Compliance API changedapi/compliance
Nearest release: v2.1.322, published 2 hours before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+5,291added
Lines−17removed
From line
19
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits37to this page, all time
## Compliance API › Organizations › Security Posture ### Get an organization's security posture
The whole hunk
from line 19, old and new numbered
/
This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.
The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.
from line 19
1919
2020#### Query parameters
2121
22- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "account_migration_completed" or 571 more`
22- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "account_migration_completed" or 589 more`
2323
2424 Filter activities by type. See the response `data` schema for the additional fields each type returns. Cannot be combined with `exclude_activity_types[]`.
2525
from line 266
266266
267267 An organization admin allowed one artifact to be shared outside the organization by link while the organization-wide external sharing setting was off, or revoked that permission.
268268
269 - `"claude_artifact_folder_created"`
270
271 A folder for artifacts was created, inside another folder or in none.
272
273 - `"claude_artifact_folder_moved"`
274
275 A folder for artifacts was moved into, out of or between other folders, by its owner or by someone else, whether or not a folder is shared; the artifacts and folders inside it moved with it and were not recorded as moves of their own.
276
269277 - `"claude_artifact_invite_accepted"`
270278
271279 Someone outside the organization signed in with a verified account for the invited address and accepted an invitation to an artifact, and can now open it; recorded in the artifact owner's organization. The person who accepted is identified by `invitee_email` and `invitee_user_id`.
from line 290
282290
283291 A member changed the access level of an email invitation to an artifact for someone outside the organization, whether the invitation was still pending or had been accepted; recorded in the artifact owner's organization with that member as the actor.
284292
293 - `"claude_artifact_moved"`
294
295 An artifact was moved into, out of or between folders, by its owner or by someone else, whether or not a folder is shared; an artifact that leaves its folder as part of another event, such as its own deletion or the erasure of an account, might not be recorded as a move.
296
285297 - `"claude_artifact_published"`
286298
287 A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded when the artifact is saved, including saves of private artifacts, except that automatic saves made while a person keeps editing may be recorded periodically for that person rather than once per save; changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
299 A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded when the artifact is saved, including saves of private artifacts and, for some artifacts, edits to stored content that make no new version, except that such edits, and automatic saves made while a person keeps editing, may be recorded periodically for that person rather than once per save; changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
288300
289301 - `"claude_artifact_sent_to_partner"`
290302
from line 838
826838
827839 An administrator allowed a skill version despite its security scan's verdict, or that allowance was revoked.
828840
841 - `"claude_skill_served_version_updated"`
842
843 A skill's served version, the version that members get, was updated: an administrator or the owner chose a version, a saved version became the served version, or an accepted library submission was published into the skill. A new version that is served as soon as it is saved may appear only as claude_skill_version_created.
844
845 - `"claude_skill_version_created"`
846
847 A new version of a skill was created.
848
829849 - `"claude_survey_closed"`
830850
831851 An organization admin closed an in-app survey before its end date, ending the collection of responses; a survey that reaches its end date records no event.
from line 1414
13941414
13951415 Organization domain was removed.
13961416
1417 - `"org_domain_sso_enforcement_updated"`
1418
1419 A verified domain's single sign-on requirement changed, per surface.
1420
1421 - `"org_domain_sso_routing_updated"`
1422
1423 A verified domain's single sign-on routing was saved or changed. Lists the identity provider connections the domain's users sign in through before and after; the two lists are the same when a save changed nothing.
1424
13971425 - `"org_domain_verified"`
13981426
13991427 Organization domain was verified.
from line 1458
14301458
14311459 A primary owner accepted the Business Associate Agreement and enabled the HIPAA configuration for the organization through the self-serve flow.
14321460
1461 - `"org_idp_connection_created"`
1462
1463 An identity provider connection was added to the parent organization.
1464
1465 - `"org_idp_connection_deleted"`
1466
1467 An identity provider connection was removed from the parent organization, along with the settings that referenced it.
1468
1469 - `"org_idp_connection_updated"`
1470
1471 An identity provider connection's settings were changed.
1472
14331473 - `"org_invite_link_disabled"`
14341474
14351475 Organization invite link was disabled.
from line 1570
15301570
15311571 Organization parent search was performed.
15321572
1573 - `"org_security_control_attestation_updated"`
1574
1575 The organization's attestation for a security control was recorded, changed, renewed or cleared by an administrator, or was ended automatically.
1576
15331577 - `"org_sso_add_initiated"`
15341578
15351579 Organization SSO setup was initiated.
from line 1698
16541698
16551699 Access to owned projects was restored.
16561700
1701 - `"parent_organization_centralized_management_enrolled"`
1702
1703 A parent organization was enrolled in centralized management.
1704
1705 - `"parent_organization_centralized_management_organization_updated"`
1706
1707 An organization's approval of its parent organization's Centralized Management setup changed, or its administrators were reminded to approve.
1708
1709 - `"parent_organization_centralized_management_setup_updated"`
1710
1711 The Centralized Management setup of a parent organization changed: it was started or abandoned, its proposed administrators changed, its remaining organizations were force approved, or it completed.
1712
1713 - `"parent_organization_centralized_management_unenrolled"`
1714
1715 A parent organization was unenrolled from centralized management.
1716
1717 - `"parent_organization_member_removed"`
1718
1719 A parent-organization admin role was removed from a user.
1720
1721 - `"parent_organization_member_updated"`
1722
1723 A parent-organization admin role was granted or changed for a user.
1724
1725 - `"parent_organization_settings_updated"`
1726
1727 Parent organization settings were updated.
1728
16571729 - `"payment_method_updated"`
16581730
16591731 The organization's default payment method was updated.
from line 2449
23772449
23782450 format: date-time
23792451
2380- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "account_migration_completed" or 571 more`
2452- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "account_migration_completed" or 589 more`
23812453
23822454 Exclude activities of these types. Cannot be combined with `activity_types[]`.
23832455
from line 2696
26242696
26252697 An organization admin allowed one artifact to be shared outside the organization by link while the organization-wide external sharing setting was off, or revoked that permission.
26262698
2699 - `"claude_artifact_folder_created"`
2700
2701 A folder for artifacts was created, inside another folder or in none.
2702
2703 - `"claude_artifact_folder_moved"`
2704
2705 A folder for artifacts was moved into, out of or between other folders, by its owner or by someone else, whether or not a folder is shared; the artifacts and folders inside it moved with it and were not recorded as moves of their own.
2706
26272707 - `"claude_artifact_invite_accepted"`
26282708
26292709 Someone outside the organization signed in with a verified account for the invited address and accepted an invitation to an artifact, and can now open it; recorded in the artifact owner's organization. The person who accepted is identified by `invitee_email` and `invitee_user_id`.
from line 2720
26402720
26412721 A member changed the access level of an email invitation to an artifact for someone outside the organization, whether the invitation was still pending or had been accepted; recorded in the artifact owner's organization with that member as the actor.
26422722
2723 - `"claude_artifact_moved"`
2724
2725 An artifact was moved into, out of or between folders, by its owner or by someone else, whether or not a folder is shared; an artifact that leaves its folder as part of another event, such as its own deletion or the erasure of an account, might not be recorded as a move.
2726
26432727 - `"claude_artifact_published"`
26442728
2645 A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded when the artifact is saved, including saves of private artifacts, except that automatic saves made while a person keeps editing may be recorded periodically for that person rather than once per save; changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
2729 A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded when the artifact is saved, including saves of private artifacts and, for some artifacts, edits to stored content that make no new version, except that such edits, and automatic saves made while a person keeps editing, may be recorded periodically for that person rather than once per save; changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
26462730
26472731 - `"claude_artifact_sent_to_partner"`
26482732
from line 3268
31843268
31853269 An administrator allowed a skill version despite its security scan's verdict, or that allowance was revoked.
31863270
3271 - `"claude_skill_served_version_updated"`
3272
3273 A skill's served version, the version that members get, was updated: an administrator or the owner chose a version, a saved version became the served version, or an accepted library submission was published into the skill. A new version that is served as soon as it is saved may appear only as claude_skill_version_created.
3274
3275 - `"claude_skill_version_created"`
3276
3277 A new version of a skill was created.
3278
31873279 - `"claude_survey_closed"`
31883280
31893281 An organization admin closed an in-app survey before its end date, ending the collection of responses; a survey that reaches its end date records no event.
from line 3844
37523844
37533845 Organization domain was removed.
37543846
3847 - `"org_domain_sso_enforcement_updated"`
3848
3849 A verified domain's single sign-on requirement changed, per surface.
3850
3851 - `"org_domain_sso_routing_updated"`
3852
3853 A verified domain's single sign-on routing was saved or changed. Lists the identity provider connections the domain's users sign in through before and after; the two lists are the same when a save changed nothing.
3854
37553855 - `"org_domain_verified"`
37563856
37573857 Organization domain was verified.
from line 3888
37883888
37893889 A primary owner accepted the Business Associate Agreement and enabled the HIPAA configuration for the organization through the self-serve flow.
37903890
3891 - `"org_idp_connection_created"`
3892
3893 An identity provider connection was added to the parent organization.
3894
3895 - `"org_idp_connection_deleted"`
3896
3897 An identity provider connection was removed from the parent organization, along with the settings that referenced it.
3898
3899 - `"org_idp_connection_updated"`
3900
3901 An identity provider connection's settings were changed.
3902
37913903 - `"org_invite_link_disabled"`
37923904
37933905 Organization invite link was disabled.
from line 4000
38884000
38894001 Organization parent search was performed.
38904002
4003 - `"org_security_control_attestation_updated"`
4004
4005 The organization's attestation for a security control was recorded, changed, renewed or cleared by an administrator, or was ended automatically.
4006
38914007 - `"org_sso_add_initiated"`
38924008
38934009 Organization SSO setup was initiated.
from line 4128
40124128
40134129 Access to owned projects was restored.
40144130
4131 - `"parent_organization_centralized_management_enrolled"`
4132
4133 A parent organization was enrolled in centralized management.
4134
4135 - `"parent_organization_centralized_management_organization_updated"`
4136
4137 An organization's approval of its parent organization's Centralized Management setup changed, or its administrators were reminded to approve.
4138
4139 - `"parent_organization_centralized_management_setup_updated"`
4140
4141 The Centralized Management setup of a parent organization changed: it was started or abandoned, its proposed administrators changed, its remaining organizations were force approved, or it completed.
4142
4143 - `"parent_organization_centralized_management_unenrolled"`
4144
4145 A parent organization was unenrolled from centralized management.
4146
4147 - `"parent_organization_member_removed"`
4148
4149 A parent-organization admin role was removed from a user.
4150
4151 - `"parent_organization_member_updated"`
4152
4153 A parent-organization admin role was granted or changed for a user.
4154
4155 - `"parent_organization_settings_updated"`
4156
4157 Parent organization settings were updated.
4158
40154159 - `"payment_method_updated"`
40164160
40174161 The organization's default payment method was updated.
from line 4859
47154859
47164860- `organization_ids: optional array of string`
47174861
4718 Filter activities by organization IDs (accepts `org_...` or organization UUID). Enumerate IDs via `GET /v1/compliance/organizations`.
4862 Filter activities by organization IDs (accepts `org_...` or organization UUID, up to 20). Enumerate IDs via `GET /v1/compliance/organizations`.
47194863
47204864- `user_ids: optional array of string`
47214865
from line 4877
47334877
47344878#### Returns
47354879
4736- `data: optional array of AbuseDecisionReceived or AccountDeleted or AccountMigrationCompleted or 571 more`
4880- `data: optional array of AbuseDecisionReceived or AccountDeleted or AccountMigrationCompleted or 589 more`
47374881
47384882 List of activity records. Each element's `type` field identifies which activity it is and which additional fields are present.
47394883
from line 9766
96229766
96239767 - `ClaudeArtifactPublished object`
96249768
9625 A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded when the artifact is saved, including saves of private artifacts, except that automatic saves made while a person keeps editing may be recorded periodically for that person rather than once per save; changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
9769 A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded when the artifact is saved, including saves of private artifacts and, for some artifacts, edits to stored content that make no new version, except that such edits, and automatic saves made while a person keeps editing, may be recorded periodically for that person rather than once per save; changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
96269770
96279771 - `type: optional "claude_artifact_published"`
96289772
from line 10242
1009810242
1009910243 - `audience: array of Organization or Users or AnyoneWithLink`
1010010244
10101 The artifact's sharing audience after the change. If empty, the artifact is visible only to its owner.
10245 The artifact's own sharing audience after the change. If empty, the artifact itself is not shared with named users, its organization or anyone with the link, but people can still have access in other ways, such as through a folder it is in or a folder above that one. Changes people make to a folder's sharing are recorded as `role_assignment_granted` and `role_assignment_revoked` activities on the folder, and moves as `claude_artifact_moved` and `claude_artifact_folder_moved`.
1010210246
1010310247 - `Organization object`
1010410248
from line 22142
2199822142
2199922143 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
2200022144
22145 - `ClaudeArtifactFolderCreated object`
22146
22147 A folder for artifacts was created, inside another folder or in none.
22148
22149 - `type: optional "claude_artifact_folder_created"`
22150
22151 default: claude_artifact_folder_created
22152
22153 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
22154
22155 - `APIActor object`
22156
22157 - `type: optional "api_actor"`
22158
22159 default: api_actor
22160
22161 - `api_key_id: string`
22162
22163 - `ip_address: string`
22164
22165 - `user_agent: string`
22166
22167 - `UserActor object`
22168
22169 - `type: optional "user_actor"`
22170
22171 default: user_actor
22172
22173 - `email_address: string`
22174
22175 format: email
22176
22177 - `ip_address: string`
22178
22179 - `user_agent: string`
22180
22181 - `user_id: string`
22182
22183 - `UnauthenticatedUserActor object`
22184
22185 - `type: optional "unauthenticated_user_actor"`
22186
22187 default: unauthenticated_user_actor
22188
22189 - `ip_address: string`
22190
22191 - `user_agent: string`
22192
22193 - `unauthenticated_email_address: optional string or null`
22194
22195 format: email
22196
22197 - `AnthropicActor object`
22198
22199 - `type: optional "anthropic_actor"`
22200
22201 default: anthropic_actor
22202
22203 - `email_address: optional string or null`
22204
22205 format: email
22206
22207 - `SystemActor object`
22208
22209 Automated background processing performed by Anthropic systems, acting
22210 without a user or customer credential.
