Query compliance activities changedapi/compliance/activities/list
Nearest release: v2.1.309, published 2 hours after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+3,697added
Lines−9removed
From line
15
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits32to this page, all time
The whole hunk
from line 15, old and new numbered
/
This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.
The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.
from line 15
1515
1616## Query parameters
1717
18- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 544 more`
18- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "account_migration_completed" or 558 more`
1919
2020 Filter activities by type. See the response `data` schema for the additional fields each type returns. Cannot be combined with `exclude_activity_types[]`.
2121
from line 27
2727
2828 User-initiated self-service account deletion.
2929
30 - `"account_migration_completed"`
31
32 A personal Claude account's migration into the organization finished: the migrated data is now part of the organization.
33
34 - `"account_migration_failed"`
35
36 A personal Claude account's migration into the organization did not complete.
37
38 - `"account_migration_started"`
39
40 A personal Claude account began migrating into the organization: its data, including conversations, projects and files, is being moved from the member's personal account into this organization.
41
3042 - `"admin_api_key_created"`
3143
3244 An admin API key was created.
from line 359
347359
348360 Claude Code Review configuration was enabled/disabled for an org.
349361
362 - `"claude_code_review_promo_enrolled"`
363
364 An organization admin enrolled the organization in a Claude Code Review promotion, for example by claiming promotional credits.
365
350366 - `"claude_code_review_repository_added"`
351367
352368 A repository was added to org-level Claude Code Review configuration.
from line 417
401417
402418 - `"claude_code_security_scan_project_updated"`
403419
404 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience.
420 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience, or a user paused the project's scheduled scanning, unpaused it, or lifted a billing pause on it.
405421
406422 - `"claude_code_security_scan_project_visibility_updated"`
407423
from line 735
719735
720736 SAML IdP configuration updated for a public sector organization.
721737
738 - `"claude_skill_auto_disabled"`
739
740 A skill that had been turned on for a member automatically was turned off for them automatically, not by the member; reason says why. A member turning a skill off themselves is recorded as claude_skill_disabled.
741
742 - `"claude_skill_auto_enabled"`
743
744 A skill was turned on for a member automatically, not by the member; trigger gives the cause, such as another member sharing an eligible skill with them. A member turning a skill on themselves is recorded as claude_skill_enabled.
745
722746 - `"claude_skill_created"`
723747
724748 Skill was created.
from line 895
871895
872896 A new version of an existing org-owned desktop extension was uploaded.
873897
898 - `"domain_claim_cancelled"`
899
900 A pending domain claim was cancelled before it took effect, so the personal accounts on the claimed domains will no longer be migrated or deactivated at its deadline.
901
902 - `"domain_claim_deadline_updated"`
903
904 The migration deadline of a pending domain claim was moved to a later or an earlier date by Anthropic staff or an automated process.
905
874906 - `"domain_claim_initiated"`
875907
876908 Domain capture claim initiated over personal accounts on verified domains.
from line 1907
18751907
18761908 An org-level spend limit snooze/ignore state was changed.
18771909
1910 - `"platform_telemetry_destination_auto_disabled"`
1911
1912 A telemetry destination was disabled automatically after deliveries to it failed, so no telemetry is sent to it until an administrator enables it again.
1913
1914 - `"platform_telemetry_destination_created"`
1915
1916 A telemetry destination was registered for the organization.
1917
1918 - `"platform_telemetry_destination_deleted"`
1919
1920 A telemetry destination was deleted.
1921
1922 - `"platform_telemetry_destination_updated"`
1923
1924 A telemetry destination's configuration was updated. State changes and changes of its workspace scope (the type, or the list through an update's workspace_ids) are included; the workspaces an update took off or put on the list are also recorded as workspace_removed and workspace_added activities. Previous and current values are recorded only for the endpoint URL, the traces URL, the content mode and the workspaces type.
1925
1926 - `"platform_telemetry_destination_workspace_added"`
1927
1928 A workspace was added to the workspace list of a telemetry destination. When the list type is "include", the destination starts to receive the spans of that workspace; when it is "exclude", the destination stops receiving them.
1929
1930 - `"platform_telemetry_destination_workspace_removed"`
1931
1932 A workspace was removed from the workspace list of a telemetry destination, by a change to the list or because the destination was deleted. When the list type is "include", the destination stops receiving the spans of that workspace; when it is "exclude", the destination receives them again unless the destination was deleted.
1933
18781934 - `"platform_usage_report_claude_code_viewed"`
18791935
18801936 The Claude Code usage report was viewed.
from line 2318
22622318
22632319 format: date-time
22642320
2265- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 544 more`
2321- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "account_migration_completed" or 558 more`
22662322
22672323 Exclude activities of these types. Cannot be combined with `activity_types[]`.
22682324
from line 2330
22742330
22752331 User-initiated self-service account deletion.
22762332
2333 - `"account_migration_completed"`
2334
2335 A personal Claude account's migration into the organization finished: the migrated data is now part of the organization.
2336
2337 - `"account_migration_failed"`
2338
2339 A personal Claude account's migration into the organization did not complete.
2340
2341 - `"account_migration_started"`
2342
2343 A personal Claude account began migrating into the organization: its data, including conversations, projects and files, is being moved from the member's personal account into this organization.
2344
22772345 - `"admin_api_key_created"`
22782346
22792347 An admin API key was created.
from line 2662
25942662
25952663 Claude Code Review configuration was enabled/disabled for an org.
25962664
2665 - `"claude_code_review_promo_enrolled"`
2666
2667 An organization admin enrolled the organization in a Claude Code Review promotion, for example by claiming promotional credits.
2668
25972669 - `"claude_code_review_repository_added"`
25982670
25992671 A repository was added to org-level Claude Code Review configuration.
from line 2720
26482720
26492721 - `"claude_code_security_scan_project_updated"`
26502722
2651 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience.
2723 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience, or a user paused the project's scheduled scanning, unpaused it, or lifted a billing pause on it.
26522724
26532725 - `"claude_code_security_scan_project_visibility_updated"`
26542726
from line 3038
29663038
29673039 SAML IdP configuration updated for a public sector organization.
29683040
3041 - `"claude_skill_auto_disabled"`
3042
3043 A skill that had been turned on for a member automatically was turned off for them automatically, not by the member; reason says why. A member turning a skill off themselves is recorded as claude_skill_disabled.
3044
3045 - `"claude_skill_auto_enabled"`
3046
3047 A skill was turned on for a member automatically, not by the member; trigger gives the cause, such as another member sharing an eligible skill with them. A member turning a skill on themselves is recorded as claude_skill_enabled.
3048
29693049 - `"claude_skill_created"`
29703050
29713051 Skill was created.
from line 3198
31183198
31193199 A new version of an existing org-owned desktop extension was uploaded.
31203200
3201 - `"domain_claim_cancelled"`
3202
3203 A pending domain claim was cancelled before it took effect, so the personal accounts on the claimed domains will no longer be migrated or deactivated at its deadline.
3204
3205 - `"domain_claim_deadline_updated"`
3206
3207 The migration deadline of a pending domain claim was moved to a later or an earlier date by Anthropic staff or an automated process.
3208
31213209 - `"domain_claim_initiated"`
31223210
31233211 Domain capture claim initiated over personal accounts on verified domains.
from line 4210
41224210
41234211 An org-level spend limit snooze/ignore state was changed.
41244212
4213 - `"platform_telemetry_destination_auto_disabled"`
4214
4215 A telemetry destination was disabled automatically after deliveries to it failed, so no telemetry is sent to it until an administrator enables it again.
4216
4217 - `"platform_telemetry_destination_created"`
4218
4219 A telemetry destination was registered for the organization.
4220
4221 - `"platform_telemetry_destination_deleted"`
4222
4223 A telemetry destination was deleted.
4224
4225 - `"platform_telemetry_destination_updated"`
4226
4227 A telemetry destination's configuration was updated. State changes and changes of its workspace scope (the type, or the list through an update's workspace_ids) are included; the workspaces an update took off or put on the list are also recorded as workspace_removed and workspace_added activities. Previous and current values are recorded only for the endpoint URL, the traces URL, the content mode and the workspaces type.
4228
4229 - `"platform_telemetry_destination_workspace_added"`
4230
4231 A workspace was added to the workspace list of a telemetry destination. When the list type is "include", the destination starts to receive the spans of that workspace; when it is "exclude", the destination stops receiving them.
4232
4233 - `"platform_telemetry_destination_workspace_removed"`
4234
4235 A workspace was removed from the workspace list of a telemetry destination, by a change to the list or because the destination was deleted. When the list type is "include", the destination stops receiving the spans of that workspace; when it is "exclude", the destination receives them again unless the destination was deleted.
4236
41254237 - `"platform_usage_report_claude_code_viewed"`
41264238
41274239 The Claude Code usage report was viewed.
from line 4619
45074619
45084620## Returns
45094621
4510- `data: optional array of AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 544 more`
4622- `data: optional array of AbuseDecisionReceived or AccountDeleted or AccountMigrationCompleted or 558 more`
45114623
45124624 List of activity records. Each element's `type` field identifies which activity it is and which additional fields are present.
45134625
from line 5099
49875099
49885100 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
49895101
5102 - `AccountMigrationCompleted object`
5103
5104 A personal Claude account's migration into the organization finished: the migrated data is now part of the organization.
5105
5106 - `type: optional "account_migration_completed"`
5107
5108 default: account_migration_completed
5109
5110 - `account_migration_id: string`
5111
5112 Tagged ID of the migration, e.g. "amig_...", matching the account_migration_started activity that opened it.
5113
5114 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
5115
5116 - `APIActor object`
5117
5118 - `type: optional "api_actor"`
5119
5120 default: api_actor
5121
5122 - `api_key_id: string`
5123
5124 - `ip_address: string`
5125
5126 - `user_agent: string`
5127
5128 - `UserActor object`
5129
5130 - `type: optional "user_actor"`
5131
5132 default: user_actor
5133
5134 - `email_address: string`
5135
5136 format: email
5137
5138 - `ip_address: string`
5139
5140 - `user_agent: string`
5141
5142 - `user_id: string`
5143
5144 - `UnauthenticatedUserActor object`
5145
5146 - `type: optional "unauthenticated_user_actor"`
5147
5148 default: unauthenticated_user_actor
5149
5150 - `ip_address: string`
5151
5152 - `user_agent: string`
5153
5154 - `unauthenticated_email_address: optional string or null`
5155
5156 format: email
5157
5158 - `AnthropicActor object`
5159
5160 - `type: optional "anthropic_actor"`
5161
5162 default: anthropic_actor
5163
5164 - `email_address: optional string or null`
5165
5166 format: email
5167
5168 - `SystemActor object`
5169
5170 Automated background processing performed by Anthropic systems, acting
5171 without a user or customer credential.
5172
5173 - `type: optional "system_actor"`
5174
5175 default: system_actor
5176
5177 - `service: optional string or null`
5178
5179 Name of the automated process that performed the action, when known.
5180
5181 - `AdminAPIKeyActor object`
5182
5183 - `type: optional "admin_api_key_actor"`
5184
5185 default: admin_api_key_actor
5186
5187 - `admin_api_key_id: string`
5188
5189 - `ip_address: string`
5190
5191 - `user_agent: string`
5192
5193 - `ServiceAccountActor object`
5194
5195 - `type: optional "service_account_actor"`
5196
5197 default: service_account_actor
5198
5199 - `ip_address: string`
5200
5201 - `service_account_id: string`
5202
5203 - `user_agent: string`
5204
5205 - `ScimDirectorySyncActor object`
5206
5207 - `type: optional "scim_directory_sync_actor"`
5208
5209 default: scim_directory_sync_actor
5210
5211 - `directory_id: string`
5212
5213 - `workos_event_id: string`
5214
5215 - `idp_connection_type: optional string or null`
5216
5217 - `FederatedIdentityActor object`
5218
5219 A federated external workload authenticated via a verified OIDC token.
5220
5221 Carries the verified issuer, subject, and audience claims from the
5222 presented JWT.
