Compliance API changedapi/compliance
Nearest release: v2.1.309, published 2 hours after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+3,716added
Lines−16removed
From line
19
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits33to this page, all time
The whole hunk
from line 19, old and new numbered
/
This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.
The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.
from line 19
1919
2020#### Query parameters
2121
22- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 544 more`
22- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "account_migration_completed" or 558 more`
2323
2424 Filter activities by type. See the response `data` schema for the additional fields each type returns. Cannot be combined with `exclude_activity_types[]`.
2525
from line 31
3131
3232 User-initiated self-service account deletion.
3333
34 - `"account_migration_completed"`
35
36 A personal Claude account's migration into the organization finished: the migrated data is now part of the organization.
37
38 - `"account_migration_failed"`
39
40 A personal Claude account's migration into the organization did not complete.
41
42 - `"account_migration_started"`
43
44 A personal Claude account began migrating into the organization: its data, including conversations, projects and files, is being moved from the member's personal account into this organization.
45
3446 - `"admin_api_key_created"`
3547
3648 An admin API key was created.
from line 363
351363
352364 Claude Code Review configuration was enabled/disabled for an org.
353365
366 - `"claude_code_review_promo_enrolled"`
367
368 An organization admin enrolled the organization in a Claude Code Review promotion, for example by claiming promotional credits.
369
354370 - `"claude_code_review_repository_added"`
355371
356372 A repository was added to org-level Claude Code Review configuration.
from line 421
405421
406422 - `"claude_code_security_scan_project_updated"`
407423
408 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience.
424 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience, or a user paused the project's scheduled scanning, unpaused it, or lifted a billing pause on it.
409425
410426 - `"claude_code_security_scan_project_visibility_updated"`
411427
from line 739
723739
724740 SAML IdP configuration updated for a public sector organization.
725741
742 - `"claude_skill_auto_disabled"`
743
744 A skill that had been turned on for a member automatically was turned off for them automatically, not by the member; reason says why. A member turning a skill off themselves is recorded as claude_skill_disabled.
745
746 - `"claude_skill_auto_enabled"`
747
748 A skill was turned on for a member automatically, not by the member; trigger gives the cause, such as another member sharing an eligible skill with them. A member turning a skill on themselves is recorded as claude_skill_enabled.
749
726750 - `"claude_skill_created"`
727751
728752 Skill was created.
from line 899
875899
876900 A new version of an existing org-owned desktop extension was uploaded.
877901
902 - `"domain_claim_cancelled"`
903
904 A pending domain claim was cancelled before it took effect, so the personal accounts on the claimed domains will no longer be migrated or deactivated at its deadline.
905
906 - `"domain_claim_deadline_updated"`
907
908 The migration deadline of a pending domain claim was moved to a later or an earlier date by Anthropic staff or an automated process.
909
878910 - `"domain_claim_initiated"`
879911
880912 Domain capture claim initiated over personal accounts on verified domains.
from line 1911
18791911
18801912 An org-level spend limit snooze/ignore state was changed.
18811913
1914 - `"platform_telemetry_destination_auto_disabled"`
1915
1916 A telemetry destination was disabled automatically after deliveries to it failed, so no telemetry is sent to it until an administrator enables it again.
1917
1918 - `"platform_telemetry_destination_created"`
1919
1920 A telemetry destination was registered for the organization.
1921
1922 - `"platform_telemetry_destination_deleted"`
1923
1924 A telemetry destination was deleted.
1925
1926 - `"platform_telemetry_destination_updated"`
1927
1928 A telemetry destination's configuration was updated. State changes and changes of its workspace scope (the type, or the list through an update's workspace_ids) are included; the workspaces an update took off or put on the list are also recorded as workspace_removed and workspace_added activities. Previous and current values are recorded only for the endpoint URL, the traces URL, the content mode and the workspaces type.
1929
1930 - `"platform_telemetry_destination_workspace_added"`
1931
1932 A workspace was added to the workspace list of a telemetry destination. When the list type is "include", the destination starts to receive the spans of that workspace; when it is "exclude", the destination stops receiving them.
1933
1934 - `"platform_telemetry_destination_workspace_removed"`
1935
1936 A workspace was removed from the workspace list of a telemetry destination, by a change to the list or because the destination was deleted. When the list type is "include", the destination stops receiving the spans of that workspace; when it is "exclude", the destination receives them again unless the destination was deleted.
1937
18821938 - `"platform_usage_report_claude_code_viewed"`
18831939
18841940 The Claude Code usage report was viewed.
from line 2322
22662322
22672323 format: date-time
22682324
2269- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 544 more`
2325- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "account_migration_completed" or 558 more`
22702326
22712327 Exclude activities of these types. Cannot be combined with `activity_types[]`.
22722328
from line 2334
22782334
22792335 User-initiated self-service account deletion.
22802336
2337 - `"account_migration_completed"`
2338
2339 A personal Claude account's migration into the organization finished: the migrated data is now part of the organization.
2340
2341 - `"account_migration_failed"`
2342
2343 A personal Claude account's migration into the organization did not complete.
2344
2345 - `"account_migration_started"`
2346
2347 A personal Claude account began migrating into the organization: its data, including conversations, projects and files, is being moved from the member's personal account into this organization.
2348
22812349 - `"admin_api_key_created"`
22822350
22832351 An admin API key was created.
from line 2666
25982666
25992667 Claude Code Review configuration was enabled/disabled for an org.
26002668
2669 - `"claude_code_review_promo_enrolled"`
2670
2671 An organization admin enrolled the organization in a Claude Code Review promotion, for example by claiming promotional credits.
2672
26012673 - `"claude_code_review_repository_added"`
26022674
26032675 A repository was added to org-level Claude Code Review configuration.
from line 2724
26522724
26532725 - `"claude_code_security_scan_project_updated"`
26542726
2655 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience.
2727 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience, or a user paused the project's scheduled scanning, unpaused it, or lifted a billing pause on it.
26562728
26572729 - `"claude_code_security_scan_project_visibility_updated"`
26582730
from line 3042
29703042
29713043 SAML IdP configuration updated for a public sector organization.
29723044
3045 - `"claude_skill_auto_disabled"`
3046
3047 A skill that had been turned on for a member automatically was turned off for them automatically, not by the member; reason says why. A member turning a skill off themselves is recorded as claude_skill_disabled.
3048
3049 - `"claude_skill_auto_enabled"`
3050
3051 A skill was turned on for a member automatically, not by the member; trigger gives the cause, such as another member sharing an eligible skill with them. A member turning a skill on themselves is recorded as claude_skill_enabled.
3052
29733053 - `"claude_skill_created"`
29743054
29753055 Skill was created.
from line 3202
31223202
31233203 A new version of an existing org-owned desktop extension was uploaded.
31243204
3205 - `"domain_claim_cancelled"`
3206
3207 A pending domain claim was cancelled before it took effect, so the personal accounts on the claimed domains will no longer be migrated or deactivated at its deadline.
3208
3209 - `"domain_claim_deadline_updated"`
3210
3211 The migration deadline of a pending domain claim was moved to a later or an earlier date by Anthropic staff or an automated process.
3212
31253213 - `"domain_claim_initiated"`
31263214
31273215 Domain capture claim initiated over personal accounts on verified domains.
from line 4214
41264214
41274215 An org-level spend limit snooze/ignore state was changed.
41284216
4217 - `"platform_telemetry_destination_auto_disabled"`
4218
4219 A telemetry destination was disabled automatically after deliveries to it failed, so no telemetry is sent to it until an administrator enables it again.
4220
4221 - `"platform_telemetry_destination_created"`
4222
4223 A telemetry destination was registered for the organization.
4224
4225 - `"platform_telemetry_destination_deleted"`
4226
4227 A telemetry destination was deleted.
4228
4229 - `"platform_telemetry_destination_updated"`
4230
4231 A telemetry destination's configuration was updated. State changes and changes of its workspace scope (the type, or the list through an update's workspace_ids) are included; the workspaces an update took off or put on the list are also recorded as workspace_removed and workspace_added activities. Previous and current values are recorded only for the endpoint URL, the traces URL, the content mode and the workspaces type.
4232
4233 - `"platform_telemetry_destination_workspace_added"`
4234
4235 A workspace was added to the workspace list of a telemetry destination. When the list type is "include", the destination starts to receive the spans of that workspace; when it is "exclude", the destination stops receiving them.
4236
4237 - `"platform_telemetry_destination_workspace_removed"`
4238
4239 A workspace was removed from the workspace list of a telemetry destination, by a change to the list or because the destination was deleted. When the list type is "include", the destination stops receiving the spans of that workspace; when it is "exclude", the destination receives them again unless the destination was deleted.
4240
41294241 - `"platform_usage_report_claude_code_viewed"`
41304242
41314243 The Claude Code usage report was viewed.
from line 4623
45114623
45124624#### Returns
45134625
4514- `data: optional array of AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 544 more`
4626- `data: optional array of AbuseDecisionReceived or AccountDeleted or AccountMigrationCompleted or 558 more`
45154627
45164628 List of activity records. Each element's `type` field identifies which activity it is and which additional fields are present.
45174629
from line 5103
49915103
49925104 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
49935105
5106 - `AccountMigrationCompleted object`
5107
5108 A personal Claude account's migration into the organization finished: the migrated data is now part of the organization.
5109
5110 - `type: optional "account_migration_completed"`
5111
5112 default: account_migration_completed
5113
5114 - `account_migration_id: string`
5115
5116 Tagged ID of the migration, e.g. "amig_...", matching the account_migration_started activity that opened it.
5117
5118 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
5119
5120 - `APIActor object`
5121
5122 - `type: optional "api_actor"`
5123
5124 default: api_actor
5125
5126 - `api_key_id: string`
5127
5128 - `ip_address: string`
5129
5130 - `user_agent: string`
5131
5132 - `UserActor object`
5133
5134 - `type: optional "user_actor"`
5135
5136 default: user_actor
5137
5138 - `email_address: string`
5139
5140 format: email
5141
5142 - `ip_address: string`
5143
5144 - `user_agent: string`
5145
5146 - `user_id: string`
5147
5148 - `UnauthenticatedUserActor object`
5149
5150 - `type: optional "unauthenticated_user_actor"`
5151
5152 default: unauthenticated_user_actor
5153
5154 - `ip_address: string`
5155
5156 - `user_agent: string`
5157
5158 - `unauthenticated_email_address: optional string or null`
5159
5160 format: email
5161
5162 - `AnthropicActor object`
5163
5164 - `type: optional "anthropic_actor"`
5165
5166 default: anthropic_actor
5167
5168 - `email_address: optional string or null`
5169
5170 format: email
5171
5172 - `SystemActor object`
5173
5174 Automated background processing performed by Anthropic systems, acting
5175 without a user or customer credential.
5176
5177 - `type: optional "system_actor"`
5178
5179 default: system_actor
5180
5181 - `service: optional string or null`
5182
5183 Name of the automated process that performed the action, when known.
5184
5185 - `AdminAPIKeyActor object`
5186
5187 - `type: optional "admin_api_key_actor"`
5188
5189 default: admin_api_key_actor
5190
5191 - `admin_api_key_id: string`
5192
5193 - `ip_address: string`
5194
5195 - `user_agent: string`
5196
5197 - `ServiceAccountActor object`
5198
5199 - `type: optional "service_account_actor"`
5200
5201 default: service_account_actor
5202
5203 - `ip_address: string`
5204
5205 - `service_account_id: string`
5206
5207 - `user_agent: string`
5208
5209 - `ScimDirectorySyncActor object`
5210
5211 - `type: optional "scim_directory_sync_actor"`
5212
5213 default: scim_directory_sync_actor
5214
5215 - `directory_id: string`
5216
5217 - `workos_event_id: string`
5218
5219 - `idp_connection_type: optional string or null`
5220
5221 - `FederatedIdentityActor object`
5222
5223 A federated external workload authenticated via a verified OIDC token.
5224
5225 Carries the verified issuer, subject, and audience claims from the
5226 presented JWT.
