830
82831 default: org_domain_sso_routing_updated
82832
82833 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
82834
82835 - `APIActor object`
82836
82837 - `type: optional "api_actor"`
82838
82839 default: api_actor
82840
82841 - `api_key_id: string`
82842
82843 - `ip_address: string`
82844
82845 - `user_agent: string`
82846
82847 - `UserActor object`
82848
82849 - `type: optional "user_actor"`
82850
82851 default: user_actor
82852
82853 - `email_address: string`
82854
82855 format: email
82856
82857 - `ip_address: string`
82858
82859 - `user_agent: string`
82860
82861 - `user_id: string`
82862
82863 - `UnauthenticatedUserActor object`
82864
82865 - `type: optional "unauthenticated_user_actor"`
82866
82867 default: unauthenticated_user_actor
82868
82869 - `ip_address: string`
82870
82871 - `user_agent: string`
82872
82873 - `unauthenticated_email_address: optional string or null`
82874
82875 format: email
82876
82877 - `AnthropicActor object`
82878
82879 - `type: optional "anthropic_actor"`
82880
82881 default: anthropic_actor
82882
82883 - `email_address: optional string or null`
82884
82885 format: email
82886
82887 - `SystemActor object`
82888
82889 Automated background processing performed by Anthropic systems, acting
82890 without a user or customer credential.
82891
82892 - `type: optional "system_actor"`
82893
82894 default: system_actor
82895
82896 - `service: optional string or null`
82897
82898 Name of the automated process that performed the action, when known.
82899
82900 - `AdminAPIKeyActor object`
82901
82902 - `type: optional "admin_api_key_actor"`
82903
82904 default: admin_api_key_actor
82905
82906 - `admin_api_key_id: string`
82907
82908 - `ip_address: string`
82909
82910 - `user_agent: string`
82911
82912 - `ServiceAccountActor object`
82913
82914 - `type: optional "service_account_actor"`
82915
82916 default: service_account_actor
82917
82918 - `ip_address: string`
82919
82920 - `service_account_id: string`
82921
82922 - `user_agent: string`
82923
82924 - `ScimDirectorySyncActor object`
82925
82926 - `type: optional "scim_directory_sync_actor"`
82927
82928 default: scim_directory_sync_actor
82929
82930 - `directory_id: string`
82931
82932 - `workos_event_id: string`
82933
82934 - `idp_connection_type: optional string or null`
82935
82936 - `FederatedIdentityActor object`
82937
82938 A federated external workload authenticated via a verified OIDC token.
82939
82940 Carries the verified issuer, subject, and audience claims from the
82941 presented JWT.
82942
82943 - `type: optional "federated_identity_actor"`
82944
82945 default: federated_identity_actor
82946
82947 - `issuer: string`
82948
82949 - `subject: string`
82950
82951 - `audience: optional array of string`
82952
82953 - `ip_address: optional string or null`
82954
82955 - `user_agent: optional string or null`
82956
82957 - `FederatedActor object`
82958
82959 An external identity asserted by a trusted provider — a cloud-provider
82960 gateway or a customer-registered federation issuer — acting without an
82961 Anthropic-provisioned account or service account.
82962
82963 - `type: optional "federated_actor"`
82964
82965 default: federated_actor
82966
82967 - `provider: Aws or Azure or Gcp or Oidc`
82968
82969 - `Aws object`
82970
82971 Asserting party: the AWS account the organization is bound to.
82972
82973 - `type: optional "aws"`
82974
82975 default: aws
82976
82977 - `account_id: string`
82978
82979 - `signed_principal: string`
82980
82981 The AWS-signed ARN of the IAM principal that requested the token.
82982
82983 - `Azure object`
82984
82985 Asserting party: the Azure subscription the organization is bound to.
82986
82987 - `type: optional "azure"`
82988
82989 default: azure
82990
82991 - `subscription_id: string`
82992
82993 - `Gcp object`
82994
82995 Asserting party: the GCP project the organization is bound to.
82996
82997 - `type: optional "gcp"`
82998
82999 default: gcp
83000
83001 - `project_number: string`
83002
83003 - `Oidc object`
83004
83005 Asserting party: a customer-registered OIDC federation issuer.
83006
83007 - `type: optional "oidc"`
83008
83009 default: oidc
83010
83011 - `issuer: optional string or null`
83012
83013 The federation issuer's URL. Null when the presented credential failed verification.
83014
83015 - `ip_address: optional string or null`
83016
83017 - `subject: optional string or null`
83018
83019 The provider's verified identifier for the caller; its form depends on the provider.
83020
83021 - `user_agent: optional string or null`
83022
83023 - `AttestedDeviceActor object`
83024
83025 An attested mobile device authenticated via Apple App Attest.
83026
83027 - `type: optional "attested_device_actor"`
83028
83029 default: attested_device_actor
83030
83031 - `external_client_id: string`
83032
83033 - `kid_hash: string`
83034
83035 - `ip_address: optional string or null`
83036
83037 - `user_agent: optional string or null`
83038
83039 - `domain: string`
83040
83041 The verified domain whose routing changed.
83042
83043 - `id: optional string`
83044
83045 Unique identifier for the activity e.g. 'activity_abcd1234'
83046
83047 - `created_at: optional string`
83048
83049 When this activity occurred.
83050
83051 format: date-time
83052
83053 - `idp_connection_ids: optional array of string`
83054
83055 The identity provider connections (e.g. "idpc_01Ab...") the domain routes to after, in the order they were added to the domain. Empty if it routes to none.
83056
83057 - `organization_id: optional string or null`
83058
83059 Organization ID this activity is associated with
83060
83061 - `organization_uuid: optional string or null`
83062
83063 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
83064
83065 - `previous_idp_connection_ids: optional array of string`
83066
83067 The identity provider connections (e.g. "idpc_01Ab...") the domain routed to before, in the order they were added to the domain. Empty if it routed to none.
83068
8110183069 - `OrgDomainVerified object`
8110283070
8110383071 Organization domain was verified.
from line 85982
8401485982
8401585983 The IP range before this change; absent unless the range itself was changed.
8401685984
85985 - `OrgIdpConnectionCreated object`
85986
85987 An identity provider connection was added to the parent organization.
85988
85989 - `type: optional "org_idp_connection_created"`
85990
85991 default: org_idp_connection_created
85992
85993 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
85994
85995 - `APIActor object`
85996
85997 - `type: optional "api_actor"`
85998
85999 default: api_actor
86000
86001 - `api_key_id: string`
86002
86003 - `ip_address: string`
86004
86005 - `user_agent: string`
86006
86007 - `UserActor object`
86008
86009 - `type: optional "user_actor"`
86010
86011 default: user_actor
86012
86013 - `email_address: string`
86014
86015 format: email
86016
86017 - `ip_address: string`
86018
86019 - `user_agent: string`
86020
86021 - `user_id: string`
86022
86023 - `UnauthenticatedUserActor object`
86024
86025 - `type: optional "unauthenticated_user_actor"`
86026
86027 default: unauthenticated_user_actor
86028
86029 - `ip_address: string`
86030
86031 - `user_agent: string`
86032
86033 - `unauthenticated_email_address: optional string or null`
86034
86035 format: email
86036
86037 - `AnthropicActor object`
86038
86039 - `type: optional "anthropic_actor"`
86040
86041 default: anthropic_actor
86042
86043 - `email_address: optional string or null`
86044
86045 format: email
86046
86047 - `SystemActor object`
86048
86049 Automated background processing performed by Anthropic systems, acting
86050 without a user or customer credential.
86051
86052 - `type: optional "system_actor"`
86053
86054 default: system_actor
86055
86056 - `service: optional string or null`
86057
86058 Name of the automated process that performed the action, when known.
86059
86060 - `AdminAPIKeyActor object`
86061
86062 - `type: optional "admin_api_key_actor"`
86063
86064 default: admin_api_key_actor
86065
86066 - `admin_api_key_id: string`
86067
86068 - `ip_address: string`
86069
86070 - `user_agent: string`
86071
86072 - `ServiceAccountActor object`
86073
86074 - `type: optional "service_account_actor"`
86075
86076 default: service_account_actor
86077
86078 - `ip_address: string`
86079
86080 - `service_account_id: string`
86081
86082 - `user_agent: string`
86083
86084 - `ScimDirectorySyncActor object`
86085
86086 - `type: optional "scim_directory_sync_actor"`
86087
86088 default: scim_directory_sync_actor
86089
86090 - `directory_id: string`
86091
86092 - `workos_event_id: string`
86093
86094 - `idp_connection_type: optional string or null`
86095
86096 - `FederatedIdentityActor object`
86097
86098 A federated external workload authenticated via a verified OIDC token.
86099
86100 Carries the verified issuer, subject, and audience claims from the
86101 presented JWT.
86102
86103 - `type: optional "federated_identity_actor"`
86104
86105 default: federated_identity_actor
86106
86107 - `issuer: string`
86108
86109 - `subject: string`
86110
86111 - `audience: optional array of string`
86112
86113 - `ip_address: optional string or null`
86114
86115 - `user_agent: optional string or null`
86116
86117 - `FederatedActor object`
86118
86119 An external identity asserted by a trusted provider — a cloud-provider
86120 gateway or a customer-registered federation issuer — acting without an
86121 Anthropic-provisioned account or service account.
86122
86123 - `type: optional "federated_actor"`
86124
86125 default: federated_actor
86126
86127 - `provider: Aws or Azure or Gcp or Oidc`
86128
86129 - `Aws object`
86130
86131 Asserting party: the AWS account the organization is bound to.
86132
86133 - `type: optional "aws"`
86134
86135 default: aws
86136
86137 - `account_id: string`
86138
86139 - `signed_principal: string`
86140
86141 The AWS-signed ARN of the IAM principal that requested the token.
86142
86143 - `Azure object`
86144
86145 Asserting party: the Azure subscription the organization is bound to.
86146
86147 - `type: optional "azure"`
86148
86149 default: azure
86150
86151 - `subscription_id: string`
86152
86153 - `Gcp object`
86154
86155 Asserting party: the GCP project the organization is bound to.
86156
86157 - `type: optional "gcp"`
86158
86159 default: gcp
86160
86161 - `project_number: string`
86162
86163 - `Oidc object`
86164
86165 Asserting party: a customer-registered OIDC federation issuer.
86166
86167 - `type: optional "oidc"`
86168
86169 default: oidc
86170
86171 - `issuer: optional string or null`
86172
86173 The federation issuer's URL. Null when the presented credential failed verification.
86174
86175 - `ip_address: optional string or null`
86176
86177 - `subject: optional string or null`
86178
86179 The provider's verified identifier for the caller; its form depends on the provider.
86180
86181 - `user_agent: optional string or null`
86182
86183 - `AttestedDeviceActor object`
86184
86185 An attested mobile device authenticated via Apple App Attest.
86186
86187 - `type: optional "attested_device_actor"`
86188
86189 default: attested_device_actor
86190
86191 - `external_client_id: string`
86192
86193 - `kid_hash: string`
86194
86195 - `ip_address: optional string or null`
86196
86197 - `user_agent: optional string or null`
86198
86199 - `display_name: string`
86200
86201 The display name the administrator gave the connection.
86202
86203 - `idp_connection_id: string`
86204
86205 The identity provider connection that was created, e.g. "idpc_01Ab...".
86206
86207 - `id: optional string`
86208
86209 Unique identifier for the activity e.g. 'activity_abcd1234'
86210
86211 - `created_at: optional string`
86212
86213 When this activity occurred.
86214
86215 format: date-time
86216
86217 - `organization_id: optional string or null`
86218
86219 Organization ID this activity is associated with
86220
86221 - `organization_uuid: optional string or null`
86222
86223 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
86224
86225 - `OrgIdpConnectionDeleted object`
86226
86227 An identity provider connection was removed from the parent organization, along with the settings that referenced it.
86228
86229 - `type: optional "org_idp_connection_deleted"`
86230
86231 default: org_idp_connection_deleted
86232
86233 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
86234
86235 - `APIActor object`
86236
86237 - `type: optional "api_actor"`
86238
86239 default: api_actor
86240
86241 - `api_key_id: string`
86242
86243 - `ip_address: string`
86244
86245 - `user_agent: string`
86246
86247 - `UserActor object`
86248
86249 - `type: optional "user_actor"`
86250
86251 default: user_actor
86252
86253 - `email_address: string`
86254
86255 format: email
86256
86257 - `ip_address: string`
86258
86259 - `user_agent: string`
86260
86261 - `user_id: string`
86262
86263 - `UnauthenticatedUserActor object`
86264
86265 - `type: optional "unauthenticated_user_actor"`
86266
86267 default: unauthenticated_user_actor
86268
86269 - `ip_address: string`
86270
86271 - `user_agent: string`
86272
86273 - `unauthenticated_email_address: optional string or null`
86274
86275 format: email
86276
86277 - `AnthropicActor object`
86278
86279 - `type: optional "anthropic_actor"`
86280
86281 default: anthropic_actor
86282
86283 - `email_address: optional string or null`
86284
86285 format: email
86286
86287 - `SystemActor object`
86288
86289 Automated background processing performed by Anthropic systems, acting
86290 without a user or customer credential.
86291
86292 - `type: optional "system_actor"`
86293
86294 default: system_actor
86295
86296 - `service: optional string or null`
86297
86298 Name of the automated process that performed the action, when known.
86299
86300 - `AdminAPIKeyActor object`
86301
86302 - `type: optional "admin_api_key_actor"`
86303
86304 default: admin_api_key_actor
86305
86306 - `admin_api_key_id: string`
86307
86308 - `ip_address: string`
86309
86310 - `user_agent: string`
86311
86312 - `ServiceAccountActor object`
86313
86314 - `type: optional "service_account_actor"`
86315
86316 default: service_account_actor
86317
86318 - `ip_address: string`
86319
86320 - `service_account_id: string`
86321
86322 - `user_agent: string`
86323
86324 - `ScimDirectorySyncActor object`
86325
86326 - `type: optional "scim_directory_sync_actor"`
86327
86328 default: scim_directory_sync_actor
86329
86330 - `directory_id: string`
86331
86332 - `workos_event_id: string`
86333
86334 - `idp_connection_type: optional string or null`
86335
86336 - `FederatedIdentityActor object`
86337
86338 A federated external workload authenticated via a verified OIDC token.
86339
86340 Carries the verified issuer, subject, and audience claims from the
86341 presented JWT.
