Activities changedapi/compliance/activities
Nearest release: v2.1.309, published 2 hours after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+7,278added
Lines−14removed
From line
17
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits32to this page, all time
The whole hunk
from line 17, old and new numbered
/
This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.
The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.
from line 17
1717
1818### Query parameters
1919
20- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 544 more`
20- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "account_migration_completed" or 558 more`
2121
2222 Filter activities by type. See the response `data` schema for the additional fields each type returns. Cannot be combined with `exclude_activity_types[]`.
2323
from line 29
2929
3030 User-initiated self-service account deletion.
3131
32 - `"account_migration_completed"`
33
34 A personal Claude account's migration into the organization finished: the migrated data is now part of the organization.
35
36 - `"account_migration_failed"`
37
38 A personal Claude account's migration into the organization did not complete.
39
40 - `"account_migration_started"`
41
42 A personal Claude account began migrating into the organization: its data, including conversations, projects and files, is being moved from the member's personal account into this organization.
43
3244 - `"admin_api_key_created"`
3345
3446 An admin API key was created.
from line 361
349361
350362 Claude Code Review configuration was enabled/disabled for an org.
351363
364 - `"claude_code_review_promo_enrolled"`
365
366 An organization admin enrolled the organization in a Claude Code Review promotion, for example by claiming promotional credits.
367
352368 - `"claude_code_review_repository_added"`
353369
354370 A repository was added to org-level Claude Code Review configuration.
from line 419
403419
404420 - `"claude_code_security_scan_project_updated"`
405421
406 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience.
422 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience, or a user paused the project's scheduled scanning, unpaused it, or lifted a billing pause on it.
407423
408424 - `"claude_code_security_scan_project_visibility_updated"`
409425
from line 737
721737
722738 SAML IdP configuration updated for a public sector organization.
723739
740 - `"claude_skill_auto_disabled"`
741
742 A skill that had been turned on for a member automatically was turned off for them automatically, not by the member; reason says why. A member turning a skill off themselves is recorded as claude_skill_disabled.
743
744 - `"claude_skill_auto_enabled"`
745
746 A skill was turned on for a member automatically, not by the member; trigger gives the cause, such as another member sharing an eligible skill with them. A member turning a skill on themselves is recorded as claude_skill_enabled.
747
724748 - `"claude_skill_created"`
725749
726750 Skill was created.
from line 897
873897
874898 A new version of an existing org-owned desktop extension was uploaded.
875899
900 - `"domain_claim_cancelled"`
901
902 A pending domain claim was cancelled before it took effect, so the personal accounts on the claimed domains will no longer be migrated or deactivated at its deadline.
903
904 - `"domain_claim_deadline_updated"`
905
906 The migration deadline of a pending domain claim was moved to a later or an earlier date by Anthropic staff or an automated process.
907
876908 - `"domain_claim_initiated"`
877909
878910 Domain capture claim initiated over personal accounts on verified domains.
from line 1909
18771909
18781910 An org-level spend limit snooze/ignore state was changed.
18791911
1912 - `"platform_telemetry_destination_auto_disabled"`
1913
1914 A telemetry destination was disabled automatically after deliveries to it failed, so no telemetry is sent to it until an administrator enables it again.
1915
1916 - `"platform_telemetry_destination_created"`
1917
1918 A telemetry destination was registered for the organization.
1919
1920 - `"platform_telemetry_destination_deleted"`
1921
1922 A telemetry destination was deleted.
1923
1924 - `"platform_telemetry_destination_updated"`
1925
1926 A telemetry destination's configuration was updated. State changes and changes of its workspace scope (the type, or the list through an update's workspace_ids) are included; the workspaces an update took off or put on the list are also recorded as workspace_removed and workspace_added activities. Previous and current values are recorded only for the endpoint URL, the traces URL, the content mode and the workspaces type.
1927
1928 - `"platform_telemetry_destination_workspace_added"`
1929
1930 A workspace was added to the workspace list of a telemetry destination. When the list type is "include", the destination starts to receive the spans of that workspace; when it is "exclude", the destination stops receiving them.
1931
1932 - `"platform_telemetry_destination_workspace_removed"`
1933
1934 A workspace was removed from the workspace list of a telemetry destination, by a change to the list or because the destination was deleted. When the list type is "include", the destination stops receiving the spans of that workspace; when it is "exclude", the destination receives them again unless the destination was deleted.
1935
18801936 - `"platform_usage_report_claude_code_viewed"`
18811937
18821938 The Claude Code usage report was viewed.
from line 2320
22642320
22652321 format: date-time
22662322
2267- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 544 more`
2323- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "account_migration_completed" or 558 more`
22682324
22692325 Exclude activities of these types. Cannot be combined with `activity_types[]`.
22702326
from line 2332
22762332
22772333 User-initiated self-service account deletion.
22782334
2335 - `"account_migration_completed"`
2336
2337 A personal Claude account's migration into the organization finished: the migrated data is now part of the organization.
2338
2339 - `"account_migration_failed"`
2340
2341 A personal Claude account's migration into the organization did not complete.
2342
2343 - `"account_migration_started"`
2344
2345 A personal Claude account began migrating into the organization: its data, including conversations, projects and files, is being moved from the member's personal account into this organization.
2346
22792347 - `"admin_api_key_created"`
22802348
22812349 An admin API key was created.
from line 2664
25962664
25972665 Claude Code Review configuration was enabled/disabled for an org.
25982666
2667 - `"claude_code_review_promo_enrolled"`
2668
2669 An organization admin enrolled the organization in a Claude Code Review promotion, for example by claiming promotional credits.
2670
25992671 - `"claude_code_review_repository_added"`
26002672
26012673 A repository was added to org-level Claude Code Review configuration.
from line 2722
26502722
26512723 - `"claude_code_security_scan_project_updated"`
26522724
2653 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience.
2725 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience, or a user paused the project's scheduled scanning, unpaused it, or lifted a billing pause on it.
26542726
26552727 - `"claude_code_security_scan_project_visibility_updated"`
26562728
from line 3040
29683040
29693041 SAML IdP configuration updated for a public sector organization.
29703042
3043 - `"claude_skill_auto_disabled"`
3044
3045 A skill that had been turned on for a member automatically was turned off for them automatically, not by the member; reason says why. A member turning a skill off themselves is recorded as claude_skill_disabled.
3046
3047 - `"claude_skill_auto_enabled"`
3048
3049 A skill was turned on for a member automatically, not by the member; trigger gives the cause, such as another member sharing an eligible skill with them. A member turning a skill on themselves is recorded as claude_skill_enabled.
3050
29713051 - `"claude_skill_created"`
29723052
29733053 Skill was created.
from line 3200
31203200
31213201 A new version of an existing org-owned desktop extension was uploaded.
31223202
3203 - `"domain_claim_cancelled"`
3204
3205 A pending domain claim was cancelled before it took effect, so the personal accounts on the claimed domains will no longer be migrated or deactivated at its deadline.
3206
3207 - `"domain_claim_deadline_updated"`
3208
3209 The migration deadline of a pending domain claim was moved to a later or an earlier date by Anthropic staff or an automated process.
3210
31233211 - `"domain_claim_initiated"`
31243212
31253213 Domain capture claim initiated over personal accounts on verified domains.
from line 4212
41244212
41254213 An org-level spend limit snooze/ignore state was changed.
41264214
4215 - `"platform_telemetry_destination_auto_disabled"`
4216
4217 A telemetry destination was disabled automatically after deliveries to it failed, so no telemetry is sent to it until an administrator enables it again.
4218
4219 - `"platform_telemetry_destination_created"`
4220
4221 A telemetry destination was registered for the organization.
4222
4223 - `"platform_telemetry_destination_deleted"`
4224
4225 A telemetry destination was deleted.
4226
4227 - `"platform_telemetry_destination_updated"`
4228
4229 A telemetry destination's configuration was updated. State changes and changes of its workspace scope (the type, or the list through an update's workspace_ids) are included; the workspaces an update took off or put on the list are also recorded as workspace_removed and workspace_added activities. Previous and current values are recorded only for the endpoint URL, the traces URL, the content mode and the workspaces type.
4230
4231 - `"platform_telemetry_destination_workspace_added"`
4232
4233 A workspace was added to the workspace list of a telemetry destination. When the list type is "include", the destination starts to receive the spans of that workspace; when it is "exclude", the destination stops receiving them.
4234
4235 - `"platform_telemetry_destination_workspace_removed"`
4236
4237 A workspace was removed from the workspace list of a telemetry destination, by a change to the list or because the destination was deleted. When the list type is "include", the destination stops receiving the spans of that workspace; when it is "exclude", the destination receives them again unless the destination was deleted.
4238
41274239 - `"platform_usage_report_claude_code_viewed"`
41284240
41294241 The Claude Code usage report was viewed.
from line 4621
45094621
45104622### Returns
45114623
4512- `data: optional array of AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 544 more`
4624- `data: optional array of AbuseDecisionReceived or AccountDeleted or AccountMigrationCompleted or 558 more`
45134625
45144626 List of activity records. Each element's `type` field identifies which activity it is and which additional fields are present.
45154627
from line 5101
49895101
49905102 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
49915103
5104 - `AccountMigrationCompleted object`
5105
5106 A personal Claude account's migration into the organization finished: the migrated data is now part of the organization.
5107
5108 - `type: optional "account_migration_completed"`
5109
5110 default: account_migration_completed
5111
5112 - `account_migration_id: string`
5113
5114 Tagged ID of the migration, e.g. "amig_...", matching the account_migration_started activity that opened it.
5115
5116 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
5117
5118 - `APIActor object`
5119
5120 - `type: optional "api_actor"`
5121
5122 default: api_actor
5123
5124 - `api_key_id: string`
5125
5126 - `ip_address: string`
5127
5128 - `user_agent: string`
5129
5130 - `UserActor object`
5131
5132 - `type: optional "user_actor"`
5133
5134 default: user_actor
5135
5136 - `email_address: string`
5137
5138 format: email
5139
5140 - `ip_address: string`
5141
5142 - `user_agent: string`
5143
5144 - `user_id: string`
5145
5146 - `UnauthenticatedUserActor object`
5147
5148 - `type: optional "unauthenticated_user_actor"`
5149
5150 default: unauthenticated_user_actor
5151
5152 - `ip_address: string`
5153
5154 - `user_agent: string`
5155
5156 - `unauthenticated_email_address: optional string or null`
5157
5158 format: email
5159
5160 - `AnthropicActor object`
5161
5162 - `type: optional "anthropic_actor"`
5163
5164 default: anthropic_actor
5165
5166 - `email_address: optional string or null`
5167
5168 format: email
5169
5170 - `SystemActor object`
5171
5172 Automated background processing performed by Anthropic systems, acting
5173 without a user or customer credential.
5174
5175 - `type: optional "system_actor"`
5176
5177 default: system_actor
5178
5179 - `service: optional string or null`
5180
5181 Name of the automated process that performed the action, when known.
5182
5183 - `AdminAPIKeyActor object`
5184
5185 - `type: optional "admin_api_key_actor"`
5186
5187 default: admin_api_key_actor
5188
5189 - `admin_api_key_id: string`
5190
5191 - `ip_address: string`
5192
5193 - `user_agent: string`
5194
5195 - `ServiceAccountActor object`
5196
5197 - `type: optional "service_account_actor"`
5198
5199 default: service_account_actor
5200
5201 - `ip_address: string`
5202
5203 - `service_account_id: string`
5204
5205 - `user_agent: string`
5206
5207 - `ScimDirectorySyncActor object`
5208
5209 - `type: optional "scim_directory_sync_actor"`
5210
5211 default: scim_directory_sync_actor
5212
5213 - `directory_id: string`
5214
5215 - `workos_event_id: string`
5216
5217 - `idp_connection_type: optional string or null`
5218
5219 - `FederatedIdentityActor object`
5220
5221 A federated external workload authenticated via a verified OIDC token.
5222
5223 Carries the verified issuer, subject, and audience claims from the
5224 presented JWT.
5225
5226 - `type: optional "federated_identity_actor"`
5227
5228 default: federated_identity_actor
5229
5230 - `issuer: string`
5231
5232 - `subject: string`
5233
5234 - `audience: optional array of string`
5235
5236 - `ip_address: optional string or null`
5237
5238 - `user_agent: optional string or null`
5239
5240 - `FederatedActor object`
5241
5242 An external identity asserted by a trusted provider — a cloud-provider
5243 gateway or a customer-registered federation issuer — acting without an
5244 Anthropic-provisioned account or service account.
5245
5246 - `type: optional "federated_actor"`
5247
5248 default: federated_actor
5249
5250 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
5251
5252 - `FederatedActorAwsProvider object`
5253
5254 Asserting party: the AWS account the organization is bound to.
5255
5256 - `type: optional "aws"`
5257
5258 default: aws
5259
5260 - `account_id: string`
5261
5262 - `signed_principal: string`
5263
5264 The AWS-signed ARN of the IAM principal that requested the token.
5265
5266 - `FederatedActorAzureProvider object`
5267
5268 Asserting party: the Azure subscription the organization is bound to.
5269
5270 - `type: optional "azure"`
5271
5272 default: azure
5273
5274 - `subscription_id: string`
5275
5276 - `FederatedActorGcpProvider object`
5277
5278 Asserting party: the GCP project the organization is bound to.
5279
5280 - `type: optional "gcp"`
5281
5282 default: gcp
5283
5284 - `project_number: string`
5285
5286 - `FederatedActorOidcProvider object`
5287
5288 Asserting party: a customer-registered OIDC federation issuer.
5289
5290 - `type: optional "oidc"`
5291
5292 default: oidc
5293
5294 - `issuer: optional string or null`
5295
5296 The federation issuer's URL. Null when the presented credential failed verification.
5297
5298 - `ip_address: optional string or null`
5299
5300 - `subject: optional string or null`
5301
5302 The provider's verified identifier for the caller; its form depends on the provider.
5303
5304 - `user_agent: optional string or null`
5305
5306 - `AttestedDeviceActor object`
5307
5308 An attested mobile device authenticated via Apple App Attest.
5309
5310 - `type: optional "attested_device_actor"`
5311
5312 default: attested_device_actor
5313
5314 - `external_client_id: string`
5315
5316 - `kid_hash: string`
5317
5318 - `ip_address: optional string or null`
5319
5320 - `user_agent: optional string or null`
5321
5322 - `id: optional string`
5323
5324 Unique identifier for the activity e.g. 'activity_abcd1234'
5325
5326 - `created_at: optional string`
5327
5328 When this activity occurred.
5329
5330 format: date-time
5331
5332 - `migrated_user_email: optional string or null`
5333
5334 Email address of the user whose personal account was migrated, when known.
5335
5336 - `migrated_user_id: optional string or null`
5337
5338 Tagged ID of the user whose personal account was migrated, e.g. "user_...", when known.
5339
5340 - `organization_id: optional string or null`
5341
5342 Organization ID this activity is associated with
5343
5344 - `organization_uuid: optional string or null`
5345
5346 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
5347
5348 - `AccountMigrationFailed object`
5349
5350 A personal Claude account's migration into the organization did not complete.
5351
5352 - `type: optional "account_migration_failed"`
5353
5354 default: account_migration_failed
5355
5356 - `account_migration_id: string`
5357
5358 Tagged ID of the migration, e.g. "amig_...", matching the account_migration_started activity that opened it, if one was recorded; a later retry is a new migration with its own ID.
5359
5360 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
5361
5362 - `APIActor object`
5363
5364 - `type: optional "api_actor"`
5365
5366 default: api_actor
5367
5368 - `api_key_id: string`
5369
5370 - `ip_address: string`
5371
5372 - `user_agent: string`
5373
5374 - `UserActor object`
5375
5376 - `type: optional "user_actor"`
5377
5378 default: user_actor
5379
5380 - `email_address: string`
5381
5382 format: email
5383
5384 - `ip_address: string`
5385
5386 - `user_agent: string`
5387
5388 - `user_id: string`
5389
5390 - `UnauthenticatedUserActor object`
5391
5392 - `type: optional "unauthenticated_user_actor"`
5393
5394 default: unauthenticated_user_actor
5395
5396 - `ip_address: string`
5397
5398 - `user_agent: string`
5399
5400 - `unauthenticated_email_address: optional string or null`
5401
5402 format: email
5403
5404 - `AnthropicActor object`
5405
5406 - `type: optional "anthropic_actor"`
5407
5408 default: anthropic_actor
5409
5410 - `email_address: optional string or null`
5411
5412 format: email
5413
5414 - `SystemActor object`
5415
5416 Automated background processing performed by Anthropic systems, acting
5417 without a user or customer credential.
5418
5419 - `type: optional "system_actor"`
5420
5421 default: system_actor
5422
5423 - `service: optional string or null`
5424
5425 Name of the automated process that performed the action, when known.
5426
5427 - `AdminAPIKeyActor object`
5428
5429 - `type: optional "admin_api_key_actor"`
5430
5431 default: admin_api_key_actor
5432
5433 - `admin_api_key_id: string`
5434
5435 - `ip_address: string`
5436
5437 - `user_agent: string`
5438
5439 - `ServiceAccountActor object`
5440
5441 - `type: optional "service_account_actor"`
5442
5443 default: service_account_actor
5444
5445 - `ip_address: string`
5446
5447 - `service_account_id: string`
5448
5449 - `user_agent: string`
5450
5451 - `ScimDirectorySyncActor object`
5452
5453 - `type: optional "scim_directory_sync_actor"`
5454
5455 default: scim_directory_sync_actor
5456
5457 - `directory_id: string`
5458
5459 - `workos_event_id: string`
5460
5461 - `idp_connection_type: optional string or null`
5462
5463 - `FederatedIdentityActor object`
5464
5465 A federated external workload authenticated via a verified OIDC token.
5466
5467 Carries the verified issuer, subject, and audience claims from the
5468 presented JWT.
5469
5470 - `type: optional "federated_identity_actor"`
5471
5472 default: federated_identity_actor
5473
5474 - `issuer: string`
5475
5476 - `subject: string`
5477
5478 - `audience: optional array of string`
5479
5480 - `ip_address: optional string or null`
5481
5482 - `user_agent: optional string or null`
5483
5484 - `FederatedActor object`
5485
5486 An external identity asserted by a trusted provider — a cloud-provider
5487 gateway or a customer-registered federation issuer — acting without an
5488 Anthropic-provisioned account or service account.
5489
5490 - `type: optional "federated_actor"`
5491
5492 default: federated_actor
5493
5494 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
5495
5496 - `FederatedActorAwsProvider object`
5497
5498 Asserting party: the AWS account the organization is bound to.
5499
5500 - `type: optional "aws"`
5501
5502 default: aws
5503
5504 - `account_id: string`
5505
5506 - `signed_principal: string`
5507
5508 The AWS-signed ARN of the IAM principal that requested the token.
5509
5510 - `FederatedActorAzureProvider object`
5511
5512 Asserting party: the Azure subscription the organization is bound to.
5513
5514 - `type: optional "azure"`
5515
5516 default: azure
5517
5518 - `subscription_id: string`
5519
5520 - `FederatedActorGcpProvider object`
5521
5522 Asserting party: the GCP project the organization is bound to.
5523
5524 - `type: optional "gcp"`
5525
5526 default: gcp
5527
5528 - `project_number: string`
5529
5530 - `FederatedActorOidcProvider object`
5531
5532 Asserting party: a customer-registered OIDC federation issuer.
5533
5534 - `type: optional "oidc"`
5535
5536 default: oidc
5537
5538 - `issuer: optional string or null`
5539
5540 The federation issuer's URL. Null when the presented credential failed verification.
5541
5542 - `ip_address: optional string or null`
5543
5544 - `subject: optional string or null`
5545
5546 The provider's verified identifier for the caller; its form depends on the provider.
5547
5548 - `user_agent: optional string or null`
5549
5550 - `AttestedDeviceActor object`
5551
5552 An attested mobile device authenticated via Apple App Attest.
5553
5554 - `type: optional "attested_device_actor"`
5555
5556 default: attested_device_actor
5557
5558 - `external_client_id: string`
5559
5560 - `kid_hash: string`
5561
5562 - `ip_address: optional string or null`
5563
5564 - `user_agent: optional string or null`
5565
5566 - `id: optional string`
5567
5568 Unique identifier for the activity e.g. 'activity_abcd1234'
5569
5570 - `created_at: optional string`
5571
5572 When this activity occurred.
5573
5574 format: date-time
5575
5576 - `failure_reasons: optional array of "already_member_of_target" or "already_migrating" or "anthropic_staff_action" or 12 more`
5577
5578 Why the migration did not complete, each reason listed once. In these values "source" is the member's personal account and "target" is this organization. "source_equals_target", "source_not_personal_org", "user_not_member_of_source" and "user_not_sole_member_of_source": the account is not a single-member personal account that can be migrated. "target_not_enterprise_org": this organization's plan does not accept the migration. "already_member_of_target": the migration already happened. "target_membership_not_provisioned" and "target_membership_unassigned_no_seats": the member has no usable seat in this organization. "already_migrating": another migration of the same account is in progress. "source_too_large": the personal account holds more data than a migration can move. "target_became_inactive": this organization became inactive before the migration finished. "migration_failed": an error stopped the migration. "anthropic_staff_action": Anthropic staff stopped the migration. "migration_blocked_redacted": stands in for every reason that is not shared with the organization. Values may be added over time; treat an unrecognized value as a generic failure. "unspecified" is never emitted.
5579
5580 - `"already_member_of_target"`
5581
5582 - `"already_migrating"`
5583
5584 - `"anthropic_staff_action"`
5585
5586 - `"migration_blocked_redacted"`
5587
5588 - `"migration_failed"`
5589
5590 - `"source_equals_target"`
5591
5592 - `"source_not_personal_org"`
5593
5594 - `"source_too_large"`
5595
5596 - `"target_became_inactive"`
5597
5598 - `"target_membership_not_provisioned"`
5599
5600 - `"target_membership_unassigned_no_seats"`
5601
5602 - `"target_not_enterprise_org"`
5603
5604 - `"unspecified"`
5605
5606 - `"user_not_member_of_source"`
5607
5608 - `"user_not_sole_member_of_source"`
5609
5610 - `migrated_user_email: optional string or null`
5611
5612 Email address of the user whose personal account was being migrated, when known.
5613
5614 - `migrated_user_id: optional string or null`
5615
5616 Tagged ID of the user whose personal account was being migrated, e.g. "user_...", when known.
5617
5618 - `organization_id: optional string or null`
5619
5620 Organization ID this activity is associated with
5621
5622 - `organization_uuid: optional string or null`
5623
5624 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
5625
5626 - `AccountMigrationStarted object`
5627
5628 A personal Claude account began migrating into the organization: its data, including conversations, projects and files, is being moved from the member's personal account into this organization.
5629
5630 - `type: optional "account_migration_started"`
5631
5632 default: account_migration_started
5633
5634 - `account_migration_id: string`
5635
5636 Tagged ID of the migration, e.g. "amig_...". The same ID appears on the completed or failed activity that closes the migration, when one is recorded.
5637
5638 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
5639
5640 - `APIActor object`
5641
5642 - `type: optional "api_actor"`
5643
5644 default: api_actor
5645
5646 - `api_key_id: string`
5647
5648 - `ip_address: string`
5649
5650 - `user_agent: string`
5651
5652 - `UserActor object`
5653
5654 - `type: optional "user_actor"`
5655
5656 default: user_actor
5657
5658 - `email_address: string`
5659
5660 format: email
5661
5662 - `ip_address: string`
5663
5664 - `user_agent: string`
5665
5666 - `user_id: string`
5667
5668 - `UnauthenticatedUserActor object`
5669
5670 - `type: optional "unauthenticated_user_actor"`
5671
5672 default: unauthenticated_user_actor
5673
5674 - `ip_address: string`
5675
5676 - `user_agent: string`
5677
5678 - `unauthenticated_email_address: optional string or null`
5679
5680 format: email
5681
5682 - `AnthropicActor object`
5683
5684 - `type: optional "anthropic_actor"`
5685
5686 default: anthropic_actor
5687
5688 - `email_address: optional string or null`
5689
5690 format: email
5691
5692 - `SystemActor object`
5693
5694 Automated background processing performed by Anthropic systems, acting
5695 without a user or customer credential.