5227
5228 - `type: optional "federated_identity_actor"`
5229
5230 default: federated_identity_actor
5231
5232 - `issuer: string`
5233
5234 - `subject: string`
5235
5236 - `audience: optional array of string`
5237
5238 - `ip_address: optional string or null`
5239
5240 - `user_agent: optional string or null`
5241
5242 - `FederatedActor object`
5243
5244 An external identity asserted by a trusted provider — a cloud-provider
5245 gateway or a customer-registered federation issuer — acting without an
5246 Anthropic-provisioned account or service account.
5247
5248 - `type: optional "federated_actor"`
5249
5250 default: federated_actor
5251
5252 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
5253
5254 - `FederatedActorAwsProvider object`
5255
5256 Asserting party: the AWS account the organization is bound to.
5257
5258 - `type: optional "aws"`
5259
5260 default: aws
5261
5262 - `account_id: string`
5263
5264 - `signed_principal: string`
5265
5266 The AWS-signed ARN of the IAM principal that requested the token.
5267
5268 - `FederatedActorAzureProvider object`
5269
5270 Asserting party: the Azure subscription the organization is bound to.
5271
5272 - `type: optional "azure"`
5273
5274 default: azure
5275
5276 - `subscription_id: string`
5277
5278 - `FederatedActorGcpProvider object`
5279
5280 Asserting party: the GCP project the organization is bound to.
5281
5282 - `type: optional "gcp"`
5283
5284 default: gcp
5285
5286 - `project_number: string`
5287
5288 - `FederatedActorOidcProvider object`
5289
5290 Asserting party: a customer-registered OIDC federation issuer.
5291
5292 - `type: optional "oidc"`
5293
5294 default: oidc
5295
5296 - `issuer: optional string or null`
5297
5298 The federation issuer's URL. Null when the presented credential failed verification.
5299
5300 - `ip_address: optional string or null`
5301
5302 - `subject: optional string or null`
5303
5304 The provider's verified identifier for the caller; its form depends on the provider.
5305
5306 - `user_agent: optional string or null`
5307
5308 - `AttestedDeviceActor object`
5309
5310 An attested mobile device authenticated via Apple App Attest.
5311
5312 - `type: optional "attested_device_actor"`
5313
5314 default: attested_device_actor
5315
5316 - `external_client_id: string`
5317
5318 - `kid_hash: string`
5319
5320 - `ip_address: optional string or null`
5321
5322 - `user_agent: optional string or null`
5323
5324 - `id: optional string`
5325
5326 Unique identifier for the activity e.g. 'activity_abcd1234'
5327
5328 - `created_at: optional string`
5329
5330 When this activity occurred.
5331
5332 format: date-time
5333
5334 - `migrated_user_email: optional string or null`
5335
5336 Email address of the user whose personal account was migrated, when known.
5337
5338 - `migrated_user_id: optional string or null`
5339
5340 Tagged ID of the user whose personal account was migrated, e.g. "user_...", when known.
5341
5342 - `organization_id: optional string or null`
5343
5344 Organization ID this activity is associated with
5345
5346 - `organization_uuid: optional string or null`
5347
5348 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
5349
5350 - `AccountMigrationFailed object`
5351
5352 A personal Claude account's migration into the organization did not complete.
5353
5354 - `type: optional "account_migration_failed"`
5355
5356 default: account_migration_failed
5357
5358 - `account_migration_id: string`
5359
5360 Tagged ID of the migration, e.g. "amig_...", matching the account_migration_started activity that opened it, if one was recorded; a later retry is a new migration with its own ID.
5361
5362 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
5363
5364 - `APIActor object`
5365
5366 - `type: optional "api_actor"`
5367
5368 default: api_actor
5369
5370 - `api_key_id: string`
5371
5372 - `ip_address: string`
5373
5374 - `user_agent: string`
5375
5376 - `UserActor object`
5377
5378 - `type: optional "user_actor"`
5379
5380 default: user_actor
5381
5382 - `email_address: string`
5383
5384 format: email
5385
5386 - `ip_address: string`
5387
5388 - `user_agent: string`
5389
5390 - `user_id: string`
5391
5392 - `UnauthenticatedUserActor object`
5393
5394 - `type: optional "unauthenticated_user_actor"`
5395
5396 default: unauthenticated_user_actor
5397
5398 - `ip_address: string`
5399
5400 - `user_agent: string`
5401
5402 - `unauthenticated_email_address: optional string or null`
5403
5404 format: email
5405
5406 - `AnthropicActor object`
5407
5408 - `type: optional "anthropic_actor"`
5409
5410 default: anthropic_actor
5411
5412 - `email_address: optional string or null`
5413
5414 format: email
5415
5416 - `SystemActor object`
5417
5418 Automated background processing performed by Anthropic systems, acting
5419 without a user or customer credential.
5420
5421 - `type: optional "system_actor"`
5422
5423 default: system_actor
5424
5425 - `service: optional string or null`
5426
5427 Name of the automated process that performed the action, when known.
5428
5429 - `AdminAPIKeyActor object`
5430
5431 - `type: optional "admin_api_key_actor"`
5432
5433 default: admin_api_key_actor
5434
5435 - `admin_api_key_id: string`
5436
5437 - `ip_address: string`
5438
5439 - `user_agent: string`
5440
5441 - `ServiceAccountActor object`
5442
5443 - `type: optional "service_account_actor"`
5444
5445 default: service_account_actor
5446
5447 - `ip_address: string`
5448
5449 - `service_account_id: string`
5450
5451 - `user_agent: string`
5452
5453 - `ScimDirectorySyncActor object`
5454
5455 - `type: optional "scim_directory_sync_actor"`
5456
5457 default: scim_directory_sync_actor
5458
5459 - `directory_id: string`
5460
5461 - `workos_event_id: string`
5462
5463 - `idp_connection_type: optional string or null`
5464
5465 - `FederatedIdentityActor object`
5466
5467 A federated external workload authenticated via a verified OIDC token.
5468
5469 Carries the verified issuer, subject, and audience claims from the
5470 presented JWT.
5471
5472 - `type: optional "federated_identity_actor"`
5473
5474 default: federated_identity_actor
5475
5476 - `issuer: string`
5477
5478 - `subject: string`
5479
5480 - `audience: optional array of string`
5481
5482 - `ip_address: optional string or null`
5483
5484 - `user_agent: optional string or null`
5485
5486 - `FederatedActor object`
5487
5488 An external identity asserted by a trusted provider — a cloud-provider
5489 gateway or a customer-registered federation issuer — acting without an
5490 Anthropic-provisioned account or service account.
5491
5492 - `type: optional "federated_actor"`
5493
5494 default: federated_actor
5495
5496 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
5497
5498 - `FederatedActorAwsProvider object`
5499
5500 Asserting party: the AWS account the organization is bound to.
5501
5502 - `type: optional "aws"`
5503
5504 default: aws
5505
5506 - `account_id: string`
5507
5508 - `signed_principal: string`
5509
5510 The AWS-signed ARN of the IAM principal that requested the token.
5511
5512 - `FederatedActorAzureProvider object`
5513
5514 Asserting party: the Azure subscription the organization is bound to.
5515
5516 - `type: optional "azure"`
5517
5518 default: azure
5519
5520 - `subscription_id: string`
5521
5522 - `FederatedActorGcpProvider object`
5523
5524 Asserting party: the GCP project the organization is bound to.
5525
5526 - `type: optional "gcp"`
5527
5528 default: gcp
5529
5530 - `project_number: string`
5531
5532 - `FederatedActorOidcProvider object`
5533
5534 Asserting party: a customer-registered OIDC federation issuer.
5535
5536 - `type: optional "oidc"`
5537
5538 default: oidc
5539
5540 - `issuer: optional string or null`
5541
5542 The federation issuer's URL. Null when the presented credential failed verification.
5543
5544 - `ip_address: optional string or null`
5545
5546 - `subject: optional string or null`
5547
5548 The provider's verified identifier for the caller; its form depends on the provider.
5549
5550 - `user_agent: optional string or null`
5551
5552 - `AttestedDeviceActor object`
5553
5554 An attested mobile device authenticated via Apple App Attest.
5555
5556 - `type: optional "attested_device_actor"`
5557
5558 default: attested_device_actor
5559
5560 - `external_client_id: string`
5561
5562 - `kid_hash: string`
5563
5564 - `ip_address: optional string or null`
5565
5566 - `user_agent: optional string or null`
5567
5568 - `id: optional string`
5569
5570 Unique identifier for the activity e.g. 'activity_abcd1234'
5571
5572 - `created_at: optional string`
5573
5574 When this activity occurred.
5575
5576 format: date-time
5577
5578 - `failure_reasons: optional array of "already_member_of_target" or "already_migrating" or "anthropic_staff_action" or 12 more`
5579
5580 Why the migration did not complete, each reason listed once. In these values "source" is the member's personal account and "target" is this organization. "source_equals_target", "source_not_personal_org", "user_not_member_of_source" and "user_not_sole_member_of_source": the account is not a single-member personal account that can be migrated. "target_not_enterprise_org": this organization's plan does not accept the migration. "already_member_of_target": the migration already happened. "target_membership_not_provisioned" and "target_membership_unassigned_no_seats": the member has no usable seat in this organization. "already_migrating": another migration of the same account is in progress. "source_too_large": the personal account holds more data than a migration can move. "target_became_inactive": this organization became inactive before the migration finished. "migration_failed": an error stopped the migration. "anthropic_staff_action": Anthropic staff stopped the migration. "migration_blocked_redacted": stands in for every reason that is not shared with the organization. Values may be added over time; treat an unrecognized value as a generic failure. "unspecified" is never emitted.
5581
5582 - `"already_member_of_target"`
5583
5584 - `"already_migrating"`
5585
5586 - `"anthropic_staff_action"`
5587
5588 - `"migration_blocked_redacted"`
5589
5590 - `"migration_failed"`
5591
5592 - `"source_equals_target"`
5593
5594 - `"source_not_personal_org"`
5595
5596 - `"source_too_large"`
5597
5598 - `"target_became_inactive"`
5599
5600 - `"target_membership_not_provisioned"`
5601
5602 - `"target_membership_unassigned_no_seats"`
5603
5604 - `"target_not_enterprise_org"`
5605
5606 - `"unspecified"`
5607
5608 - `"user_not_member_of_source"`
5609
5610 - `"user_not_sole_member_of_source"`
5611
5612 - `migrated_user_email: optional string or null`
5613
5614 Email address of the user whose personal account was being migrated, when known.
5615
5616 - `migrated_user_id: optional string or null`
5617
5618 Tagged ID of the user whose personal account was being migrated, e.g. "user_...", when known.
5619
5620 - `organization_id: optional string or null`
5621
5622 Organization ID this activity is associated with
5623
5624 - `organization_uuid: optional string or null`
5625
5626 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
5627
5628 - `AccountMigrationStarted object`
5629
5630 A personal Claude account began migrating into the organization: its data, including conversations, projects and files, is being moved from the member's personal account into this organization.
5631
5632 - `type: optional "account_migration_started"`
5633
5634 default: account_migration_started
5635
5636 - `account_migration_id: string`
5637
5638 Tagged ID of the migration, e.g. "amig_...". The same ID appears on the completed or failed activity that closes the migration, when one is recorded.
5639
5640 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
5641
5642 - `APIActor object`
5643
5644 - `type: optional "api_actor"`
5645
5646 default: api_actor
5647
5648 - `api_key_id: string`
5649
5650 - `ip_address: string`
5651
5652 - `user_agent: string`
5653
5654 - `UserActor object`
5655
5656 - `type: optional "user_actor"`
5657
5658 default: user_actor
5659
5660 - `email_address: string`
5661
5662 format: email
5663
5664 - `ip_address: string`
5665
5666 - `user_agent: string`
5667
5668 - `user_id: string`
5669
5670 - `UnauthenticatedUserActor object`
5671
5672 - `type: optional "unauthenticated_user_actor"`
5673
5674 default: unauthenticated_user_actor
5675
5676 - `ip_address: string`
5677
5678 - `user_agent: string`
5679
5680 - `unauthenticated_email_address: optional string or null`
5681
5682 format: email
5683
5684 - `AnthropicActor object`
5685
5686 - `type: optional "anthropic_actor"`
5687
5688 default: anthropic_actor
5689
5690 - `email_address: optional string or null`
5691
5692 format: email
5693
5694 - `SystemActor object`
5695
5696 Automated background processing performed by Anthropic systems, acting
5697 without a user or customer credential.
5698
5699 - `type: optional "system_actor"`
5700
5701 default: system_actor
5702
5703 - `service: optional string or null`
5704
5705 Name of the automated process that performed the action, when known.
5706
5707 - `AdminAPIKeyActor object`
5708
5709 - `type: optional "admin_api_key_actor"`
5710
5711 default: admin_api_key_actor
5712
5713 - `admin_api_key_id: string`
5714
5715 - `ip_address: string`
5716
5717 - `user_agent: string`
5718
5719 - `ServiceAccountActor object`
5720
5721 - `type: optional "service_account_actor"`
5722
5723 default: service_account_actor
5724
5725 - `ip_address: string`
5726
5727 - `service_account_id: string`
5728
5729 - `user_agent: string`
5730
5731 - `ScimDirectorySyncActor object`
5732
5733 - `type: optional "scim_directory_sync_actor"`
5734
5735 default: scim_directory_sync_actor
5736
5737 - `directory_id: string`
5738
5739 - `workos_event_id: string`
5740
5741 - `idp_connection_type: optional string or null`
5742
5743 - `FederatedIdentityActor object`
5744
5745 A federated external workload authenticated via a verified OIDC token.
5746
5747 Carries the verified issuer, subject, and audience claims from the
5748 presented JWT.