86342
86343 - `type: optional "federated_identity_actor"`
86344
86345 default: federated_identity_actor
86346
86347 - `issuer: string`
86348
86349 - `subject: string`
86350
86351 - `audience: optional array of string`
86352
86353 - `ip_address: optional string or null`
86354
86355 - `user_agent: optional string or null`
86356
86357 - `FederatedActor object`
86358
86359 An external identity asserted by a trusted provider — a cloud-provider
86360 gateway or a customer-registered federation issuer — acting without an
86361 Anthropic-provisioned account or service account.
86362
86363 - `type: optional "federated_actor"`
86364
86365 default: federated_actor
86366
86367 - `provider: Aws or Azure or Gcp or Oidc`
86368
86369 - `Aws object`
86370
86371 Asserting party: the AWS account the organization is bound to.
86372
86373 - `type: optional "aws"`
86374
86375 default: aws
86376
86377 - `account_id: string`
86378
86379 - `signed_principal: string`
86380
86381 The AWS-signed ARN of the IAM principal that requested the token.
86382
86383 - `Azure object`
86384
86385 Asserting party: the Azure subscription the organization is bound to.
86386
86387 - `type: optional "azure"`
86388
86389 default: azure
86390
86391 - `subscription_id: string`
86392
86393 - `Gcp object`
86394
86395 Asserting party: the GCP project the organization is bound to.
86396
86397 - `type: optional "gcp"`
86398
86399 default: gcp
86400
86401 - `project_number: string`
86402
86403 - `Oidc object`
86404
86405 Asserting party: a customer-registered OIDC federation issuer.
86406
86407 - `type: optional "oidc"`
86408
86409 default: oidc
86410
86411 - `issuer: optional string or null`
86412
86413 The federation issuer's URL. Null when the presented credential failed verification.
86414
86415 - `ip_address: optional string or null`
86416
86417 - `subject: optional string or null`
86418
86419 The provider's verified identifier for the caller; its form depends on the provider.
86420
86421 - `user_agent: optional string or null`
86422
86423 - `AttestedDeviceActor object`
86424
86425 An attested mobile device authenticated via Apple App Attest.
86426
86427 - `type: optional "attested_device_actor"`
86428
86429 default: attested_device_actor
86430
86431 - `external_client_id: string`
86432
86433 - `kid_hash: string`
86434
86435 - `ip_address: optional string or null`
86436
86437 - `user_agent: optional string or null`
86438
86439 - `directory_removed: boolean`
86440
86441 Whether a directory sync connection was removed with the connection.
86442
86443 - `display_name: string`
86444
86445 The connection's display name at the time of deletion.
86446
86447 - `idp_connection_id: string`
86448
86449 The identity provider connection that was deleted, e.g. "idpc_01Ab...".
86450
86451 - `id: optional string`
86452
86453 Unique identifier for the activity e.g. 'activity_abcd1234'
86454
86455 - `created_at: optional string`
86456
86457 When this activity occurred.
86458
86459 format: date-time
86460
86461 - `organization_id: optional string or null`
86462
86463 Organization ID this activity is associated with
86464
86465 - `organization_uuid: optional string or null`
86466
86467 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
86468
86469 - `role_mappings_removed: optional array of object`
86470
86471 Group-to-role mappings that were removed with the connection.
86472
86473 - `idp_group_name: string`
86474
86475 Name of the identity provider group the mapping matched.
86476
86477 - `organization_id: string`
86478
86479 The organization the mapping belonged to, e.g. "org_01Ab...".
86480
86481 - `role: string`
86482
86483 The role members of the group were given.
86484
86485 - `seat_tier_mappings_removed: optional array of object`
86486
86487 Group-to-seat-tier mappings that were removed with the connection.
86488
86489 - `idp_group_name: string`
86490
86491 Name of the identity provider group the mapping matched.
86492
86493 - `organization_id: string`
86494
86495 The organization the mapping belonged to, e.g. "org_01Ab...".
86496
86497 - `seat_tier: string`
86498
86499 The seat tier members of the group were given.
86500
86501 - `unrouted_domains: optional array of string`
86502
86503 Verified domains whose single sign-on was routed through this connection; they no longer route anywhere.
86504
86505 - `OrgIdpConnectionUpdated object`
86506
86507 An identity provider connection's settings were changed.
86508
86509 - `type: optional "org_idp_connection_updated"`
86510
86511 default: org_idp_connection_updated
86512
86513 - `action: "renamed" or "shown_at_sign_in_changed" or "sso_restricted_to_scim_directory_members_changed" or "unspecified"`
86514
86515 Which setting was changed.
86516
86517 - `"renamed"`
86518
86519 - `"shown_at_sign_in_changed"`
86520
86521 - `"sso_restricted_to_scim_directory_members_changed"`
86522
86523 - `"unspecified"`
86524
86525 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
86526
86527 - `APIActor object`
86528
86529 - `type: optional "api_actor"`
86530
86531 default: api_actor
86532
86533 - `api_key_id: string`
86534
86535 - `ip_address: string`
86536
86537 - `user_agent: string`
86538
86539 - `UserActor object`
86540
86541 - `type: optional "user_actor"`
86542
86543 default: user_actor
86544
86545 - `email_address: string`
86546
86547 format: email
86548
86549 - `ip_address: string`
86550
86551 - `user_agent: string`
86552
86553 - `user_id: string`
86554
86555 - `UnauthenticatedUserActor object`
86556
86557 - `type: optional "unauthenticated_user_actor"`
86558
86559 default: unauthenticated_user_actor
86560
86561 - `ip_address: string`
86562
86563 - `user_agent: string`
86564
86565 - `unauthenticated_email_address: optional string or null`
86566
86567 format: email
86568
86569 - `AnthropicActor object`
86570
86571 - `type: optional "anthropic_actor"`
86572
86573 default: anthropic_actor
86574
86575 - `email_address: optional string or null`
86576
86577 format: email
86578
86579 - `SystemActor object`
86580
86581 Automated background processing performed by Anthropic systems, acting
86582 without a user or customer credential.
86583
86584 - `type: optional "system_actor"`
86585
86586 default: system_actor
86587
86588 - `service: optional string or null`
86589
86590 Name of the automated process that performed the action, when known.
86591
86592 - `AdminAPIKeyActor object`
86593
86594 - `type: optional "admin_api_key_actor"`
86595
86596 default: admin_api_key_actor
86597
86598 - `admin_api_key_id: string`
86599
86600 - `ip_address: string`
86601
86602 - `user_agent: string`
86603
86604 - `ServiceAccountActor object`
86605
86606 - `type: optional "service_account_actor"`
86607
86608 default: service_account_actor
86609
86610 - `ip_address: string`
86611
86612 - `service_account_id: string`
86613
86614 - `user_agent: string`
86615
86616 - `ScimDirectorySyncActor object`
86617
86618 - `type: optional "scim_directory_sync_actor"`
86619
86620 default: scim_directory_sync_actor
86621
86622 - `directory_id: string`
86623
86624 - `workos_event_id: string`
86625
86626 - `idp_connection_type: optional string or null`
86627
86628 - `FederatedIdentityActor object`
86629
86630 A federated external workload authenticated via a verified OIDC token.
86631
86632 Carries the verified issuer, subject, and audience claims from the
86633 presented JWT.
86634
86635 - `type: optional "federated_identity_actor"`
86636
86637 default: federated_identity_actor
86638
86639 - `issuer: string`
86640
86641 - `subject: string`
86642
86643 - `audience: optional array of string`
86644
86645 - `ip_address: optional string or null`
86646
86647 - `user_agent: optional string or null`
86648
86649 - `FederatedActor object`
86650
86651 An external identity asserted by a trusted provider — a cloud-provider
86652 gateway or a customer-registered federation issuer — acting without an
86653 Anthropic-provisioned account or service account.
86654
86655 - `type: optional "federated_actor"`
86656
86657 default: federated_actor
86658
86659 - `provider: Aws or Azure or Gcp or Oidc`
86660
86661 - `Aws object`
86662
86663 Asserting party: the AWS account the organization is bound to.
86664
86665 - `type: optional "aws"`
86666
86667 default: aws
86668
86669 - `account_id: string`
86670
86671 - `signed_principal: string`
86672
86673 The AWS-signed ARN of the IAM principal that requested the token.
86674
86675 - `Azure object`
86676
86677 Asserting party: the Azure subscription the organization is bound to.
86678
86679 - `type: optional "azure"`
86680
86681 default: azure
86682
86683 - `subscription_id: string`
86684
86685 - `Gcp object`
86686
86687 Asserting party: the GCP project the organization is bound to.
86688
86689 - `type: optional "gcp"`
86690
86691 default: gcp
86692
86693 - `project_number: string`
86694
86695 - `Oidc object`
86696
86697 Asserting party: a customer-registered OIDC federation issuer.
86698
86699 - `type: optional "oidc"`
86700
86701 default: oidc
86702
86703 - `issuer: optional string or null`
86704
86705 The federation issuer's URL. Null when the presented credential failed verification.
86706
86707 - `ip_address: optional string or null`
86708
86709 - `subject: optional string or null`
86710
86711 The provider's verified identifier for the caller; its form depends on the provider.
86712
86713 - `user_agent: optional string or null`
86714
86715 - `AttestedDeviceActor object`
86716
86717 An attested mobile device authenticated via Apple App Attest.
86718
86719 - `type: optional "attested_device_actor"`
86720
86721 default: attested_device_actor
86722
86723 - `external_client_id: string`
86724
86725 - `kid_hash: string`
86726
86727 - `ip_address: optional string or null`
86728
86729 - `user_agent: optional string or null`
86730
86731 - `display_name: string`
86732
86733 The connection's display name after the change.
86734
86735 - `idp_connection_id: string`
86736
86737 The identity provider connection that was changed, e.g. "idpc_01Ab...".
86738
86739 - `id: optional string`
86740
86741 Unique identifier for the activity e.g. 'activity_abcd1234'
86742
86743 - `created_at: optional string`
86744
86745 When this activity occurred.
86746
86747 format: date-time
86748
86749 - `organization_id: optional string or null`
86750
86751 Organization ID this activity is associated with
86752
86753 - `organization_uuid: optional string or null`
86754
86755 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
86756
86757 - `shown_at_sign_in: optional boolean or null`
86758
86759 After the change, whether the sign-in page offers the connection. Set only when action is shown_at_sign_in_changed.
86760
86761 - `sso_restricted_to_scim_directory_members: optional boolean or null`
86762
86763 After the change, whether sign-in with the connection is limited to the people its SCIM directory lists as active, apart from primary owners and parent organization owners. Set only when action is sso_restricted_to_scim_directory_members_changed.
86764
8401786765 - `OrgInviteLinkDisabled object`
8401886766
8401986767 Organization invite link was disabled.
from line 94466
9171894466
9171994467 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
9172094468
94469 - `OrgSecurityControlAttestationUpdated object`
94470
94471 The organization's attestation for a security control was recorded, changed, renewed or cleared by an administrator, or was ended automatically.
94472
94473 - `type: optional "org_security_control_attestation_updated"`
94474
94475 default: org_security_control_attestation_updated
94476
94477 - `action: "attested" or "changed" or "cleared" or 3 more`
94478
94479 What happened to the attestation.
94480
94481 - `"attested"`
94482
94483 An administrator recorded an attestation for a control that had none.
94484
94485 - `"changed"`
94486
94487 An administrator replaced the attestation, either with another status or, when `status` and `previous_status` are equal, with the same status, as with `renewed`.
94488
94489 - `"cleared"`
94490
94491 An administrator removed the attestation.
94492
94493 - `"lapsed"`
94494
94495 The attestation was ended automatically, not by an administrator. This activity can be later than the change that ended the attestation, and a change that could end an attestation was not always followed by this activity.
94496
94497 - `"renewed"`
94498
94499 An administrator saved the attestation again with the same status. Such a save can also be recorded as `changed`.
94500
94501 - `"unspecified"`
94502
94503 Not used. No activity is recorded with this value.
94504
94505 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
94506
94507 - `APIActor object`
94508
94509 - `type: optional "api_actor"`
94510
94511 default: api_actor
94512
94513 - `api_key_id: string`
94514
94515 - `ip_address: string`
94516
94517 - `user_agent: string`
94518
94519 - `UserActor object`
94520
94521 - `type: optional "user_actor"`
94522
94523 default: user_actor
94524
94525 - `email_address: string`
94526
94527 format: email
94528
94529 - `ip_address: string`
94530
94531 - `user_agent: string`
94532
94533 - `user_id: string`
94534
94535 - `UnauthenticatedUserActor object`
94536
94537 - `type: optional "unauthenticated_user_actor"`
94538
94539 default: unauthenticated_user_actor
94540
94541 - `ip_address: string`
94542
94543 - `user_agent: string`
94544
94545 - `unauthenticated_email_address: optional string or null`
94546
94547 format: email
94548
94549 - `AnthropicActor object`
94550
94551 - `type: optional "anthropic_actor"`
94552
94553 default: anthropic_actor
94554
94555 - `email_address: optional string or null`
94556
94557 format: email
94558
94559 - `SystemActor object`
94560
94561 Automated background processing performed by Anthropic systems, acting
94562 without a user or customer credential.
94563
94564 - `type: optional "system_actor"`
94565
94566 default: system_actor
94567
94568 - `service: optional string or null`
94569
94570 Name of the automated process that performed the action, when known.
94571
94572 - `AdminAPIKeyActor object`
94573
94574 - `type: optional "admin_api_key_actor"`
94575
94576 default: admin_api_key_actor
94577
94578 - `admin_api_key_id: string`
94579
94580 - `ip_address: string`
94581
94582 - `user_agent: string`
94583
94584 - `ServiceAccountActor object`
94585
94586 - `type: optional "service_account_actor"`
94587
94588 default: service_account_actor
94589
94590 - `ip_address: string`
94591
94592 - `service_account_id: string`
94593
94594 - `user_agent: string`
94595
94596 - `ScimDirectorySyncActor object`
94597
94598 - `type: optional "scim_directory_sync_actor"`
94599
94600 default: scim_directory_sync_actor
94601
94602 - `directory_id: string`
94603
94604 - `workos_event_id: string`
94605
94606 - `idp_connection_type: optional string or null`
94607
94608 - `FederatedIdentityActor object`
94609
94610 A federated external workload authenticated via a verified OIDC token.
94611
94612 Carries the verified issuer, subject, and audience claims from the
94613 presented JWT.
94614
94615 - `type: optional "federated_identity_actor"`
94616
94617 default: federated_identity_actor
94618
94619 - `issuer: string`
94620
94621 - `subject: string`
94622
94623 - `audience: optional array of string`
94624
94625 - `ip_address: optional string or null`
94626
94627 - `user_agent: optional string or null`
94628
94629 - `FederatedActor object`
94630
94631 An external identity asserted by a trusted provider — a cloud-provider
94632 gateway or a customer-registered federation issuer — acting without an
94633 Anthropic-provisioned account or service account.
94634
94635 - `type: optional "federated_actor"`
94636
94637 default: federated_actor
94638
94639 - `provider: Aws or Azure or Gcp or Oidc`
94640
94641 - `Aws object`
94642
94643 Asserting party: the AWS account the organization is bound to.
94644
94645 - `type: optional "aws"`
94646
94647 default: aws
94648
94649 - `account_id: string`
94650
94651 - `signed_principal: string`
94652
94653 The AWS-signed ARN of the IAM principal that requested the token.
94654
94655 - `Azure object`
94656
94657 Asserting party: the Azure subscription the organization is bound to.
94658
94659 - `type: optional "azure"`
94660
94661 default: azure
94662
94663 - `subscription_id: string`
94664
94665 - `Gcp object`
94666
94667 Asserting party: the GCP project the organization is bound to.
94668
94669 - `type: optional "gcp"`
94670
94671 default: gcp
94672
94673 - `project_number: string`
94674
94675 - `Oidc object`
94676
94677 Asserting party: a customer-registered OIDC federation issuer.
94678
94679 - `type: optional "oidc"`
94680
94681 default: oidc
94682
94683 - `issuer: optional string or null`
94684
94685 The federation issuer's URL. Null when the presented credential failed verification.
94686
94687 - `ip_address: optional string or null`
94688
94689 - `subject: optional string or null`
94690
94691 The provider's verified identifier for the caller; its form depends on the provider.
94692
94693 - `user_agent: optional string or null`
94694
94695 - `AttestedDeviceActor object`
94696
94697 An attested mobile device authenticated via Apple App Attest.
94698
94699 - `type: optional "attested_device_actor"`
94700
94701 default: attested_device_actor
94702
94703 - `external_client_id: string`
94704
94705 - `kid_hash: string`
94706
94707 - `ip_address: optional string or null`
94708
94709 - `user_agent: optional string or null`
94710
94711 - `control: string`
94712
94713 The identifier of the security control the attestation applies to, for example "oauth_conditional_access".
94714
94715 - `id: optional string`
94716
94717 Unique identifier for the activity e.g. 'activity_abcd1234'
94718
94719 - `created_at: optional string`
94720
94721 When this activity occurred.
94722
94723 format: date-time
94724
94725 - `organization_id: optional string or null`
94726
94727 Organization ID this activity is associated with
94728
94729 - `organization_uuid: optional string or null`
94730
94731 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
94732
94733 - `previous_status: optional "accepted_risk" or "completed" or "unspecified" or null`
94734
94735 The status before this change; absent when action is "attested".
94736
94737 - `"accepted_risk"`
94738
94739 An administrator attested that the organization accepts the risk of not meeting the control.
94740
94741 - `"completed"`
94742
94743 An administrator attested that the organization meets the control.
94744
94745 - `"unspecified"`
94746
94747 Not used. No activity is recorded with this value.
94748
94749 - `review_date: optional string or null`
94750
94751 The UTC day (ISO 8601 date) on which the attestation was due to stop taking effect; absent when it had no end date or was cleared.