5696
5697 - `type: optional "system_actor"`
5698
5699 default: system_actor
5700
5701 - `service: optional string or null`
5702
5703 Name of the automated process that performed the action, when known.
5704
5705 - `AdminAPIKeyActor object`
5706
5707 - `type: optional "admin_api_key_actor"`
5708
5709 default: admin_api_key_actor
5710
5711 - `admin_api_key_id: string`
5712
5713 - `ip_address: string`
5714
5715 - `user_agent: string`
5716
5717 - `ServiceAccountActor object`
5718
5719 - `type: optional "service_account_actor"`
5720
5721 default: service_account_actor
5722
5723 - `ip_address: string`
5724
5725 - `service_account_id: string`
5726
5727 - `user_agent: string`
5728
5729 - `ScimDirectorySyncActor object`
5730
5731 - `type: optional "scim_directory_sync_actor"`
5732
5733 default: scim_directory_sync_actor
5734
5735 - `directory_id: string`
5736
5737 - `workos_event_id: string`
5738
5739 - `idp_connection_type: optional string or null`
5740
5741 - `FederatedIdentityActor object`
5742
5743 A federated external workload authenticated via a verified OIDC token.
5744
5745 Carries the verified issuer, subject, and audience claims from the
5746 presented JWT.
5747
5748 - `type: optional "federated_identity_actor"`
5749
5750 default: federated_identity_actor
5751
5752 - `issuer: string`
5753
5754 - `subject: string`
5755
5756 - `audience: optional array of string`
5757
5758 - `ip_address: optional string or null`
5759
5760 - `user_agent: optional string or null`
5761
5762 - `FederatedActor object`
5763
5764 An external identity asserted by a trusted provider — a cloud-provider
5765 gateway or a customer-registered federation issuer — acting without an
5766 Anthropic-provisioned account or service account.
5767
5768 - `type: optional "federated_actor"`
5769
5770 default: federated_actor
5771
5772 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
5773
5774 - `FederatedActorAwsProvider object`
5775
5776 Asserting party: the AWS account the organization is bound to.
5777
5778 - `type: optional "aws"`
5779
5780 default: aws
5781
5782 - `account_id: string`
5783
5784 - `signed_principal: string`
5785
5786 The AWS-signed ARN of the IAM principal that requested the token.
5787
5788 - `FederatedActorAzureProvider object`
5789
5790 Asserting party: the Azure subscription the organization is bound to.
5791
5792 - `type: optional "azure"`
5793
5794 default: azure
5795
5796 - `subscription_id: string`
5797
5798 - `FederatedActorGcpProvider object`
5799
5800 Asserting party: the GCP project the organization is bound to.
5801
5802 - `type: optional "gcp"`
5803
5804 default: gcp
5805
5806 - `project_number: string`
5807
5808 - `FederatedActorOidcProvider object`
5809
5810 Asserting party: a customer-registered OIDC federation issuer.
5811
5812 - `type: optional "oidc"`
5813
5814 default: oidc
5815
5816 - `issuer: optional string or null`
5817
5818 The federation issuer's URL. Null when the presented credential failed verification.
5819
5820 - `ip_address: optional string or null`
5821
5822 - `subject: optional string or null`
5823
5824 The provider's verified identifier for the caller; its form depends on the provider.
5825
5826 - `user_agent: optional string or null`
5827
5828 - `AttestedDeviceActor object`
5829
5830 An attested mobile device authenticated via Apple App Attest.
5831
5832 - `type: optional "attested_device_actor"`
5833
5834 default: attested_device_actor
5835
5836 - `external_client_id: string`
5837
5838 - `kid_hash: string`
5839
5840 - `ip_address: optional string or null`
5841
5842 - `user_agent: optional string or null`
5843
5844 - `migrated_user_email: string`
5845
5846 Email address of the user whose personal account is being migrated.
5847
5848 - `migrated_user_id: string`
5849
5850 Tagged ID of the user whose personal account is being migrated, e.g. "user_...".
5851
5852 - `id: optional string`
5853
5854 Unique identifier for the activity e.g. 'activity_abcd1234'
5855
5856 - `created_at: optional string`
5857
5858 When this activity occurred.
5859
5860 format: date-time
5861
5862 - `organization_id: optional string or null`
5863
5864 Organization ID this activity is associated with
5865
5866 - `organization_uuid: optional string or null`
5867
5868 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
5869
49925870 - `AdminAPIKeyCreated object`
49935871
49945872 An admin API key was created.
from line 26355
2547726355
2547826356 Per-review spend limit in USD before the change. Absent when no configuration existed before this update or no limit was set.
2547926357
26358 - `previous_review_level: optional string or null`
26359
26360 Review level set for the organization's code reviews before the change: "low" (Quick), "medium" (Standard) or "high" (Deep). Absent when no configuration existed before this update or no level was set.
26361
2548026362 - `previous_show_tips: optional boolean or null`
2548126363
2548226364 Whether tip-style pull-request comments were enabled before the change. Absent when no configuration existed before this update.
from line 26367
2548526367
2548626368 Whether the verification stage of code review was enabled for the organization before the change. Absent when no configuration existed before this update or no preference was set.
2548726369
26370 - `review_level: optional string or null`
26371
26372 Review level now set for the organization's code reviews: "low" (Quick), "medium" (Standard) or "high" (Deep). Repositories without their own level use this one. Absent when no level is set; the default level, Standard, then applies.
26373
2548826374 - `show_tips: optional boolean or null`
2548926375
2549026376 Whether tip-style pull-request comments are now enabled
from line 26379
2549326379
2549426380 Whether the verification stage of code review is now enabled for the organization. Absent when the organization has not set a preference and the default applies.
2549526381
26382 - `ClaudeCodeReviewPromoEnrolled object`
26383
26384 An organization admin enrolled the organization in a Claude Code Review promotion, for example by claiming promotional credits.
26385
26386 - `type: optional "claude_code_review_promo_enrolled"`
26387
26388 default: claude_code_review_promo_enrolled
26389
26390 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
26391
26392 - `APIActor object`
26393
26394 - `type: optional "api_actor"`
26395
26396 default: api_actor
26397
26398 - `api_key_id: string`
26399
26400 - `ip_address: string`
26401
26402 - `user_agent: string`
26403
26404 - `UserActor object`
26405
26406 - `type: optional "user_actor"`
26407
26408 default: user_actor
26409
26410 - `email_address: string`
26411
26412 format: email
26413
26414 - `ip_address: string`
26415
26416 - `user_agent: string`
26417
26418 - `user_id: string`
26419
26420 - `UnauthenticatedUserActor object`
26421
26422 - `type: optional "unauthenticated_user_actor"`
26423
26424 default: unauthenticated_user_actor
26425
26426 - `ip_address: string`
26427
26428 - `user_agent: string`
26429
26430 - `unauthenticated_email_address: optional string or null`
26431
26432 format: email
26433
26434 - `AnthropicActor object`
26435
26436 - `type: optional "anthropic_actor"`
26437
26438 default: anthropic_actor
26439
26440 - `email_address: optional string or null`
26441
26442 format: email
26443
26444 - `SystemActor object`
26445
26446 Automated background processing performed by Anthropic systems, acting
26447 without a user or customer credential.
26448
26449 - `type: optional "system_actor"`
26450
26451 default: system_actor
26452
26453 - `service: optional string or null`
26454
26455 Name of the automated process that performed the action, when known.
26456
26457 - `AdminAPIKeyActor object`
26458
26459 - `type: optional "admin_api_key_actor"`
26460
26461 default: admin_api_key_actor
26462
26463 - `admin_api_key_id: string`
26464
26465 - `ip_address: string`
26466
26467 - `user_agent: string`
26468
26469 - `ServiceAccountActor object`
26470
26471 - `type: optional "service_account_actor"`
26472
26473 default: service_account_actor
26474
26475 - `ip_address: string`
26476
26477 - `service_account_id: string`
26478
26479 - `user_agent: string`
26480
26481 - `ScimDirectorySyncActor object`
26482
26483 - `type: optional "scim_directory_sync_actor"`
26484
26485 default: scim_directory_sync_actor
26486
26487 - `directory_id: string`
26488
26489 - `workos_event_id: string`
26490
26491 - `idp_connection_type: optional string or null`
26492
26493 - `FederatedIdentityActor object`
26494
26495 A federated external workload authenticated via a verified OIDC token.
26496
26497 Carries the verified issuer, subject, and audience claims from the
26498 presented JWT.
26499
26500 - `type: optional "federated_identity_actor"`
26501
26502 default: federated_identity_actor
26503
26504 - `issuer: string`
26505
26506 - `subject: string`
26507
26508 - `audience: optional array of string`
26509
26510 - `ip_address: optional string or null`
26511
26512 - `user_agent: optional string or null`
26513
26514 - `FederatedActor object`
26515
26516 An external identity asserted by a trusted provider — a cloud-provider
26517 gateway or a customer-registered federation issuer — acting without an
26518 Anthropic-provisioned account or service account.
26519
26520 - `type: optional "federated_actor"`
26521
26522 default: federated_actor
26523
26524 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
26525
26526 - `FederatedActorAwsProvider object`
26527
26528 Asserting party: the AWS account the organization is bound to.
26529
26530 - `type: optional "aws"`
26531
26532 default: aws
26533
26534 - `account_id: string`
26535
26536 - `signed_principal: string`
26537
26538 The AWS-signed ARN of the IAM principal that requested the token.
26539
26540 - `FederatedActorAzureProvider object`
26541
26542 Asserting party: the Azure subscription the organization is bound to.
26543
26544 - `type: optional "azure"`
26545
26546 default: azure
26547
26548 - `subscription_id: string`
26549
26550 - `FederatedActorGcpProvider object`
26551
26552 Asserting party: the GCP project the organization is bound to.
26553
26554 - `type: optional "gcp"`
26555
26556 default: gcp
26557
26558 - `project_number: string`
26559
26560 - `FederatedActorOidcProvider object`
26561
26562 Asserting party: a customer-registered OIDC federation issuer.
26563
26564 - `type: optional "oidc"`
26565
26566 default: oidc
26567
26568 - `issuer: optional string or null`
26569
26570 The federation issuer's URL. Null when the presented credential failed verification.
26571
26572 - `ip_address: optional string or null`
26573
26574 - `subject: optional string or null`
26575
26576 The provider's verified identifier for the caller; its form depends on the provider.
26577
26578 - `user_agent: optional string or null`
26579
26580 - `AttestedDeviceActor object`
26581
26582 An attested mobile device authenticated via Apple App Attest.
26583
26584 - `type: optional "attested_device_actor"`
26585
26586 default: attested_device_actor
26587
26588 - `external_client_id: string`
26589
26590 - `kid_hash: string`
26591
26592 - `ip_address: optional string or null`
26593
26594 - `user_agent: optional string or null`
26595
26596 - `promo_id: string`
26597
26598 Identifier of the promotion the organization enrolled in.
26599
26600 - `id: optional string`
26601
26602 Unique identifier for the activity e.g. 'activity_abcd1234'
26603
26604 - `created_at: optional string`
26605
26606 When this activity occurred.
26607
26608 format: date-time
26609
26610 - `expires_at: optional string or null`
26611
26612 When the organization's promotional access or credits expire.
26613
26614 format: date-time
26615
26616 - `organization_id: optional string or null`
26617
26618 Organization ID this activity is associated with
26619
26620 - `organization_uuid: optional string or null`
26621
26622 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
26623
2549626624 - `ClaudeCodeReviewRepositoryAdded object`
2549726625
2549826626 A repository was added to org-level Claude Code Review configuration.
from line 27357
2622927357
2623027358 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
2623127359
27360 - `previous_review_level: optional string or null`
27361
27362 Review level set for this repository's code reviews before the change: "low" (Quick), "medium" (Standard) or "high" (Deep). Absent when no level was set.
27363
27364 - `review_level: optional string or null`
27365
27366 Review level now set for this repository's code reviews: "low" (Quick), "medium" (Standard) or "high" (Deep). Absent when no level is set; the repository then uses the organization-wide level (review_level on claude_code_review_config_updated), or Standard if none is set.
27367
2623227368 - `status: optional string or null`
2623327369
2623427370 Updated status (ACTIVE/INACTIVE)
from line 29833
2869729833
2869829834 - `ClaudeCodeSecurityScanProjectUpdated object`
2869929835
28700 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience.
29836 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience, or a user paused the project's scheduled scanning, unpaused it, or lifted a billing pause on it.
2870129837
2870229838 - `type: optional "claude_code_security_scan_project_updated"`
2870329839
2870429840 default: claude_code_security_scan_project_updated
2870529841
28706 - `action: "archived" or "created" or "migrated" or 3 more`
29842 - `action: "archived" or "billing_pause_lifted" or "created" or 6 more`
2870729843
2870829844 The state change applied to the scan project.
2870929845
2871029846 - `"archived"`
2871129847
29848 - `"billing_pause_lifted"`
29849
2871229850 - `"created"`
2871329851
2871429852 - `"migrated"`
2871529853
29854 - `"paused"`
29855
2871629856 - `"resumed"`
2871729857
2871829858 - `"unarchived"`
2871929859
29860 - `"unpaused"`
29861
2872029862 - `"unspecified"`
2872129863
2872229864 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
from line 40117
3897540117
3897640118 A short provider-specific identifier for the external resource after the update, e.g. `owner/repo` for GitHub or a file ID for Google Drive.
3897740119
40120 - `ClaudeSkillAutoDisabled object`
40121
40122 A skill that had been turned on for a member automatically was turned off for them automatically, not by the member; reason says why. A member turning a skill off themselves is recorded as claude_skill_disabled.
40123
40124 - `type: optional "claude_skill_auto_disabled"`
40125
40126 default: claude_skill_auto_disabled
40127
40128 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
40129
40130 - `APIActor object`
40131
40132 - `type: optional "api_actor"`
40133
40134 default: api_actor
40135
40136 - `api_key_id: string`
40137
40138 - `ip_address: string`
40139
40140 - `user_agent: string`
40141
40142 - `UserActor object`
40143
40144 - `type: optional "user_actor"`
40145
40146 default: user_actor
40147
40148 - `email_address: string`
40149
40150 format: email
40151
40152 - `ip_address: string`
40153
40154 - `user_agent: string`
40155
40156 - `user_id: string`
40157
40158 - `UnauthenticatedUserActor object`
40159
40160 - `type: optional "unauthenticated_user_actor"`
40161
40162 default: unauthenticated_user_actor
40163
40164 - `ip_address: string`
40165
40166 - `user_agent: string`
40167
40168 - `unauthenticated_email_address: optional string or null`
40169
40170 format: email
40171
40172 - `AnthropicActor object`
40173
40174 - `type: optional "anthropic_actor"`
40175
40176 default: anthropic_actor
40177
40178 - `email_address: optional string or null`
40179
40180 format: email
40181
40182 - `SystemActor object`
40183
40184 Automated background processing performed by Anthropic systems, acting
40185 without a user or customer credential.
40186
40187 - `type: optional "system_actor"`
40188
40189 default: system_actor
40190
40191 - `service: optional string or null`
40192
40193 Name of the automated process that performed the action, when known.
40194
40195 - `AdminAPIKeyActor object`
40196
40197 - `type: optional "admin_api_key_actor"`
40198
40199 default: admin_api_key_actor
40200
40201 - `admin_api_key_id: string`
40202
40203 - `ip_address: string`
40204
40205 - `user_agent: string`
40206
40207 - `ServiceAccountActor object`
40208
40209 - `type: optional "service_account_actor"`
40210
40211 default: service_account_actor
40212
40213 - `ip_address: string`
40214
40215 - `service_account_id: string`
40216
40217 - `user_agent: string`
40218
40219 - `ScimDirectorySyncActor object`
40220
40221 - `type: optional "scim_directory_sync_actor"`
40222
40223 default: scim_directory_sync_actor
40224
40225 - `directory_id: string`
40226
40227 - `workos_event_id: string`
40228
40229 - `idp_connection_type: optional string or null`
40230
40231 - `FederatedIdentityActor object`
40232
40233 A federated external workload authenticated via a verified OIDC token.
40234
40235 Carries the verified issuer, subject, and audience claims from the
40236 presented JWT.
40237
40238 - `type: optional "federated_identity_actor"`
40239
40240 default: federated_identity_actor
40241
40242 - `issuer: string`
40243
40244 - `subject: string`
40245
40246 - `audience: optional array of string`
40247
40248 - `ip_address: optional string or null`
40249
40250 - `user_agent: optional string or null`
40251
40252 - `FederatedActor object`
40253
40254 An external identity asserted by a trusted provider — a cloud-provider
40255 gateway or a customer-registered federation issuer — acting without an
40256 Anthropic-provisioned account or service account.
40257
40258 - `type: optional "federated_actor"`
40259
40260 default: federated_actor
40261
40262 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
40263
40264 - `FederatedActorAwsProvider object`
40265
40266 Asserting party: the AWS account the organization is bound to.
40267
40268 - `type: optional "aws"`
40269
40270 default: aws
40271
40272 - `account_id: string`
40273
40274 - `signed_principal: string`
40275
40276 The AWS-signed ARN of the IAM principal that requested the token.
40277
40278 - `FederatedActorAzureProvider object`
40279
40280 Asserting party: the Azure subscription the organization is bound to.
40281
40282 - `type: optional "azure"`
40283
40284 default: azure
40285
40286 - `subscription_id: string`
40287
40288 - `FederatedActorGcpProvider object`
40289
40290 Asserting party: the GCP project the organization is bound to.
40291
40292 - `type: optional "gcp"`
40293
40294 default: gcp
40295
40296 - `project_number: string`
40297
40298 - `FederatedActorOidcProvider object`
40299
40300 Asserting party: a customer-registered OIDC federation issuer.
40301
40302 - `type: optional "oidc"`
40303
40304 default: oidc
40305
40306 - `issuer: optional string or null`
40307
40308 The federation issuer's URL. Null when the presented credential failed verification.
40309
40310 - `ip_address: optional string or null`
40311
40312 - `subject: optional string or null`
40313
40314 The provider's verified identifier for the caller; its form depends on the provider.
40315
40316 - `user_agent: optional string or null`
40317
40318 - `AttestedDeviceActor object`
40319
40320 An attested mobile device authenticated via Apple App Attest.
40321
40322 - `type: optional "attested_device_actor"`
40323
40324 default: attested_device_actor
40325
40326 - `external_client_id: string`
40327
40328 - `kid_hash: string`
40329
40330 - `ip_address: optional string or null`
40331
40332 - `user_agent: optional string or null`
40333
40334 - `reason: "auto_enable_reverted" or "content_changed" or "unspecified"`
40335
40336 Why the skill was turned off automatically: "content_changed" (a change to the skill was saved or attempted, or the skill was scanned again, and it could not be confirmed as still eligible to be on automatically) or "auto_enable_reverted" (Anthropic turned off skills that had been turned on automatically; not in response to a change to this skill).
40337
40338 - `"auto_enable_reverted"`
40339
40340 - `"content_changed"`
40341
40342 - `"unspecified"`
40343
40344 - `user_id: string`
40345
40346 The member the skill was turned off for.
40347
40348 - `id: optional string`
40349
40350 Unique identifier for the activity e.g. 'activity_abcd1234'
40351
40352 - `created_at: optional string`
40353
40354 When this activity occurred.
40355
40356 format: date-time
40357
40358 - `organization_id: optional string or null`
40359
40360 Organization ID this activity is associated with
40361
40362 - `organization_uuid: optional string or null`
40363
40364 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
40365
40366 - `shared_by_user_id: optional string or null`
40367
40368 For a skill that had been turned on because it was shared: the member who shared it.
40369
40370 - `skill_id: optional string or null`
40371
40372 The skill that was turned off.
40373
40374 - `skill_name: optional string or null`
40375
40376 The name of the skill that was turned off.
40377
40378 - `skill_version: optional string or null`
40379
40380 The version of the skill the member had just before it was turned off. Absent when not known.
40381
40382 - `ClaudeSkillAutoEnabled object`
40383
40384 A skill was turned on for a member automatically, not by the member; trigger gives the cause, such as another member sharing an eligible skill with them. A member turning a skill on themselves is recorded as claude_skill_enabled.
40385
40386 - `type: optional "claude_skill_auto_enabled"`
40387
40388 default: claude_skill_auto_enabled
40389
40390 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
40391
40392 - `APIActor object`
40393
40394 - `type: optional "api_actor"`
40395
40396 default: api_actor
40397
40398 - `api_key_id: string`
40399
40400 - `ip_address: string`
40401
40402 - `user_agent: string`
40403
40404 - `UserActor object`
40405
40406 - `type: optional "user_actor"`
40407
40408 default: user_actor
40409
40410 - `email_address: string`
40411
40412 format: email
40413
40414 - `ip_address: string`
40415
40416 - `user_agent: string`
40417
40418 - `user_id: string`
40419
40420 - `UnauthenticatedUserActor object`
40421
40422 - `type: optional "unauthenticated_user_actor"`
40423
40424 default: unauthenticated_user_actor
40425
40426 - `ip_address: string`
40427
40428 - `user_agent: string`
40429
40430 - `unauthenticated_email_address: optional string or null`
40431
40432 format: email
40433
40434 - `AnthropicActor object`
40435
40436 - `type: optional "anthropic_actor"`
40437
40438 default: anthropic_actor
40439
40440 - `email_address: optional string or null`
40441
40442 format: email
40443
40444 - `SystemActor object`
40445
40446 Automated background processing performed by Anthropic systems, acting
40447 without a user or customer credential.
40448
40449 - `type: optional "system_actor"`
40450
40451 default: system_actor
40452
40453 - `service: optional string or null`
40454
40455 Name of the automated process that performed the action, when known.
40456
40457 - `AdminAPIKeyActor object`
40458
40459 - `type: optional "admin_api_key_actor"`
40460
40461 default: admin_api_key_actor
40462
40463 - `admin_api_key_id: string`
40464
40465 - `ip_address: string`
40466
40467 - `user_agent: string`
40468
40469 - `ServiceAccountActor object`
40470
40471 - `type: optional "service_account_actor"`
40472
40473 default: service_account_actor
40474
40475 - `ip_address: string`
40476
40477 - `service_account_id: string`
40478
40479 - `user_agent: string`
40480
40481 - `ScimDirectorySyncActor object`
40482
40483 - `type: optional "scim_directory_sync_actor"`
40484
40485 default: scim_directory_sync_actor
40486
40487 - `directory_id: string`
40488
40489 - `workos_event_id: string`
40490
40491 - `idp_connection_type: optional string or null`
40492
40493 - `FederatedIdentityActor object`
40494
40495 A federated external workload authenticated via a verified OIDC token.
40496
40497 Carries the verified issuer, subject, and audience claims from the
40498 presented JWT.
40499
40500 - `type: optional "federated_identity_actor"`
40501
40502 default: federated_identity_actor
40503
40504 - `issuer: string`
40505
40506 - `subject: string`
40507
40508 - `audience: optional array of string`
40509
40510 - `ip_address: optional string or null`
40511
40512 - `user_agent: optional string or null`
40513
40514 - `FederatedActor object`
40515
40516 An external identity asserted by a trusted provider — a cloud-provider
40517 gateway or a customer-registered federation issuer — acting without an
40518 Anthropic-provisioned account or service account.
40519
40520 - `type: optional "federated_actor"`
40521
40522 default: federated_actor
40523
40524 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
40525
40526 - `FederatedActorAwsProvider object`
40527
40528 Asserting party: the AWS account the organization is bound to.
40529
40530 - `type: optional "aws"`
40531
40532 default: aws
40533
40534 - `account_id: string`
40535
40536 - `signed_principal: string`
40537
40538 The AWS-signed ARN of the IAM principal that requested the token.
40539
40540 - `FederatedActorAzureProvider object`
40541
40542 Asserting party: the Azure subscription the organization is bound to.
40543
40544 - `type: optional "azure"`
40545
40546 default: azure
40547
40548 - `subscription_id: string`
40549
40550 - `FederatedActorGcpProvider object`
40551
40552 Asserting party: the GCP project the organization is bound to.
40553
40554 - `type: optional "gcp"`
40555
40556 default: gcp
40557
40558 - `project_number: string`
40559
40560 - `FederatedActorOidcProvider object`
40561
40562 Asserting party: a customer-registered OIDC federation issuer.
40563
40564 - `type: optional "oidc"`
40565
40566 default: oidc
40567
40568 - `issuer: optional string or null`
40569
40570 The federation issuer's URL. Null when the presented credential failed verification.
40571
40572 - `ip_address: optional string or null`
40573
40574 - `subject: optional string or null`
40575
40576 The provider's verified identifier for the caller; its form depends on the provider.
40577
40578 - `user_agent: optional string or null`
40579
40580 - `AttestedDeviceActor object`
40581
40582 An attested mobile device authenticated via Apple App Attest.
40583
40584 - `type: optional "attested_device_actor"`
40585
40586 default: attested_device_actor
40587
40588 - `external_client_id: string`
40589
40590 - `kid_hash: string`
40591
40592 - `ip_address: optional string or null`
40593
40594 - `user_agent: optional string or null`
40595
40596 - `trigger: "share" or "unspecified"`
40597
40598 What caused the skill to be turned on automatically: "share" (another member shared it with the member, directly or through a group).