22211
22212 - `type: optional "system_actor"`
22213
22214 default: system_actor
22215
22216 - `service: optional string or null`
22217
22218 Name of the automated process that performed the action, when known.
22219
22220 - `AdminAPIKeyActor object`
22221
22222 - `type: optional "admin_api_key_actor"`
22223
22224 default: admin_api_key_actor
22225
22226 - `admin_api_key_id: string`
22227
22228 - `ip_address: string`
22229
22230 - `user_agent: string`
22231
22232 - `ServiceAccountActor object`
22233
22234 - `type: optional "service_account_actor"`
22235
22236 default: service_account_actor
22237
22238 - `ip_address: string`
22239
22240 - `service_account_id: string`
22241
22242 - `user_agent: string`
22243
22244 - `ScimDirectorySyncActor object`
22245
22246 - `type: optional "scim_directory_sync_actor"`
22247
22248 default: scim_directory_sync_actor
22249
22250 - `directory_id: string`
22251
22252 - `workos_event_id: string`
22253
22254 - `idp_connection_type: optional string or null`
22255
22256 - `FederatedIdentityActor object`
22257
22258 A federated external workload authenticated via a verified OIDC token.
22259
22260 Carries the verified issuer, subject, and audience claims from the
22261 presented JWT.
22262
22263 - `type: optional "federated_identity_actor"`
22264
22265 default: federated_identity_actor
22266
22267 - `issuer: string`
22268
22269 - `subject: string`
22270
22271 - `audience: optional array of string`
22272
22273 - `ip_address: optional string or null`
22274
22275 - `user_agent: optional string or null`
22276
22277 - `FederatedActor object`
22278
22279 An external identity asserted by a trusted provider — a cloud-provider
22280 gateway or a customer-registered federation issuer — acting without an
22281 Anthropic-provisioned account or service account.
22282
22283 - `type: optional "federated_actor"`
22284
22285 default: federated_actor
22286
22287 - `provider: Aws or Azure or Gcp or Oidc`
22288
22289 - `Aws object`
22290
22291 Asserting party: the AWS account the organization is bound to.
22292
22293 - `type: optional "aws"`
22294
22295 default: aws
22296
22297 - `account_id: string`
22298
22299 - `signed_principal: string`
22300
22301 The AWS-signed ARN of the IAM principal that requested the token.
22302
22303 - `Azure object`
22304
22305 Asserting party: the Azure subscription the organization is bound to.
22306
22307 - `type: optional "azure"`
22308
22309 default: azure
22310
22311 - `subscription_id: string`
22312
22313 - `Gcp object`
22314
22315 Asserting party: the GCP project the organization is bound to.
22316
22317 - `type: optional "gcp"`
22318
22319 default: gcp
22320
22321 - `project_number: string`
22322
22323 - `Oidc object`
22324
22325 Asserting party: a customer-registered OIDC federation issuer.
22326
22327 - `type: optional "oidc"`
22328
22329 default: oidc
22330
22331 - `issuer: optional string or null`
22332
22333 The federation issuer's URL. Null when the presented credential failed verification.
22334
22335 - `ip_address: optional string or null`
22336
22337 - `subject: optional string or null`
22338
22339 The provider's verified identifier for the caller; its form depends on the provider.
22340
22341 - `user_agent: optional string or null`
22342
22343 - `AttestedDeviceActor object`
22344
22345 An attested mobile device authenticated via Apple App Attest.
22346
22347 - `type: optional "attested_device_actor"`
22348
22349 default: attested_device_actor
22350
22351 - `external_client_id: string`
22352
22353 - `kid_hash: string`
22354
22355 - `ip_address: optional string or null`
22356
22357 - `user_agent: optional string or null`
22358
22359 - `claude_artifact_folder_id: string`
22360
22361 Tagged ID ("cfld_...") of the folder that was created.
22362
22363 - `id: optional string`
22364
22365 Unique identifier for the activity e.g. 'activity_abcd1234'
22366
22367 - `created_at: optional string`
22368
22369 When this activity occurred.
22370
22371 format: date-time
22372
22373 - `organization_id: optional string or null`
22374
22375 Organization ID this activity is associated with
22376
22377 - `organization_uuid: optional string or null`
22378
22379 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
22380
22381 - `parent_claude_artifact_folder_id: optional string or null`
22382
22383 Tagged ID ("cfld_...") of the folder that the new folder was created directly inside; absent when it was created in no other folder.
22384
22385 - `ClaudeArtifactFolderMoved object`
22386
22387 A folder for artifacts was moved into, out of or between other folders, by its owner or by someone else, whether or not a folder is shared; the artifacts and folders inside it moved with it and were not recorded as moves of their own.
22388
22389 - `type: optional "claude_artifact_folder_moved"`
22390
22391 default: claude_artifact_folder_moved
22392
22393 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
22394
22395 - `APIActor object`
22396
22397 - `type: optional "api_actor"`
22398
22399 default: api_actor
22400
22401 - `api_key_id: string`
22402
22403 - `ip_address: string`
22404
22405 - `user_agent: string`
22406
22407 - `UserActor object`
22408
22409 - `type: optional "user_actor"`
22410
22411 default: user_actor
22412
22413 - `email_address: string`
22414
22415 format: email
22416
22417 - `ip_address: string`
22418
22419 - `user_agent: string`
22420
22421 - `user_id: string`
22422
22423 - `UnauthenticatedUserActor object`
22424
22425 - `type: optional "unauthenticated_user_actor"`
22426
22427 default: unauthenticated_user_actor
22428
22429 - `ip_address: string`
22430
22431 - `user_agent: string`
22432
22433 - `unauthenticated_email_address: optional string or null`
22434
22435 format: email
22436
22437 - `AnthropicActor object`
22438
22439 - `type: optional "anthropic_actor"`
22440
22441 default: anthropic_actor
22442
22443 - `email_address: optional string or null`
22444
22445 format: email
22446
22447 - `SystemActor object`
22448
22449 Automated background processing performed by Anthropic systems, acting
22450 without a user or customer credential.
22451
22452 - `type: optional "system_actor"`
22453
22454 default: system_actor
22455
22456 - `service: optional string or null`
22457
22458 Name of the automated process that performed the action, when known.
22459
22460 - `AdminAPIKeyActor object`
22461
22462 - `type: optional "admin_api_key_actor"`
22463
22464 default: admin_api_key_actor
22465
22466 - `admin_api_key_id: string`
22467
22468 - `ip_address: string`
22469
22470 - `user_agent: string`
22471
22472 - `ServiceAccountActor object`
22473
22474 - `type: optional "service_account_actor"`
22475
22476 default: service_account_actor
22477
22478 - `ip_address: string`
22479
22480 - `service_account_id: string`
22481
22482 - `user_agent: string`
22483
22484 - `ScimDirectorySyncActor object`
22485
22486 - `type: optional "scim_directory_sync_actor"`
22487
22488 default: scim_directory_sync_actor
22489
22490 - `directory_id: string`
22491
22492 - `workos_event_id: string`
22493
22494 - `idp_connection_type: optional string or null`
22495
22496 - `FederatedIdentityActor object`
22497
22498 A federated external workload authenticated via a verified OIDC token.
22499
22500 Carries the verified issuer, subject, and audience claims from the
22501 presented JWT.
22502
22503 - `type: optional "federated_identity_actor"`
22504
22505 default: federated_identity_actor
22506
22507 - `issuer: string`
22508
22509 - `subject: string`
22510
22511 - `audience: optional array of string`
22512
22513 - `ip_address: optional string or null`
22514
22515 - `user_agent: optional string or null`
22516
22517 - `FederatedActor object`
22518
22519 An external identity asserted by a trusted provider — a cloud-provider
22520 gateway or a customer-registered federation issuer — acting without an
22521 Anthropic-provisioned account or service account.
22522
22523 - `type: optional "federated_actor"`
22524
22525 default: federated_actor
22526
22527 - `provider: Aws or Azure or Gcp or Oidc`
22528
22529 - `Aws object`
22530
22531 Asserting party: the AWS account the organization is bound to.
22532
22533 - `type: optional "aws"`
22534
22535 default: aws
22536
22537 - `account_id: string`
22538
22539 - `signed_principal: string`
22540
22541 The AWS-signed ARN of the IAM principal that requested the token.
22542
22543 - `Azure object`
22544
22545 Asserting party: the Azure subscription the organization is bound to.
22546
22547 - `type: optional "azure"`
22548
22549 default: azure
22550
22551 - `subscription_id: string`
22552
22553 - `Gcp object`
22554
22555 Asserting party: the GCP project the organization is bound to.
22556
22557 - `type: optional "gcp"`
22558
22559 default: gcp
22560
22561 - `project_number: string`
22562
22563 - `Oidc object`
22564
22565 Asserting party: a customer-registered OIDC federation issuer.
22566
22567 - `type: optional "oidc"`
22568
22569 default: oidc
22570
22571 - `issuer: optional string or null`
22572
22573 The federation issuer's URL. Null when the presented credential failed verification.
22574
22575 - `ip_address: optional string or null`
22576
22577 - `subject: optional string or null`
22578
22579 The provider's verified identifier for the caller; its form depends on the provider.
22580
22581 - `user_agent: optional string or null`
22582
22583 - `AttestedDeviceActor object`
22584
22585 An attested mobile device authenticated via Apple App Attest.
22586
22587 - `type: optional "attested_device_actor"`
22588
22589 default: attested_device_actor
22590
22591 - `external_client_id: string`
22592
22593 - `kid_hash: string`
22594
22595 - `ip_address: optional string or null`
22596
22597 - `user_agent: optional string or null`
22598
22599 - `claude_artifact_folder_id: string`
22600
22601 Tagged ID ("cfld_...") of the folder that was moved.
22602
22603 - `id: optional string`
22604
22605 Unique identifier for the activity e.g. 'activity_abcd1234'
22606
22607 - `created_at: optional string`
22608
22609 When this activity occurred.
22610
22611 format: date-time
22612
22613 - `member_gained_count: optional number or null`
22614
22615 The number of people with whom a folder containing the moved folder, directly or through other folders, was individually shared after the move and none was before; people who gained access only another way, such as through a group or organization-wide sharing, are not counted, so zero does not mean that nobody gained access, and those counted can already have had access another way, for example through the moved folder's own sharing; absent when it could not be determined.
22616
22617 - `member_lost_count: optional number or null`
22618
22619 The number of people with whom a folder containing the moved folder, directly or through other folders, was individually shared before the move and none was after; people who had access only another way, such as through a group or organization-wide sharing, are not counted, so zero does not mean that nobody lost access, and those counted can still have access another way, for example through the moved folder's own sharing; absent when it could not be determined.
22620
22621 - `member_lowered_count: optional number or null`
22622
22623 The number of people with whom a folder containing the moved folder, directly or through other folders, was individually shared both before and after the move, at a lower access level after than before; a person's level is the highest that any of those folders gave them, and the moved folder's own sharing is not compared; absent when it could not be determined.
22624
22625 - `member_raised_count: optional number or null`
22626
22627 The number of people with whom a folder containing the moved folder, directly or through other folders, was individually shared both before and after the move, at a higher access level after than before; a person's level is the highest that any of those folders gave them, and the moved folder's own sharing is not compared; absent when it could not be determined.
22628
22629 - `moved_by_owner: optional boolean or null`
22630
22631 True when the person who moved the folder was its owner, false when it was someone else.
22632
22633 - `organization_id: optional string or null`
22634
22635 Organization ID this activity is associated with
22636
22637 - `organization_sharing_change: optional "gained" or "lost" or "lowered" or 3 more or null`
22638
22639 How the move changed the sharing with the whole organization of the folders containing the moved folder, directly or through other folders, by the highest access level that any of them gave the whole organization before and after the move: `gained` when none gave any before and one did after, `lost` when one did before and none did after, `raised` or `lowered` when that level was higher or lower after the move, `unchanged` when it was the same or none gave any; this follows the sharing saved on those folders, which can differ from who can open them, for example while sharing with the whole organization is turned off; the moved folder's own sharing is not compared; absent when it could not be determined.
22640
22641 - `"gained"`
22642
22643 - `"lost"`
22644
22645 - `"lowered"`
22646
22647 - `"raised"`
22648
22649 - `"unchanged"`
22650
22651 - `"unspecified"`
22652
22653 - `organization_uuid: optional string or null`
22654
22655 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
22656
22657 - `parent_claude_artifact_folder_id: optional string or null`
22658
22659 Tagged ID ("cfld_...") of the folder that directly contained the moved folder after the move; absent when the moved folder was left in no other folder.
22660
22661 - `previous_parent_claude_artifact_folder_id: optional string or null`
22662
22663 Tagged ID ("cfld_...") of the folder that directly contained the moved folder before the move; absent when the moved folder was in no other folder, or when that could not be determined.
22664
2200122665 - `ClaudeArtifactInviteAccepted object`
2200222666
2200322667 Someone outside the organization signed in with a verified account for the invited address and accepted an invitation to an artifact, and can now open it; recorded in the artifact owner's organization. The person who accepted is identified by `invitee_email` and `invitee_user_id`.
from line 23670
2300623670
2300723671 The access level the invitation granted before the change, for example `commenter`.
2300823672
23673 - `ClaudeArtifactMoved object`
23674
23675 An artifact was moved into, out of or between folders, by its owner or by someone else, whether or not a folder is shared; an artifact that leaves its folder as part of another event, such as its own deletion or the erasure of an account, might not be recorded as a move.
23676
23677 - `type: optional "claude_artifact_moved"`
23678
23679 default: claude_artifact_moved
23680
23681 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
23682
23683 - `APIActor object`
23684
23685 - `type: optional "api_actor"`
23686
23687 default: api_actor
23688
23689 - `api_key_id: string`
23690
23691 - `ip_address: string`
23692
23693 - `user_agent: string`
23694
23695 - `UserActor object`
23696
23697 - `type: optional "user_actor"`
23698
23699 default: user_actor
23700
23701 - `email_address: string`
23702
23703 format: email
23704
23705 - `ip_address: string`
23706
23707 - `user_agent: string`
23708
23709 - `user_id: string`
23710
23711 - `UnauthenticatedUserActor object`
23712
23713 - `type: optional "unauthenticated_user_actor"`
23714
23715 default: unauthenticated_user_actor
23716
23717 - `ip_address: string`
23718
23719 - `user_agent: string`
23720
23721 - `unauthenticated_email_address: optional string or null`
23722
23723 format: email
23724
23725 - `AnthropicActor object`
23726
23727 - `type: optional "anthropic_actor"`
23728
23729 default: anthropic_actor
23730
23731 - `email_address: optional string or null`
23732
23733 format: email
23734
23735 - `SystemActor object`
23736
23737 Automated background processing performed by Anthropic systems, acting
23738 without a user or customer credential.