5223
5224 - `type: optional "federated_identity_actor"`
5225
5226 default: federated_identity_actor
5227
5228 - `issuer: string`
5229
5230 - `subject: string`
5231
5232 - `audience: optional array of string`
5233
5234 - `ip_address: optional string or null`
5235
5236 - `user_agent: optional string or null`
5237
5238 - `FederatedActor object`
5239
5240 An external identity asserted by a trusted provider — a cloud-provider
5241 gateway or a customer-registered federation issuer — acting without an
5242 Anthropic-provisioned account or service account.
5243
5244 - `type: optional "federated_actor"`
5245
5246 default: federated_actor
5247
5248 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
5249
5250 - `FederatedActorAwsProvider object`
5251
5252 Asserting party: the AWS account the organization is bound to.
5253
5254 - `type: optional "aws"`
5255
5256 default: aws
5257
5258 - `account_id: string`
5259
5260 - `signed_principal: string`
5261
5262 The AWS-signed ARN of the IAM principal that requested the token.
5263
5264 - `FederatedActorAzureProvider object`
5265
5266 Asserting party: the Azure subscription the organization is bound to.
5267
5268 - `type: optional "azure"`
5269
5270 default: azure
5271
5272 - `subscription_id: string`
5273
5274 - `FederatedActorGcpProvider object`
5275
5276 Asserting party: the GCP project the organization is bound to.
5277
5278 - `type: optional "gcp"`
5279
5280 default: gcp
5281
5282 - `project_number: string`
5283
5284 - `FederatedActorOidcProvider object`
5285
5286 Asserting party: a customer-registered OIDC federation issuer.
5287
5288 - `type: optional "oidc"`
5289
5290 default: oidc
5291
5292 - `issuer: optional string or null`
5293
5294 The federation issuer's URL. Null when the presented credential failed verification.
5295
5296 - `ip_address: optional string or null`
5297
5298 - `subject: optional string or null`
5299
5300 The provider's verified identifier for the caller; its form depends on the provider.
5301
5302 - `user_agent: optional string or null`
5303
5304 - `AttestedDeviceActor object`
5305
5306 An attested mobile device authenticated via Apple App Attest.
5307
5308 - `type: optional "attested_device_actor"`
5309
5310 default: attested_device_actor
5311
5312 - `external_client_id: string`
5313
5314 - `kid_hash: string`
5315
5316 - `ip_address: optional string or null`
5317
5318 - `user_agent: optional string or null`
5319
5320 - `id: optional string`
5321
5322 Unique identifier for the activity e.g. 'activity_abcd1234'
5323
5324 - `created_at: optional string`
5325
5326 When this activity occurred.
5327
5328 format: date-time
5329
5330 - `migrated_user_email: optional string or null`
5331
5332 Email address of the user whose personal account was migrated, when known.
5333
5334 - `migrated_user_id: optional string or null`
5335
5336 Tagged ID of the user whose personal account was migrated, e.g. "user_...", when known.
5337
5338 - `organization_id: optional string or null`
5339
5340 Organization ID this activity is associated with
5341
5342 - `organization_uuid: optional string or null`
5343
5344 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
5345
5346 - `AccountMigrationFailed object`
5347
5348 A personal Claude account's migration into the organization did not complete.
5349
5350 - `type: optional "account_migration_failed"`
5351
5352 default: account_migration_failed
5353
5354 - `account_migration_id: string`
5355
5356 Tagged ID of the migration, e.g. "amig_...", matching the account_migration_started activity that opened it, if one was recorded; a later retry is a new migration with its own ID.
5357
5358 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
5359
5360 - `APIActor object`
5361
5362 - `type: optional "api_actor"`
5363
5364 default: api_actor
5365
5366 - `api_key_id: string`
5367
5368 - `ip_address: string`
5369
5370 - `user_agent: string`
5371
5372 - `UserActor object`
5373
5374 - `type: optional "user_actor"`
5375
5376 default: user_actor
5377
5378 - `email_address: string`
5379
5380 format: email
5381
5382 - `ip_address: string`
5383
5384 - `user_agent: string`
5385
5386 - `user_id: string`
5387
5388 - `UnauthenticatedUserActor object`
5389
5390 - `type: optional "unauthenticated_user_actor"`
5391
5392 default: unauthenticated_user_actor
5393
5394 - `ip_address: string`
5395
5396 - `user_agent: string`
5397
5398 - `unauthenticated_email_address: optional string or null`
5399
5400 format: email
5401
5402 - `AnthropicActor object`
5403
5404 - `type: optional "anthropic_actor"`
5405
5406 default: anthropic_actor
5407
5408 - `email_address: optional string or null`
5409
5410 format: email
5411
5412 - `SystemActor object`
5413
5414 Automated background processing performed by Anthropic systems, acting
5415 without a user or customer credential.
5416
5417 - `type: optional "system_actor"`
5418
5419 default: system_actor
5420
5421 - `service: optional string or null`
5422
5423 Name of the automated process that performed the action, when known.
5424
5425 - `AdminAPIKeyActor object`
5426
5427 - `type: optional "admin_api_key_actor"`
5428
5429 default: admin_api_key_actor
5430
5431 - `admin_api_key_id: string`
5432
5433 - `ip_address: string`
5434
5435 - `user_agent: string`
5436
5437 - `ServiceAccountActor object`
5438
5439 - `type: optional "service_account_actor"`
5440
5441 default: service_account_actor
5442
5443 - `ip_address: string`
5444
5445 - `service_account_id: string`
5446
5447 - `user_agent: string`
5448
5449 - `ScimDirectorySyncActor object`
5450
5451 - `type: optional "scim_directory_sync_actor"`
5452
5453 default: scim_directory_sync_actor
5454
5455 - `directory_id: string`
5456
5457 - `workos_event_id: string`
5458
5459 - `idp_connection_type: optional string or null`
5460
5461 - `FederatedIdentityActor object`
5462
5463 A federated external workload authenticated via a verified OIDC token.
5464
5465 Carries the verified issuer, subject, and audience claims from the
5466 presented JWT.
5467
5468 - `type: optional "federated_identity_actor"`
5469
5470 default: federated_identity_actor
5471
5472 - `issuer: string`
5473
5474 - `subject: string`
5475
5476 - `audience: optional array of string`
5477
5478 - `ip_address: optional string or null`
5479
5480 - `user_agent: optional string or null`
5481
5482 - `FederatedActor object`
5483
5484 An external identity asserted by a trusted provider — a cloud-provider
5485 gateway or a customer-registered federation issuer — acting without an
5486 Anthropic-provisioned account or service account.
5487
5488 - `type: optional "federated_actor"`
5489
5490 default: federated_actor
5491
5492 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
5493
5494 - `FederatedActorAwsProvider object`
5495
5496 Asserting party: the AWS account the organization is bound to.
5497
5498 - `type: optional "aws"`
5499
5500 default: aws
5501
5502 - `account_id: string`
5503
5504 - `signed_principal: string`
5505
5506 The AWS-signed ARN of the IAM principal that requested the token.
5507
5508 - `FederatedActorAzureProvider object`
5509
5510 Asserting party: the Azure subscription the organization is bound to.
5511
5512 - `type: optional "azure"`
5513
5514 default: azure
5515
5516 - `subscription_id: string`
5517
5518 - `FederatedActorGcpProvider object`
5519
5520 Asserting party: the GCP project the organization is bound to.
5521
5522 - `type: optional "gcp"`
5523
5524 default: gcp
5525
5526 - `project_number: string`
5527
5528 - `FederatedActorOidcProvider object`
5529
5530 Asserting party: a customer-registered OIDC federation issuer.
5531
5532 - `type: optional "oidc"`
5533
5534 default: oidc
5535
5536 - `issuer: optional string or null`
5537
5538 The federation issuer's URL. Null when the presented credential failed verification.
5539
5540 - `ip_address: optional string or null`
5541
5542 - `subject: optional string or null`
5543
5544 The provider's verified identifier for the caller; its form depends on the provider.
5545
5546 - `user_agent: optional string or null`
5547
5548 - `AttestedDeviceActor object`
5549
5550 An attested mobile device authenticated via Apple App Attest.
5551
5552 - `type: optional "attested_device_actor"`
5553
5554 default: attested_device_actor
5555
5556 - `external_client_id: string`
5557
5558 - `kid_hash: string`
5559
5560 - `ip_address: optional string or null`
5561
5562 - `user_agent: optional string or null`
5563
5564 - `id: optional string`
5565
5566 Unique identifier for the activity e.g. 'activity_abcd1234'
5567
5568 - `created_at: optional string`
5569
5570 When this activity occurred.
5571
5572 format: date-time
5573
5574 - `failure_reasons: optional array of "already_member_of_target" or "already_migrating" or "anthropic_staff_action" or 12 more`
5575
5576 Why the migration did not complete, each reason listed once. In these values "source" is the member's personal account and "target" is this organization. "source_equals_target", "source_not_personal_org", "user_not_member_of_source" and "user_not_sole_member_of_source": the account is not a single-member personal account that can be migrated. "target_not_enterprise_org": this organization's plan does not accept the migration. "already_member_of_target": the migration already happened. "target_membership_not_provisioned" and "target_membership_unassigned_no_seats": the member has no usable seat in this organization. "already_migrating": another migration of the same account is in progress. "source_too_large": the personal account holds more data than a migration can move. "target_became_inactive": this organization became inactive before the migration finished. "migration_failed": an error stopped the migration. "anthropic_staff_action": Anthropic staff stopped the migration. "migration_blocked_redacted": stands in for every reason that is not shared with the organization. Values may be added over time; treat an unrecognized value as a generic failure. "unspecified" is never emitted.
5577
5578 - `"already_member_of_target"`
5579
5580 - `"already_migrating"`
5581
5582 - `"anthropic_staff_action"`
5583
5584 - `"migration_blocked_redacted"`
5585
5586 - `"migration_failed"`
5587
5588 - `"source_equals_target"`
5589
5590 - `"source_not_personal_org"`
5591
5592 - `"source_too_large"`
5593
5594 - `"target_became_inactive"`
5595
5596 - `"target_membership_not_provisioned"`
5597
5598 - `"target_membership_unassigned_no_seats"`
5599
5600 - `"target_not_enterprise_org"`
5601
5602 - `"unspecified"`
5603
5604 - `"user_not_member_of_source"`
5605
5606 - `"user_not_sole_member_of_source"`
5607
5608 - `migrated_user_email: optional string or null`
5609
5610 Email address of the user whose personal account was being migrated, when known.
5611
5612 - `migrated_user_id: optional string or null`
5613
5614 Tagged ID of the user whose personal account was being migrated, e.g. "user_...", when known.
5615
5616 - `organization_id: optional string or null`
5617
5618 Organization ID this activity is associated with
5619
5620 - `organization_uuid: optional string or null`
5621
5622 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
5623
5624 - `AccountMigrationStarted object`
5625
5626 A personal Claude account began migrating into the organization: its data, including conversations, projects and files, is being moved from the member's personal account into this organization.
5627
5628 - `type: optional "account_migration_started"`
5629
5630 default: account_migration_started
5631
5632 - `account_migration_id: string`
5633
5634 Tagged ID of the migration, e.g. "amig_...". The same ID appears on the completed or failed activity that closes the migration, when one is recorded.
5635
5636 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
5637
5638 - `APIActor object`
5639
5640 - `type: optional "api_actor"`
5641
5642 default: api_actor
5643
5644 - `api_key_id: string`
5645
5646 - `ip_address: string`
5647
5648 - `user_agent: string`
5649
5650 - `UserActor object`
5651
5652 - `type: optional "user_actor"`
5653
5654 default: user_actor
5655
5656 - `email_address: string`
5657
5658 format: email
5659
5660 - `ip_address: string`
5661
5662 - `user_agent: string`
5663
5664 - `user_id: string`
5665
5666 - `UnauthenticatedUserActor object`
5667
5668 - `type: optional "unauthenticated_user_actor"`
5669
5670 default: unauthenticated_user_actor
5671
5672 - `ip_address: string`
5673
5674 - `user_agent: string`
5675
5676 - `unauthenticated_email_address: optional string or null`
5677
5678 format: email
5679
5680 - `AnthropicActor object`
5681
5682 - `type: optional "anthropic_actor"`
5683
5684 default: anthropic_actor
5685
5686 - `email_address: optional string or null`
5687
5688 format: email
5689
5690 - `SystemActor object`
5691
5692 Automated background processing performed by Anthropic systems, acting
5693 without a user or customer credential.
5694
5695 - `type: optional "system_actor"`
5696
5697 default: system_actor
5698
5699 - `service: optional string or null`
5700
5701 Name of the automated process that performed the action, when known.
5702
5703 - `AdminAPIKeyActor object`
5704
5705 - `type: optional "admin_api_key_actor"`
5706
5707 default: admin_api_key_actor
5708
5709 - `admin_api_key_id: string`
5710
5711 - `ip_address: string`
5712
5713 - `user_agent: string`
5714
5715 - `ServiceAccountActor object`
5716
5717 - `type: optional "service_account_actor"`
5718
5719 default: service_account_actor
5720
5721 - `ip_address: string`
5722
5723 - `service_account_id: string`
5724
5725 - `user_agent: string`
5726
5727 - `ScimDirectorySyncActor object`
5728
5729 - `type: optional "scim_directory_sync_actor"`
5730
5731 default: scim_directory_sync_actor
5732
5733 - `directory_id: string`
5734
5735 - `workos_event_id: string`
5736
5737 - `idp_connection_type: optional string or null`
5738
5739 - `FederatedIdentityActor object`
5740
5741 A federated external workload authenticated via a verified OIDC token.
5742
5743 Carries the verified issuer, subject, and audience claims from the
5744 presented JWT.