94752
94753 - `status: optional "accepted_risk" or "completed" or "unspecified" or null`
94754
94755 The attested status; absent when the attestation was cleared.
94756
94757 - `"accepted_risk"`
94758
94759 An administrator attested that the organization accepts the risk of not meeting the control.
94760
94761 - `"completed"`
94762
94763 An administrator attested that the organization meets the control.
94764
94765 - `"unspecified"`
94766
94767 Not used. No activity is recorded with this value.
94768
9172194769 - `OrgSyncDeletingSynchronizedFilesStarted object`
9172294770
9172394771 Organization started deleting synchronized files.
from line 99772
9672499772
9672599773 - `user_agent: optional string or null`
9672699774
96727 - `updates: array of Name or Capabilities or RedactContent or 112 more`
99775 - `updates: array of Name or Capabilities or RedactContent or 114 more`
9672899776
9672999777 - `Name object`
9673099778
from line 100206
97158100206
97159100207 Setting value immediately before this change
97160100208
100209 - `ClaudeAIChatExternalSharingEnabled object`
100210
100211 The Claude.ai external chat sharing setting (inviting addresses outside the organization) was changed for the organization.
100212
100213 - `type: optional "claude_ai_chat_external_sharing_enabled"`
100214
100215 default: claude_ai_chat_external_sharing_enabled
100216
100217 - `current_value: optional boolean or null`
100218
100219 Setting value immediately after this change
100220
100221 - `previous_value: optional boolean or null`
100222
100223 Setting value immediately before this change
100224
97161100225 - `ClaudeAICcrSharingEnabled object`
97162100226
97163100227 The Claude.ai remote Claude Code session sharing setting was changed for the organization.
from line 101739
98675101739
98676101740 Setting value immediately before this change. Null means the setting had not been set for the organization, so the plan default applied.
98677101741
101742 - `ClaudeAIChatOrgSharingEnabled object`
101743
101744 The Claude.ai setting that lets members share a chat with everyone in the organization was changed for the organization.
101745
101746 - `type: optional "claude_ai_chat_org_sharing_enabled"`
101747
101748 default: claude_ai_chat_org_sharing_enabled
101749
101750 - `current_value: optional boolean or null`
101751
101752 Setting value immediately after this change
101753
101754 - `previous_value: optional boolean or null`
101755
101756 Setting value immediately before this change. Null means the setting had not been set for the organization, so the default (on) applied.
101757
98678101758 - `ArtifactTypeDashboardsEnabled object`
98679101759
98680101760 The setting that lets members create Dashboards, one of Anthropic's built-in Artifact types, was changed for the organization.
from line 102117
99037102117
99038102118 Tagged ID of the member whose access to their owned projects was restored, when known.
99039102119
102120 - `ParentOrganizationCentralizedManagementEnrolled object`
102121
102122 A parent organization was enrolled in centralized management.
102123
102124 - `type: optional "parent_organization_centralized_management_enrolled"`
102125
102126 default: parent_organization_centralized_management_enrolled
102127
102128 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
102129
102130 - `APIActor object`
102131
102132 - `type: optional "api_actor"`
102133
102134 default: api_actor
102135
102136 - `api_key_id: string`
102137
102138 - `ip_address: string`
102139
102140 - `user_agent: string`
102141
102142 - `UserActor object`
102143
102144 - `type: optional "user_actor"`
102145
102146 default: user_actor
102147
102148 - `email_address: string`
102149
102150 format: email
102151
102152 - `ip_address: string`
102153
102154 - `user_agent: string`
102155
102156 - `user_id: string`
102157
102158 - `UnauthenticatedUserActor object`
102159
102160 - `type: optional "unauthenticated_user_actor"`
102161
102162 default: unauthenticated_user_actor
102163
102164 - `ip_address: string`
102165
102166 - `user_agent: string`
102167
102168 - `unauthenticated_email_address: optional string or null`
102169
102170 format: email
102171
102172 - `AnthropicActor object`
102173
102174 - `type: optional "anthropic_actor"`
102175
102176 default: anthropic_actor
102177
102178 - `email_address: optional string or null`
102179
102180 format: email
102181
102182 - `SystemActor object`
102183
102184 Automated background processing performed by Anthropic systems, acting
102185 without a user or customer credential.
102186
102187 - `type: optional "system_actor"`
102188
102189 default: system_actor
102190
102191 - `service: optional string or null`
102192
102193 Name of the automated process that performed the action, when known.
102194
102195 - `AdminAPIKeyActor object`
102196
102197 - `type: optional "admin_api_key_actor"`
102198
102199 default: admin_api_key_actor
102200
102201 - `admin_api_key_id: string`
102202
102203 - `ip_address: string`
102204
102205 - `user_agent: string`
102206
102207 - `ServiceAccountActor object`
102208
102209 - `type: optional "service_account_actor"`
102210
102211 default: service_account_actor
102212
102213 - `ip_address: string`
102214
102215 - `service_account_id: string`
102216
102217 - `user_agent: string`
102218
102219 - `ScimDirectorySyncActor object`
102220
102221 - `type: optional "scim_directory_sync_actor"`
102222
102223 default: scim_directory_sync_actor
102224
102225 - `directory_id: string`
102226
102227 - `workos_event_id: string`
102228
102229 - `idp_connection_type: optional string or null`
102230
102231 - `FederatedIdentityActor object`
102232
102233 A federated external workload authenticated via a verified OIDC token.
102234
102235 Carries the verified issuer, subject, and audience claims from the
102236 presented JWT.
102237
102238 - `type: optional "federated_identity_actor"`
102239
102240 default: federated_identity_actor
102241
102242 - `issuer: string`
102243
102244 - `subject: string`
102245
102246 - `audience: optional array of string`
102247
102248 - `ip_address: optional string or null`
102249
102250 - `user_agent: optional string or null`
102251
102252 - `FederatedActor object`
102253
102254 An external identity asserted by a trusted provider — a cloud-provider
102255 gateway or a customer-registered federation issuer — acting without an
102256 Anthropic-provisioned account or service account.
102257
102258 - `type: optional "federated_actor"`
102259
102260 default: federated_actor
102261
102262 - `provider: Aws or Azure or Gcp or Oidc`
102263
102264 - `Aws object`
102265
102266 Asserting party: the AWS account the organization is bound to.
102267
102268 - `type: optional "aws"`
102269
102270 default: aws
102271
102272 - `account_id: string`
102273
102274 - `signed_principal: string`
102275
102276 The AWS-signed ARN of the IAM principal that requested the token.
102277
102278 - `Azure object`
102279
102280 Asserting party: the Azure subscription the organization is bound to.
102281
102282 - `type: optional "azure"`
102283
102284 default: azure
102285
102286 - `subscription_id: string`
102287
102288 - `Gcp object`
102289
102290 Asserting party: the GCP project the organization is bound to.
102291
102292 - `type: optional "gcp"`
102293
102294 default: gcp
102295
102296 - `project_number: string`
102297
102298 - `Oidc object`
102299
102300 Asserting party: a customer-registered OIDC federation issuer.
102301
102302 - `type: optional "oidc"`
102303
102304 default: oidc
102305
102306 - `issuer: optional string or null`
102307
102308 The federation issuer's URL. Null when the presented credential failed verification.
102309
102310 - `ip_address: optional string or null`
102311
102312 - `subject: optional string or null`
102313
102314 The provider's verified identifier for the caller; its form depends on the provider.
102315
102316 - `user_agent: optional string or null`
102317
102318 - `AttestedDeviceActor object`
102319
102320 An attested mobile device authenticated via Apple App Attest.
102321
102322 - `type: optional "attested_device_actor"`
102323
102324 default: attested_device_actor
102325
102326 - `external_client_id: string`
102327
102328 - `kid_hash: string`
102329
102330 - `ip_address: optional string or null`
102331
102332 - `user_agent: optional string or null`
102333
102334 - `parent_organization_id: string`
102335
102336 The parent organization that was enrolled in centralized management.
102337
102338 - `id: optional string`
102339
102340 Unique identifier for the activity e.g. 'activity_abcd1234'
102341
102342 - `created_at: optional string`
102343
102344 When this activity occurred.
102345
102346 format: date-time
102347
102348 - `members: optional array of object`
102349
102350 The members granted parent-organization roles at enrollment.
102351
102352 - `role: "admin" or "owner" or "unspecified"`
102353
102354 The parent-organization role held.
102355
102356 - `"admin"`
102357
102358 - `"owner"`
102359
102360 - `"unspecified"`
102361
102362 - `user_id: string`
102363
102364 Tagged ID of the member's account.
102365
102366 - `organization_id: optional string or null`
102367
102368 Organization ID this activity is associated with
102369
102370 - `organization_uuid: optional string or null`
102371
102372 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
102373
102374 - `ParentOrganizationCentralizedManagementOrganizationUpdated object`
102375
102376 An organization's approval of its parent organization's Centralized Management setup changed, or its administrators were reminded to approve.
102377
102378 - `type: optional "parent_organization_centralized_management_organization_updated"`
102379
102380 default: parent_organization_centralized_management_organization_updated
102381
102382 - `action: "approval_withdrawn" or "approved" or "force_included" or 3 more`
102383
102384 How the organization's approval changed.
102385
102386 - `"approval_withdrawn"`
102387
102388 - `"approved"`
102389
102390 - `"force_included"`
102391
102392 - `"joined"`
102393
102394 - `"reminder_sent"`
102395
102396 - `"unspecified"`
102397
102398 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
102399
102400 - `APIActor object`
102401
102402 - `type: optional "api_actor"`
102403
102404 default: api_actor
102405
102406 - `api_key_id: string`
102407
102408 - `ip_address: string`
102409
102410 - `user_agent: string`
102411
102412 - `UserActor object`
102413
102414 - `type: optional "user_actor"`
102415
102416 default: user_actor
102417
102418 - `email_address: string`
102419
102420 format: email
102421
102422 - `ip_address: string`
102423
102424 - `user_agent: string`
102425
102426 - `user_id: string`
102427
102428 - `UnauthenticatedUserActor object`
102429
102430 - `type: optional "unauthenticated_user_actor"`
102431
102432 default: unauthenticated_user_actor
102433
102434 - `ip_address: string`
102435
102436 - `user_agent: string`
102437
102438 - `unauthenticated_email_address: optional string or null`
102439
102440 format: email
102441
102442 - `AnthropicActor object`
102443
102444 - `type: optional "anthropic_actor"`
102445
102446 default: anthropic_actor
102447
102448 - `email_address: optional string or null`
102449
102450 format: email
102451
102452 - `SystemActor object`
102453
102454 Automated background processing performed by Anthropic systems, acting
102455 without a user or customer credential.
102456
102457 - `type: optional "system_actor"`
102458
102459 default: system_actor
102460
102461 - `service: optional string or null`
102462
102463 Name of the automated process that performed the action, when known.
102464
102465 - `AdminAPIKeyActor object`
102466
102467 - `type: optional "admin_api_key_actor"`
102468
102469 default: admin_api_key_actor
102470
102471 - `admin_api_key_id: string`
102472
102473 - `ip_address: string`
102474
102475 - `user_agent: string`
102476
102477 - `ServiceAccountActor object`
102478
102479 - `type: optional "service_account_actor"`
102480
102481 default: service_account_actor
102482
102483 - `ip_address: string`
102484
102485 - `service_account_id: string`
102486
102487 - `user_agent: string`
102488
102489 - `ScimDirectorySyncActor object`
102490
102491 - `type: optional "scim_directory_sync_actor"`
102492
102493 default: scim_directory_sync_actor
102494
102495 - `directory_id: string`
102496
102497 - `workos_event_id: string`
102498
102499 - `idp_connection_type: optional string or null`
102500
102501 - `FederatedIdentityActor object`
102502
102503 A federated external workload authenticated via a verified OIDC token.
102504
102505 Carries the verified issuer, subject, and audience claims from the
102506 presented JWT.
102507
102508 - `type: optional "federated_identity_actor"`
102509
102510 default: federated_identity_actor
102511
102512 - `issuer: string`
102513
102514 - `subject: string`
102515
102516 - `audience: optional array of string`
102517
102518 - `ip_address: optional string or null`
102519
102520 - `user_agent: optional string or null`
102521
102522 - `FederatedActor object`
102523
102524 An external identity asserted by a trusted provider — a cloud-provider
102525 gateway or a customer-registered federation issuer — acting without an
102526 Anthropic-provisioned account or service account.
102527
102528 - `type: optional "federated_actor"`
102529
102530 default: federated_actor
102531
102532 - `provider: Aws or Azure or Gcp or Oidc`
102533
102534 - `Aws object`
102535
102536 Asserting party: the AWS account the organization is bound to.
102537
102538 - `type: optional "aws"`
102539
102540 default: aws
102541
102542 - `account_id: string`
102543
102544 - `signed_principal: string`
102545
102546 The AWS-signed ARN of the IAM principal that requested the token.
102547
102548 - `Azure object`
102549
102550 Asserting party: the Azure subscription the organization is bound to.
102551
102552 - `type: optional "azure"`
102553
102554 default: azure
102555
102556 - `subscription_id: string`
102557
102558 - `Gcp object`
102559
102560 Asserting party: the GCP project the organization is bound to.
102561
102562 - `type: optional "gcp"`
102563
102564 default: gcp
102565
102566 - `project_number: string`
102567
102568 - `Oidc object`
102569
102570 Asserting party: a customer-registered OIDC federation issuer.
102571
102572 - `type: optional "oidc"`
102573
102574 default: oidc
102575
102576 - `issuer: optional string or null`
102577
102578 The federation issuer's URL. Null when the presented credential failed verification.
102579
102580 - `ip_address: optional string or null`
102581
102582 - `subject: optional string or null`
102583
102584 The provider's verified identifier for the caller; its form depends on the provider.
102585
102586 - `user_agent: optional string or null`
102587
102588 - `AttestedDeviceActor object`
102589
102590 An attested mobile device authenticated via Apple App Attest.
102591
102592 - `type: optional "attested_device_actor"`
102593
102594 default: attested_device_actor
102595
102596 - `external_client_id: string`
102597
102598 - `kid_hash: string`
102599
102600 - `ip_address: optional string or null`
102601
102602 - `user_agent: optional string or null`
102603
102604 - `parent_organization_id: string`
102605
102606 The parent organization running the setup, e.g. "parent_org_01HX...".
102607
102608 - `target_organization_id: string`
102609
102610 The organization whose approval changed, e.g. "org_01HX...".
102611
102612 - `id: optional string`
102613
102614 Unique identifier for the activity e.g. 'activity_abcd1234'
102615
102616 - `created_at: optional string`
102617
102618 When this activity occurred.
102619
102620 format: date-time
102621
102622 - `organization_id: optional string or null`
102623
102624 Organization ID this activity is associated with
102625
102626 - `organization_uuid: optional string or null`
102627
102628 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
102629
102630 - `set_changed_at: optional string or null`
102631
102632 The version of the proposed administrators the approval, withdrawal or inclusion applied to (absent for reminders).
