Activities changedapi/compliance/activities
Nearest release: v2.1.306, published 2 hours after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+5,528added
Lines−4removed
From line
17
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits30to this page, all time
The whole hunk
from line 17, old and new numbered
/
This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.
from line 17
1717
1818### Query parameters
1919
20- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 533 more`
20- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 544 more`
2121
2222 Filter activities by type. See the response `data` schema for the additional fields each type returns. Cannot be combined with `exclude_activity_types[]`.
2323
from line 537
537537
538538 A GitHub integration's configuration was updated.
539539
540 - `"claude_insights_attribution_setting_updated"`
541
542 An organization admin set the organization's setting that allows Smart Reports to be opened in the rendering that attributes findings to individual, identified members (off: no member can open that rendering). Every write is recorded, so the two values are equal when the setting was written with the value it already had.
543
544 - `"claude_insights_report_archived"`
545
546 A Smart Report was archived, hiding it from the organization's default report list, by an organization admin or by the delegate who ran it (a member the organization allowed to run reports on a limited scope).
547
548 - `"claude_insights_report_attribution_viewed"`
549
550 A Smart Report was viewed or downloaded with its usage findings attributed to individual, identified members of the organization (rather than in the default rendering, which identifies no member), one session it lists was inspected from that attributed rendering, or an organization admin was shown which members one of its recommendations suggests.
551
552 - `"claude_insights_report_deleted"`
553
554 An archived Smart Report was permanently deleted, by an organization admin or by the delegate who ran it (a member the organization allowed to run reports on a limited scope): its document was removed; purge_confirmed says whether it was also removed from the organization's report list.
555
556 - `"claude_insights_report_feedback_submitted"`
557
558 Feedback was submitted on a Smart Report by an organization admin, by the delegate who ran it (a member the organization allowed to run reports on a limited scope), or by a member it was shared with. The event records which report was rated, not the ratings themselves or the member's written comment.
559
560 - `"claude_insights_report_renamed"`
561
562 A Smart Report was renamed, by an organization admin or by the delegate who ran it (a member the organization allowed to run reports on a limited scope).
563
564 - `"claude_insights_report_sharing_updated"`
565
566 An organization admin, or the delegate who ran the report (a member the organization allowed to run reports on a limited scope), changed who a Smart Report is shared with: the organization members who may open the report by link, and whether they may open the rendering that attributes findings to individual members.
567
568 - `"claude_insights_report_triggered"`
569
570 A Smart Report was triggered by an organization admin, or by a delegate: a member the organization allowed to run reports on a limited scope. A Smart Report is an aggregate analysis of the organization's usage over a date range, optionally scoped to one or more directory groups, to a directory attribute's values, or to product surfaces.
571
572 - `"claude_insights_report_unarchived"`
573
574 An archived Smart Report was restored to the organization's default report list, by an organization admin or by the delegate who ran it (a member the organization allowed to run reports on a limited scope).
575
576 - `"claude_insights_report_viewed"`
577
578 A Smart Report was viewed or downloaded in its default rendering, which identifies no member of the organization (viewing or downloading the rendering that attributes findings to individual members is recorded as a separate activity).
579
580 - `"claude_insights_resource_access_updated"`
581
582 Which directory groups, or which values of one directory attribute, a member may run Smart Reports on (the member's delegated scope) changed: an organization admin set or revoked it, or Smart Reports itself (a system actor) revoked it when the member left the organization.
583
540584 - `"claude_organization_settings_updated"`
541585
542586 Organization settings were updated.
from line 2264
22202264
22212265 format: date-time
22222266
2223- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 533 more`
2267- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 544 more`
22242268
22252269 Exclude activities of these types. Cannot be combined with `activity_types[]`.
22262270
from line 2784
27402784
27412785 A GitHub integration's configuration was updated.
27422786
2787 - `"claude_insights_attribution_setting_updated"`
2788
2789 An organization admin set the organization's setting that allows Smart Reports to be opened in the rendering that attributes findings to individual, identified members (off: no member can open that rendering). Every write is recorded, so the two values are equal when the setting was written with the value it already had.
2790
2791 - `"claude_insights_report_archived"`
2792
2793 A Smart Report was archived, hiding it from the organization's default report list, by an organization admin or by the delegate who ran it (a member the organization allowed to run reports on a limited scope).
2794
2795 - `"claude_insights_report_attribution_viewed"`
2796
2797 A Smart Report was viewed or downloaded with its usage findings attributed to individual, identified members of the organization (rather than in the default rendering, which identifies no member), one session it lists was inspected from that attributed rendering, or an organization admin was shown which members one of its recommendations suggests.
2798
2799 - `"claude_insights_report_deleted"`
2800
2801 An archived Smart Report was permanently deleted, by an organization admin or by the delegate who ran it (a member the organization allowed to run reports on a limited scope): its document was removed; purge_confirmed says whether it was also removed from the organization's report list.