5749
5750 - `type: optional "federated_identity_actor"`
5751
5752 default: federated_identity_actor
5753
5754 - `issuer: string`
5755
5756 - `subject: string`
5757
5758 - `audience: optional array of string`
5759
5760 - `ip_address: optional string or null`
5761
5762 - `user_agent: optional string or null`
5763
5764 - `FederatedActor object`
5765
5766 An external identity asserted by a trusted provider — a cloud-provider
5767 gateway or a customer-registered federation issuer — acting without an
5768 Anthropic-provisioned account or service account.
5769
5770 - `type: optional "federated_actor"`
5771
5772 default: federated_actor
5773
5774 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
5775
5776 - `FederatedActorAwsProvider object`
5777
5778 Asserting party: the AWS account the organization is bound to.
5779
5780 - `type: optional "aws"`
5781
5782 default: aws
5783
5784 - `account_id: string`
5785
5786 - `signed_principal: string`
5787
5788 The AWS-signed ARN of the IAM principal that requested the token.
5789
5790 - `FederatedActorAzureProvider object`
5791
5792 Asserting party: the Azure subscription the organization is bound to.
5793
5794 - `type: optional "azure"`
5795
5796 default: azure
5797
5798 - `subscription_id: string`
5799
5800 - `FederatedActorGcpProvider object`
5801
5802 Asserting party: the GCP project the organization is bound to.
5803
5804 - `type: optional "gcp"`
5805
5806 default: gcp
5807
5808 - `project_number: string`
5809
5810 - `FederatedActorOidcProvider object`
5811
5812 Asserting party: a customer-registered OIDC federation issuer.
5813
5814 - `type: optional "oidc"`
5815
5816 default: oidc
5817
5818 - `issuer: optional string or null`
5819
5820 The federation issuer's URL. Null when the presented credential failed verification.
5821
5822 - `ip_address: optional string or null`
5823
5824 - `subject: optional string or null`
5825
5826 The provider's verified identifier for the caller; its form depends on the provider.
5827
5828 - `user_agent: optional string or null`
5829
5830 - `AttestedDeviceActor object`
5831
5832 An attested mobile device authenticated via Apple App Attest.
5833
5834 - `type: optional "attested_device_actor"`
5835
5836 default: attested_device_actor
5837
5838 - `external_client_id: string`
5839
5840 - `kid_hash: string`
5841
5842 - `ip_address: optional string or null`
5843
5844 - `user_agent: optional string or null`
5845
5846 - `migrated_user_email: string`
5847
5848 Email address of the user whose personal account is being migrated.
5849
5850 - `migrated_user_id: string`
5851
5852 Tagged ID of the user whose personal account is being migrated, e.g. "user_...".
5853
5854 - `id: optional string`
5855
5856 Unique identifier for the activity e.g. 'activity_abcd1234'
5857
5858 - `created_at: optional string`
5859
5860 When this activity occurred.
5861
5862 format: date-time
5863
5864 - `organization_id: optional string or null`
5865
5866 Organization ID this activity is associated with
5867
5868 - `organization_uuid: optional string or null`
5869
5870 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
5871
49945872 - `AdminAPIKeyCreated object`
49955873
49965874 An admin API key was created.
from line 26357
2547926357
2548026358 Per-review spend limit in USD before the change. Absent when no configuration existed before this update or no limit was set.
2548126359
26360 - `previous_review_level: optional string or null`
26361
26362 Review level set for the organization's code reviews before the change: "low" (Quick), "medium" (Standard) or "high" (Deep). Absent when no configuration existed before this update or no level was set.
26363
2548226364 - `previous_show_tips: optional boolean or null`
2548326365
2548426366 Whether tip-style pull-request comments were enabled before the change. Absent when no configuration existed before this update.
from line 26369
2548726369
2548826370 Whether the verification stage of code review was enabled for the organization before the change. Absent when no configuration existed before this update or no preference was set.
2548926371
26372 - `review_level: optional string or null`
26373
26374 Review level now set for the organization's code reviews: "low" (Quick), "medium" (Standard) or "high" (Deep). Repositories without their own level use this one. Absent when no level is set; the default level, Standard, then applies.
26375
2549026376 - `show_tips: optional boolean or null`
2549126377
2549226378 Whether tip-style pull-request comments are now enabled
from line 26381
2549526381
2549626382 Whether the verification stage of code review is now enabled for the organization. Absent when the organization has not set a preference and the default applies.
2549726383
26384 - `ClaudeCodeReviewPromoEnrolled object`
26385
26386 An organization admin enrolled the organization in a Claude Code Review promotion, for example by claiming promotional credits.
26387
26388 - `type: optional "claude_code_review_promo_enrolled"`
26389
26390 default: claude_code_review_promo_enrolled
26391
26392 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
26393
26394 - `APIActor object`
26395
26396 - `type: optional "api_actor"`
26397
26398 default: api_actor
26399
26400 - `api_key_id: string`
26401
26402 - `ip_address: string`
26403
26404 - `user_agent: string`
26405
26406 - `UserActor object`
26407
26408 - `type: optional "user_actor"`
26409
26410 default: user_actor
26411
26412 - `email_address: string`
26413
26414 format: email
26415
26416 - `ip_address: string`
26417
26418 - `user_agent: string`
26419
26420 - `user_id: string`
26421
26422 - `UnauthenticatedUserActor object`
26423
26424 - `type: optional "unauthenticated_user_actor"`
26425
26426 default: unauthenticated_user_actor
26427
26428 - `ip_address: string`
26429
26430 - `user_agent: string`
26431
26432 - `unauthenticated_email_address: optional string or null`
26433
26434 format: email
26435
26436 - `AnthropicActor object`
26437
26438 - `type: optional "anthropic_actor"`
26439
26440 default: anthropic_actor
26441
26442 - `email_address: optional string or null`
26443
26444 format: email
26445
26446 - `SystemActor object`
26447
26448 Automated background processing performed by Anthropic systems, acting
26449 without a user or customer credential.
26450
26451 - `type: optional "system_actor"`
26452
26453 default: system_actor
26454
26455 - `service: optional string or null`
26456
26457 Name of the automated process that performed the action, when known.
26458
26459 - `AdminAPIKeyActor object`
26460
26461 - `type: optional "admin_api_key_actor"`
26462
26463 default: admin_api_key_actor
26464
26465 - `admin_api_key_id: string`
26466
26467 - `ip_address: string`
26468
26469 - `user_agent: string`
26470
26471 - `ServiceAccountActor object`
26472
26473 - `type: optional "service_account_actor"`
26474
26475 default: service_account_actor
26476
26477 - `ip_address: string`
26478
26479 - `service_account_id: string`
26480
26481 - `user_agent: string`
26482
26483 - `ScimDirectorySyncActor object`
26484
26485 - `type: optional "scim_directory_sync_actor"`
26486
26487 default: scim_directory_sync_actor
26488
26489 - `directory_id: string`
26490
26491 - `workos_event_id: string`
26492
26493 - `idp_connection_type: optional string or null`
26494
26495 - `FederatedIdentityActor object`
26496
26497 A federated external workload authenticated via a verified OIDC token.
26498
26499 Carries the verified issuer, subject, and audience claims from the
26500 presented JWT.
26501
26502 - `type: optional "federated_identity_actor"`
26503
26504 default: federated_identity_actor
26505
26506 - `issuer: string`
26507
26508 - `subject: string`
26509
26510 - `audience: optional array of string`
26511
26512 - `ip_address: optional string or null`
26513
26514 - `user_agent: optional string or null`
26515
26516 - `FederatedActor object`
26517
26518 An external identity asserted by a trusted provider — a cloud-provider
26519 gateway or a customer-registered federation issuer — acting without an
26520 Anthropic-provisioned account or service account.
26521
26522 - `type: optional "federated_actor"`
26523
26524 default: federated_actor
26525
26526 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
26527
26528 - `FederatedActorAwsProvider object`
26529
26530 Asserting party: the AWS account the organization is bound to.
26531
26532 - `type: optional "aws"`
26533
26534 default: aws
26535
26536 - `account_id: string`
26537
26538 - `signed_principal: string`
26539
26540 The AWS-signed ARN of the IAM principal that requested the token.
26541
26542 - `FederatedActorAzureProvider object`
26543
26544 Asserting party: the Azure subscription the organization is bound to.
26545
26546 - `type: optional "azure"`
26547
26548 default: azure
26549
26550 - `subscription_id: string`
26551
26552 - `FederatedActorGcpProvider object`
26553
26554 Asserting party: the GCP project the organization is bound to.
26555
26556 - `type: optional "gcp"`
26557
26558 default: gcp
26559
26560 - `project_number: string`
26561
26562 - `FederatedActorOidcProvider object`
26563
26564 Asserting party: a customer-registered OIDC federation issuer.
26565
26566 - `type: optional "oidc"`
26567
26568 default: oidc
26569
26570 - `issuer: optional string or null`
26571
26572 The federation issuer's URL. Null when the presented credential failed verification.
26573
26574 - `ip_address: optional string or null`
26575
26576 - `subject: optional string or null`
26577
26578 The provider's verified identifier for the caller; its form depends on the provider.
26579
26580 - `user_agent: optional string or null`
26581
26582 - `AttestedDeviceActor object`
26583
26584 An attested mobile device authenticated via Apple App Attest.
26585
26586 - `type: optional "attested_device_actor"`
26587
26588 default: attested_device_actor
26589
26590 - `external_client_id: string`
26591
26592 - `kid_hash: string`
26593
26594 - `ip_address: optional string or null`
26595
26596 - `user_agent: optional string or null`
26597
26598 - `promo_id: string`
26599
26600 Identifier of the promotion the organization enrolled in.
26601
26602 - `id: optional string`
26603
26604 Unique identifier for the activity e.g. 'activity_abcd1234'
26605
26606 - `created_at: optional string`
26607
26608 When this activity occurred.
26609
26610 format: date-time
26611
26612 - `expires_at: optional string or null`
26613
26614 When the organization's promotional access or credits expire.
26615
26616 format: date-time
26617
26618 - `organization_id: optional string or null`
26619
26620 Organization ID this activity is associated with
26621
26622 - `organization_uuid: optional string or null`
26623
26624 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
26625
2549826626 - `ClaudeCodeReviewRepositoryAdded object`
2549926627
2550026628 A repository was added to org-level Claude Code Review configuration.
from line 27359
2623127359
2623227360 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
2623327361
27362 - `previous_review_level: optional string or null`
27363
27364 Review level set for this repository's code reviews before the change: "low" (Quick), "medium" (Standard) or "high" (Deep). Absent when no level was set.
27365
27366 - `review_level: optional string or null`
27367
27368 Review level now set for this repository's code reviews: "low" (Quick), "medium" (Standard) or "high" (Deep). Absent when no level is set; the repository then uses the organization-wide level (review_level on claude_code_review_config_updated), or Standard if none is set.
27369
2623427370 - `status: optional string or null`
2623527371
2623627372 Updated status (ACTIVE/INACTIVE)
from line 29835
2869929835
2870029836 - `ClaudeCodeSecurityScanProjectUpdated object`
2870129837
28702 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience.
29838 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience, or a user paused the project's scheduled scanning, unpaused it, or lifted a billing pause on it.
2870329839
2870429840 - `type: optional "claude_code_security_scan_project_updated"`
2870529841
2870629842 default: claude_code_security_scan_project_updated
2870729843
28708 - `action: "archived" or "created" or "migrated" or 3 more`
29844 - `action: "archived" or "billing_pause_lifted" or "created" or 6 more`
2870929845
2871029846 The state change applied to the scan project.
2871129847
2871229848 - `"archived"`
2871329849
29850 - `"billing_pause_lifted"`
29851
2871429852 - `"created"`
2871529853
2871629854 - `"migrated"`
2871729855
29856 - `"paused"`
29857
2871829858 - `"resumed"`
2871929859
2872029860 - `"unarchived"`
2872129861
29862 - `"unpaused"`
29863
2872229864 - `"unspecified"`
2872329865
2872429866 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
from line 40119
3897740119
3897840120 A short provider-specific identifier for the external resource after the update, e.g. `owner/repo` for GitHub or a file ID for Google Drive.
3897940121
40122 - `ClaudeSkillAutoDisabled object`
40123
40124 A skill that had been turned on for a member automatically was turned off for them automatically, not by the member; reason says why. A member turning a skill off themselves is recorded as claude_skill_disabled.
40125
40126 - `type: optional "claude_skill_auto_disabled"`
40127
40128 default: claude_skill_auto_disabled
40129
40130 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
40131
40132 - `APIActor object`
40133
40134 - `type: optional "api_actor"`
40135
40136 default: api_actor
40137
40138 - `api_key_id: string`
40139
40140 - `ip_address: string`
40141
40142 - `user_agent: string`
40143
40144 - `UserActor object`
40145
40146 - `type: optional "user_actor"`
40147
40148 default: user_actor
40149
40150 - `email_address: string`
40151
40152 format: email
40153
40154 - `ip_address: string`
40155
40156 - `user_agent: string`
40157
40158 - `user_id: string`
40159
40160 - `UnauthenticatedUserActor object`
40161
40162 - `type: optional "unauthenticated_user_actor"`
40163
40164 default: unauthenticated_user_actor
40165
40166 - `ip_address: string`
40167
40168 - `user_agent: string`
40169
40170 - `unauthenticated_email_address: optional string or null`
40171
40172 format: email
40173
40174 - `AnthropicActor object`
40175
40176 - `type: optional "anthropic_actor"`
40177
40178 default: anthropic_actor
40179
40180 - `email_address: optional string or null`
40181
40182 format: email
40183
40184 - `SystemActor object`
40185
40186 Automated background processing performed by Anthropic systems, acting
40187 without a user or customer credential.
40188
40189 - `type: optional "system_actor"`
40190
40191 default: system_actor
40192
40193 - `service: optional string or null`
40194
40195 Name of the automated process that performed the action, when known.
40196
40197 - `AdminAPIKeyActor object`
40198
40199 - `type: optional "admin_api_key_actor"`
40200
40201 default: admin_api_key_actor
40202
40203 - `admin_api_key_id: string`
40204
40205 - `ip_address: string`
40206
40207 - `user_agent: string`
40208
40209 - `ServiceAccountActor object`
40210
40211 - `type: optional "service_account_actor"`
40212
40213 default: service_account_actor
40214
40215 - `ip_address: string`
40216
40217 - `service_account_id: string`
40218
40219 - `user_agent: string`
40220
40221 - `ScimDirectorySyncActor object`
40222
40223 - `type: optional "scim_directory_sync_actor"`
40224
40225 default: scim_directory_sync_actor
40226
40227 - `directory_id: string`
40228
40229 - `workos_event_id: string`
40230
40231 - `idp_connection_type: optional string or null`
40232
40233 - `FederatedIdentityActor object`
40234
40235 A federated external workload authenticated via a verified OIDC token.
40236
40237 Carries the verified issuer, subject, and audience claims from the
40238 presented JWT.