102633
102634 format: date-time
102635
102636 - `ParentOrganizationCentralizedManagementSetupUpdated object`
102637
102638 The Centralized Management setup of a parent organization changed: it was started or abandoned, its proposed administrators changed, its remaining organizations were force approved, or it completed.
102639
102640 - `type: optional "parent_organization_centralized_management_setup_updated"`
102641
102642 default: parent_organization_centralized_management_setup_updated
102643
102644 - `action: "abandoned" or "child_joined" or "completed" or 6 more`
102645
102646 How the setup changed.
102647
102648 - `"abandoned"`
102649
102650 - `"child_joined"`
102651
102652 - `"completed"`
102653
102654 - `"force_approved"`
102655
102656 - `"nominee_added"`
102657
102658 - `"nominee_removed"`
102659
102660 - `"restarted"`
102661
102662 - `"started"`
102663
102664 - `"unspecified"`
102665
102666 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
102667
102668 - `APIActor object`
102669
102670 - `type: optional "api_actor"`
102671
102672 default: api_actor
102673
102674 - `api_key_id: string`
102675
102676 - `ip_address: string`
102677
102678 - `user_agent: string`
102679
102680 - `UserActor object`
102681
102682 - `type: optional "user_actor"`
102683
102684 default: user_actor
102685
102686 - `email_address: string`
102687
102688 format: email
102689
102690 - `ip_address: string`
102691
102692 - `user_agent: string`
102693
102694 - `user_id: string`
102695
102696 - `UnauthenticatedUserActor object`
102697
102698 - `type: optional "unauthenticated_user_actor"`
102699
102700 default: unauthenticated_user_actor
102701
102702 - `ip_address: string`
102703
102704 - `user_agent: string`
102705
102706 - `unauthenticated_email_address: optional string or null`
102707
102708 format: email
102709
102710 - `AnthropicActor object`
102711
102712 - `type: optional "anthropic_actor"`
102713
102714 default: anthropic_actor
102715
102716 - `email_address: optional string or null`
102717
102718 format: email
102719
102720 - `SystemActor object`
102721
102722 Automated background processing performed by Anthropic systems, acting
102723 without a user or customer credential.
102724
102725 - `type: optional "system_actor"`
102726
102727 default: system_actor
102728
102729 - `service: optional string or null`
102730
102731 Name of the automated process that performed the action, when known.
102732
102733 - `AdminAPIKeyActor object`
102734
102735 - `type: optional "admin_api_key_actor"`
102736
102737 default: admin_api_key_actor
102738
102739 - `admin_api_key_id: string`
102740
102741 - `ip_address: string`
102742
102743 - `user_agent: string`
102744
102745 - `ServiceAccountActor object`
102746
102747 - `type: optional "service_account_actor"`
102748
102749 default: service_account_actor
102750
102751 - `ip_address: string`
102752
102753 - `service_account_id: string`
102754
102755 - `user_agent: string`
102756
102757 - `ScimDirectorySyncActor object`
102758
102759 - `type: optional "scim_directory_sync_actor"`
102760
102761 default: scim_directory_sync_actor
102762
102763 - `directory_id: string`
102764
102765 - `workos_event_id: string`
102766
102767 - `idp_connection_type: optional string or null`
102768
102769 - `FederatedIdentityActor object`
102770
102771 A federated external workload authenticated via a verified OIDC token.
102772
102773 Carries the verified issuer, subject, and audience claims from the
102774 presented JWT.
102775
102776 - `type: optional "federated_identity_actor"`
102777
102778 default: federated_identity_actor
102779
102780 - `issuer: string`
102781
102782 - `subject: string`
102783
102784 - `audience: optional array of string`
102785
102786 - `ip_address: optional string or null`
102787
102788 - `user_agent: optional string or null`
102789
102790 - `FederatedActor object`
102791
102792 An external identity asserted by a trusted provider — a cloud-provider
102793 gateway or a customer-registered federation issuer — acting without an
102794 Anthropic-provisioned account or service account.
102795
102796 - `type: optional "federated_actor"`
102797
102798 default: federated_actor
102799
102800 - `provider: Aws or Azure or Gcp or Oidc`
102801
102802 - `Aws object`
102803
102804 Asserting party: the AWS account the organization is bound to.
102805
102806 - `type: optional "aws"`
102807
102808 default: aws
102809
102810 - `account_id: string`
102811
102812 - `signed_principal: string`
102813
102814 The AWS-signed ARN of the IAM principal that requested the token.
102815
102816 - `Azure object`
102817
102818 Asserting party: the Azure subscription the organization is bound to.
102819
102820 - `type: optional "azure"`
102821
102822 default: azure
102823
102824 - `subscription_id: string`
102825
102826 - `Gcp object`
102827
102828 Asserting party: the GCP project the organization is bound to.
102829
102830 - `type: optional "gcp"`
102831
102832 default: gcp
102833
102834 - `project_number: string`
102835
102836 - `Oidc object`
102837
102838 Asserting party: a customer-registered OIDC federation issuer.
102839
102840 - `type: optional "oidc"`
102841
102842 default: oidc
102843
102844 - `issuer: optional string or null`
102845
102846 The federation issuer's URL. Null when the presented credential failed verification.
102847
102848 - `ip_address: optional string or null`
102849
102850 - `subject: optional string or null`
102851
102852 The provider's verified identifier for the caller; its form depends on the provider.
102853
102854 - `user_agent: optional string or null`
102855
102856 - `AttestedDeviceActor object`
102857
102858 An attested mobile device authenticated via Apple App Attest.
102859
102860 - `type: optional "attested_device_actor"`
102861
102862 default: attested_device_actor
102863
102864 - `external_client_id: string`
102865
102866 - `kid_hash: string`
102867
102868 - `ip_address: optional string or null`
102869
102870 - `user_agent: optional string or null`
102871
102872 - `parent_organization_id: string`
102873
102874 The parent organization whose setup changed, e.g. "parent_org_01HX...".
102875
102876 - `id: optional string`
102877
102878 Unique identifier for the activity e.g. 'activity_abcd1234'
102879
102880 - `created_at: optional string`
102881
102882 When this activity occurred.
102883
102884 format: date-time
102885
102886 - `nominated_via_organization_id: optional string or null`
102887
102888 The organization the administrator was proposed through (nominee_added), e.g. "org_01HX...".
102889
102890 - `nominee_account_id: optional string or null`
102891
102892 The administrator added to or removed from the proposed administrators (nominee_added, nominee_removed), e.g. "user_01HX...".
102893
102894 - `organization_id: optional string or null`
102895
102896 Organization ID this activity is associated with
102897
102898 - `organization_uuid: optional string or null`
102899
102900 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
102901
102902 - `set_changed_at: optional string or null`
102903
102904 When the proposed administrators last changed as of this event; events sharing this value belong to the same version of the proposed administrators.
102905
102906 format: date-time
102907
102908 - `ParentOrganizationCentralizedManagementUnenrolled object`
102909
102910 A parent organization was unenrolled from centralized management.
102911
102912 - `type: optional "parent_organization_centralized_management_unenrolled"`
102913
102914 default: parent_organization_centralized_management_unenrolled
102915
102916 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
102917
102918 - `APIActor object`
102919
102920 - `type: optional "api_actor"`
102921
102922 default: api_actor
102923
102924 - `api_key_id: string`
102925
102926 - `ip_address: string`
102927
102928 - `user_agent: string`
102929
102930 - `UserActor object`
102931
102932 - `type: optional "user_actor"`
102933
102934 default: user_actor
102935
102936 - `email_address: string`
102937
102938 format: email
102939
102940 - `ip_address: string`
102941
102942 - `user_agent: string`
102943
102944 - `user_id: string`
102945
102946 - `UnauthenticatedUserActor object`
102947
102948 - `type: optional "unauthenticated_user_actor"`
102949
102950 default: unauthenticated_user_actor
102951
102952 - `ip_address: string`
102953
102954 - `user_agent: string`
102955
102956 - `unauthenticated_email_address: optional string or null`
102957
102958 format: email
102959
102960 - `AnthropicActor object`
102961
102962 - `type: optional "anthropic_actor"`
102963
102964 default: anthropic_actor
102965
102966 - `email_address: optional string or null`
102967
102968 format: email
102969
102970 - `SystemActor object`
102971
102972 Automated background processing performed by Anthropic systems, acting
102973 without a user or customer credential.
102974
102975 - `type: optional "system_actor"`
102976
102977 default: system_actor
102978
102979 - `service: optional string or null`
102980
102981 Name of the automated process that performed the action, when known.
102982
102983 - `AdminAPIKeyActor object`
102984
102985 - `type: optional "admin_api_key_actor"`
102986
102987 default: admin_api_key_actor
102988
102989 - `admin_api_key_id: string`
102990
102991 - `ip_address: string`
102992
102993 - `user_agent: string`
102994
102995 - `ServiceAccountActor object`
102996
102997 - `type: optional "service_account_actor"`
102998
102999 default: service_account_actor
103000
103001 - `ip_address: string`
103002
103003 - `service_account_id: string`
103004
103005 - `user_agent: string`
103006
103007 - `ScimDirectorySyncActor object`
103008
103009 - `type: optional "scim_directory_sync_actor"`
103010
103011 default: scim_directory_sync_actor
103012
103013 - `directory_id: string`
103014
103015 - `workos_event_id: string`
103016
103017 - `idp_connection_type: optional string or null`
103018
103019 - `FederatedIdentityActor object`
103020
103021 A federated external workload authenticated via a verified OIDC token.
103022
103023 Carries the verified issuer, subject, and audience claims from the
103024 presented JWT.
103025
103026 - `type: optional "federated_identity_actor"`
103027
103028 default: federated_identity_actor
103029
103030 - `issuer: string`
103031
103032 - `subject: string`
103033
103034 - `audience: optional array of string`
103035
103036 - `ip_address: optional string or null`
103037
103038 - `user_agent: optional string or null`
103039
103040 - `FederatedActor object`
103041
103042 An external identity asserted by a trusted provider — a cloud-provider
103043 gateway or a customer-registered federation issuer — acting without an
103044 Anthropic-provisioned account or service account.
103045
103046 - `type: optional "federated_actor"`
103047
103048 default: federated_actor
103049
103050 - `provider: Aws or Azure or Gcp or Oidc`
103051
103052 - `Aws object`
103053
103054 Asserting party: the AWS account the organization is bound to.
103055
103056 - `type: optional "aws"`
103057
103058 default: aws
103059
103060 - `account_id: string`
103061
103062 - `signed_principal: string`
103063
103064 The AWS-signed ARN of the IAM principal that requested the token.
103065
103066 - `Azure object`
103067
103068 Asserting party: the Azure subscription the organization is bound to.
103069
103070 - `type: optional "azure"`
103071
103072 default: azure
103073
103074 - `subscription_id: string`
103075
103076 - `Gcp object`
103077
103078 Asserting party: the GCP project the organization is bound to.
103079
103080 - `type: optional "gcp"`
103081
103082 default: gcp
103083
103084 - `project_number: string`
103085
103086 - `Oidc object`
103087
103088 Asserting party: a customer-registered OIDC federation issuer.
103089
103090 - `type: optional "oidc"`
103091
103092 default: oidc
103093
103094 - `issuer: optional string or null`
103095
103096 The federation issuer's URL. Null when the presented credential failed verification.
103097
103098 - `ip_address: optional string or null`
103099
103100 - `subject: optional string or null`
103101
103102 The provider's verified identifier for the caller; its form depends on the provider.
103103
103104 - `user_agent: optional string or null`
103105
103106 - `AttestedDeviceActor object`
103107
103108 An attested mobile device authenticated via Apple App Attest.
103109
103110 - `type: optional "attested_device_actor"`
103111
103112 default: attested_device_actor
103113
103114 - `external_client_id: string`
103115
103116 - `kid_hash: string`
103117
103118 - `ip_address: optional string or null`
103119
103120 - `user_agent: optional string or null`
103121
103122 - `parent_organization_id: string`
103123
103124 The parent organization that was unenrolled from centralized management.
103125
103126 - `id: optional string`
103127
103128 Unique identifier for the activity e.g. 'activity_abcd1234'
103129
103130 - `created_at: optional string`
103131
103132 When this activity occurred.
103133
103134 format: date-time
103135
103136 - `members: optional array of object`
103137
103138 The members whose parent-organization roles were revoked at unenrollment.
103139
103140 - `role: "admin" or "owner" or "unspecified"`
103141
103142 The parent-organization role held.
103143
103144 - `"admin"`
103145
103146 - `"owner"`
103147
103148 - `"unspecified"`
103149
103150 - `user_id: string`
103151
103152 Tagged ID of the member's account.
103153
103154 - `organization_id: optional string or null`
103155
103156 Organization ID this activity is associated with
103157
103158 - `organization_uuid: optional string or null`
103159
103160 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
103161
103162 - `ParentOrganizationMemberRemoved object`
103163
103164 A parent-organization admin role was removed from a user.
103165
103166 - `type: optional "parent_organization_member_removed"`
103167
103168 default: parent_organization_member_removed
103169
103170 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
103171
103172 - `APIActor object`
103173
103174 - `type: optional "api_actor"`
103175
103176 default: api_actor
103177
103178 - `api_key_id: string`
103179
103180 - `ip_address: string`
103181
103182 - `user_agent: string`
103183
103184 - `UserActor object`
103185
103186 - `type: optional "user_actor"`
103187
103188 default: user_actor
103189
103190 - `email_address: string`
103191
103192 format: email
103193
103194 - `ip_address: string`
103195
103196 - `user_agent: string`
103197
103198 - `user_id: string`
103199
103200 - `UnauthenticatedUserActor object`
103201
103202 - `type: optional "unauthenticated_user_actor"`
103203
103204 default: unauthenticated_user_actor
103205
103206 - `ip_address: string`
103207
103208 - `user_agent: string`
103209
103210 - `unauthenticated_email_address: optional string or null`
103211
103212 format: email
103213
103214 - `AnthropicActor object`
103215
103216 - `type: optional "anthropic_actor"`
103217
103218 default: anthropic_actor
103219
103220 - `email_address: optional string or null`
103221
103222 format: email
103223
103224 - `SystemActor object`
103225
103226 Automated background processing performed by Anthropic systems, acting
103227 without a user or customer credential.