2802
2803 - `"claude_insights_report_feedback_submitted"`
2804
2805 Feedback was submitted on a Smart Report by an organization admin, by the delegate who ran it (a member the organization allowed to run reports on a limited scope), or by a member it was shared with. The event records which report was rated, not the ratings themselves or the member's written comment.
2806
2807 - `"claude_insights_report_renamed"`
2808
2809 A Smart Report was renamed, by an organization admin or by the delegate who ran it (a member the organization allowed to run reports on a limited scope).
2810
2811 - `"claude_insights_report_sharing_updated"`
2812
2813 An organization admin, or the delegate who ran the report (a member the organization allowed to run reports on a limited scope), changed who a Smart Report is shared with: the organization members who may open the report by link, and whether they may open the rendering that attributes findings to individual members.
2814
2815 - `"claude_insights_report_triggered"`
2816
2817 A Smart Report was triggered by an organization admin, or by a delegate: a member the organization allowed to run reports on a limited scope. A Smart Report is an aggregate analysis of the organization's usage over a date range, optionally scoped to one or more directory groups, to a directory attribute's values, or to product surfaces.
2818
2819 - `"claude_insights_report_unarchived"`
2820
2821 An archived Smart Report was restored to the organization's default report list, by an organization admin or by the delegate who ran it (a member the organization allowed to run reports on a limited scope).
2822
2823 - `"claude_insights_report_viewed"`
2824
2825 A Smart Report was viewed or downloaded in its default rendering, which identifies no member of the organization (viewing or downloading the rendering that attributes findings to individual members is recorded as a separate activity).
2826
2827 - `"claude_insights_resource_access_updated"`
2828
2829 Which directory groups, or which values of one directory attribute, a member may run Smart Reports on (the member's delegated scope) changed: an organization admin set or revoked it, or Smart Reports itself (a system actor) revoked it when the member left the organization.
2830
27432831 - `"claude_organization_settings_updated"`
27442832
27452833 Organization settings were updated.
from line 4509
44214509
44224510### Returns
44234511
4424- `data: optional array of AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 533 more`
4512- `data: optional array of AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 544 more`
44254513
44264514 List of activity records. Each element's `type` field identifies which activity it is and which additional fields are present.
44274515
from line 9203
91159203
91169204 - `previous_write_user_count: optional number or null`
91179205
9118 The number of accounts on the explicit write allowlist before the change. Only meaningful when `previous_write_mode` is `users`.
9119
9120 - `read_agent_ids: optional array of string`
9121
9122 The Claude agents (`cagt_…` identifiers) whose channel holds view access to the artifact after the change. Reflects the standing grants, so it is populated on every sharing update for an artifact shared with agents, not only when an agent grant changed. Empty when none.
9123
9124 - `read_group_ids: optional array of string`
9125
9126 The admin-managed groups (`rbac_group_…` identifiers) whose members hold view access to the artifact after the change (including every `write_group_ids` entry). Reflects the standing grants, so it is populated on every sharing update for an artifact shared with groups, not only when a group grant changed. Empty when none.
9127
9128 - `write_agent_ids: optional array of string`
9129
9130 The Claude agents (`cagt_…` identifiers) whose channel holds edit access to the artifact after the change. Reflects the standing grants, so it is populated on every sharing update for an artifact shared with agents, not only when an agent grant changed. Empty when none.
9131
9132 - `write_group_ids: optional array of string`
9133
9134 The admin-managed groups (`rbac_group_…` identifiers) whose members hold edit access to the artifact after the change. Reflects the standing grants, like `read_group_ids`. Empty when none.
9135
9136 - `ClaudeArtifactViewed object`
9137
9138 An artifact was viewed.
9139
9140 - `type: optional "claude_artifact_viewed"`
9141
9142 default: claude_artifact_viewed
9143
9144 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
9145
9146 - `APIActor object`
9147
9148 - `type: optional "api_actor"`
9149
9150 default: api_actor
9151
9152 - `api_key_id: string`
9153
9154 - `ip_address: string`
9155
9156 - `user_agent: string`
9157
9158 - `UserActor object`
9159
9160 - `type: optional "user_actor"`
9161
9162 default: user_actor
9163
9164 - `email_address: string`
9165
9166 format: email
9167
9168 - `ip_address: string`
9169
9170 - `user_agent: string`
9171
9172 - `user_id: string`
9173
9174 - `UnauthenticatedUserActor object`
9175
9176 - `type: optional "unauthenticated_user_actor"`
9177
9178 default: unauthenticated_user_actor
9179
9180 - `ip_address: string`
9181
9182 - `user_agent: string`
9183
9184 - `unauthenticated_email_address: optional string or null`
9185
9186 format: email
9187
9188 - `AnthropicActor object`
9189
9190 - `type: optional "anthropic_actor"`
9191
9192 default: anthropic_actor
9193
9194 - `email_address: optional string or null`
9195
9196 format: email
9197
9198 - `SystemActor object`
9199
9200 Automated background processing performed by Anthropic systems, acting
9201 without a user or customer credential.