23739
23740 - `type: optional "system_actor"`
23741
23742 default: system_actor
23743
23744 - `service: optional string or null`
23745
23746 Name of the automated process that performed the action, when known.
23747
23748 - `AdminAPIKeyActor object`
23749
23750 - `type: optional "admin_api_key_actor"`
23751
23752 default: admin_api_key_actor
23753
23754 - `admin_api_key_id: string`
23755
23756 - `ip_address: string`
23757
23758 - `user_agent: string`
23759
23760 - `ServiceAccountActor object`
23761
23762 - `type: optional "service_account_actor"`
23763
23764 default: service_account_actor
23765
23766 - `ip_address: string`
23767
23768 - `service_account_id: string`
23769
23770 - `user_agent: string`
23771
23772 - `ScimDirectorySyncActor object`
23773
23774 - `type: optional "scim_directory_sync_actor"`
23775
23776 default: scim_directory_sync_actor
23777
23778 - `directory_id: string`
23779
23780 - `workos_event_id: string`
23781
23782 - `idp_connection_type: optional string or null`
23783
23784 - `FederatedIdentityActor object`
23785
23786 A federated external workload authenticated via a verified OIDC token.
23787
23788 Carries the verified issuer, subject, and audience claims from the
23789 presented JWT.
23790
23791 - `type: optional "federated_identity_actor"`
23792
23793 default: federated_identity_actor
23794
23795 - `issuer: string`
23796
23797 - `subject: string`
23798
23799 - `audience: optional array of string`
23800
23801 - `ip_address: optional string or null`
23802
23803 - `user_agent: optional string or null`
23804
23805 - `FederatedActor object`
23806
23807 An external identity asserted by a trusted provider — a cloud-provider
23808 gateway or a customer-registered federation issuer — acting without an
23809 Anthropic-provisioned account or service account.
23810
23811 - `type: optional "federated_actor"`
23812
23813 default: federated_actor
23814
23815 - `provider: Aws or Azure or Gcp or Oidc`
23816
23817 - `Aws object`
23818
23819 Asserting party: the AWS account the organization is bound to.
23820
23821 - `type: optional "aws"`
23822
23823 default: aws
23824
23825 - `account_id: string`
23826
23827 - `signed_principal: string`
23828
23829 The AWS-signed ARN of the IAM principal that requested the token.
23830
23831 - `Azure object`
23832
23833 Asserting party: the Azure subscription the organization is bound to.
23834
23835 - `type: optional "azure"`
23836
23837 default: azure
23838
23839 - `subscription_id: string`
23840
23841 - `Gcp object`
23842
23843 Asserting party: the GCP project the organization is bound to.
23844
23845 - `type: optional "gcp"`
23846
23847 default: gcp
23848
23849 - `project_number: string`
23850
23851 - `Oidc object`
23852
23853 Asserting party: a customer-registered OIDC federation issuer.
23854
23855 - `type: optional "oidc"`
23856
23857 default: oidc
23858
23859 - `issuer: optional string or null`
23860
23861 The federation issuer's URL. Null when the presented credential failed verification.
23862
23863 - `ip_address: optional string or null`
23864
23865 - `subject: optional string or null`
23866
23867 The provider's verified identifier for the caller; its form depends on the provider.
23868
23869 - `user_agent: optional string or null`
23870
23871 - `AttestedDeviceActor object`
23872
23873 An attested mobile device authenticated via Apple App Attest.
23874
23875 - `type: optional "attested_device_actor"`
23876
23877 default: attested_device_actor
23878
23879 - `external_client_id: string`
23880
23881 - `kid_hash: string`
23882
23883 - `ip_address: optional string or null`
23884
23885 - `user_agent: optional string or null`
23886
23887 - `claude_artifact_id: string`
23888
23889 Tagged ID of the artifact that was moved.
23890
23891 - `id: optional string`
23892
23893 Unique identifier for the activity e.g. 'activity_abcd1234'
23894
23895 - `created_at: optional string`
23896
23897 When this activity occurred.
23898
23899 format: date-time
23900
23901 - `member_gained_count: optional number or null`
23902
23903 The number of people with whom the folder holding the artifact, or a folder containing that folder, was individually shared after the move and none was before; people reached only through a group or organization-wide sharing are not counted, so zero does not mean that nobody gained access, and all four counts are absent when they could not be determined.
23904
23905 - `member_lost_count: optional number or null`
23906
23907 The number of people with whom the folder holding the artifact, or a folder containing that folder, was individually shared before the move and none was after; people who had access only through a group or organization-wide sharing are not counted, so zero does not mean that nobody lost access, and those counted may still have access to the artifact another way.
23908
23909 - `member_lowered_count: optional number or null`
23910
23911 The number of people whose individually shared access level, through the folder holding the artifact and the folders containing that folder, was lower after the move than before.
23912
23913 - `member_raised_count: optional number or null`
23914
23915 The number of people whose individually shared access level, through the folder holding the artifact and the folders containing that folder, was higher after the move than before.
23916
23917 - `moved_by_owner: optional boolean or null`
23918
23919 True when the person who moved the artifact was its owner, false when it was someone else.
23920
23921 - `organization_id: optional string or null`
23922
23923 Organization ID this activity is associated with
23924
23925 - `organization_uuid: optional string or null`
23926
23927 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
23928
23929 - `parent_claude_artifact_folder_id: optional string or null`
23930
23931 Tagged ID ("cfld_...") of the folder the artifact was in after the move; absent when it was left in no folder.
23932
23933 - `previous_parent_claude_artifact_folder_id: optional string or null`
23934
23935 Tagged ID ("cfld_...") of the folder the artifact was in before the move; absent when it was in no folder, or when that could not be determined.
23936
2300923937 - `ClaudeArtifactSentToPartner object`
2301023938
2301123939 A member sent an export of an artifact to a partner application ("Send to …" on the artifact; a partner is a third-party application listed in Claude's connector directory): a file exported from the artifact was made available over a temporary link for the chosen partner to fetch. One activity is recorded per send, in the artifact owner's organization with the sending member as actor, whether or not the partner then retrieved the file; the partner's own import of the file is not part of this record. The file's name and contents are not recorded.
from line 32630
3170232630
3170332631 format: date-time
3170432632
32633 - `finding_id: optional string or null`
32634
32635 Tagged ID of the finding the session was created for, omitted from some events, such as those recorded before this field was introduced.
32636
3170532637 - `organization_id: optional string or null`
3170632638
3170732639 Organization ID this activity is associated with
from line 32642
3171032642
3171132643 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
3171232644
32645 - `scan_project_id: optional string or null`
32646
32647 Tagged ID of the scan project the finding belongs to, omitted from some events, such as those recorded before this field was introduced.
32648
3171332649 - `ClaudeCodeSecurityVulnerabilityUpdated object`
3171432650
3171532651 A Claude Code Security vulnerability finding was dismissed, restored, marked fixed, or reopened.
from line 44920
4398444920
4398544921 - `marketplace_id: optional string or null`
4398644922
43987 The marketplace of the plugin that carries the skill; unset for a standalone skill.
44923 The marketplace of the plugin that carries the skill, if any.
4398844924
4398944925 - `organization_id: optional string or null`
4399044926
from line 44936
4400044936
4400144937 - `plugin_id: optional string or null`
4400244938
44003 The plugin that carries the skill; unset for a standalone skill.
44939 The plugin that carries the skill, if any.
4400444940
4400544941 - `scope: optional "organization" or "personal" or "unspecified" or null`
4400644942
from line 45282
4434645282
4434745283 Name of the skill (its SKILL.md name, as on the other skill activities).
4434845284
45285 - `ClaudeSkillServedVersionUpdated object`
45286
45287 A skill's served version, the version that members get, was updated: an administrator or the owner chose a version, a saved version became the served version, or an accepted library submission was published into the skill. A new version that is served as soon as it is saved may appear only as claude_skill_version_created.
45288
45289 - `type: optional "claude_skill_served_version_updated"`
45290
45291 default: claude_skill_served_version_updated
45292
45293 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
45294
45295 - `APIActor object`
45296
45297 - `type: optional "api_actor"`
45298
45299 default: api_actor
45300
45301 - `api_key_id: string`
45302
45303 - `ip_address: string`
45304
45305 - `user_agent: string`
45306
45307 - `UserActor object`
45308
45309 - `type: optional "user_actor"`
45310
45311 default: user_actor
45312
45313 - `email_address: string`
45314
45315 format: email
45316
45317 - `ip_address: string`
45318
45319 - `user_agent: string`
45320
45321 - `user_id: string`
45322
45323 - `UnauthenticatedUserActor object`
45324
45325 - `type: optional "unauthenticated_user_actor"`
45326
45327 default: unauthenticated_user_actor
45328
45329 - `ip_address: string`
45330
45331 - `user_agent: string`
45332
45333 - `unauthenticated_email_address: optional string or null`
45334
45335 format: email
45336
45337 - `AnthropicActor object`
45338
45339 - `type: optional "anthropic_actor"`
45340
45341 default: anthropic_actor
45342
45343 - `email_address: optional string or null`
45344
45345 format: email
45346
45347 - `SystemActor object`
45348
45349 Automated background processing performed by Anthropic systems, acting
45350 without a user or customer credential.
45351
45352 - `type: optional "system_actor"`
45353
45354 default: system_actor
45355
45356 - `service: optional string or null`
45357
45358 Name of the automated process that performed the action, when known.
45359
45360 - `AdminAPIKeyActor object`
45361
45362 - `type: optional "admin_api_key_actor"`
45363
45364 default: admin_api_key_actor
45365
45366 - `admin_api_key_id: string`
45367
45368 - `ip_address: string`
45369
45370 - `user_agent: string`
45371
45372 - `ServiceAccountActor object`
45373
45374 - `type: optional "service_account_actor"`
45375
45376 default: service_account_actor
45377
45378 - `ip_address: string`
45379
45380 - `service_account_id: string`
45381
45382 - `user_agent: string`
45383
45384 - `ScimDirectorySyncActor object`
45385
45386 - `type: optional "scim_directory_sync_actor"`
45387
45388 default: scim_directory_sync_actor
45389
45390 - `directory_id: string`
45391
45392 - `workos_event_id: string`
45393
45394 - `idp_connection_type: optional string or null`
45395
45396 - `FederatedIdentityActor object`
45397
45398 A federated external workload authenticated via a verified OIDC token.
45399
45400 Carries the verified issuer, subject, and audience claims from the
45401 presented JWT.
45402
45403 - `type: optional "federated_identity_actor"`
45404
45405 default: federated_identity_actor
45406
45407 - `issuer: string`
45408
45409 - `subject: string`
45410
45411 - `audience: optional array of string`
45412
45413 - `ip_address: optional string or null`
45414
45415 - `user_agent: optional string or null`
45416
45417 - `FederatedActor object`
45418
45419 An external identity asserted by a trusted provider — a cloud-provider
45420 gateway or a customer-registered federation issuer — acting without an
45421 Anthropic-provisioned account or service account.
45422
45423 - `type: optional "federated_actor"`
45424
45425 default: federated_actor
45426
45427 - `provider: Aws or Azure or Gcp or Oidc`
45428
45429 - `Aws object`
45430
45431 Asserting party: the AWS account the organization is bound to.
45432
45433 - `type: optional "aws"`
45434
45435 default: aws
45436
45437 - `account_id: string`
45438
45439 - `signed_principal: string`
45440
45441 The AWS-signed ARN of the IAM principal that requested the token.
45442
45443 - `Azure object`
45444
45445 Asserting party: the Azure subscription the organization is bound to.
45446
45447 - `type: optional "azure"`
45448
45449 default: azure
45450
45451 - `subscription_id: string`
45452
45453 - `Gcp object`
45454
45455 Asserting party: the GCP project the organization is bound to.
45456
45457 - `type: optional "gcp"`
45458
45459 default: gcp
45460
45461 - `project_number: string`
45462
45463 - `Oidc object`
45464
45465 Asserting party: a customer-registered OIDC federation issuer.
45466
45467 - `type: optional "oidc"`
45468
45469 default: oidc
45470
45471 - `issuer: optional string or null`
45472
45473 The federation issuer's URL. Null when the presented credential failed verification.
45474
45475 - `ip_address: optional string or null`
45476
45477 - `subject: optional string or null`
45478
45479 The provider's verified identifier for the caller; its form depends on the provider.
45480
45481 - `user_agent: optional string or null`
45482
45483 - `AttestedDeviceActor object`
45484
45485 An attested mobile device authenticated via Apple App Attest.
45486
45487 - `type: optional "attested_device_actor"`
45488
45489 default: attested_device_actor
45490
45491 - `external_client_id: string`
45492
45493 - `kid_hash: string`
45494
45495 - `ip_address: optional string or null`
45496
45497 - `user_agent: optional string or null`
45498
45499 - `scope: "organization" or "personal" or "unspecified"`
45500
45501 Whether the skill is the member's own or the organization's.
45502
45503 - `"organization"`
45504
45505 - `"personal"`
45506
45507 - `"unspecified"`
45508
45509 - `to_skill_version: string`
45510
45511 The number of the served version after the update.
45512
45513 - `trigger: "library_publish" or "manual" or "save" or "unspecified"`
45514
45515 What caused the update.
45516
45517 - `"library_publish"`
45518
45519 - `"manual"`
45520
45521 - `"save"`
45522
45523 - `"unspecified"`
45524
45525 - `id: optional string`
45526
45527 Unique identifier for the activity e.g. 'activity_abcd1234'
45528
45529 - `created_at: optional string`
45530
45531 When this activity occurred.
45532
45533 format: date-time
45534
45535 - `from_skill_version: optional string or null`
45536
45537 The number of the served version before the update; the same as to_skill_version when that version was already being served. Unset when the skill had no served version or the number could not be read.
45538
45539 - `organization_id: optional string or null`
45540
45541 Organization ID this activity is associated with
45542
45543 - `organization_uuid: optional string or null`
45544
45545 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
45546
45547 - `owner_user_id: optional string or null`
45548
45549 The member who owns the skill; unset for an organization-owned skill.
45550
45551 - `skill_id: optional string or null`
45552
45553 The skill whose served version was updated.
45554
45555 - `skill_name: optional string or null`
45556
45557 The name of the skill whose served version was updated.
45558
45559 - `ClaudeSkillVersionCreated object`
45560
45561 A new version of a skill was created.
45562
45563 - `type: optional "claude_skill_version_created"`
45564
45565 default: claude_skill_version_created
45566
45567 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
45568
45569 - `APIActor object`
45570
45571 - `type: optional "api_actor"`
45572
45573 default: api_actor
45574
45575 - `api_key_id: string`
45576
45577 - `ip_address: string`
45578
45579 - `user_agent: string`
45580
45581 - `UserActor object`
45582
45583 - `type: optional "user_actor"`
45584
45585 default: user_actor
45586
45587 - `email_address: string`
45588
45589 format: email
45590
45591 - `ip_address: string`
45592
45593 - `user_agent: string`
45594
45595 - `user_id: string`
45596
45597 - `UnauthenticatedUserActor object`
45598
45599 - `type: optional "unauthenticated_user_actor"`
45600
45601 default: unauthenticated_user_actor
45602
45603 - `ip_address: string`
45604
45605 - `user_agent: string`
45606
45607 - `unauthenticated_email_address: optional string or null`
45608
45609 format: email
45610
45611 - `AnthropicActor object`
45612
45613 - `type: optional "anthropic_actor"`
45614
45615 default: anthropic_actor
45616
45617 - `email_address: optional string or null`
45618
45619 format: email
45620
45621 - `SystemActor object`
45622
45623 Automated background processing performed by Anthropic systems, acting
45624 without a user or customer credential.