40599
40600 - `"share"`
40601
40602 - `"unspecified"`
40603
40604 - `user_id: string`
40605
40606 The member the skill was turned on for.
40607
40608 - `id: optional string`
40609
40610 Unique identifier for the activity e.g. 'activity_abcd1234'
40611
40612 - `created_at: optional string`
40613
40614 When this activity occurred.
40615
40616 format: date-time
40617
40618 - `organization_id: optional string or null`
40619
40620 Organization ID this activity is associated with
40621
40622 - `organization_uuid: optional string or null`
40623
40624 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
40625
40626 - `shared_at: optional string or null`
40627
40628 For a skill turned on because it was shared: when it was shared with the member or with their group.
40629
40630 format: date-time
40631
40632 - `shared_by_user_id: optional string or null`
40633
40634 For a skill turned on because it was shared: the member who shared it.
40635
40636 - `shared_via: optional "direct" or "group" or "unspecified" or null`
40637
40638 For a skill turned on because it was shared: "direct" if shared with the member themselves, "group" if shared with a group they belong to.
40639
40640 - `"direct"`
40641
40642 - `"group"`
40643
40644 - `"unspecified"`
40645
40646 - `skill_id: optional string or null`
40647
40648 The skill that was turned on.
40649
40650 - `skill_name: optional string or null`
40651
40652 The name of the skill that was turned on.
40653
40654 - `skill_version: optional string or null`
40655
40656 The version of the skill that was turned on.
40657
3897840658 - `ClaudeSkillDownloaded object`
3897940659
3898040660 A member explicitly downloaded a skill's files to their device: the Download action in Claude, a single file saved from the skill viewer, or an install they asked one of their Claude apps for. Background syncs to the Claude apps, viewing a skill in the app and services reading a skill on the member's behalf are not recorded.
from line 49267
4758749267
4758849268 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
4758949269
49270 - `DomainClaimCancelled object`
49271
49272 A pending domain claim was cancelled before it took effect, so the personal accounts on the claimed domains will no longer be migrated or deactivated at its deadline.
49273
49274 - `type: optional "domain_claim_cancelled"`
49275
49276 default: domain_claim_cancelled
49277
49278 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
49279
49280 - `APIActor object`
49281
49282 - `type: optional "api_actor"`
49283
49284 default: api_actor
49285
49286 - `api_key_id: string`
49287
49288 - `ip_address: string`
49289
49290 - `user_agent: string`
49291
49292 - `UserActor object`
49293
49294 - `type: optional "user_actor"`
49295
49296 default: user_actor
49297
49298 - `email_address: string`
49299
49300 format: email
49301
49302 - `ip_address: string`
49303
49304 - `user_agent: string`
49305
49306 - `user_id: string`
49307
49308 - `UnauthenticatedUserActor object`
49309
49310 - `type: optional "unauthenticated_user_actor"`
49311
49312 default: unauthenticated_user_actor
49313
49314 - `ip_address: string`
49315
49316 - `user_agent: string`
49317
49318 - `unauthenticated_email_address: optional string or null`
49319
49320 format: email
49321
49322 - `AnthropicActor object`
49323
49324 - `type: optional "anthropic_actor"`
49325
49326 default: anthropic_actor
49327
49328 - `email_address: optional string or null`
49329
49330 format: email
49331
49332 - `SystemActor object`
49333
49334 Automated background processing performed by Anthropic systems, acting
49335 without a user or customer credential.
49336
49337 - `type: optional "system_actor"`
49338
49339 default: system_actor
49340
49341 - `service: optional string or null`
49342
49343 Name of the automated process that performed the action, when known.
49344
49345 - `AdminAPIKeyActor object`
49346
49347 - `type: optional "admin_api_key_actor"`
49348
49349 default: admin_api_key_actor
49350
49351 - `admin_api_key_id: string`
49352
49353 - `ip_address: string`
49354
49355 - `user_agent: string`
49356
49357 - `ServiceAccountActor object`
49358
49359 - `type: optional "service_account_actor"`
49360
49361 default: service_account_actor
49362
49363 - `ip_address: string`
49364
49365 - `service_account_id: string`
49366
49367 - `user_agent: string`
49368
49369 - `ScimDirectorySyncActor object`
49370
49371 - `type: optional "scim_directory_sync_actor"`
49372
49373 default: scim_directory_sync_actor
49374
49375 - `directory_id: string`
49376
49377 - `workos_event_id: string`
49378
49379 - `idp_connection_type: optional string or null`
49380
49381 - `FederatedIdentityActor object`
49382
49383 A federated external workload authenticated via a verified OIDC token.
49384
49385 Carries the verified issuer, subject, and audience claims from the
49386 presented JWT.
49387
49388 - `type: optional "federated_identity_actor"`
49389
49390 default: federated_identity_actor
49391
49392 - `issuer: string`
49393
49394 - `subject: string`
49395
49396 - `audience: optional array of string`
49397
49398 - `ip_address: optional string or null`
49399
49400 - `user_agent: optional string or null`
49401
49402 - `FederatedActor object`
49403
49404 An external identity asserted by a trusted provider — a cloud-provider
49405 gateway or a customer-registered federation issuer — acting without an
49406 Anthropic-provisioned account or service account.
49407
49408 - `type: optional "federated_actor"`
49409
49410 default: federated_actor
49411
49412 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
49413
49414 - `FederatedActorAwsProvider object`
49415
49416 Asserting party: the AWS account the organization is bound to.
49417
49418 - `type: optional "aws"`
49419
49420 default: aws
49421
49422 - `account_id: string`
49423
49424 - `signed_principal: string`
49425
49426 The AWS-signed ARN of the IAM principal that requested the token.
49427
49428 - `FederatedActorAzureProvider object`
49429
49430 Asserting party: the Azure subscription the organization is bound to.
49431
49432 - `type: optional "azure"`
49433
49434 default: azure
49435
49436 - `subscription_id: string`
49437
49438 - `FederatedActorGcpProvider object`
49439
49440 Asserting party: the GCP project the organization is bound to.
49441
49442 - `type: optional "gcp"`
49443
49444 default: gcp
49445
49446 - `project_number: string`
49447
49448 - `FederatedActorOidcProvider object`
49449
49450 Asserting party: a customer-registered OIDC federation issuer.
49451
49452 - `type: optional "oidc"`
49453
49454 default: oidc
49455
49456 - `issuer: optional string or null`
49457
49458 The federation issuer's URL. Null when the presented credential failed verification.
49459
49460 - `ip_address: optional string or null`
49461
49462 - `subject: optional string or null`
49463
49464 The provider's verified identifier for the caller; its form depends on the provider.
49465
49466 - `user_agent: optional string or null`
49467
49468 - `AttestedDeviceActor object`
49469
49470 An attested mobile device authenticated via Apple App Attest.
49471
49472 - `type: optional "attested_device_actor"`
49473
49474 default: attested_device_actor
49475
49476 - `external_client_id: string`
49477
49478 - `kid_hash: string`
49479
49480 - `ip_address: optional string or null`
49481
49482 - `user_agent: optional string or null`
49483
49484 - `domain_claim_id: string`
49485
49486 The domain claim that was cancelled, e.g. "dclm_01Ab...".
49487
49488 - `id: optional string`
49489
49490 Unique identifier for the activity e.g. 'activity_abcd1234'
49491
49492 - `created_at: optional string`
49493
49494 When this activity occurred.
49495
49496 format: date-time
49497
49498 - `organization_id: optional string or null`
49499
49500 Organization ID this activity is associated with
49501
49502 - `organization_uuid: optional string or null`
49503
49504 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
49505
49506 - `DomainClaimDeadlineUpdated object`
49507
49508 The migration deadline of a pending domain claim was moved to a later or an earlier date by Anthropic staff or an automated process.
49509
49510 - `type: optional "domain_claim_deadline_updated"`
49511
49512 default: domain_claim_deadline_updated
49513
49514 - `action: "extended" or "shortened" or "unspecified"`
49515
49516 Whether the deadline was extended (moved later) or shortened (moved earlier).
49517
49518 - `"extended"`
49519
49520 - `"shortened"`
49521
49522 - `"unspecified"`
49523
49524 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
49525
49526 - `APIActor object`
49527
49528 - `type: optional "api_actor"`
49529
49530 default: api_actor
49531
49532 - `api_key_id: string`
49533
49534 - `ip_address: string`
49535
49536 - `user_agent: string`
49537
49538 - `UserActor object`
49539
49540 - `type: optional "user_actor"`
49541
49542 default: user_actor
49543
49544 - `email_address: string`
49545
49546 format: email
49547
49548 - `ip_address: string`
49549
49550 - `user_agent: string`
49551
49552 - `user_id: string`
49553
49554 - `UnauthenticatedUserActor object`
49555
49556 - `type: optional "unauthenticated_user_actor"`
49557
49558 default: unauthenticated_user_actor
49559
49560 - `ip_address: string`
49561
49562 - `user_agent: string`
49563
49564 - `unauthenticated_email_address: optional string or null`
49565
49566 format: email
49567
49568 - `AnthropicActor object`
49569
49570 - `type: optional "anthropic_actor"`
49571
49572 default: anthropic_actor
49573
49574 - `email_address: optional string or null`
49575
49576 format: email
49577
49578 - `SystemActor object`
49579
49580 Automated background processing performed by Anthropic systems, acting
49581 without a user or customer credential.
49582
49583 - `type: optional "system_actor"`
49584
49585 default: system_actor
49586
49587 - `service: optional string or null`
49588
49589 Name of the automated process that performed the action, when known.
49590
49591 - `AdminAPIKeyActor object`
49592
49593 - `type: optional "admin_api_key_actor"`
49594
49595 default: admin_api_key_actor
49596
49597 - `admin_api_key_id: string`
49598
49599 - `ip_address: string`
49600
49601 - `user_agent: string`
49602
49603 - `ServiceAccountActor object`
49604
49605 - `type: optional "service_account_actor"`
49606
49607 default: service_account_actor
49608
49609 - `ip_address: string`
49610
49611 - `service_account_id: string`
49612
49613 - `user_agent: string`
49614
49615 - `ScimDirectorySyncActor object`
49616
49617 - `type: optional "scim_directory_sync_actor"`
49618
49619 default: scim_directory_sync_actor
49620
49621 - `directory_id: string`
49622
49623 - `workos_event_id: string`
49624
49625 - `idp_connection_type: optional string or null`
49626
49627 - `FederatedIdentityActor object`
49628
49629 A federated external workload authenticated via a verified OIDC token.
49630
49631 Carries the verified issuer, subject, and audience claims from the
49632 presented JWT.
49633
49634 - `type: optional "federated_identity_actor"`
49635
49636 default: federated_identity_actor
49637
49638 - `issuer: string`
49639
49640 - `subject: string`
49641
49642 - `audience: optional array of string`
49643
49644 - `ip_address: optional string or null`
49645
49646 - `user_agent: optional string or null`
49647
49648 - `FederatedActor object`
49649
49650 An external identity asserted by a trusted provider — a cloud-provider
49651 gateway or a customer-registered federation issuer — acting without an
49652 Anthropic-provisioned account or service account.
49653
49654 - `type: optional "federated_actor"`
49655
49656 default: federated_actor
49657
49658 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
49659
49660 - `FederatedActorAwsProvider object`
49661
49662 Asserting party: the AWS account the organization is bound to.
49663
49664 - `type: optional "aws"`
49665
49666 default: aws
49667
49668 - `account_id: string`
49669
49670 - `signed_principal: string`
49671
49672 The AWS-signed ARN of the IAM principal that requested the token.
49673
49674 - `FederatedActorAzureProvider object`
49675
49676 Asserting party: the Azure subscription the organization is bound to.
49677
49678 - `type: optional "azure"`
49679
49680 default: azure
49681
49682 - `subscription_id: string`
49683
49684 - `FederatedActorGcpProvider object`
49685
49686 Asserting party: the GCP project the organization is bound to.
49687
49688 - `type: optional "gcp"`
49689
49690 default: gcp
49691
49692 - `project_number: string`
49693
49694 - `FederatedActorOidcProvider object`
49695
49696 Asserting party: a customer-registered OIDC federation issuer.
49697
49698 - `type: optional "oidc"`
49699
49700 default: oidc
49701
49702 - `issuer: optional string or null`
49703
49704 The federation issuer's URL. Null when the presented credential failed verification.
49705
49706 - `ip_address: optional string or null`
49707
49708 - `subject: optional string or null`
49709
49710 The provider's verified identifier for the caller; its form depends on the provider.
49711
49712 - `user_agent: optional string or null`
49713
49714 - `AttestedDeviceActor object`
49715
49716 An attested mobile device authenticated via Apple App Attest.
49717
49718 - `type: optional "attested_device_actor"`
49719
49720 default: attested_device_actor
49721
49722 - `external_client_id: string`
49723
49724 - `kid_hash: string`
49725
49726 - `ip_address: optional string or null`
49727
49728 - `user_agent: optional string or null`
49729
49730 - `domain_claim_id: string`
49731
49732 The domain claim whose deadline was moved, e.g. "dclm_01Ab...".
49733
49734 - `id: optional string`
49735
49736 Unique identifier for the activity e.g. 'activity_abcd1234'
49737
49738 - `created_at: optional string`
49739
49740 When this activity occurred.
49741
49742 format: date-time
49743
49744 - `deadline_at: optional string or null`
49745
49746 The deadline after the change.
49747
49748 format: date-time
49749
49750 - `organization_id: optional string or null`
49751
49752 Organization ID this activity is associated with
49753
49754 - `organization_uuid: optional string or null`
49755
49756 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
49757
49758 - `previous_deadline_at: optional string or null`
49759
49760 The deadline before the change.
49761
49762 format: date-time
49763
4759049764 - `DomainClaimInitiated object`
4759149765
4759249766 Domain capture claim initiated over personal accounts on verified domains.
from line 55439
5326555439
5326655440 - `token_fingerprint_sha256: optional string or null`
5326755441
53268 Org-scoped SHA-256 of the submitted token: `sha256(org_uuid || 0x00 || token)`, lowercase-hex-encoded, where `org_uuid` is the organization's UUID as a dashed lowercase string, `0x00` is a single zero byte, and `token` is the submitted value's raw bytes. Per-org correlation only — the same token in two orgs produces distinct fingerprints. Set only when the submitted value carries a known GitHub PAT prefix (a high-entropy token format); unset for all other submissions, including rejected non-PAT input.
55442 Not populated.
5326955443
5327055444 - `GitlabConfigurationCreated object`
5327155445
from line 93273
9109993273
9110093274 - `user_agent: optional string or null`
9110193275
91102 - `updates: array of Name or Capabilities or RedactContent or 104 more`
93276 - `updates: array of Name or Capabilities or RedactContent or 105 more`
9110393277
9110493278 - `Name object`
9110593279
from line 95192
9301895192
9301995193 Setting value immediately before this change. Null means the setting was not set, so its default applied.
9302095194
95195 - `ConnectorRequestsOptedIn object`
95196
95197 The organization's opt-in to connector requests, which lets members ask the organization's owners to add a connector, was changed. The "Let members request connectors" switch sets it the first time it is turned on; turning that switch off, or on again, is recorded as a `disabled_admin_request_types` change (`enable_connector` joins or leaves the list).
95198
95199 - `type: optional "connector_requests_opted_in"`
95200
95201 default: connector_requests_opted_in
95202
95203 - `current_value: optional boolean or null`
95204
95205 Setting value immediately after this change
95206
95207 - `previous_value: optional boolean or null`
95208
95209 Setting value immediately before this change. Null means the organization had never opted in or out.
95210
9302195211 - `id: optional string`
9302295212
9302395213 Unique identifier for the activity e.g. 'activity_abcd1234'
from line 114298
112108114298
112109114299 UUID of the spend limit.
112110114300
114301 - `PlatformTelemetryDestinationAutoDisabled object`
114302
114303 A telemetry destination was disabled automatically after deliveries to it failed, so no telemetry is sent to it until an administrator enables it again.
114304
114305 - `type: optional "platform_telemetry_destination_auto_disabled"`
114306
114307 default: platform_telemetry_destination_auto_disabled
114308
114309 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
114310
114311 - `APIActor object`
114312
114313 - `type: optional "api_actor"`
114314
114315 default: api_actor
114316
114317 - `api_key_id: string`
114318
114319 - `ip_address: string`
114320
114321 - `user_agent: string`
114322
114323 - `UserActor object`
114324
114325 - `type: optional "user_actor"`
114326
114327 default: user_actor
114328
114329 - `email_address: string`
114330
114331 format: email
114332
114333 - `ip_address: string`
114334
114335 - `user_agent: string`
114336
114337 - `user_id: string`
114338
114339 - `UnauthenticatedUserActor object`
114340
114341 - `type: optional "unauthenticated_user_actor"`
114342
114343 default: unauthenticated_user_actor
114344
114345 - `ip_address: string`
114346
114347 - `user_agent: string`
114348
114349 - `unauthenticated_email_address: optional string or null`
114350
114351 format: email
114352
114353 - `AnthropicActor object`
114354
114355 - `type: optional "anthropic_actor"`
114356
114357 default: anthropic_actor
114358
114359 - `email_address: optional string or null`
114360
114361 format: email
114362
114363 - `SystemActor object`
114364
114365 Automated background processing performed by Anthropic systems, acting
114366 without a user or customer credential.
114367
114368 - `type: optional "system_actor"`
114369
114370 default: system_actor
114371
114372 - `service: optional string or null`
114373
114374 Name of the automated process that performed the action, when known.
114375
114376 - `AdminAPIKeyActor object`
114377
114378 - `type: optional "admin_api_key_actor"`
114379
114380 default: admin_api_key_actor
114381
114382 - `admin_api_key_id: string`
114383
114384 - `ip_address: string`
114385
114386 - `user_agent: string`
114387
114388 - `ServiceAccountActor object`
114389
114390 - `type: optional "service_account_actor"`
114391
114392 default: service_account_actor
114393
114394 - `ip_address: string`
114395
114396 - `service_account_id: string`
114397
114398 - `user_agent: string`
114399
114400 - `ScimDirectorySyncActor object`
114401
114402 - `type: optional "scim_directory_sync_actor"`
114403
114404 default: scim_directory_sync_actor
114405
114406 - `directory_id: string`
114407
114408 - `workos_event_id: string`
114409
114410 - `idp_connection_type: optional string or null`
114411
114412 - `FederatedIdentityActor object`
114413
114414 A federated external workload authenticated via a verified OIDC token.
114415
114416 Carries the verified issuer, subject, and audience claims from the
114417 presented JWT.
114418
114419 - `type: optional "federated_identity_actor"`
114420
114421 default: federated_identity_actor
114422
114423 - `issuer: string`
114424
114425 - `subject: string`
114426
114427 - `audience: optional array of string`
114428
114429 - `ip_address: optional string or null`
114430
114431 - `user_agent: optional string or null`
114432
114433 - `FederatedActor object`
114434
114435 An external identity asserted by a trusted provider — a cloud-provider
114436 gateway or a customer-registered federation issuer — acting without an
114437 Anthropic-provisioned account or service account.
114438
114439 - `type: optional "federated_actor"`
114440
114441 default: federated_actor
114442
114443 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
114444
114445 - `FederatedActorAwsProvider object`
114446
114447 Asserting party: the AWS account the organization is bound to.
114448
114449 - `type: optional "aws"`
114450
114451 default: aws
114452
114453 - `account_id: string`
114454
114455 - `signed_principal: string`
114456
114457 The AWS-signed ARN of the IAM principal that requested the token.
114458
114459 - `FederatedActorAzureProvider object`
114460
114461 Asserting party: the Azure subscription the organization is bound to.
114462
114463 - `type: optional "azure"`
114464
114465 default: azure
114466
114467 - `subscription_id: string`
114468
114469 - `FederatedActorGcpProvider object`
114470
114471 Asserting party: the GCP project the organization is bound to.
114472
114473 - `type: optional "gcp"`
114474
114475 default: gcp
114476
114477 - `project_number: string`
114478
114479 - `FederatedActorOidcProvider object`
114480
114481 Asserting party: a customer-registered OIDC federation issuer.
114482
114483 - `type: optional "oidc"`
114484
114485 default: oidc
114486
114487 - `issuer: optional string or null`
114488
114489 The federation issuer's URL. Null when the presented credential failed verification.
114490
114491 - `ip_address: optional string or null`
114492
114493 - `subject: optional string or null`
114494
114495 The provider's verified identifier for the caller; its form depends on the provider.
114496
114497 - `user_agent: optional string or null`
114498
114499 - `AttestedDeviceActor object`
114500
114501 An attested mobile device authenticated via Apple App Attest.
114502
114503 - `type: optional "attested_device_actor"`
114504
114505 default: attested_device_actor
114506
114507 - `external_client_id: string`
114508
114509 - `kid_hash: string`
114510
114511 - `ip_address: optional string or null`
114512
114513 - `user_agent: optional string or null`
114514
114515 - `telemetry_destination_id: string`
114516
114517 Tagged telemetry destination ID, e.g. "tdst_01HX...".
114518
114519 - `trigger: "invalid_address" or "redirect" or "sustained_failure" or "unspecified"`
114520
114521 Why the destination was disabled: deliveries failed for longer than Anthropic allows ("sustained_failure"), they failed that long and the hostname does not resolve to a public address ("invalid_address"), or the endpoint answered with an HTTP redirect ("redirect").
114522
114523 - `"invalid_address"`
114524
114525 - `"redirect"`
114526
114527 - `"sustained_failure"`
114528
114529 - `"unspecified"`
114530
114531 - `id: optional string`
114532
114533 Unique identifier for the activity e.g. 'activity_abcd1234'
114534
114535 - `created_at: optional string`
114536
114537 When this activity occurred.
114538
114539 format: date-time
114540
114541 - `organization_id: optional string or null`
114542
114543 Organization ID this activity is associated with
114544
114545 - `organization_uuid: optional string or null`
114546
114547 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
114548
114549 - `PlatformTelemetryDestinationCreated object`
114550
114551 A telemetry destination was registered for the organization.
114552
114553 - `type: optional "platform_telemetry_destination_created"`
114554
114555 default: platform_telemetry_destination_created
114556
114557 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
114558
114559 - `APIActor object`
114560
114561 - `type: optional "api_actor"`
114562
114563 default: api_actor
114564
114565 - `api_key_id: string`
114566
114567 - `ip_address: string`
114568
114569 - `user_agent: string`
114570
114571 - `UserActor object`
114572
114573 - `type: optional "user_actor"`
114574
114575 default: user_actor
114576
114577 - `email_address: string`
114578
114579 format: email
114580
114581 - `ip_address: string`
114582
114583 - `user_agent: string`
114584
114585 - `user_id: string`
114586
114587 - `UnauthenticatedUserActor object`
114588
114589 - `type: optional "unauthenticated_user_actor"`
114590
114591 default: unauthenticated_user_actor
114592
114593 - `ip_address: string`
114594
114595 - `user_agent: string`
114596
114597 - `unauthenticated_email_address: optional string or null`
114598
114599 format: email
114600
114601 - `AnthropicActor object`
114602
114603 - `type: optional "anthropic_actor"`
114604
114605 default: anthropic_actor
114606
114607 - `email_address: optional string or null`
114608
114609 format: email
114610
114611 - `SystemActor object`
114612
114613 Automated background processing performed by Anthropic systems, acting
114614 without a user or customer credential.
114615
114616 - `type: optional "system_actor"`
114617
114618 default: system_actor
114619
114620 - `service: optional string or null`
114621
114622 Name of the automated process that performed the action, when known.
114623
114624 - `AdminAPIKeyActor object`
114625
114626 - `type: optional "admin_api_key_actor"`
114627
114628 default: admin_api_key_actor
114629
114630 - `admin_api_key_id: string`
114631
114632 - `ip_address: string`
114633
114634 - `user_agent: string`
114635
114636 - `ServiceAccountActor object`
114637
114638 - `type: optional "service_account_actor"`
114639
114640 default: service_account_actor
114641
114642 - `ip_address: string`
114643
114644 - `service_account_id: string`
114645
114646 - `user_agent: string`
114647
114648 - `ScimDirectorySyncActor object`
114649
114650 - `type: optional "scim_directory_sync_actor"`
114651
114652 default: scim_directory_sync_actor
114653
114654 - `directory_id: string`
114655
114656 - `workos_event_id: string`
114657
114658 - `idp_connection_type: optional string or null`
114659
114660 - `FederatedIdentityActor object`
114661
114662 A federated external workload authenticated via a verified OIDC token.
114663
114664 Carries the verified issuer, subject, and audience claims from the
114665 presented JWT.
