Activities changedapi/compliance/activities
Nearest release: v2.1.304, published 6 hours before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+4,276added
Lines−4removed
From line
17
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits30to this page, all time
The whole hunk
from line 17, old and new numbered
/
This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.
from line 17
1717
1818### Query parameters
1919
20- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 525 more`
20- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 533 more`
2121
2222 Filter activities by type. See the response `data` schema for the additional fields each type returns. Cannot be combined with `exclude_activity_types[]`.
2323
from line 573
573573
574574 A security scan of a plugin completed and produced a verdict.
575575
576 - `"claude_plugin_served_version_updated"`
577
578 A plugin's served version was updated: an administrator or the owner chose a version, a saved version became the served version, or an accepted library submission was published into the plugin.
579
576580 - `"claude_plugin_updated"`
577581
578582 Plugin was updated.
579583
584 - `"claude_plugin_version_created"`
585
586 A new version of a plugin was created.
587
580588 - `"claude_project_archived"`
581589
582590 A Claude project was archived.
from line 1289
12811289
12821290 An owner of the organization accepted the terms for using artifacts with the HIPAA configuration enabled.
12831291
1292 - `"org_hipaa_claude_code_cowork_restrictions_deferred"`
1293
1294 The HIPAA configuration for Claude Code (local mode) and Cowork (local mode) was left off for the organization when the configuration launched, and stays off until it is applied.
1295
1296 - `"org_hipaa_claude_code_cowork_restrictions_enabled"`
1297
1298 The HIPAA configuration was applied to Claude Code (local mode) and Cowork (local mode) for the organization.
1299
12841300 - `"org_hipaa_self_serve_enabled"`
12851301
12861302 A primary owner accepted the Business Associate Agreement and enabled the HIPAA configuration for the organization through the self-serve flow.
from line 1357
13411357
13421358 Admin bulk-dismissed join requests.
13431359
1360 - `"org_library_submission_created"`
1361
1362 A member submitted one of their own skills or plugins for publication into the organization library.
1363
1364 - `"org_library_submission_resolved"`
1365
1366 A member's submission of a skill or plugin to the organization library was accepted or denied, or an accepted one finished publishing.
1367
1368 - `"org_library_submission_withdrawn"`
1369
1370 A pending submission to the organization library was withdrawn before any reviewer decided on it.
1371
13441372 - `"org_magic_link_second_factor_toggled"`
13451373
13461374 Organization magic link second factor was toggled.
13471375
1376 - `"org_member_avatar_removed"`
1377
1378 An administrator removed another member's profile picture.
1379
13481380 - `"org_member_invites_disabled"`
13491381
13501382 Admin disabled member invites for the organization.
from line 2220
21882220
21892221 format: date-time
21902222
2191- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 525 more`
2223- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 533 more`
21922224
21932225 Exclude activities of these types. Cannot be combined with `activity_types[]`.
21942226
from line 2776
27442776
27452777 A security scan of a plugin completed and produced a verdict.
27462778
2779 - `"claude_plugin_served_version_updated"`
2780
2781 A plugin's served version was updated: an administrator or the owner chose a version, a saved version became the served version, or an accepted library submission was published into the plugin.
2782
27472783 - `"claude_plugin_updated"`
27482784
27492785 Plugin was updated.
27502786
2787 - `"claude_plugin_version_created"`
2788
2789 A new version of a plugin was created.
2790
27512791 - `"claude_project_archived"`
27522792
27532793 A Claude project was archived.
from line 3492
34523492
34533493 An owner of the organization accepted the terms for using artifacts with the HIPAA configuration enabled.
34543494
3495 - `"org_hipaa_claude_code_cowork_restrictions_deferred"`
3496
3497 The HIPAA configuration for Claude Code (local mode) and Cowork (local mode) was left off for the organization when the configuration launched, and stays off until it is applied.
3498
3499 - `"org_hipaa_claude_code_cowork_restrictions_enabled"`
3500
3501 The HIPAA configuration was applied to Claude Code (local mode) and Cowork (local mode) for the organization.
3502
34553503 - `"org_hipaa_self_serve_enabled"`
34563504
34573505 A primary owner accepted the Business Associate Agreement and enabled the HIPAA configuration for the organization through the self-serve flow.
from line 3560
35123560
35133561 Admin bulk-dismissed join requests.
35143562
3563 - `"org_library_submission_created"`
3564
3565 A member submitted one of their own skills or plugins for publication into the organization library.
3566
3567 - `"org_library_submission_resolved"`
3568
3569 A member's submission of a skill or plugin to the organization library was accepted or denied, or an accepted one finished publishing.