103228
103229 - `type: optional "system_actor"`
103230
103231 default: system_actor
103232
103233 - `service: optional string or null`
103234
103235 Name of the automated process that performed the action, when known.
103236
103237 - `AdminAPIKeyActor object`
103238
103239 - `type: optional "admin_api_key_actor"`
103240
103241 default: admin_api_key_actor
103242
103243 - `admin_api_key_id: string`
103244
103245 - `ip_address: string`
103246
103247 - `user_agent: string`
103248
103249 - `ServiceAccountActor object`
103250
103251 - `type: optional "service_account_actor"`
103252
103253 default: service_account_actor
103254
103255 - `ip_address: string`
103256
103257 - `service_account_id: string`
103258
103259 - `user_agent: string`
103260
103261 - `ScimDirectorySyncActor object`
103262
103263 - `type: optional "scim_directory_sync_actor"`
103264
103265 default: scim_directory_sync_actor
103266
103267 - `directory_id: string`
103268
103269 - `workos_event_id: string`
103270
103271 - `idp_connection_type: optional string or null`
103272
103273 - `FederatedIdentityActor object`
103274
103275 A federated external workload authenticated via a verified OIDC token.
103276
103277 Carries the verified issuer, subject, and audience claims from the
103278 presented JWT.
103279
103280 - `type: optional "federated_identity_actor"`
103281
103282 default: federated_identity_actor
103283
103284 - `issuer: string`
103285
103286 - `subject: string`
103287
103288 - `audience: optional array of string`
103289
103290 - `ip_address: optional string or null`
103291
103292 - `user_agent: optional string or null`
103293
103294 - `FederatedActor object`
103295
103296 An external identity asserted by a trusted provider — a cloud-provider
103297 gateway or a customer-registered federation issuer — acting without an
103298 Anthropic-provisioned account or service account.
103299
103300 - `type: optional "federated_actor"`
103301
103302 default: federated_actor
103303
103304 - `provider: Aws or Azure or Gcp or Oidc`
103305
103306 - `Aws object`
103307
103308 Asserting party: the AWS account the organization is bound to.
103309
103310 - `type: optional "aws"`
103311
103312 default: aws
103313
103314 - `account_id: string`
103315
103316 - `signed_principal: string`
103317
103318 The AWS-signed ARN of the IAM principal that requested the token.
103319
103320 - `Azure object`
103321
103322 Asserting party: the Azure subscription the organization is bound to.
103323
103324 - `type: optional "azure"`
103325
103326 default: azure
103327
103328 - `subscription_id: string`
103329
103330 - `Gcp object`
103331
103332 Asserting party: the GCP project the organization is bound to.
103333
103334 - `type: optional "gcp"`
103335
103336 default: gcp
103337
103338 - `project_number: string`
103339
103340 - `Oidc object`
103341
103342 Asserting party: a customer-registered OIDC federation issuer.
103343
103344 - `type: optional "oidc"`
103345
103346 default: oidc
103347
103348 - `issuer: optional string or null`
103349
103350 The federation issuer's URL. Null when the presented credential failed verification.
103351
103352 - `ip_address: optional string or null`
103353
103354 - `subject: optional string or null`
103355
103356 The provider's verified identifier for the caller; its form depends on the provider.
103357
103358 - `user_agent: optional string or null`
103359
103360 - `AttestedDeviceActor object`
103361
103362 An attested mobile device authenticated via Apple App Attest.
103363
103364 - `type: optional "attested_device_actor"`
103365
103366 default: attested_device_actor
103367
103368 - `external_client_id: string`
103369
103370 - `kid_hash: string`
103371
103372 - `ip_address: optional string or null`
103373
103374 - `user_agent: optional string or null`
103375
103376 - `parent_organization_id: string`
103377
103378 The parent organization whose admin roster was changed.
103379
103380 - `role: string`
103381
103382 The role the user held on the parent organization at the time of removal.
103383
103384 - `user_id: string`
103385
103386 The user whose parent-organization admin role was removed.
103387
103388 - `id: optional string`
103389
103390 Unique identifier for the activity e.g. 'activity_abcd1234'
103391
103392 - `created_at: optional string`
103393
103394 When this activity occurred.
103395
103396 format: date-time
103397
103398 - `organization_id: optional string or null`
103399
103400 Organization ID this activity is associated with
103401
103402 - `organization_uuid: optional string or null`
103403
103404 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
103405
103406 - `ParentOrganizationMemberUpdated object`
103407
103408 A parent-organization admin role was granted or changed for a user.
103409
103410 - `type: optional "parent_organization_member_updated"`
103411
103412 default: parent_organization_member_updated
103413
103414 - `action: "added" or "role_changed" or "unspecified"`
103415
103416 Whether the user was newly granted the role or had an existing role changed.
103417
103418 - `"added"`
103419
103420 - `"role_changed"`
103421
103422 - `"unspecified"`
103423
103424 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
103425
103426 - `APIActor object`
103427
103428 - `type: optional "api_actor"`
103429
103430 default: api_actor
103431
103432 - `api_key_id: string`
103433
103434 - `ip_address: string`
103435
103436 - `user_agent: string`
103437
103438 - `UserActor object`
103439
103440 - `type: optional "user_actor"`
103441
103442 default: user_actor
103443
103444 - `email_address: string`
103445
103446 format: email
103447
103448 - `ip_address: string`
103449
103450 - `user_agent: string`
103451
103452 - `user_id: string`
103453
103454 - `UnauthenticatedUserActor object`
103455
103456 - `type: optional "unauthenticated_user_actor"`
103457
103458 default: unauthenticated_user_actor
103459
103460 - `ip_address: string`
103461
103462 - `user_agent: string`
103463
103464 - `unauthenticated_email_address: optional string or null`
103465
103466 format: email
103467
103468 - `AnthropicActor object`
103469
103470 - `type: optional "anthropic_actor"`
103471
103472 default: anthropic_actor
103473
103474 - `email_address: optional string or null`
103475
103476 format: email
103477
103478 - `SystemActor object`
103479
103480 Automated background processing performed by Anthropic systems, acting
103481 without a user or customer credential.
103482
103483 - `type: optional "system_actor"`
103484
103485 default: system_actor
103486
103487 - `service: optional string or null`
103488
103489 Name of the automated process that performed the action, when known.
103490
103491 - `AdminAPIKeyActor object`
103492
103493 - `type: optional "admin_api_key_actor"`
103494
103495 default: admin_api_key_actor
103496
103497 - `admin_api_key_id: string`
103498
103499 - `ip_address: string`
103500
103501 - `user_agent: string`
103502
103503 - `ServiceAccountActor object`
103504
103505 - `type: optional "service_account_actor"`
103506
103507 default: service_account_actor
103508
103509 - `ip_address: string`
103510
103511 - `service_account_id: string`
103512
103513 - `user_agent: string`
103514
103515 - `ScimDirectorySyncActor object`
103516
103517 - `type: optional "scim_directory_sync_actor"`
103518
103519 default: scim_directory_sync_actor
103520
103521 - `directory_id: string`
103522
103523 - `workos_event_id: string`
103524
103525 - `idp_connection_type: optional string or null`
103526
103527 - `FederatedIdentityActor object`
103528
103529 A federated external workload authenticated via a verified OIDC token.
103530
103531 Carries the verified issuer, subject, and audience claims from the
103532 presented JWT.
103533
103534 - `type: optional "federated_identity_actor"`
103535
103536 default: federated_identity_actor
103537
103538 - `issuer: string`
103539
103540 - `subject: string`
103541
103542 - `audience: optional array of string`
103543
103544 - `ip_address: optional string or null`
103545
103546 - `user_agent: optional string or null`
103547
103548 - `FederatedActor object`
103549
103550 An external identity asserted by a trusted provider — a cloud-provider
103551 gateway or a customer-registered federation issuer — acting without an
103552 Anthropic-provisioned account or service account.
103553
103554 - `type: optional "federated_actor"`
103555
103556 default: federated_actor
103557
103558 - `provider: Aws or Azure or Gcp or Oidc`
103559
103560 - `Aws object`
103561
103562 Asserting party: the AWS account the organization is bound to.
103563
103564 - `type: optional "aws"`
103565
103566 default: aws
103567
103568 - `account_id: string`
103569
103570 - `signed_principal: string`
103571
103572 The AWS-signed ARN of the IAM principal that requested the token.
103573
103574 - `Azure object`
103575
103576 Asserting party: the Azure subscription the organization is bound to.
103577
103578 - `type: optional "azure"`
103579
103580 default: azure
103581
103582 - `subscription_id: string`
103583
103584 - `Gcp object`
103585
103586 Asserting party: the GCP project the organization is bound to.
103587
103588 - `type: optional "gcp"`
103589
103590 default: gcp
103591
103592 - `project_number: string`
103593
103594 - `Oidc object`
103595
103596 Asserting party: a customer-registered OIDC federation issuer.
103597
103598 - `type: optional "oidc"`
103599
103600 default: oidc
103601
103602 - `issuer: optional string or null`
103603
103604 The federation issuer's URL. Null when the presented credential failed verification.
103605
103606 - `ip_address: optional string or null`
103607
103608 - `subject: optional string or null`
103609
103610 The provider's verified identifier for the caller; its form depends on the provider.
103611
103612 - `user_agent: optional string or null`
103613
103614 - `AttestedDeviceActor object`
103615
103616 An attested mobile device authenticated via Apple App Attest.
103617
103618 - `type: optional "attested_device_actor"`
103619
103620 default: attested_device_actor
103621
103622 - `external_client_id: string`
103623
103624 - `kid_hash: string`
103625
103626 - `ip_address: optional string or null`
103627
103628 - `user_agent: optional string or null`
103629
103630 - `parent_organization_id: string`
103631
103632 The parent organization whose admin roster was changed.
103633
103634 - `role: string`
103635
103636 The role the user now holds on the parent organization.
103637
103638 - `user_id: string`
103639
103640 The user whose parent-organization admin role was set.
103641
103642 - `id: optional string`
103643
103644 Unique identifier for the activity e.g. 'activity_abcd1234'
103645
103646 - `created_at: optional string`
103647
103648 When this activity occurred.
103649
103650 format: date-time
103651
103652 - `organization_id: optional string or null`
103653
103654 Organization ID this activity is associated with
103655
103656 - `organization_uuid: optional string or null`
103657
103658 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
103659
103660 - `ParentOrganizationSettingsUpdated object`
103661
103662 Parent organization settings were updated.
103663
103664 - `type: optional "parent_organization_settings_updated"`
103665
103666 default: parent_organization_settings_updated
103667
103668 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
103669
103670 - `APIActor object`
103671
103672 - `type: optional "api_actor"`
103673
103674 default: api_actor
103675
103676 - `api_key_id: string`
103677
103678 - `ip_address: string`
103679
103680 - `user_agent: string`
103681
103682 - `UserActor object`
103683
103684 - `type: optional "user_actor"`
103685
103686 default: user_actor
103687
103688 - `email_address: string`
103689
103690 format: email
103691
103692 - `ip_address: string`
103693
103694 - `user_agent: string`
103695
103696 - `user_id: string`
103697
103698 - `UnauthenticatedUserActor object`
103699
103700 - `type: optional "unauthenticated_user_actor"`
103701
103702 default: unauthenticated_user_actor
103703
103704 - `ip_address: string`
103705
103706 - `user_agent: string`
103707
103708 - `unauthenticated_email_address: optional string or null`
103709
103710 format: email
103711
103712 - `AnthropicActor object`
103713
103714 - `type: optional "anthropic_actor"`
103715
103716 default: anthropic_actor
103717
103718 - `email_address: optional string or null`
103719
103720 format: email
103721
103722 - `SystemActor object`
103723
103724 Automated background processing performed by Anthropic systems, acting
103725 without a user or customer credential.
103726
103727 - `type: optional "system_actor"`
103728
103729 default: system_actor
103730
103731 - `service: optional string or null`
103732
103733 Name of the automated process that performed the action, when known.
103734
103735 - `AdminAPIKeyActor object`
103736
103737 - `type: optional "admin_api_key_actor"`
103738
103739 default: admin_api_key_actor
103740
103741 - `admin_api_key_id: string`
103742
103743 - `ip_address: string`
103744
103745 - `user_agent: string`
103746
103747 - `ServiceAccountActor object`
103748
103749 - `type: optional "service_account_actor"`
103750
103751 default: service_account_actor
103752
103753 - `ip_address: string`
103754
103755 - `service_account_id: string`
103756
103757 - `user_agent: string`
103758
103759 - `ScimDirectorySyncActor object`
103760
103761 - `type: optional "scim_directory_sync_actor"`
103762
103763 default: scim_directory_sync_actor
103764
103765 - `directory_id: string`
103766
103767 - `workos_event_id: string`
103768
103769 - `idp_connection_type: optional string or null`
103770
103771 - `FederatedIdentityActor object`
103772
103773 A federated external workload authenticated via a verified OIDC token.
103774
103775 Carries the verified issuer, subject, and audience claims from the
103776 presented JWT.
103777
103778 - `type: optional "federated_identity_actor"`
103779
103780 default: federated_identity_actor
103781
103782 - `issuer: string`
103783
103784 - `subject: string`
103785
103786 - `audience: optional array of string`
103787
103788 - `ip_address: optional string or null`
103789
103790 - `user_agent: optional string or null`
103791
103792 - `FederatedActor object`
103793
103794 An external identity asserted by a trusted provider — a cloud-provider
103795 gateway or a customer-registered federation issuer — acting without an
103796 Anthropic-provisioned account or service account.
103797
103798 - `type: optional "federated_actor"`
103799
103800 default: federated_actor
103801
103802 - `provider: Aws or Azure or Gcp or Oidc`
103803
103804 - `Aws object`
103805
103806 Asserting party: the AWS account the organization is bound to.
103807
103808 - `type: optional "aws"`
103809
103810 default: aws
103811
103812 - `account_id: string`
103813
103814 - `signed_principal: string`
103815
103816 The AWS-signed ARN of the IAM principal that requested the token.
103817
103818 - `Azure object`
103819
103820 Asserting party: the Azure subscription the organization is bound to.
103821
103822 - `type: optional "azure"`
103823
103824 default: azure
103825
103826 - `subscription_id: string`
103827
103828 - `Gcp object`
103829
103830 Asserting party: the GCP project the organization is bound to.
103831
103832 - `type: optional "gcp"`
103833
103834 default: gcp
103835
103836 - `project_number: string`
103837
103838 - `Oidc object`
103839
103840 Asserting party: a customer-registered OIDC federation issuer.
103841
103842 - `type: optional "oidc"`
103843
103844 default: oidc
103845
103846 - `issuer: optional string or null`
103847
103848 The federation issuer's URL. Null when the presented credential failed verification.
103849
103850 - `ip_address: optional string or null`
103851
103852 - `subject: optional string or null`
103853
103854 The provider's verified identifier for the caller; its form depends on the provider.
103855
103856 - `user_agent: optional string or null`
103857
103858 - `AttestedDeviceActor object`
103859
103860 An attested mobile device authenticated via Apple App Attest.
103861
103862 - `type: optional "attested_device_actor"`
103863
103864 default: attested_device_actor
103865
103866 - `external_client_id: string`
103867
103868 - `kid_hash: string`
103869
103870 - `ip_address: optional string or null`
103871
103872 - `user_agent: optional string or null`
103873
103874 - `parent_organization_id: string`
103875
103876 The parent organization whose settings were updated.
103877
103878 - `updates: array of object`
103879
103880 The setting changes applied in this update.
103881
103882 - `type: optional "name"`
103883
103884 default: name
103885
103886 - `current_value: string`
103887
103888 Setting value immediately after this change
103889
103890 - `previous_value: string`
103891
103892 Setting value immediately before this change
103893
103894 - `id: optional string`
103895
103896 Unique identifier for the activity e.g. 'activity_abcd1234'
103897
103898 - `created_at: optional string`
103899
103900 When this activity occurred.
103901
103902 format: date-time
103903
103904 - `organization_id: optional string or null`
103905
103906 Organization ID this activity is associated with
103907
103908 - `organization_uuid: optional string or null`
103909
103910 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
103911
99040103912 - `PaymentMethodUpdated object`
99041103913
99042103914 The organization's default payment method was updated.
from line 138559
133687138559
133688138560 format: date-time
133689138561
138562 - `idp_connection_id: optional string or null`
138563
138564 Identifies the identity provider connection the sign-in came through. `null` or absent when the sign-in was not matched to one of the parent organization's identity provider connections. Absent on activities recorded before this field was introduced.