114666
114667 - `type: optional "federated_identity_actor"`
114668
114669 default: federated_identity_actor
114670
114671 - `issuer: string`
114672
114673 - `subject: string`
114674
114675 - `audience: optional array of string`
114676
114677 - `ip_address: optional string or null`
114678
114679 - `user_agent: optional string or null`
114680
114681 - `FederatedActor object`
114682
114683 An external identity asserted by a trusted provider — a cloud-provider
114684 gateway or a customer-registered federation issuer — acting without an
114685 Anthropic-provisioned account or service account.
114686
114687 - `type: optional "federated_actor"`
114688
114689 default: federated_actor
114690
114691 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
114692
114693 - `FederatedActorAwsProvider object`
114694
114695 Asserting party: the AWS account the organization is bound to.
114696
114697 - `type: optional "aws"`
114698
114699 default: aws
114700
114701 - `account_id: string`
114702
114703 - `signed_principal: string`
114704
114705 The AWS-signed ARN of the IAM principal that requested the token.
114706
114707 - `FederatedActorAzureProvider object`
114708
114709 Asserting party: the Azure subscription the organization is bound to.
114710
114711 - `type: optional "azure"`
114712
114713 default: azure
114714
114715 - `subscription_id: string`
114716
114717 - `FederatedActorGcpProvider object`
114718
114719 Asserting party: the GCP project the organization is bound to.
114720
114721 - `type: optional "gcp"`
114722
114723 default: gcp
114724
114725 - `project_number: string`
114726
114727 - `FederatedActorOidcProvider object`
114728
114729 Asserting party: a customer-registered OIDC federation issuer.
114730
114731 - `type: optional "oidc"`
114732
114733 default: oidc
114734
114735 - `issuer: optional string or null`
114736
114737 The federation issuer's URL. Null when the presented credential failed verification.
114738
114739 - `ip_address: optional string or null`
114740
114741 - `subject: optional string or null`
114742
114743 The provider's verified identifier for the caller; its form depends on the provider.
114744
114745 - `user_agent: optional string or null`
114746
114747 - `AttestedDeviceActor object`
114748
114749 An attested mobile device authenticated via Apple App Attest.
114750
114751 - `type: optional "attested_device_actor"`
114752
114753 default: attested_device_actor
114754
114755 - `external_client_id: string`
114756
114757 - `kid_hash: string`
114758
114759 - `ip_address: optional string or null`
114760
114761 - `user_agent: optional string or null`
114762
114763 - `telemetry_destination_id: string`
114764
114765 Tagged telemetry destination ID, e.g. "tdst_01HX...".
114766
114767 - `id: optional string`
114768
114769 Unique identifier for the activity e.g. 'activity_abcd1234'
114770
114771 - `created_at: optional string`
114772
114773 When this activity occurred.
114774
114775 format: date-time
114776
114777 - `endpoint_url: optional string or null`
114778
114779 The destination's endpoint URL as stored, e.g. "https://collector.example.com/otlp"; the API refuses credentials, query strings and fragments in this URL.
114780
114781 - `organization_id: optional string or null`
114782
114783 Organization ID this activity is associated with
114784
114785 - `organization_uuid: optional string or null`
114786
114787 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
114788
114789 - `traces: optional object or null`
114790
114791 The destination's settings for traces, as the API returns them.
114792
114793 - `content_mode: string`
114794
114795 What the exported spans contain: "metadata_only", or "content" when they also carry message and tool content.
114796
114797 - `enabled: boolean`
114798
114799 Whether the destination receives traces.
114800
114801 - `endpoint_url: optional string or null`
114802
114803 The destination's separate traces URL as stored, e.g. "https://collector.example.com/v2/trace/otlp"; like the endpoint URL it never contains credentials, a query string or a fragment. Omitted when the destination has none; traces then go to the endpoint URL plus "/v1/traces".
114804
114805 - `max_content_bytes: optional number or null`
114806
114807 The most bytes of content that one exported span keeps; omitted when the destination sets no bound and only Anthropic's maximum applies.
114808
114809 - `workspaces: optional object or null`
114810
114811 Which workspaces the destination covers, as the API returns it: its type only, "all", "include" or "exclude". The workspaces put on its list by the same request are recorded as workspace_added activities.
114812
114813 - `type: string`
114814
114815 "all": every workspace of the organization; "include": the workspaces on the destination's list; "exclude": every workspace but those on its list.
114816
114817 - `PlatformTelemetryDestinationDeleted object`
114818
114819 A telemetry destination was deleted.
114820
114821 - `type: optional "platform_telemetry_destination_deleted"`
114822
114823 default: platform_telemetry_destination_deleted
114824
114825 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
114826
114827 - `APIActor object`
114828
114829 - `type: optional "api_actor"`
114830
114831 default: api_actor
114832
114833 - `api_key_id: string`
114834
114835 - `ip_address: string`
114836
114837 - `user_agent: string`
114838
114839 - `UserActor object`
114840
114841 - `type: optional "user_actor"`
114842
114843 default: user_actor
114844
114845 - `email_address: string`
114846
114847 format: email
114848
114849 - `ip_address: string`
114850
114851 - `user_agent: string`
114852
114853 - `user_id: string`
114854
114855 - `UnauthenticatedUserActor object`
114856
114857 - `type: optional "unauthenticated_user_actor"`
114858
114859 default: unauthenticated_user_actor
114860
114861 - `ip_address: string`
114862
114863 - `user_agent: string`
114864
114865 - `unauthenticated_email_address: optional string or null`
114866
114867 format: email
114868
114869 - `AnthropicActor object`
114870
114871 - `type: optional "anthropic_actor"`
114872
114873 default: anthropic_actor
114874
114875 - `email_address: optional string or null`
114876
114877 format: email
114878
114879 - `SystemActor object`
114880
114881 Automated background processing performed by Anthropic systems, acting
114882 without a user or customer credential.
114883
114884 - `type: optional "system_actor"`
114885
114886 default: system_actor
114887
114888 - `service: optional string or null`
114889
114890 Name of the automated process that performed the action, when known.
114891
114892 - `AdminAPIKeyActor object`
114893
114894 - `type: optional "admin_api_key_actor"`
114895
114896 default: admin_api_key_actor
114897
114898 - `admin_api_key_id: string`
114899
114900 - `ip_address: string`
114901
114902 - `user_agent: string`
114903
114904 - `ServiceAccountActor object`
114905
114906 - `type: optional "service_account_actor"`
114907
114908 default: service_account_actor
114909
114910 - `ip_address: string`
114911
114912 - `service_account_id: string`
114913
114914 - `user_agent: string`
114915
114916 - `ScimDirectorySyncActor object`
114917
114918 - `type: optional "scim_directory_sync_actor"`
114919
114920 default: scim_directory_sync_actor
114921
114922 - `directory_id: string`
114923
114924 - `workos_event_id: string`
114925
114926 - `idp_connection_type: optional string or null`
114927
114928 - `FederatedIdentityActor object`
114929
114930 A federated external workload authenticated via a verified OIDC token.
114931
114932 Carries the verified issuer, subject, and audience claims from the
114933 presented JWT.
114934
114935 - `type: optional "federated_identity_actor"`
114936
114937 default: federated_identity_actor
114938
114939 - `issuer: string`
114940
114941 - `subject: string`
114942
114943 - `audience: optional array of string`
114944
114945 - `ip_address: optional string or null`
114946
114947 - `user_agent: optional string or null`
114948
114949 - `FederatedActor object`
114950
114951 An external identity asserted by a trusted provider — a cloud-provider
114952 gateway or a customer-registered federation issuer — acting without an
114953 Anthropic-provisioned account or service account.
114954
114955 - `type: optional "federated_actor"`
114956
114957 default: federated_actor
114958
114959 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
114960
114961 - `FederatedActorAwsProvider object`
114962
114963 Asserting party: the AWS account the organization is bound to.
114964
114965 - `type: optional "aws"`
114966
114967 default: aws
114968
114969 - `account_id: string`
114970
114971 - `signed_principal: string`
114972
114973 The AWS-signed ARN of the IAM principal that requested the token.
114974
114975 - `FederatedActorAzureProvider object`
114976
114977 Asserting party: the Azure subscription the organization is bound to.
114978
114979 - `type: optional "azure"`
114980
114981 default: azure
114982
114983 - `subscription_id: string`
114984
114985 - `FederatedActorGcpProvider object`
114986
114987 Asserting party: the GCP project the organization is bound to.
114988
114989 - `type: optional "gcp"`
114990
114991 default: gcp
114992
114993 - `project_number: string`
114994
114995 - `FederatedActorOidcProvider object`
114996
114997 Asserting party: a customer-registered OIDC federation issuer.
114998
114999 - `type: optional "oidc"`
115000
115001 default: oidc
115002
115003 - `issuer: optional string or null`
115004
115005 The federation issuer's URL. Null when the presented credential failed verification.
115006
115007 - `ip_address: optional string or null`
115008
115009 - `subject: optional string or null`
115010
115011 The provider's verified identifier for the caller; its form depends on the provider.
115012
115013 - `user_agent: optional string or null`
115014
115015 - `AttestedDeviceActor object`
115016
115017 An attested mobile device authenticated via Apple App Attest.
115018
115019 - `type: optional "attested_device_actor"`
115020
115021 default: attested_device_actor
115022
115023 - `external_client_id: string`
115024
115025 - `kid_hash: string`
115026
115027 - `ip_address: optional string or null`
115028
115029 - `user_agent: optional string or null`
115030
115031 - `telemetry_destination_id: string`
115032
115033 Tagged telemetry destination ID, e.g. "tdst_01HX...".
115034
115035 - `id: optional string`
115036
115037 Unique identifier for the activity e.g. 'activity_abcd1234'
115038
115039 - `created_at: optional string`
115040
115041 When this activity occurred.
115042
115043 format: date-time
115044
115045 - `organization_id: optional string or null`
115046
115047 Organization ID this activity is associated with
115048
115049 - `organization_uuid: optional string or null`
115050
115051 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
115052
115053 - `PlatformTelemetryDestinationUpdated object`
115054
115055 A telemetry destination's configuration was updated. State changes and changes of its workspace scope (the type, or the list through an update's workspace_ids) are included; the workspaces an update took off or put on the list are also recorded as workspace_removed and workspace_added activities. Previous and current values are recorded only for the endpoint URL, the traces URL, the content mode and the workspaces type.
115056
115057 - `type: optional "platform_telemetry_destination_updated"`
115058
115059 default: platform_telemetry_destination_updated
115060
115061 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
115062
115063 - `APIActor object`
115064
115065 - `type: optional "api_actor"`
115066
115067 default: api_actor
115068
115069 - `api_key_id: string`
115070
115071 - `ip_address: string`
115072
115073 - `user_agent: string`
115074
115075 - `UserActor object`
115076
115077 - `type: optional "user_actor"`
115078
115079 default: user_actor
115080
115081 - `email_address: string`
115082
115083 format: email
115084
115085 - `ip_address: string`
115086
115087 - `user_agent: string`
115088
115089 - `user_id: string`
115090
115091 - `UnauthenticatedUserActor object`
115092
115093 - `type: optional "unauthenticated_user_actor"`
115094
115095 default: unauthenticated_user_actor
115096
115097 - `ip_address: string`
115098
115099 - `user_agent: string`
115100
115101 - `unauthenticated_email_address: optional string or null`
115102
115103 format: email
115104
115105 - `AnthropicActor object`
115106
115107 - `type: optional "anthropic_actor"`
115108
115109 default: anthropic_actor
115110
115111 - `email_address: optional string or null`
115112
115113 format: email
115114
115115 - `SystemActor object`
115116
115117 Automated background processing performed by Anthropic systems, acting
115118 without a user or customer credential.
115119
115120 - `type: optional "system_actor"`
115121
115122 default: system_actor
115123
115124 - `service: optional string or null`
115125
115126 Name of the automated process that performed the action, when known.
115127
115128 - `AdminAPIKeyActor object`
115129
115130 - `type: optional "admin_api_key_actor"`
115131
115132 default: admin_api_key_actor
115133
115134 - `admin_api_key_id: string`
115135
115136 - `ip_address: string`
115137
115138 - `user_agent: string`
115139
115140 - `ServiceAccountActor object`
115141
115142 - `type: optional "service_account_actor"`
115143
115144 default: service_account_actor
115145
115146 - `ip_address: string`
115147
115148 - `service_account_id: string`
115149
115150 - `user_agent: string`
115151
115152 - `ScimDirectorySyncActor object`
115153
115154 - `type: optional "scim_directory_sync_actor"`
115155
115156 default: scim_directory_sync_actor
115157
115158 - `directory_id: string`
115159
115160 - `workos_event_id: string`
115161
115162 - `idp_connection_type: optional string or null`
115163
115164 - `FederatedIdentityActor object`
115165
115166 A federated external workload authenticated via a verified OIDC token.
115167
115168 Carries the verified issuer, subject, and audience claims from the
115169 presented JWT.
115170
115171 - `type: optional "federated_identity_actor"`
115172
115173 default: federated_identity_actor
115174
115175 - `issuer: string`
115176
115177 - `subject: string`
115178
115179 - `audience: optional array of string`
115180
115181 - `ip_address: optional string or null`
115182
115183 - `user_agent: optional string or null`
115184
115185 - `FederatedActor object`
115186
115187 An external identity asserted by a trusted provider — a cloud-provider
115188 gateway or a customer-registered federation issuer — acting without an
115189 Anthropic-provisioned account or service account.
115190
115191 - `type: optional "federated_actor"`
115192
115193 default: federated_actor
115194
115195 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
115196
115197 - `FederatedActorAwsProvider object`
115198
115199 Asserting party: the AWS account the organization is bound to.
115200
115201 - `type: optional "aws"`
115202
115203 default: aws
115204
115205 - `account_id: string`
115206
115207 - `signed_principal: string`
115208
115209 The AWS-signed ARN of the IAM principal that requested the token.
115210
115211 - `FederatedActorAzureProvider object`
115212
115213 Asserting party: the Azure subscription the organization is bound to.
115214
115215 - `type: optional "azure"`
115216
115217 default: azure
115218
115219 - `subscription_id: string`
115220
115221 - `FederatedActorGcpProvider object`
115222
115223 Asserting party: the GCP project the organization is bound to.
115224
115225 - `type: optional "gcp"`
115226
115227 default: gcp
115228
115229 - `project_number: string`
115230
115231 - `FederatedActorOidcProvider object`
115232
115233 Asserting party: a customer-registered OIDC federation issuer.
115234
115235 - `type: optional "oidc"`
115236
115237 default: oidc
115238
115239 - `issuer: optional string or null`
115240
115241 The federation issuer's URL. Null when the presented credential failed verification.
115242
115243 - `ip_address: optional string or null`
115244
115245 - `subject: optional string or null`
115246
115247 The provider's verified identifier for the caller; its form depends on the provider.
115248
115249 - `user_agent: optional string or null`
115250
115251 - `AttestedDeviceActor object`
115252
115253 An attested mobile device authenticated via Apple App Attest.
115254
115255 - `type: optional "attested_device_actor"`
115256
115257 default: attested_device_actor
115258
115259 - `external_client_id: string`
115260
115261 - `kid_hash: string`
115262
115263 - `ip_address: optional string or null`
115264
115265 - `user_agent: optional string or null`
115266
115267 - `telemetry_destination_id: string`
115268
115269 Tagged telemetry destination ID, e.g. "tdst_01HX...".
115270
115271 - `id: optional string`
115272
115273 Unique identifier for the activity e.g. 'activity_abcd1234'
115274
115275 - `created_at: optional string`
115276
115277 When this activity occurred.
115278
115279 format: date-time
115280
115281 - `organization_id: optional string or null`
115282
115283 Organization ID this activity is associated with
115284
115285 - `organization_uuid: optional string or null`
115286
115287 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
115288
115289 - `updated_fields: optional array of string`
115290
115291 Names of the configuration fields whose value changed, e.g. "endpoint_url", "headers", "state"; "traces" when any setting for traces changed. Header names and values are never included.
115292
115293 - `updates: optional array of object`
115294
115295 The field-level value changes in this update, in this order: an "endpoint_url" entry when the endpoint URL changed, a "traces_endpoint_url" entry when the traces URL changed, a "traces_content_mode" entry when the content mode changed, and a "workspaces" entry ("all", "include" or "exclude") when the workspaces type changed; empty otherwise.
115296
115297 - `type: "endpoint_url" or "traces_content_mode" or "traces_endpoint_url" or 2 more`
115298
115299 The destination field that changed
115300
115301 - `"endpoint_url"`
115302
115303 - `"traces_content_mode"`
115304
115305 - `"traces_endpoint_url"`
115306
115307 - `"unspecified"`
115308
115309 - `"workspaces"`
115310
115311 - `current_value: string`
115312
115313 Field value immediately after this change
115314
115315 - `previous_value: string`
115316
115317 Field value immediately before this change
115318
115319 - `PlatformTelemetryDestinationWorkspaceAdded object`
115320
115321 A workspace was added to the workspace list of a telemetry destination. When the list type is "include", the destination starts to receive the spans of that workspace; when it is "exclude", the destination stops receiving them.
115322
115323 - `type: optional "platform_telemetry_destination_workspace_added"`
115324
115325 default: platform_telemetry_destination_workspace_added
115326
115327 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
115328
115329 - `APIActor object`
115330
115331 - `type: optional "api_actor"`
115332
115333 default: api_actor
115334
115335 - `api_key_id: string`
115336
115337 - `ip_address: string`
115338
115339 - `user_agent: string`
115340
115341 - `UserActor object`
115342
115343 - `type: optional "user_actor"`
115344
115345 default: user_actor
115346
115347 - `email_address: string`
115348
115349 format: email
115350
115351 - `ip_address: string`
115352
115353 - `user_agent: string`
115354
115355 - `user_id: string`
115356
115357 - `UnauthenticatedUserActor object`
115358
115359 - `type: optional "unauthenticated_user_actor"`
115360
115361 default: unauthenticated_user_actor
115362
115363 - `ip_address: string`
115364
115365 - `user_agent: string`
115366
115367 - `unauthenticated_email_address: optional string or null`
115368
115369 format: email
115370
115371 - `AnthropicActor object`
115372
115373 - `type: optional "anthropic_actor"`
115374
115375 default: anthropic_actor
115376
115377 - `email_address: optional string or null`
115378
115379 format: email
115380
115381 - `SystemActor object`
115382
115383 Automated background processing performed by Anthropic systems, acting
115384 without a user or customer credential.
115385
115386 - `type: optional "system_actor"`
115387
115388 default: system_actor
115389
115390 - `service: optional string or null`
115391
115392 Name of the automated process that performed the action, when known.
115393
115394 - `AdminAPIKeyActor object`
115395
115396 - `type: optional "admin_api_key_actor"`
115397
115398 default: admin_api_key_actor
115399
115400 - `admin_api_key_id: string`
115401
115402 - `ip_address: string`
115403
115404 - `user_agent: string`
115405
115406 - `ServiceAccountActor object`
115407
115408 - `type: optional "service_account_actor"`
115409
115410 default: service_account_actor
115411
115412 - `ip_address: string`
115413
115414 - `service_account_id: string`
115415
115416 - `user_agent: string`
115417
115418 - `ScimDirectorySyncActor object`
115419
115420 - `type: optional "scim_directory_sync_actor"`
115421
115422 default: scim_directory_sync_actor
115423
115424 - `directory_id: string`
115425
115426 - `workos_event_id: string`
115427
115428 - `idp_connection_type: optional string or null`
115429
115430 - `FederatedIdentityActor object`
115431
115432 A federated external workload authenticated via a verified OIDC token.
115433
115434 Carries the verified issuer, subject, and audience claims from the
115435 presented JWT.
115436
115437 - `type: optional "federated_identity_actor"`
115438
115439 default: federated_identity_actor
115440
115441 - `issuer: string`
115442
115443 - `subject: string`
115444
115445 - `audience: optional array of string`
115446
115447 - `ip_address: optional string or null`
115448
115449 - `user_agent: optional string or null`
115450
115451 - `FederatedActor object`
115452
115453 An external identity asserted by a trusted provider — a cloud-provider
115454 gateway or a customer-registered federation issuer — acting without an
115455 Anthropic-provisioned account or service account.
115456
115457 - `type: optional "federated_actor"`
115458
115459 default: federated_actor
115460
115461 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
115462
115463 - `FederatedActorAwsProvider object`
115464
115465 Asserting party: the AWS account the organization is bound to.
115466
115467 - `type: optional "aws"`
115468
115469 default: aws
115470
115471 - `account_id: string`
115472
115473 - `signed_principal: string`
115474
115475 The AWS-signed ARN of the IAM principal that requested the token.
115476
115477 - `FederatedActorAzureProvider object`
115478
115479 Asserting party: the Azure subscription the organization is bound to.
115480
115481 - `type: optional "azure"`
115482
115483 default: azure
115484
115485 - `subscription_id: string`
115486
115487 - `FederatedActorGcpProvider object`
115488
115489 Asserting party: the GCP project the organization is bound to.
115490
115491 - `type: optional "gcp"`
115492
115493 default: gcp
115494
115495 - `project_number: string`
115496
115497 - `FederatedActorOidcProvider object`
115498
115499 Asserting party: a customer-registered OIDC federation issuer.
115500
115501 - `type: optional "oidc"`
115502
115503 default: oidc
115504
115505 - `issuer: optional string or null`
115506
115507 The federation issuer's URL. Null when the presented credential failed verification.
115508
115509 - `ip_address: optional string or null`
115510
115511 - `subject: optional string or null`
115512
115513 The provider's verified identifier for the caller; its form depends on the provider.
115514
115515 - `user_agent: optional string or null`
115516
115517 - `AttestedDeviceActor object`
115518
115519 An attested mobile device authenticated via Apple App Attest.
115520
115521 - `type: optional "attested_device_actor"`
115522
115523 default: attested_device_actor
115524
115525 - `external_client_id: string`
115526
115527 - `kid_hash: string`
115528
115529 - `ip_address: optional string or null`
115530
115531 - `user_agent: optional string or null`
115532
115533 - `telemetry_destination_id: string`
115534
115535 Tagged telemetry destination ID, e.g. "tdst_01HX...".
115536
115537 - `workspace_id: string`
115538
115539 Tagged ID of the workspace put on the list, e.g. "wrkspc_01HX...".
115540
115541 - `id: optional string`
115542
115543 Unique identifier for the activity e.g. 'activity_abcd1234'
115544
115545 - `created_at: optional string`
115546
115547 When this activity occurred.
115548
115549 format: date-time
115550
115551 - `organization_id: optional string or null`
115552
115553 Organization ID this activity is associated with
115554
115555 - `organization_uuid: optional string or null`
115556
115557 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
115558
115559 - `PlatformTelemetryDestinationWorkspaceRemoved object`
115560
115561 A workspace was removed from the workspace list of a telemetry destination, by a change to the list or because the destination was deleted. When the list type is "include", the destination stops receiving the spans of that workspace; when it is "exclude", the destination receives them again unless the destination was deleted.
115562
115563 - `type: optional "platform_telemetry_destination_workspace_removed"`
115564
115565 default: platform_telemetry_destination_workspace_removed
115566
115567 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
115568
115569 - `APIActor object`
115570
115571 - `type: optional "api_actor"`
115572
115573 default: api_actor
115574
115575 - `api_key_id: string`
115576
115577 - `ip_address: string`
115578
115579 - `user_agent: string`
115580
115581 - `UserActor object`
115582
115583 - `type: optional "user_actor"`
115584
115585 default: user_actor
115586
115587 - `email_address: string`
115588
115589 format: email
115590
115591 - `ip_address: string`
115592
115593 - `user_agent: string`
115594
115595 - `user_id: string`
115596
115597 - `UnauthenticatedUserActor object`
115598
115599 - `type: optional "unauthenticated_user_actor"`
115600
115601 default: unauthenticated_user_actor
115602
115603 - `ip_address: string`
115604
115605 - `user_agent: string`
115606
115607 - `unauthenticated_email_address: optional string or null`
115608
115609 format: email
115610
115611 - `AnthropicActor object`
115612
115613 - `type: optional "anthropic_actor"`
115614
115615 default: anthropic_actor
115616
115617 - `email_address: optional string or null`
115618
115619 format: email
115620
115621 - `SystemActor object`
115622
115623 Automated background processing performed by Anthropic systems, acting
115624 without a user or customer credential.