5745
5746 - `type: optional "federated_identity_actor"`
5747
5748 default: federated_identity_actor
5749
5750 - `issuer: string`
5751
5752 - `subject: string`
5753
5754 - `audience: optional array of string`
5755
5756 - `ip_address: optional string or null`
5757
5758 - `user_agent: optional string or null`
5759
5760 - `FederatedActor object`
5761
5762 An external identity asserted by a trusted provider — a cloud-provider
5763 gateway or a customer-registered federation issuer — acting without an
5764 Anthropic-provisioned account or service account.
5765
5766 - `type: optional "federated_actor"`
5767
5768 default: federated_actor
5769
5770 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
5771
5772 - `FederatedActorAwsProvider object`
5773
5774 Asserting party: the AWS account the organization is bound to.
5775
5776 - `type: optional "aws"`
5777
5778 default: aws
5779
5780 - `account_id: string`
5781
5782 - `signed_principal: string`
5783
5784 The AWS-signed ARN of the IAM principal that requested the token.
5785
5786 - `FederatedActorAzureProvider object`
5787
5788 Asserting party: the Azure subscription the organization is bound to.
5789
5790 - `type: optional "azure"`
5791
5792 default: azure
5793
5794 - `subscription_id: string`
5795
5796 - `FederatedActorGcpProvider object`
5797
5798 Asserting party: the GCP project the organization is bound to.
5799
5800 - `type: optional "gcp"`
5801
5802 default: gcp
5803
5804 - `project_number: string`
5805
5806 - `FederatedActorOidcProvider object`
5807
5808 Asserting party: a customer-registered OIDC federation issuer.
5809
5810 - `type: optional "oidc"`
5811
5812 default: oidc
5813
5814 - `issuer: optional string or null`
5815
5816 The federation issuer's URL. Null when the presented credential failed verification.
5817
5818 - `ip_address: optional string or null`
5819
5820 - `subject: optional string or null`
5821
5822 The provider's verified identifier for the caller; its form depends on the provider.
5823
5824 - `user_agent: optional string or null`
5825
5826 - `AttestedDeviceActor object`
5827
5828 An attested mobile device authenticated via Apple App Attest.
5829
5830 - `type: optional "attested_device_actor"`
5831
5832 default: attested_device_actor
5833
5834 - `external_client_id: string`
5835
5836 - `kid_hash: string`
5837
5838 - `ip_address: optional string or null`
5839
5840 - `user_agent: optional string or null`
5841
5842 - `migrated_user_email: string`
5843
5844 Email address of the user whose personal account is being migrated.
5845
5846 - `migrated_user_id: string`
5847
5848 Tagged ID of the user whose personal account is being migrated, e.g. "user_...".
5849
5850 - `id: optional string`
5851
5852 Unique identifier for the activity e.g. 'activity_abcd1234'
5853
5854 - `created_at: optional string`
5855
5856 When this activity occurred.
5857
5858 format: date-time
5859
5860 - `organization_id: optional string or null`
5861
5862 Organization ID this activity is associated with
5863
5864 - `organization_uuid: optional string or null`
5865
5866 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
5867
49905868 - `AdminAPIKeyCreated object`
49915869
49925870 An admin API key was created.
from line 26353
2547526353
2547626354 Per-review spend limit in USD before the change. Absent when no configuration existed before this update or no limit was set.
2547726355
26356 - `previous_review_level: optional string or null`
26357
26358 Review level set for the organization's code reviews before the change: "low" (Quick), "medium" (Standard) or "high" (Deep). Absent when no configuration existed before this update or no level was set.
26359
2547826360 - `previous_show_tips: optional boolean or null`
2547926361
2548026362 Whether tip-style pull-request comments were enabled before the change. Absent when no configuration existed before this update.
from line 26365
2548326365
2548426366 Whether the verification stage of code review was enabled for the organization before the change. Absent when no configuration existed before this update or no preference was set.
2548526367
26368 - `review_level: optional string or null`
26369
26370 Review level now set for the organization's code reviews: "low" (Quick), "medium" (Standard) or "high" (Deep). Repositories without their own level use this one. Absent when no level is set; the default level, Standard, then applies.
26371
2548626372 - `show_tips: optional boolean or null`
2548726373
2548826374 Whether tip-style pull-request comments are now enabled
from line 26377
2549126377
2549226378 Whether the verification stage of code review is now enabled for the organization. Absent when the organization has not set a preference and the default applies.
2549326379
26380 - `ClaudeCodeReviewPromoEnrolled object`
26381
26382 An organization admin enrolled the organization in a Claude Code Review promotion, for example by claiming promotional credits.
26383
26384 - `type: optional "claude_code_review_promo_enrolled"`
26385
26386 default: claude_code_review_promo_enrolled
26387
26388 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
26389
26390 - `APIActor object`
26391
26392 - `type: optional "api_actor"`
26393
26394 default: api_actor
26395
26396 - `api_key_id: string`
26397
26398 - `ip_address: string`
26399
26400 - `user_agent: string`
26401
26402 - `UserActor object`
26403
26404 - `type: optional "user_actor"`
26405
26406 default: user_actor
26407
26408 - `email_address: string`
26409
26410 format: email
26411
26412 - `ip_address: string`
26413
26414 - `user_agent: string`
26415
26416 - `user_id: string`
26417
26418 - `UnauthenticatedUserActor object`
26419
26420 - `type: optional "unauthenticated_user_actor"`
26421
26422 default: unauthenticated_user_actor
26423
26424 - `ip_address: string`
26425
26426 - `user_agent: string`
26427
26428 - `unauthenticated_email_address: optional string or null`
26429
26430 format: email
26431
26432 - `AnthropicActor object`
26433
26434 - `type: optional "anthropic_actor"`
26435
26436 default: anthropic_actor
26437
26438 - `email_address: optional string or null`
26439
26440 format: email
26441
26442 - `SystemActor object`
26443
26444 Automated background processing performed by Anthropic systems, acting
26445 without a user or customer credential.
26446
26447 - `type: optional "system_actor"`
26448
26449 default: system_actor
26450
26451 - `service: optional string or null`
26452
26453 Name of the automated process that performed the action, when known.
26454
26455 - `AdminAPIKeyActor object`
26456
26457 - `type: optional "admin_api_key_actor"`
26458
26459 default: admin_api_key_actor
26460
26461 - `admin_api_key_id: string`
26462
26463 - `ip_address: string`
26464
26465 - `user_agent: string`
26466
26467 - `ServiceAccountActor object`
26468
26469 - `type: optional "service_account_actor"`
26470
26471 default: service_account_actor
26472
26473 - `ip_address: string`
26474
26475 - `service_account_id: string`
26476
26477 - `user_agent: string`
26478
26479 - `ScimDirectorySyncActor object`
26480
26481 - `type: optional "scim_directory_sync_actor"`
26482
26483 default: scim_directory_sync_actor
26484
26485 - `directory_id: string`
26486
26487 - `workos_event_id: string`
26488
26489 - `idp_connection_type: optional string or null`
26490
26491 - `FederatedIdentityActor object`
26492
26493 A federated external workload authenticated via a verified OIDC token.
26494
26495 Carries the verified issuer, subject, and audience claims from the
26496 presented JWT.
26497
26498 - `type: optional "federated_identity_actor"`
26499
26500 default: federated_identity_actor
26501
26502 - `issuer: string`
26503
26504 - `subject: string`
26505
26506 - `audience: optional array of string`
26507
26508 - `ip_address: optional string or null`
26509
26510 - `user_agent: optional string or null`
26511
26512 - `FederatedActor object`
26513
26514 An external identity asserted by a trusted provider — a cloud-provider
26515 gateway or a customer-registered federation issuer — acting without an
26516 Anthropic-provisioned account or service account.
26517
26518 - `type: optional "federated_actor"`
26519
26520 default: federated_actor
26521
26522 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
26523
26524 - `FederatedActorAwsProvider object`
26525
26526 Asserting party: the AWS account the organization is bound to.
26527
26528 - `type: optional "aws"`
26529
26530 default: aws
26531
26532 - `account_id: string`
26533
26534 - `signed_principal: string`
26535
26536 The AWS-signed ARN of the IAM principal that requested the token.
26537
26538 - `FederatedActorAzureProvider object`
26539
26540 Asserting party: the Azure subscription the organization is bound to.
26541
26542 - `type: optional "azure"`
26543
26544 default: azure
26545
26546 - `subscription_id: string`
26547
26548 - `FederatedActorGcpProvider object`
26549
26550 Asserting party: the GCP project the organization is bound to.
26551
26552 - `type: optional "gcp"`
26553
26554 default: gcp
26555
26556 - `project_number: string`
26557
26558 - `FederatedActorOidcProvider object`
26559
26560 Asserting party: a customer-registered OIDC federation issuer.
26561
26562 - `type: optional "oidc"`
26563
26564 default: oidc
26565
26566 - `issuer: optional string or null`
26567
26568 The federation issuer's URL. Null when the presented credential failed verification.
26569
26570 - `ip_address: optional string or null`
26571
26572 - `subject: optional string or null`
26573
26574 The provider's verified identifier for the caller; its form depends on the provider.
26575
26576 - `user_agent: optional string or null`
26577
26578 - `AttestedDeviceActor object`
26579
26580 An attested mobile device authenticated via Apple App Attest.
26581
26582 - `type: optional "attested_device_actor"`
26583
26584 default: attested_device_actor
26585
26586 - `external_client_id: string`
26587
26588 - `kid_hash: string`
26589
26590 - `ip_address: optional string or null`
26591
26592 - `user_agent: optional string or null`
26593
26594 - `promo_id: string`
26595
26596 Identifier of the promotion the organization enrolled in.
26597
26598 - `id: optional string`
26599
26600 Unique identifier for the activity e.g. 'activity_abcd1234'
26601
26602 - `created_at: optional string`
26603
26604 When this activity occurred.
26605
26606 format: date-time
26607
26608 - `expires_at: optional string or null`
26609
26610 When the organization's promotional access or credits expire.
26611
26612 format: date-time
26613
26614 - `organization_id: optional string or null`
26615
26616 Organization ID this activity is associated with
26617
26618 - `organization_uuid: optional string or null`
26619
26620 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
26621
2549426622 - `ClaudeCodeReviewRepositoryAdded object`
2549526623
2549626624 A repository was added to org-level Claude Code Review configuration.
from line 27355
2622727355
2622827356 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
2622927357
27358 - `previous_review_level: optional string or null`
27359
27360 Review level set for this repository's code reviews before the change: "low" (Quick), "medium" (Standard) or "high" (Deep). Absent when no level was set.
27361
27362 - `review_level: optional string or null`
27363
27364 Review level now set for this repository's code reviews: "low" (Quick), "medium" (Standard) or "high" (Deep). Absent when no level is set; the repository then uses the organization-wide level (review_level on claude_code_review_config_updated), or Standard if none is set.
27365
2623027366 - `status: optional string or null`
2623127367
2623227368 Updated status (ACTIVE/INACTIVE)
from line 29831
2869529831
2869629832 - `ClaudeCodeSecurityScanProjectUpdated object`
2869729833
28698 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience.
29834 A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience, or a user paused the project's scheduled scanning, unpaused it, or lifted a billing pause on it.
2869929835
2870029836 - `type: optional "claude_code_security_scan_project_updated"`
2870129837
2870229838 default: claude_code_security_scan_project_updated
2870329839
28704 - `action: "archived" or "created" or "migrated" or 3 more`
29840 - `action: "archived" or "billing_pause_lifted" or "created" or 6 more`
2870529841
2870629842 The state change applied to the scan project.
2870729843
2870829844 - `"archived"`
2870929845
29846 - `"billing_pause_lifted"`
29847
2871029848 - `"created"`
2871129849
2871229850 - `"migrated"`
2871329851
29852 - `"paused"`
29853
2871429854 - `"resumed"`
2871529855
2871629856 - `"unarchived"`
2871729857
29858 - `"unpaused"`
29859
2871829860 - `"unspecified"`
2871929861
2872029862 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
from line 40115
3897340115
3897440116 A short provider-specific identifier for the external resource after the update, e.g. `owner/repo` for GitHub or a file ID for Google Drive.
3897540117
40118 - `ClaudeSkillAutoDisabled object`
40119
40120 A skill that had been turned on for a member automatically was turned off for them automatically, not by the member; reason says why. A member turning a skill off themselves is recorded as claude_skill_disabled.
40121
40122 - `type: optional "claude_skill_auto_disabled"`
40123
40124 default: claude_skill_auto_disabled
40125
40126 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
40127
40128 - `APIActor object`
40129
40130 - `type: optional "api_actor"`
40131
40132 default: api_actor
40133
40134 - `api_key_id: string`
40135
40136 - `ip_address: string`
40137
40138 - `user_agent: string`
40139
40140 - `UserActor object`
40141
40142 - `type: optional "user_actor"`
40143
40144 default: user_actor
40145
40146 - `email_address: string`
40147
40148 format: email
40149
40150 - `ip_address: string`
40151
40152 - `user_agent: string`
40153
40154 - `user_id: string`
40155
40156 - `UnauthenticatedUserActor object`
40157
40158 - `type: optional "unauthenticated_user_actor"`
40159
40160 default: unauthenticated_user_actor
40161
40162 - `ip_address: string`
40163
40164 - `user_agent: string`
40165
40166 - `unauthenticated_email_address: optional string or null`
40167
40168 format: email
40169
40170 - `AnthropicActor object`
40171
40172 - `type: optional "anthropic_actor"`
40173
40174 default: anthropic_actor
40175
40176 - `email_address: optional string or null`
40177
40178 format: email
40179
40180 - `SystemActor object`
40181
40182 Automated background processing performed by Anthropic systems, acting
40183 without a user or customer credential.