138565
133690138566 - `organization_id: optional string or null`
133691138567
133692138568 Organization ID this activity is associated with
from line 138795
133919138795
133920138796 format: date-time
133921138797
138798 - `idp_connection_id: optional string or null`
138799
138800 Identifies the identity provider connection the user was sent to. `null` or absent when the user was not sent to a single connection, for example when they choose one on the next page. Absent on activities recorded before this field was introduced.
138801
133922138802 - `organization_id: optional string or null`
133923138803
133924138804 Organization ID this activity is associated with
from line 139039
134159139039
134160139040 format: date-time
134161139041
139042 - `idp_connection_id: optional string or null`
139043
139044 Identifies the identity provider connection the user signed in through. `null` or absent when the sign-in was not matched to one of the parent organization's identity provider connections. Absent on activities recorded before this field was introduced.
139045
134162139046 - `mfa_method: optional "not_used" or "unspecified" or null`
134163139047
134164139048 The second authentication factor performed during this login, if any. `null` when the second-factor status is not recorded on this event — for example, when authentication was delegated to an external identity provider and any second factor is not visible to Anthropic, or when this event is one step of a multistep login whose MFA is reported on another activity. May be absent on activities recorded before this field was introduced.
134165139049
api/compliance/apps Changed · +15 / -3 lines
from line 2844
28442844forward-only: pass the response's `next_page` value back as `page` to
28452845retrieve the next page, and stop when `next_page` is null.
28462846
2847Returns 403 with the `error_code` `organization_compliance_restricted` in
2848`error.details` when an organization the request covers, or the key's own
2849organization, has compliance settings that do not allow its remote
2850sessions to be listed through the Compliance API. No sessions are
2851returned, and the error does not say which organization it is.
2852
28472853#### Query parameters
28482854
28492855- `created_at: optional object`
from line 2938
29322938
29332939 - `product_surface: string or null`
29342940
2935 The Claude product the session was created from. Currently `cowork_remote`, for Cowork sessions started on claude.ai web or mobile. More values will appear as other surfaces launch, so treat any unrecognized value as an unclassified surface rather than an error. Null for sessions created before this field was recorded, for surfaces that do not stamp it, and for unrecognized tag values.
2941 The Claude product the session was created from. Currently `cowork_remote`, for Cowork sessions started on claude.ai web or mobile, and `claude_tag`, for Claude Tag sessions started in Slack. More values will appear as other surfaces launch, so treat any unrecognized value as an unclassified surface rather than an error. Null for sessions created before this field was recorded, for surfaces that do not stamp it, and for unrecognized tag values.
29362942
29372943 - `started_by_user: object or null`
29382944
from line 3036
30303036and for sessions outside the organizations the key may read. A
30313037malformed session identifier returns 400.
30323038
3039Returns 403 with the `error_code` `organization_compliance_restricted` in
3040`error.details` when the session's organization, or the key's own
3041organization, has compliance settings that do not allow its remote
3042sessions to be read through the Compliance API. A retry does not help
3043until those settings change.
3044
30333045#### Path parameters
30343046
30353047- `claude_remote_session_id: string`
from line 3244
32323244
32333245 - `product_surface: string or null`
32343246
3235 The Claude product the session was created from. Currently `cowork_remote`, for Cowork sessions started on claude.ai web or mobile. More values will appear as other surfaces launch, so treat any unrecognized value as an unclassified surface rather than an error. Null for sessions created before this field was recorded, for surfaces that do not stamp it, and for unrecognized tag values.
3247 The Claude product the session was created from. Currently `cowork_remote`, for Cowork sessions started on claude.ai web or mobile, and `claude_tag`, for Claude Tag sessions started in Slack. More values will appear as other surfaces launch, so treat any unrecognized value as an unclassified surface rather than an error. Null for sessions created before this field was recorded, for surfaces that do not stamp it, and for unrecognized tag values.
32363248
32373249 - `started_by_user: object or null`
32383250
from line 3377
33653377
33663378 - `gte: optional string`
33673379
3368 Return only Artifacts updated at or after this time (RFC 3339 format). Time filters match an eventually-consistent index and Artifacts published before this field was recorded never match — omit the time filter for compliance-complete enumeration. For incremental export, apply a generous overlap margin between windows and dedupe by `id`: adjacent tiling silently misses items whose index update lagged their publish.
3380 Return only Artifacts updated at or after this time (RFC 3339 format). Time filters match an eventually-consistent index and Artifacts published before this field was recorded never match — omit the time filter for compliance-complete enumeration. For incremental export, apply a generous overlap margin between windows and dedupe by `id`: adjacent tiling silently misses items whose index update lagged their publish. Folder changes, such as sharing or unsharing a folder or moving an Artifact or folder, can change `read_mode` without changing `updated_at`, so time filters do not pick up those changes. To see an Artifact's current `read_mode`, omit the time filter.
33693381
33703382 format: date-time
33713383
api/compliance/apps/sessions Changed · +14 / -2 lines
from line 632
632632forward-only: pass the response's `next_page` value back as `page` to
633633retrieve the next page, and stop when `next_page` is null.
634634
635Returns 403 with the `error_code` `organization_compliance_restricted` in
636`error.details` when an organization the request covers, or the key's own
637organization, has compliance settings that do not allow its remote
638sessions to be listed through the Compliance API. No sessions are
639returned, and the error does not say which organization it is.
640
635641#### Query parameters
636642
637643- `created_at: optional object`
from line 726
720726
721727 - `product_surface: string or null`
722728
723 The Claude product the session was created from. Currently `cowork_remote`, for Cowork sessions started on claude.ai web or mobile. More values will appear as other surfaces launch, so treat any unrecognized value as an unclassified surface rather than an error. Null for sessions created before this field was recorded, for surfaces that do not stamp it, and for unrecognized tag values.
729 The Claude product the session was created from. Currently `cowork_remote`, for Cowork sessions started on claude.ai web or mobile, and `claude_tag`, for Claude Tag sessions started in Slack. More values will appear as other surfaces launch, so treat any unrecognized value as an unclassified surface rather than an error. Null for sessions created before this field was recorded, for surfaces that do not stamp it, and for unrecognized tag values.
724730
725731 - `started_by_user: object or null`
726732
from line 824
818824and for sessions outside the organizations the key may read. A
819825malformed session identifier returns 400.
820826
827Returns 403 with the `error_code` `organization_compliance_restricted` in
828`error.details` when the session's organization, or the key's own
829organization, has compliance settings that do not allow its remote
830sessions to be read through the Compliance API. A retry does not help
831until those settings change.
832
821833#### Path parameters
822834
823835- `claude_remote_session_id: string`
from line 1032
10201032
10211033 - `product_surface: string or null`
10221034
1023 The Claude product the session was created from. Currently `cowork_remote`, for Cowork sessions started on claude.ai web or mobile. More values will appear as other surfaces launch, so treat any unrecognized value as an unclassified surface rather than an error. Null for sessions created before this field was recorded, for surfaces that do not stamp it, and for unrecognized tag values.
1035 The Claude product the session was created from. Currently `cowork_remote`, for Cowork sessions started on claude.ai web or mobile, and `claude_tag`, for Claude Tag sessions started in Slack. More values will appear as other surfaces launch, so treat any unrecognized value as an unclassified surface rather than an error. Null for sessions created before this field was recorded, for surfaces that do not stamp it, and for unrecognized tag values.
10241036
10251037 - `started_by_user: object or null`
10261038
api/compliance/apps/sessions/remote Changed · +15 / -3 lines
from line 27
2727forward-only: pass the response's `next_page` value back as `page` to
2828retrieve the next page, and stop when `next_page` is null.
2929
30Returns 403 with the `error_code` `organization_compliance_restricted` in
31`error.details` when an organization the request covers, or the key's own
32organization, has compliance settings that do not allow its remote
33sessions to be listed through the Compliance API. No sessions are
34returned, and the error does not say which organization it is.
35
3036### Query parameters
3137
3238- `created_at: optional object`
from line 121
115121
116122 - `product_surface: string or null`
117123
118 The Claude product the session was created from. Currently `cowork_remote`, for Cowork sessions started on claude.ai web or mobile. More values will appear as other surfaces launch, so treat any unrecognized value as an unclassified surface rather than an error. Null for sessions created before this field was recorded, for surfaces that do not stamp it, and for unrecognized tag values.
124 The Claude product the session was created from. Currently `cowork_remote`, for Cowork sessions started on claude.ai web or mobile, and `claude_tag`, for Claude Tag sessions started in Slack. More values will appear as other surfaces launch, so treat any unrecognized value as an unclassified surface rather than an error. Null for sessions created before this field was recorded, for surfaces that do not stamp it, and for unrecognized tag values.
119125
120126 - `started_by_user: object or null`
121127
from line 228
222228
223229 - `product_surface: string or null`
224230
225 The Claude product the session was created from. Currently `cowork_remote`, for Cowork sessions started on claude.ai web or mobile. More values will appear as other surfaces launch, so treat any unrecognized value as an unclassified surface rather than an error. Null for sessions created before this field was recorded, for surfaces that do not stamp it, and for unrecognized tag values.
231 The Claude product the session was created from. Currently `cowork_remote`, for Cowork sessions started on claude.ai web or mobile, and `claude_tag`, for Claude Tag sessions started in Slack. More values will appear as other surfaces launch, so treat any unrecognized value as an unclassified surface rather than an error. Null for sessions created before this field was recorded, for surfaces that do not stamp it, and for unrecognized tag values.
226232
227233 - `started_by_user: object or null`
228234
from line 291
285291and for sessions outside the organizations the key may read. A
286292malformed session identifier returns 400.
287293
294Returns 403 with the `error_code` `organization_compliance_restricted` in
295`error.details` when the session's organization, or the key's own
296organization, has compliance settings that do not allow its remote
297sessions to be read through the Compliance API. A retry does not help
298until those settings change.
299
288300#### Path parameters
289301
290302- `claude_remote_session_id: string`
from line 499
487499
488500 - `product_surface: string or null`
489501
490 The Claude product the session was created from. Currently `cowork_remote`, for Cowork sessions started on claude.ai web or mobile. More values will appear as other surfaces launch, so treat any unrecognized value as an unclassified surface rather than an error. Null for sessions created before this field was recorded, for surfaces that do not stamp it, and for unrecognized tag values.
502 The Claude product the session was created from. Currently `cowork_remote`, for Cowork sessions started on claude.ai web or mobile, and `claude_tag`, for Claude Tag sessions started in Slack. More values will appear as other surfaces launch, so treat any unrecognized value as an unclassified surface rather than an error. Null for sessions created before this field was recorded, for surfaces that do not stamp it, and for unrecognized tag values.
491503
492504 - `started_by_user: object or null`
493505
api/compliance/apps/sessions/remote/list Changed · +7 / -1 lines
from line 25
2525forward-only: pass the response's `next_page` value back as `page` to
2626retrieve the next page, and stop when `next_page` is null.
2727
28Returns 403 with the `error_code` `organization_compliance_restricted` in
29`error.details` when an organization the request covers, or the key's own
30organization, has compliance settings that do not allow its remote
31sessions to be listed through the Compliance API. No sessions are
32returned, and the error does not say which organization it is.
33
2834## Query parameters
2935
3036- `created_at: optional object`
from line 119
113119
114120 - `product_surface: string or null`
115121
116 The Claude product the session was created from. Currently `cowork_remote`, for Cowork sessions started on claude.ai web or mobile. More values will appear as other surfaces launch, so treat any unrecognized value as an unclassified surface rather than an error. Null for sessions created before this field was recorded, for surfaces that do not stamp it, and for unrecognized tag values.
122 The Claude product the session was created from. Currently `cowork_remote`, for Cowork sessions started on claude.ai web or mobile, and `claude_tag`, for Claude Tag sessions started in Slack. More values will appear as other surfaces launch, so treat any unrecognized value as an unclassified surface rather than an error. Null for sessions created before this field was recorded, for surfaces that do not stamp it, and for unrecognized tag values.
117123
118124 - `started_by_user: object or null`
119125
api/compliance/apps/sessions/remote/messages Changed · +7 / -1 lines
from line 30
3030and for sessions outside the organizations the key may read. A
3131malformed session identifier returns 400.
3232
33Returns 403 with the `error_code` `organization_compliance_restricted` in
34`error.details` when the session's organization, or the key's own
35organization, has compliance settings that do not allow its remote
36sessions to be read through the Compliance API. A retry does not help
37until those settings change.
38
3339### Path parameters
3440
3541- `claude_remote_session_id: string`
from line 238
232238
233239 - `product_surface: string or null`
234240
235 The Claude product the session was created from. Currently `cowork_remote`, for Cowork sessions started on claude.ai web or mobile. More values will appear as other surfaces launch, so treat any unrecognized value as an unclassified surface rather than an error. Null for sessions created before this field was recorded, for surfaces that do not stamp it, and for unrecognized tag values.
241 The Claude product the session was created from. Currently `cowork_remote`, for Cowork sessions started on claude.ai web or mobile, and `claude_tag`, for Claude Tag sessions started in Slack. More values will appear as other surfaces launch, so treat any unrecognized value as an unclassified surface rather than an error. Null for sessions created before this field was recorded, for surfaces that do not stamp it, and for unrecognized tag values.
236242
237243 - `started_by_user: object or null`
238244
api/compliance/apps/sessions/remote/messages/list Changed · +7 / -1 lines
from line 28
2828and for sessions outside the organizations the key may read. A
2929malformed session identifier returns 400.
3030
31Returns 403 with the `error_code` `organization_compliance_restricted` in
32`error.details` when the session's organization, or the key's own
33organization, has compliance settings that do not allow its remote
34sessions to be read through the Compliance API. A retry does not help
35until those settings change.
36
3137## Path parameters
3238
3339- `claude_remote_session_id: string`
from line 236
230236
231237 - `product_surface: string or null`
232238
233 The Claude product the session was created from. Currently `cowork_remote`, for Cowork sessions started on claude.ai web or mobile. More values will appear as other surfaces launch, so treat any unrecognized value as an unclassified surface rather than an error. Null for sessions created before this field was recorded, for surfaces that do not stamp it, and for unrecognized tag values.