40239
40240 - `type: optional "federated_identity_actor"`
40241
40242 default: federated_identity_actor
40243
40244 - `issuer: string`
40245
40246 - `subject: string`
40247
40248 - `audience: optional array of string`
40249
40250 - `ip_address: optional string or null`
40251
40252 - `user_agent: optional string or null`
40253
40254 - `FederatedActor object`
40255
40256 An external identity asserted by a trusted provider — a cloud-provider
40257 gateway or a customer-registered federation issuer — acting without an
40258 Anthropic-provisioned account or service account.
40259
40260 - `type: optional "federated_actor"`
40261
40262 default: federated_actor
40263
40264 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
40265
40266 - `FederatedActorAwsProvider object`
40267
40268 Asserting party: the AWS account the organization is bound to.
40269
40270 - `type: optional "aws"`
40271
40272 default: aws
40273
40274 - `account_id: string`
40275
40276 - `signed_principal: string`
40277
40278 The AWS-signed ARN of the IAM principal that requested the token.
40279
40280 - `FederatedActorAzureProvider object`
40281
40282 Asserting party: the Azure subscription the organization is bound to.
40283
40284 - `type: optional "azure"`
40285
40286 default: azure
40287
40288 - `subscription_id: string`
40289
40290 - `FederatedActorGcpProvider object`
40291
40292 Asserting party: the GCP project the organization is bound to.
40293
40294 - `type: optional "gcp"`
40295
40296 default: gcp
40297
40298 - `project_number: string`
40299
40300 - `FederatedActorOidcProvider object`
40301
40302 Asserting party: a customer-registered OIDC federation issuer.
40303
40304 - `type: optional "oidc"`
40305
40306 default: oidc
40307
40308 - `issuer: optional string or null`
40309
40310 The federation issuer's URL. Null when the presented credential failed verification.
40311
40312 - `ip_address: optional string or null`
40313
40314 - `subject: optional string or null`
40315
40316 The provider's verified identifier for the caller; its form depends on the provider.
40317
40318 - `user_agent: optional string or null`
40319
40320 - `AttestedDeviceActor object`
40321
40322 An attested mobile device authenticated via Apple App Attest.
40323
40324 - `type: optional "attested_device_actor"`
40325
40326 default: attested_device_actor
40327
40328 - `external_client_id: string`
40329
40330 - `kid_hash: string`
40331
40332 - `ip_address: optional string or null`
40333
40334 - `user_agent: optional string or null`
40335
40336 - `reason: "auto_enable_reverted" or "content_changed" or "unspecified"`
40337
40338 Why the skill was turned off automatically: "content_changed" (a change to the skill was saved or attempted, or the skill was scanned again, and it could not be confirmed as still eligible to be on automatically) or "auto_enable_reverted" (Anthropic turned off skills that had been turned on automatically; not in response to a change to this skill).
40339
40340 - `"auto_enable_reverted"`
40341
40342 - `"content_changed"`
40343
40344 - `"unspecified"`
40345
40346 - `user_id: string`
40347
40348 The member the skill was turned off for.
40349
40350 - `id: optional string`
40351
40352 Unique identifier for the activity e.g. 'activity_abcd1234'
40353
40354 - `created_at: optional string`
40355
40356 When this activity occurred.
40357
40358 format: date-time
40359
40360 - `organization_id: optional string or null`
40361
40362 Organization ID this activity is associated with
40363
40364 - `organization_uuid: optional string or null`
40365
40366 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
40367
40368 - `shared_by_user_id: optional string or null`
40369
40370 For a skill that had been turned on because it was shared: the member who shared it.
40371
40372 - `skill_id: optional string or null`
40373
40374 The skill that was turned off.
40375
40376 - `skill_name: optional string or null`
40377
40378 The name of the skill that was turned off.
40379
40380 - `skill_version: optional string or null`
40381
40382 The version of the skill the member had just before it was turned off. Absent when not known.
40383
40384 - `ClaudeSkillAutoEnabled object`
40385
40386 A skill was turned on for a member automatically, not by the member; trigger gives the cause, such as another member sharing an eligible skill with them. A member turning a skill on themselves is recorded as claude_skill_enabled.
40387
40388 - `type: optional "claude_skill_auto_enabled"`
40389
40390 default: claude_skill_auto_enabled
40391
40392 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
40393
40394 - `APIActor object`
40395
40396 - `type: optional "api_actor"`
40397
40398 default: api_actor
40399
40400 - `api_key_id: string`
40401
40402 - `ip_address: string`
40403
40404 - `user_agent: string`
40405
40406 - `UserActor object`
40407
40408 - `type: optional "user_actor"`
40409
40410 default: user_actor
40411
40412 - `email_address: string`
40413
40414 format: email
40415
40416 - `ip_address: string`
40417
40418 - `user_agent: string`
40419
40420 - `user_id: string`
40421
40422 - `UnauthenticatedUserActor object`
40423
40424 - `type: optional "unauthenticated_user_actor"`
40425
40426 default: unauthenticated_user_actor
40427
40428 - `ip_address: string`
40429
40430 - `user_agent: string`
40431
40432 - `unauthenticated_email_address: optional string or null`
40433
40434 format: email
40435
40436 - `AnthropicActor object`
40437
40438 - `type: optional "anthropic_actor"`
40439
40440 default: anthropic_actor
40441
40442 - `email_address: optional string or null`
40443
40444 format: email
40445
40446 - `SystemActor object`
40447
40448 Automated background processing performed by Anthropic systems, acting
40449 without a user or customer credential.
40450
40451 - `type: optional "system_actor"`
40452
40453 default: system_actor
40454
40455 - `service: optional string or null`
40456
40457 Name of the automated process that performed the action, when known.
40458
40459 - `AdminAPIKeyActor object`
40460
40461 - `type: optional "admin_api_key_actor"`
40462
40463 default: admin_api_key_actor
40464
40465 - `admin_api_key_id: string`
40466
40467 - `ip_address: string`
40468
40469 - `user_agent: string`
40470
40471 - `ServiceAccountActor object`
40472
40473 - `type: optional "service_account_actor"`
40474
40475 default: service_account_actor
40476
40477 - `ip_address: string`
40478
40479 - `service_account_id: string`
40480
40481 - `user_agent: string`
40482
40483 - `ScimDirectorySyncActor object`
40484
40485 - `type: optional "scim_directory_sync_actor"`
40486
40487 default: scim_directory_sync_actor
40488
40489 - `directory_id: string`
40490
40491 - `workos_event_id: string`
40492
40493 - `idp_connection_type: optional string or null`
40494
40495 - `FederatedIdentityActor object`
40496
40497 A federated external workload authenticated via a verified OIDC token.
40498
40499 Carries the verified issuer, subject, and audience claims from the
40500 presented JWT.
40501
40502 - `type: optional "federated_identity_actor"`
40503
40504 default: federated_identity_actor
40505
40506 - `issuer: string`
40507
40508 - `subject: string`
40509
40510 - `audience: optional array of string`
40511
40512 - `ip_address: optional string or null`
40513
40514 - `user_agent: optional string or null`
40515
40516 - `FederatedActor object`
40517
40518 An external identity asserted by a trusted provider — a cloud-provider
40519 gateway or a customer-registered federation issuer — acting without an
40520 Anthropic-provisioned account or service account.
40521
40522 - `type: optional "federated_actor"`
40523
40524 default: federated_actor
40525
40526 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
40527
40528 - `FederatedActorAwsProvider object`
40529
40530 Asserting party: the AWS account the organization is bound to.
40531
40532 - `type: optional "aws"`
40533
40534 default: aws
40535
40536 - `account_id: string`
40537
40538 - `signed_principal: string`
40539
40540 The AWS-signed ARN of the IAM principal that requested the token.
40541
40542 - `FederatedActorAzureProvider object`
40543
40544 Asserting party: the Azure subscription the organization is bound to.
40545
40546 - `type: optional "azure"`
40547
40548 default: azure
40549
40550 - `subscription_id: string`
40551
40552 - `FederatedActorGcpProvider object`
40553
40554 Asserting party: the GCP project the organization is bound to.
40555
40556 - `type: optional "gcp"`
40557
40558 default: gcp
40559
40560 - `project_number: string`
40561
40562 - `FederatedActorOidcProvider object`
40563
40564 Asserting party: a customer-registered OIDC federation issuer.
40565
40566 - `type: optional "oidc"`
40567
40568 default: oidc
40569
40570 - `issuer: optional string or null`
40571
40572 The federation issuer's URL. Null when the presented credential failed verification.
40573
40574 - `ip_address: optional string or null`
40575
40576 - `subject: optional string or null`
40577
40578 The provider's verified identifier for the caller; its form depends on the provider.
40579
40580 - `user_agent: optional string or null`
40581
40582 - `AttestedDeviceActor object`
40583
40584 An attested mobile device authenticated via Apple App Attest.
40585
40586 - `type: optional "attested_device_actor"`
40587
40588 default: attested_device_actor
40589
40590 - `external_client_id: string`
40591
40592 - `kid_hash: string`
40593
40594 - `ip_address: optional string or null`
40595
40596 - `user_agent: optional string or null`
40597
40598 - `trigger: "share" or "unspecified"`
40599
40600 What caused the skill to be turned on automatically: "share" (another member shared it with the member, directly or through a group).
40601
40602 - `"share"`
40603
40604 - `"unspecified"`
40605
40606 - `user_id: string`
40607
40608 The member the skill was turned on for.
40609
40610 - `id: optional string`
40611
40612 Unique identifier for the activity e.g. 'activity_abcd1234'
40613
40614 - `created_at: optional string`
40615
40616 When this activity occurred.
40617
40618 format: date-time
40619
40620 - `organization_id: optional string or null`
40621
40622 Organization ID this activity is associated with
40623
40624 - `organization_uuid: optional string or null`
40625
40626 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
40627
40628 - `shared_at: optional string or null`
40629
40630 For a skill turned on because it was shared: when it was shared with the member or with their group.
40631
40632 format: date-time
40633
40634 - `shared_by_user_id: optional string or null`
40635
40636 For a skill turned on because it was shared: the member who shared it.
40637
40638 - `shared_via: optional "direct" or "group" or "unspecified" or null`
40639
40640 For a skill turned on because it was shared: "direct" if shared with the member themselves, "group" if shared with a group they belong to.
40641
40642 - `"direct"`
40643
40644 - `"group"`
40645
40646 - `"unspecified"`
40647
40648 - `skill_id: optional string or null`
40649
40650 The skill that was turned on.
40651
40652 - `skill_name: optional string or null`
40653
40654 The name of the skill that was turned on.
40655
40656 - `skill_version: optional string or null`
40657
40658 The version of the skill that was turned on.
40659
3898040660 - `ClaudeSkillDownloaded object`
3898140661
3898240662 A member explicitly downloaded a skill's files to their device: the Download action in Claude, a single file saved from the skill viewer, or an install they asked one of their Claude apps for. Background syncs to the Claude apps, viewing a skill in the app and services reading a skill on the member's behalf are not recorded.
from line 49269
4758949269
4759049270 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
4759149271
49272 - `DomainClaimCancelled object`
49273
49274 A pending domain claim was cancelled before it took effect, so the personal accounts on the claimed domains will no longer be migrated or deactivated at its deadline.
49275
49276 - `type: optional "domain_claim_cancelled"`
49277
49278 default: domain_claim_cancelled
49279
49280 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
49281
49282 - `APIActor object`
49283
49284 - `type: optional "api_actor"`
49285
49286 default: api_actor
49287
49288 - `api_key_id: string`
49289
49290 - `ip_address: string`
49291
49292 - `user_agent: string`
49293
49294 - `UserActor object`
49295
49296 - `type: optional "user_actor"`
49297
49298 default: user_actor
49299
49300 - `email_address: string`
49301
49302 format: email
49303
49304 - `ip_address: string`
49305
49306 - `user_agent: string`
49307
49308 - `user_id: string`
49309
49310 - `UnauthenticatedUserActor object`
49311
49312 - `type: optional "unauthenticated_user_actor"`
49313
49314 default: unauthenticated_user_actor
49315
49316 - `ip_address: string`
49317
49318 - `user_agent: string`
49319
49320 - `unauthenticated_email_address: optional string or null`
49321
49322 format: email
49323
49324 - `AnthropicActor object`
49325
49326 - `type: optional "anthropic_actor"`
49327
49328 default: anthropic_actor
49329
49330 - `email_address: optional string or null`
49331
49332 format: email
49333
49334 - `SystemActor object`
49335
49336 Automated background processing performed by Anthropic systems, acting
49337 without a user or customer credential.