45625
45626 - `type: optional "system_actor"`
45627
45628 default: system_actor
45629
45630 - `service: optional string or null`
45631
45632 Name of the automated process that performed the action, when known.
45633
45634 - `AdminAPIKeyActor object`
45635
45636 - `type: optional "admin_api_key_actor"`
45637
45638 default: admin_api_key_actor
45639
45640 - `admin_api_key_id: string`
45641
45642 - `ip_address: string`
45643
45644 - `user_agent: string`
45645
45646 - `ServiceAccountActor object`
45647
45648 - `type: optional "service_account_actor"`
45649
45650 default: service_account_actor
45651
45652 - `ip_address: string`
45653
45654 - `service_account_id: string`
45655
45656 - `user_agent: string`
45657
45658 - `ScimDirectorySyncActor object`
45659
45660 - `type: optional "scim_directory_sync_actor"`
45661
45662 default: scim_directory_sync_actor
45663
45664 - `directory_id: string`
45665
45666 - `workos_event_id: string`
45667
45668 - `idp_connection_type: optional string or null`
45669
45670 - `FederatedIdentityActor object`
45671
45672 A federated external workload authenticated via a verified OIDC token.
45673
45674 Carries the verified issuer, subject, and audience claims from the
45675 presented JWT.
45676
45677 - `type: optional "federated_identity_actor"`
45678
45679 default: federated_identity_actor
45680
45681 - `issuer: string`
45682
45683 - `subject: string`
45684
45685 - `audience: optional array of string`
45686
45687 - `ip_address: optional string or null`
45688
45689 - `user_agent: optional string or null`
45690
45691 - `FederatedActor object`
45692
45693 An external identity asserted by a trusted provider — a cloud-provider
45694 gateway or a customer-registered federation issuer — acting without an
45695 Anthropic-provisioned account or service account.
45696
45697 - `type: optional "federated_actor"`
45698
45699 default: federated_actor
45700
45701 - `provider: Aws or Azure or Gcp or Oidc`
45702
45703 - `Aws object`
45704
45705 Asserting party: the AWS account the organization is bound to.
45706
45707 - `type: optional "aws"`
45708
45709 default: aws
45710
45711 - `account_id: string`
45712
45713 - `signed_principal: string`
45714
45715 The AWS-signed ARN of the IAM principal that requested the token.
45716
45717 - `Azure object`
45718
45719 Asserting party: the Azure subscription the organization is bound to.
45720
45721 - `type: optional "azure"`
45722
45723 default: azure
45724
45725 - `subscription_id: string`
45726
45727 - `Gcp object`
45728
45729 Asserting party: the GCP project the organization is bound to.
45730
45731 - `type: optional "gcp"`
45732
45733 default: gcp
45734
45735 - `project_number: string`
45736
45737 - `Oidc object`
45738
45739 Asserting party: a customer-registered OIDC federation issuer.
45740
45741 - `type: optional "oidc"`
45742
45743 default: oidc
45744
45745 - `issuer: optional string or null`
45746
45747 The federation issuer's URL. Null when the presented credential failed verification.
45748
45749 - `ip_address: optional string or null`
45750
45751 - `subject: optional string or null`
45752
45753 The provider's verified identifier for the caller; its form depends on the provider.
45754
45755 - `user_agent: optional string or null`
45756
45757 - `AttestedDeviceActor object`
45758
45759 An attested mobile device authenticated via Apple App Attest.
45760
45761 - `type: optional "attested_device_actor"`
45762
45763 default: attested_device_actor
45764
45765 - `external_client_id: string`
45766
45767 - `kid_hash: string`
45768
45769 - `ip_address: optional string or null`
45770
45771 - `user_agent: optional string or null`
45772
45773 - `scope: "organization" or "personal" or "unspecified"`
45774
45775 Whether the skill is the member's own or the organization's.
45776
45777 - `"organization"`
45778
45779 - `"personal"`
45780
45781 - `"unspecified"`
45782
45783 - `skill_version: string`
45784
45785 The number of the new version.
45786
45787 - `id: optional string`
45788
45789 Unique identifier for the activity e.g. 'activity_abcd1234'
45790
45791 - `created_at: optional string`
45792
45793 When this activity occurred.
45794
45795 format: date-time
45796
45797 - `organization_id: optional string or null`
45798
45799 Organization ID this activity is associated with
45800
45801 - `organization_uuid: optional string or null`
45802
45803 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
45804
45805 - `owner_user_id: optional string or null`
45806
45807 The member who owns the skill; unset for an organization-owned skill.
45808
45809 - `skill_id: optional string or null`
45810
45811 The skill that gained a version.
45812
45813 - `skill_name: optional string or null`
45814
45815 The name of the skill that gained a version.
45816
4434945817 - `ClaudeSurveyClosed object`
4435045818
4435145819 An organization admin closed an in-app survey before its end date, ending the collection of responses; a survey that reaches its end date records no event.
from line 53900
5243253900
5243353901 - `rbac_inclusion_enabled: optional boolean or null`
5243453902
52435 Whether Inference hooks apply only to members whose role grants the Inference hooks inspection permission, as configured after this change. Null means the setting is off: either nothing has been saved for it, or it is not available to the organization. When on, requests from members whose roles do not grant that permission are not sent to the organization's endpoint. Only a custom role that this permission was added to grants it; a role set to grant all capabilities, or all generally available capabilities, does not grant it. Members on one of the organization's built-in roles (such as User, Admin, or Owner) rather than a custom role never have this permission. Requests not tied to a member, such as those made with an API key, are not sent either, and neither are requests from Claude in Slack conversations.
53903 Whether Inference hooks apply only to members whose role grants the Inference hooks inspection permission, as configured after this change. Null means the setting is off: either nothing has been saved for it, or it is not available to the organization. When on, requests from members whose roles do not grant that permission are not sent to the organization's endpoint. Only a custom role that this permission was added to grants it; setting a role's "Capability access" to "All capabilities" or "All generally available" does not grant it. Members on one of the organization's built-in roles (such as User, Admin, or Owner) rather than a custom role never have this permission. Requests not tied to a member, such as those made with an API key, are not sent either, and neither are requests from Claude in Slack conversations.
5243653904
5243753905 - `reset_circuit_breaker: optional boolean or null`
5243853906
from line 82570
8110282570
8110382571 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
8110482572
82573 - `OrgDomainSSOEnforcementUpdated object`
82574
82575 A verified domain's single sign-on requirement changed, per surface.
82576
82577 - `type: optional "org_domain_sso_enforcement_updated"`
82578
82579 default: org_domain_sso_enforcement_updated
82580
82581 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
82582
82583 - `APIActor object`
82584
82585 - `type: optional "api_actor"`
82586
82587 default: api_actor
82588
82589 - `api_key_id: string`
82590
82591 - `ip_address: string`
82592
82593 - `user_agent: string`
82594
82595 - `UserActor object`
82596
82597 - `type: optional "user_actor"`
82598
82599 default: user_actor
82600
82601 - `email_address: string`
82602
82603 format: email
82604
82605 - `ip_address: string`
82606
82607 - `user_agent: string`
82608
82609 - `user_id: string`
82610
82611 - `UnauthenticatedUserActor object`
82612
82613 - `type: optional "unauthenticated_user_actor"`
82614
82615 default: unauthenticated_user_actor
82616
82617 - `ip_address: string`
82618
82619 - `user_agent: string`
82620
82621 - `unauthenticated_email_address: optional string or null`
82622
82623 format: email
82624
82625 - `AnthropicActor object`
82626
82627 - `type: optional "anthropic_actor"`
82628
82629 default: anthropic_actor
82630
82631 - `email_address: optional string or null`
82632
82633 format: email
82634
82635 - `SystemActor object`
82636
82637 Automated background processing performed by Anthropic systems, acting
82638 without a user or customer credential.
82639
82640 - `type: optional "system_actor"`
82641
82642 default: system_actor
82643
82644 - `service: optional string or null`
82645
82646 Name of the automated process that performed the action, when known.
82647
82648 - `AdminAPIKeyActor object`
82649
82650 - `type: optional "admin_api_key_actor"`
82651
82652 default: admin_api_key_actor
82653
82654 - `admin_api_key_id: string`
82655
82656 - `ip_address: string`
82657
82658 - `user_agent: string`
82659
82660 - `ServiceAccountActor object`
82661
82662 - `type: optional "service_account_actor"`
82663
82664 default: service_account_actor
82665
82666 - `ip_address: string`
82667
82668 - `service_account_id: string`
82669
82670 - `user_agent: string`
82671
82672 - `ScimDirectorySyncActor object`
82673
82674 - `type: optional "scim_directory_sync_actor"`
82675
82676 default: scim_directory_sync_actor
82677
82678 - `directory_id: string`
82679
82680 - `workos_event_id: string`
82681
82682 - `idp_connection_type: optional string or null`
82683
82684 - `FederatedIdentityActor object`
82685
82686 A federated external workload authenticated via a verified OIDC token.
82687
82688 Carries the verified issuer, subject, and audience claims from the
82689 presented JWT.
82690
82691 - `type: optional "federated_identity_actor"`
82692
82693 default: federated_identity_actor
82694
82695 - `issuer: string`
82696
82697 - `subject: string`
82698
82699 - `audience: optional array of string`
82700
82701 - `ip_address: optional string or null`
82702
82703 - `user_agent: optional string or null`
82704
82705 - `FederatedActor object`
82706
82707 An external identity asserted by a trusted provider — a cloud-provider
82708 gateway or a customer-registered federation issuer — acting without an
82709 Anthropic-provisioned account or service account.
82710
82711 - `type: optional "federated_actor"`
82712
82713 default: federated_actor
82714
82715 - `provider: Aws or Azure or Gcp or Oidc`
82716
82717 - `Aws object`
82718
82719 Asserting party: the AWS account the organization is bound to.
82720
82721 - `type: optional "aws"`
82722
82723 default: aws
82724
82725 - `account_id: string`
82726
82727 - `signed_principal: string`
82728
82729 The AWS-signed ARN of the IAM principal that requested the token.
82730
82731 - `Azure object`
82732
82733 Asserting party: the Azure subscription the organization is bound to.
82734
82735 - `type: optional "azure"`
82736
82737 default: azure
82738
82739 - `subscription_id: string`
82740
82741 - `Gcp object`
82742
82743 Asserting party: the GCP project the organization is bound to.
82744
82745 - `type: optional "gcp"`
82746
82747 default: gcp
82748
82749 - `project_number: string`
82750
82751 - `Oidc object`
82752
82753 Asserting party: a customer-registered OIDC federation issuer.
82754
82755 - `type: optional "oidc"`
82756
82757 default: oidc
82758
82759 - `issuer: optional string or null`
82760
82761 The federation issuer's URL. Null when the presented credential failed verification.
82762
82763 - `ip_address: optional string or null`
82764
82765 - `subject: optional string or null`
82766
82767 The provider's verified identifier for the caller; its form depends on the provider.
82768
82769 - `user_agent: optional string or null`
82770
82771 - `AttestedDeviceActor object`
82772
82773 An attested mobile device authenticated via Apple App Attest.
82774
82775 - `type: optional "attested_device_actor"`
82776
82777 default: attested_device_actor
82778
82779 - `external_client_id: string`
82780
82781 - `kid_hash: string`
82782
82783 - `ip_address: optional string or null`
82784
82785 - `user_agent: optional string or null`
82786
82787 - `claudeai_sso_enforced: boolean`
82788
82789 Whether single sign-on is required on claude.ai after the change.
82790
82791 - `console_sso_enforced: boolean`
82792
82793 Whether single sign-on is required on the Console after the change.
82794
82795 - `domain: string`
82796
82797 The verified domain whose requirement changed.
82798
82799 - `previous_claudeai_sso_enforced: boolean`
82800
82801 Whether single sign-on was required on claude.ai before the change.
82802
82803 - `previous_console_sso_enforced: boolean`
82804
82805 Whether single sign-on was required on the Console before the change.
82806
82807 - `id: optional string`
82808
82809 Unique identifier for the activity e.g. 'activity_abcd1234'
82810
82811 - `created_at: optional string`
82812
82813 When this activity occurred.
82814
82815 format: date-time
82816
82817 - `idp_connection_ids: optional array of string`
82818
82819 The identity provider connections (e.g. "idpc_01Ab...") the domain routes to at the time of the change, in the order they were added to the domain. Empty if it routes to none.
82820
82821 - `organization_id: optional string or null`
82822
82823 Organization ID this activity is associated with
82824
82825 - `organization_uuid: optional string or null`
82826
82827 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
82828
82829 - `OrgDomainSSORoutingUpdated object`
82830
82831 A verified domain's single sign-on routing was saved or changed. Lists the identity provider connections the domain's users sign in through before and after; the two lists are the same when a save changed nothing.
82832
82833 - `type: optional "org_domain_sso_routing_updated"`
82834
82835 default: org_domain_sso_routing_updated
82836
82837 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
82838
82839 - `APIActor object`
82840
82841 - `type: optional "api_actor"`
82842
82843 default: api_actor
82844
82845 - `api_key_id: string`
82846
82847 - `ip_address: string`
82848
82849 - `user_agent: string`
82850
82851 - `UserActor object`
82852
82853 - `type: optional "user_actor"`
82854
82855 default: user_actor
82856
82857 - `email_address: string`
82858
82859 format: email
82860
82861 - `ip_address: string`
82862
82863 - `user_agent: string`
82864
82865 - `user_id: string`
82866
82867 - `UnauthenticatedUserActor object`
82868
82869 - `type: optional "unauthenticated_user_actor"`
82870
82871 default: unauthenticated_user_actor
82872
82873 - `ip_address: string`
82874
82875 - `user_agent: string`
82876
82877 - `unauthenticated_email_address: optional string or null`
82878
82879 format: email
82880
82881 - `AnthropicActor object`
82882
82883 - `type: optional "anthropic_actor"`
82884
82885 default: anthropic_actor
82886
82887 - `email_address: optional string or null`
82888
82889 format: email
82890
82891 - `SystemActor object`
82892
82893 Automated background processing performed by Anthropic systems, acting
82894 without a user or customer credential.