115625
115626 - `type: optional "system_actor"`
115627
115628 default: system_actor
115629
115630 - `service: optional string or null`
115631
115632 Name of the automated process that performed the action, when known.
115633
115634 - `AdminAPIKeyActor object`
115635
115636 - `type: optional "admin_api_key_actor"`
115637
115638 default: admin_api_key_actor
115639
115640 - `admin_api_key_id: string`
115641
115642 - `ip_address: string`
115643
115644 - `user_agent: string`
115645
115646 - `ServiceAccountActor object`
115647
115648 - `type: optional "service_account_actor"`
115649
115650 default: service_account_actor
115651
115652 - `ip_address: string`
115653
115654 - `service_account_id: string`
115655
115656 - `user_agent: string`
115657
115658 - `ScimDirectorySyncActor object`
115659
115660 - `type: optional "scim_directory_sync_actor"`
115661
115662 default: scim_directory_sync_actor
115663
115664 - `directory_id: string`
115665
115666 - `workos_event_id: string`
115667
115668 - `idp_connection_type: optional string or null`
115669
115670 - `FederatedIdentityActor object`
115671
115672 A federated external workload authenticated via a verified OIDC token.
115673
115674 Carries the verified issuer, subject, and audience claims from the
115675 presented JWT.
115676
115677 - `type: optional "federated_identity_actor"`
115678
115679 default: federated_identity_actor
115680
115681 - `issuer: string`
115682
115683 - `subject: string`
115684
115685 - `audience: optional array of string`
115686
115687 - `ip_address: optional string or null`
115688
115689 - `user_agent: optional string or null`
115690
115691 - `FederatedActor object`
115692
115693 An external identity asserted by a trusted provider — a cloud-provider
115694 gateway or a customer-registered federation issuer — acting without an
115695 Anthropic-provisioned account or service account.
115696
115697 - `type: optional "federated_actor"`
115698
115699 default: federated_actor
115700
115701 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
115702
115703 - `FederatedActorAwsProvider object`
115704
115705 Asserting party: the AWS account the organization is bound to.
115706
115707 - `type: optional "aws"`
115708
115709 default: aws
115710
115711 - `account_id: string`
115712
115713 - `signed_principal: string`
115714
115715 The AWS-signed ARN of the IAM principal that requested the token.
115716
115717 - `FederatedActorAzureProvider object`
115718
115719 Asserting party: the Azure subscription the organization is bound to.
115720
115721 - `type: optional "azure"`
115722
115723 default: azure
115724
115725 - `subscription_id: string`
115726
115727 - `FederatedActorGcpProvider object`
115728
115729 Asserting party: the GCP project the organization is bound to.
115730
115731 - `type: optional "gcp"`
115732
115733 default: gcp
115734
115735 - `project_number: string`
115736
115737 - `FederatedActorOidcProvider object`
115738
115739 Asserting party: a customer-registered OIDC federation issuer.
115740
115741 - `type: optional "oidc"`
115742
115743 default: oidc
115744
115745 - `issuer: optional string or null`
115746
115747 The federation issuer's URL. Null when the presented credential failed verification.
115748
115749 - `ip_address: optional string or null`
115750
115751 - `subject: optional string or null`
115752
115753 The provider's verified identifier for the caller; its form depends on the provider.
115754
115755 - `user_agent: optional string or null`
115756
115757 - `AttestedDeviceActor object`
115758
115759 An attested mobile device authenticated via Apple App Attest.
115760
115761 - `type: optional "attested_device_actor"`
115762
115763 default: attested_device_actor
115764
115765 - `external_client_id: string`
115766
115767 - `kid_hash: string`
115768
115769 - `ip_address: optional string or null`
115770
115771 - `user_agent: optional string or null`
115772
115773 - `telemetry_destination_id: string`
115774
115775 Tagged telemetry destination ID, e.g. "tdst_01HX...".
115776
115777 - `workspace_id: string`
115778
115779 Tagged ID of the workspace taken off the list, e.g. "wrkspc_01HX...".
115780
115781 - `id: optional string`
115782
115783 Unique identifier for the activity e.g. 'activity_abcd1234'
115784
115785 - `created_at: optional string`
115786
115787 When this activity occurred.
115788
115789 format: date-time
115790
115791 - `organization_id: optional string or null`
115792
115793 Organization ID this activity is associated with
115794
115795 - `organization_uuid: optional string or null`
115796
115797 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
115798
112111115799 - `PlatformUsageReportClaudeCodeViewed object`
112112115800
112113115801 The Claude Code usage report was viewed.
from line 144544
140856144544
140857144545### Activity List Response
140858144546
140859- `ActivityListResponse = AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 544 more`
144547- `ActivityListResponse = AbuseDecisionReceived or AccountDeleted or AccountMigrationCompleted or 558 more`
140860144548
140861144549 - `AbuseDecisionReceived object`
140862144550
from line 145022
141334145022
141335145023 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
141336145024
145025 - `AccountMigrationCompleted object`
145026
145027 A personal Claude account's migration into the organization finished: the migrated data is now part of the organization.
145028
145029 - `type: optional "account_migration_completed"`
145030
145031 default: account_migration_completed
145032
145033 - `account_migration_id: string`
145034
145035 Tagged ID of the migration, e.g. "amig_...", matching the account_migration_started activity that opened it.
145036
145037 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
145038
145039 - `APIActor object`
145040
145041 - `type: optional "api_actor"`
145042
145043 default: api_actor
145044
145045 - `api_key_id: string`
145046
145047 - `ip_address: string`
145048
145049 - `user_agent: string`
145050
145051 - `UserActor object`
145052
145053 - `type: optional "user_actor"`
145054
145055 default: user_actor
145056
145057 - `email_address: string`
145058
145059 format: email
145060
145061 - `ip_address: string`
145062
145063 - `user_agent: string`
145064
145065 - `user_id: string`
145066
145067 - `UnauthenticatedUserActor object`
145068
145069 - `type: optional "unauthenticated_user_actor"`
145070
145071 default: unauthenticated_user_actor
145072
145073 - `ip_address: string`
145074
145075 - `user_agent: string`
145076
145077 - `unauthenticated_email_address: optional string or null`
145078
145079 format: email
145080
145081 - `AnthropicActor object`
145082
145083 - `type: optional "anthropic_actor"`
145084
145085 default: anthropic_actor
145086
145087 - `email_address: optional string or null`
145088
145089 format: email
145090
145091 - `SystemActor object`
145092
145093 Automated background processing performed by Anthropic systems, acting
145094 without a user or customer credential.
145095
145096 - `type: optional "system_actor"`
145097
145098 default: system_actor
145099
145100 - `service: optional string or null`
145101
145102 Name of the automated process that performed the action, when known.
145103
145104 - `AdminAPIKeyActor object`
145105
145106 - `type: optional "admin_api_key_actor"`
145107
145108 default: admin_api_key_actor
145109
145110 - `admin_api_key_id: string`
145111
145112 - `ip_address: string`
145113
145114 - `user_agent: string`
145115
145116 - `ServiceAccountActor object`
145117
145118 - `type: optional "service_account_actor"`
145119
145120 default: service_account_actor
145121
145122 - `ip_address: string`
145123
145124 - `service_account_id: string`
145125
145126 - `user_agent: string`
145127
145128 - `ScimDirectorySyncActor object`
145129
145130 - `type: optional "scim_directory_sync_actor"`
145131
145132 default: scim_directory_sync_actor
145133
145134 - `directory_id: string`
145135
145136 - `workos_event_id: string`
145137
145138 - `idp_connection_type: optional string or null`
145139
145140 - `FederatedIdentityActor object`
145141
145142 A federated external workload authenticated via a verified OIDC token.
145143
145144 Carries the verified issuer, subject, and audience claims from the
145145 presented JWT.
145146
145147 - `type: optional "federated_identity_actor"`
145148
145149 default: federated_identity_actor
145150
145151 - `issuer: string`
145152
145153 - `subject: string`
145154
145155 - `audience: optional array of string`
145156
145157 - `ip_address: optional string or null`
145158
145159 - `user_agent: optional string or null`
145160
145161 - `FederatedActor object`
145162
145163 An external identity asserted by a trusted provider — a cloud-provider
145164 gateway or a customer-registered federation issuer — acting without an
145165 Anthropic-provisioned account or service account.
145166
145167 - `type: optional "federated_actor"`
145168
145169 default: federated_actor
145170
145171 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
145172
145173 - `FederatedActorAwsProvider object`
145174
145175 Asserting party: the AWS account the organization is bound to.
145176
145177 - `type: optional "aws"`
145178
145179 default: aws
145180
145181 - `account_id: string`
145182
145183 - `signed_principal: string`
145184
145185 The AWS-signed ARN of the IAM principal that requested the token.
145186
145187 - `FederatedActorAzureProvider object`
145188
145189 Asserting party: the Azure subscription the organization is bound to.
145190
145191 - `type: optional "azure"`
145192
145193 default: azure
145194
145195 - `subscription_id: string`
145196
145197 - `FederatedActorGcpProvider object`
145198
145199 Asserting party: the GCP project the organization is bound to.
145200
145201 - `type: optional "gcp"`
145202
145203 default: gcp
145204
145205 - `project_number: string`
145206
145207 - `FederatedActorOidcProvider object`
145208
145209 Asserting party: a customer-registered OIDC federation issuer.
145210
145211 - `type: optional "oidc"`
145212
145213 default: oidc
145214
145215 - `issuer: optional string or null`
145216
145217 The federation issuer's URL. Null when the presented credential failed verification.
145218
145219 - `ip_address: optional string or null`
145220
145221 - `subject: optional string or null`
145222
145223 The provider's verified identifier for the caller; its form depends on the provider.
145224
145225 - `user_agent: optional string or null`
145226
145227 - `AttestedDeviceActor object`
145228
145229 An attested mobile device authenticated via Apple App Attest.
145230
145231 - `type: optional "attested_device_actor"`
145232
145233 default: attested_device_actor
145234
145235 - `external_client_id: string`
145236
145237 - `kid_hash: string`
145238
145239 - `ip_address: optional string or null`
145240
145241 - `user_agent: optional string or null`
145242
145243 - `id: optional string`
145244
145245 Unique identifier for the activity e.g. 'activity_abcd1234'
145246
145247 - `created_at: optional string`
145248
145249 When this activity occurred.
145250
145251 format: date-time
145252
145253 - `migrated_user_email: optional string or null`
145254
145255 Email address of the user whose personal account was migrated, when known.
145256
145257 - `migrated_user_id: optional string or null`
145258
145259 Tagged ID of the user whose personal account was migrated, e.g. "user_...", when known.
145260
145261 - `organization_id: optional string or null`
145262
145263 Organization ID this activity is associated with
145264
145265 - `organization_uuid: optional string or null`
145266
145267 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
145268
145269 - `AccountMigrationFailed object`
145270
145271 A personal Claude account's migration into the organization did not complete.
145272
145273 - `type: optional "account_migration_failed"`
145274
145275 default: account_migration_failed
145276
145277 - `account_migration_id: string`
145278
145279 Tagged ID of the migration, e.g. "amig_...", matching the account_migration_started activity that opened it, if one was recorded; a later retry is a new migration with its own ID.
145280
145281 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
145282
145283 - `APIActor object`
145284
145285 - `type: optional "api_actor"`
145286
145287 default: api_actor
145288
145289 - `api_key_id: string`
145290
145291 - `ip_address: string`
145292
145293 - `user_agent: string`
145294
145295 - `UserActor object`
145296
145297 - `type: optional "user_actor"`
145298
145299 default: user_actor
145300
145301 - `email_address: string`
145302
145303 format: email
145304
145305 - `ip_address: string`
145306
145307 - `user_agent: string`
145308
145309 - `user_id: string`
145310
145311 - `UnauthenticatedUserActor object`
145312
145313 - `type: optional "unauthenticated_user_actor"`
145314
145315 default: unauthenticated_user_actor
145316
145317 - `ip_address: string`
145318
145319 - `user_agent: string`
145320
145321 - `unauthenticated_email_address: optional string or null`
145322
145323 format: email
145324
145325 - `AnthropicActor object`
145326
145327 - `type: optional "anthropic_actor"`
145328
145329 default: anthropic_actor
145330
145331 - `email_address: optional string or null`
145332
145333 format: email
145334
145335 - `SystemActor object`
145336
145337 Automated background processing performed by Anthropic systems, acting
145338 without a user or customer credential.
145339
145340 - `type: optional "system_actor"`
145341
145342 default: system_actor
145343
145344 - `service: optional string or null`
145345
145346 Name of the automated process that performed the action, when known.
145347
145348 - `AdminAPIKeyActor object`
145349
145350 - `type: optional "admin_api_key_actor"`
145351
145352 default: admin_api_key_actor
145353
145354 - `admin_api_key_id: string`
145355
145356 - `ip_address: string`
145357
145358 - `user_agent: string`
145359
145360 - `ServiceAccountActor object`
145361
145362 - `type: optional "service_account_actor"`
145363
145364 default: service_account_actor
145365
145366 - `ip_address: string`
145367
145368 - `service_account_id: string`
145369
145370 - `user_agent: string`
145371
145372 - `ScimDirectorySyncActor object`
145373
145374 - `type: optional "scim_directory_sync_actor"`
145375
145376 default: scim_directory_sync_actor
145377
145378 - `directory_id: string`
145379
145380 - `workos_event_id: string`
145381
145382 - `idp_connection_type: optional string or null`
145383
145384 - `FederatedIdentityActor object`
145385
145386 A federated external workload authenticated via a verified OIDC token.
145387
145388 Carries the verified issuer, subject, and audience claims from the
145389 presented JWT.
145390
145391 - `type: optional "federated_identity_actor"`
145392
145393 default: federated_identity_actor
145394
145395 - `issuer: string`
145396
145397 - `subject: string`
145398
145399 - `audience: optional array of string`
145400
145401 - `ip_address: optional string or null`
145402
145403 - `user_agent: optional string or null`
145404
145405 - `FederatedActor object`
145406
145407 An external identity asserted by a trusted provider — a cloud-provider
145408 gateway or a customer-registered federation issuer — acting without an
145409 Anthropic-provisioned account or service account.
145410
145411 - `type: optional "federated_actor"`
145412
145413 default: federated_actor
145414
145415 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
145416
145417 - `FederatedActorAwsProvider object`
145418
145419 Asserting party: the AWS account the organization is bound to.
145420
145421 - `type: optional "aws"`
145422
145423 default: aws
145424
145425 - `account_id: string`
145426
145427 - `signed_principal: string`
145428
145429 The AWS-signed ARN of the IAM principal that requested the token.
145430
145431 - `FederatedActorAzureProvider object`
145432
145433 Asserting party: the Azure subscription the organization is bound to.
145434
145435 - `type: optional "azure"`
145436
145437 default: azure
145438
145439 - `subscription_id: string`
145440
145441 - `FederatedActorGcpProvider object`
145442
145443 Asserting party: the GCP project the organization is bound to.
145444
145445 - `type: optional "gcp"`
145446
145447 default: gcp
145448
145449 - `project_number: string`
145450
145451 - `FederatedActorOidcProvider object`
145452
145453 Asserting party: a customer-registered OIDC federation issuer.
145454
145455 - `type: optional "oidc"`
145456
145457 default: oidc
145458
145459 - `issuer: optional string or null`
145460
145461 The federation issuer's URL. Null when the presented credential failed verification.
145462
145463 - `ip_address: optional string or null`
145464
145465 - `subject: optional string or null`
145466
145467 The provider's verified identifier for the caller; its form depends on the provider.
145468
145469 - `user_agent: optional string or null`
145470
145471 - `AttestedDeviceActor object`
145472
145473 An attested mobile device authenticated via Apple App Attest.
145474
145475 - `type: optional "attested_device_actor"`
145476
145477 default: attested_device_actor
145478
145479 - `external_client_id: string`
145480
145481 - `kid_hash: string`
145482
145483 - `ip_address: optional string or null`
145484
145485 - `user_agent: optional string or null`
145486
145487 - `id: optional string`
145488
145489 Unique identifier for the activity e.g. 'activity_abcd1234'
145490
145491 - `created_at: optional string`
145492
145493 When this activity occurred.
145494
145495 format: date-time
145496
145497 - `failure_reasons: optional array of "already_member_of_target" or "already_migrating" or "anthropic_staff_action" or 12 more`
145498
145499 Why the migration did not complete, each reason listed once. In these values "source" is the member's personal account and "target" is this organization. "source_equals_target", "source_not_personal_org", "user_not_member_of_source" and "user_not_sole_member_of_source": the account is not a single-member personal account that can be migrated. "target_not_enterprise_org": this organization's plan does not accept the migration. "already_member_of_target": the migration already happened. "target_membership_not_provisioned" and "target_membership_unassigned_no_seats": the member has no usable seat in this organization. "already_migrating": another migration of the same account is in progress. "source_too_large": the personal account holds more data than a migration can move. "target_became_inactive": this organization became inactive before the migration finished. "migration_failed": an error stopped the migration. "anthropic_staff_action": Anthropic staff stopped the migration. "migration_blocked_redacted": stands in for every reason that is not shared with the organization. Values may be added over time; treat an unrecognized value as a generic failure. "unspecified" is never emitted.
145500
145501 - `"already_member_of_target"`
145502
145503 - `"already_migrating"`
145504
145505 - `"anthropic_staff_action"`
145506
145507 - `"migration_blocked_redacted"`
145508
145509 - `"migration_failed"`
145510
145511 - `"source_equals_target"`
145512
145513 - `"source_not_personal_org"`
145514
145515 - `"source_too_large"`
145516
145517 - `"target_became_inactive"`
145518
145519 - `"target_membership_not_provisioned"`
145520
145521 - `"target_membership_unassigned_no_seats"`
145522
145523 - `"target_not_enterprise_org"`
145524
145525 - `"unspecified"`
145526
145527 - `"user_not_member_of_source"`
145528
145529 - `"user_not_sole_member_of_source"`
145530
145531 - `migrated_user_email: optional string or null`
145532
145533 Email address of the user whose personal account was being migrated, when known.
145534
145535 - `migrated_user_id: optional string or null`
145536
145537 Tagged ID of the user whose personal account was being migrated, e.g. "user_...", when known.
145538
145539 - `organization_id: optional string or null`
145540
145541 Organization ID this activity is associated with
145542
145543 - `organization_uuid: optional string or null`
145544
145545 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
145546
145547 - `AccountMigrationStarted object`
145548
145549 A personal Claude account began migrating into the organization: its data, including conversations, projects and files, is being moved from the member's personal account into this organization.
145550
145551 - `type: optional "account_migration_started"`
145552
145553 default: account_migration_started
145554
145555 - `account_migration_id: string`
145556
145557 Tagged ID of the migration, e.g. "amig_...". The same ID appears on the completed or failed activity that closes the migration, when one is recorded.
145558
145559 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
145560
145561 - `APIActor object`
145562
145563 - `type: optional "api_actor"`
145564
145565 default: api_actor
145566
145567 - `api_key_id: string`
145568
145569 - `ip_address: string`
145570
145571 - `user_agent: string`
145572
145573 - `UserActor object`
145574
145575 - `type: optional "user_actor"`
145576
145577 default: user_actor
145578
145579 - `email_address: string`
145580
145581 format: email
145582
145583 - `ip_address: string`
145584
145585 - `user_agent: string`
145586
145587 - `user_id: string`
145588
145589 - `UnauthenticatedUserActor object`
145590
145591 - `type: optional "unauthenticated_user_actor"`
145592
145593 default: unauthenticated_user_actor
145594
145595 - `ip_address: string`
145596
145597 - `user_agent: string`
145598
145599 - `unauthenticated_email_address: optional string or null`
145600
145601 format: email
145602
145603 - `AnthropicActor object`
145604
145605 - `type: optional "anthropic_actor"`
145606
145607 default: anthropic_actor
145608
145609 - `email_address: optional string or null`
145610
145611 format: email
145612
145613 - `SystemActor object`
145614
145615 Automated background processing performed by Anthropic systems, acting
145616 without a user or customer credential.
145617
145618 - `type: optional "system_actor"`
145619
145620 default: system_actor
145621
145622 - `service: optional string or null`
145623
145624 Name of the automated process that performed the action, when known.
145625
145626 - `AdminAPIKeyActor object`
145627
145628 - `type: optional "admin_api_key_actor"`
145629
145630 default: admin_api_key_actor
145631
145632 - `admin_api_key_id: string`
145633
145634 - `ip_address: string`
145635
145636 - `user_agent: string`
145637
145638 - `ServiceAccountActor object`
145639
145640 - `type: optional "service_account_actor"`
145641
145642 default: service_account_actor
145643
145644 - `ip_address: string`
145645
145646 - `service_account_id: string`
145647
145648 - `user_agent: string`
145649
145650 - `ScimDirectorySyncActor object`
145651
145652 - `type: optional "scim_directory_sync_actor"`
145653
145654 default: scim_directory_sync_actor
145655
145656 - `directory_id: string`
145657
145658 - `workos_event_id: string`
145659
145660 - `idp_connection_type: optional string or null`
145661
145662 - `FederatedIdentityActor object`
145663
145664 A federated external workload authenticated via a verified OIDC token.
145665
145666 Carries the verified issuer, subject, and audience claims from the
145667 presented JWT.
145668
145669 - `type: optional "federated_identity_actor"`
145670
145671 default: federated_identity_actor
145672
145673 - `issuer: string`
145674
145675 - `subject: string`
145676
145677 - `audience: optional array of string`
145678
145679 - `ip_address: optional string or null`
145680
145681 - `user_agent: optional string or null`
145682
145683 - `FederatedActor object`
145684
145685 An external identity asserted by a trusted provider — a cloud-provider
145686 gateway or a customer-registered federation issuer — acting without an
145687 Anthropic-provisioned account or service account.
145688
145689 - `type: optional "federated_actor"`
145690
145691 default: federated_actor
145692
145693 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
145694
145695 - `FederatedActorAwsProvider object`
145696
145697 Asserting party: the AWS account the organization is bound to.
145698
145699 - `type: optional "aws"`
145700
145701 default: aws
145702
145703 - `account_id: string`
145704
145705 - `signed_principal: string`
145706
145707 The AWS-signed ARN of the IAM principal that requested the token.
145708
145709 - `FederatedActorAzureProvider object`
145710
145711 Asserting party: the Azure subscription the organization is bound to.
145712
145713 - `type: optional "azure"`
145714
145715 default: azure
145716
145717 - `subscription_id: string`
145718
145719 - `FederatedActorGcpProvider object`
145720
145721 Asserting party: the GCP project the organization is bound to.
145722
145723 - `type: optional "gcp"`
145724
145725 default: gcp
145726
145727 - `project_number: string`
145728
145729 - `FederatedActorOidcProvider object`
145730
145731 Asserting party: a customer-registered OIDC federation issuer.
145732
145733 - `type: optional "oidc"`
145734
145735 default: oidc
145736
145737 - `issuer: optional string or null`
145738
145739 The federation issuer's URL. Null when the presented credential failed verification.
145740
145741 - `ip_address: optional string or null`
145742
145743 - `subject: optional string or null`
145744
145745 The provider's verified identifier for the caller; its form depends on the provider.
145746
145747 - `user_agent: optional string or null`
145748
145749 - `AttestedDeviceActor object`
145750
145751 An attested mobile device authenticated via Apple App Attest.
145752
145753 - `type: optional "attested_device_actor"`
145754
145755 default: attested_device_actor
145756
145757 - `external_client_id: string`
145758
145759 - `kid_hash: string`
145760
145761 - `ip_address: optional string or null`
145762
145763 - `user_agent: optional string or null`
145764
145765 - `migrated_user_email: string`
145766
145767 Email address of the user whose personal account is being migrated.
145768
145769 - `migrated_user_id: string`
145770
145771 Tagged ID of the user whose personal account is being migrated, e.g. "user_...".
145772
145773 - `id: optional string`
145774
145775 Unique identifier for the activity e.g. 'activity_abcd1234'
145776
145777 - `created_at: optional string`
145778
145779 When this activity occurred.
145780
145781 format: date-time
145782
145783 - `organization_id: optional string or null`
145784
145785 Organization ID this activity is associated with
145786
145787 - `organization_uuid: optional string or null`
145788
145789 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
145790
141337145791 - `AdminAPIKeyCreated object`
141338145792
141339145793 An admin API key was created.
from line 166276
161822166276
161823166277 Per-review spend limit in USD before the change. Absent when no configuration existed before this update or no limit was set.
161824166278
166279 - `previous_review_level: optional string or null`
166280
166281 Review level set for the organization's code reviews before the change: "low" (Quick), "medium" (Standard) or "high" (Deep). Absent when no configuration existed before this update or no level was set.