49338
49339 - `type: optional "system_actor"`
49340
49341 default: system_actor
49342
49343 - `service: optional string or null`
49344
49345 Name of the automated process that performed the action, when known.
49346
49347 - `AdminAPIKeyActor object`
49348
49349 - `type: optional "admin_api_key_actor"`
49350
49351 default: admin_api_key_actor
49352
49353 - `admin_api_key_id: string`
49354
49355 - `ip_address: string`
49356
49357 - `user_agent: string`
49358
49359 - `ServiceAccountActor object`
49360
49361 - `type: optional "service_account_actor"`
49362
49363 default: service_account_actor
49364
49365 - `ip_address: string`
49366
49367 - `service_account_id: string`
49368
49369 - `user_agent: string`
49370
49371 - `ScimDirectorySyncActor object`
49372
49373 - `type: optional "scim_directory_sync_actor"`
49374
49375 default: scim_directory_sync_actor
49376
49377 - `directory_id: string`
49378
49379 - `workos_event_id: string`
49380
49381 - `idp_connection_type: optional string or null`
49382
49383 - `FederatedIdentityActor object`
49384
49385 A federated external workload authenticated via a verified OIDC token.
49386
49387 Carries the verified issuer, subject, and audience claims from the
49388 presented JWT.
49389
49390 - `type: optional "federated_identity_actor"`
49391
49392 default: federated_identity_actor
49393
49394 - `issuer: string`
49395
49396 - `subject: string`
49397
49398 - `audience: optional array of string`
49399
49400 - `ip_address: optional string or null`
49401
49402 - `user_agent: optional string or null`
49403
49404 - `FederatedActor object`
49405
49406 An external identity asserted by a trusted provider — a cloud-provider
49407 gateway or a customer-registered federation issuer — acting without an
49408 Anthropic-provisioned account or service account.
49409
49410 - `type: optional "federated_actor"`
49411
49412 default: federated_actor
49413
49414 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
49415
49416 - `FederatedActorAwsProvider object`
49417
49418 Asserting party: the AWS account the organization is bound to.
49419
49420 - `type: optional "aws"`
49421
49422 default: aws
49423
49424 - `account_id: string`
49425
49426 - `signed_principal: string`
49427
49428 The AWS-signed ARN of the IAM principal that requested the token.
49429
49430 - `FederatedActorAzureProvider object`
49431
49432 Asserting party: the Azure subscription the organization is bound to.
49433
49434 - `type: optional "azure"`
49435
49436 default: azure
49437
49438 - `subscription_id: string`
49439
49440 - `FederatedActorGcpProvider object`
49441
49442 Asserting party: the GCP project the organization is bound to.
49443
49444 - `type: optional "gcp"`
49445
49446 default: gcp
49447
49448 - `project_number: string`
49449
49450 - `FederatedActorOidcProvider object`
49451
49452 Asserting party: a customer-registered OIDC federation issuer.
49453
49454 - `type: optional "oidc"`
49455
49456 default: oidc
49457
49458 - `issuer: optional string or null`
49459
49460 The federation issuer's URL. Null when the presented credential failed verification.
49461
49462 - `ip_address: optional string or null`
49463
49464 - `subject: optional string or null`
49465
49466 The provider's verified identifier for the caller; its form depends on the provider.
49467
49468 - `user_agent: optional string or null`
49469
49470 - `AttestedDeviceActor object`
49471
49472 An attested mobile device authenticated via Apple App Attest.
49473
49474 - `type: optional "attested_device_actor"`
49475
49476 default: attested_device_actor
49477
49478 - `external_client_id: string`
49479
49480 - `kid_hash: string`
49481
49482 - `ip_address: optional string or null`
49483
49484 - `user_agent: optional string or null`
49485
49486 - `domain_claim_id: string`
49487
49488 The domain claim that was cancelled, e.g. "dclm_01Ab...".
49489
49490 - `id: optional string`
49491
49492 Unique identifier for the activity e.g. 'activity_abcd1234'
49493
49494 - `created_at: optional string`
49495
49496 When this activity occurred.
49497
49498 format: date-time
49499
49500 - `organization_id: optional string or null`
49501
49502 Organization ID this activity is associated with
49503
49504 - `organization_uuid: optional string or null`
49505
49506 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
49507
49508 - `DomainClaimDeadlineUpdated object`
49509
49510 The migration deadline of a pending domain claim was moved to a later or an earlier date by Anthropic staff or an automated process.
49511
49512 - `type: optional "domain_claim_deadline_updated"`
49513
49514 default: domain_claim_deadline_updated
49515
49516 - `action: "extended" or "shortened" or "unspecified"`
49517
49518 Whether the deadline was extended (moved later) or shortened (moved earlier).
49519
49520 - `"extended"`
49521
49522 - `"shortened"`
49523
49524 - `"unspecified"`
49525
49526 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
49527
49528 - `APIActor object`
49529
49530 - `type: optional "api_actor"`
49531
49532 default: api_actor
49533
49534 - `api_key_id: string`
49535
49536 - `ip_address: string`
49537
49538 - `user_agent: string`
49539
49540 - `UserActor object`
49541
49542 - `type: optional "user_actor"`
49543
49544 default: user_actor
49545
49546 - `email_address: string`
49547
49548 format: email
49549
49550 - `ip_address: string`
49551
49552 - `user_agent: string`
49553
49554 - `user_id: string`
49555
49556 - `UnauthenticatedUserActor object`
49557
49558 - `type: optional "unauthenticated_user_actor"`
49559
49560 default: unauthenticated_user_actor
49561
49562 - `ip_address: string`
49563
49564 - `user_agent: string`
49565
49566 - `unauthenticated_email_address: optional string or null`
49567
49568 format: email
49569
49570 - `AnthropicActor object`
49571
49572 - `type: optional "anthropic_actor"`
49573
49574 default: anthropic_actor
49575
49576 - `email_address: optional string or null`
49577
49578 format: email
49579
49580 - `SystemActor object`
49581
49582 Automated background processing performed by Anthropic systems, acting
49583 without a user or customer credential.
49584
49585 - `type: optional "system_actor"`
49586
49587 default: system_actor
49588
49589 - `service: optional string or null`
49590
49591 Name of the automated process that performed the action, when known.
49592
49593 - `AdminAPIKeyActor object`
49594
49595 - `type: optional "admin_api_key_actor"`
49596
49597 default: admin_api_key_actor
49598
49599 - `admin_api_key_id: string`
49600
49601 - `ip_address: string`
49602
49603 - `user_agent: string`
49604
49605 - `ServiceAccountActor object`
49606
49607 - `type: optional "service_account_actor"`
49608
49609 default: service_account_actor
49610
49611 - `ip_address: string`
49612
49613 - `service_account_id: string`
49614
49615 - `user_agent: string`
49616
49617 - `ScimDirectorySyncActor object`
49618
49619 - `type: optional "scim_directory_sync_actor"`
49620
49621 default: scim_directory_sync_actor
49622
49623 - `directory_id: string`
49624
49625 - `workos_event_id: string`
49626
49627 - `idp_connection_type: optional string or null`
49628
49629 - `FederatedIdentityActor object`
49630
49631 A federated external workload authenticated via a verified OIDC token.
49632
49633 Carries the verified issuer, subject, and audience claims from the
49634 presented JWT.
49635
49636 - `type: optional "federated_identity_actor"`
49637
49638 default: federated_identity_actor
49639
49640 - `issuer: string`
49641
49642 - `subject: string`
49643
49644 - `audience: optional array of string`
49645
49646 - `ip_address: optional string or null`
49647
49648 - `user_agent: optional string or null`
49649
49650 - `FederatedActor object`
49651
49652 An external identity asserted by a trusted provider — a cloud-provider
49653 gateway or a customer-registered federation issuer — acting without an
49654 Anthropic-provisioned account or service account.
49655
49656 - `type: optional "federated_actor"`
49657
49658 default: federated_actor
49659
49660 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
49661
49662 - `FederatedActorAwsProvider object`
49663
49664 Asserting party: the AWS account the organization is bound to.
49665
49666 - `type: optional "aws"`
49667
49668 default: aws
49669
49670 - `account_id: string`
49671
49672 - `signed_principal: string`
49673
49674 The AWS-signed ARN of the IAM principal that requested the token.
49675
49676 - `FederatedActorAzureProvider object`
49677
49678 Asserting party: the Azure subscription the organization is bound to.
49679
49680 - `type: optional "azure"`
49681
49682 default: azure
49683
49684 - `subscription_id: string`
49685
49686 - `FederatedActorGcpProvider object`
49687
49688 Asserting party: the GCP project the organization is bound to.
49689
49690 - `type: optional "gcp"`
49691
49692 default: gcp
49693
49694 - `project_number: string`
49695
49696 - `FederatedActorOidcProvider object`
49697
49698 Asserting party: a customer-registered OIDC federation issuer.
49699
49700 - `type: optional "oidc"`
49701
49702 default: oidc
49703
49704 - `issuer: optional string or null`
49705
49706 The federation issuer's URL. Null when the presented credential failed verification.
49707
49708 - `ip_address: optional string or null`
49709
49710 - `subject: optional string or null`
49711
49712 The provider's verified identifier for the caller; its form depends on the provider.
49713
49714 - `user_agent: optional string or null`
49715
49716 - `AttestedDeviceActor object`
49717
49718 An attested mobile device authenticated via Apple App Attest.
49719
49720 - `type: optional "attested_device_actor"`
49721
49722 default: attested_device_actor
49723
49724 - `external_client_id: string`
49725
49726 - `kid_hash: string`
49727
49728 - `ip_address: optional string or null`
49729
49730 - `user_agent: optional string or null`
49731
49732 - `domain_claim_id: string`
49733
49734 The domain claim whose deadline was moved, e.g. "dclm_01Ab...".
49735
49736 - `id: optional string`
49737
49738 Unique identifier for the activity e.g. 'activity_abcd1234'
49739
49740 - `created_at: optional string`
49741
49742 When this activity occurred.
49743
49744 format: date-time
49745
49746 - `deadline_at: optional string or null`
49747
49748 The deadline after the change.
49749
49750 format: date-time
49751
49752 - `organization_id: optional string or null`
49753
49754 Organization ID this activity is associated with
49755
49756 - `organization_uuid: optional string or null`
49757
49758 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
49759
49760 - `previous_deadline_at: optional string or null`
49761
49762 The deadline before the change.
49763
49764 format: date-time
49765
4759249766 - `DomainClaimInitiated object`
4759349767
4759449768 Domain capture claim initiated over personal accounts on verified domains.
from line 55441
5326755441
5326855442 - `token_fingerprint_sha256: optional string or null`
5326955443
53270 Org-scoped SHA-256 of the submitted token: `sha256(org_uuid || 0x00 || token)`, lowercase-hex-encoded, where `org_uuid` is the organization's UUID as a dashed lowercase string, `0x00` is a single zero byte, and `token` is the submitted value's raw bytes. Per-org correlation only — the same token in two orgs produces distinct fingerprints. Set only when the submitted value carries a known GitHub PAT prefix (a high-entropy token format); unset for all other submissions, including rejected non-PAT input.
55444 Not populated.
5327155445
5327255446 - `GitlabConfigurationCreated object`
5327355447
from line 93275
9110193275
9110293276 - `user_agent: optional string or null`
9110393277
91104 - `updates: array of Name or Capabilities or RedactContent or 104 more`
93278 - `updates: array of Name or Capabilities or RedactContent or 105 more`
9110593279
9110693280 - `Name object`
9110793281
from line 95194
9302095194
9302195195 Setting value immediately before this change. Null means the setting was not set, so its default applied.
9302295196
95197 - `ConnectorRequestsOptedIn object`
95198
95199 The organization's opt-in to connector requests, which lets members ask the organization's owners to add a connector, was changed. The "Let members request connectors" switch sets it the first time it is turned on; turning that switch off, or on again, is recorded as a `disabled_admin_request_types` change (`enable_connector` joins or leaves the list).
95200
95201 - `type: optional "connector_requests_opted_in"`
95202
95203 default: connector_requests_opted_in
95204
95205 - `current_value: optional boolean or null`
95206
95207 Setting value immediately after this change
95208
95209 - `previous_value: optional boolean or null`
95210
95211 Setting value immediately before this change. Null means the organization had never opted in or out.
95212
9302395213 - `id: optional string`
9302495214
9302595215 Unique identifier for the activity e.g. 'activity_abcd1234'
from line 114300
112110114300
112111114301 UUID of the spend limit.
112112114302
114303 - `PlatformTelemetryDestinationAutoDisabled object`
114304
114305 A telemetry destination was disabled automatically after deliveries to it failed, so no telemetry is sent to it until an administrator enables it again.
114306
114307 - `type: optional "platform_telemetry_destination_auto_disabled"`
114308
114309 default: platform_telemetry_destination_auto_disabled
114310
114311 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
114312
114313 - `APIActor object`
114314
114315 - `type: optional "api_actor"`
114316
114317 default: api_actor
114318
114319 - `api_key_id: string`
114320
114321 - `ip_address: string`
114322
114323 - `user_agent: string`
114324
114325 - `UserActor object`
114326
114327 - `type: optional "user_actor"`
114328
114329 default: user_actor
114330
114331 - `email_address: string`
114332
114333 format: email
114334
114335 - `ip_address: string`
114336
114337 - `user_agent: string`
114338
114339 - `user_id: string`
114340
114341 - `UnauthenticatedUserActor object`
114342
114343 - `type: optional "unauthenticated_user_actor"`
114344
114345 default: unauthenticated_user_actor
114346
114347 - `ip_address: string`
114348
114349 - `user_agent: string`
114350
114351 - `unauthenticated_email_address: optional string or null`
114352
114353 format: email
114354
114355 - `AnthropicActor object`
114356
114357 - `type: optional "anthropic_actor"`
114358
114359 default: anthropic_actor
114360
114361 - `email_address: optional string or null`
114362
114363 format: email
114364
114365 - `SystemActor object`
114366
114367 Automated background processing performed by Anthropic systems, acting
114368 without a user or customer credential.