40184
40185 - `type: optional "system_actor"`
40186
40187 default: system_actor
40188
40189 - `service: optional string or null`
40190
40191 Name of the automated process that performed the action, when known.
40192
40193 - `AdminAPIKeyActor object`
40194
40195 - `type: optional "admin_api_key_actor"`
40196
40197 default: admin_api_key_actor
40198
40199 - `admin_api_key_id: string`
40200
40201 - `ip_address: string`
40202
40203 - `user_agent: string`
40204
40205 - `ServiceAccountActor object`
40206
40207 - `type: optional "service_account_actor"`
40208
40209 default: service_account_actor
40210
40211 - `ip_address: string`
40212
40213 - `service_account_id: string`
40214
40215 - `user_agent: string`
40216
40217 - `ScimDirectorySyncActor object`
40218
40219 - `type: optional "scim_directory_sync_actor"`
40220
40221 default: scim_directory_sync_actor
40222
40223 - `directory_id: string`
40224
40225 - `workos_event_id: string`
40226
40227 - `idp_connection_type: optional string or null`
40228
40229 - `FederatedIdentityActor object`
40230
40231 A federated external workload authenticated via a verified OIDC token.
40232
40233 Carries the verified issuer, subject, and audience claims from the
40234 presented JWT.
40235
40236 - `type: optional "federated_identity_actor"`
40237
40238 default: federated_identity_actor
40239
40240 - `issuer: string`
40241
40242 - `subject: string`
40243
40244 - `audience: optional array of string`
40245
40246 - `ip_address: optional string or null`
40247
40248 - `user_agent: optional string or null`
40249
40250 - `FederatedActor object`
40251
40252 An external identity asserted by a trusted provider — a cloud-provider
40253 gateway or a customer-registered federation issuer — acting without an
40254 Anthropic-provisioned account or service account.
40255
40256 - `type: optional "federated_actor"`
40257
40258 default: federated_actor
40259
40260 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
40261
40262 - `FederatedActorAwsProvider object`
40263
40264 Asserting party: the AWS account the organization is bound to.
40265
40266 - `type: optional "aws"`
40267
40268 default: aws
40269
40270 - `account_id: string`
40271
40272 - `signed_principal: string`
40273
40274 The AWS-signed ARN of the IAM principal that requested the token.
40275
40276 - `FederatedActorAzureProvider object`
40277
40278 Asserting party: the Azure subscription the organization is bound to.
40279
40280 - `type: optional "azure"`
40281
40282 default: azure
40283
40284 - `subscription_id: string`
40285
40286 - `FederatedActorGcpProvider object`
40287
40288 Asserting party: the GCP project the organization is bound to.
40289
40290 - `type: optional "gcp"`
40291
40292 default: gcp
40293
40294 - `project_number: string`
40295
40296 - `FederatedActorOidcProvider object`
40297
40298 Asserting party: a customer-registered OIDC federation issuer.
40299
40300 - `type: optional "oidc"`
40301
40302 default: oidc
40303
40304 - `issuer: optional string or null`
40305
40306 The federation issuer's URL. Null when the presented credential failed verification.
40307
40308 - `ip_address: optional string or null`
40309
40310 - `subject: optional string or null`
40311
40312 The provider's verified identifier for the caller; its form depends on the provider.
40313
40314 - `user_agent: optional string or null`
40315
40316 - `AttestedDeviceActor object`
40317
40318 An attested mobile device authenticated via Apple App Attest.
40319
40320 - `type: optional "attested_device_actor"`
40321
40322 default: attested_device_actor
40323
40324 - `external_client_id: string`
40325
40326 - `kid_hash: string`
40327
40328 - `ip_address: optional string or null`
40329
40330 - `user_agent: optional string or null`
40331
40332 - `reason: "auto_enable_reverted" or "content_changed" or "unspecified"`
40333
40334 Why the skill was turned off automatically: "content_changed" (a change to the skill was saved or attempted, or the skill was scanned again, and it could not be confirmed as still eligible to be on automatically) or "auto_enable_reverted" (Anthropic turned off skills that had been turned on automatically; not in response to a change to this skill).
40335
40336 - `"auto_enable_reverted"`
40337
40338 - `"content_changed"`
40339
40340 - `"unspecified"`
40341
40342 - `user_id: string`
40343
40344 The member the skill was turned off for.
40345
40346 - `id: optional string`
40347
40348 Unique identifier for the activity e.g. 'activity_abcd1234'
40349
40350 - `created_at: optional string`
40351
40352 When this activity occurred.
40353
40354 format: date-time
40355
40356 - `organization_id: optional string or null`
40357
40358 Organization ID this activity is associated with
40359
40360 - `organization_uuid: optional string or null`
40361
40362 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
40363
40364 - `shared_by_user_id: optional string or null`
40365
40366 For a skill that had been turned on because it was shared: the member who shared it.
40367
40368 - `skill_id: optional string or null`
40369
40370 The skill that was turned off.
40371
40372 - `skill_name: optional string or null`
40373
40374 The name of the skill that was turned off.
40375
40376 - `skill_version: optional string or null`
40377
40378 The version of the skill the member had just before it was turned off. Absent when not known.
40379
40380 - `ClaudeSkillAutoEnabled object`
40381
40382 A skill was turned on for a member automatically, not by the member; trigger gives the cause, such as another member sharing an eligible skill with them. A member turning a skill on themselves is recorded as claude_skill_enabled.
40383
40384 - `type: optional "claude_skill_auto_enabled"`
40385
40386 default: claude_skill_auto_enabled
40387
40388 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
40389
40390 - `APIActor object`
40391
40392 - `type: optional "api_actor"`
40393
40394 default: api_actor
40395
40396 - `api_key_id: string`
40397
40398 - `ip_address: string`
40399
40400 - `user_agent: string`
40401
40402 - `UserActor object`
40403
40404 - `type: optional "user_actor"`
40405
40406 default: user_actor
40407
40408 - `email_address: string`
40409
40410 format: email
40411
40412 - `ip_address: string`
40413
40414 - `user_agent: string`
40415
40416 - `user_id: string`
40417
40418 - `UnauthenticatedUserActor object`
40419
40420 - `type: optional "unauthenticated_user_actor"`
40421
40422 default: unauthenticated_user_actor
40423
40424 - `ip_address: string`
40425
40426 - `user_agent: string`
40427
40428 - `unauthenticated_email_address: optional string or null`
40429
40430 format: email
40431
40432 - `AnthropicActor object`
40433
40434 - `type: optional "anthropic_actor"`
40435
40436 default: anthropic_actor
40437
40438 - `email_address: optional string or null`
40439
40440 format: email
40441
40442 - `SystemActor object`
40443
40444 Automated background processing performed by Anthropic systems, acting
40445 without a user or customer credential.
40446
40447 - `type: optional "system_actor"`
40448
40449 default: system_actor
40450
40451 - `service: optional string or null`
40452
40453 Name of the automated process that performed the action, when known.
40454
40455 - `AdminAPIKeyActor object`
40456
40457 - `type: optional "admin_api_key_actor"`
40458
40459 default: admin_api_key_actor
40460
40461 - `admin_api_key_id: string`
40462
40463 - `ip_address: string`
40464
40465 - `user_agent: string`
40466
40467 - `ServiceAccountActor object`
40468
40469 - `type: optional "service_account_actor"`
40470
40471 default: service_account_actor
40472
40473 - `ip_address: string`
40474
40475 - `service_account_id: string`
40476
40477 - `user_agent: string`
40478
40479 - `ScimDirectorySyncActor object`
40480
40481 - `type: optional "scim_directory_sync_actor"`
40482
40483 default: scim_directory_sync_actor
40484
40485 - `directory_id: string`
40486
40487 - `workos_event_id: string`
40488
40489 - `idp_connection_type: optional string or null`
40490
40491 - `FederatedIdentityActor object`
40492
40493 A federated external workload authenticated via a verified OIDC token.
40494
40495 Carries the verified issuer, subject, and audience claims from the
40496 presented JWT.
40497
40498 - `type: optional "federated_identity_actor"`
40499
40500 default: federated_identity_actor
40501
40502 - `issuer: string`
40503
40504 - `subject: string`
40505
40506 - `audience: optional array of string`
40507
40508 - `ip_address: optional string or null`
40509
40510 - `user_agent: optional string or null`
40511
40512 - `FederatedActor object`
40513
40514 An external identity asserted by a trusted provider — a cloud-provider
40515 gateway or a customer-registered federation issuer — acting without an
40516 Anthropic-provisioned account or service account.
40517
40518 - `type: optional "federated_actor"`
40519
40520 default: federated_actor
40521
40522 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
40523
40524 - `FederatedActorAwsProvider object`
40525
40526 Asserting party: the AWS account the organization is bound to.
40527
40528 - `type: optional "aws"`
40529
40530 default: aws
40531
40532 - `account_id: string`
40533
40534 - `signed_principal: string`
40535
40536 The AWS-signed ARN of the IAM principal that requested the token.
40537
40538 - `FederatedActorAzureProvider object`
40539
40540 Asserting party: the Azure subscription the organization is bound to.
40541
40542 - `type: optional "azure"`
40543
40544 default: azure
40545
40546 - `subscription_id: string`
40547
40548 - `FederatedActorGcpProvider object`
40549
40550 Asserting party: the GCP project the organization is bound to.
40551
40552 - `type: optional "gcp"`
40553
40554 default: gcp
40555
40556 - `project_number: string`
40557
40558 - `FederatedActorOidcProvider object`
40559
40560 Asserting party: a customer-registered OIDC federation issuer.
40561
40562 - `type: optional "oidc"`
40563
40564 default: oidc
40565
40566 - `issuer: optional string or null`
40567
40568 The federation issuer's URL. Null when the presented credential failed verification.
40569
40570 - `ip_address: optional string or null`
40571
40572 - `subject: optional string or null`
40573
40574 The provider's verified identifier for the caller; its form depends on the provider.
40575
40576 - `user_agent: optional string or null`
40577
40578 - `AttestedDeviceActor object`
40579
40580 An attested mobile device authenticated via Apple App Attest.
40581
40582 - `type: optional "attested_device_actor"`
40583
40584 default: attested_device_actor
40585
40586 - `external_client_id: string`
40587
40588 - `kid_hash: string`
40589
40590 - `ip_address: optional string or null`
40591
40592 - `user_agent: optional string or null`
40593
40594 - `trigger: "share" or "unspecified"`
40595
40596 What caused the skill to be turned on automatically: "share" (another member shared it with the member, directly or through a group).
40597
40598 - `"share"`
40599
40600 - `"unspecified"`
40601
40602 - `user_id: string`
40603
40604 The member the skill was turned on for.
40605
40606 - `id: optional string`
40607
40608 Unique identifier for the activity e.g. 'activity_abcd1234'
40609
40610 - `created_at: optional string`
40611
40612 When this activity occurred.
40613
40614 format: date-time
40615
40616 - `organization_id: optional string or null`
40617
40618 Organization ID this activity is associated with
40619
40620 - `organization_uuid: optional string or null`
40621
40622 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
40623
40624 - `shared_at: optional string or null`
40625
40626 For a skill turned on because it was shared: when it was shared with the member or with their group.
40627
40628 format: date-time
40629
40630 - `shared_by_user_id: optional string or null`
40631
40632 For a skill turned on because it was shared: the member who shared it.
40633
40634 - `shared_via: optional "direct" or "group" or "unspecified" or null`
40635
40636 For a skill turned on because it was shared: "direct" if shared with the member themselves, "group" if shared with a group they belong to.
40637
40638 - `"direct"`
40639
40640 - `"group"`
40641
40642 - `"unspecified"`
40643
40644 - `skill_id: optional string or null`
40645
40646 The skill that was turned on.
40647
40648 - `skill_name: optional string or null`
40649
40650 The name of the skill that was turned on.
40651
40652 - `skill_version: optional string or null`
40653
40654 The version of the skill that was turned on.
40655
3897640656 - `ClaudeSkillDownloaded object`
3897740657
3897840658 A member explicitly downloaded a skill's files to their device: the Download action in Claude, a single file saved from the skill viewer, or an install they asked one of their Claude apps for. Background syncs to the Claude apps, viewing a skill in the app and services reading a skill on the member's behalf are not recorded.
from line 49265
4758549265
4758649266 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
4758749267
49268 - `DomainClaimCancelled object`
49269
49270 A pending domain claim was cancelled before it took effect, so the personal accounts on the claimed domains will no longer be migrated or deactivated at its deadline.
