Query compliance activities changedapi/compliance/activities/list
Nearest release: v2.1.306, published 2 hours after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+2,809added
Lines−3removed
From line
15
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits30to this page, all time
The whole hunk
from line 15, old and new numbered
/
This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.
from line 15
1515
1616## Query parameters
1717
18- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 533 more`
18- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 544 more`
1919
2020 Filter activities by type. See the response `data` schema for the additional fields each type returns. Cannot be combined with `exclude_activity_types[]`.
2121
from line 535
535535
536536 A GitHub integration's configuration was updated.
537537
538 - `"claude_insights_attribution_setting_updated"`
539
540 An organization admin set the organization's setting that allows Smart Reports to be opened in the rendering that attributes findings to individual, identified members (off: no member can open that rendering). Every write is recorded, so the two values are equal when the setting was written with the value it already had.
541
542 - `"claude_insights_report_archived"`
543
544 A Smart Report was archived, hiding it from the organization's default report list, by an organization admin or by the delegate who ran it (a member the organization allowed to run reports on a limited scope).
545
546 - `"claude_insights_report_attribution_viewed"`
547
548 A Smart Report was viewed or downloaded with its usage findings attributed to individual, identified members of the organization (rather than in the default rendering, which identifies no member), one session it lists was inspected from that attributed rendering, or an organization admin was shown which members one of its recommendations suggests.
549
550 - `"claude_insights_report_deleted"`
551
552 An archived Smart Report was permanently deleted, by an organization admin or by the delegate who ran it (a member the organization allowed to run reports on a limited scope): its document was removed; purge_confirmed says whether it was also removed from the organization's report list.
553
554 - `"claude_insights_report_feedback_submitted"`
555
556 Feedback was submitted on a Smart Report by an organization admin, by the delegate who ran it (a member the organization allowed to run reports on a limited scope), or by a member it was shared with. The event records which report was rated, not the ratings themselves or the member's written comment.
557
558 - `"claude_insights_report_renamed"`
559
560 A Smart Report was renamed, by an organization admin or by the delegate who ran it (a member the organization allowed to run reports on a limited scope).
561
562 - `"claude_insights_report_sharing_updated"`
563
564 An organization admin, or the delegate who ran the report (a member the organization allowed to run reports on a limited scope), changed who a Smart Report is shared with: the organization members who may open the report by link, and whether they may open the rendering that attributes findings to individual members.
565
566 - `"claude_insights_report_triggered"`
567
568 A Smart Report was triggered by an organization admin, or by a delegate: a member the organization allowed to run reports on a limited scope. A Smart Report is an aggregate analysis of the organization's usage over a date range, optionally scoped to one or more directory groups, to a directory attribute's values, or to product surfaces.
569
570 - `"claude_insights_report_unarchived"`
571
572 An archived Smart Report was restored to the organization's default report list, by an organization admin or by the delegate who ran it (a member the organization allowed to run reports on a limited scope).
573
574 - `"claude_insights_report_viewed"`
575
576 A Smart Report was viewed or downloaded in its default rendering, which identifies no member of the organization (viewing or downloading the rendering that attributes findings to individual members is recorded as a separate activity).
577
578 - `"claude_insights_resource_access_updated"`
579
580 Which directory groups, or which values of one directory attribute, a member may run Smart Reports on (the member's delegated scope) changed: an organization admin set or revoked it, or Smart Reports itself (a system actor) revoked it when the member left the organization.
581
538582 - `"claude_organization_settings_updated"`
539583
540584 Organization settings were updated.
from line 2262
22182262
22192263 format: date-time
22202264
2221- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 533 more`
2265- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 544 more`
22222266
22232267 Exclude activities of these types. Cannot be combined with `activity_types[]`.
22242268
from line 2782
27382782
27392783 A GitHub integration's configuration was updated.
27402784
2785 - `"claude_insights_attribution_setting_updated"`
2786
2787 An organization admin set the organization's setting that allows Smart Reports to be opened in the rendering that attributes findings to individual, identified members (off: no member can open that rendering). Every write is recorded, so the two values are equal when the setting was written with the value it already had.
2788
2789 - `"claude_insights_report_archived"`
2790
2791 A Smart Report was archived, hiding it from the organization's default report list, by an organization admin or by the delegate who ran it (a member the organization allowed to run reports on a limited scope).
2792
2793 - `"claude_insights_report_attribution_viewed"`
2794
2795 A Smart Report was viewed or downloaded with its usage findings attributed to individual, identified members of the organization (rather than in the default rendering, which identifies no member), one session it lists was inspected from that attributed rendering, or an organization admin was shown which members one of its recommendations suggests.
2796
2797 - `"claude_insights_report_deleted"`
2798
2799 An archived Smart Report was permanently deleted, by an organization admin or by the delegate who ran it (a member the organization allowed to run reports on a limited scope): its document was removed; purge_confirmed says whether it was also removed from the organization's report list.