114369
114370 - `type: optional "system_actor"`
114371
114372 default: system_actor
114373
114374 - `service: optional string or null`
114375
114376 Name of the automated process that performed the action, when known.
114377
114378 - `AdminAPIKeyActor object`
114379
114380 - `type: optional "admin_api_key_actor"`
114381
114382 default: admin_api_key_actor
114383
114384 - `admin_api_key_id: string`
114385
114386 - `ip_address: string`
114387
114388 - `user_agent: string`
114389
114390 - `ServiceAccountActor object`
114391
114392 - `type: optional "service_account_actor"`
114393
114394 default: service_account_actor
114395
114396 - `ip_address: string`
114397
114398 - `service_account_id: string`
114399
114400 - `user_agent: string`
114401
114402 - `ScimDirectorySyncActor object`
114403
114404 - `type: optional "scim_directory_sync_actor"`
114405
114406 default: scim_directory_sync_actor
114407
114408 - `directory_id: string`
114409
114410 - `workos_event_id: string`
114411
114412 - `idp_connection_type: optional string or null`
114413
114414 - `FederatedIdentityActor object`
114415
114416 A federated external workload authenticated via a verified OIDC token.
114417
114418 Carries the verified issuer, subject, and audience claims from the
114419 presented JWT.
114420
114421 - `type: optional "federated_identity_actor"`
114422
114423 default: federated_identity_actor
114424
114425 - `issuer: string`
114426
114427 - `subject: string`
114428
114429 - `audience: optional array of string`
114430
114431 - `ip_address: optional string or null`
114432
114433 - `user_agent: optional string or null`
114434
114435 - `FederatedActor object`
114436
114437 An external identity asserted by a trusted provider — a cloud-provider
114438 gateway or a customer-registered federation issuer — acting without an
114439 Anthropic-provisioned account or service account.
114440
114441 - `type: optional "federated_actor"`
114442
114443 default: federated_actor
114444
114445 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
114446
114447 - `FederatedActorAwsProvider object`
114448
114449 Asserting party: the AWS account the organization is bound to.
114450
114451 - `type: optional "aws"`
114452
114453 default: aws
114454
114455 - `account_id: string`
114456
114457 - `signed_principal: string`
114458
114459 The AWS-signed ARN of the IAM principal that requested the token.
114460
114461 - `FederatedActorAzureProvider object`
114462
114463 Asserting party: the Azure subscription the organization is bound to.
114464
114465 - `type: optional "azure"`
114466
114467 default: azure
114468
114469 - `subscription_id: string`
114470
114471 - `FederatedActorGcpProvider object`
114472
114473 Asserting party: the GCP project the organization is bound to.
114474
114475 - `type: optional "gcp"`
114476
114477 default: gcp
114478
114479 - `project_number: string`
114480
114481 - `FederatedActorOidcProvider object`
114482
114483 Asserting party: a customer-registered OIDC federation issuer.
114484
114485 - `type: optional "oidc"`
114486
114487 default: oidc
114488
114489 - `issuer: optional string or null`
114490
114491 The federation issuer's URL. Null when the presented credential failed verification.
114492
114493 - `ip_address: optional string or null`
114494
114495 - `subject: optional string or null`
114496
114497 The provider's verified identifier for the caller; its form depends on the provider.
114498
114499 - `user_agent: optional string or null`
114500
114501 - `AttestedDeviceActor object`
114502
114503 An attested mobile device authenticated via Apple App Attest.
114504
114505 - `type: optional "attested_device_actor"`
114506
114507 default: attested_device_actor
114508
114509 - `external_client_id: string`
114510
114511 - `kid_hash: string`
114512
114513 - `ip_address: optional string or null`
114514
114515 - `user_agent: optional string or null`
114516
114517 - `telemetry_destination_id: string`
114518
114519 Tagged telemetry destination ID, e.g. "tdst_01HX...".
114520
114521 - `trigger: "invalid_address" or "redirect" or "sustained_failure" or "unspecified"`
114522
114523 Why the destination was disabled: deliveries failed for longer than Anthropic allows ("sustained_failure"), they failed that long and the hostname does not resolve to a public address ("invalid_address"), or the endpoint answered with an HTTP redirect ("redirect").
114524
114525 - `"invalid_address"`
114526
114527 - `"redirect"`
114528
114529 - `"sustained_failure"`
114530
114531 - `"unspecified"`
114532
114533 - `id: optional string`
114534
114535 Unique identifier for the activity e.g. 'activity_abcd1234'
114536
114537 - `created_at: optional string`
114538
114539 When this activity occurred.
114540
114541 format: date-time
114542
114543 - `organization_id: optional string or null`
114544
114545 Organization ID this activity is associated with
114546
114547 - `organization_uuid: optional string or null`
114548
114549 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
114550
114551 - `PlatformTelemetryDestinationCreated object`
114552
114553 A telemetry destination was registered for the organization.
114554
114555 - `type: optional "platform_telemetry_destination_created"`
114556
114557 default: platform_telemetry_destination_created
114558
114559 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
114560
114561 - `APIActor object`
114562
114563 - `type: optional "api_actor"`
114564
114565 default: api_actor
114566
114567 - `api_key_id: string`
114568
114569 - `ip_address: string`
114570
114571 - `user_agent: string`
114572
114573 - `UserActor object`
114574
114575 - `type: optional "user_actor"`
114576
114577 default: user_actor
114578
114579 - `email_address: string`
114580
114581 format: email
114582
114583 - `ip_address: string`
114584
114585 - `user_agent: string`
114586
114587 - `user_id: string`
114588
114589 - `UnauthenticatedUserActor object`
114590
114591 - `type: optional "unauthenticated_user_actor"`
114592
114593 default: unauthenticated_user_actor
114594
114595 - `ip_address: string`
114596
114597 - `user_agent: string`
114598
114599 - `unauthenticated_email_address: optional string or null`
114600
114601 format: email
114602
114603 - `AnthropicActor object`
114604
114605 - `type: optional "anthropic_actor"`
114606
114607 default: anthropic_actor
114608
114609 - `email_address: optional string or null`
114610
114611 format: email
114612
114613 - `SystemActor object`
114614
114615 Automated background processing performed by Anthropic systems, acting
114616 without a user or customer credential.
114617
114618 - `type: optional "system_actor"`
114619
114620 default: system_actor
114621
114622 - `service: optional string or null`
114623
114624 Name of the automated process that performed the action, when known.
114625
114626 - `AdminAPIKeyActor object`
114627
114628 - `type: optional "admin_api_key_actor"`
114629
114630 default: admin_api_key_actor
114631
114632 - `admin_api_key_id: string`
114633
114634 - `ip_address: string`
114635
114636 - `user_agent: string`
114637
114638 - `ServiceAccountActor object`
114639
114640 - `type: optional "service_account_actor"`
114641
114642 default: service_account_actor
114643
114644 - `ip_address: string`
114645
114646 - `service_account_id: string`
114647
114648 - `user_agent: string`
114649
114650 - `ScimDirectorySyncActor object`
114651
114652 - `type: optional "scim_directory_sync_actor"`
114653
114654 default: scim_directory_sync_actor
114655
114656 - `directory_id: string`
114657
114658 - `workos_event_id: string`
114659
114660 - `idp_connection_type: optional string or null`
114661
114662 - `FederatedIdentityActor object`
114663
114664 A federated external workload authenticated via a verified OIDC token.
114665
114666 Carries the verified issuer, subject, and audience claims from the
114667 presented JWT.
114668
114669 - `type: optional "federated_identity_actor"`
114670
114671 default: federated_identity_actor
114672
114673 - `issuer: string`
114674
114675 - `subject: string`
114676
114677 - `audience: optional array of string`
114678
114679 - `ip_address: optional string or null`
114680
114681 - `user_agent: optional string or null`
114682
114683 - `FederatedActor object`
114684
114685 An external identity asserted by a trusted provider — a cloud-provider
114686 gateway or a customer-registered federation issuer — acting without an
114687 Anthropic-provisioned account or service account.
114688
114689 - `type: optional "federated_actor"`
114690
114691 default: federated_actor
114692
114693 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
114694
114695 - `FederatedActorAwsProvider object`
114696
114697 Asserting party: the AWS account the organization is bound to.
114698
114699 - `type: optional "aws"`
114700
114701 default: aws
114702
114703 - `account_id: string`
114704
114705 - `signed_principal: string`
114706
114707 The AWS-signed ARN of the IAM principal that requested the token.
114708
114709 - `FederatedActorAzureProvider object`
114710
114711 Asserting party: the Azure subscription the organization is bound to.
114712
114713 - `type: optional "azure"`
114714
114715 default: azure
114716
114717 - `subscription_id: string`
114718
114719 - `FederatedActorGcpProvider object`
114720
114721 Asserting party: the GCP project the organization is bound to.
114722
114723 - `type: optional "gcp"`
114724
114725 default: gcp
114726
114727 - `project_number: string`
114728
114729 - `FederatedActorOidcProvider object`
114730
114731 Asserting party: a customer-registered OIDC federation issuer.
114732
114733 - `type: optional "oidc"`
114734
114735 default: oidc
114736
114737 - `issuer: optional string or null`
114738
114739 The federation issuer's URL. Null when the presented credential failed verification.
114740
114741 - `ip_address: optional string or null`
114742
114743 - `subject: optional string or null`
114744
114745 The provider's verified identifier for the caller; its form depends on the provider.
114746
114747 - `user_agent: optional string or null`
114748
114749 - `AttestedDeviceActor object`
114750
114751 An attested mobile device authenticated via Apple App Attest.
114752
114753 - `type: optional "attested_device_actor"`
114754
114755 default: attested_device_actor
114756
114757 - `external_client_id: string`
114758
114759 - `kid_hash: string`
114760
114761 - `ip_address: optional string or null`
114762
114763 - `user_agent: optional string or null`
114764
114765 - `telemetry_destination_id: string`
114766
114767 Tagged telemetry destination ID, e.g. "tdst_01HX...".
114768
114769 - `id: optional string`
114770
114771 Unique identifier for the activity e.g. 'activity_abcd1234'
114772
114773 - `created_at: optional string`
114774
114775 When this activity occurred.
114776
114777 format: date-time
114778
114779 - `endpoint_url: optional string or null`
114780
114781 The destination's endpoint URL as stored, e.g. "https://collector.example.com/otlp"; the API refuses credentials, query strings and fragments in this URL.
114782
114783 - `organization_id: optional string or null`
114784
114785 Organization ID this activity is associated with
114786
114787 - `organization_uuid: optional string or null`
114788
114789 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
114790
114791 - `traces: optional object or null`
114792
114793 The destination's settings for traces, as the API returns them.
114794
114795 - `content_mode: string`
114796
114797 What the exported spans contain: "metadata_only", or "content" when they also carry message and tool content.
114798
114799 - `enabled: boolean`
114800
114801 Whether the destination receives traces.
114802
114803 - `endpoint_url: optional string or null`
114804
114805 The destination's separate traces URL as stored, e.g. "https://collector.example.com/v2/trace/otlp"; like the endpoint URL it never contains credentials, a query string or a fragment. Omitted when the destination has none; traces then go to the endpoint URL plus "/v1/traces".
114806
114807 - `max_content_bytes: optional number or null`
114808
114809 The most bytes of content that one exported span keeps; omitted when the destination sets no bound and only Anthropic's maximum applies.
114810
114811 - `workspaces: optional object or null`
114812
114813 Which workspaces the destination covers, as the API returns it: its type only, "all", "include" or "exclude". The workspaces put on its list by the same request are recorded as workspace_added activities.
114814
114815 - `type: string`
114816
114817 "all": every workspace of the organization; "include": the workspaces on the destination's list; "exclude": every workspace but those on its list.
114818
114819 - `PlatformTelemetryDestinationDeleted object`
114820
114821 A telemetry destination was deleted.
114822
114823 - `type: optional "platform_telemetry_destination_deleted"`
114824
114825 default: platform_telemetry_destination_deleted
114826
114827 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
114828
114829 - `APIActor object`
114830
114831 - `type: optional "api_actor"`
114832
114833 default: api_actor
114834
114835 - `api_key_id: string`
114836
114837 - `ip_address: string`
114838
114839 - `user_agent: string`
114840
114841 - `UserActor object`
114842
114843 - `type: optional "user_actor"`
114844
114845 default: user_actor
114846
114847 - `email_address: string`
114848
114849 format: email
114850
114851 - `ip_address: string`
114852
114853 - `user_agent: string`
114854
114855 - `user_id: string`
114856
114857 - `UnauthenticatedUserActor object`
114858
114859 - `type: optional "unauthenticated_user_actor"`
114860
114861 default: unauthenticated_user_actor
114862
114863 - `ip_address: string`
114864
114865 - `user_agent: string`
114866
114867 - `unauthenticated_email_address: optional string or null`
114868
114869 format: email
114870
114871 - `AnthropicActor object`
114872
114873 - `type: optional "anthropic_actor"`
114874
114875 default: anthropic_actor
114876
114877 - `email_address: optional string or null`
114878
114879 format: email
114880
114881 - `SystemActor object`
114882
114883 Automated background processing performed by Anthropic systems, acting
114884 without a user or customer credential.