49271
49272 - `type: optional "domain_claim_cancelled"`
49273
49274 default: domain_claim_cancelled
49275
49276 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
49277
49278 - `APIActor object`
49279
49280 - `type: optional "api_actor"`
49281
49282 default: api_actor
49283
49284 - `api_key_id: string`
49285
49286 - `ip_address: string`
49287
49288 - `user_agent: string`
49289
49290 - `UserActor object`
49291
49292 - `type: optional "user_actor"`
49293
49294 default: user_actor
49295
49296 - `email_address: string`
49297
49298 format: email
49299
49300 - `ip_address: string`
49301
49302 - `user_agent: string`
49303
49304 - `user_id: string`
49305
49306 - `UnauthenticatedUserActor object`
49307
49308 - `type: optional "unauthenticated_user_actor"`
49309
49310 default: unauthenticated_user_actor
49311
49312 - `ip_address: string`
49313
49314 - `user_agent: string`
49315
49316 - `unauthenticated_email_address: optional string or null`
49317
49318 format: email
49319
49320 - `AnthropicActor object`
49321
49322 - `type: optional "anthropic_actor"`
49323
49324 default: anthropic_actor
49325
49326 - `email_address: optional string or null`
49327
49328 format: email
49329
49330 - `SystemActor object`
49331
49332 Automated background processing performed by Anthropic systems, acting
49333 without a user or customer credential.
49334
49335 - `type: optional "system_actor"`
49336
49337 default: system_actor
49338
49339 - `service: optional string or null`
49340
49341 Name of the automated process that performed the action, when known.
49342
49343 - `AdminAPIKeyActor object`
49344
49345 - `type: optional "admin_api_key_actor"`
49346
49347 default: admin_api_key_actor
49348
49349 - `admin_api_key_id: string`
49350
49351 - `ip_address: string`
49352
49353 - `user_agent: string`
49354
49355 - `ServiceAccountActor object`
49356
49357 - `type: optional "service_account_actor"`
49358
49359 default: service_account_actor
49360
49361 - `ip_address: string`
49362
49363 - `service_account_id: string`
49364
49365 - `user_agent: string`
49366
49367 - `ScimDirectorySyncActor object`
49368
49369 - `type: optional "scim_directory_sync_actor"`
49370
49371 default: scim_directory_sync_actor
49372
49373 - `directory_id: string`
49374
49375 - `workos_event_id: string`
49376
49377 - `idp_connection_type: optional string or null`
49378
49379 - `FederatedIdentityActor object`
49380
49381 A federated external workload authenticated via a verified OIDC token.
49382
49383 Carries the verified issuer, subject, and audience claims from the
49384 presented JWT.
49385
49386 - `type: optional "federated_identity_actor"`
49387
49388 default: federated_identity_actor
49389
49390 - `issuer: string`
49391
49392 - `subject: string`
49393
49394 - `audience: optional array of string`
49395
49396 - `ip_address: optional string or null`
49397
49398 - `user_agent: optional string or null`
49399
49400 - `FederatedActor object`
49401
49402 An external identity asserted by a trusted provider — a cloud-provider
49403 gateway or a customer-registered federation issuer — acting without an
49404 Anthropic-provisioned account or service account.
49405
49406 - `type: optional "federated_actor"`
49407
49408 default: federated_actor
49409
49410 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
49411
49412 - `FederatedActorAwsProvider object`
49413
49414 Asserting party: the AWS account the organization is bound to.
49415
49416 - `type: optional "aws"`
49417
49418 default: aws
49419
49420 - `account_id: string`
49421
49422 - `signed_principal: string`
49423
49424 The AWS-signed ARN of the IAM principal that requested the token.
49425
49426 - `FederatedActorAzureProvider object`
49427
49428 Asserting party: the Azure subscription the organization is bound to.
49429
49430 - `type: optional "azure"`
49431
49432 default: azure
49433
49434 - `subscription_id: string`
49435
49436 - `FederatedActorGcpProvider object`
49437
49438 Asserting party: the GCP project the organization is bound to.
49439
49440 - `type: optional "gcp"`
49441
49442 default: gcp
49443
49444 - `project_number: string`
49445
49446 - `FederatedActorOidcProvider object`
49447
49448 Asserting party: a customer-registered OIDC federation issuer.
49449
49450 - `type: optional "oidc"`
49451
49452 default: oidc
49453
49454 - `issuer: optional string or null`
49455
49456 The federation issuer's URL. Null when the presented credential failed verification.
49457
49458 - `ip_address: optional string or null`
49459
49460 - `subject: optional string or null`
49461
49462 The provider's verified identifier for the caller; its form depends on the provider.
49463
49464 - `user_agent: optional string or null`
49465
49466 - `AttestedDeviceActor object`
49467
49468 An attested mobile device authenticated via Apple App Attest.
49469
49470 - `type: optional "attested_device_actor"`
49471
49472 default: attested_device_actor
49473
49474 - `external_client_id: string`
49475
49476 - `kid_hash: string`
49477
49478 - `ip_address: optional string or null`
49479
49480 - `user_agent: optional string or null`
49481
49482 - `domain_claim_id: string`
49483
49484 The domain claim that was cancelled, e.g. "dclm_01Ab...".
49485
49486 - `id: optional string`
49487
49488 Unique identifier for the activity e.g. 'activity_abcd1234'
49489
49490 - `created_at: optional string`
49491
49492 When this activity occurred.
49493
49494 format: date-time
49495
49496 - `organization_id: optional string or null`
49497
49498 Organization ID this activity is associated with
49499
49500 - `organization_uuid: optional string or null`
49501
49502 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
49503
49504 - `DomainClaimDeadlineUpdated object`
49505
49506 The migration deadline of a pending domain claim was moved to a later or an earlier date by Anthropic staff or an automated process.
49507
49508 - `type: optional "domain_claim_deadline_updated"`
49509
49510 default: domain_claim_deadline_updated
49511
49512 - `action: "extended" or "shortened" or "unspecified"`
49513
49514 Whether the deadline was extended (moved later) or shortened (moved earlier).
49515
49516 - `"extended"`
49517
49518 - `"shortened"`
49519
49520 - `"unspecified"`
49521
49522 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
49523
49524 - `APIActor object`
49525
49526 - `type: optional "api_actor"`
49527
49528 default: api_actor
49529
49530 - `api_key_id: string`
49531
49532 - `ip_address: string`
49533
49534 - `user_agent: string`
49535
49536 - `UserActor object`
49537
49538 - `type: optional "user_actor"`
49539
49540 default: user_actor
49541
49542 - `email_address: string`
49543
49544 format: email
49545
49546 - `ip_address: string`
49547
49548 - `user_agent: string`
49549
49550 - `user_id: string`
49551
49552 - `UnauthenticatedUserActor object`
49553
49554 - `type: optional "unauthenticated_user_actor"`
49555
49556 default: unauthenticated_user_actor
49557
49558 - `ip_address: string`
49559
49560 - `user_agent: string`
49561
49562 - `unauthenticated_email_address: optional string or null`
49563
49564 format: email
49565
49566 - `AnthropicActor object`
49567
49568 - `type: optional "anthropic_actor"`
49569
49570 default: anthropic_actor
49571
49572 - `email_address: optional string or null`
49573
49574 format: email
49575
49576 - `SystemActor object`
49577
49578 Automated background processing performed by Anthropic systems, acting
49579 without a user or customer credential.
49580
49581 - `type: optional "system_actor"`
49582
49583 default: system_actor
49584
49585 - `service: optional string or null`
49586
49587 Name of the automated process that performed the action, when known.
49588
49589 - `AdminAPIKeyActor object`
49590
49591 - `type: optional "admin_api_key_actor"`
49592
49593 default: admin_api_key_actor
49594
49595 - `admin_api_key_id: string`
49596
49597 - `ip_address: string`
49598
49599 - `user_agent: string`
49600
49601 - `ServiceAccountActor object`
49602
49603 - `type: optional "service_account_actor"`
49604
49605 default: service_account_actor
49606
49607 - `ip_address: string`
49608
49609 - `service_account_id: string`
49610
49611 - `user_agent: string`
49612
49613 - `ScimDirectorySyncActor object`
49614
49615 - `type: optional "scim_directory_sync_actor"`
49616
49617 default: scim_directory_sync_actor
49618
49619 - `directory_id: string`
49620
49621 - `workos_event_id: string`
49622
49623 - `idp_connection_type: optional string or null`
49624
49625 - `FederatedIdentityActor object`
49626
49627 A federated external workload authenticated via a verified OIDC token.
49628
49629 Carries the verified issuer, subject, and audience claims from the
49630 presented JWT.
49631
49632 - `type: optional "federated_identity_actor"`
49633
49634 default: federated_identity_actor
49635
49636 - `issuer: string`
49637
49638 - `subject: string`
49639
49640 - `audience: optional array of string`
49641
49642 - `ip_address: optional string or null`
49643
49644 - `user_agent: optional string or null`
49645
49646 - `FederatedActor object`
49647
49648 An external identity asserted by a trusted provider — a cloud-provider
49649 gateway or a customer-registered federation issuer — acting without an
49650 Anthropic-provisioned account or service account.
49651
49652 - `type: optional "federated_actor"`
49653
49654 default: federated_actor
49655
49656 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
49657
49658 - `FederatedActorAwsProvider object`
49659
49660 Asserting party: the AWS account the organization is bound to.
49661
49662 - `type: optional "aws"`
49663
49664 default: aws
49665
49666 - `account_id: string`
49667
49668 - `signed_principal: string`
49669
49670 The AWS-signed ARN of the IAM principal that requested the token.
49671
49672 - `FederatedActorAzureProvider object`
49673
49674 Asserting party: the Azure subscription the organization is bound to.
49675
49676 - `type: optional "azure"`
49677
49678 default: azure
49679
49680 - `subscription_id: string`
49681
49682 - `FederatedActorGcpProvider object`
49683
49684 Asserting party: the GCP project the organization is bound to.
49685
49686 - `type: optional "gcp"`
49687
49688 default: gcp
49689
49690 - `project_number: string`
49691
49692 - `FederatedActorOidcProvider object`
49693
49694 Asserting party: a customer-registered OIDC federation issuer.
49695
49696 - `type: optional "oidc"`
49697
49698 default: oidc
49699
49700 - `issuer: optional string or null`
49701
49702 The federation issuer's URL. Null when the presented credential failed verification.
49703
49704 - `ip_address: optional string or null`
49705
49706 - `subject: optional string or null`
49707
49708 The provider's verified identifier for the caller; its form depends on the provider.
49709
49710 - `user_agent: optional string or null`
49711
49712 - `AttestedDeviceActor object`
49713
49714 An attested mobile device authenticated via Apple App Attest.
49715
49716 - `type: optional "attested_device_actor"`
49717
49718 default: attested_device_actor
49719
49720 - `external_client_id: string`
49721
49722 - `kid_hash: string`
49723
49724 - `ip_address: optional string or null`
49725
49726 - `user_agent: optional string or null`
49727
49728 - `domain_claim_id: string`
49729
49730 The domain claim whose deadline was moved, e.g. "dclm_01Ab...".
49731
49732 - `id: optional string`
49733
49734 Unique identifier for the activity e.g. 'activity_abcd1234'
49735
49736 - `created_at: optional string`
49737
49738 When this activity occurred.
49739
49740 format: date-time
49741
49742 - `deadline_at: optional string or null`
49743
49744 The deadline after the change.
49745
49746 format: date-time
49747
49748 - `organization_id: optional string or null`
49749
49750 Organization ID this activity is associated with
49751
49752 - `organization_uuid: optional string or null`
49753
49754 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
49755
49756 - `previous_deadline_at: optional string or null`
49757
49758 The deadline before the change.
49759
49760 format: date-time
49761
4758849762 - `DomainClaimInitiated object`
4758949763
4759049764 Domain capture claim initiated over personal accounts on verified domains.
from line 55437
5326355437
5326455438 - `token_fingerprint_sha256: optional string or null`
5326555439
53266 Org-scoped SHA-256 of the submitted token: `sha256(org_uuid || 0x00 || token)`, lowercase-hex-encoded, where `org_uuid` is the organization's UUID as a dashed lowercase string, `0x00` is a single zero byte, and `token` is the submitted value's raw bytes. Per-org correlation only — the same token in two orgs produces distinct fingerprints. Set only when the submitted value carries a known GitHub PAT prefix (a high-entropy token format); unset for all other submissions, including rejected non-PAT input.
55440 Not populated.
5326755441
5326855442 - `GitlabConfigurationCreated object`
5326955443
from line 93271
9109793271
9109893272 - `user_agent: optional string or null`
9109993273
91100 - `updates: array of Name or Capabilities or RedactContent or 104 more`
93274 - `updates: array of Name or Capabilities or RedactContent or 105 more`
9110193275
9110293276 - `Name object`
9110393277
from line 95190
9301695190
9301795191 Setting value immediately before this change. Null means the setting was not set, so its default applied.
9301895192
95193 - `ConnectorRequestsOptedIn object`
95194
95195 The organization's opt-in to connector requests, which lets members ask the organization's owners to add a connector, was changed. The "Let members request connectors" switch sets it the first time it is turned on; turning that switch off, or on again, is recorded as a `disabled_admin_request_types` change (`enable_connector` joins or leaves the list).