82895
82896 - `type: optional "system_actor"`
82897
82898 default: system_actor
82899
82900 - `service: optional string or null`
82901
82902 Name of the automated process that performed the action, when known.
82903
82904 - `AdminAPIKeyActor object`
82905
82906 - `type: optional "admin_api_key_actor"`
82907
82908 default: admin_api_key_actor
82909
82910 - `admin_api_key_id: string`
82911
82912 - `ip_address: string`
82913
82914 - `user_agent: string`
82915
82916 - `ServiceAccountActor object`
82917
82918 - `type: optional "service_account_actor"`
82919
82920 default: service_account_actor
82921
82922 - `ip_address: string`
82923
82924 - `service_account_id: string`
82925
82926 - `user_agent: string`
82927
82928 - `ScimDirectorySyncActor object`
82929
82930 - `type: optional "scim_directory_sync_actor"`
82931
82932 default: scim_directory_sync_actor
82933
82934 - `directory_id: string`
82935
82936 - `workos_event_id: string`
82937
82938 - `idp_connection_type: optional string or null`
82939
82940 - `FederatedIdentityActor object`
82941
82942 A federated external workload authenticated via a verified OIDC token.
82943
82944 Carries the verified issuer, subject, and audience claims from the
82945 presented JWT.
82946
82947 - `type: optional "federated_identity_actor"`
82948
82949 default: federated_identity_actor
82950
82951 - `issuer: string`
82952
82953 - `subject: string`
82954
82955 - `audience: optional array of string`
82956
82957 - `ip_address: optional string or null`
82958
82959 - `user_agent: optional string or null`
82960
82961 - `FederatedActor object`
82962
82963 An external identity asserted by a trusted provider — a cloud-provider
82964 gateway or a customer-registered federation issuer — acting without an
82965 Anthropic-provisioned account or service account.
82966
82967 - `type: optional "federated_actor"`
82968
82969 default: federated_actor
82970
82971 - `provider: Aws or Azure or Gcp or Oidc`
82972
82973 - `Aws object`
82974
82975 Asserting party: the AWS account the organization is bound to.
82976
82977 - `type: optional "aws"`
82978
82979 default: aws
82980
82981 - `account_id: string`
82982
82983 - `signed_principal: string`
82984
82985 The AWS-signed ARN of the IAM principal that requested the token.
82986
82987 - `Azure object`
82988
82989 Asserting party: the Azure subscription the organization is bound to.
82990
82991 - `type: optional "azure"`
82992
82993 default: azure
82994
82995 - `subscription_id: string`
82996
82997 - `Gcp object`
82998
82999 Asserting party: the GCP project the organization is bound to.
83000
83001 - `type: optional "gcp"`
83002
83003 default: gcp
83004
83005 - `project_number: string`
83006
83007 - `Oidc object`
83008
83009 Asserting party: a customer-registered OIDC federation issuer.
83010
83011 - `type: optional "oidc"`
83012
83013 default: oidc
83014
83015 - `issuer: optional string or null`
83016
83017 The federation issuer's URL. Null when the presented credential failed verification.
83018
83019 - `ip_address: optional string or null`
83020
83021 - `subject: optional string or null`
83022
83023 The provider's verified identifier for the caller; its form depends on the provider.
83024
83025 - `user_agent: optional string or null`
83026
83027 - `AttestedDeviceActor object`
83028
83029 An attested mobile device authenticated via Apple App Attest.
83030
83031 - `type: optional "attested_device_actor"`
83032
83033 default: attested_device_actor
83034
83035 - `external_client_id: string`
83036
83037 - `kid_hash: string`
83038
83039 - `ip_address: optional string or null`
83040
83041 - `user_agent: optional string or null`
83042
83043 - `domain: string`
83044
83045 The verified domain whose routing changed.
83046
83047 - `id: optional string`
83048
83049 Unique identifier for the activity e.g. 'activity_abcd1234'
83050
83051 - `created_at: optional string`
83052
83053 When this activity occurred.
83054
83055 format: date-time
83056
83057 - `idp_connection_ids: optional array of string`
83058
83059 The identity provider connections (e.g. "idpc_01Ab...") the domain routes to after, in the order they were added to the domain. Empty if it routes to none.
83060
83061 - `organization_id: optional string or null`
83062
83063 Organization ID this activity is associated with
83064
83065 - `organization_uuid: optional string or null`
83066
83067 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
83068
83069 - `previous_idp_connection_ids: optional array of string`
83070
83071 The identity provider connections (e.g. "idpc_01Ab...") the domain routed to before, in the order they were added to the domain. Empty if it routed to none.
83072
8110583073 - `OrgDomainVerified object`
8110683074
8110783075 Organization domain was verified.
from line 85986
8401885986
8401985987 The IP range before this change; absent unless the range itself was changed.
8402085988
85989 - `OrgIdpConnectionCreated object`
85990
85991 An identity provider connection was added to the parent organization.
85992
85993 - `type: optional "org_idp_connection_created"`
85994
85995 default: org_idp_connection_created
85996
85997 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
85998
85999 - `APIActor object`
86000
86001 - `type: optional "api_actor"`
86002
86003 default: api_actor
86004
86005 - `api_key_id: string`
86006
86007 - `ip_address: string`
86008
86009 - `user_agent: string`
86010
86011 - `UserActor object`
86012
86013 - `type: optional "user_actor"`
86014
86015 default: user_actor
86016
86017 - `email_address: string`
86018
86019 format: email
86020
86021 - `ip_address: string`
86022
86023 - `user_agent: string`
86024
86025 - `user_id: string`
86026
86027 - `UnauthenticatedUserActor object`
86028
86029 - `type: optional "unauthenticated_user_actor"`
86030
86031 default: unauthenticated_user_actor
86032
86033 - `ip_address: string`
86034
86035 - `user_agent: string`
86036
86037 - `unauthenticated_email_address: optional string or null`
86038
86039 format: email
86040
86041 - `AnthropicActor object`
86042
86043 - `type: optional "anthropic_actor"`
86044
86045 default: anthropic_actor
86046
86047 - `email_address: optional string or null`
86048
86049 format: email
86050
86051 - `SystemActor object`
86052
86053 Automated background processing performed by Anthropic systems, acting
86054 without a user or customer credential.
86055
86056 - `type: optional "system_actor"`
86057
86058 default: system_actor
86059
86060 - `service: optional string or null`
86061
86062 Name of the automated process that performed the action, when known.
86063
86064 - `AdminAPIKeyActor object`
86065
86066 - `type: optional "admin_api_key_actor"`
86067
86068 default: admin_api_key_actor
86069
86070 - `admin_api_key_id: string`
86071
86072 - `ip_address: string`
86073
86074 - `user_agent: string`
86075
86076 - `ServiceAccountActor object`
86077
86078 - `type: optional "service_account_actor"`
86079
86080 default: service_account_actor
86081
86082 - `ip_address: string`
86083
86084 - `service_account_id: string`
86085
86086 - `user_agent: string`
86087
86088 - `ScimDirectorySyncActor object`
86089
86090 - `type: optional "scim_directory_sync_actor"`
86091
86092 default: scim_directory_sync_actor
86093
86094 - `directory_id: string`
86095
86096 - `workos_event_id: string`
86097
86098 - `idp_connection_type: optional string or null`
86099
86100 - `FederatedIdentityActor object`
86101
86102 A federated external workload authenticated via a verified OIDC token.
86103
86104 Carries the verified issuer, subject, and audience claims from the
86105 presented JWT.
86106
86107 - `type: optional "federated_identity_actor"`
86108
86109 default: federated_identity_actor
86110
86111 - `issuer: string`
86112
86113 - `subject: string`
86114
86115 - `audience: optional array of string`
86116
86117 - `ip_address: optional string or null`
86118
86119 - `user_agent: optional string or null`
86120
86121 - `FederatedActor object`
86122
86123 An external identity asserted by a trusted provider — a cloud-provider
86124 gateway or a customer-registered federation issuer — acting without an
86125 Anthropic-provisioned account or service account.
86126
86127 - `type: optional "federated_actor"`
86128
86129 default: federated_actor
86130
86131 - `provider: Aws or Azure or Gcp or Oidc`
86132
86133 - `Aws object`
86134
86135 Asserting party: the AWS account the organization is bound to.
86136
86137 - `type: optional "aws"`
86138
86139 default: aws
86140
86141 - `account_id: string`
86142
86143 - `signed_principal: string`
86144
86145 The AWS-signed ARN of the IAM principal that requested the token.
86146
86147 - `Azure object`
86148
86149 Asserting party: the Azure subscription the organization is bound to.
86150
86151 - `type: optional "azure"`
86152
86153 default: azure
86154
86155 - `subscription_id: string`
86156
86157 - `Gcp object`
86158
86159 Asserting party: the GCP project the organization is bound to.
86160
86161 - `type: optional "gcp"`
86162
86163 default: gcp
86164
86165 - `project_number: string`
86166
86167 - `Oidc object`
86168
86169 Asserting party: a customer-registered OIDC federation issuer.
86170
86171 - `type: optional "oidc"`
86172
86173 default: oidc
86174
86175 - `issuer: optional string or null`
86176
86177 The federation issuer's URL. Null when the presented credential failed verification.
86178
86179 - `ip_address: optional string or null`
86180
86181 - `subject: optional string or null`
86182
86183 The provider's verified identifier for the caller; its form depends on the provider.
86184
86185 - `user_agent: optional string or null`
86186
86187 - `AttestedDeviceActor object`
86188
86189 An attested mobile device authenticated via Apple App Attest.
86190
86191 - `type: optional "attested_device_actor"`
86192
86193 default: attested_device_actor
86194
86195 - `external_client_id: string`
86196
86197 - `kid_hash: string`
86198
86199 - `ip_address: optional string or null`
86200
86201 - `user_agent: optional string or null`
86202
86203 - `display_name: string`
86204
86205 The display name the administrator gave the connection.
86206
86207 - `idp_connection_id: string`
86208
86209 The identity provider connection that was created, e.g. "idpc_01Ab...".
86210
86211 - `id: optional string`
86212
86213 Unique identifier for the activity e.g. 'activity_abcd1234'
86214
86215 - `created_at: optional string`
86216
86217 When this activity occurred.
86218
86219 format: date-time
86220
86221 - `organization_id: optional string or null`
86222
86223 Organization ID this activity is associated with
86224
86225 - `organization_uuid: optional string or null`
86226
86227 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
86228
86229 - `OrgIdpConnectionDeleted object`
86230
86231 An identity provider connection was removed from the parent organization, along with the settings that referenced it.
86232
86233 - `type: optional "org_idp_connection_deleted"`
86234
86235 default: org_idp_connection_deleted
86236
86237 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
86238
86239 - `APIActor object`
86240
86241 - `type: optional "api_actor"`
86242
86243 default: api_actor
86244
86245 - `api_key_id: string`
86246
86247 - `ip_address: string`
86248
86249 - `user_agent: string`
86250
86251 - `UserActor object`
86252
86253 - `type: optional "user_actor"`
86254
86255 default: user_actor
86256
86257 - `email_address: string`
86258
86259 format: email
86260
86261 - `ip_address: string`
86262
86263 - `user_agent: string`
86264
86265 - `user_id: string`
86266
86267 - `UnauthenticatedUserActor object`
86268
86269 - `type: optional "unauthenticated_user_actor"`
86270
86271 default: unauthenticated_user_actor
86272
86273 - `ip_address: string`
86274
86275 - `user_agent: string`
86276
86277 - `unauthenticated_email_address: optional string or null`
86278
86279 format: email
86280
86281 - `AnthropicActor object`
86282
86283 - `type: optional "anthropic_actor"`
86284
86285 default: anthropic_actor
86286
86287 - `email_address: optional string or null`
86288
86289 format: email
86290
86291 - `SystemActor object`
86292
86293 Automated background processing performed by Anthropic systems, acting
86294 without a user or customer credential.
86295
86296 - `type: optional "system_actor"`
86297
86298 default: system_actor
86299
86300 - `service: optional string or null`
86301
86302 Name of the automated process that performed the action, when known.
86303
86304 - `AdminAPIKeyActor object`
86305
86306 - `type: optional "admin_api_key_actor"`
86307
86308 default: admin_api_key_actor
86309
86310 - `admin_api_key_id: string`
86311
86312 - `ip_address: string`
86313
86314 - `user_agent: string`
86315
86316 - `ServiceAccountActor object`
86317
86318 - `type: optional "service_account_actor"`
86319
86320 default: service_account_actor
86321
86322 - `ip_address: string`
86323
86324 - `service_account_id: string`
86325
86326 - `user_agent: string`
86327
86328 - `ScimDirectorySyncActor object`
86329
86330 - `type: optional "scim_directory_sync_actor"`
86331
86332 default: scim_directory_sync_actor
86333
86334 - `directory_id: string`
86335
86336 - `workos_event_id: string`
86337
86338 - `idp_connection_type: optional string or null`
86339
86340 - `FederatedIdentityActor object`
86341
86342 A federated external workload authenticated via a verified OIDC token.
86343
86344 Carries the verified issuer, subject, and audience claims from the
86345 presented JWT.