3570
3571 - `"org_library_submission_withdrawn"`
3572
3573 A pending submission to the organization library was withdrawn before any reviewer decided on it.
3574
35153575 - `"org_magic_link_second_factor_toggled"`
35163576
35173577 Organization magic link second factor was toggled.
35183578
3579 - `"org_member_avatar_removed"`
3580
3581 An administrator removed another member's profile picture.
3582
35193583 - `"org_member_invites_disabled"`
35203584
35213585 Admin disabled member invites for the organization.
from line 4421
43574421
43584422### Returns
43594423
4360- `data: optional array of AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 525 more`
4424- `data: optional array of AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 533 more`
43614425
43624426 List of activity records. Each element's `type` field identifies which activity it is and which additional fields are present.
43634427
from line 9089
90259089
90269090 The read-axis sharing mode before the change: `owner`, `users`, `org`, or `public` (anyone on the internet).
90279091
9092 - `previous_read_agent_ids: optional array of string`
9093
9094 The Claude agents (`cagt_…` identifiers) whose channel held view access to the artifact before the change. Empty when none.
9095
9096 - `previous_read_group_ids: optional array of string`
9097
9098 The admin-managed groups (`rbac_group_…` identifiers) whose members held view access to the artifact before the change. Edit access implies view access, so every `previous_write_group_ids` entry also appears here. Empty when none.
9099
90289100 - `previous_user_count: optional number or null`
90299101
90309102 The number of accounts on the explicit read allowlist before the change. Only meaningful when `previous_mode` is `users`.
90319103
9104 - `previous_write_agent_ids: optional array of string`
9105
9106 The Claude agents (`cagt_…` identifiers) whose channel held edit access to the artifact before the change. Empty when none.
9107
9108 - `previous_write_group_ids: optional array of string`
9109
9110 The admin-managed groups (`rbac_group_…` identifiers) whose members held edit access to the artifact before the change. Empty when none.
9111
90329112 - `previous_write_mode: optional string or null`
90339113
90349114 The write-axis sharing mode before the change: `owner`, `users`, or `org`.
from line 9117
90379117
90389118 The number of accounts on the explicit write allowlist before the change. Only meaningful when `previous_write_mode` is `users`.
90399119
9120 - `read_agent_ids: optional array of string`
9121
9122 The Claude agents (`cagt_…` identifiers) whose channel holds view access to the artifact after the change. Reflects the standing grants, so it is populated on every sharing update for an artifact shared with agents, not only when an agent grant changed. Empty when none.
9123
9124 - `read_group_ids: optional array of string`
9125
9126 The admin-managed groups (`rbac_group_…` identifiers) whose members hold view access to the artifact after the change (including every `write_group_ids` entry). Reflects the standing grants, so it is populated on every sharing update for an artifact shared with groups, not only when a group grant changed. Empty when none.
9127
9128 - `write_agent_ids: optional array of string`
9129
9130 The Claude agents (`cagt_…` identifiers) whose channel holds edit access to the artifact after the change. Reflects the standing grants, so it is populated on every sharing update for an artifact shared with agents, not only when an agent grant changed. Empty when none.
9131
9132 - `write_group_ids: optional array of string`
9133
9134 The admin-managed groups (`rbac_group_…` identifiers) whose members hold edit access to the artifact after the change. Reflects the standing grants, like `read_group_ids`. Empty when none.