166282
161825166283 - `previous_show_tips: optional boolean or null`
161826166284
161827166285 Whether tip-style pull-request comments were enabled before the change. Absent when no configuration existed before this update.
from line 166288
161830166288
161831166289 Whether the verification stage of code review was enabled for the organization before the change. Absent when no configuration existed before this update or no preference was set.
161832166290
166291 - `review_level: optional string or null`
166292
166293 Review level now set for the organization's code reviews: "low" (Quick), "medium" (Standard) or "high" (Deep). Repositories without their own level use this one. Absent when no level is set; the default level, Standard, then applies.
166294
161833166295 - `show_tips: optional boolean or null`
161834166296
161835166297 Whether tip-style pull-request comments are now enabled
from line 166300
161838166300
161839166301 Whether the verification stage of code review is now enabled for the organization. Absent when the organization has not set a preference and the default applies.
161840166302
166303 - `ClaudeCodeReviewPromoEnrolled object`
166304
166305 An organization admin enrolled the organization in a Claude Code Review promotion, for example by claiming promotional credits.
166306
166307 - `type: optional "claude_code_review_promo_enrolled"`
166308
166309 default: claude_code_review_promo_enrolled
166310
166311 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
166312
166313 - `APIActor object`
166314
166315 - `type: optional "api_actor"`
166316
166317 default: api_actor
166318
166319 - `api_key_id: string`
166320
166321 - `ip_address: string`
166322
166323 - `user_agent: string`
166324
166325 - `UserActor object`
166326
166327 - `type: optional "user_actor"`
166328
166329 default: user_actor
166330
166331 - `email_address: string`
166332
166333 format: email
166334
166335 - `ip_address: string`
166336
166337 - `user_agent: string`
166338
166339 - `user_id: string`
166340
166341 - `UnauthenticatedUserActor object`
166342
166343 - `type: optional "unauthenticated_user_actor"`
166344
166345 default: unauthenticated_user_actor
166346
166347 - `ip_address: string`
166348
166349 - `user_agent: string`
166350
166351 - `unauthenticated_email_address: optional string or null`
166352
166353 format: email
166354
166355 - `AnthropicActor object`
166356
166357 - `type: optional "anthropic_actor"`
166358
166359 default: anthropic_actor
166360
166361 - `email_address: optional string or null`
166362
166363 format: email
166364
166365 - `SystemActor object`
166366
166367 Automated background processing performed by Anthropic systems, acting
166368 without a user or customer credential.
166369
166370 - `type: optional "system_actor"`
166371
166372 default: system_actor
166373
166374 - `service: optional string or null`
166375
166376 Name of the automated process that performed the action, when known.
166377
166378 - `AdminAPIKeyActor object`
166379
166380 - `type: optional "admin_api_key_actor"`
166381
166382 default: admin_api_key_actor
166383
166384 - `admin_api_key_id: string`
166385
166386 - `ip_address: string`
166387
166388 - `user_agent: string`
166389
166390 - `ServiceAccountActor object`
166391
166392 - `type: optional "service_account_actor"`
166393
166394 default: service_account_actor
166395
166396 - `ip_address: string`
166397
166398 - `service_account_id: string`
166399
166400 - `user_agent: string`
166401
166402 - `ScimDirectorySyncActor object`
166403
166404 - `type: optional "scim_directory_sync_actor"`
166405
166406 default: scim_directory_sync_actor
166407
166408 - `directory_id: string`
166409
166410 - `workos_event_id: string`
166411
166412 - `idp_connection_type: optional string or null`
166413
166414 - `FederatedIdentityActor object`
166415
166416 A federated external workload authenticated via a verified OIDC token.
166417
166418 Carries the verified issuer, subject, and audience claims from the
166419 presented JWT.
166420
166421 - `type: optional "federated_identity_actor"`
166422
166423 default: federated_identity_actor
166424
166425 - `issuer: string`
166426
166427 - `subject: string`
166428
166429 - `audience: optional array of string`
166430
166431 - `ip_address: optional string or null`
166432
166433 - `user_agent: optional string or null`
166434
166435 - `FederatedActor object`
166436
166437 An external identity asserted by a trusted provider — a cloud-provider
166438 gateway or a customer-registered federation issuer — acting without an
166439 Anthropic-provisioned account or service account.
166440
166441 - `type: optional "federated_actor"`
166442
166443 default: federated_actor
166444
166445 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
166446
166447 - `FederatedActorAwsProvider object`
166448
166449 Asserting party: the AWS account the organization is bound to.
166450
166451 - `type: optional "aws"`
166452
166453 default: aws
166454
166455 - `account_id: string`
166456
166457 - `signed_principal: string`
166458
166459 The AWS-signed ARN of the IAM principal that requested the token.
166460
166461 - `FederatedActorAzureProvider object`
166462
166463 Asserting party: the Azure subscription the organization is bound to.
166464
166465 - `type: optional "azure"`
166466
166467 default: azure
166468
166469 - `subscription_id: string`
166470
166471 - `FederatedActorGcpProvider object`
166472
166473 Asserting party: the GCP project the organization is bound to.
166474
166475 - `type: optional "gcp"`
166476
166477 default: gcp
166478
166479 - `project_number: string`
166480
166481 - `FederatedActorOidcProvider object`
166482
166483 Asserting party: a customer-registered OIDC federation issuer.
166484
166485 - `type: optional "oidc"`
166486
166487 default: oidc
166488
166489 - `issuer: optional string or null`
166490
166491 The federation issuer's URL. Null when the presented credential failed verification.
166492
166493 - `ip_address: optional string or null`
166494
166495 - `subject: optional string or null`
166496
166497 The provider's verified identifier for the caller; its form depends on the provider.
166498
166499 - `user_agent: optional string or null`
166500
166501 - `AttestedDeviceActor object`
166502
166503 An attested mobile device authenticated via Apple App Attest.
166504
166505 - `type: optional "attested_device_actor"`
166506
166507 default: attested_device_actor
166508
166509 - `external_client_id: string`
166510
166511 - `kid_hash: string`
166512
166513 - `ip_address: optional string or null`
166514
166515 - `user_agent: optional string or null`
166516
166517 - `promo_id: string`
166518
166519 Identifier of the promotion the organization enrolled in.
166520
166521 - `id: optional string`
166522
166523 Unique identifier for the activity e.g. 'activity_abcd1234'
166524
166525 - `created_at: optional string`
166526
166527 When this activity occurred.
166528
166529 format: date-time
166530
166531 - `expires_at: optional string or null`
166532
166533 When the organization's promotional access or credits expire.
166534
166535 format: date-time
166536
166537 - `organization_id: optional string or null`
166538
166539 Organization ID this activity is associated with
166540
166541 - `organization_uuid: optional string or null`
166542
166543 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
166544
161841166545 - `ClaudeCodeReviewRepositoryAdded object`
161842166546
161843166547 A repository was added to org-level Claude Code Review configuration.
from line 167278
162574167278
162575167279 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
162576167280
167281 - `previous_review_level: optional string or null`
167282
167283 Review level set for this repository's code reviews before the change: "low" (Quick), "medium" (Standard) or "high" (Deep). Absent when no level was set.
167284
167285 - `review_level: optional string or null`
167286
167287 Review level now set for this repository's code reviews: "low" (Quick), "medium" (Standard) or "high" (Deep). Absent when no level is set; the repository then uses the organization-wide level (review_level on claude_code_review_config_updated), or Standard if none is set.
167288
162577167289 - `status: optional string or null`
162578167290
162579167291 Updated status (ACTIVE/INACTIVE)
from line 169754
165042169754
165043169755 - `ClaudeCodeSecurityScanProjectUpdated object`
165044169756
165045 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience.
169757 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience, or a user paused the project's scheduled scanning, unpaused it, or lifted a billing pause on it.
165046169758
165047169759 - `type: optional "claude_code_security_scan_project_updated"`
165048169760
165049169761 default: claude_code_security_scan_project_updated
165050169762
165051 - `action: "archived" or "created" or "migrated" or 3 more`
169763 - `action: "archived" or "billing_pause_lifted" or "created" or 6 more`
165052169764
165053169765 The state change applied to the scan project.
165054169766
165055169767 - `"archived"`
165056169768
169769 - `"billing_pause_lifted"`
169770
165057169771 - `"created"`
165058169772
165059169773 - `"migrated"`
165060169774
169775 - `"paused"`
169776
165061169777 - `"resumed"`
165062169778
165063169779 - `"unarchived"`
165064169780
169781 - `"unpaused"`
169782
165065169783 - `"unspecified"`
165066169784
165067169785 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
from line 180038
175320180038
175321180039 A short provider-specific identifier for the external resource after the update, e.g. `owner/repo` for GitHub or a file ID for Google Drive.
175322180040
180041 - `ClaudeSkillAutoDisabled object`
180042
180043 A skill that had been turned on for a member automatically was turned off for them automatically, not by the member; reason says why. A member turning a skill off themselves is recorded as claude_skill_disabled.
180044
180045 - `type: optional "claude_skill_auto_disabled"`
180046
180047 default: claude_skill_auto_disabled
180048
180049 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
180050
180051 - `APIActor object`
180052
180053 - `type: optional "api_actor"`
180054
180055 default: api_actor
180056
180057 - `api_key_id: string`
180058
180059 - `ip_address: string`
180060
180061 - `user_agent: string`
180062
180063 - `UserActor object`
180064
180065 - `type: optional "user_actor"`
180066
180067 default: user_actor
180068
180069 - `email_address: string`
180070
180071 format: email
180072
180073 - `ip_address: string`
180074
180075 - `user_agent: string`
180076
180077 - `user_id: string`
180078
180079 - `UnauthenticatedUserActor object`
180080
180081 - `type: optional "unauthenticated_user_actor"`
180082
180083 default: unauthenticated_user_actor
180084
180085 - `ip_address: string`
180086
180087 - `user_agent: string`
180088
180089 - `unauthenticated_email_address: optional string or null`
180090
180091 format: email
180092
180093 - `AnthropicActor object`
180094
180095 - `type: optional "anthropic_actor"`
180096
180097 default: anthropic_actor
180098
180099 - `email_address: optional string or null`
180100
180101 format: email
180102
180103 - `SystemActor object`
180104
180105 Automated background processing performed by Anthropic systems, acting
180106 without a user or customer credential.
180107
180108 - `type: optional "system_actor"`
180109
180110 default: system_actor
180111
180112 - `service: optional string or null`
180113
180114 Name of the automated process that performed the action, when known.
180115
180116 - `AdminAPIKeyActor object`
180117
180118 - `type: optional "admin_api_key_actor"`
180119
180120 default: admin_api_key_actor
180121
180122 - `admin_api_key_id: string`
180123
180124 - `ip_address: string`
180125
180126 - `user_agent: string`
180127
180128 - `ServiceAccountActor object`
180129
180130 - `type: optional "service_account_actor"`
180131
180132 default: service_account_actor
180133
180134 - `ip_address: string`
180135
180136 - `service_account_id: string`
180137
180138 - `user_agent: string`
180139
180140 - `ScimDirectorySyncActor object`
180141
180142 - `type: optional "scim_directory_sync_actor"`
180143
180144 default: scim_directory_sync_actor
180145
180146 - `directory_id: string`
180147
180148 - `workos_event_id: string`
180149
180150 - `idp_connection_type: optional string or null`
180151
180152 - `FederatedIdentityActor object`
180153
180154 A federated external workload authenticated via a verified OIDC token.
180155
180156 Carries the verified issuer, subject, and audience claims from the
180157 presented JWT.
180158
180159 - `type: optional "federated_identity_actor"`
180160
180161 default: federated_identity_actor
180162
180163 - `issuer: string`
180164
180165 - `subject: string`
180166
180167 - `audience: optional array of string`
180168
180169 - `ip_address: optional string or null`
180170
180171 - `user_agent: optional string or null`
180172
180173 - `FederatedActor object`
180174
180175 An external identity asserted by a trusted provider — a cloud-provider
180176 gateway or a customer-registered federation issuer — acting without an
180177 Anthropic-provisioned account or service account.
180178
180179 - `type: optional "federated_actor"`
180180
180181 default: federated_actor
180182
180183 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
180184
180185 - `FederatedActorAwsProvider object`
180186
180187 Asserting party: the AWS account the organization is bound to.
180188
180189 - `type: optional "aws"`
180190
180191 default: aws
180192
180193 - `account_id: string`
180194
180195 - `signed_principal: string`
180196
180197 The AWS-signed ARN of the IAM principal that requested the token.
180198
180199 - `FederatedActorAzureProvider object`
180200
180201 Asserting party: the Azure subscription the organization is bound to.
180202
180203 - `type: optional "azure"`
180204
180205 default: azure
180206
180207 - `subscription_id: string`
180208
180209 - `FederatedActorGcpProvider object`
180210
180211 Asserting party: the GCP project the organization is bound to.
180212
180213 - `type: optional "gcp"`
180214
180215 default: gcp
180216
180217 - `project_number: string`
180218
180219 - `FederatedActorOidcProvider object`
180220
180221 Asserting party: a customer-registered OIDC federation issuer.
180222
180223 - `type: optional "oidc"`
180224
180225 default: oidc
180226
180227 - `issuer: optional string or null`
180228
180229 The federation issuer's URL. Null when the presented credential failed verification.
180230
180231 - `ip_address: optional string or null`
180232
180233 - `subject: optional string or null`
180234
180235 The provider's verified identifier for the caller; its form depends on the provider.
180236
180237 - `user_agent: optional string or null`
180238
180239 - `AttestedDeviceActor object`
180240
180241 An attested mobile device authenticated via Apple App Attest.
180242
180243 - `type: optional "attested_device_actor"`
180244
180245 default: attested_device_actor
180246
180247 - `external_client_id: string`
180248
180249 - `kid_hash: string`
180250
180251 - `ip_address: optional string or null`
180252
180253 - `user_agent: optional string or null`
180254
180255 - `reason: "auto_enable_reverted" or "content_changed" or "unspecified"`
180256
180257 Why the skill was turned off automatically: "content_changed" (a change to the skill was saved or attempted, or the skill was scanned again, and it could not be confirmed as still eligible to be on automatically) or "auto_enable_reverted" (Anthropic turned off skills that had been turned on automatically; not in response to a change to this skill).
180258
180259 - `"auto_enable_reverted"`
180260
180261 - `"content_changed"`
180262
180263 - `"unspecified"`
180264
180265 - `user_id: string`
180266
180267 The member the skill was turned off for.
180268
180269 - `id: optional string`
180270
180271 Unique identifier for the activity e.g. 'activity_abcd1234'
180272
180273 - `created_at: optional string`
180274
180275 When this activity occurred.
180276
180277 format: date-time
180278
180279 - `organization_id: optional string or null`
180280
180281 Organization ID this activity is associated with
180282
180283 - `organization_uuid: optional string or null`
180284
180285 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
180286
180287 - `shared_by_user_id: optional string or null`
180288
180289 For a skill that had been turned on because it was shared: the member who shared it.
180290
180291 - `skill_id: optional string or null`
180292
180293 The skill that was turned off.
180294
180295 - `skill_name: optional string or null`
180296
180297 The name of the skill that was turned off.
180298
180299 - `skill_version: optional string or null`
180300
180301 The version of the skill the member had just before it was turned off. Absent when not known.
180302
180303 - `ClaudeSkillAutoEnabled object`
180304
180305 A skill was turned on for a member automatically, not by the member; trigger gives the cause, such as another member sharing an eligible skill with them. A member turning a skill on themselves is recorded as claude_skill_enabled.
180306
180307 - `type: optional "claude_skill_auto_enabled"`
180308
180309 default: claude_skill_auto_enabled
180310
180311 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
180312
180313 - `APIActor object`
180314
180315 - `type: optional "api_actor"`
180316
180317 default: api_actor
180318
180319 - `api_key_id: string`
180320
180321 - `ip_address: string`
180322
180323 - `user_agent: string`
180324
180325 - `UserActor object`
180326
180327 - `type: optional "user_actor"`
180328
180329 default: user_actor
180330
180331 - `email_address: string`
180332
180333 format: email
180334
180335 - `ip_address: string`
180336
180337 - `user_agent: string`
180338
180339 - `user_id: string`
180340
180341 - `UnauthenticatedUserActor object`
180342
180343 - `type: optional "unauthenticated_user_actor"`
180344
180345 default: unauthenticated_user_actor
180346
180347 - `ip_address: string`
180348
180349 - `user_agent: string`
180350
180351 - `unauthenticated_email_address: optional string or null`
180352
180353 format: email
180354
180355 - `AnthropicActor object`
180356
180357 - `type: optional "anthropic_actor"`
180358
180359 default: anthropic_actor
180360
180361 - `email_address: optional string or null`
180362
180363 format: email
180364
180365 - `SystemActor object`
180366
180367 Automated background processing performed by Anthropic systems, acting
180368 without a user or customer credential.
180369
180370 - `type: optional "system_actor"`
180371
180372 default: system_actor
180373
180374 - `service: optional string or null`
180375
180376 Name of the automated process that performed the action, when known.
180377
180378 - `AdminAPIKeyActor object`
180379
180380 - `type: optional "admin_api_key_actor"`
180381
180382 default: admin_api_key_actor
180383
180384 - `admin_api_key_id: string`
180385
180386 - `ip_address: string`
180387
180388 - `user_agent: string`
180389
180390 - `ServiceAccountActor object`
180391
180392 - `type: optional "service_account_actor"`
180393
180394 default: service_account_actor
180395
180396 - `ip_address: string`
180397
180398 - `service_account_id: string`
180399
180400 - `user_agent: string`
180401
180402 - `ScimDirectorySyncActor object`
180403
180404 - `type: optional "scim_directory_sync_actor"`
180405
180406 default: scim_directory_sync_actor
180407
180408 - `directory_id: string`
180409
180410 - `workos_event_id: string`
180411
180412 - `idp_connection_type: optional string or null`
180413
180414 - `FederatedIdentityActor object`
180415
180416 A federated external workload authenticated via a verified OIDC token.
180417
180418 Carries the verified issuer, subject, and audience claims from the
180419 presented JWT.
180420
180421 - `type: optional "federated_identity_actor"`
180422
180423 default: federated_identity_actor
180424
180425 - `issuer: string`
180426
180427 - `subject: string`
180428
180429 - `audience: optional array of string`
180430
180431 - `ip_address: optional string or null`
180432
180433 - `user_agent: optional string or null`
180434
180435 - `FederatedActor object`
180436
180437 An external identity asserted by a trusted provider — a cloud-provider
180438 gateway or a customer-registered federation issuer — acting without an
180439 Anthropic-provisioned account or service account.
180440
180441 - `type: optional "federated_actor"`
180442
180443 default: federated_actor
180444
180445 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
180446
180447 - `FederatedActorAwsProvider object`
180448
180449 Asserting party: the AWS account the organization is bound to.
180450
180451 - `type: optional "aws"`
180452
180453 default: aws
180454
180455 - `account_id: string`
180456
180457 - `signed_principal: string`
180458
180459 The AWS-signed ARN of the IAM principal that requested the token.
180460
180461 - `FederatedActorAzureProvider object`
180462
180463 Asserting party: the Azure subscription the organization is bound to.
180464
180465 - `type: optional "azure"`
180466
180467 default: azure
180468
180469 - `subscription_id: string`
180470
180471 - `FederatedActorGcpProvider object`
180472
180473 Asserting party: the GCP project the organization is bound to.
180474
180475 - `type: optional "gcp"`
180476
180477 default: gcp
180478
180479 - `project_number: string`
180480
180481 - `FederatedActorOidcProvider object`
180482
180483 Asserting party: a customer-registered OIDC federation issuer.
180484
180485 - `type: optional "oidc"`
180486
180487 default: oidc
180488
180489 - `issuer: optional string or null`
180490
180491 The federation issuer's URL. Null when the presented credential failed verification.
180492
180493 - `ip_address: optional string or null`
180494
180495 - `subject: optional string or null`
180496
180497 The provider's verified identifier for the caller; its form depends on the provider.
180498
180499 - `user_agent: optional string or null`
180500
180501 - `AttestedDeviceActor object`
180502
180503 An attested mobile device authenticated via Apple App Attest.
180504
180505 - `type: optional "attested_device_actor"`
180506
180507 default: attested_device_actor
180508
180509 - `external_client_id: string`
180510
180511 - `kid_hash: string`
180512
180513 - `ip_address: optional string or null`
180514
180515 - `user_agent: optional string or null`
180516
180517 - `trigger: "share" or "unspecified"`
180518
180519 What caused the skill to be turned on automatically: "share" (another member shared it with the member, directly or through a group).
180520
180521 - `"share"`
180522
180523 - `"unspecified"`
180524
180525 - `user_id: string`
180526
180527 The member the skill was turned on for.
180528
180529 - `id: optional string`
180530
180531 Unique identifier for the activity e.g. 'activity_abcd1234'
180532
180533 - `created_at: optional string`
180534
180535 When this activity occurred.
180536
180537 format: date-time
180538
180539 - `organization_id: optional string or null`
180540
180541 Organization ID this activity is associated with
180542
180543 - `organization_uuid: optional string or null`
180544
180545 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
180546
180547 - `shared_at: optional string or null`
180548
180549 For a skill turned on because it was shared: when it was shared with the member or with their group.
180550
180551 format: date-time
180552
180553 - `shared_by_user_id: optional string or null`
180554
180555 For a skill turned on because it was shared: the member who shared it.
180556
180557 - `shared_via: optional "direct" or "group" or "unspecified" or null`
180558
180559 For a skill turned on because it was shared: "direct" if shared with the member themselves, "group" if shared with a group they belong to.
180560
180561 - `"direct"`
180562
180563 - `"group"`
180564
180565 - `"unspecified"`
180566
180567 - `skill_id: optional string or null`
180568
180569 The skill that was turned on.
180570
180571 - `skill_name: optional string or null`
180572
180573 The name of the skill that was turned on.
180574
180575 - `skill_version: optional string or null`
180576
180577 The version of the skill that was turned on.
180578
175323180579 - `ClaudeSkillDownloaded object`
175324180580
175325180581 A member explicitly downloaded a skill's files to their device: the Download action in Claude, a single file saved from the skill viewer, or an install they asked one of their Claude apps for. Background syncs to the Claude apps, viewing a skill in the app and services reading a skill on the member's behalf are not recorded.
from line 189188
183932189188
183933189189 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
183934189190
189191 - `DomainClaimCancelled object`
189192
189193 A pending domain claim was cancelled before it took effect, so the personal accounts on the claimed domains will no longer be migrated or deactivated at its deadline.
189194
189195 - `type: optional "domain_claim_cancelled"`
189196
189197 default: domain_claim_cancelled
189198
189199 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
189200
189201 - `APIActor object`
189202
189203 - `type: optional "api_actor"`
189204
189205 default: api_actor
189206
189207 - `api_key_id: string`
189208
189209 - `ip_address: string`
189210
189211 - `user_agent: string`
189212
189213 - `UserActor object`
189214
189215 - `type: optional "user_actor"`
189216
189217 default: user_actor
189218
189219 - `email_address: string`
189220
189221 format: email
189222
189223 - `ip_address: string`
189224
189225 - `user_agent: string`
189226
189227 - `user_id: string`
189228
189229 - `UnauthenticatedUserActor object`
189230
189231 - `type: optional "unauthenticated_user_actor"`
189232
189233 default: unauthenticated_user_actor
189234
189235 - `ip_address: string`
189236
189237 - `user_agent: string`
189238
189239 - `unauthenticated_email_address: optional string or null`
189240
189241 format: email
189242
189243 - `AnthropicActor object`
189244
189245 - `type: optional "anthropic_actor"`
189246
189247 default: anthropic_actor
189248
189249 - `email_address: optional string or null`
189250
189251 format: email
189252
189253 - `SystemActor object`
189254
189255 Automated background processing performed by Anthropic systems, acting
189256 without a user or customer credential.
189257
189258 - `type: optional "system_actor"`
189259
189260 default: system_actor
189261
189262 - `service: optional string or null`
189263
189264 Name of the automated process that performed the action, when known.
189265
189266 - `AdminAPIKeyActor object`
189267
189268 - `type: optional "admin_api_key_actor"`
189269
189270 default: admin_api_key_actor
189271
189272 - `admin_api_key_id: string`
189273
189274 - `ip_address: string`
189275
189276 - `user_agent: string`
189277
189278 - `ServiceAccountActor object`
189279
189280 - `type: optional "service_account_actor"`
189281
189282 default: service_account_actor
189283
189284 - `ip_address: string`
189285
189286 - `service_account_id: string`
189287
189288 - `user_agent: string`
189289
189290 - `ScimDirectorySyncActor object`
189291
189292 - `type: optional "scim_directory_sync_actor"`
189293
189294 default: scim_directory_sync_actor
189295
189296 - `directory_id: string`
189297
189298 - `workos_event_id: string`
189299
189300 - `idp_connection_type: optional string or null`
189301
189302 - `FederatedIdentityActor object`
189303
189304 A federated external workload authenticated via a verified OIDC token.
189305
189306 Carries the verified issuer, subject, and audience claims from the
189307 presented JWT.