86346
86347 - `type: optional "federated_identity_actor"`
86348
86349 default: federated_identity_actor
86350
86351 - `issuer: string`
86352
86353 - `subject: string`
86354
86355 - `audience: optional array of string`
86356
86357 - `ip_address: optional string or null`
86358
86359 - `user_agent: optional string or null`
86360
86361 - `FederatedActor object`
86362
86363 An external identity asserted by a trusted provider — a cloud-provider
86364 gateway or a customer-registered federation issuer — acting without an
86365 Anthropic-provisioned account or service account.
86366
86367 - `type: optional "federated_actor"`
86368
86369 default: federated_actor
86370
86371 - `provider: Aws or Azure or Gcp or Oidc`
86372
86373 - `Aws object`
86374
86375 Asserting party: the AWS account the organization is bound to.
86376
86377 - `type: optional "aws"`
86378
86379 default: aws
86380
86381 - `account_id: string`
86382
86383 - `signed_principal: string`
86384
86385 The AWS-signed ARN of the IAM principal that requested the token.
86386
86387 - `Azure object`
86388
86389 Asserting party: the Azure subscription the organization is bound to.
86390
86391 - `type: optional "azure"`
86392
86393 default: azure
86394
86395 - `subscription_id: string`
86396
86397 - `Gcp object`
86398
86399 Asserting party: the GCP project the organization is bound to.
86400
86401 - `type: optional "gcp"`
86402
86403 default: gcp
86404
86405 - `project_number: string`
86406
86407 - `Oidc object`
86408
86409 Asserting party: a customer-registered OIDC federation issuer.
86410
86411 - `type: optional "oidc"`
86412
86413 default: oidc
86414
86415 - `issuer: optional string or null`
86416
86417 The federation issuer's URL. Null when the presented credential failed verification.
86418
86419 - `ip_address: optional string or null`
86420
86421 - `subject: optional string or null`
86422
86423 The provider's verified identifier for the caller; its form depends on the provider.
86424
86425 - `user_agent: optional string or null`
86426
86427 - `AttestedDeviceActor object`
86428
86429 An attested mobile device authenticated via Apple App Attest.
86430
86431 - `type: optional "attested_device_actor"`
86432
86433 default: attested_device_actor
86434
86435 - `external_client_id: string`
86436
86437 - `kid_hash: string`
86438
86439 - `ip_address: optional string or null`
86440
86441 - `user_agent: optional string or null`
86442
86443 - `directory_removed: boolean`
86444
86445 Whether a directory sync connection was removed with the connection.
86446
86447 - `display_name: string`
86448
86449 The connection's display name at the time of deletion.
86450
86451 - `idp_connection_id: string`
86452
86453 The identity provider connection that was deleted, e.g. "idpc_01Ab...".
86454
86455 - `id: optional string`
86456
86457 Unique identifier for the activity e.g. 'activity_abcd1234'
86458
86459 - `created_at: optional string`
86460
86461 When this activity occurred.
86462
86463 format: date-time
86464
86465 - `organization_id: optional string or null`
86466
86467 Organization ID this activity is associated with
86468
86469 - `organization_uuid: optional string or null`
86470
86471 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
86472
86473 - `role_mappings_removed: optional array of object`
86474
86475 Group-to-role mappings that were removed with the connection.
86476
86477 - `idp_group_name: string`
86478
86479 Name of the identity provider group the mapping matched.
86480
86481 - `organization_id: string`
86482
86483 The organization the mapping belonged to, e.g. "org_01Ab...".
86484
86485 - `role: string`
86486
86487 The role members of the group were given.
86488
86489 - `seat_tier_mappings_removed: optional array of object`
86490
86491 Group-to-seat-tier mappings that were removed with the connection.
86492
86493 - `idp_group_name: string`
86494
86495 Name of the identity provider group the mapping matched.
86496
86497 - `organization_id: string`
86498
86499 The organization the mapping belonged to, e.g. "org_01Ab...".
86500
86501 - `seat_tier: string`
86502
86503 The seat tier members of the group were given.
86504
86505 - `unrouted_domains: optional array of string`
86506
86507 Verified domains whose single sign-on was routed through this connection; they no longer route anywhere.
86508
86509 - `OrgIdpConnectionUpdated object`
86510
86511 An identity provider connection's settings were changed.
86512
86513 - `type: optional "org_idp_connection_updated"`
86514
86515 default: org_idp_connection_updated
86516
86517 - `action: "renamed" or "shown_at_sign_in_changed" or "sso_restricted_to_scim_directory_members_changed" or "unspecified"`
86518
86519 Which setting was changed.
86520
86521 - `"renamed"`
86522
86523 - `"shown_at_sign_in_changed"`
86524
86525 - `"sso_restricted_to_scim_directory_members_changed"`
86526
86527 - `"unspecified"`
86528
86529 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
86530
86531 - `APIActor object`
86532
86533 - `type: optional "api_actor"`
86534
86535 default: api_actor
86536
86537 - `api_key_id: string`
86538
86539 - `ip_address: string`
86540
86541 - `user_agent: string`
86542
86543 - `UserActor object`
86544
86545 - `type: optional "user_actor"`
86546
86547 default: user_actor
86548
86549 - `email_address: string`
86550
86551 format: email
86552
86553 - `ip_address: string`
86554
86555 - `user_agent: string`
86556
86557 - `user_id: string`
86558
86559 - `UnauthenticatedUserActor object`
86560
86561 - `type: optional "unauthenticated_user_actor"`
86562
86563 default: unauthenticated_user_actor
86564
86565 - `ip_address: string`
86566
86567 - `user_agent: string`
86568
86569 - `unauthenticated_email_address: optional string or null`
86570
86571 format: email
86572
86573 - `AnthropicActor object`
86574
86575 - `type: optional "anthropic_actor"`
86576
86577 default: anthropic_actor
86578
86579 - `email_address: optional string or null`
86580
86581 format: email
86582
86583 - `SystemActor object`
86584
86585 Automated background processing performed by Anthropic systems, acting
86586 without a user or customer credential.
86587
86588 - `type: optional "system_actor"`
86589
86590 default: system_actor
86591
86592 - `service: optional string or null`
86593
86594 Name of the automated process that performed the action, when known.
86595
86596 - `AdminAPIKeyActor object`
86597
86598 - `type: optional "admin_api_key_actor"`
86599
86600 default: admin_api_key_actor
86601
86602 - `admin_api_key_id: string`
86603
86604 - `ip_address: string`
86605
86606 - `user_agent: string`
86607
86608 - `ServiceAccountActor object`
86609
86610 - `type: optional "service_account_actor"`
86611
86612 default: service_account_actor
86613
86614 - `ip_address: string`
86615
86616 - `service_account_id: string`
86617
86618 - `user_agent: string`
86619
86620 - `ScimDirectorySyncActor object`
86621
86622 - `type: optional "scim_directory_sync_actor"`
86623
86624 default: scim_directory_sync_actor
86625
86626 - `directory_id: string`
86627
86628 - `workos_event_id: string`
86629
86630 - `idp_connection_type: optional string or null`
86631
86632 - `FederatedIdentityActor object`
86633
86634 A federated external workload authenticated via a verified OIDC token.
86635
86636 Carries the verified issuer, subject, and audience claims from the
86637 presented JWT.
86638
86639 - `type: optional "federated_identity_actor"`
86640
86641 default: federated_identity_actor
86642
86643 - `issuer: string`
86644
86645 - `subject: string`
86646
86647 - `audience: optional array of string`
86648
86649 - `ip_address: optional string or null`
86650
86651 - `user_agent: optional string or null`
86652
86653 - `FederatedActor object`
86654
86655 An external identity asserted by a trusted provider — a cloud-provider
86656 gateway or a customer-registered federation issuer — acting without an
86657 Anthropic-provisioned account or service account.
86658
86659 - `type: optional "federated_actor"`
86660
86661 default: federated_actor
86662
86663 - `provider: Aws or Azure or Gcp or Oidc`
86664
86665 - `Aws object`
86666
86667 Asserting party: the AWS account the organization is bound to.
86668
86669 - `type: optional "aws"`
86670
86671 default: aws
86672
86673 - `account_id: string`
86674
86675 - `signed_principal: string`
86676
86677 The AWS-signed ARN of the IAM principal that requested the token.
86678
86679 - `Azure object`
86680
86681 Asserting party: the Azure subscription the organization is bound to.
86682
86683 - `type: optional "azure"`
86684
86685 default: azure
86686
86687 - `subscription_id: string`
86688
86689 - `Gcp object`
86690
86691 Asserting party: the GCP project the organization is bound to.
86692
86693 - `type: optional "gcp"`
86694
86695 default: gcp
86696
86697 - `project_number: string`
86698
86699 - `Oidc object`
86700
86701 Asserting party: a customer-registered OIDC federation issuer.
86702
86703 - `type: optional "oidc"`
86704
86705 default: oidc
86706
86707 - `issuer: optional string or null`
86708
86709 The federation issuer's URL. Null when the presented credential failed verification.
86710
86711 - `ip_address: optional string or null`
86712
86713 - `subject: optional string or null`
86714
86715 The provider's verified identifier for the caller; its form depends on the provider.
86716
86717 - `user_agent: optional string or null`
86718
86719 - `AttestedDeviceActor object`
86720
86721 An attested mobile device authenticated via Apple App Attest.
86722
86723 - `type: optional "attested_device_actor"`
86724
86725 default: attested_device_actor
86726
86727 - `external_client_id: string`
86728
86729 - `kid_hash: string`
86730
86731 - `ip_address: optional string or null`
86732
86733 - `user_agent: optional string or null`
86734
86735 - `display_name: string`
86736
86737 The connection's display name after the change.
86738
86739 - `idp_connection_id: string`
86740
86741 The identity provider connection that was changed, e.g. "idpc_01Ab...".
86742
86743 - `id: optional string`
86744
86745 Unique identifier for the activity e.g. 'activity_abcd1234'
86746
86747 - `created_at: optional string`
86748
86749 When this activity occurred.
86750
86751 format: date-time
86752
86753 - `organization_id: optional string or null`
86754
86755 Organization ID this activity is associated with
86756
86757 - `organization_uuid: optional string or null`
86758
86759 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
86760
86761 - `shown_at_sign_in: optional boolean or null`
86762
86763 After the change, whether the sign-in page offers the connection. Set only when action is shown_at_sign_in_changed.
86764
86765 - `sso_restricted_to_scim_directory_members: optional boolean or null`
86766
86767 After the change, whether sign-in with the connection is limited to the people its SCIM directory lists as active, apart from primary owners and parent organization owners. Set only when action is sso_restricted_to_scim_directory_members_changed.
86768
8402186769 - `OrgInviteLinkDisabled object`
8402286770
8402386771 Organization invite link was disabled.
from line 94470
9172294470
9172394471 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
9172494472
94473 - `OrgSecurityControlAttestationUpdated object`
94474
94475 The organization's attestation for a security control was recorded, changed, renewed or cleared by an administrator, or was ended automatically.
94476
94477 - `type: optional "org_security_control_attestation_updated"`
94478
94479 default: org_security_control_attestation_updated
94480
94481 - `action: "attested" or "changed" or "cleared" or 3 more`
94482
94483 What happened to the attestation.
94484
94485 - `"attested"`
94486
94487 An administrator recorded an attestation for a control that had none.
94488
94489 - `"changed"`
94490
94491 An administrator replaced the attestation, either with another status or, when `status` and `previous_status` are equal, with the same status, as with `renewed`.
94492
94493 - `"cleared"`
94494
94495 An administrator removed the attestation.
94496
94497 - `"lapsed"`
94498
94499 The attestation was ended automatically, not by an administrator. This activity can be later than the change that ended the attestation, and a change that could end an attestation was not always followed by this activity.
94500
94501 - `"renewed"`
94502
94503 An administrator saved the attestation again with the same status. Such a save can also be recorded as `changed`.
94504
94505 - `"unspecified"`
94506
94507 Not used. No activity is recorded with this value.
94508
94509 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
94510
94511 - `APIActor object`
94512
94513 - `type: optional "api_actor"`
94514
94515 default: api_actor
94516
94517 - `api_key_id: string`
94518
94519 - `ip_address: string`
94520
94521 - `user_agent: string`
94522
94523 - `UserActor object`
94524
94525 - `type: optional "user_actor"`
94526
94527 default: user_actor
94528
94529 - `email_address: string`
94530
94531 format: email
94532
94533 - `ip_address: string`
94534
94535 - `user_agent: string`
94536
94537 - `user_id: string`
94538
94539 - `UnauthenticatedUserActor object`
94540
94541 - `type: optional "unauthenticated_user_actor"`
94542
94543 default: unauthenticated_user_actor
94544
94545 - `ip_address: string`
94546
94547 - `user_agent: string`
94548
94549 - `unauthenticated_email_address: optional string or null`
94550
94551 format: email
94552
94553 - `AnthropicActor object`
94554
94555 - `type: optional "anthropic_actor"`
94556
94557 default: anthropic_actor
94558
94559 - `email_address: optional string or null`
94560
94561 format: email
94562
94563 - `SystemActor object`
94564
94565 Automated background processing performed by Anthropic systems, acting
94566 without a user or customer credential.
94567
94568 - `type: optional "system_actor"`
94569
94570 default: system_actor
94571
94572 - `service: optional string or null`
94573
94574 Name of the automated process that performed the action, when known.
94575
94576 - `AdminAPIKeyActor object`
94577
94578 - `type: optional "admin_api_key_actor"`
94579
94580 default: admin_api_key_actor
94581
94582 - `admin_api_key_id: string`
94583
94584 - `ip_address: string`
94585
94586 - `user_agent: string`
94587
94588 - `ServiceAccountActor object`
94589
94590 - `type: optional "service_account_actor"`
94591
94592 default: service_account_actor
94593
94594 - `ip_address: string`
94595
94596 - `service_account_id: string`
94597
94598 - `user_agent: string`
94599
94600 - `ScimDirectorySyncActor object`
94601
94602 - `type: optional "scim_directory_sync_actor"`
94603
94604 default: scim_directory_sync_actor
94605
94606 - `directory_id: string`
94607
94608 - `workos_event_id: string`
94609
94610 - `idp_connection_type: optional string or null`
94611
94612 - `FederatedIdentityActor object`
94613
94614 A federated external workload authenticated via a verified OIDC token.
94615
94616 Carries the verified issuer, subject, and audience claims from the
94617 presented JWT.
94618
94619 - `type: optional "federated_identity_actor"`
94620
94621 default: federated_identity_actor
94622
94623 - `issuer: string`
94624
94625 - `subject: string`
94626
94627 - `audience: optional array of string`
94628
94629 - `ip_address: optional string or null`
94630
94631 - `user_agent: optional string or null`
94632
94633 - `FederatedActor object`
94634
94635 An external identity asserted by a trusted provider — a cloud-provider
94636 gateway or a customer-registered federation issuer — acting without an
94637 Anthropic-provisioned account or service account.
94638
94639 - `type: optional "federated_actor"`
94640
94641 default: federated_actor
94642
94643 - `provider: Aws or Azure or Gcp or Oidc`
94644
94645 - `Aws object`
94646
94647 Asserting party: the AWS account the organization is bound to.
94648
94649 - `type: optional "aws"`
94650
94651 default: aws
94652
94653 - `account_id: string`
94654
94655 - `signed_principal: string`
94656
94657 The AWS-signed ARN of the IAM principal that requested the token.
94658
94659 - `Azure object`
94660
94661 Asserting party: the Azure subscription the organization is bound to.
94662
94663 - `type: optional "azure"`
94664
94665 default: azure
94666
94667 - `subscription_id: string`
94668
94669 - `Gcp object`
94670
94671 Asserting party: the GCP project the organization is bound to.
94672
94673 - `type: optional "gcp"`
94674
94675 default: gcp
94676
94677 - `project_number: string`
94678
94679 - `Oidc object`
94680
94681 Asserting party: a customer-registered OIDC federation issuer.
94682
94683 - `type: optional "oidc"`
94684
94685 default: oidc
94686
94687 - `issuer: optional string or null`
94688
94689 The federation issuer's URL. Null when the presented credential failed verification.
94690
94691 - `ip_address: optional string or null`
94692
94693 - `subject: optional string or null`
94694
94695 The provider's verified identifier for the caller; its form depends on the provider.
94696
94697 - `user_agent: optional string or null`
94698
94699 - `AttestedDeviceActor object`
94700
94701 An attested mobile device authenticated via Apple App Attest.
94702
94703 - `type: optional "attested_device_actor"`
94704
94705 default: attested_device_actor
94706
94707 - `external_client_id: string`
94708
94709 - `kid_hash: string`
94710
94711 - `ip_address: optional string or null`
94712
94713 - `user_agent: optional string or null`
94714
94715 - `control: string`
94716
94717 The identifier of the security control the attestation applies to, for example "oauth_conditional_access".
94718
94719 - `id: optional string`
94720
94721 Unique identifier for the activity e.g. 'activity_abcd1234'
94722
94723 - `created_at: optional string`
94724
94725 When this activity occurred.
94726
94727 format: date-time
94728
94729 - `organization_id: optional string or null`
94730
94731 Organization ID this activity is associated with
94732
94733 - `organization_uuid: optional string or null`
94734
94735 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
94736
94737 - `previous_status: optional "accepted_risk" or "completed" or "unspecified" or null`
94738
94739 The status before this change; absent when action is "attested".
94740
94741 - `"accepted_risk"`
94742
94743 An administrator attested that the organization accepts the risk of not meeting the control.
94744
94745 - `"completed"`
94746
94747 An administrator attested that the organization meets the control.
94748
94749 - `"unspecified"`
94750
94751 Not used. No activity is recorded with this value.
94752
94753 - `review_date: optional string or null`
94754
94755 The UTC day (ISO 8601 date) on which the attestation was due to stop taking effect; absent when it had no end date or was cleared.