2800
2801 - `"claude_insights_report_feedback_submitted"`
2802
2803 Feedback was submitted on a Smart Report by an organization admin, by the delegate who ran it (a member the organization allowed to run reports on a limited scope), or by a member it was shared with. The event records which report was rated, not the ratings themselves or the member's written comment.
2804
2805 - `"claude_insights_report_renamed"`
2806
2807 A Smart Report was renamed, by an organization admin or by the delegate who ran it (a member the organization allowed to run reports on a limited scope).
2808
2809 - `"claude_insights_report_sharing_updated"`
2810
2811 An organization admin, or the delegate who ran the report (a member the organization allowed to run reports on a limited scope), changed who a Smart Report is shared with: the organization members who may open the report by link, and whether they may open the rendering that attributes findings to individual members.
2812
2813 - `"claude_insights_report_triggered"`
2814
2815 A Smart Report was triggered by an organization admin, or by a delegate: a member the organization allowed to run reports on a limited scope. A Smart Report is an aggregate analysis of the organization's usage over a date range, optionally scoped to one or more directory groups, to a directory attribute's values, or to product surfaces.
2816
2817 - `"claude_insights_report_unarchived"`
2818
2819 An archived Smart Report was restored to the organization's default report list, by an organization admin or by the delegate who ran it (a member the organization allowed to run reports on a limited scope).
2820
2821 - `"claude_insights_report_viewed"`
2822
2823 A Smart Report was viewed or downloaded in its default rendering, which identifies no member of the organization (viewing or downloading the rendering that attributes findings to individual members is recorded as a separate activity).
2824
2825 - `"claude_insights_resource_access_updated"`
2826
2827 Which directory groups, or which values of one directory attribute, a member may run Smart Reports on (the member's delegated scope) changed: an organization admin set or revoked it, or Smart Reports itself (a system actor) revoked it when the member left the organization.
2828
27412829 - `"claude_organization_settings_updated"`
27422830
27432831 Organization settings were updated.
from line 4507
44194507
44204508## Returns
44214509
4422- `data: optional array of AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 533 more`
4510- `data: optional array of AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 544 more`
44234511
44244512 List of activity records. Each element's `type` field identifies which activity it is and which additional fields are present.
44254513
from line 9201
91139201
91149202 - `previous_write_user_count: optional number or null`
91159203
9116 The number of accounts on the explicit write allowlist before the change. Only meaningful when `previous_write_mode` is `users`.
9117
9118 - `read_agent_ids: optional array of string`
9119
9120 The Claude agents (`cagt_…` identifiers) whose channel holds view access to the artifact after the change. Reflects the standing grants, so it is populated on every sharing update for an artifact shared with agents, not only when an agent grant changed. Empty when none.
9121
9122 - `read_group_ids: optional array of string`
9123
9124 The admin-managed groups (`rbac_group_…` identifiers) whose members hold view access to the artifact after the change (including every `write_group_ids` entry). Reflects the standing grants, so it is populated on every sharing update for an artifact shared with groups, not only when a group grant changed. Empty when none.
9125
9126 - `write_agent_ids: optional array of string`
9127
9128 The Claude agents (`cagt_…` identifiers) whose channel holds edit access to the artifact after the change. Reflects the standing grants, so it is populated on every sharing update for an artifact shared with agents, not only when an agent grant changed. Empty when none.
9129
9130 - `write_group_ids: optional array of string`
9131
9132 The admin-managed groups (`rbac_group_…` identifiers) whose members hold edit access to the artifact after the change. Reflects the standing grants, like `read_group_ids`. Empty when none.
9133
9134 - `ClaudeArtifactViewed object`
9135
9136 An artifact was viewed.
9137
9138 - `type: optional "claude_artifact_viewed"`
9139
9140 default: claude_artifact_viewed
9141
9142 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
9143
9144 - `APIActor object`
9145
9146 - `type: optional "api_actor"`
9147
9148 default: api_actor
9149
9150 - `api_key_id: string`
9151
9152 - `ip_address: string`
9153
9154 - `user_agent: string`
9155
9156 - `UserActor object`
9157
9158 - `type: optional "user_actor"`
9159
9160 default: user_actor
9161
9162 - `email_address: string`
9163
9164 format: email
9165
9166 - `ip_address: string`
9167
9168 - `user_agent: string`
9169
9170 - `user_id: string`
9171
9172 - `UnauthenticatedUserActor object`
9173
9174 - `type: optional "unauthenticated_user_actor"`
9175
9176 default: unauthenticated_user_actor
9177
9178 - `ip_address: string`
9179
9180 - `user_agent: string`
9181
9182 - `unauthenticated_email_address: optional string or null`
9183
9184 format: email
9185
9186 - `AnthropicActor object`
9187
9188 - `type: optional "anthropic_actor"`
9189
9190 default: anthropic_actor
9191
9192 - `email_address: optional string or null`
9193
9194 format: email
9195
9196 - `SystemActor object`
9197
9198 Automated background processing performed by Anthropic systems, acting
9199 without a user or customer credential.