9202
9203 - `type: optional "system_actor"`
9204
9205 default: system_actor
9206
9207 - `service: optional string or null`
9208
9209 Name of the automated process that performed the action, when known.
9210
9211 - `AdminAPIKeyActor object`
9212
9213 - `type: optional "admin_api_key_actor"`
9214
9215 default: admin_api_key_actor
9216
9217 - `admin_api_key_id: string`
9218
9219 - `ip_address: string`
9220
9221 - `user_agent: string`
9222
9223 - `ServiceAccountActor object`
9224
9225 - `type: optional "service_account_actor"`
9226
9227 default: service_account_actor
9228
9229 - `ip_address: string`
9230
9231 - `service_account_id: string`
9232
9233 - `user_agent: string`
9234
9235 - `ScimDirectorySyncActor object`
9236
9237 - `type: optional "scim_directory_sync_actor"`
9238
9239 default: scim_directory_sync_actor
9240
9241 - `directory_id: string`
9242
9243 - `workos_event_id: string`
9244
9245 - `idp_connection_type: optional string or null`
9246
9247 - `FederatedIdentityActor object`
9248
9249 A federated external workload authenticated via a verified OIDC token.
9250
9251 Carries the verified issuer, subject, and audience claims from the
9252 presented JWT.
9253
9254 - `type: optional "federated_identity_actor"`
9255
9256 default: federated_identity_actor
9257
9258 - `issuer: string`
9259
9260 - `subject: string`
9261
9262 - `audience: optional array of string`
9263
9264 - `ip_address: optional string or null`
9265
9266 - `user_agent: optional string or null`
9267
9268 - `FederatedActor object`
9269
9270 An external identity asserted by a trusted provider — a cloud-provider
9271 gateway or a customer-registered federation issuer — acting without an
9272 Anthropic-provisioned account or service account.
9273
9274 - `type: optional "federated_actor"`
9275
9276 default: federated_actor
9277
9278 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
9279
9280 - `FederatedActorAwsProvider object`
9281
9282 Asserting party: the AWS account the organization is bound to.
9283
9284 - `type: optional "aws"`
9285
9286 default: aws
9287
9288 - `account_id: string`
9289
9290 - `signed_principal: string`
9291
9292 The AWS-signed ARN of the IAM principal that requested the token.
9293
9294 - `FederatedActorAzureProvider object`
9295
9296 Asserting party: the Azure subscription the organization is bound to.
9297
9298 - `type: optional "azure"`
9299
9300 default: azure
9301
9302 - `subscription_id: string`
9303
9304 - `FederatedActorGcpProvider object`
9305
9306 Asserting party: the GCP project the organization is bound to.
9307
9308 - `type: optional "gcp"`
9309
9310 default: gcp
9311
9312 - `project_number: string`
9313
9314 - `FederatedActorOidcProvider object`
9315
9316 Asserting party: a customer-registered OIDC federation issuer.
9317
9318 - `type: optional "oidc"`
9319
9320 default: oidc
9321
9322 - `issuer: optional string or null`
9323
9324 The federation issuer's URL. Null when the presented credential failed verification.
9325
9326 - `ip_address: optional string or null`
9327
9328 - `subject: optional string or null`
9329
9330 The provider's verified identifier for the caller; its form depends on the provider.
9331
9332 - `user_agent: optional string or null`
9333
9334 - `AttestedDeviceActor object`
9335
9336 An attested mobile device authenticated via Apple App Attest.
9337
9338 - `type: optional "attested_device_actor"`
9339
9340 default: attested_device_actor
9341
9342 - `external_client_id: string`
9343
9344 - `kid_hash: string`
9345
9346 - `ip_address: optional string or null`
9347
9348 - `user_agent: optional string or null`
9349
9350 - `claude_artifact_id: string`
9351
9352 The artifact's identifier.
9353
9354 - `id: optional string`
9355
9356 Unique identifier for the activity e.g. 'activity_abcd1234'
9357
9358 - `claude_artifact_version_id: optional string or null`
9359
9360 The version of the artifact the user was served, when known.
9361
9362 - `created_at: optional string`
9363
9364 When this activity occurred.
9365
9366 format: date-time
9367
9368 - `organization_id: optional string or null`
9369
9370 Organization ID this activity is associated with
9371
9372 - `organization_uuid: optional string or null`
9373
9374 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or call
9206 The number of accounts on the explicit write allowlist befor
No line in this hunk matches that.