94756
94757 - `status: optional "accepted_risk" or "completed" or "unspecified" or null`
94758
94759 The attested status; absent when the attestation was cleared.
94760
94761 - `"accepted_risk"`
94762
94763 An administrator attested that the organization accepts the risk of not meeting the control.
94764
94765 - `"completed"`
94766
94767 An administrator attested that the organization meets the control.
94768
94769 - `"unspecified"`
94770
94771 Not used. No activity is recorded with this value.
94772
9172594773 - `OrgSyncDeletingSynchronizedFilesStarted object`
9172694774
9172794775 Organization started deleting synchronized files.
from line 99776
9672899776
9672999777 - `user_agent: optional string or null`
9673099778
96731 - `updates: array of Name or Capabilities or RedactContent or 112 more`
99779 - `updates: array of Name or Capabilities or RedactContent or 114 more`
9673299780
9673399781 - `Name object`
9673499782
from line 100210
97162100210
97163100211 Setting value immediately before this change
97164100212
100213 - `ClaudeAIChatExternalSharingEnabled object`
100214
100215 The Claude.ai external chat sharing setting (inviting addresses outside the organization) was changed for the organization.
100216
100217 - `type: optional "claude_ai_chat_external_sharing_enabled"`
100218
100219 default: claude_ai_chat_external_sharing_enabled
100220
100221 - `current_value: optional boolean or null`
100222
100223 Setting value immediately after this change
100224
100225 - `previous_value: optional boolean or null`
100226
100227 Setting value immediately before this change
100228
97165100229 - `ClaudeAICcrSharingEnabled object`
97166100230
97167100231 The Claude.ai remote Claude Code session sharing setting was changed for the organization.
from line 101743
98679101743
98680101744 Setting value immediately before this change. Null means the setting had not been set for the organization, so the plan default applied.
98681101745
101746 - `ClaudeAIChatOrgSharingEnabled object`
101747
101748 The Claude.ai setting that lets members share a chat with everyone in the organization was changed for the organization.
101749
101750 - `type: optional "claude_ai_chat_org_sharing_enabled"`
101751
101752 default: claude_ai_chat_org_sharing_enabled
101753
101754 - `current_value: optional boolean or null`
101755
101756 Setting value immediately after this change
101757
101758 - `previous_value: optional boolean or null`
101759
101760 Setting value immediately before this change. Null means the setting had not been set for the organization, so the default (on) applied.
101761
98682101762 - `ArtifactTypeDashboardsEnabled object`
98683101763
98684101764 The setting that lets members create Dashboards, one of Anthropic's built-in Artifact types, was changed for the organization.
from line 102121
99041102121
99042102122 Tagged ID of the member whose access to their owned projects was restored, when known.
99043102123
102124 - `ParentOrganizationCentralizedManagementEnrolled object`
102125
102126 A parent organization was enrolled in centralized management.
102127
102128 - `type: optional "parent_organization_centralized_management_enrolled"`
102129
102130 default: parent_organization_centralized_management_enrolled
102131
102132 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
102133
102134 - `APIActor object`
102135
102136 - `type: optional "api_actor"`
102137
102138 default: api_actor
102139
102140 - `api_key_id: string`
102141
102142 - `ip_address: string`
102143
102144 - `user_agent: string`
102145
102146 - `UserActor object`
102147
102148 - `type: optional "user_actor"`
102149
102150 default: user_actor
102151
102152 - `email_address: string`
102153
102154 format: email
102155
102156 - `ip_address: string`
102157
102158 - `user_agent: string`
102159
102160 - `user_id: string`
102161
102162 - `UnauthenticatedUserActor object`
102163
102164 - `type: optional "unauthenticated_user_actor"`
102165
102166 default: unauthenticated_user_actor
102167
102168 - `ip_address: string`
102169
102170 - `user_agent: string`
102171
102172 - `unauthenticated_email_address: optional string or null`
102173
102174 format: email
102175
102176 - `AnthropicActor object`
102177
102178 - `type: optional "anthropic_actor"`
102179
102180 default: anthropic_actor
102181
102182 - `email_address: optional string or null`
102183
102184 format: email
102185
102186 - `SystemActor object`
102187
102188 Automated background processing performed by Anthropic systems, acting
102189 without a user or customer credential.
102190
102191 - `type: optional "system_actor"`
102192
102193 default: system_actor
102194
102195 - `service: optional string or null`
102196
102197 Name of the automated process that performed the action, when known.
102198
102199 - `AdminAPIKeyActor object`
102200
102201 - `type: optional "admin_api_key_actor"`
102202
102203 default: admin_api_key_actor
102204
102205 - `admin_api_key_id: string`
102206
102207 - `ip_address: string`
102208
102209 - `user_agent: string`
102210
102211 - `ServiceAccountActor object`
102212
102213 - `type: optional "service_account_actor"`
102214
102215 default: service_account_actor
102216
102217 - `ip_address: string`
102218
102219 - `service_account_id: string`
102220
102221 - `user_agent: string`
102222
102223 - `ScimDirectorySyncActor object`
102224
102225 - `type: optional "scim_directory_sync_actor"`
102226
102227 default: scim_directory_sync_actor
102228
102229 - `directory_id: string`
102230
102231 - `workos_event_id: string`
102232
102233 - `idp_connection_type: optional string or null`
102234
102235 - `FederatedIdentityActor object`
102236
102237 A federated external workload authenticated via a verified OIDC token.
102238
102239 Carries the verified issuer, subject, and audience claims from the
102240 presented JWT.
102241
102242 - `type: optional "federated_identity_actor"`
102243
102244 default: federated_identity_actor
102245
102246 - `issuer: string`
102247
102248 - `subject: string`
102249
102250 - `audience: optional array of string`
102251
102252 - `ip_address: optional string or null`
102253
102254 - `user_agent: optional string or null`
102255
102256 - `FederatedActor object`
102257
102258 An external identity asserted by a trusted provider — a cloud-provider
102259 gateway or a customer-registered federation issuer — acting without an
102260 Anthropic-provisioned account or service account.
102261
102262 - `type: optional "federated_actor"`
102263
102264 default: federated_actor
102265
102266 - `provider: Aws or Azure or Gcp or Oidc`
102267
102268 - `Aws object`
102269
102270 Asserting party: the AWS account the organization is bound to.
102271
102272 - `type: optional "aws"`
102273
102274 default: aws
102275
102276 - `account_id: string`
102277
102278 - `signed_principal: string`
102279
102280 The AWS-signed ARN of the IAM principal that requested the token.
102281
102282 - `Azure object`
102283
102284 Asserting party: the Azure subscription the organization is bound to.
102285
102286 - `type: optional "azure"`
102287
102288 default: azure
102289
102290 - `subscription_id: string`
102291
102292 - `Gcp object`
102293
102294 Asserting party: the GCP project the organization is bound to.
102295
102296 - `type: optional "gcp"`
102297
102298 default: gcp
102299
102300 - `project_number: string`
102301
102302 - `Oidc object`
102303
102304 Asserting party: a customer-registered OIDC federation issuer.
102305
102306 - `type: optional "oidc"`
102307
102308 default: oidc
102309
102310 - `issuer: optional string or null`
102311
102312 The federation issuer's URL. Null when the presented credential failed verification.
102313
102314 - `ip_address: optional string or null`
102315
102316 - `subject: optional string or null`
102317
102318 The provider's verified identifier for the caller; its form depends on the provider.
102319
102320 - `user_agent: optional string or null`
102321
102322 - `AttestedDeviceActor object`
102323
102324 An attested mobile device authenticated via Apple App Attest.
102325
102326 - `type: optional "attested_device_actor"`
102327
102328 default: attested_device_actor
102329
102330 - `external_client_id: string`
102331
102332 - `kid_hash: string`
102333
102334 - `ip_address: optional string or null`
102335
102336 - `user_agent: optional string or null`
102337
102338 - `parent_organization_id: string`
102339
102340 The parent organization that was enrolled in centralized management.
102341
102342 - `id: optional string`
102343
102344 Unique identifier for the activity e.g. 'activity_abcd1234'
102345
102346 - `created_at: optional string`
102347
102348 When this activity occurred.
102349
102350 format: date-time
102351
102352 - `members: optional array of object`
102353
102354 The members granted parent-organization roles at enrollment.
102355
102356 - `role: "admin" or "owner" or "unspecified"`
102357
102358 The parent-organization role held.
102359
102360 - `"admin"`
102361
102362 - `"owner"`
102363
102364 - `"unspecified"`
102365
102366 - `user_id: string`
102367
102368 Tagged ID of the member's account.
102369
102370 - `organization_id: optional string or null`
102371
102372 Organization ID this activity is associated with
102373
102374 - `organization_uuid: optional string or null`
102375
102376 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
102377
102378 - `ParentOrganizationCentralizedManagementOrganizationUpdated object`
102379
102380 An organization's approval of its parent organization's Centralized Management setup changed, or its administrators were reminded to approve.
102381
102382 - `type: optional "parent_organization_centralized_management_organization_updated"`
102383
102384 default: parent_organization_centralized_management_organization_updated
102385
102386 - `action: "approval_withdrawn" or "approved" or "force_included" or 3 more`
102387
102388 How the organization's approval changed.
102389
102390 - `"approval_withdrawn"`
102391
102392 - `"approved"`
102393
102394 - `"force_included"`
102395
102396 - `"joined"`
102397
102398 - `"reminder_sent"`
102399
102400 - `"unspecified"`
102401
102402 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
102403
102404 - `APIActor object`
102405
102406 - `type: optional "api_actor"`
102407
102408 default: api_actor
102409
102410 - `api_key_id: string`
102411
102412 - `ip_address: string`
102413
102414 - `user_agent: string`
102415
102416 - `UserActor object`
102417
102418 - `type: optional "user_actor"`
102419
102420 default: user_actor
102421
102422 - `email_address: string`
102423
102424 format: email
102425
102426 - `ip_address: string`
102427
102428 - `user_agent: string`
102429
102430 - `user_id: string`
102431
102432 - `UnauthenticatedUserActor object`
102433
102434 - `type: optional "unauthenticated_user_actor"`
102435
102436 default: unauthenticated_user_actor
102437
102438 - `ip_address: string`
102439
102440 - `user_agent: string`
102441
102442 - `unauthenticated_email_address: optional string or null`
102443
102444 format: email
102445
102446 - `AnthropicActor object`
102447
102448 - `type: optional "anthropic_actor"`
102449
102450 default: anthropic_actor
102451
102452 - `email_address: optional string or null`
102453
102454 format: email
102455
102456 - `SystemActor object`
102457
102458 Automated background processing performed by Anthropic systems, acting
102459 without a user or customer credential.
102460
102461 - `type: optional "system_actor"`
102462
102463 default: system_actor
102464
102465 - `service: optional string or null`
102466
102467 Name of the automated process that performed the action, when known.
102468
102469 - `AdminAPIKeyActor object`
102470
102471 - `type: optional "admin_api_key_actor"`
102472
102473 default: admin_api_key_actor
102474
102475 - `admin_api_key_id: string`
102476
102477 - `ip_address: string`
102478
102479 - `user_agent: string`
102480
102481 - `ServiceAccountActor object`
102482
102483 - `type: optional "service_account_actor"`
102484
102485 default: service_account_actor
102486
102487 - `ip_address: string`
102488
102489 - `service_account_id: string`
102490
102491 - `user_agent: string`
102492
102493 - `ScimDirectorySyncActor object`
102494
102495 - `type: optional "scim_directory_sync_actor"`
102496
102497 default: scim_directory_sync_actor
102498
102499 - `directory_id: string`
102500
102501 - `workos_event_id: string`
102502
102503 - `idp_connection_type: optional string or null`
102504
102505 - `FederatedIdentityActor object`
102506
102507 A federated external workload authenticated via a verified OIDC token.
102508
102509 Carries the verified issuer, subject, and audience claims from the
102510 presented JWT.
102511
102512 - `type: optional "federated_identity_actor"`
102513
102514 default: federated_identity_actor
102515
102516 - `issuer: string`
102517
102518 - `subject: string`
102519
102520 - `audience: optional array of string`
102521
102522 - `ip_address: optional string or null`
102523
102524 - `user_agent: optional string or null`
102525
102526 - `FederatedActor object`
102527
102528 An external identity asserted by a trusted provider — a cloud-provider
102529 gateway or a customer-registered federation issuer — acting without an
102530 Anthropic-provisioned account or service account.
102531
102532 - `type: optional "federated_actor"`
102533
102534 default: federated_actor
102535
102536 - `provider: Aws or Azure or Gcp or Oidc`
102537
102538 - `Aws object`
102539
102540 Asserting party: the AWS account the organization is bound to.
102541
102542 - `type: optional "aws"`
102543
102544 default: aws
102545
102546 - `account_id: string`
102547
102548 - `signed_principal: string`
102549
102550 The AWS-signed ARN of the IAM principal that requested the token.
102551
102552 - `Azure object`
102553
102554 Asserting party: the Azure subscription the organization is bound to.
102555
102556 - `type: optional "azure"`
102557
102558 default: azure
102559
102560 - `subscription_id: string`
102561
102562 - `Gcp object`
102563
102564 Asserting party: the GCP project the organization is bound to.
102565
102566 - `type: optional "gcp"`
102567
102568 default: gcp
102569
102570 - `project_number: string`
102571
102572 - `Oidc object`
102573
102574 Asserting party: a customer-registered OIDC federation issuer.
102575
102576 - `type: optional "oidc"`
102577
102578 default: oidc
102579
102580 - `issuer: optional string or null`
102581
102582 The federation issuer's URL. Null when the presented credential failed verification.
102583
102584 - `ip_address: optional string or null`
102585
102586 - `subject: optional string or null`
102587
102588 The provider's verified identifier for the caller; its form depends on the provider.
102589
102590 - `user_agent: optional string or null`
102591
102592 - `AttestedDeviceActor object`
102593
102594 An attested mobile device authenticated via Apple App Attest.
102595
102596 - `type: optional "attested_device_actor"`
102597
102598 default: attested_device_actor
102599
102600 - `external_client_id: string`
102601
102602 - `kid_hash: string`
102603
102604 - `ip_address: optional string or null`
102605
102606 - `user_agent: optional string or null`
102607
102608 - `parent_organization_id: string`
102609
102610 The parent organization running the setup, e.g. "parent_org_01HX...".
102611
102612 - `target_organization_id: string`
102613
102614 The organization whose approval changed, e.g. "org_01HX...".
102615
102616 - `id: optional string`
102617
102618 Unique identifier for the activity e.g. 'activity_abcd1234'
102619
102620 - `created_at: optional string`
102621
102622 When this activity occurred.
102623
102624 format: date-time
102625
102626 - `organization_id: optional string or null`
102627
102628 Organization ID this activity is associated with
102629
102630 - `organization_uuid: optional string or null`
102631
102632 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
102633
102634 - `set_changed_at: optional string or null`
102635
102636 The version of the proposed administrators the approval, withdrawal or inclusion applied to (absent for reminders).
