Compliance API changedgovernment/org-admin/compliance-api
Nearest release: v2.1.319, published 15 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 6 Nov 2026 16:05 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 6 Nov 2026 16:07 UTC.
Upstream edited
Recorded here
Lines+4added
Lines−5removed
From line
10
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits13to this page, all time
The whole hunk
from line 10, old and new numbered
/
from line 10
1010
1111## Managing API keys
1212
13To create and manage keys for your organization, open **Compliance API** under **Settings** in the organization admin portal. To create and manage keys that return events for every organization in your tenant, open **Compliance API keys** under **Settings** in the [tenant admin portal](https://claude.com/docs/government/tenant-admin/overview.md). Only tenant administrators can open the tenant admin portal.
13To create and manage keys for your organization, open **Compliance API** under **Settings** in the [organization admin portal](https://claude.com/docs/government/org-admin/overview.md#who-can-access-it). To create and manage keys that return events for every organization in your tenant, open **Compliance API keys** under **Settings** in the [tenant admin portal](https://claude.com/docs/government/tenant-admin/overview.md). Only tenant administrators can open the tenant admin portal.
1414
1515Both pages list only their own keys, showing each key's name, a hint with the last few characters of the key so you can tell keys apart, when the key was created, and whether it is active or revoked.
1616
from line 26
2626
2727## Calling the API
2828
29Send a GET request to your Claude for Government host followed by the fixed path `/gateway-api/v1/compliance/activities`, with your key in the `x-api-key` header. The Claude for Government host is the address of your organization admin portal. If you are unsure of it, ask your Anthropic representative.
29Send a GET request to your Claude for Government host followed by the fixed path `/gateway-api/v1/compliance/activities`, with your key in the `x-api-key` header. The Claude for Government host is the domain name in the address of your organization admin portal. If you are unsure of it, ask your Anthropic representative.
3030
3131```http theme={null}
32GET https://<claude-for-government-host>/gateway-api/v1/compliance/activities?since=2026-07-01T00:00:00Z&limit=500
32GET https://<claude-for-government-host>/gateway-api/v1/compliance/activities?since=<start-time>&limit=500
3333x-api-key: <your-compliance-api-key>
3434```
3535
from line 80
8080The `actor` object identifies who performed the action. Its `type` is one of:
8181
8282* `user_actor` for a person acting through the product or admin portal.
83* `admin_api_key_actor` for an action taken through an administrative API key.
8483* `anthropic_actor` for an action performed by Anthropic personnel or systems on your behalf, such as initial provisioning. No individual identity is included.
8584
8685Each event also carries fields specific to its type, such as the role a user was changed to or the name of a key that was created.
from line 133
134133
135134Most deployments run a small scheduled worker that polls the API on a fixed interval, forwards each event to the SIEM's HTTP ingest endpoint, and records a time watermark so the next run picks up where the last one left off. A worker that falls more than 30 days behind cannot recover the gap.
136135
137A typical run requests `since=<watermark>`, forwards every event returned, and if `has_more` is true, follows `after_id=<last_id>` for each further page until `has_more` is false. After all pages are drained, advance your watermark to the newest `created_at` you saw. Event `id` values are stable and unique, so your collector can deduplicate on `id` and safely retry a page or use an overlapping `since` without creating duplicate records in the SIEM.
136A typical run requests `since=<watermark>`, forwards every event returned, and if `has_more` is true, follows `after_id=<last_id>` for each further page until `has_more` is false. After all pages are drained, advance your watermark to one hour before the newest `created_at` you saw, because an event can reach the feed after a newer one. Event `id` values are stable and unique, so your collector should deduplicate on `id`, and can then safely retry a page or use an overlapping `since` without creating duplicate records in the SIEM.
138137
139138## When the API is disabled
140139
No line in this hunk matches that.