Query compliance activities changedapi/compliance/activities/list
Nearest release: v2.1.304, published 6 hours before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+2,171added
Lines−3removed
From line
15
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits30to this page, all time
The whole hunk
from line 15, old and new numbered
/
This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.
from line 15
1515
1616## Query parameters
1717
18- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 525 more`
18- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 533 more`
1919
2020 Filter activities by type. See the response `data` schema for the additional fields each type returns. Cannot be combined with `exclude_activity_types[]`.
2121
from line 571
571571
572572 A security scan of a plugin completed and produced a verdict.
573573
574 - `"claude_plugin_served_version_updated"`
575
576 A plugin's served version was updated: an administrator or the owner chose a version, a saved version became the served version, or an accepted library submission was published into the plugin.
577
574578 - `"claude_plugin_updated"`
575579
576580 Plugin was updated.
577581
582 - `"claude_plugin_version_created"`
583
584 A new version of a plugin was created.
585
578586 - `"claude_project_archived"`
579587
580588 A Claude project was archived.
from line 1287
12791287
12801288 An owner of the organization accepted the terms for using artifacts with the HIPAA configuration enabled.
12811289
1290 - `"org_hipaa_claude_code_cowork_restrictions_deferred"`
1291
1292 The HIPAA configuration for Claude Code (local mode) and Cowork (local mode) was left off for the organization when the configuration launched, and stays off until it is applied.
1293
1294 - `"org_hipaa_claude_code_cowork_restrictions_enabled"`
1295
1296 The HIPAA configuration was applied to Claude Code (local mode) and Cowork (local mode) for the organization.
1297
12821298 - `"org_hipaa_self_serve_enabled"`
12831299
12841300 A primary owner accepted the Business Associate Agreement and enabled the HIPAA configuration for the organization through the self-serve flow.
from line 1355
13391355
13401356 Admin bulk-dismissed join requests.
13411357
1358 - `"org_library_submission_created"`
1359
1360 A member submitted one of their own skills or plugins for publication into the organization library.
1361
1362 - `"org_library_submission_resolved"`
1363
1364 A member's submission of a skill or plugin to the organization library was accepted or denied, or an accepted one finished publishing.
1365
1366 - `"org_library_submission_withdrawn"`
1367
1368 A pending submission to the organization library was withdrawn before any reviewer decided on it.
1369
13421370 - `"org_magic_link_second_factor_toggled"`
13431371
13441372 Organization magic link second factor was toggled.
13451373
1374 - `"org_member_avatar_removed"`
1375
1376 An administrator removed another member's profile picture.
1377
13461378 - `"org_member_invites_disabled"`
13471379
13481380 Admin disabled member invites for the organization.
from line 2218
21862218
21872219 format: date-time
21882220
2189- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 525 more`
2221- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 533 more`
21902222
21912223 Exclude activities of these types. Cannot be combined with `activity_types[]`.
21922224
from line 2774
27422774
27432775 A security scan of a plugin completed and produced a verdict.
27442776
2777 - `"claude_plugin_served_version_updated"`
2778
2779 A plugin's served version was updated: an administrator or the owner chose a version, a saved version became the served version, or an accepted library submission was published into the plugin.
2780
27452781 - `"claude_plugin_updated"`
27462782
27472783 Plugin was updated.
27482784
2785 - `"claude_plugin_version_created"`
2786
2787 A new version of a plugin was created.
2788
27492789 - `"claude_project_archived"`
27502790
27512791 A Claude project was archived.
from line 3490
34503490
34513491 An owner of the organization accepted the terms for using artifacts with the HIPAA configuration enabled.
34523492
3493 - `"org_hipaa_claude_code_cowork_restrictions_deferred"`
3494
3495 The HIPAA configuration for Claude Code (local mode) and Cowork (local mode) was left off for the organization when the configuration launched, and stays off until it is applied.
3496
3497 - `"org_hipaa_claude_code_cowork_restrictions_enabled"`
3498
3499 The HIPAA configuration was applied to Claude Code (local mode) and Cowork (local mode) for the organization.
3500
34533501 - `"org_hipaa_self_serve_enabled"`
34543502
34553503 A primary owner accepted the Business Associate Agreement and enabled the HIPAA configuration for the organization through the self-serve flow.
from line 3558
35103558
35113559 Admin bulk-dismissed join requests.
35123560
3561 - `"org_library_submission_created"`
3562
3563 A member submitted one of their own skills or plugins for publication into the organization library.
3564
3565 - `"org_library_submission_resolved"`
3566
3567 A member's submission of a skill or plugin to the organization library was accepted or denied, or an accepted one finished publishing.