95196
95197 - `type: optional "connector_requests_opted_in"`
95198
95199 default: connector_requests_opted_in
95200
95201 - `current_value: optional boolean or null`
95202
95203 Setting value immediately after this change
95204
95205 - `previous_value: optional boolean or null`
95206
95207 Setting value immediately before this change. Null means the organization had never opted in or out.
95208
9301995209 - `id: optional string`
9302095210
9302195211 Unique identifier for the activity e.g. 'activity_abcd1234'
from line 114296
112106114296
112107114297 UUID of the spend limit.
112108114298
114299 - `PlatformTelemetryDestinationAutoDisabled object`
114300
114301 A telemetry destination was disabled automatically after deliveries to it failed, so no telemetry is sent to it until an administrator enables it again.
114302
114303 - `type: optional "platform_telemetry_destination_auto_disabled"`
114304
114305 default: platform_telemetry_destination_auto_disabled
114306
114307 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
114308
114309 - `APIActor object`
114310
114311 - `type: optional "api_actor"`
114312
114313 default: api_actor
114314
114315 - `api_key_id: string`
114316
114317 - `ip_address: string`
114318
114319 - `user_agent: string`
114320
114321 - `UserActor object`
114322
114323 - `type: optional "user_actor"`
114324
114325 default: user_actor
114326
114327 - `email_address: string`
114328
114329 format: email
114330
114331 - `ip_address: string`
114332
114333 - `user_agent: string`
114334
114335 - `user_id: string`
114336
114337 - `UnauthenticatedUserActor object`
114338
114339 - `type: optional "unauthenticated_user_actor"`
114340
114341 default: unauthenticated_user_actor
114342
114343 - `ip_address: string`
114344
114345 - `user_agent: string`
114346
114347 - `unauthenticated_email_address: optional string or null`
114348
114349 format: email
114350
114351 - `AnthropicActor object`
114352
114353 - `type: optional "anthropic_actor"`
114354
114355 default: anthropic_actor
114356
114357 - `email_address: optional string or null`
114358
114359 format: email
114360
114361 - `SystemActor object`
114362
114363 Automated background processing performed by Anthropic systems, acting
114364 without a user or customer credential.
114365
114366 - `type: optional "system_actor"`
114367
114368 default: system_actor
114369
114370 - `service: optional string or null`
114371
114372 Name of the automated process that performed the action, when known.
114373
114374 - `AdminAPIKeyActor object`
114375
114376 - `type: optional "admin_api_key_actor"`
114377
114378 default: admin_api_key_actor
114379
114380 - `admin_api_key_id: string`
114381
114382 - `ip_address: string`
114383
114384 - `user_agent: string`
114385
114386 - `ServiceAccountActor object`
114387
114388 - `type: optional "service_account_actor"`
114389
114390 default: service_account_actor
114391
114392 - `ip_address: string`
114393
114394 - `service_account_id: string`
114395
114396 - `user_agent: string`
114397
114398 - `ScimDirectorySyncActor object`
114399
114400 - `type: optional "scim_directory_sync_actor"`
114401
114402 default: scim_directory_sync_actor
114403
114404 - `directory_id: string`
114405
114406 - `workos_event_id: string`
114407
114408 - `idp_connection_type: optional string or null`
114409
114410 - `FederatedIdentityActor object`
114411
114412 A federated external workload authenticated via a verified OIDC token.
114413
114414 Carries the verified issuer, subject, and audience claims from the
114415 presented JWT.
114416
114417 - `type: optional "federated_identity_actor"`
114418
114419 default: federated_identity_actor
114420
114421 - `issuer: string`
114422
114423 - `subject: string`
114424
114425 - `audience: optional array of string`
114426
114427 - `ip_address: optional string or null`
114428
114429 - `user_agent: optional string or null`
114430
114431 - `FederatedActor object`
114432
114433 An external identity asserted by a trusted provider — a cloud-provider
114434 gateway or a customer-registered federation issuer — acting without an
114435 Anthropic-provisioned account or service account.
114436
114437 - `type: optional "federated_actor"`
114438
114439 default: federated_actor
114440
114441 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
114442
114443 - `FederatedActorAwsProvider object`
114444
114445 Asserting party: the AWS account the organization is bound to.
114446
114447 - `type: optional "aws"`
114448
114449 default: aws
114450
114451 - `account_id: string`
114452
114453 - `signed_principal: string`
114454
114455 The AWS-signed ARN of the IAM principal that requested the token.
114456
114457 - `FederatedActorAzureProvider object`
114458
114459 Asserting party: the Azure subscription the organization is bound to.
114460
114461 - `type: optional "azure"`
114462
114463 default: azure
114464
114465 - `subscription_id: string`
114466
114467 - `FederatedActorGcpProvider object`
114468
114469 Asserting party: the GCP project the organization is bound to.
114470
114471 - `type: optional "gcp"`
114472
114473 default: gcp
114474
114475 - `project_number: string`
114476
114477 - `FederatedActorOidcProvider object`
114478
114479 Asserting party: a customer-registered OIDC federation issuer.
114480
114481 - `type: optional "oidc"`
114482
114483 default: oidc
114484
114485 - `issuer: optional string or null`
114486
114487 The federation issuer's URL. Null when the presented credential failed verification.
114488
114489 - `ip_address: optional string or null`
114490
114491 - `subject: optional string or null`
114492
114493 The provider's verified identifier for the caller; its form depends on the provider.
114494
114495 - `user_agent: optional string or null`
114496
114497 - `AttestedDeviceActor object`
114498
114499 An attested mobile device authenticated via Apple App Attest.
114500
114501 - `type: optional "attested_device_actor"`
114502
114503 default: attested_device_actor
114504
114505 - `external_client_id: string`
114506
114507 - `kid_hash: string`
114508
114509 - `ip_address: optional string or null`
114510
114511 - `user_agent: optional string or null`
114512
114513 - `telemetry_destination_id: string`
114514
114515 Tagged telemetry destination ID, e.g. "tdst_01HX...".
114516
114517 - `trigger: "invalid_address" or "redirect" or "sustained_failure" or "unspecified"`
114518
114519 Why the destination was disabled: deliveries failed for longer than Anthropic allows ("sustained_failure"), they failed that long and the hostname does not resolve to a public address ("invalid_address"), or the endpoint answered with an HTTP redirect ("redirect").
114520
114521 - `"invalid_address"`
114522
114523 - `"redirect"`
114524
114525 - `"sustained_failure"`
114526
114527 - `"unspecified"`
114528
114529 - `id: optional string`
114530
114531 Unique identifier for the activity e.g. 'activity_abcd1234'
114532
114533 - `created_at: optional string`
114534
114535 When this activity occurred.
114536
114537 format: date-time
114538
114539 - `organization_id: optional string or null`
114540
114541 Organization ID this activity is associated with
114542
114543 - `organization_uuid: optional string or null`
114544
114545 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
114546
114547 - `PlatformTelemetryDestinationCreated object`
114548
114549 A telemetry destination was registered for the organization.
114550
114551 - `type: optional "platform_telemetry_destination_created"`
114552
114553 default: platform_telemetry_destination_created
114554
114555 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
114556
114557 - `APIActor object`
114558
114559 - `type: optional "api_actor"`
114560
114561 default: api_actor
114562
114563 - `api_key_id: string`
114564
114565 - `ip_address: string`
114566
114567 - `user_agent: string`
114568
114569 - `UserActor object`
114570
114571 - `type: optional "user_actor"`
114572
114573 default: user_actor
114574
114575 - `email_address: string`
114576
114577 format: email
114578
114579 - `ip_address: string`
114580
114581 - `user_agent: string`
114582
114583 - `user_id: string`
114584
114585 - `UnauthenticatedUserActor object`
114586
114587 - `type: optional "unauthenticated_user_actor"`
114588
114589 default: unauthenticated_user_actor
114590
114591 - `ip_address: string`
114592
114593 - `user_agent: string`
114594
114595 - `unauthenticated_email_address: optional string or null`
114596
114597 format: email
114598
114599 - `AnthropicActor object`
114600
114601 - `type: optional "anthropic_actor"`
114602
114603 default: anthropic_actor
114604
114605 - `email_address: optional string or null`
114606
114607 format: email
114608
114609 - `SystemActor object`
114610
114611 Automated background processing performed by Anthropic systems, acting
114612 without a user or customer credential.
114613
114614 - `type: optional "system_actor"`
114615
114616 default: system_actor
114617
114618 - `service: optional string or null`
114619
114620 Name of the automated process that performed the action, when known.
114621
114622 - `AdminAPIKeyActor object`
114623
114624 - `type: optional "admin_api_key_actor"`
114625
114626 default: admin_api_key_actor
114627
114628 - `admin_api_key_id: string`
114629
114630 - `ip_address: string`
114631
114632 - `user_agent: string`
114633
114634 - `ServiceAccountActor object`
114635
114636 - `type: optional "service_account_actor"`
114637
114638 default: service_account_actor
114639
114640 - `ip_address: string`
114641
114642 - `service_account_id: string`
114643
114644 - `user_agent: string`
114645
114646 - `ScimDirectorySyncActor object`
114647
114648 - `type: optional "scim_directory_sync_actor"`
114649
114650 default: scim_directory_sync_actor
114651
114652 - `directory_id: string`
114653
114654 - `workos_event_id: string`
114655
114656 - `idp_connection_type: optional string or null`
114657
114658 - `FederatedIdentityActor object`
114659
114660 A federated external workload authenticated via a verified OIDC token.
114661
114662 Carries the verified issuer, subject, and audience claims from the
114663 presented JWT.
114664
114665 - `type: optional "federated_identity_actor"`
114666
114667 default: federated_identity_actor
114668
114669 - `issuer: string`
114670
114671 - `subject: string`
114672
114673 - `audience: optional array of string`
114674
114675 - `ip_address: optional string or null`
114676
114677 - `user_agent: optional string or null`
114678
114679 - `FederatedActor object`
114680
114681 An external identity asserted by a trusted provider — a cloud-provider
114682 gateway or a customer-registered federation issuer — acting without an
114683 Anthropic-provisioned account or service account.
114684
114685 - `type: optional "federated_actor"`
114686
114687 default: federated_actor
114688
114689 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
114690
114691 - `FederatedActorAwsProvider object`
114692
114693 Asserting party: the AWS account the organization is bound to.
114694
114695 - `type: optional "aws"`
114696
114697 default: aws
114698
114699 - `account_id: string`
114700
114701 - `signed_principal: string`
114702
114703 The AWS-signed ARN of the IAM principal that requested the token.
114704
114705 - `FederatedActorAzureProvider object`
114706
114707 Asserting party: the Azure subscription the organization is bound to.
114708
114709 - `type: optional "azure"`
114710
114711 default: azure
114712
114713 - `subscription_id: string`
114714
114715 - `FederatedActorGcpProvider object`
114716
114717 Asserting party: the GCP project the organization is bound to.
114718
114719 - `type: optional "gcp"`
114720
114721 default: gcp
114722
114723 - `project_number: string`
114724
114725 - `FederatedActorOidcProvider object`
114726
114727 Asserting party: a customer-registered OIDC federation issuer.
114728
114729 - `type: optional "oidc"`
114730
114731 default: oidc
114732
114733 - `issuer: optional string or null`
114734
114735 The federation issuer's URL. Null when the presented credential failed verification.
114736
114737 - `ip_address: optional string or null`
114738
114739 - `subject: optional string or null`
114740
114741 The provider's verified identifier for the caller; its form depends on the provider.
114742
114743 - `user_agent: optional string or null`
114744
114745 - `AttestedDeviceActor object`
114746
114747 An attested mobile device authenticated via Apple App Attest.
114748
114749 - `type: optional "attested_device_actor"`
114750
114751 default: attested_device_actor
114752
114753 - `external_client_id: string`
114754
114755 - `kid_hash: string`
114756
114757 - `ip_address: optional string or null`
114758
114759 - `user_agent: optional string or null`
114760
114761 - `telemetry_destination_id: string`
114762
114763 Tagged telemetry destination ID, e.g. "tdst_01HX...".
114764
114765 - `id: optional string`
114766
114767 Unique identifier for the activity e.g. 'activity_abcd1234'
114768
114769 - `created_at: optional string`
114770
114771 When this activity occurred.
114772
114773 format: date-time
114774
114775 - `endpoint_url: optional string or null`
114776
114777 The destination's endpoint URL as stored, e.g. "https://collector.example.com/otlp"; the API refuses credentials, query strings and fragments in this URL.