9200
9201 - `type: optional "system_actor"`
9202
9203 default: system_actor
9204
9205 - `service: optional string or null`
9206
9207 Name of the automated process that performed the action, when known.
9208
9209 - `AdminAPIKeyActor object`
9210
9211 - `type: optional "admin_api_key_actor"`
9212
9213 default: admin_api_key_actor
9214
9215 - `admin_api_key_id: string`
9216
9217 - `ip_address: string`
9218
9219 - `user_agent: string`
9220
9221 - `ServiceAccountActor object`
9222
9223 - `type: optional "service_account_actor"`
9224
9225 default: service_account_actor
9226
9227 - `ip_address: string`
9228
9229 - `service_account_id: string`
9230
9231 - `user_agent: string`
9232
9233 - `ScimDirectorySyncActor object`
9234
9235 - `type: optional "scim_directory_sync_actor"`
9236
9237 default: scim_directory_sync_actor
9238
9239 - `directory_id: string`
9240
9241 - `workos_event_id: string`
9242
9243 - `idp_connection_type: optional string or null`
9244
9245 - `FederatedIdentityActor object`
9246
9247 A federated external workload authenticated via a verified OIDC token.
9248
9249 Carries the verified issuer, subject, and audience claims from the
9250 presented JWT.
9251
9252 - `type: optional "federated_identity_actor"`
9253
9254 default: federated_identity_actor
9255
9256 - `issuer: string`
9257
9258 - `subject: string`
9259
9260 - `audience: optional array of string`
9261
9262 - `ip_address: optional string or null`
9263
9264 - `user_agent: optional string or null`
9265
9266 - `FederatedActor object`
9267
9268 An external identity asserted by a trusted provider — a cloud-provider
9269 gateway or a customer-registered federation issuer — acting without an
9270 Anthropic-provisioned account or service account.
9271
9272 - `type: optional "federated_actor"`
9273
9274 default: federated_actor
9275
9276 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
9277
9278 - `FederatedActorAwsProvider object`
9279
9280 Asserting party: the AWS account the organization is bound to.
9281
9282 - `type: optional "aws"`
9283
9284 default: aws
9285
9286 - `account_id: string`
9287
9288 - `signed_principal: string`
9289
9290 The AWS-signed ARN of the IAM principal that requested the token.
9291
9292 - `FederatedActorAzureProvider object`
9293
9294 Asserting party: the Azure subscription the organization is bound to.
9295
9296 - `type: optional "azure"`
9297
9298 default: azure
9299
9300 - `subscription_id: string`
9301
9302 - `FederatedActorGcpProvider object`
9303
9304 Asserting party: the GCP project the organization is bound to.
9305
9306 - `type: optional "gcp"`
9307
9308 default: gcp
9309
9310 - `project_number: string`
9311
9312 - `FederatedActorOidcProvider object`
9313
9314 Asserting party: a customer-registered OIDC federation issuer.
9315
9316 - `type: optional "oidc"`
9317
9318 default: oidc
9319
9320 - `issuer: optional string or null`
9321
9322 The federation issuer's URL. Null when the presented credential failed verification.
9323
9324 - `ip_address: optional string or null`
9325
9326 - `subject: optional string or null`
9327
9328 The provider's verified identifier for the caller; its form depends on the provider.
9329
9330 - `user_agent: optional string or null`
9331
9332 - `AttestedDeviceActor object`
9333
9334 An attested mobile device authenticated via Apple App Attest.
9335
9336 - `type: optional "attested_device_actor"`
9337
9338 default: attested_device_actor
9339
9340 - `external_client_id: string`
9341
9342 - `kid_hash: string`
9343
9344 - `ip_address: optional string or null`
9345
9346 - `user_agent: optional string or null`
9347
9348 - `claude_artifact_id: string`
9349
9350 The artifact's identifier.
9351
9352 - `id: optional string`
9353
9354 Unique identifier for the activity e.g. 'activity_abcd1234'
9355
9356 - `claude_artifact_version_id: optional string or null`
9357
9358 The version of the artifact the user was served, when known.
9359
9360 - `created_at: optional string`
9361
9362 When this activity occurred.
9363
9364 format: date-time
9365
9366 - `organization_id: optional string or null`
9367
9368 Organization ID this activity is associated with
9369
9370 - `organization_uuid: optional string or null`
9371
9372 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or
9204 The number of accounts on the explicit write allowlist b
No line in this hunk matches that.