189308
189309 - `type: optional "federated_identity_actor"`
189310
189311 default: federated_identity_actor
189312
189313 - `issuer: string`
189314
189315 - `subject: string`
189316
189317 - `audience: optional array of string`
189318
189319 - `ip_address: optional string or null`
189320
189321 - `user_agent: optional string or null`
189322
189323 - `FederatedActor object`
189324
189325 An external identity asserted by a trusted provider — a cloud-provider
189326 gateway or a customer-registered federation issuer — acting without an
189327 Anthropic-provisioned account or service account.
189328
189329 - `type: optional "federated_actor"`
189330
189331 default: federated_actor
189332
189333 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
189334
189335 - `FederatedActorAwsProvider object`
189336
189337 Asserting party: the AWS account the organization is bound to.
189338
189339 - `type: optional "aws"`
189340
189341 default: aws
189342
189343 - `account_id: string`
189344
189345 - `signed_principal: string`
189346
189347 The AWS-signed ARN of the IAM principal that requested the token.
189348
189349 - `FederatedActorAzureProvider object`
189350
189351 Asserting party: the Azure subscription the organization is bound to.
189352
189353 - `type: optional "azure"`
189354
189355 default: azure
189356
189357 - `subscription_id: string`
189358
189359 - `FederatedActorGcpProvider object`
189360
189361 Asserting party: the GCP project the organization is bound to.
189362
189363 - `type: optional "gcp"`
189364
189365 default: gcp
189366
189367 - `project_number: string`
189368
189369 - `FederatedActorOidcProvider object`
189370
189371 Asserting party: a customer-registered OIDC federation issuer.
189372
189373 - `type: optional "oidc"`
189374
189375 default: oidc
189376
189377 - `issuer: optional string or null`
189378
189379 The federation issuer's URL. Null when the presented credential failed verification.
189380
189381 - `ip_address: optional string or null`
189382
189383 - `subject: optional string or null`
189384
189385 The provider's verified identifier for the caller; its form depends on the provider.
189386
189387 - `user_agent: optional string or null`
189388
189389 - `AttestedDeviceActor object`
189390
189391 An attested mobile device authenticated via Apple App Attest.
189392
189393 - `type: optional "attested_device_actor"`
189394
189395 default: attested_device_actor
189396
189397 - `external_client_id: string`
189398
189399 - `kid_hash: string`
189400
189401 - `ip_address: optional string or null`
189402
189403 - `user_agent: optional string or null`
189404
189405 - `domain_claim_id: string`
189406
189407 The domain claim that was cancelled, e.g. "dclm_01Ab...".
189408
189409 - `id: optional string`
189410
189411 Unique identifier for the activity e.g. 'activity_abcd1234'
189412
189413 - `created_at: optional string`
189414
189415 When this activity occurred.
189416
189417 format: date-time
189418
189419 - `organization_id: optional string or null`
189420
189421 Organization ID this activity is associated with
189422
189423 - `organization_uuid: optional string or null`
189424
189425 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
189426
189427 - `DomainClaimDeadlineUpdated object`
189428
189429 The migration deadline of a pending domain claim was moved to a later or an earlier date by Anthropic staff or an automated process.
189430
189431 - `type: optional "domain_claim_deadline_updated"`
189432
189433 default: domain_claim_deadline_updated
189434
189435 - `action: "extended" or "shortened" or "unspecified"`
189436
189437 Whether the deadline was extended (moved later) or shortened (moved earlier).
189438
189439 - `"extended"`
189440
189441 - `"shortened"`
189442
189443 - `"unspecified"`
189444
189445 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
189446
189447 - `APIActor object`
189448
189449 - `type: optional "api_actor"`
189450
189451 default: api_actor
189452
189453 - `api_key_id: string`
189454
189455 - `ip_address: string`
189456
189457 - `user_agent: string`
189458
189459 - `UserActor object`
189460
189461 - `type: optional "user_actor"`
189462
189463 default: user_actor
189464
189465 - `email_address: string`
189466
189467 format: email
189468
189469 - `ip_address: string`
189470
189471 - `user_agent: string`
189472
189473 - `user_id: string`
189474
189475 - `UnauthenticatedUserActor object`
189476
189477 - `type: optional "unauthenticated_user_actor"`
189478
189479 default: unauthenticated_user_actor
189480
189481 - `ip_address: string`
189482
189483 - `user_agent: string`
189484
189485 - `unauthenticated_email_address: optional string or null`
189486
189487 format: email
189488
189489 - `AnthropicActor object`
189490
189491 - `type: optional "anthropic_actor"`
189492
189493 default: anthropic_actor
189494
189495 - `email_address: optional string or null`
189496
189497 format: email
189498
189499 - `SystemActor object`
189500
189501 Automated background processing performed by Anthropic systems, acting
189502 without a user or customer credential.
189503
189504 - `type: optional "system_actor"`
189505
189506 default: system_actor
189507
189508 - `service: optional string or null`
189509
189510 Name of the automated process that performed the action, when known.
189511
189512 - `AdminAPIKeyActor object`
189513
189514 - `type: optional "admin_api_key_actor"`
189515
189516 default: admin_api_key_actor
189517
189518 - `admin_api_key_id: string`
189519
189520 - `ip_address: string`
189521
189522 - `user_agent: string`
189523
189524 - `ServiceAccountActor object`
189525
189526 - `type: optional "service_account_actor"`
189527
189528 default: service_account_actor
189529
189530 - `ip_address: string`
189531
189532 - `service_account_id: string`
189533
189534 - `user_agent: string`
189535
189536 - `ScimDirectorySyncActor object`
189537
189538 - `type: optional "scim_directory_sync_actor"`
189539
189540 default: scim_directory_sync_actor
189541
189542 - `directory_id: string`
189543
189544 - `workos_event_id: string`
189545
189546 - `idp_connection_type: optional string or null`
189547
189548 - `FederatedIdentityActor object`
189549
189550 A federated external workload authenticated via a verified OIDC token.
189551
189552 Carries the verified issuer, subject, and audience claims from the
189553 presented JWT.
189554
189555 - `type: optional "federated_identity_actor"`
189556
189557 default: federated_identity_actor
189558
189559 - `issuer: string`
189560
189561 - `subject: string`
189562
189563 - `audience: optional array of string`
189564
189565 - `ip_address: optional string or null`
189566
189567 - `user_agent: optional string or null`
189568
189569 - `FederatedActor object`
189570
189571 An external identity asserted by a trusted provider — a cloud-provider
189572 gateway or a customer-registered federation issuer — acting without an
189573 Anthropic-provisioned account or service account.
189574
189575 - `type: optional "federated_actor"`
189576
189577 default: federated_actor
189578
189579 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
189580
189581 - `FederatedActorAwsProvider object`
189582
189583 Asserting party: the AWS account the organization is bound to.
189584
189585 - `type: optional "aws"`
189586
189587 default: aws
189588
189589 - `account_id: string`
189590
189591 - `signed_principal: string`
189592
189593 The AWS-signed ARN of the IAM principal that requested the token.
189594
189595 - `FederatedActorAzureProvider object`
189596
189597 Asserting party: the Azure subscription the organization is bound to.
189598
189599 - `type: optional "azure"`
189600
189601 default: azure
189602
189603 - `subscription_id: string`
189604
189605 - `FederatedActorGcpProvider object`
189606
189607 Asserting party: the GCP project the organization is bound to.
189608
189609 - `type: optional "gcp"`
189610
189611 default: gcp
189612
189613 - `project_number: string`
189614
189615 - `FederatedActorOidcProvider object`
189616
189617 Asserting party: a customer-registered OIDC federation issuer.
189618
189619 - `type: optional "oidc"`
189620
189621 default: oidc
189622
189623 - `issuer: optional string or null`
189624
189625 The federation issuer's URL. Null when the presented credential failed verification.
189626
189627 - `ip_address: optional string or null`
189628
189629 - `subject: optional string or null`
189630
189631 The provider's verified identifier for the caller; its form depends on the provider.
189632
189633 - `user_agent: optional string or null`
189634
189635 - `AttestedDeviceActor object`
189636
189637 An attested mobile device authenticated via Apple App Attest.
189638
189639 - `type: optional "attested_device_actor"`
189640
189641 default: attested_device_actor
189642
189643 - `external_client_id: string`
189644
189645 - `kid_hash: string`
189646
189647 - `ip_address: optional string or null`
189648
189649 - `user_agent: optional string or null`
189650
189651 - `domain_claim_id: string`
189652
189653 The domain claim whose deadline was moved, e.g. "dclm_01Ab...".
189654
189655 - `id: optional string`
189656
189657 Unique identifier for the activity e.g. 'activity_abcd1234'
189658
189659 - `created_at: optional string`
189660
189661 When this activity occurred.
189662
189663 format: date-time
189664
189665 - `deadline_at: optional string or null`
189666
189667 The deadline after the change.
189668
189669 format: date-time
189670
189671 - `organization_id: optional string or null`
189672
189673 Organization ID this activity is associated with
189674
189675 - `organization_uuid: optional string or null`
189676
189677 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
189678
189679 - `previous_deadline_at: optional string or null`
189680
189681 The deadline before the change.
189682
189683 format: date-time
189684
183935189685 - `DomainClaimInitiated object`
183936189686
183937189687 Domain capture claim initiated over personal accounts on verified domains.
from line 195360
189610195360
189611195361 - `token_fingerprint_sha256: optional string or null`
189612195362
189613 Org-scoped SHA-256 of the submitted token: `sha256(org_uuid || 0x00 || token)`, lowercase-hex-encoded, where `org_uuid` is the organization's UUID as a dashed lowercase string, `0x00` is a single zero byte, and `token` is the submitted value's raw bytes. Per-org correlation only — the same token in two orgs produces distinct fingerprints. Set only when the submitted value carries a known GitHub PAT prefix (a high-entropy token format); unset for all other submissions, including rejected non-PAT input.
195363 Not populated.
189614195364
189615195365 - `GitlabConfigurationCreated object`
189616195366
from line 233194
227444233194
227445233195 - `user_agent: optional string or null`
227446233196
227447 - `updates: array of Name or Capabilities or RedactContent or 104 more`
233197 - `updates: array of Name or Capabilities or RedactContent or 105 more`
227448233198
227449233199 - `Name object`
227450233200
from line 235113
229363235113
229364235114 Setting value immediately before this change. Null means the setting was not set, so its default applied.
229365235115
235116 - `ConnectorRequestsOptedIn object`
235117
235118 The organization's opt-in to connector requests, which lets members ask the organization's owners to add a connector, was changed. The "Let members request connectors" switch sets it the first time it is turned on; turning that switch off, or on again, is recorded as a `disabled_admin_request_types` change (`enable_connector` joins or leaves the list).
235119
235120 - `type: optional "connector_requests_opted_in"`
235121
235122 default: connector_requests_opted_in
235123
235124 - `current_value: optional boolean or null`
235125
235126 Setting value immediately after this change
235127
235128 - `previous_value: optional boolean or null`
235129
235130 Setting value immediately before this change. Null means the organization had never opted in or out.
235131
229366235132 - `id: optional string`
229367235133
229368235134 Unique identifier for the activity e.g. 'activity_abcd1234'
from line 254219
248453254219
248454254220 UUID of the spend limit.
248455254221
254222 - `PlatformTelemetryDestinationAutoDisabled object`
254223
254224 A telemetry destination was disabled automatically after deliveries to it failed, so no telemetry is sent to it until an administrator enables it again.
254225
254226 - `type: optional "platform_telemetry_destination_auto_disabled"`
254227
254228 default: platform_telemetry_destination_auto_disabled
254229
254230 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
254231
254232 - `APIActor object`
254233
254234 - `type: optional "api_actor"`
254235
254236 default: api_actor
254237
254238 - `api_key_id: string`
254239
254240 - `ip_address: string`
254241
254242 - `user_agent: string`
254243
254244 - `UserActor object`
254245
254246 - `type: optional "user_actor"`
254247
254248 default: user_actor
254249
254250 - `email_address: string`
254251
254252 format: email
254253
254254 - `ip_address: string`
254255
254256 - `user_agent: string`
254257
254258 - `user_id: string`
254259
254260 - `UnauthenticatedUserActor object`
254261
254262 - `type: optional "unauthenticated_user_actor"`
254263
254264 default: unauthenticated_user_actor
254265
254266 - `ip_address: string`
254267
254268 - `user_agent: string`
254269
254270 - `unauthenticated_email_address: optional string or null`
254271
254272 format: email
254273
254274 - `AnthropicActor object`
254275
254276 - `type: optional "anthropic_actor"`
254277
254278 default: anthropic_actor
254279
254280 - `email_address: optional string or null`
254281
254282 format: email
254283
254284 - `SystemActor object`
254285
254286 Automated background processing performed by Anthropic systems, acting
254287 without a user or customer credential.
254288
254289 - `type: optional "system_actor"`
254290
254291 default: system_actor
254292
254293 - `service: optional string or null`
254294
254295 Name of the automated process that performed the action, when known.
254296
254297 - `AdminAPIKeyActor object`
254298
254299 - `type: optional "admin_api_key_actor"`
254300
254301 default: admin_api_key_actor
254302
254303 - `admin_api_key_id: string`
254304
254305 - `ip_address: string`
254306
254307 - `user_agent: string`
254308
254309 - `ServiceAccountActor object`
254310
254311 - `type: optional "service_account_actor"`
254312
254313 default: service_account_actor
254314
254315 - `ip_address: string`
254316
254317 - `service_account_id: string`
254318
254319 - `user_agent: string`
254320
254321 - `ScimDirectorySyncActor object`
254322
254323 - `type: optional "scim_directory_sync_actor"`
254324
254325 default: scim_directory_sync_actor
254326
254327 - `directory_id: string`
254328
254329 - `workos_event_id: string`
254330
254331 - `idp_connection_type: optional string or null`
254332
254333 - `FederatedIdentityActor object`
254334
254335 A federated external workload authenticated via a verified OIDC token.
254336
254337 Carries the verified issuer, subject, and audience claims from the
254338 presented JWT.
254339
254340 - `type: optional "federated_identity_actor"`
254341
254342 default: federated_identity_actor
254343
254344 - `issuer: string`
254345
254346 - `subject: string`
254347
254348 - `audience: optional array of string`
254349
254350 - `ip_address: optional string or null`
254351
254352 - `user_agent: optional string or null`
254353
254354 - `FederatedActor object`
254355
254356 An external identity asserted by a trusted provider — a cloud-provider
254357 gateway or a customer-registered federation issuer — acting without an
254358 Anthropic-provisioned account or service account.
254359
254360 - `type: optional "federated_actor"`
254361
254362 default: federated_actor
254363
254364 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
254365
254366 - `FederatedActorAwsProvider object`
254367
254368 Asserting party: the AWS account the organization is bound to.
254369
254370 - `type: optional "aws"`
254371
254372 default: aws
254373
254374 - `account_id: string`
254375
254376 - `signed_principal: string`
254377
254378 The AWS-signed ARN of the IAM principal that requested the token.
254379
254380 - `FederatedActorAzureProvider object`
254381
254382 Asserting party: the Azure subscription the organization is bound to.
254383
254384 - `type: optional "azure"`
254385
254386 default: azure
254387
254388 - `subscription_id: string`
254389
254390 - `FederatedActorGcpProvider object`
254391
254392 Asserting party: the GCP project the organization is bound to.
254393
254394 - `type: optional "gcp"`
254395
254396 default: gcp
254397
254398 - `project_number: string`
254399
254400 - `FederatedActorOidcProvider object`
254401
254402 Asserting party: a customer-registered OIDC federation issuer.
254403
254404 - `type: optional "oidc"`
254405
254406 default: oidc
254407
254408 - `issuer: optional string or null`
254409
254410 The federation issuer's URL. Null when the presented credential failed verification.
254411
254412 - `ip_address: optional string or null`
254413
254414 - `subject: optional string or null`
254415
254416 The provider's verified identifier for the caller; its form depends on the provider.
254417
254418 - `user_agent: optional string or null`
254419
254420 - `AttestedDeviceActor object`
254421
254422 An attested mobile device authenticated via Apple App Attest.
254423
254424 - `type: optional "attested_device_actor"`
254425
254426 default: attested_device_actor
254427
254428 - `external_client_id: string`
254429
254430 - `kid_hash: string`
254431
254432 - `ip_address: optional string or null`
254433
254434 - `user_agent: optional string or null`
254435
254436 - `telemetry_destination_id: string`
254437
254438 Tagged telemetry destination ID, e.g. "tdst_01HX...".
254439
254440 - `trigger: "invalid_address" or "redirect" or "sustained_failure" or "unspecified"`
254441
254442 Why the destination was disabled: deliveries failed for longer than Anthropic allows ("sustained_failure"), they failed that long and the hostname does not resolve to a public address ("invalid_address"), or the endpoint answered with an HTTP redirect ("redirect").
254443
254444 - `"invalid_address"`
254445
254446 - `"redirect"`
254447
254448 - `"sustained_failure"`
254449
254450 - `"unspecified"`
254451
254452 - `id: optional string`
254453
254454 Unique identifier for the activity e.g. 'activity_abcd1234'
254455
254456 - `created_at: optional string`
254457
254458 When this activity occurred.
254459
254460 format: date-time
254461
254462 - `organization_id: optional string or null`
254463
254464 Organization ID this activity is associated with
254465
254466 - `organization_uuid: optional string or null`
254467
254468 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
254469
254470 - `PlatformTelemetryDestinationCreated object`
254471
254472 A telemetry destination was registered for the organization.
254473
254474 - `type: optional "platform_telemetry_destination_created"`
254475
254476 default: platform_telemetry_destination_created
254477
254478 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
254479
254480 - `APIActor object`
254481
254482 - `type: optional "api_actor"`
254483
254484 default: api_actor
254485
254486 - `api_key_id: string`
254487
254488 - `ip_address: string`
254489
254490 - `user_agent: string`
254491
254492 - `UserActor object`
254493
254494 - `type: optional "user_actor"`
254495
254496 default: user_actor
254497
254498 - `email_address: string`
254499
254500 format: email
254501
254502 - `ip_address: string`
254503
254504 - `user_agent: string`
254505
254506 - `user_id: string`
254507
254508 - `UnauthenticatedUserActor object`
254509
254510 - `type: optional "unauthenticated_user_actor"`
254511
254512 default: unauthenticated_user_actor
254513
254514 - `ip_address: string`
254515
254516 - `user_agent: string`
254517
254518 - `unauthenticated_email_address: optional string or null`
254519
254520 format: email
254521
254522 - `AnthropicActor object`
254523
254524 - `type: optional "anthropic_actor"`
254525
254526 default: anthropic_actor
254527
254528 - `email_address: optional string or null`
254529
254530 format: email
254531
254532 - `SystemActor object`
254533
254534 Automated background processing performed by Anthropic systems, acting
254535 without a user or customer credential.
254536
254537 - `type: optional "system_actor"`
254538
254539 default: system_actor
254540
254541 - `service: optional string or null`
254542
254543 Name of the automated process that performed the action, when known.
254544
254545 - `AdminAPIKeyActor object`
254546
254547 - `type: optional "admin_api_key_actor"`
254548
254549 default: admin_api_key_actor
254550
254551 - `admin_api_key_id: string`
254552
254553 - `ip_address: string`
254554
254555 - `user_agent: string`
254556
254557 - `ServiceAccountActor object`
254558
254559 - `type: optional "service_account_actor"`
254560
254561 default: service_account_actor
254562
254563 - `ip_address: string`
254564
254565 - `service_account_id: string`
254566
254567 - `user_agent: string`
254568
254569 - `ScimDirectorySyncActor object`
254570
254571 - `type: optional "scim_directory_sync_actor"`
254572
254573 default: scim_directory_sync_actor
254574
254575 - `directory_id: string`
254576
254577 - `workos_event_id: string`
254578
254579 - `idp_connection_type: optional string or null`
254580
254581 - `FederatedIdentityActor object`
254582
254583 A federated external workload authenticated via a verified OIDC token.
254584
254585 Carries the verified issuer, subject, and audience claims from the
254586 presented JWT.
254587
254588 - `type: optional "federated_identity_actor"`
254589
254590 default: federated_identity_actor
254591
254592 - `issuer: string`
254593
254594 - `subject: string`
254595
254596 - `audience: optional array of string`
254597
254598 - `ip_address: optional string or null`
254599
254600 - `user_agent: optional string or null`
254601
254602 - `FederatedActor object`
254603
254604 An external identity asserted by a trusted provider — a cloud-provider
254605 gateway or a customer-registered federation issuer — acting without an
254606 Anthropic-provisioned account or service account.
254607
254608 - `type: optional "federated_actor"`
254609
254610 default: federated_actor
254611
254612 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
254613
254614 - `FederatedActorAwsProvider object`
254615
254616 Asserting party: the AWS account the organization is bound to.
254617
254618 - `type: optional "aws"`
254619
254620 default: aws
254621
254622 - `account_id: string`
254623
254624 - `signed_principal: string`
254625
254626 The AWS-signed ARN of the IAM principal that requested the token.
254627
254628 - `FederatedActorAzureProvider object`
254629
254630 Asserting party: the Azure subscription the organization is bound to.
254631
254632 - `type: optional "azure"`
254633
254634 default: azure
254635
254636 - `subscription_id: string`
254637
254638 - `FederatedActorGcpProvider object`
254639
254640 Asserting party: the GCP project the organization is bound to.
254641
254642 - `type: optional "gcp"`
254643
254644 default: gcp
254645
254646 - `project_number: string`
254647
254648 - `FederatedActorOidcProvider object`
254649
254650 Asserting party: a customer-registered OIDC federation issuer.
254651
254652 - `type: optional "oidc"`
254653
254654 default: oidc
254655
254656 - `issuer: optional string or null`
254657
254658 The federation issuer's URL. Null when the presented credential failed verification.
254659
254660 - `ip_address: optional string or null`
254661
254662 - `subject: optional string or null`
254663
254664 The provider's verified identifier for the caller; its form depends on the provider.
254665
254666 - `user_agent: optional string or null`
254667
254668 - `AttestedDeviceActor object`
254669
254670 An attested mobile device authenticated via Apple App Attest.
254671
254672 - `type: optional "attested_device_actor"`
254673
254674 default: attested_device_actor
254675
254676 - `external_client_id: string`
254677
254678 - `kid_hash: string`
254679
254680 - `ip_address: optional string or null`
254681
254682 - `user_agent: optional string or null`
254683
254684 - `telemetry_destination_id: string`
254685
254686 Tagged telemetry destination ID, e.g. "tdst_01HX...".
254687
254688 - `id: optional string`
254689
254690 Unique identifier for the activity e.g. 'activity_abcd1234'
254691
254692 - `created_at: optional string`
254693
254694 When this activity occurred.
254695
254696 format: date-time
254697
254698 - `endpoint_url: optional string or null`
254699
254700 The destination's endpoint URL as stored, e.g. "https://collector.example.com/otlp"; the API refuses credentials, query strings and fragments in this URL.
254701
254702 - `organization_id: optional string or null`
254703
254704 Organization ID this activity is associated with
254705
254706 - `organization_uuid: optional string or null`
254707
254708 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
254709
254710 - `traces: optional object or null`
254711
254712 The destination's settings for traces, as the API returns them.
254713
254714 - `content_mode: string`
254715
254716 What the exported spans contain: "metadata_only", or "content" when they also carry message and tool content.
254717
254718 - `enabled: boolean`
254719
254720 Whether the destination receives traces.
254721
254722 - `endpoint_url: optional string or null`
254723
254724 The destination's separate traces URL as stored, e.g. "https://collector.example.com/v2/trace/otlp"; like the endpoint URL it never contains credentials, a query string or a fragment. Omitted when the destination has none; traces then go to the endpoint URL plus "/v1/traces".
254725
254726 - `max_content_bytes: optional number or null`
254727
254728 The most bytes of content that one exported span keeps; omitted when the destination sets no bound and only Anthropic's maximum applies.
254729
254730 - `workspaces: optional object or null`
254731
254732 Which workspaces the destination covers, as the API returns it: its type only, "all", "include" or "exclude". The workspaces put on its list by the same request are recorded as workspace_added activities.
254733
254734 - `type: string`
254735
254736 "all": every workspace of the organization; "include": the workspaces on the destination's list; "exclude": every workspace but those on its list.