114885
114886 - `type: optional "system_actor"`
114887
114888 default: system_actor
114889
114890 - `service: optional string or null`
114891
114892 Name of the automated process that performed the action, when known.
114893
114894 - `AdminAPIKeyActor object`
114895
114896 - `type: optional "admin_api_key_actor"`
114897
114898 default: admin_api_key_actor
114899
114900 - `admin_api_key_id: string`
114901
114902 - `ip_address: string`
114903
114904 - `user_agent: string`
114905
114906 - `ServiceAccountActor object`
114907
114908 - `type: optional "service_account_actor"`
114909
114910 default: service_account_actor
114911
114912 - `ip_address: string`
114913
114914 - `service_account_id: string`
114915
114916 - `user_agent: string`
114917
114918 - `ScimDirectorySyncActor object`
114919
114920 - `type: optional "scim_directory_sync_actor"`
114921
114922 default: scim_directory_sync_actor
114923
114924 - `directory_id: string`
114925
114926 - `workos_event_id: string`
114927
114928 - `idp_connection_type: optional string or null`
114929
114930 - `FederatedIdentityActor object`
114931
114932 A federated external workload authenticated via a verified OIDC token.
114933
114934 Carries the verified issuer, subject, and audience claims from the
114935 presented JWT.
114936
114937 - `type: optional "federated_identity_actor"`
114938
114939 default: federated_identity_actor
114940
114941 - `issuer: string`
114942
114943 - `subject: string`
114944
114945 - `audience: optional array of string`
114946
114947 - `ip_address: optional string or null`
114948
114949 - `user_agent: optional string or null`
114950
114951 - `FederatedActor object`
114952
114953 An external identity asserted by a trusted provider — a cloud-provider
114954 gateway or a customer-registered federation issuer — acting without an
114955 Anthropic-provisioned account or service account.
114956
114957 - `type: optional "federated_actor"`
114958
114959 default: federated_actor
114960
114961 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
114962
114963 - `FederatedActorAwsProvider object`
114964
114965 Asserting party: the AWS account the organization is bound to.
114966
114967 - `type: optional "aws"`
114968
114969 default: aws
114970
114971 - `account_id: string`
114972
114973 - `signed_principal: string`
114974
114975 The AWS-signed ARN of the IAM principal that requested the token.
114976
114977 - `FederatedActorAzureProvider object`
114978
114979 Asserting party: the Azure subscription the organization is bound to.
114980
114981 - `type: optional "azure"`
114982
114983 default: azure
114984
114985 - `subscription_id: string`
114986
114987 - `FederatedActorGcpProvider object`
114988
114989 Asserting party: the GCP project the organization is bound to.
114990
114991 - `type: optional "gcp"`
114992
114993 default: gcp
114994
114995 - `project_number: string`
114996
114997 - `FederatedActorOidcProvider object`
114998
114999 Asserting party: a customer-registered OIDC federation issuer.
115000
115001 - `type: optional "oidc"`
115002
115003 default: oidc
115004
115005 - `issuer: optional string or null`
115006
115007 The federation issuer's URL. Null when the presented credential failed verification.
115008
115009 - `ip_address: optional string or null`
115010
115011 - `subject: optional string or null`
115012
115013 The provider's verified identifier for the caller; its form depends on the provider.
115014
115015 - `user_agent: optional string or null`
115016
115017 - `AttestedDeviceActor object`
115018
115019 An attested mobile device authenticated via Apple App Attest.
115020
115021 - `type: optional "attested_device_actor"`
115022
115023 default: attested_device_actor
115024
115025 - `external_client_id: string`
115026
115027 - `kid_hash: string`
115028
115029 - `ip_address: optional string or null`
115030
115031 - `user_agent: optional string or null`
115032
115033 - `telemetry_destination_id: string`
115034
115035 Tagged telemetry destination ID, e.g. "tdst_01HX...".
115036
115037 - `id: optional string`
115038
115039 Unique identifier for the activity e.g. 'activity_abcd1234'
115040
115041 - `created_at: optional string`
115042
115043 When this activity occurred.
115044
115045 format: date-time
115046
115047 - `organization_id: optional string or null`
115048
115049 Organization ID this activity is associated with
115050
115051 - `organization_uuid: optional string or null`
115052
115053 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
115054
115055 - `PlatformTelemetryDestinationUpdated object`
115056
115057 A telemetry destination's configuration was updated. State changes and changes of its workspace scope (the type, or the list through an update's workspace_ids) are included; the workspaces an update took off or put on the list are also recorded as workspace_removed and workspace_added activities. Previous and current values are recorded only for the endpoint URL, the traces URL, the content mode and the workspaces type.
115058
115059 - `type: optional "platform_telemetry_destination_updated"`
115060
115061 default: platform_telemetry_destination_updated
115062
115063 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
115064
115065 - `APIActor object`
115066
115067 - `type: optional "api_actor"`
115068
115069 default: api_actor
115070
115071 - `api_key_id: string`
115072
115073 - `ip_address: string`
115074
115075 - `user_agent: string`
115076
115077 - `UserActor object`
115078
115079 - `type: optional "user_actor"`
115080
115081 default: user_actor
115082
115083 - `email_address: string`
115084
115085 format: email
115086
115087 - `ip_address: string`
115088
115089 - `user_agent: string`
115090
115091 - `user_id: string`
115092
115093 - `UnauthenticatedUserActor object`
115094
115095 - `type: optional "unauthenticated_user_actor"`
115096
115097 default: unauthenticated_user_actor
115098
115099 - `ip_address: string`
115100
115101 - `user_agent: string`
115102
115103 - `unauthenticated_email_address: optional string or null`
115104
115105 format: email
115106
115107 - `AnthropicActor object`
115108
115109 - `type: optional "anthropic_actor"`
115110
115111 default: anthropic_actor
115112
115113 - `email_address: optional string or null`
115114
115115 format: email
115116
115117 - `SystemActor object`
115118
115119 Automated background processing performed by Anthropic systems, acting
115120 without a user or customer credential.
115121
115122 - `type: optional "system_actor"`
115123
115124 default: system_actor
115125
115126 - `service: optional string or null`
115127
115128 Name of the automated process that performed the action, when known.
115129
115130 - `AdminAPIKeyActor object`
115131
115132 - `type: optional "admin_api_key_actor"`
115133
115134 default: admin_api_key_actor
115135
115136 - `admin_api_key_id: string`
115137
115138 - `ip_address: string`
115139
115140 - `user_agent: string`
115141
115142 - `ServiceAccountActor object`
115143
115144 - `type: optional "service_account_actor"`
115145
115146 default: service_account_actor
115147
115148 - `ip_address: string`
115149
115150 - `service_account_id: string`
115151
115152 - `user_agent: string`
115153
115154 - `ScimDirectorySyncActor object`
115155
115156 - `type: optional "scim_directory_sync_actor"`
115157
115158 default: scim_directory_sync_actor
115159
115160 - `directory_id: string`
115161
115162 - `workos_event_id: string`
115163
115164 - `idp_connection_type: optional string or null`
115165
115166 - `FederatedIdentityActor object`
115167
115168 A federated external workload authenticated via a verified OIDC token.
115169
115170 Carries the verified issuer, subject, and audience claims from the
115171 presented JWT.
115172
115173 - `type: optional "federated_identity_actor"`
115174
115175 default: federated_identity_actor
115176
115177 - `issuer: string`
115178
115179 - `subject: string`
115180
115181 - `audience: optional array of string`
115182
115183 - `ip_address: optional string or null`
115184
115185 - `user_agent: optional string or null`
115186
115187 - `FederatedActor object`
115188
115189 An external identity asserted by a trusted provider — a cloud-provider
115190 gateway or a customer-registered federation issuer — acting without an
115191 Anthropic-provisioned account or service account.
115192
115193 - `type: optional "federated_actor"`
115194
115195 default: federated_actor
115196
115197 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
115198
115199 - `FederatedActorAwsProvider object`
115200
115201 Asserting party: the AWS account the organization is bound to.
115202
115203 - `type: optional "aws"`
115204
115205 default: aws
115206
115207 - `account_id: string`
115208
115209 - `signed_principal: string`
115210
115211 The AWS-signed ARN of the IAM principal that requested the token.
115212
115213 - `FederatedActorAzureProvider object`
115214
115215 Asserting party: the Azure subscription the organization is bound to.
115216
115217 - `type: optional "azure"`
115218
115219 default: azure
115220
115221 - `subscription_id: string`
115222
115223 - `FederatedActorGcpProvider object`
115224
115225 Asserting party: the GCP project the organization is bound to.
115226
115227 - `type: optional "gcp"`
115228
115229 default: gcp
115230
115231 - `project_number: string`
115232
115233 - `FederatedActorOidcProvider object`
115234
115235 Asserting party: a customer-registered OIDC federation issuer.
115236
115237 - `type: optional "oidc"`
115238
115239 default: oidc
115240
115241 - `issuer: optional string or null`
115242
115243 The federation issuer's URL. Null when the presented credential failed verification.
115244
115245 - `ip_address: optional string or null`
115246
115247 - `subject: optional string or null`
115248
115249 The provider's verified identifier for the caller; its form depends on the provider.
115250
115251 - `user_agent: optional string or null`
115252
115253 - `AttestedDeviceActor object`
115254
115255 An attested mobile device authenticated via Apple App Attest.
115256
115257 - `type: optional "attested_device_actor"`
115258
115259 default: attested_device_actor
115260
115261 - `external_client_id: string`
115262
115263 - `kid_hash: string`
115264
115265 - `ip_address: optional string or null`
115266
115267 - `user_agent: optional string or null`
115268
115269 - `telemetry_destination_id: string`
115270
115271 Tagged telemetry destination ID, e.g. "tdst_01HX...".
115272
115273 - `id: optional string`
115274
115275 Unique identifier for the activity e.g. 'activity_abcd1234'
115276
115277 - `created_at: optional string`
115278
115279 When this activity occurred.
115280
115281 format: date-time
115282
115283 - `organization_id: optional string or null`
115284
115285 Organization ID this activity is associated with
115286
115287 - `organization_uuid: optional string or null`
115288
115289 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
115290
115291 - `updated_fields: optional array of string`
115292
115293 Names of the configuration fields whose value changed, e.g. "endpoint_url", "headers", "state"; "traces" when any setting for traces changed. Header names and values are never included.
115294
115295 - `updates: optional array of object`
115296
115297 The field-level value changes in this update, in this order: an "endpoint_url" entry when the endpoint URL changed, a "traces_endpoint_url" entry when the traces URL changed, a "traces_content_mode" entry when the content mode changed, and a "workspaces" entry ("all", "include" or "exclude") when the workspaces type changed; empty otherwise.
115298
115299 - `type: "endpoint_url" or "traces_content_mode" or "traces_endpoint_url" or 2 more`
115300
115301 The destination field that changed
115302
115303 - `"endpoint_url"`
115304
115305 - `"traces_content_mode"`
115306
115307 - `"traces_endpoint_url"`
115308
115309 - `"unspecified"`
115310
115311 - `"workspaces"`
115312
115313 - `current_value: string`
115314
115315 Field value immediately after this change
115316
115317 - `previous_value: string`
115318
115319 Field value immediately before this change
115320
115321 - `PlatformTelemetryDestinationWorkspaceAdded object`
115322
115323 A workspace was added to the workspace list of a telemetry destination. When the list type is "include", the destination starts to receive the spans of that workspace; when it is "exclude", the destination stops receiving them.
115324
115325 - `type: optional "platform_telemetry_destination_workspace_added"`
115326
115327 default: platform_telemetry_destination_workspace_added
115328
115329 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
115330
115331 - `APIActor object`
115332
115333 - `type: optional "api_actor"`
115334
115335 default: api_actor
115336
115337 - `api_key_id: string`
115338
115339 - `ip_address: string`
115340
115341 - `user_agent: string`
115342
115343 - `UserActor object`
115344
115345 - `type: optional "user_actor"`
115346
115347 default: user_actor
115348
115349 - `email_address: string`
115350
115351 format: email
115352
115353 - `ip_address: string`
115354
115355 - `user_agent: string`
115356
115357 - `user_id: string`
115358
115359 - `UnauthenticatedUserActor object`
115360
115361 - `type: optional "unauthenticated_user_actor"`
115362
115363 default: unauthenticated_user_actor
115364
115365 - `ip_address: string`
115366
115367 - `user_agent: string`
115368
115369 - `unauthenticated_email_address: optional string or null`
115370
115371 format: email
115372
115373 - `AnthropicActor object`
115374
115375 - `type: optional "anthropic_actor"`
115376
115377 default: anthropic_actor
115378
115379 - `email_address: optional string or null`
115380
115381 format: email
115382
115383 - `SystemActor object`
115384
115385 Automated background processing performed by Anthropic systems, acting
115386 without a user or customer credential.