239 The Claude product the session was created from. Currently `cowork_remote`, for Cowork sessions started on claude.ai web or mobile, and `claude_tag`, for Claude Tag sessions started in Slack. More values will appear as other surfaces launch, so treat any unrecognized value as an unclassified surface rather than an error. Null for sessions created before this field was recorded, for surfaces that do not stamp it, and for unrecognized tag values.
234240
235241 - `started_by_user: object or null`
236242
api/compliance/organizations Changed · +380 / -2 lines
## Organizations › Security Posture ### Get an organization's security posture
from line 631
631631
632632The organization must belong to the API key's organization hierarchy;
633633unknown organizations and organizations outside the hierarchy return 404.
634The verified_domains and identity_providers settings describe the whole
635parent organization and are returned only to API keys that are not
636restricted to a single organization.
634637
635638#### Path parameters
636639
from line 699
696699
697700- `organization_id: string`
698701
699- `settings: array of Boolean or Integer or String or 3 more`
702- `settings: array of Boolean or Integer or String or 5 more`
700703
701704 - `Boolean object`
702705
from line 709
706709
707710 default: boolean
708711
709 - `name: "access_transparency_enabled" or "ai_powered_artifacts_enabled" or "api_workbench_feedback_collection_enabled" or 61 more`
712 - `name: "access_transparency_enabled" or "ai_powered_artifacts_enabled" or "api_workbench_feedback_collection_enabled" or 64 more`
710713
711714 - `"access_transparency_enabled"`
712715
from line 731
728731
729732 - `"claude_ai_ccr_support_sharing_enabled"`
730733
734 - `"claude_ai_chat_external_sharing_enabled"`
735
736 - `"claude_ai_chat_org_sharing_enabled"`
737
731738 - `"claude_ai_chat_sharing_enabled"`
732739
733740 - `"claude_ai_feedback_collection_enabled"`
from line 771
764771
765772 - `"claude_in_slack_enabled"`
766773
774 - `"claude_science_auto_mode_enabled"`
775
767776 - `"claude_science_custom_connectors_enabled"`
768777
769778 - `"claude_science_custom_skills_enabled"`
from line 970
961970
962971 default: data_retention_periods
963972
973 - `VerifiedDomains object`
974
975 The domains verified for the organization's parent organization. The
976 same for every organization under that parent, and returned only to API
977 keys that are not restricted to a single organization.
978
979 - `type: optional "verified_domains"`
980
981 default: verified_domains
982
983 - `value: array of object`
984
985 - `domain: string`
986
987 The verified domain name.
988
989 - `sso_claude_ai_enforced: boolean`
990
991 Whether single sign-on is required to sign in to Claude.ai with an email address on this domain.
992
993 - `sso_console_enforced: boolean`
994
995 Whether single sign-on is required to sign in to the Claude Console with an email address on this domain.
996
997 - `name: optional "verified_domains"`
998
999 default: verified_domains
1000
1001 - `IdentityProviders object`
1002
1003 The IdP connections of the organization's parent organization, oldest
1004 first. The same for every organization under that parent, and returned
1005 only to API keys that are not restricted to a single organization.
1006
1007 - `type: optional "identity_providers"`
1008
1009 default: identity_providers
1010
1011 - `value: array of object`
1012
1013 - `id: string`
1014
1015 Unique identifier for the IdP connection.
1016
1017 - `directory_sync_enabled: boolean`
1018
1019 Whether directory sync through this IdP connection is enabled.
1020
1021 - `sso_enabled: boolean`
1022
1023 Whether single sign-on through this IdP connection is enabled.
1024
1025 - `name: optional "identity_providers"`
1026
1027 default: identity_providers
1028
9641029#### Example
9651030
9661031```bash
from line 1061
9961061 }
9971062 ],
9981063 "type": "effective_organization_settings"
1064}
1065```
1066
1067## Organizations › Security Posture
1068
1069### Get an organization's security posture
1070
1071**GET** `/v1/compliance/organizations/{organization_id}/security_posture`
1072
1073Get an organization's security controls and their current results.
1074
1075Returns the organization's security controls, evaluated at the time of the
1076request, each with its attestation when this endpoint returns one. The controls come
1077in one `controls` list, which is not paginated. A control can have no entry, for
1078example when it is about a feature that the organization cannot have, so a missing
1079control is not a pass.
1080
1081The `anthropic-version` header is required: a request without it returns 400.
1082The endpoint takes no query parameters, so there is no filter, and a request with
1083any query parameter also returns 400. A request also returns 400 when the Compliance
1084API is not enabled for the API key's parent organization.
1085The request returns 404 when `organization_id` names no organization, names one
1086that the API key cannot read, or names one whose security controls are not
1087available. A request over a rate limit returns 429.
1088
1089One error has an `error_code` in `error.details`. A 503 with
1090`posture_evaluation_failed` means that the evaluation could not be completed.
1091Wait for the time in the `Retry-After` header before trying again. A 504 means
1092that the evaluation did not finish in time, and the request can be tried again.
1093
1094#### Path parameters
1095
1096- `organization_id: string`
1097
1098 The organization's UUID
1099
1100#### Headers
1101
1102- `"anthropic-version": optional string`
1103
1104 The version of the Claude API you want to use.
1105
1106 Read more about versioning and our version history [here](https://platform.claude.com/docs/en/api/versioning?sdk_languages=http).
1107
1108- `"x-api-key": optional string`
1109
1110#### Returns
1111
1112- `type: "security_posture"`
1113
1114 Always `security_posture`.
1115
1116- `comments_status: "available" or "not_enabled" or "not_permitted" or 2 more`
1117
1118 Whether attestation comments were read. More values can be added; read an unknown one as `unavailable`.
1119
1120 - `"available"`
1121
1122 Comments were read, so a null `comment` means that there is none, or that the attestation was saved moments ago.
1123
1124 - `"not_enabled"`
1125
1126 This endpoint does not return comments for the organization, so every `comment` is null.
1127
1128 - `"not_permitted"`
1129
1130 The API key holds neither `read:compliance_user_data` nor `read:org_audit`, so every `comment` and every `attested_by` is null.
1131
1132 - `"requires_organization_key"`
1133
1134 The API key was not created in the organization, for example because it was created for the parent organization, so no comment is read and every `comment` is null. `attested_by` is returned as it is to a key created in the organization. This value does not say whether this endpoint returns comments for the organization. Retrying does not help: only a key created in the organization can read its comments.
1135
1136 - `"unavailable"`
1137
1138 Comments could not be read for this response. A later request may succeed, but some causes persist, for example when the organization's customer-managed encryption key cannot be used.
1139
1140- `controls: array of object`
1141
1142 The organization's controls, never empty. A control can have no entry, for example when it is about a feature that the organization cannot have, so a missing control is not a pass.
1143
1144 - `id: string`
1145
1146 The control's identifier, which is the same for every organization and never changes.
1147
1148 - `attestation: object or null`
1149
1150 The attestation of this control. It is still returned after it stops being in effect; see its `state`. Null when nobody has attested, when attestations of this kind are not enabled for the organization, and while the status is `descriptive`, `not_applicable` or `not_evaluated`. It is also null when the attestation stored for the control is of a kind that this endpoint does not return, so null does not prove that nobody has attested.
1151
1152 - `attested_at: string`
1153
1154 When the attestation was made.
1155
1156 format: date-time
1157
1158 - `attested_by: object or null`
1159
1160 Who made the attestation. Null when the response's `comments_status` is `not_permitted`, when showing who attested is not enabled for the organization, when the person's account has been deleted, or while Anthropic holds back who attested for every organization.
1161
1162 - `type: "user_actor"`
1163
1164 Always `user_actor`.
1165
1166 - `user_id: string`
1167
1168 User identifier (tagged ID, prefixed `user_`).
1169
1170 - `comment: string or null`
1171
1172 The comment saved with the attestation, of at most 2,000 characters. It is the text of the last save, which can keep words that an earlier administrator wrote. Null if there is none, or if the response's `comments_status` is not `available`.
1173
1174 - `state: "check_passing" or "in_force" or "review_due" or "setting_changed" or null`
1175
1176 Whether the attestation is still in effect. Null only on a manual control, and only when end dates do not apply to the organization; the attestation is then in effect. More values can be added; read an unknown one as not in effect.
1177
1178 - `"check_passing"`
1179
1180 Not in effect: the automatic check passes.
1181
1182 - `"in_force"`
1183
1184 The attestation is in effect.
1185
1186 - `"review_due"`
1187
1188 Not in effect: the attestation's end date, also called its review date, has come, so it is due for review.
1189
1190 - `"setting_changed"`
1191
1192 Not in effect: the automatic check fails, either on a different value from the one whose risk was accepted, or after the accepted risk was recorded as ended.
1193
1194 - `current_value: string or null`
1195
1196 The value read for the control, as display text whose wording can change. It is in English, apart from values taken from the organization's settings, such as its allowed email domains. A list names only the entries that this endpoint recognizes, followed by the number of other entries, if any. Null on a manual control, while the status is `not_evaluated`, and while the status is `not_applicable` because the control applies only when another setting has a certain value.
1197
1198 - `desired_state: string or null`
1199
1200 The recommended value, as display text whose wording can change. It is in English, apart from values such as the organization's ID. Null when there is none for this organization.
1201
1202 - `display_name: string`
1203
1204 The control's display name, in English.
1205
1206 - `rating: "descriptive" or "failed" or "not_attested" or "passed"`
1207
1208 The control's overall result, which follows from `status`. More values can be added; read an unknown one as not passed.
1209
1210 - `"descriptive"`
1211
1212 Descriptive: not rated, which includes controls that do not apply or could not be read.
1213
1214 - `"failed"`
1215
1216 Failed. Because of an attestation that this endpoint does not return, a control can have this rating while the Security posture page shows it as Passed.
1217
1218 - `"not_attested"`
1219
1220 Not attested: a manual control with no attestation in effect.
1221
1222 - `"passed"`
1223
1224 Passed. This includes a control with an accepted risk in effect, whether automatic or manual.
1225
1226 - `section: "capabilities" or "chats_desktop_mdm" or "claude_code_admin_console" or 7 more`
1227
1228 The section that this control belongs to. More values can be added; treat an unknown one as a section of its own.
1229
1230 - `"capabilities"`
1231
1232 Capabilities
1233
1234 - `"chats_desktop_mdm"`
1235
1236 Chats: desktop device management
1237
1238 - `"claude_code_admin_console"`
1239
1240 Claude Code: admin console
1241
1242 - `"claude_code_managed_settings"`
1243
1244 Claude Code: managed settings
1245
1246 - `"connectors_integrations"`
1247
1248 Connectors and integrations
1249
1250 - `"cowork_admin_console"`
1251
1252 Cowork: admin console
1253
1254 - `"cowork_desktop_mdm"`
1255
1256 Cowork: desktop device management
1257
1258 - `"data_privacy"`
1259
1260 Data and privacy
1261
1262 - `"healthy_adoption"`
1263
1264 Healthy adoption
1265
1266 - `"identity_access"`
1267
1268 Identity and access
1269
1270 - `setting_name: string or null`
1271
1272 The `name` of the entry in the organization's effective settings that this control reads. Null when it reads no such entry.
1273
1274 - `status: "attestation_not_enabled" or "attested_accepted_risk" or "attested_completed" or 10 more`
1275
1276 Why the control has its rating. A manual control is one that only a person can check. An automatic control reads a value from the organization, usually one of its settings, and some are checked against a recommended value. The recommended values are those of the standard profile, which every organization is rated under. More values can be added; count a control with an unknown one by its `rating`.
1277
1278 - `"attestation_not_enabled"`
1279
1280 A manual control that nobody in the organization can attest to.
1281
1282 - `"attested_accepted_risk"`
1283
1284 A manual control attested as Accepted risk, with the attestation in effect.
1285
1286 - `"attested_completed"`
1287
1288 A manual control attested as Completed, with the attestation in effect.
1289
1290 - `"descriptive"`
1291
1292 The control is reported for information only.
1293
1294 - `"exceeds_baseline"`
1295
1296 The current value is stricter than the recommended value.
1297
1298 - `"failed"`
1299
1300 The current value does not meet the recommended value. An attestation that this endpoint does not return can also give a control this status.
1301
1302 - `"failed_check_accepted_risk"`
1303
1304 The automatic check fails, and an accepted risk is in effect.
1305
1306 - `"matches_profile"`
1307
1308 The current value equals the recommended value.
1309
1310 - `"not_applicable"`
1311
1312 The control does not apply to the organization.
1313
1314 - `"not_attested"`
1315
1316 A manual control that can be attested to, with no attestation in effect.
1317
1318 - `"not_evaluated"`
1319
1320 The setting behind the control, or another setting that decides whether the control applies, could not be read.
1321
1322 - `"passed"`
1323
1324 The current value meets the recommended value.
1325
1326 - `"review"`
1327
1328 The current value is looser than the recommended value.
1329
1330- `evaluated_at: string`
1331
1332 The time at which every control was evaluated.
1333
1334 format: date-time
1335
1336- `organization_id: string`
1337
1338 The organization's UUID.
1339
1340#### Example
1341
1342```bash
1343curl https://api.anthropic.com/v1/compliance/organizations/$ORGANIZATION_ID/security_posture \
1344 -H 'anthropic-version: 2023-06-01' \
1345 -H "Authorization: Bearer $ANTHROPIC_COMPLIANCE_API_KEY"
1346```
1347
1348##### Response (200)
1349
1350```json
1351{
1352 "comments_status": "not_enabled",
1353 "controls": [
1354 {
1355 "id": "sso_enabled",
1356 "attestation": {
1357 "attested_at": "2025-03-12T18:22:41.123456Z",
1358 "attested_by": {
1359 "type": "user_actor",
1360 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
1361 },
1362 "comment": null,
1363 "state": "in_force"
1364 },
1365 "current_value": "On",
1366 "desired_state": "On",
1367 "display_name": "Single sign-on (SSO)",
1368 "rating": "passed",
1369 "section": "identity_access",
1370 "setting_name": "sso_enabled",
1371 "status": "passed"
1372 }
1373 ],
1374 "evaluated_at": "2025-03-12T18:22:41.123456Z",
1375 "organization_id": "a1b2c3d4-e5f6-4789-a012-3456789abcde",
1376 "type": "security_posture"
9991377}
10001378```
10011379
api/compliance/organizations/security_posture New page · 553 lines, new page
# Security Posture ## Get an organization's security posture ### Path parameters ### Headers ### Returns ### Example #### Response (200) ## Domain types ### Security Posture Retrieve Response
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Security Posture
url: https://platform.claude.com/docs/en/api/compliance/organizations/security_posture
---
# Security Posture
## Get an organization's security posture
**GET** `/v1/compliance/organizations/{organization_id}/security_posture`
Get an organization's security controls and their current results.
Returns the organization's security controls, evaluated at the time of the
request, each with its attestation when this endpoint returns one. The controls come
in one `controls` list, which is not paginated. A control can have no entry, for
example when it is about a feature that the organization cannot have, so a missing
control is not a pass.
The `anthropic-version` header is required: a request without it returns 400.
The endpoint takes no query parameters, so there is no filter, and a request with
any query parameter also returns 400. A request also returns 400 when the Compliance
API is not enabled for the API key's parent organization.