114778
114779 - `organization_id: optional string or null`
114780
114781 Organization ID this activity is associated with
114782
114783 - `organization_uuid: optional string or null`
114784
114785 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
114786
114787 - `traces: optional object or null`
114788
114789 The destination's settings for traces, as the API returns them.
114790
114791 - `content_mode: string`
114792
114793 What the exported spans contain: "metadata_only", or "content" when they also carry message and tool content.
114794
114795 - `enabled: boolean`
114796
114797 Whether the destination receives traces.
114798
114799 - `endpoint_url: optional string or null`
114800
114801 The destination's separate traces URL as stored, e.g. "https://collector.example.com/v2/trace/otlp"; like the endpoint URL it never contains credentials, a query string or a fragment. Omitted when the destination has none; traces then go to the endpoint URL plus "/v1/traces".
114802
114803 - `max_content_bytes: optional number or null`
114804
114805 The most bytes of content that one exported span keeps; omitted when the destination sets no bound and only Anthropic's maximum applies.
114806
114807 - `workspaces: optional object or null`
114808
114809 Which workspaces the destination covers, as the API returns it: its type only, "all", "include" or "exclude". The workspaces put on its list by the same request are recorded as workspace_added activities.
114810
114811 - `type: string`
114812
114813 "all": every workspace of the organization; "include": the workspaces on the destination's list; "exclude": every workspace but those on its list.
114814
114815 - `PlatformTelemetryDestinationDeleted object`
114816
114817 A telemetry destination was deleted.
114818
114819 - `type: optional "platform_telemetry_destination_deleted"`
114820
114821 default: platform_telemetry_destination_deleted
114822
114823 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
114824
114825 - `APIActor object`
114826
114827 - `type: optional "api_actor"`
114828
114829 default: api_actor
114830
114831 - `api_key_id: string`
114832
114833 - `ip_address: string`
114834
114835 - `user_agent: string`
114836
114837 - `UserActor object`
114838
114839 - `type: optional "user_actor"`
114840
114841 default: user_actor
114842
114843 - `email_address: string`
114844
114845 format: email
114846
114847 - `ip_address: string`
114848
114849 - `user_agent: string`
114850
114851 - `user_id: string`
114852
114853 - `UnauthenticatedUserActor object`
114854
114855 - `type: optional "unauthenticated_user_actor"`
114856
114857 default: unauthenticated_user_actor
114858
114859 - `ip_address: string`
114860
114861 - `user_agent: string`
114862
114863 - `unauthenticated_email_address: optional string or null`
114864
114865 format: email
114866
114867 - `AnthropicActor object`
114868
114869 - `type: optional "anthropic_actor"`
114870
114871 default: anthropic_actor
114872
114873 - `email_address: optional string or null`
114874
114875 format: email
114876
114877 - `SystemActor object`
114878
114879 Automated background processing performed by Anthropic systems, acting
114880 without a user or customer credential.
114881
114882 - `type: optional "system_actor"`
114883
114884 default: system_actor
114885
114886 - `service: optional string or null`
114887
114888 Name of the automated process that performed the action, when known.
114889
114890 - `AdminAPIKeyActor object`
114891
114892 - `type: optional "admin_api_key_actor"`
114893
114894 default: admin_api_key_actor
114895
114896 - `admin_api_key_id: string`
114897
114898 - `ip_address: string`
114899
114900 - `user_agent: string`
114901
114902 - `ServiceAccountActor object`
114903
114904 - `type: optional "service_account_actor"`
114905
114906 default: service_account_actor
114907
114908 - `ip_address: string`
114909
114910 - `service_account_id: string`
114911
114912 - `user_agent: string`
114913
114914 - `ScimDirectorySyncActor object`
114915
114916 - `type: optional "scim_directory_sync_actor"`
114917
114918 default: scim_directory_sync_actor
114919
114920 - `directory_id: string`
114921
114922 - `workos_event_id: string`
114923
114924 - `idp_connection_type: optional string or null`
114925
114926 - `FederatedIdentityActor object`
114927
114928 A federated external workload authenticated via a verified OIDC token.
114929
114930 Carries the verified issuer, subject, and audience claims from the
114931 presented JWT.
114932
114933 - `type: optional "federated_identity_actor"`
114934
114935 default: federated_identity_actor
114936
114937 - `issuer: string`
114938
114939 - `subject: string`
114940
114941 - `audience: optional array of string`
114942
114943 - `ip_address: optional string or null`
114944
114945 - `user_agent: optional string or null`
114946
114947 - `FederatedActor object`
114948
114949 An external identity asserted by a trusted provider — a cloud-provider
114950 gateway or a customer-registered federation issuer — acting without an
114951 Anthropic-provisioned account or service account.
114952
114953 - `type: optional "federated_actor"`
114954
114955 default: federated_actor
114956
114957 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
114958
114959 - `FederatedActorAwsProvider object`
114960
114961 Asserting party: the AWS account the organization is bound to.
114962
114963 - `type: optional "aws"`
114964
114965 default: aws
114966
114967 - `account_id: string`
114968
114969 - `signed_principal: string`
114970
114971 The AWS-signed ARN of the IAM principal that requested the token.
114972
114973 - `FederatedActorAzureProvider object`
114974
114975 Asserting party: the Azure subscription the organization is bound to.
114976
114977 - `type: optional "azure"`
114978
114979 default: azure
114980
114981 - `subscription_id: string`
114982
114983 - `FederatedActorGcpProvider object`
114984
114985 Asserting party: the GCP project the organization is bound to.
114986
114987 - `type: optional "gcp"`
114988
114989 default: gcp
114990
114991 - `project_number: string`
114992
114993 - `FederatedActorOidcProvider object`
114994
114995 Asserting party: a customer-registered OIDC federation issuer.
114996
114997 - `type: optional "oidc"`
114998
114999 default: oidc
115000
115001 - `issuer: optional string or null`
115002
115003 The federation issuer's URL. Null when the presented credential failed verification.
115004
115005 - `ip_address: optional string or null`
115006
115007 - `subject: optional string or null`
115008
115009 The provider's verified identifier for the caller; its form depends on the provider.
115010
115011 - `user_agent: optional string or null`
115012
115013 - `AttestedDeviceActor object`
115014
115015 An attested mobile device authenticated via Apple App Attest.
115016
115017 - `type: optional "attested_device_actor"`
115018
115019 default: attested_device_actor
115020
115021 - `external_client_id: string`
115022
115023 - `kid_hash: string`
115024
115025 - `ip_address: optional string or null`
115026
115027 - `user_agent: optional string or null`
115028
115029 - `telemetry_destination_id: string`
115030
115031 Tagged telemetry destination ID, e.g. "tdst_01HX...".
115032
115033 - `id: optional string`
115034
115035 Unique identifier for the activity e.g. 'activity_abcd1234'
115036
115037 - `created_at: optional string`
115038
115039 When this activity occurred.
115040
115041 format: date-time
115042
115043 - `organization_id: optional string or null`
115044
115045 Organization ID this activity is associated with
115046
115047 - `organization_uuid: optional string or null`
115048
115049 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
115050
115051 - `PlatformTelemetryDestinationUpdated object`
115052
115053 A telemetry destination's configuration was updated. State changes and changes of its workspace scope (the type, or the list through an update's workspace_ids) are included; the workspaces an update took off or put on the list are also recorded as workspace_removed and workspace_added activities. Previous and current values are recorded only for the endpoint URL, the traces URL, the content mode and the workspaces type.
115054
115055 - `type: optional "platform_telemetry_destination_updated"`
115056
115057 default: platform_telemetry_destination_updated
115058
115059 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
115060
115061 - `APIActor object`
115062
115063 - `type: optional "api_actor"`
115064
115065 default: api_actor
115066
115067 - `api_key_id: string`
115068
115069 - `ip_address: string`
115070
115071 - `user_agent: string`
115072
115073 - `UserActor object`
115074
115075 - `type: optional "user_actor"`
115076
115077 default: user_actor
115078
115079 - `email_address: string`
115080
115081 format: email
115082
115083 - `ip_address: string`
115084
115085 - `user_agent: string`
115086
115087 - `user_id: string`
115088
115089 - `UnauthenticatedUserActor object`
115090
115091 - `type: optional "unauthenticated_user_actor"`
115092
115093 default: unauthenticated_user_actor
115094
115095 - `ip_address: string`
115096
115097 - `user_agent: string`
115098
115099 - `unauthenticated_email_address: optional string or null`
115100
115101 format: email
115102
115103 - `AnthropicActor object`
115104
115105 - `type: optional "anthropic_actor"`
115106
115107 default: anthropic_actor
115108
115109 - `email_address: optional string or null`
115110
115111 format: email
115112
115113 - `SystemActor object`
115114
115115 Automated background processing performed by Anthropic systems, acting
115116 without a user or customer credential.
115117
115118 - `type: optional "system_actor"`
115119
115120 default: system_actor
115121
115122 - `service: optional string or null`
115123
115124 Name of the automated process that performed the action, when known.
115125
115126 - `AdminAPIKeyActor object`
115127
115128 - `type: optional "admin_api_key_actor"`
115129
115130 default: admin_api_key_actor
115131
115132 - `admin_api_key_id: string`
115133
115134 - `ip_address: string`
115135
115136 - `user_agent: string`
115137
115138 - `ServiceAccountActor object`
115139
115140 - `type: optional "service_account_actor"`
115141
115142 default: service_account_actor
115143
115144 - `ip_address: string`
115145
115146 - `service_account_id: string`
115147
115148 - `user_agent: string`
115149
115150 - `ScimDirectorySyncActor object`
115151
115152 - `type: optional "scim_directory_sync_actor"`
115153
115154 default: scim_directory_sync_actor
115155
115156 - `directory_id: string`
115157
115158 - `workos_event_id: string`
115159
115160 - `idp_connection_type: optional string or null`
115161
115162 - `FederatedIdentityActor object`
115163
115164 A federated external workload authenticated via a verified OIDC token.
115165
115166 Carries the verified issuer, subject, and audience claims from the
115167 presented JWT.
115168
115169 - `type: optional "federated_identity_actor"`
115170
115171 default: federated_identity_actor
115172
115173 - `issuer: string`
115174
115175 - `subject: string`
115176
115177 - `audience: optional array of string`
115178
115179 - `ip_address: optional string or null`
115180
115181 - `user_agent: optional string or null`
115182
115183 - `FederatedActor object`
115184
115185 An external identity asserted by a trusted provider — a cloud-provider
115186 gateway or a customer-registered federation issuer — acting without an
115187 Anthropic-provisioned account or service account.
115188
115189 - `type: optional "federated_actor"`
115190
115191 default: federated_actor
115192
115193 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
115194
115195 - `FederatedActorAwsProvider object`
115196
115197 Asserting party: the AWS account the organization is bound to.
115198
115199 - `type: optional "aws"`
115200
115201 default: aws
115202
115203 - `account_id: string`
115204
115205 - `signed_principal: string`
115206
115207 The AWS-signed ARN of the IAM principal that requested the token.
115208
115209 - `FederatedActorAzureProvider object`
115210
115211 Asserting party: the Azure subscription the organization is bound to.
115212
115213 - `type: optional "azure"`
115214
115215 default: azure
115216
115217 - `subscription_id: string`
115218
115219 - `FederatedActorGcpProvider object`
115220
115221 Asserting party: the GCP project the organization is bound to.
115222
115223 - `type: optional "gcp"`
115224
115225 default: gcp
115226
115227 - `project_number: string`
115228
115229 - `FederatedActorOidcProvider object`
115230
115231 Asserting party: a customer-registered OIDC federation issuer.
115232
115233 - `type: optional "oidc"`
115234
115235 default: oidc
115236
115237 - `issuer: optional string or null`
115238
115239 The federation issuer's URL. Null when the presented credential failed verification.
115240
115241 - `ip_address: optional string or null`
115242
115243 - `subject: optional string or null`
115244
115245 The provider's verified identifier for the caller; its form depends on the provider.
115246
115247 - `user_agent: optional string or null`
115248
115249 - `AttestedDeviceActor object`
115250
115251 An attested mobile device authenticated via Apple App Attest.
115252
115253 - `type: optional "attested_device_actor"`
115254
115255 default: attested_device_actor
115256
115257 - `external_client_id: string`
115258
115259 - `kid_hash: string`
115260
115261 - `ip_address: optional string or null`
115262
115263 - `user_agent: optional string or null`
115264
115265 - `telemetry_destination_id: string`
115266
115267 Tagged telemetry destination ID, e.g. "tdst_01HX...".
115268
115269 - `id: optional string`
115270
115271 Unique identifier for the activity e.g. 'activity_abcd1234'
115272
115273 - `created_at: optional string`
115274
115275 When this activity occurred.
115276
115277 format: date-time
115278
115279 - `organization_id: optional string or null`
115280
115281 Organization ID this activity is associated with
115282
115283 - `organization_uuid: optional string or null`
115284
115285 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
115286
115287 - `updated_fields: optional array of string`
115288
115289 Names of the configuration fields whose value changed, e.g. "endpoint_url", "headers", "state"; "traces" when any setting for traces changed. Header names and values are never included.