115387
115388 - `type: optional "system_actor"`
115389
115390 default: system_actor
115391
115392 - `service: optional string or null`
115393
115394 Name of the automated process that performed the action, when known.
115395
115396 - `AdminAPIKeyActor object`
115397
115398 - `type: optional "admin_api_key_actor"`
115399
115400 default: admin_api_key_actor
115401
115402 - `admin_api_key_id: string`
115403
115404 - `ip_address: string`
115405
115406 - `user_agent: string`
115407
115408 - `ServiceAccountActor object`
115409
115410 - `type: optional "service_account_actor"`
115411
115412 default: service_account_actor
115413
115414 - `ip_address: string`
115415
115416 - `service_account_id: string`
115417
115418 - `user_agent: string`
115419
115420 - `ScimDirectorySyncActor object`
115421
115422 - `type: optional "scim_directory_sync_actor"`
115423
115424 default: scim_directory_sync_actor
115425
115426 - `directory_id: string`
115427
115428 - `workos_event_id: string`
115429
115430 - `idp_connection_type: optional string or null`
115431
115432 - `FederatedIdentityActor object`
115433
115434 A federated external workload authenticated via a verified OIDC token.
115435
115436 Carries the verified issuer, subject, and audience claims from the
115437 presented JWT.
115438
115439 - `type: optional "federated_identity_actor"`
115440
115441 default: federated_identity_actor
115442
115443 - `issuer: string`
115444
115445 - `subject: string`
115446
115447 - `audience: optional array of string`
115448
115449 - `ip_address: optional string or null`
115450
115451 - `user_agent: optional string or null`
115452
115453 - `FederatedActor object`
115454
115455 An external identity asserted by a trusted provider — a cloud-provider
115456 gateway or a customer-registered federation issuer — acting without an
115457 Anthropic-provisioned account or service account.
115458
115459 - `type: optional "federated_actor"`
115460
115461 default: federated_actor
115462
115463 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
115464
115465 - `FederatedActorAwsProvider object`
115466
115467 Asserting party: the AWS account the organization is bound to.
115468
115469 - `type: optional "aws"`
115470
115471 default: aws
115472
115473 - `account_id: string`
115474
115475 - `signed_principal: string`
115476
115477 The AWS-signed ARN of the IAM principal that requested the token.
115478
115479 - `FederatedActorAzureProvider object`
115480
115481 Asserting party: the Azure subscription the organization is bound to.
115482
115483 - `type: optional "azure"`
115484
115485 default: azure
115486
115487 - `subscription_id: string`
115488
115489 - `FederatedActorGcpProvider object`
115490
115491 Asserting party: the GCP project the organization is bound to.
115492
115493 - `type: optional "gcp"`
115494
115495 default: gcp
115496
115497 - `project_number: string`
115498
115499 - `FederatedActorOidcProvider object`
115500
115501 Asserting party: a customer-registered OIDC federation issuer.
115502
115503 - `type: optional "oidc"`
115504
115505 default: oidc
115506
115507 - `issuer: optional string or null`
115508
115509 The federation issuer's URL. Null when the presented credential failed verification.
115510
115511 - `ip_address: optional string or null`
115512
115513 - `subject: optional string or null`
115514
115515 The provider's verified identifier for the caller; its form depends on the provider.
115516
115517 - `user_agent: optional string or null`
115518
115519 - `AttestedDeviceActor object`
115520
115521 An attested mobile device authenticated via Apple App Attest.
115522
115523 - `type: optional "attested_device_actor"`
115524
115525 default: attested_device_actor
115526
115527 - `external_client_id: string`
115528
115529 - `kid_hash: string`
115530
115531 - `ip_address: optional string or null`
115532
115533 - `user_agent: optional string or null`
115534
115535 - `telemetry_destination_id: string`
115536
115537 Tagged telemetry destination ID, e.g. "tdst_01HX...".
115538
115539 - `workspace_id: string`
115540
115541 Tagged ID of the workspace put on the list, e.g. "wrkspc_01HX...".
115542
115543 - `id: optional string`
115544
115545 Unique identifier for the activity e.g. 'activity_abcd1234'
115546
115547 - `created_at: optional string`
115548
115549 When this activity occurred.
115550
115551 format: date-time
115552
115553 - `organization_id: optional string or null`
115554
115555 Organization ID this activity is associated with
115556
115557 - `organization_uuid: optional string or null`
115558
115559 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
115560
115561 - `PlatformTelemetryDestinationWorkspaceRemoved object`
115562
115563 A workspace was removed from the workspace list of a telemetry destination, by a change to the list or because the destination was deleted. When the list type is "include", the destination stops receiving the spans of that workspace; when it is "exclude", the destination receives them again unless the destination was deleted.
115564
115565 - `type: optional "platform_telemetry_destination_workspace_removed"`
115566
115567 default: platform_telemetry_destination_workspace_removed
115568
115569 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
115570
115571 - `APIActor object`
115572
115573 - `type: optional "api_actor"`
115574
115575 default: api_actor
115576
115577 - `api_key_id: string`
115578
115579 - `ip_address: string`
115580
115581 - `user_agent: string`
115582
115583 - `UserActor object`
115584
115585 - `type: optional "user_actor"`
115586
115587 default: user_actor
115588
115589 - `email_address: string`
115590
115591 format: email
115592
115593 - `ip_address: string`
115594
115595 - `user_agent: string`
115596
115597 - `user_id: string`
115598
115599 - `UnauthenticatedUserActor object`
115600
115601 - `type: optional "unauthenticated_user_actor"`
115602
115603 default: unauthenticated_user_actor
115604
115605 - `ip_address: string`
115606
115607 - `user_agent: string`
115608
115609 - `unauthenticated_email_address: optional string or null`
115610
115611 format: email
115612
115613 - `AnthropicActor object`
115614
115615 - `type: optional "anthropic_actor"`
115616
115617 default: anthropic_actor
115618
115619 - `email_address: optional string or null`
115620
115621 format: email
115622
115623 - `SystemActor object`
115624
115625 Automated background processing performed by Anthropic systems, acting
115626 without a user or customer credential.
115627
115628 - `type: optional "system_actor"`
115629
115630 default: system_actor
115631
115632 - `service: optional string or null`
115633
115634 Name of the automated process that performed the action, when known.
115635
115636 - `AdminAPIKeyActor object`
115637
115638 - `type: optional "admin_api_key_actor"`
115639
115640 default: admin_api_key_actor
115641
115642 - `admin_api_key_id: string`
115643
115644 - `ip_address: string`
115645
115646 - `user_agent: string`
115647
115648 - `ServiceAccountActor object`
115649
115650 - `type: optional "service_account_actor"`
115651
115652 default: service_account_actor
115653
115654 - `ip_address: string`
115655
115656 - `service_account_id: string`
115657
115658 - `user_agent: string`
115659
115660 - `ScimDirectorySyncActor object`
115661
115662 - `type: optional "scim_directory_sync_actor"`
115663
115664 default: scim_directory_sync_actor
115665
115666 - `directory_id: string`
115667
115668 - `workos_event_id: string`
115669
115670 - `idp_connection_type: optional string or null`
115671
115672 - `FederatedIdentityActor object`
115673
115674 A federated external workload authenticated via a verified OIDC token.
115675
115676 Carries the verified issuer, subject, and audience claims from the
115677 presented JWT.
115678
115679 - `type: optional "federated_identity_actor"`
115680
115681 default: federated_identity_actor
115682
115683 - `issuer: string`
115684
115685 - `subject: string`
115686
115687 - `audience: optional array of string`
115688
115689 - `ip_address: optional string or null`
115690
115691 - `user_agent: optional string or null`
115692
115693 - `FederatedActor object`
115694
115695 An external identity asserted by a trusted provider — a cloud-provider
115696 gateway or a customer-registered federation issuer — acting without an
115697 Anthropic-provisioned account or service account.
115698
115699 - `type: optional "federated_actor"`
115700
115701 default: federated_actor
115702
115703 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
115704
115705 - `FederatedActorAwsProvider object`
115706
115707 Asserting party: the AWS account the organization is bound to.
115708
115709 - `type: optional "aws"`
115710
115711 default: aws
115712
115713 - `account_id: string`
115714
115715 - `signed_principal: string`
115716
115717 The AWS-signed ARN of the IAM principal that requested the token.
115718
115719 - `FederatedActorAzureProvider object`
115720
115721 Asserting party: the Azure subscription the organization is bound to.
115722
115723 - `type: optional "azure"`
115724
115725 default: azure
115726
115727 - `subscription_id: string`
115728
115729 - `FederatedActorGcpProvider object`
115730
115731 Asserting party: the GCP project the organization is bound to.
115732
115733 - `type: optional "gcp"`
115734
115735 default: gcp
115736
115737 - `project_number: string`
115738
115739 - `FederatedActorOidcProvider object`
115740
115741 Asserting party: a customer-registered OIDC federation issuer.
115742
115743 - `type: optional "oidc"`
115744
115745 default: oidc
115746
115747 - `issuer: optional string or null`
115748
115749 The federation issuer's URL. Null when the presented credential failed verification.
115750
115751 - `ip_address: optional string or null`
115752
115753 - `subject: optional string or null`
115754
115755 The provider's verified identifier for the caller; its form depends on the provider.
115756
115757 - `user_agent: optional string or null`
115758
115759 - `AttestedDeviceActor object`
115760
115761 An attested mobile device authenticated via Apple App Attest.
115762
115763 - `type: optional "attested_device_actor"`
115764
115765 default: attested_device_actor
115766
115767 - `external_client_id: string`
115768
115769 - `kid_hash: string`
115770
115771 - `ip_address: optional string or null`
115772
115773 - `user_agent: optional string or null`
115774
115775 - `telemetry_destination_id: string`
115776
115777 Tagged telemetry destination ID, e.g. "tdst_01HX...".
115778
115779 - `workspace_id: string`
115780
115781 Tagged ID of the workspace taken off the list, e.g. "wrkspc_01HX...".
115782
115783 - `id: optional string`
115784
115785 Unique identifier for the activity e.g. 'activity_abcd1234'
115786
115787 - `created_at: optional string`
115788
115789 When this activity occurred.
115790
115791 format: date-time
115792
115793 - `organization_id: optional string or null`
115794
115795 Organization ID this activity is associated with
115796
115797 - `organization_uuid: optional string or null`
115798
115799 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
115800
112113115801 - `PlatformUsageReportClaudeCodeViewed object`
112114115802
112115115803 The Claude Code usage report was viewed.
from line 146262
142574146262
142575146263 default: text
142576146264
146265 - `added_as_context: boolean`
146266
146267 True when this text block was added to a human message as context for the assistant: the user did not type it in the message box. The wording of the app's own notes for the assistant is not exported: such a block has an empty `text`. Other added text is exported and can include content that the user or their app chose. False does not mean that the user typed the text. Always false on the last text block of a message, on assistant messages, and on messages sent before 2026-10-09, whose notes are exported in full.
146268
146269 default: false
146270
142577146271 - `text: string`
142578146272
142579146273 Text content from human or assistant
142580146274
142581146275 - `thinking_redacted: boolean`
142582146276
142583 True when content enclosed in the assistant's internal-reasoning tags (or the tag markup itself) was removed from `text` during export. Removal never occurs with this field false. Always false on human messages, whose text is exported verbatim.
146277 True when content enclosed in the assistant's internal-reasoning tags (or the tag markup itself) was removed from `text` during export. Removal never occurs with this field false. Always false on human messages.
142584146278
142585146279 default: false
142586146280
from line 146537
142843146537 "type": "text",
142844146538 "text": "Can you help me draft requirements for our new dashboard feature?",
142845146539 "truncated": false,
142846 "thinking_redacted": false
146540 "thinking_redacted": false,
146541 "added_as_context": false
142847146542 }
142848146543 ],
142849146544 "files": [
from line 146561
142866146561 "type": "text",
142867146562 "text": "I'd be happy to help you draft requirements for your dashboard feature...",
142868146563 "truncated": false,
142869 "thinking_redacted": false
146564 "thinking_redacted": false,
146565 "added_as_context": false
142870146566 }
142871146567 ],
142872146568 "artifacts": [
from line 146583
142887146583 "type": "text",
142888146584 "text": "Are there any open support tickets about the dashboard?",
142889146585 "truncated": false,
142890 "thinking_redacted": false
146586 "thinking_redacted": false,
146587 "added_as_context": false
142891146588 }
142892146589 ]
142893146590 },
from line 146621
142924146621 "type": "text",
142925146622 "text": "There are two open tickets: one about slow loading and one about a missing export button.",
142926146623 "truncated": false,
142927 "thinking_redacted": false
146624 "thinking_redacted": false,
146625 "added_as_context": false
142928146626 }
142929146627 ]
142930146628 }
from line 149197
145499149197
145500149198 Artifact identifier (tagged ID)
145501149199
145502 - `artifact_type: "claude_design" or "claude_design_systems" or "claude_docs" or 4 more`
149200 - `artifact_type: "claude_dashboards" or "claude_design" or "claude_design_systems" or 5 more`
149201
149202 Which kind of Artifact this is: `code` for a site published from Claude Code, or the built-in Artifact type it was made from — `claude_docs` (Claude Docs), `claude_slides` (Slides), `claude_design` (Design), `claude_design_systems` (a design system), `claude_motion` (Motion) or `claude_dashboards` (Dashboards). `other` is an Artifact made from a built-in type this list does not name yet.
145503149203
145504 Which kind of Artifact this is: `code` for a site published from Claude Code, or the built-in Artifact type it was made from — `claude_docs` (Claude Docs), `claude_slides` (Slides), `claude_design` (Design), `claude_design_systems` (a design system) or `claude_motion` (Motion). `other` is an Artifact made from a built-in type this list does not name yet.
149204 - `"claude_dashboards"`
145505149205
145506149206 - `"claude_design"`
145507149207
145508149208
No line in this hunk matches that.