The request returns 404 when `organization_id` names no organization, names one
that the API key cannot read, or names one whose security controls are not
available. A request over a rate limit returns 429.
One error has an `error_code` in `error.details`. A 503 with
`posture_evaluation_failed` means that the evaluation could not be completed.
Wait for the time in the `Retry-After` header before trying again. A 504 means
that the evaluation did not finish in time, and the request can be tried again.
### Path parameters
- `organization_id: string`
The organization's UUID
### Headers
- `"anthropic-version": optional string`
The version of the Claude API you want to use.
Read more about versioning and our version history [here](https://platform.claude.com/docs/en/api/versioning?sdk_languages=http).
- `"x-api-key": optional string`
### Returns
- `type: "security_posture"`
Always `security_posture`.
- `comments_status: "available" or "not_enabled" or "not_permitted" or 2 more`
Whether attestation comments were read. More values can be added; read an unknown one as `unavailable`.
- `"available"`
Comments were read, so a null `comment` means that there is none, or that the attestation was saved moments ago.
- `"not_enabled"`
This endpoint does not return comments for the organization, so every `comment` is null.
- `"not_permitted"`
The API key holds neither `read:compliance_user_data` nor `read:org_audit`, so every `comment` and every `attested_by` is null.
- `"requires_organization_key"`
The API key was not created in the organization, for example because it was created for the parent organization, so no comment is read and every `comment` is null. `attested_by` is returned as it is to a key created in the organization. This value does not say whether this endpoint returns comments for the organization. Retrying does not help: only a key created in the organization can read its comments.
- `"unavailable"`
Comments could not be read for this response. A later request may succeed, but some causes persist, for example when the organization's customer-managed encryption key cannot be used.
- `controls: array of object`
The organization's controls, never empty. A control can have no entry, for example when it is about a feature that the organization cannot have, so a missing control is not a pass.
- `id: string`
The control's identifier, which is the same for every organization and never changes.
- `attestation: object or null`
The attestation of this control. It is still returned after it stops being in effect; see its `state`. Null when nobody has attested, when attestations of this kind are not enabled for the organization, and while the status is `descriptive`, `not_applicable` or `not_evaluated`. It is also null when the attestation stored for the control is of a kind that this endpoint does not return, so null does not prove that nobody has attested.
- `attested_at: string`
When the attestation was made.
format: date-time
- `attested_by: object or null`
Who made the attestation. Null when the response's `comments_status` is `not_permitted`, when showing who attested is not enabled for the organization, when the person's account has been deleted, or while Anthropic holds back who attested for every organization.
- `type: "user_actor"`
Always `user_actor`.
- `user_id: string`
User identifier (tagged ID, prefixed `user_`).
- `comment: string or null`
The comment saved with the attestation, of at most 2,000 characters. It is the text of the last save, which can keep words that an earlier administrator wrote. Null if there is none, or if the response's `comments_status` is not `available`.
- `state: "check_passing" or "in_force" or "review_due" or "setting_changed" or null`
Whether the attestation is still in effect. Null only on a manual control, and only when end dates do not apply to the organization; the attestation is then in effect. More values can be added; read an unknown one as not in effect.
- `"check_passing"`
Not in effect: the automatic check passes.
- `"in_force"`
The attestation is in effect.
- `"review_due"`
Not in effect: the attestation's end date, also called its review date, has come, so it is due for review.
- `"setting_changed"`
Not in effect: the automatic check fails, either on a different value from the one whose risk was accepted, or after the accepted risk was recorded as ended.
- `current_value: string or null`
The value read for the control, as display text whose wording can change. It is in English, apart from values taken from the organization's settings, such as its allowed email domains. A list names only the entries that this endpoint recognizes, followed by the number of other entries, if any. Null on a manual control, while the status is `not_evaluated`, and while the status is `not_applicable` because the control applies only when another setting has a certain value.
- `desired_state: string or null`
The recommended value, as display text whose wording can change. It is in English, apart from values such as the organization's ID. Null when there is none for this organization.
- `display_name: string`
The control's display name, in English.
- `rating: "descriptive" or "failed" or "not_attested" or "passed"`
The control's overall result, which follows from `status`. More values can be added; read an unknown one as not passed.
- `"descriptive"`
Descriptive: not rated, which includes controls that do not apply or could not be read.
- `"failed"`
Failed. Because of an attestation that this endpoint does not return, a control can have this rating while the Security posture page shows it as Passed.
- `"not_attested"`
Not attested: a manual control with no attestation in effect.
- `"passed"`
Passed. This includes a control with an accepted risk in effect, whether automatic or manual.
- `section: "capabilities" or "chats_desktop_mdm" or "claude_code_admin_console" or 7 more`
The section that this control belongs to. More values can be added; treat an unknown one as a section of its own.
- `"capabilities"`
Capabilities
- `"chats_desktop_mdm"`
Chats: desktop device management
- `"claude_code_admin_console"`
Claude Code: admin console
- `"claude_code_managed_settings"`
Claude Code: managed settings
- `"connectors_integrations"`
Connectors and integrations
- `"cowork_admin_console"`
Cowork: admin console
- `"cowork_desktop_mdm"`
Cowork: desktop device management
- `"data_privacy"`
Data and privacy
- `"healthy_adoption"`
Healthy adoption
- `"identity_access"`
Identity and access
- `setting_name: string or null`
The `name` of the entry in the organization's effective settings that this control reads. Null when it reads no such entry.
- `status: "attestation_not_enabled" or "attested_accepted_risk" or "attested_completed" or 10 more`
Why the control has its rating. A manual control is one that only a person can check. An automatic control reads a value from the organization, usually one of its settings, and some are checked against a recommended value. The recommended values are those of the standard profile, which every organization is rated under. More values can be added; count a control with an unknown one by its `rating`.
- `"attestation_not_enabled"`
A manual control that nobody in the organization can attest to.
- `"attested_accepted_risk"`
A manual control attested as Accepted risk, with the attestation in effect.
- `"attested_completed"`
A manual control attested as Completed, with the attestation in effect.
- `"descriptive"`
The control is reported for information only.
- `"exceeds_baseline"`
The current value is stricter than the recommended value.
- `"failed"`
The current value does not meet the recommended value. An attestation that this endpoint does not return can also give a control this status.
- `"failed_check_accepted_risk"`
The automatic check fails, and an accepted risk is in effect.
- `"matches_profile"`
The current value equals the recommended value.
- `"not_applicable"`
The control does not apply to the organization.
- `"not_attested"`
A manual control that can be attested to, with no attestation in effect.
- `"not_evaluated"`
The setting behind the control, or another setting that decides whether the control applies, could not be read.
- `"passed"`
The current value meets the recommended value.
- `"review"`
The current value is looser than the recommended value.
- `evaluated_at: string`
The time at which every control was evaluated.
format: date-time
- `organization_id: string`
The organization's UUID.
### Example
```bash
curl https://api.anthropic.com/v1/compliance/organizations/$ORGANIZATION_ID/security_posture \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_COMPLIANCE_API_KEY"
```
#### Response (200)
```json
{
"comments_status": "not_enabled",
"controls": [
{
"id": "sso_enabled",
"attestation": {
"attested_at": "2025-03-12T18:22:41.123456Z",
"attested_by": {
"type": "user_actor",
"user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
},
Cut at 300 lines. The page has the rest.
api/compliance/organizations/security_posture/retrieve New page · 315 lines, new page
# Get an organization's security posture ## Path parameters ## Headers ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Get an organization's security posture
url: https://platform.claude.com/docs/en/api/compliance/organizations/security_posture/retrieve
---
# Get an organization's security posture
**GET** `/v1/compliance/organizations/{organization_id}/security_posture`
Get an organization's security controls and their current results.
Returns the organization's security controls, evaluated at the time of the
request, each with its attestation when this endpoint returns one. The controls come
in one `controls` list, which is not paginated. A control can have no entry, for
example when it is about a feature that the organization cannot have, so a missing
control is not a pass.
The `anthropic-version` header is required: a request without it returns 400.
The endpoint takes no query parameters, so there is no filter, and a request with
any query parameter also returns 400. A request also returns 400 when the Compliance
API is not enabled for the API key's parent organization.
The request returns 404 when `organization_id` names no organization, names one
that the API key cannot read, or names one whose security controls are not
available. A request over a rate limit returns 429.
One error has an `error_code` in `error.details`. A 503 with
`posture_evaluation_failed` means that the evaluation could not be completed.
Wait for the time in the `Retry-After` header before trying again. A 504 means
that the evaluation did not finish in time, and the request can be tried again.
## Path parameters
- `organization_id: string`
The organization's UUID
## Headers
- `"anthropic-version": optional string`
The version of the Claude API you want to use.
Read more about versioning and our version history [here](https://platform.claude.com/docs/en/api/versioning?sdk_languages=http).
- `"x-api-key": optional string`
## Returns
- `type: "security_posture"`
Always `security_posture`.
- `comments_status: "available" or "not_enabled" or "not_permitted" or 2 more`
Whether attestation comments were read. More values can be added; read an unknown one as `unavailable`.
- `"available"`
Comments were read, so a null `comment` means that there is none, or that the attestation was saved moments ago.
- `"not_enabled"`
This endpoint does not return comments for the organization, so every `comment` is null.
- `"not_permitted"`
The API key holds neither `read:compliance_user_data` nor `read:org_audit`, so every `comment` and every `attested_by` is null.
- `"requires_organization_key"`
The API key was not created in the organization, for example because it was created for the parent organization, so no comment is read and every `comment` is null. `attested_by` is returned as it is to a key created in the organization. This value does not say whether this endpoint returns comments for the organization. Retrying does not help: only a key created in the organization can read its comments.
- `"unavailable"`
Comments could not be read for this response. A later request may succeed, but some causes persist, for example when the organization's customer-managed encryption key cannot be used.
- `controls: array of object`
The organization's controls, never empty. A control can have no entry, for example when it is about a feature that the organization cannot have, so a missing control is not a pass.
- `id: string`
The control's identifier, which is the same for every organization and never changes.
- `attestation: object or null`
The attestation of this control. It is still returned after it stops being in effect; see its `state`. Null when nobody has attested, when attestations of this kind are not enabled for the organization, and while the status is `descriptive`, `not_applicable` or `not_evaluated`. It is also null when the attestation stored for the control is of a kind that this endpoint does not return, so null does not prove that nobody has attested.
- `attested_at: string`
When the attestation was made.
format: date-time
- `attested_by: object or null`
Who made the attestation. Null when the response's `comments_status` is `not_permitted`, when showing who attested is not enabled for the organization, when the person's account has been deleted, or while Anthropic holds back who attested for every organization.
- `type: "user_actor"`
Always `user_actor`.
- `user_id: string`
User identifier (tagged ID, prefixed `user_`).
- `comment: string or null`
The comment saved with the attestation, of at most 2,000 characters. It is the text of the last save, which can keep words that an earlier administrator wrote. Null if there is none, or if the response's `comments_status` is not `available`.
- `state: "check_passing" or "in_force" or "review_due" or "setting_changed" or null`
Whether the attestation is still in effect. Null only on a manual control, and only when end dates do not apply to the organization; the attestation is then in effect. More values can be added; read an unknown one as not in effect.
- `"check_passing"`
Not in effect: the automatic check passes.
- `"in_force"`
The attestation is in effect.
- `"review_due"`
Not in effect: the attestation's end date, also called its review date, has come, so it is due for review.
- `"setting_changed"`
Not in effect: the automatic check fails, either on a different value from the one whose risk was accepted, or after the accepted risk was recorded as ended.
- `current_value: string or null`
The value read for the control, as display text whose wording can change. It is in English, apart from values taken from the organization's settings, such as its allowed email domains. A list names only the entries that this endpoint recognizes, followed by the number of other entries, if any. Null on a manual control, while the status is `not_evaluated`, and while the status is `not_applicable` because the control applies only when another setting has a certain value.
- `desired_state: string or null`
The recommended value, as display text whose wording can change. It is in English, apart from values such as the organization's ID. Null when there is none for this organization.
- `display_name: string`
The control's display name, in English.
- `rating: "descriptive" or "failed" or "not_attested" or "passed"`
The control's overall result, which follows from `status`. More values can be added; read an unknown one as not passed.
- `"descriptive"`
Descriptive: not rated, which includes controls that do not apply or could not be read.
- `"failed"`
Failed. Because of an attestation that this endpoint does not return, a control can have this rating while the Security posture page shows it as Passed.
- `"not_attested"`
Not attested: a manual control with no attestation in effect.
- `"passed"`
Passed. This includes a control with an accepted risk in effect, whether automatic or manual.
- `section: "capabilities" or "chats_desktop_mdm" or "claude_code_admin_console" or 7 more`
The section that this control belongs to. More values can be added; treat an unknown one as a section of its own.
- `"capabilities"`
Capabilities
- `"chats_desktop_mdm"`
Chats: desktop device management
- `"claude_code_admin_console"`
Claude Code: admin console
- `"claude_code_managed_settings"`
Claude Code: managed settings
- `"connectors_integrations"`
Connectors and integrations
- `"cowork_admin_console"`
Cowork: admin console
- `"cowork_desktop_mdm"`
Cowork: desktop device management
- `"data_privacy"`
Data and privacy
- `"healthy_adoption"`
Healthy adoption
- `"identity_access"`
Identity and access
- `setting_name: string or null`
The `name` of the entry in the organization's effective settings that this control reads. Null when it reads no such entry.
- `status: "attestation_not_enabled" or "attested_accepted_risk" or "attested_completed" or 10 more`
Why the control has its rating. A manual control is one that only a person can check. An automatic control reads a value from the organization, usually one of its settings, and some are checked against a recommended value. The recommended values are those of the standard profile, which every organization is rated under. More values can be added; count a control with an unknown one by its `rating`.
- `"attestation_not_enabled"`
A manual control that nobody in the organization can attest to.
- `"attested_accepted_risk"`
A manual control attested as Accepted risk, with the attestation in effect.
- `"attested_completed"`
A manual control attested as Completed, with the attestation in effect.
- `"descriptive"`
The control is reported for information only.
- `"exceeds_baseline"`
The current value is stricter than the recommended value.
- `"failed"`
The current value does not meet the recommended value. An attestation that this endpoint does not return can also give a control this status.
- `"failed_check_accepted_risk"`
The automatic check fails, and an accepted risk is in effect.
- `"matches_profile"`
The current value equals the recommended value.
- `"not_applicable"`
The control does not apply to the organization.
- `"not_attested"`
A manual control that can be attested to, with no attestation in effect.
- `"not_evaluated"`
The setting behind the control, or another setting that decides whether the control applies, could not be read.
- `"passed"`
The current value meets the recommended value.
- `"review"`
The current value is looser than the recommended value.
- `evaluated_at: string`
The time at which every control was evaluated.
format: date-time
- `organization_id: string`
The organization's UUID.
## Example
```bash
curl https://api.anthropic.com/v1/compliance/organizations/$ORGANIZATION_ID/security_posture \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_COMPLIANCE_API_KEY"
```
### Response (200)
```json
{
"comments_status": "not_enabled",
"controls": [
{
"id": "sso_enabled",
"attestation": {
"attested_at": "2025-03-12T18:22:41.123456Z",
"attested_by": {
"type": "user_actor",
"user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
},
"comment": null,
"state": "in_force"
Cut at 300 lines. The page has the rest.