3568
3569 - `"org_library_submission_withdrawn"`
3570
3571 A pending submission to the organization library was withdrawn before any reviewer decided on it.
3572
35133573 - `"org_magic_link_second_factor_toggled"`
35143574
35153575 Organization magic link second factor was toggled.
35163576
3577 - `"org_member_avatar_removed"`
3578
3579 An administrator removed another member's profile picture.
3580
35173581 - `"org_member_invites_disabled"`
35183582
35193583 Admin disabled member invites for the organization.
from line 4419
43554419
43564420## Returns
43574421
4358- `data: optional array of AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 525 more`
4422- `data: optional array of AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 533 more`
43594423
43604424 List of activity records. Each element's `type` field identifies which activity it is and which additional fields are present.
43614425
from line 9087
90239087
90249088 The read-axis sharing mode before the change: `owner`, `users`, `org`, or `public` (anyone on the internet).
90259089
9090 - `previous_read_agent_ids: optional array of string`
9091
9092 The Claude agents (`cagt_…` identifiers) whose channel held view access to the artifact before the change. Empty when none.
9093
9094 - `previous_read_group_ids: optional array of string`
9095
9096 The admin-managed groups (`rbac_group_…` identifiers) whose members held view access to the artifact before the change. Edit access implies view access, so every `previous_write_group_ids` entry also appears here. Empty when none.
9097
90269098 - `previous_user_count: optional number or null`
90279099
90289100 The number of accounts on the explicit read allowlist before the change. Only meaningful when `previous_mode` is `users`.
90299101
9102 - `previous_write_agent_ids: optional array of string`
9103
9104 The Claude agents (`cagt_…` identifiers) whose channel held edit access to the artifact before the change. Empty when none.
9105
9106 - `previous_write_group_ids: optional array of string`
9107
9108 The admin-managed groups (`rbac_group_…` identifiers) whose members held edit access to the artifact before the change. Empty when none.
9109
90309110 - `previous_write_mode: optional string or null`
90319111
90329112 The write-axis sharing mode before the change: `owner`, `users`, or `org`.
from line 9115
90359115
90369116 The number of accounts on the explicit write allowlist before the change. Only meaningful when `previous_write_mode` is `users`.
90379117
9118 - `read_agent_ids: optional array of string`
9119
9120 The Claude agents (`cagt_…` identifiers) whose channel holds view access to the artifact after the change. Reflects the standing grants, so it is populated on every sharing update for an artifact shared with agents, not only when an agent grant changed. Empty when none.
9121
9122 - `read_group_ids: optional array of string`
9123
9124 The admin-managed groups (`rbac_group_…` identifiers) whose members hold view access to the artifact after the change (including every `write_group_ids` entry). Reflects the standing grants, so it is populated on every sharing update for an artifact shared with groups, not only when a group grant changed. Empty when none.
9125
9126 - `write_agent_ids: optional array of string`
9127
9128 The Claude agents (`cagt_…` identifiers) whose channel holds edit access to the artifact after the change. Reflects the standing grants, so it is populated on every sharing update for an artifact shared with agents, not only when an agent grant changed. Empty when none.
9129
9130 - `write_group_ids: optional array of string`
9131
9132 The admin-managed groups (`rbac_group_…` identifiers) whose members hold edit access to the artifact after the change. Reflects the standing grants, like `read_group_ids`. Empty when none.