9135
90409136 - `ClaudeArtifactViewed object`
90419137
90429138 An artifact was viewed.
from line 9371
92759371
92769372 - `organization_uuid: optional string or null`
92779373
9278 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
9279
9280 - `AuditLogExportAccessed object`
9281
9282 Audit log export file was accessed/downloaded via signed URL.
9283
9284 - `type: optional "audit_log_export_accessed"`
9285
9286 default: audit_log_export_accessed
9287
9288 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
9289
9290 - `APIActor object`
9291
9292 - `type: optional "api_actor"`
9293
9294 default: api_actor
9295
9296 - `api_key_id: string`
9297
9298 - `ip_address: string`
9299
9300 - `user_agent: string`
9301
9302 - `UserActor object`
9303
9304 - `type: optional "user_actor"`
9305
9306 default: user_actor
9307
9308 - `email_address: string`
9309
9310 format: email
9311
9312 - `ip_address: string`
9313
9314 - `user_agent: string`
9315
9316 - `user_id: string`
9317
9318 - `UnauthenticatedUserActor object`
9319
9320 - `type: optional "unauthenticated_user_actor"`
9321
9322 default: unauthenticated_user_actor
9323
9324 - `ip_address: string`
9325
9326 - `user_agent: string`
9327
9328 - `unauthenticated_email_address: optional string or null`
9329
9330 format: email
9331
9332 - `AnthropicActor object`
9333
9334 - `type: optional "anthropic_actor"`
9335
9336 default: anthropic_actor
9337
9338 - `email_address: optional string or null`
9339
9340 format: email
9341
9342 - `SystemActor object`
9343
9344 Automated background processing performed by Anthropic systems, acting
9345 without a user or customer credential.
9346
9347 - `type: optional "system_actor"`
9348
9349 default: system_actor
9350
9351 - `service: optional string or null`
9352
9353 Name of the automated process that performed the action, when known.
9354
9355 - `AdminAPIKeyActor object`
9356
9357 - `type: optional "admin_api_key_actor"`
9358
9359 default: admin_api_key_actor
9360
9361 - `admin_api_key_id: string`
9362
9363 - `ip_address: string`
9364
9365 - `user_agent: string`
9366
9367 - `ServiceAccountActor object`
9368
9369 - `type: optional "service_account_actor"`
9370
9371 default: service_account_actor
9372
9373 - `ip_address: string`
9374
9375 - `service_account_id: string`
9376
9377 - `user_agent: string`
9378
9379 - `ScimDirectorySyncActor object`
9380
9381 - `type: optional "scim_directory_sync_actor"`
9382
9383 default: scim_directory_sync_actor
9384
9385 - `directory_id: string`
9386
9387 - `workos_event_id: string`
9388
9389 - `idp_connection_type: optional string or null`
9390
9391 - `FederatedIdentityActor object`
9392
9393 A federated external workload authenticated via a verified OIDC token.
9394
9395 Carries the verified issuer, subject, and audience claims from the
9396 presented JWT.
9397
9398 - `type: optional "federated_identity_actor"`
9399
9400 default: federated_identity_actor
9401
9402 - `issuer: string`
9403
9404 - `subject: string`
9405
9406 - `audience: optional array of string`
9407
9408 - `ip_address: optional string or null`
9409
9410 - `user_agent: optional string or null`
9411
9412 - `FederatedActor object`
9413
9414 An external identity asserted by a trusted provider — a cloud-provider
9415 gateway or a customer-registered federation issuer — acting without an
9416 Anthropic-provisioned account or service account.
9417
9418 - `type: optional "federated_actor"`
9419
9420 default: federated_actor
9421
9422 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
9423
9424 - `FederatedActorAwsProvider object`
9425
9426 Asserting party: the AWS account the organization is bound to.
9427
9428 - `type: optional "aws"`
9429
9430 default: aws
9431
9432 - `account_id: string`
9433
9434 - `signed_principal: string`
9435
9436 The AWS-signed ARN of the IAM principal that requested the token.
9437
9438 - `FederatedActorAzureProvider object`
9439
9440 Asserting party: the Azure subscription the organization is bound to.
9441
9442 - `type: optional "azure"`
9443
9444 default: azure
9445
9446 - `subscription_id: string`
9447
9448 - `FederatedActorGcpProvider object`
9449
9450 Asserting party: the GCP project the organization is bound to.
9451
9452 - `type: optional "gcp"`
9453
9454 default: gcp
9455
9456 - `project_number: string`
9457
9458 - `FederatedActorOidcProvider object`
9459
9460 Asserting party: a customer-registered OIDC federation issuer.
9461
9462 - `type: optional "oidc"`
9463
9464 default: oidc
9465
9466 - `issuer: optional string or null`
9467
9468 The federation issuer's URL. Null when the presented credential failed verification.
9469
9470 - `ip_address: optional string or null`
9471
9472 - `subject: optional string or null`
9473
9474 The provider's verified identifier for the caller; its form depends on the provider.
9475
9476 - `user_agent: optional string or null`
9477
9478 - `AttestedDeviceActor object`
9479
9480 An attested mobile device authe
9374 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or call
No line in this hunk matches that.