254737
254738 - `PlatformTelemetryDestinationDeleted object`
254739
254740 A telemetry destination was deleted.
254741
254742 - `type: optional "platform_telemetry_destination_deleted"`
254743
254744 default: platform_telemetry_destination_deleted
254745
254746 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
254747
254748 - `APIActor object`
254749
254750 - `type: optional "api_actor"`
254751
254752 default: api_actor
254753
254754 - `api_key_id: string`
254755
254756 - `ip_address: string`
254757
254758 - `user_agent: string`
254759
254760 - `UserActor object`
254761
254762 - `type: optional "user_actor"`
254763
254764 default: user_actor
254765
254766 - `email_address: string`
254767
254768 format: email
254769
254770 - `ip_address: string`
254771
254772 - `user_agent: string`
254773
254774 - `user_id: string`
254775
254776 - `UnauthenticatedUserActor object`
254777
254778 - `type: optional "unauthenticated_user_actor"`
254779
254780 default: unauthenticated_user_actor
254781
254782 - `ip_address: string`
254783
254784 - `user_agent: string`
254785
254786 - `unauthenticated_email_address: optional string or null`
254787
254788 format: email
254789
254790 - `AnthropicActor object`
254791
254792 - `type: optional "anthropic_actor"`
254793
254794 default: anthropic_actor
254795
254796 - `email_address: optional string or null`
254797
254798 format: email
254799
254800 - `SystemActor object`
254801
254802 Automated background processing performed by Anthropic systems, acting
254803 without a user or customer credential.
254804
254805 - `type: optional "system_actor"`
254806
254807 default: system_actor
254808
254809 - `service: optional string or null`
254810
254811 Name of the automated process that performed the action, when known.
254812
254813 - `AdminAPIKeyActor object`
254814
254815 - `type: optional "admin_api_key_actor"`
254816
254817 default: admin_api_key_actor
254818
254819 - `admin_api_key_id: string`
254820
254821 - `ip_address: string`
254822
254823 - `user_agent: string`
254824
254825 - `ServiceAccountActor object`
254826
254827 - `type: optional "service_account_actor"`
254828
254829 default: service_account_actor
254830
254831 - `ip_address: string`
254832
254833 - `service_account_id: string`
254834
254835 - `user_agent: string`
254836
254837 - `ScimDirectorySyncActor object`
254838
254839 - `type: optional "scim_directory_sync_actor"`
254840
254841 default: scim_directory_sync_actor
254842
254843 - `directory_id: string`
254844
254845 - `workos_event_id: string`
254846
254847 - `idp_connection_type: optional string or null`
254848
254849 - `FederatedIdentityActor object`
254850
254851 A federated external workload authenticated via a verified OIDC token.
254852
254853 Carries the verified issuer, subject, and audience claims from the
254854 presented JWT.
254855
254856 - `type: optional "federated_identity_actor"`
254857
254858 default: federated_identity_actor
254859
254860 - `issuer: string`
254861
254862 - `subject: string`
254863
254864 - `audience: optional array of string`
254865
254866 - `ip_address: optional string or null`
254867
254868 - `user_agent: optional string or null`
254869
254870 - `FederatedActor object`
254871
254872 An external identity asserted by a trusted provider — a cloud-provider
254873 gateway or a customer-registered federation issuer — acting without an
254874 Anthropic-provisioned account or service account.
254875
254876 - `type: optional "federated_actor"`
254877
254878 default: federated_actor
254879
254880 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
254881
254882 - `FederatedActorAwsProvider object`
254883
254884 Asserting party: the AWS account the organization is bound to.
254885
254886 - `type: optional "aws"`
254887
254888 default: aws
254889
254890 - `account_id: string`
254891
254892 - `signed_principal: string`
254893
254894 The AWS-signed ARN of the IAM principal that requested the token.
254895
254896 - `FederatedActorAzureProvider object`
254897
254898 Asserting party: the Azure subscription the organization is bound to.
254899
254900 - `type: optional "azure"`
254901
254902 default: azure
254903
254904 - `subscription_id: string`
254905
254906 - `FederatedActorGcpProvider object`
254907
254908 Asserting party: the GCP project the organization is bound to.
254909
254910 - `type: optional "gcp"`
254911
254912 default: gcp
254913
254914 - `project_number: string`
254915
254916 - `FederatedActorOidcProvider object`
254917
254918 Asserting party: a customer-registered OIDC federation issuer.
254919
254920 - `type: optional "oidc"`
254921
254922 default: oidc
254923
254924 - `issuer: optional string or null`
254925
254926 The federation issuer's URL. Null when the presented credential failed verification.
254927
254928 - `ip_address: optional string or null`
254929
254930 - `subject: optional string or null`
254931
254932 The provider's verified identifier for the caller; its form depends on the provider.
254933
254934 - `user_agent: optional string or null`
254935
254936 - `AttestedDeviceActor object`
254937
254938 An attested mobile device authenticated via Apple App Attest.
254939
254940 - `type: optional "attested_device_actor"`
254941
254942 default: attested_device_actor
254943
254944 - `external_client_id: string`
254945
254946 - `kid_hash: string`
254947
254948 - `ip_address: optional string or null`
254949
254950 - `user_agent: optional string or null`
254951
254952 - `telemetry_destination_id: string`
254953
254954 Tagged telemetry destination ID, e.g. "tdst_01HX...".
254955
254956 - `id: optional string`
254957
254958 Unique identifier for the activity e.g. 'activity_abcd1234'
254959
254960 - `created_at: optional string`
254961
254962 When this activity occurred.
254963
254964 format: date-time
254965
254966 - `organization_id: optional string or null`
254967
254968 Organization ID this activity is associated with
254969
254970 - `organization_uuid: optional string or null`
254971
254972 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
254973
254974 - `PlatformTelemetryDestinationUpdated object`
254975
254976 A telemetry destination's configuration was updated. State changes and changes of its workspace scope (the type, or the list through an update's workspace_ids) are included; the workspaces an update took off or put on the list are also recorded as workspace_removed and workspace_added activities. Previous and current values are recorded only for the endpoint URL, the traces URL, the content mode and the workspaces type.
254977
254978 - `type: optional "platform_telemetry_destination_updated"`
254979
254980 default: platform_telemetry_destination_updated
254981
254982 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
254983
254984 - `APIActor object`
254985
254986 - `type: optional "api_actor"`
254987
254988 default: api_actor
254989
254990 - `api_key_id: string`
254991
254992 - `ip_address: string`
254993
254994 - `user_agent: string`
254995
254996 - `UserActor object`
254997
254998 - `type: optional "user_actor"`
254999
255000 default: user_actor
255001
255002 - `email_address: string`
255003
255004 format: email
255005
255006 - `ip_address: string`
255007
255008 - `user_agent: string`
255009
255010 - `user_id: string`
255011
255012 - `UnauthenticatedUserActor object`
255013
255014 - `type: optional "unauthenticated_user_actor"`
255015
255016 default: unauthenticated_user_actor
255017
255018 - `ip_address: string`
255019
255020 - `user_agent: string`
255021
255022 - `unauthenticated_email_address: optional string or null`
255023
255024 format: email
255025
255026 - `AnthropicActor object`
255027
255028 - `type: optional "anthropic_actor"`
255029
255030 default: anthropic_actor
255031
255032 - `email_address: optional string or null`
255033
255034 format: email
255035
255036 - `SystemActor object`
255037
255038 Automated background processing performed by Anthropic systems, acting
255039 without a user or customer credential.
255040
255041 - `type: optional "system_actor"`
255042
255043 default: system_actor
255044
255045 - `service: optional string or null`
255046
255047 Name of the automated process that performed the action, when known.
255048
255049 - `AdminAPIKeyActor object`
255050
255051 - `type: optional "admin_api_key_actor"`
255052
255053 default: admin_api_key_actor
255054
255055 - `admin_api_key_id: string`
255056
255057 - `ip_address: string`
255058
255059 - `user_agent: string`
255060
255061 - `ServiceAccountActor object`
255062
255063 - `type: optional "service_account_actor"`
255064
255065 default: service_account_actor
255066
255067 - `ip_address: string`
255068
255069 - `service_account_id: string`
255070
255071 - `user_agent: string`
255072
255073 - `ScimDirectorySyncActor object`
255074
255075 - `type: optional "scim_directory_sync_actor"`
255076
255077 default: scim_directory_sync_actor
255078
255079 - `directory_id: string`
255080
255081 - `workos_event_id: string`
255082
255083 - `idp_connection_type: optional string or null`
255084
255085 - `FederatedIdentityActor object`
255086
255087 A federated external workload authenticated via a verified OIDC token.
255088
255089 Carries the verified issuer, subject, and audience claims from the
255090 presented JWT.
255091
255092 - `type: optional "federated_identity_actor"`
255093
255094 default: federated_identity_actor
255095
255096 - `issuer: string`
255097
255098 - `subject: string`
255099
255100 - `audience: optional array of string`
255101
255102 - `ip_address: optional string or null`
255103
255104 - `user_agent: optional string or null`
255105
255106 - `FederatedActor object`
255107
255108 An external identity asserted by a trusted provider — a cloud-provider
255109 gateway or a customer-registered federation issuer — acting without an
255110 Anthropic-provisioned account or service account.
255111
255112 - `type: optional "federated_actor"`
255113
255114 default: federated_actor
255115
255116 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
255117
255118 - `FederatedActorAwsProvider object`
255119
255120 Asserting party: the AWS account the organization is bound to.
255121
255122 - `type: optional "aws"`
255123
255124 default: aws
255125
255126 - `account_id: string`
255127
255128 - `signed_principal: string`
255129
255130 The AWS-signed ARN of the IAM principal that requested the token.
255131
255132 - `FederatedActorAzureProvider object`
255133
255134 Asserting party: the Azure subscription the organization is bound to.
255135
255136 - `type: optional "azure"`
255137
255138 default: azure
255139
255140 - `subscription_id: string`
255141
255142 - `FederatedActorGcpProvider object`
255143
255144 Asserting party: the GCP project the organization is bound to.
255145
255146 - `type: optional "gcp"`
255147
255148 default: gcp
255149
255150 - `project_number: string`
255151
255152 - `FederatedActorOidcProvider object`
255153
255154 Asserting party: a customer-registered OIDC federation issuer.
255155
255156 - `type: optional "oidc"`
255157
255158 default: oidc
255159
255160 - `issuer: optional string or null`
255161
255162 The federation issuer's URL. Null when the presented credential failed verification.
255163
255164 - `ip_address: optional string or null`
255165
255166 - `subject: optional string or null`
255167
255168 The provider's verified identifier for the caller; its form depends on the provider.
255169
255170 - `user_agent: optional string or null`
255171
255172 - `AttestedDeviceActor object`
255173
255174 An attested mobile device authenticated via Apple App Attest.
255175
255176 - `type: optional "attested_device_actor"`
255177
255178 default: attested_device_actor
255179
255180 - `external_client_id: string`
255181
255182 - `kid_hash: string`
255183
255184 - `ip_address: optional string or null`
255185
255186 - `user_agent: optional string or null`
255187
255188 - `telemetry_destination_id: string`
255189
255190 Tagged telemetry destination ID, e.g. "tdst_01HX...".
255191
255192 - `id: optional string`
255193
255194 Unique identifier for the activity e.g. 'activity_abcd1234'
255195
255196 - `created_at: optional string`
255197
255198 When this activity occurred.
255199
255200 format: date-time
255201
255202 - `organization_id: optional string or null`
255203
255204 Organization ID this activity is associated with
255205
255206 - `organization_uuid: optional string or null`
255207
255208 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
255209
255210 - `updated_fields: optional array of string`
255211
255212 Names of the configuration fields whose value changed, e.g. "endpoint_url", "headers", "state"; "traces" when any setting for traces changed. Header names and values are never included.
255213
255214 - `updates: optional array of object`
255215
255216 The field-level value changes in this update, in this order: an "endpoint_url" entry when the endpoint URL changed, a "traces_endpoint_url" entry when the traces URL changed, a "traces_content_mode" entry when the content mode changed, and a "workspaces" entry ("all", "include" or "exclude") when the workspaces type changed; empty otherwise.
255217
255218 - `type: "endpoint_url" or "traces_content_mode" or "traces_endpoint_url" or 2 more`
255219
255220 The destination field that changed
255221
255222 - `"endpoint_url"`
255223
255224 - `"traces_content_mode"`
255225
255226 - `"traces_endpoint_url"`
255227
255228 - `"unspecified"`
255229
255230 - `"workspaces"`
255231
255232 - `current_value: string`
255233
255234 Field value immediately after this change
255235
255236 - `previous_value: string`
255237
255238 Field value immediately before this change
255239
255240 - `PlatformTelemetryDestinationWorkspaceAdded object`
255241
255242 A workspace was added to the workspace list of a telemetry destination. When the list type is "include", the destination starts to receive the spans of that workspace; when it is "exclude", the destination stops receiving them.
255243
255244 - `type: optional "platform_telemetry_destination_workspace_added"`
255245
255246 default: platform_telemetry_destination_workspace_added
255247
255248 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
255249
255250 - `APIActor object`
255251
255252 - `type: optional "api_actor"`
255253
255254 default: api_actor
255255
255256 - `api_key_id: string`
255257
255258 - `ip_address: string`
255259
255260 - `user_agent: string`
255261
255262 - `UserActor object`
255263
255264 - `type: optional "user_actor"`
255265
255266 default: user_actor
255267
255268 - `email_address: string`
255269
255270 format: email
255271
255272 - `ip_address: string`
255273
255274 - `user_agent: string`
255275
255276 - `user_id: string`
255277
255278 - `UnauthenticatedUserActor object`
255279
255280 - `type: optional "unauthenticated_user_actor"`
255281
255282 default: unauthenticated_user_actor
255283
255284 - `ip_address: string`
255285
255286 - `user_agent: string`
255287
255288 - `unauthenticated_email_address: optional string or null`
255289
255290 format: email
255291
255292 - `AnthropicActor object`
255293
255294 - `type: optional "anthropic_actor"`
255295
255296 default: anthropic_actor
255297
255298 - `email_address: optional string or null`
255299
255300 format: email
255301
255302 - `SystemActor object`
255303
255304 Automated background processing performed by Anthropic systems, acting
255305 without a user or customer credential.
255306
255307 - `type: optional "system_actor"`
255308
255309 default: system_actor
255310
255311 - `service: optional string or null`
255312
255313 Name of the automated process that performed the action, when known.
255314
255315 - `AdminAPIKeyActor object`
255316
255317 - `type: optional "admin_api_key_actor"`
255318
255319 default: admin_api_key_actor
255320
255321 - `admin_api_key_id: string`
255322
255323 - `ip_address: string`
255324
255325 - `user_agent: string`
255326
255327 - `ServiceAccountActor object`
255328
255329 - `type: optional "service_account_actor"`
255330
255331 default: service_account_actor
255332
255333 - `ip_address: string`
255334
255335 - `service_account_id: string`
255336
255337 - `user_agent: string`
255338
255339 - `ScimDirectorySyncActor object`
255340
255341 - `type: optional "scim_directory_sync_actor"`
255342
255343 default: scim_directory_sync_actor
255344
255345 - `directory_id: string`
255346
255347 - `workos_event_id: string`
255348
255349 - `idp_connection_type: optional string or null`
255350
255351 - `FederatedIdentityActor object`
255352
255353 A federated external workload authenticated via a verified OIDC token.
255354
255355 Carries the verified issuer, subject, and audience claims from the
255356 presented JWT.
255357
255358 - `type: optional "federated_identity_actor"`
255359
255360 default: federated_identity_actor
255361
255362 - `issuer: string`
255363
255364 - `subject: string`
255365
255366 - `audience: optional array of string`
255367
255368 - `ip_address: optional string or null`
255369
255370 - `user_agent: optional string or null`
255371
255372 - `FederatedActor object`
255373
255374 An external identity asserted by a trusted provider — a cloud-provider
255375 gateway or a customer-registered federation issuer — acting without an
255376 Anthropic-provisioned account or service account.
255377
255378 - `type: optional "federated_actor"`
255379
255380 default: federated_actor
255381
255382 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
255383
255384 - `FederatedActorAwsProvider object`
255385
255386 Asserting party: the AWS account the organization is bound to.
255387
255388 - `type: optional "aws"`
255389
255390 default: aws
255391
255392 - `account_id: string`
255393
255394 - `signed_principal: string`
255395
255396 The AWS-signed ARN of the IAM principal that requested the token.
255397
255398 - `FederatedActorAzureProvider object`
255399
255400 Asserting party: the Azure subscription the organization is bound to.
255401
255402 - `type: optional "azure"`
255403
255404 default: azure
255405
255406 - `subscription_id: string`
255407
255408 - `FederatedActorGcpProvider object`
255409
255410 Asserting party: the GCP project the organization is bound to.
255411
255412 - `type: optional "gcp"`
255413
255414 default: gcp
255415
255416 - `project_number: string`
255417
255418 - `FederatedActorOidcProvider object`
255419
255420 Asserting party: a customer-registered OIDC federation issuer.
255421
255422 - `type: optional "oidc"`
255423
255424 default: oidc
255425
255426 - `issuer: optional string or null`
255427
255428 The federation issuer's URL. Null when the presented credential failed verification.
255429
255430 - `ip_address: optional string or null`
255431
255432 - `subject: optional string or null`
255433
255434 The provider's verified identifier for the caller; its form depends on the provider.
255435
255436 - `user_agent: optional string or null`
255437
255438 - `AttestedDeviceActor object`
255439
255440 An attested mobile device authenticated via Apple App Attest.
255441
255442 - `type: optional "attested_device_actor"`
255443
255444 default: attested_device_actor
255445
255446 - `external_client_id: string`
255447
255448 - `kid_hash: string`
255449
255450 - `ip_address: optional string or null`
255451
255452 - `user_agent: optional string or null`
255453
255454 - `telemetry_destination_id: string`
255455
255456 Tagged telemetry destination ID, e.g. "tdst_01HX...".
255457
255458 - `workspace_id: string`
255459
255460 Tagged ID of the workspace put on the list, e.g. "wrkspc_01HX...".
255461
255462 - `id: optional string`
255463
255464 Unique identifier for the activity e.g. 'activity_abcd1234'
255465
255466 - `created_at: optional string`
255467
255468 When this activity occurred.
255469
255470 format: date-time
255471
255472 - `organization_id: optional string or null`
255473
255474 Organization ID this activity is associated with
255475
255476 - `organization_uuid: optional string or null`
255477
255478 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
255479
255480 - `PlatformTelemetryDestinationWorkspaceRemoved object`
255481
255482 A workspace was removed from the workspace list of a telemetry destination, by a change to the list or because the destination was deleted. When the list type is "include", the destination stops receiving the spans of that workspace; when it is "exclude", the destination receives them again unless the destination was deleted.
255483
255484 - `type: optional "platform_telemetry_destination_workspace_removed"`
255485
255486 default: platform_telemetry_destination_workspace_removed
255487
255488 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
255489
255490 - `APIActor object`
255491
255492 - `type: optional "api_actor"`
255493
255494 default: api_actor
255495
255496 - `api_key_id: string`
255497
255498 - `ip_address: string`
255499
255500 - `user_agent: string`
255501
255502 - `UserActor object`
255503
255504 - `type: optional "user_actor"`
255505
255506 default: user_actor
255507
255508 - `email_address: string`
255509
255510 format: email
255511
255512 - `ip_address: string`
255513
255514 - `user_agent: string`
255515
255516 - `user_id: string`
255517
255518 - `UnauthenticatedUserActor object`
255519
255520 - `type: optional "unauthenticated_user_actor"`
255521
255522 default: unauthenticated_user_actor
255523
255524 - `ip_address: string`
255525
255526 - `user_agent: string`
255527
255528 - `unauthenticated_email_address: optional string or null`
255529
255530 format: email
255531
255532 - `AnthropicActor object`
255533
255534 - `type: optional "anthropic_actor"`
255535
255536 default: anthropic_actor
255537
255538 - `email_address: optional string or null`
255539
255540 format: email
255541
255542 - `SystemActor object`
255543
255544 Automated background processing performed by Anthropic systems, acting
255545 without a user or customer credential.
255546
255547 - `type: optional "system_actor"`
255548
255549 default: system_actor
255550
255551 - `service: optional string or null`
255552
255553 Name of the automated process that performed the action, when known.
255554
255555 - `AdminAPIKeyActor object`
255556
255557 - `type: optional "admin_api_key_actor"`
255558
255559 default: admin_api_key_actor
255560
255561 - `admin_api_key_id: string`
255562
255563 - `ip_address: string`
255564
255565 - `user_agent: string`
255566
255567 - `ServiceAccountActor object`
255568
255569 - `type: optional "service_account_actor"`
255570
255571 default: service_account_actor
255572
255573 - `ip_address: string`
255574
255575 - `service_account_id: string`
255576
255577 - `user_agent: string`
255578
255579 - `ScimDirectorySyncActor object`
255580
255581 - `type: optional "scim_directory_sync_actor"`
255582
255583 default: scim_directory_sync_actor
255584
255585 - `directory_id: string`
255586
255587 - `workos_event_id: string`
255588
255589 - `idp_connection_type: optional string or null`
255590
255591 - `FederatedIdentityActor object`
255592
255593 A federated external workload authenticated via a verified OIDC token.
255594
255595 Carries the verified issuer, subject, and audience claims from the
255596 presented JWT.
255597
255598 - `type: optional "federated_identity_actor"`
255599
255600 default: federated_identity_actor
255601
255602 - `issuer: string`
255603
255604 - `subject: string`
255605
255606 - `audience: optional array of string`
255607
255608 - `ip_address: optional string or null`
255609
255610 - `user_agent: optional string or null`
255611
255612 - `FederatedActor object`
255613
255614 An external identity asserted by a trusted provider — a cloud-provider
255615 gateway or a customer-registered federation issuer — acting without an
255616 Anthropic-provisioned account or service account.
255617
255618 - `type: optional "federated_actor"`
255619
255620 default: federated_actor
255621
255622 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
255623
255624 - `FederatedActorAwsProvider object`
255625
255626 Asserting party: the AWS account the organization is bound to.
255627
255628 - `type: optional "aws"`
255629
255630 default: aws
255631
255632 - `account_id: string`
255633
255634 - `signed_principal: string`
255635
255636 The AWS-signed ARN of the IAM principal that requested the token.
255637
255638 - `FederatedActorAzureProvider object`
255639
255640 Asserting party: the Azure subscription the organization is bound to.
255641
255642 - `type: optional "azure"`
255643
255644 default: azure
255645
255646 - `subscription_id: string`
255647
255648 - `FederatedActorGcpProvider object`
255649
255650 Asserting party: the GCP project the organization is bound to.
255651
255652 - `type: optional "gcp"`
255653
255654 default: gcp
255655
255656 - `project_number: string`
255657
255658 - `FederatedActorOidcProvider object`
255659
255660 Asserting party: a customer-registered OIDC federation issuer.
255661
255662 - `type: optional "oidc"`
255663
255664 default: oidc
255665
255666 - `issuer: optional string or null`
255667
255668 The federation issuer's URL. Null when the presented credential failed verification.
255669
255670 - `ip_address: optional string or null`
255671
255672 - `subject: optional string or null`
255673
255674 The provider's verified identifier for the caller; its form depends on the provider.
255675
255676 - `user_agent: optional string or null`
255677
255678 - `AttestedDeviceActor object`
255679
255680 An attested mobile device authenticated via Apple App Attest.
255681
255682 - `type: optional "attested_device_actor"`
255683
255684 default: attested_device_actor
255685
255686 - `external_client_id: string`
255687
255688 - `kid_hash: string`
255689
255690 - `ip_address: optional string or null`
255691
255692 - `user_agent: optional string or null`
255693
255694 - `telemetry_destination_id: string`
255695
255696 Tagged telemetry destination ID, e.g. "tdst_01HX...".
255697
255698 - `workspace_id: string`
255699
255700 Tagged ID of the workspace taken off the list, e.g. "wrkspc_01HX...".
255701
255702 - `id: optional string`
255703
255704 Unique identifier for the activity e.g. 'activity_abcd1234'
255705
255706 - `created_at: optional string`
255707
255708 When this activity occurred.
255709
255710 format: date-time
255711
255712 - `organization_id: optional string or null`
255713
255714 Organization ID this activity is associated with
255715
255716 - `organization_uuid: optional string or null`
255717
255718 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
255719
248456255720 - `PlatformUsageReportClaudeCodeViewed object`
248457255721
248458255722 The Claude Code usage report was viewed.
248459255723
No line in this hunk matches that.