9133
90389134 - `ClaudeArtifactViewed object`
90399135
90409136 An artifact was viewed.
from line 9369
92739369
92749370 - `organization_uuid: optional string or null`
92759371
9276 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
9277
9278 - `AuditLogExportAccessed object`
9279
9280 Audit log export file was accessed/downloaded via signed URL.
9281
9282 - `type: optional "audit_log_export_accessed"`
9283
9284 default: audit_log_export_accessed
9285
9286 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
9287
9288 - `APIActor object`
9289
9290 - `type: optional "api_actor"`
9291
9292 default: api_actor
9293
9294 - `api_key_id: string`
9295
9296 - `ip_address: string`
9297
9298 - `user_agent: string`
9299
9300 - `UserActor object`
9301
9302 - `type: optional "user_actor"`
9303
9304 default: user_actor
9305
9306 - `email_address: string`
9307
9308 format: email
9309
9310 - `ip_address: string`
9311
9312 - `user_agent: string`
9313
9314 - `user_id: string`
9315
9316 - `UnauthenticatedUserActor object`
9317
9318 - `type: optional "unauthenticated_user_actor"`
9319
9320 default: unauthenticated_user_actor
9321
9322 - `ip_address: string`
9323
9324 - `user_agent: string`
9325
9326 - `unauthenticated_email_address: optional string or null`
9327
9328 format: email
9329
9330 - `AnthropicActor object`
9331
9332 - `type: optional "anthropic_actor"`
9333
9334 default: anthropic_actor
9335
9336 - `email_address: optional string or null`
9337
9338 format: email
9339
9340 - `SystemActor object`
9341
9342 Automated background processing performed by Anthropic systems, acting
9343 without a user or customer credential.
9344
9345 - `type: optional "system_actor"`
9346
9347 default: system_actor
9348
9349 - `service: optional string or null`
9350
9351 Name of the automated process that performed the action, when known.
9352
9353 - `AdminAPIKeyActor object`
9354
9355 - `type: optional "admin_api_key_actor"`
9356
9357 default: admin_api_key_actor
9358
9359 - `admin_api_key_id: string`
9360
9361 - `ip_address: string`
9362
9363 - `user_agent: string`
9364
9365 - `ServiceAccountActor object`
9366
9367 - `type: optional "service_account_actor"`
9368
9369 default: service_account_actor
9370
9371 - `ip_address: string`
9372
9373 - `service_account_id: string`
9374
9375 - `user_agent: string`
9376
9377 - `ScimDirectorySyncActor object`
9378
9379 - `type: optional "scim_directory_sync_actor"`
9380
9381 default: scim_directory_sync_actor
9382
9383 - `directory_id: string`
9384
9385 - `workos_event_id: string`
9386
9387 - `idp_connection_type: optional string or null`
9388
9389 - `FederatedIdentityActor object`
9390
9391 A federated external workload authenticated via a verified OIDC token.
9392
9393 Carries the verified issuer, subject, and audience claims from the
9394 presented JWT.
9395
9396 - `type: optional "federated_identity_actor"`
9397
9398 default: federated_identity_actor
9399
9400 - `issuer: string`
9401
9402 - `subject: string`
9403
9404 - `audience: optional array of string`
9405
9406 - `ip_address: optional string or null`
9407
9408 - `user_agent: optional string or null`
9409
9410 - `FederatedActor object`
9411
9412 An external identity asserted by a trusted provider — a cloud-provider
9413 gateway or a customer-registered federation issuer — acting without an
9414 Anthropic-provisioned account or service account.
9415
9416 - `type: optional "federated_actor"`
9417
9418 default: federated_actor
9419
9420 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
9421
9422 - `FederatedActorAwsProvider object`
9423
9424 Asserting party: the AWS account the organization is bound to.
9425
9426 - `type: optional "aws"`
9427
9428 default: aws
9429
9430 - `account_id: string`
9431
9432 - `signed_principal: string`
9433
9434 The AWS-signed ARN of the IAM principal that requested the token.
9435
9436 - `FederatedActorAzureProvider object`
9437
9438 Asserting party: the Azure subscription the organization is bound to.
9439
9440 - `type: optional "azure"`
9441
9442 default: azure
9443
9444 - `subscription_id: string`
9445
9446 - `FederatedActorGcpProvider object`
9447
9448 Asserting party: the GCP project the organization is bound to.
9449
9450 - `type: optional "gcp"`
9451
9452 default: gcp
9453
9454 - `project_number: string`
9455
9456 - `FederatedActorOidcProvider object`
9457
9458 Asserting party: a customer-registered OIDC federation issuer.
9459
9460 - `type: optional "oidc"`
9461
9462 default: oidc
9463
9464 - `issuer: optional string or null`
9465
9466 The federation issuer's URL. Null when the presented credential failed verification.
9467
9468 - `ip_address: optional string or null`
9469
9470 - `subject: optional string or null`
9471
9472 The provider's verified identifier for the caller; its form depends on the provider.
9473
9474 - `user_agent: optional string or null`
9475
9476 - `AttestedDeviceActor object`
9477
9478 An attested mobile device a
9372 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or
No line in this hunk matches that.