115290
115291 - `updates: optional array of object`
115292
115293 The field-level value changes in this update, in this order: an "endpoint_url" entry when the endpoint URL changed, a "traces_endpoint_url" entry when the traces URL changed, a "traces_content_mode" entry when the content mode changed, and a "workspaces" entry ("all", "include" or "exclude") when the workspaces type changed; empty otherwise.
115294
115295 - `type: "endpoint_url" or "traces_content_mode" or "traces_endpoint_url" or 2 more`
115296
115297 The destination field that changed
115298
115299 - `"endpoint_url"`
115300
115301 - `"traces_content_mode"`
115302
115303 - `"traces_endpoint_url"`
115304
115305 - `"unspecified"`
115306
115307 - `"workspaces"`
115308
115309 - `current_value: string`
115310
115311 Field value immediately after this change
115312
115313 - `previous_value: string`
115314
115315 Field value immediately before this change
115316
115317 - `PlatformTelemetryDestinationWorkspaceAdded object`
115318
115319 A workspace was added to the workspace list of a telemetry destination. When the list type is "include", the destination starts to receive the spans of that workspace; when it is "exclude", the destination stops receiving them.
115320
115321 - `type: optional "platform_telemetry_destination_workspace_added"`
115322
115323 default: platform_telemetry_destination_workspace_added
115324
115325 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
115326
115327 - `APIActor object`
115328
115329 - `type: optional "api_actor"`
115330
115331 default: api_actor
115332
115333 - `api_key_id: string`
115334
115335 - `ip_address: string`
115336
115337 - `user_agent: string`
115338
115339 - `UserActor object`
115340
115341 - `type: optional "user_actor"`
115342
115343 default: user_actor
115344
115345 - `email_address: string`
115346
115347 format: email
115348
115349 - `ip_address: string`
115350
115351 - `user_agent: string`
115352
115353 - `user_id: string`
115354
115355 - `UnauthenticatedUserActor object`
115356
115357 - `type: optional "unauthenticated_user_actor"`
115358
115359 default: unauthenticated_user_actor
115360
115361 - `ip_address: string`
115362
115363 - `user_agent: string`
115364
115365 - `unauthenticated_email_address: optional string or null`
115366
115367 format: email
115368
115369 - `AnthropicActor object`
115370
115371 - `type: optional "anthropic_actor"`
115372
115373 default: anthropic_actor
115374
115375 - `email_address: optional string or null`
115376
115377 format: email
115378
115379 - `SystemActor object`
115380
115381 Automated background processing performed by Anthropic systems, acting
115382 without a user or customer credential.
115383
115384 - `type: optional "system_actor"`
115385
115386 default: system_actor
115387
115388 - `service: optional string or null`
115389
115390 Name of the automated process that performed the action, when known.
115391
115392 - `AdminAPIKeyActor object`
115393
115394 - `type: optional "admin_api_key_actor"`
115395
115396 default: admin_api_key_actor
115397
115398 - `admin_api_key_id: string`
115399
115400 - `ip_address: string`
115401
115402 - `user_agent: string`
115403
115404 - `ServiceAccountActor object`
115405
115406 - `type: optional "service_account_actor"`
115407
115408 default: service_account_actor
115409
115410 - `ip_address: string`
115411
115412 - `service_account_id: string`
115413
115414 - `user_agent: string`
115415
115416 - `ScimDirectorySyncActor object`
115417
115418 - `type: optional "scim_directory_sync_actor"`
115419
115420 default: scim_directory_sync_actor
115421
115422 - `directory_id: string`
115423
115424 - `workos_event_id: string`
115425
115426 - `idp_connection_type: optional string or null`
115427
115428 - `FederatedIdentityActor object`
115429
115430 A federated external workload authenticated via a verified OIDC token.
115431
115432 Carries the verified issuer, subject, and audience claims from the
115433 presented JWT.
115434
115435 - `type: optional "federated_identity_actor"`
115436
115437 default: federated_identity_actor
115438
115439 - `issuer: string`
115440
115441 - `subject: string`
115442
115443 - `audience: optional array of string`
115444
115445 - `ip_address: optional string or null`
115446
115447 - `user_agent: optional string or null`
115448
115449 - `FederatedActor object`
115450
115451 An external identity asserted by a trusted provider — a cloud-provider
115452 gateway or a customer-registered federation issuer — acting without an
115453 Anthropic-provisioned account or service account.
115454
115455 - `type: optional "federated_actor"`
115456
115457 default: federated_actor
115458
115459 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
115460
115461 - `FederatedActorAwsProvider object`
115462
115463 Asserting party: the AWS account the organization is bound to.
115464
115465 - `type: optional "aws"`
115466
115467 default: aws
115468
115469 - `account_id: string`
115470
115471 - `signed_principal: string`
115472
115473 The AWS-signed ARN of the IAM principal that requested the token.
115474
115475 - `FederatedActorAzureProvider object`
115476
115477 Asserting party: the Azure subscription the organization is bound to.
115478
115479 - `type: optional "azure"`
115480
115481 default: azure
115482
115483 - `subscription_id: string`
115484
115485 - `FederatedActorGcpProvider object`
115486
115487 Asserting party: the GCP project the organization is bound to.
115488
115489 - `type: optional "gcp"`
115490
115491 default: gcp
115492
115493 - `project_number: string`
115494
115495 - `FederatedActorOidcProvider object`
115496
115497 Asserting party: a customer-registered OIDC federation issuer.
115498
115499 - `type: optional "oidc"`
115500
115501 default: oidc
115502
115503 - `issuer: optional string or null`
115504
115505 The federation issuer's URL. Null when the presented credential failed verification.
115506
115507 - `ip_address: optional string or null`
115508
115509 - `subject: optional string or null`
115510
115511 The provider's verified identifier for the caller; its form depends on the provider.
115512
115513 - `user_agent: optional string or null`
115514
115515 - `AttestedDeviceActor object`
115516
115517 An attested mobile device authenticated via Apple App Attest.
115518
115519 - `type: optional "attested_device_actor"`
115520
115521 default: attested_device_actor
115522
115523 - `external_client_id: string`
115524
115525 - `kid_hash: string`
115526
115527 - `ip_address: optional string or null`
115528
115529 - `user_agent: optional string or null`
115530
115531 - `telemetry_destination_id: string`
115532
115533 Tagged telemetry destination ID, e.g. "tdst_01HX...".
115534
115535 - `workspace_id: string`
115536
115537 Tagged ID of the workspace put on the list, e.g. "wrkspc_01HX...".
115538
115539 - `id: optional string`
115540
115541 Unique identifier for the activity e.g. 'activity_abcd1234'
115542
115543 - `created_at: optional string`
115544
115545 When this activity occurred.
115546
115547 format: date-time
115548
115549 - `organization_id: optional string or null`
115550
115551 Organization ID this activity is associated with
115552
115553 - `organization_uuid: optional string or null`
115554
115555 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
115556
115557 - `PlatformTelemetryDestinationWorkspaceRemoved object`
115558
115559 A workspace was removed from the workspace list of a telemetry destination, by a change to the list or because the destination was deleted. When the list type is "include", the destination stops receiving the spans of that workspace; when it is "exclude", the destination receives them again unless the destination was deleted.
115560
115561 - `type: optional "platform_telemetry_destination_workspace_removed"`
115562
115563 default: platform_telemetry_destination_workspace_removed
115564
115565 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
115566
115567 - `APIActor object`
115568
115569 - `type: optional "api_actor"`
115570
115571 default: api_actor
115572
115573 - `api_key_id: string`
115574
115575 - `ip_address: string`
115576
115577 - `user_agent: string`
115578
115579 - `UserActor object`
115580
115581 - `type: optional "user_actor"`
115582
115583 default: user_actor
115584
115585 - `email_address: string`
115586
115587 format: email
115588
115589 - `ip_address: string`
115590
115591 - `user_agent: string`
115592
115593 - `user_id: string`
115594
115595 - `UnauthenticatedUserActor object`
115596
115597 - `type: optional "unauthenticated_user_actor"`
115598
115599 default: unauthenticated_user_actor
115600
115601 - `ip_address: string`
115602
115603 - `user_agent: string`
115604
115605 - `unauthenticated_email_address: optional string or null`
115606
115607 format: email
115608
115609 - `AnthropicActor object`
115610
115611 - `type: optional "anthropic_actor"`
115612
115613 default: anthropic_actor
115614
115615 - `email_address: optional string or null`
115616
115617 format: email
115618
115619 - `SystemActor object`
115620
115621 Automated background processing performed by Anthropic systems, acting
115622 without a user or customer credential.
115623
115624 - `type: optional "system_actor"`
115625
115626 default: system_actor
115627
115628 - `service: optional string or null`
115629
115630 Name of the automated process that performed the action, when known.
115631
115632 - `AdminAPIKeyActor object`
115633
115634 - `type: optional "admin_api_key_actor"`
115635
115636 default: admin_api_key_actor
115637
115638 - `admin_api_key_id: string`
115639
115640 - `ip_address: string`
115641
115642 - `user_agent: string`
115643
115644 - `ServiceAccountActor object`
115645
115646 - `type: optional "service_account_actor"`
115647
115648 default: service_account_actor
115649
115650 - `ip_address: string`
115651
115652 - `service_account_id: string`
115653
115654 - `user_agent: string`
115655
115656 - `ScimDirectorySyncActor object`
115657
115658 - `type: optional "scim_directory_sync_actor"`
115659
115660 default: scim_directory_sync_actor
115661
115662 - `directory_id: string`
115663
115664 - `workos_event_id: string`
115665
115666 - `idp_connection_type: optional string or null`
115667
115668 - `FederatedIdentityActor object`
115669
115670 A federated external workload authenticated via a verified OIDC token.
115671
115672 Carries the verified issuer, subject, and audience claims from the
115673 presented JWT.
115674
115675 - `type: optional "federated_identity_actor"`
115676
115677 default: federated_identity_actor
115678
115679 - `issuer: string`
115680
115681 - `subject: string`
115682
115683 - `audience: optional array of string`
115684
115685 - `ip_address: optional string or null`
115686
115687 - `user_agent: optional string or null`
115688
115689 - `FederatedActor object`
115690
115691 An external identity asserted by a trusted provider — a cloud-provider
115692 gateway or a customer-registered federation issuer — acting without an
115693 Anthropic-provisioned account or service account.
115694
115695 - `type: optional "federated_actor"`
115696
115697 default: federated_actor
115698
115699 - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
115700
115701 - `FederatedActorAwsProvider object`
115702
115703 Asserting party: the AWS account the organization is bound to.
115704
115705 - `type: optional "aws"`
115706
115707 default: aws
115708
115709 - `account_id: string`
115710
115711 - `signed_principal: string`
115712
115713 The AWS-signed ARN of the IAM principal that requested the token.
115714
115715 - `FederatedActorAzureProvider object`
115716
115717 Asserting party: the Azure subscription the organization is bound to.
115718
115719 - `type: optional "azure"`
115720
115721 default: azure
115722
115723 - `subscription_id: string`
115724
115725 - `FederatedActorGcpProvider object`
115726
115727 Asserting party: the GCP project the organization is bound to.
115728
115729 - `type: optional "gcp"`
115730
115731 default: gcp
115732
115733 - `project_number: string`
115734
115735 - `FederatedActorOidcProvider object`
115736
115737 Asserting party: a customer-registered OIDC federation issuer.
115738
115739 - `type: optional "oidc"`
115740
115741 default: oidc
115742
115743 - `issuer: optional string or null`
115744
115745 The federation issuer's URL. Null when the presented credential failed verification.
115746
115747 - `ip_address: optional string or null`
115748
115749 - `subject: optional string or null`
115750
115751 The provider's verified identifier for the caller; its form depends on the provider.
115752
115753 - `user_agent: optional string or null`
115754
115755 - `AttestedDeviceActor object`
115756
115757 An attested mobile device authenticated via Apple App Attest.
115758
115759 - `type: optional "attested_device_actor"`
115760
115761 default: attested_device_actor
115762
115763 - `external_client_id: string`
115764
115765 - `kid_hash: string`
115766
115767 - `ip_address: optional string or null`
115768
115769 - `user_agent: optional string or null`
115770
115771 - `telemetry_destination_id: string`
115772
115773 Tagged telemetry destination ID, e.g. "tdst_01HX...".
115774
115775 - `workspace_id: string`
115776
115777 Tagged ID of the workspace taken off the list, e.g. "wrkspc_01HX...".
115778
115779 - `id: optional string`
115780
115781 Unique identifier for the activity e.g. 'activity_abcd1234'
115782
115783 - `created_at: optional string`
115784
115785 When this activity occurred.
115786
115787 format: date-time
115788
115789 - `organization_id: optional string or null`
115790
115791 Organization ID this activity is associated with
115792
115793 - `organization_uuid: optional string or null`
115794
115795 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
115796
112109115797 - `PlatformUsageReportClaudeCodeViewed object`
112110115798
112111115799 The Claude Code usage report was viewed.
112112115800
No line in this hunk matches that.