102637
102638 format: date-time
102639
102640 - `ParentOrganizationCentralizedManagementSetupUpdated object`
102641
102642 The Centralized Management setup of a parent organization changed: it was started or abandoned, its proposed administrators changed, its remaining organizations were force approved, or it completed.
102643
102644 - `type: optional "parent_organization_centralized_management_setup_updated"`
102645
102646 default: parent_organization_centralized_management_setup_updated
102647
102648 - `action: "abandoned" or "child_joined" or "completed" or 6 more`
102649
102650 How the setup changed.
102651
102652 - `"abandoned"`
102653
102654 - `"child_joined"`
102655
102656 - `"completed"`
102657
102658 - `"force_approved"`
102659
102660 - `"nominee_added"`
102661
102662 - `"nominee_removed"`
102663
102664 - `"restarted"`
102665
102666 - `"started"`
102667
102668 - `"unspecified"`
102669
102670 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
102671
102672 - `APIActor object`
102673
102674 - `type: optional "api_actor"`
102675
102676 default: api_actor
102677
102678 - `api_key_id: string`
102679
102680 - `ip_address: string`
102681
102682 - `user_agent: string`
102683
102684 - `UserActor object`
102685
102686 - `type: optional "user_actor"`
102687
102688 default: user_actor
102689
102690 - `email_address: string`
102691
102692 format: email
102693
102694 - `ip_address: string`
102695
102696 - `user_agent: string`
102697
102698 - `user_id: string`
102699
102700 - `UnauthenticatedUserActor object`
102701
102702 - `type: optional "unauthenticated_user_actor"`
102703
102704 default: unauthenticated_user_actor
102705
102706 - `ip_address: string`
102707
102708 - `user_agent: string`
102709
102710 - `unauthenticated_email_address: optional string or null`
102711
102712 format: email
102713
102714 - `AnthropicActor object`
102715
102716 - `type: optional "anthropic_actor"`
102717
102718 default: anthropic_actor
102719
102720 - `email_address: optional string or null`
102721
102722 format: email
102723
102724 - `SystemActor object`
102725
102726 Automated background processing performed by Anthropic systems, acting
102727 without a user or customer credential.
102728
102729 - `type: optional "system_actor"`
102730
102731 default: system_actor
102732
102733 - `service: optional string or null`
102734
102735 Name of the automated process that performed the action, when known.
102736
102737 - `AdminAPIKeyActor object`
102738
102739 - `type: optional "admin_api_key_actor"`
102740
102741 default: admin_api_key_actor
102742
102743 - `admin_api_key_id: string`
102744
102745 - `ip_address: string`
102746
102747 - `user_agent: string`
102748
102749 - `ServiceAccountActor object`
102750
102751 - `type: optional "service_account_actor"`
102752
102753 default: service_account_actor
102754
102755 - `ip_address: string`
102756
102757 - `service_account_id: string`
102758
102759 - `user_agent: string`
102760
102761 - `ScimDirectorySyncActor object`
102762
102763 - `type: optional "scim_directory_sync_actor"`
102764
102765 default: scim_directory_sync_actor
102766
102767 - `directory_id: string`
102768
102769 - `workos_event_id: string`
102770
102771 - `idp_connection_type: optional string or null`
102772
102773 - `FederatedIdentityActor object`
102774
102775 A federated external workload authenticated via a verified OIDC token.
102776
102777 Carries the verified issuer, subject, and audience claims from the
102778 presented JWT.
102779
102780 - `type: optional "federated_identity_actor"`
102781
102782 default: federated_identity_actor
102783
102784 - `issuer: string`
102785
102786 - `subject: string`
102787
102788 - `audience: optional array of string`
102789
102790 - `ip_address: optional string or null`
102791
102792 - `user_agent: optional string or null`
102793
102794 - `FederatedActor object`
102795
102796 An external identity asserted by a trusted provider — a cloud-provider
102797 gateway or a customer-registered federation issuer — acting without an
102798 Anthropic-provisioned account or service account.
102799
102800 - `type: optional "federated_actor"`
102801
102802 default: federated_actor
102803
102804 - `provider: Aws or Azure or Gcp or Oidc`
102805
102806 - `Aws object`
102807
102808 Asserting party: the AWS account the organization is bound to.
102809
102810 - `type: optional "aws"`
102811
102812 default: aws
102813
102814 - `account_id: string`
102815
102816 - `signed_principal: string`
102817
102818 The AWS-signed ARN of the IAM principal that requested the token.
102819
102820 - `Azure object`
102821
102822 Asserting party: the Azure subscription the organization is bound to.
102823
102824 - `type: optional "azure"`
102825
102826 default: azure
102827
102828 - `subscription_id: string`
102829
102830 - `Gcp object`
102831
102832 Asserting party: the GCP project the organization is bound to.
102833
102834 - `type: optional "gcp"`
102835
102836 default: gcp
102837
102838 - `project_number: string`
102839
102840 - `Oidc object`
102841
102842 Asserting party: a customer-registered OIDC federation issuer.
102843
102844 - `type: optional "oidc"`
102845
102846 default: oidc
102847
102848 - `issuer: optional string or null`
102849
102850 The federation issuer's URL. Null when the presented credential failed verification.
102851
102852 - `ip_address: optional string or null`
102853
102854 - `subject: optional string or null`
102855
102856 The provider's verified identifier for the caller; its form depends on the provider.
102857
102858 - `user_agent: optional string or null`
102859
102860 - `AttestedDeviceActor object`
102861
102862 An attested mobile device authenticated via Apple App Attest.
102863
102864 - `type: optional "attested_device_actor"`
102865
102866 default: attested_device_actor
102867
102868 - `external_client_id: string`
102869
102870 - `kid_hash: string`
102871
102872 - `ip_address: optional string or null`
102873
102874 - `user_agent: optional string or null`
102875
102876 - `parent_organization_id: string`
102877
102878 The parent organization whose setup changed, e.g. "parent_org_01HX...".
102879
102880 - `id: optional string`
102881
102882 Unique identifier for the activity e.g. 'activity_abcd1234'
102883
102884 - `created_at: optional string`
102885
102886 When this activity occurred.
102887
102888 format: date-time
102889
102890 - `nominated_via_organization_id: optional string or null`
102891
102892 The organization the administrator was proposed through (nominee_added), e.g. "org_01HX...".
102893
102894 - `nominee_account_id: optional string or null`
102895
102896 The administrator added to or removed from the proposed administrators (nominee_added, nominee_removed), e.g. "user_01HX...".
102897
102898 - `organization_id: optional string or null`
102899
102900 Organization ID this activity is associated with
102901
102902 - `organization_uuid: optional string or null`
102903
102904 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
102905
102906 - `set_changed_at: optional string or null`
102907
102908 When the proposed administrators last changed as of this event; events sharing this value belong to the same version of the proposed administrators.
102909
102910 format: date-time
102911
102912 - `ParentOrganizationCentralizedManagementUnenrolled object`
102913
102914 A parent organization was unenrolled from centralized management.
102915
102916 - `type: optional "parent_organization_centralized_management_unenrolled"`
102917
102918 default: parent_organization_centralized_management_unenrolled
102919
102920 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
102921
102922 - `APIActor object`
102923
102924 - `type: optional "api_actor"`
102925
102926 default: api_actor
102927
102928 - `api_key_id: string`
102929
102930 - `ip_address: string`
102931
102932 - `user_agent: string`
102933
102934 - `UserActor object`
102935
102936 - `type: optional "user_actor"`
102937
102938 default: user_actor
102939
102940 - `email_address: string`
102941
102942 format: email
102943
102944 - `ip_address: string`
102945
102946 - `user_agent: string`
102947
102948 - `user_id: string`
102949
102950 - `UnauthenticatedUserActor object`
102951
102952 - `type: optional "unauthenticated_user_actor"`
102953
102954 default: unauthenticated_user_actor
102955
102956 - `ip_address: string`
102957
102958 - `user_agent: string`
102959
102960 - `unauthenticated_email_address: optional string or null`
102961
102962 format: email
102963
102964 - `AnthropicActor object`
102965
102966 - `type: optional "anthropic_actor"`
102967
102968 default: anthropic_actor
102969
102970 - `email_address: optional string or null`
102971
102972 format: email
102973
102974 - `SystemActor object`
102975
102976 Automated background processing performed by Anthropic systems, acting
102977 without a user or customer credential.
102978
102979 - `type: optional "system_actor"`
102980
102981 default: system_actor
102982
102983 - `service: optional string or null`
102984
102985 Name of the automated process that performed the action, when known.
102986
102987 - `AdminAPIKeyActor object`
102988
102989 - `type: optional "admin_api_key_actor"`
102990
102991 default: admin_api_key_actor
102992
102993 - `admin_api_key_id: string`
102994
102995 - `ip_address: string`
102996
102997 - `user_agent: string`
102998
102999 - `ServiceAccountActor object`
103000
103001 - `type: optional "service_account_actor"`
103002
103003 default: service_account_actor
103004
103005 - `ip_address: string`
103006
103007 - `service_account_id: string`
103008
103009 - `user_agent: string`
103010
103011 - `ScimDirectorySyncActor object`
103012
103013 - `type: optional "scim_directory_sync_actor"`
103014
103015 default: scim_directory_sync_actor
103016
103017 - `directory_id: string`
103018
103019 - `workos_event_id: string`
103020
103021 - `idp_connection_type: optional string or null`
103022
103023 - `FederatedIdentityActor object`
103024
103025 A federated external workload authenticated via a verified OIDC token.
103026
103027 Carries the verified issuer, subject, and audience claims from the
103028 presented JWT.
103029
103030 - `type: optional "federated_identity_actor"`
103031
103032 default: federated_identity_actor
103033
103034 - `issuer: string`
103035
103036 - `subject: string`
103037
103038 - `audience: optional array of string`
103039
103040 - `ip_address: optional string or null`
103041
103042 - `user_agent: optional string or null`
103043
103044 - `FederatedActor object`
103045
103046 An external identity asserted by a trusted provider — a cloud-provider
103047 gateway or a customer-registered federation issuer — acting without an
103048 Anthropic-provisioned account or service account.
103049
103050 - `type: optional "federated_actor"`
103051
103052 default: federated_actor
103053
103054 - `provider: Aws or Azure or Gcp or Oidc`
103055
103056 - `Aws object`
103057
103058 Asserting party: the AWS account the organization is bound to.
103059
103060 - `type: optional "aws"`
103061
103062 default: aws
103063
103064 - `account_id: string`
103065
103066 - `signed_principal: string`
103067
103068 The AWS-signed ARN of the IAM principal that requested the token.
103069
103070 - `Azure object`
103071
103072 Asserting party: the Azure subscription the organization is bound to.
103073
103074 - `type: optional "azure"`
103075
103076 default: azure
103077
103078 - `subscription_id: string`
103079
103080 - `Gcp object`
103081
103082 Asserting party: the GCP project the organization is bound to.
103083
103084 - `type: optional "gcp"`
103085
103086 default: gcp
103087
103088 - `project_number: string`
103089
103090 - `Oidc object`
103091
103092 Asserting party: a customer-registered OIDC federation issuer.
103093
103094 - `type: optional "oidc"`
103095
103096 default: oidc
103097
103098 - `issuer: optional string or null`
103099
103100 The federation issuer's URL. Null when the presented credential failed verification.
103101
103102 - `ip_address: optional string or null`
103103
103104 - `subject: optional string or null`
103105
103106 The provider's verified identifier for the caller; its form depends on the provider.
103107
103108 - `user_agent: optional string or null`
103109
103110 - `AttestedDeviceActor object`
103111
103112 An attested mobile device authenticated via Apple App Attest.
103113
103114 - `type: optional "attested_device_actor"`
103115
103116 default: attested_device_actor
103117
103118 - `external_client_id: string`
103119
103120 - `kid_hash: string`
103121
103122 - `ip_address: optional string or null`
103123
103124 - `user_agent: optional string or null`
103125
103126 - `parent_organization_id: string`
103127
103128 The parent organization that was unenrolled from centralized management.
103129
103130 - `id: optional string`
103131
103132 Unique identifier for the activity e.g. 'activity_abcd1234'
103133
103134 - `created_at: optional string`
103135
103136 When this activity occurred.
103137
103138 format: date-time
103139
103140 - `members: optional array of object`
103141
103142 The members whose parent-organization roles were revoked at unenrollment.
103143
103144 - `role: "admin" or "owner" or "unspecified"`
103145
103146 The parent-organization role held.
103147
103148 - `"admin"`
103149
103150 - `"owner"`
103151
103152 - `"unspecified"`
103153
103154 - `user_id: string`
103155
103156 Tagged ID of the member's account.
103157
103158 - `organization_id: optional string or null`
103159
103160 Organization ID this activity is associated with
103161
103162 - `organization_uuid: optional string or null`
103163
103164 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
103165
103166 - `ParentOrganizationMemberRemoved object`
103167
103168 A parent-organization admin role was removed from a user.
103169
103170 - `type: optional "parent_organization_member_removed"`
103171
103172 default: parent_organization_member_removed
103173
103174 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
103175
103176 - `APIActor object`
103177
103178 - `type: optional "api_actor"`
103179
103180 default: api_actor
103181
103182 - `api_key_id: string`
103183
103184 - `ip_address: string`
103185
103186 - `user_agent: string`
103187
103188 - `UserActor object`
103189
103190 - `type: optional "user_actor"`
103191
103192 default: user_actor
103193
103194 - `email_address: string`
103195
103196 format: email
103197
103198 - `ip_address: string`
103199
103200 - `user_agent: string`
103201
103202 - `user_id: string`
103203
103204 - `UnauthenticatedUserActor object`
103205
103206 - `type: optional "unauthenticated_user_actor"`
103207
103208 default: unauthenticated_user_actor
103209
103210 - `ip_address: string`
103211
103212 - `user_agent: string`
103213
103214 - `unauthenticated_email_address: optional string or null`
103215
103216 format: email
103217
103218 - `AnthropicActor object`
103219
103220 - `type: optional "anthropic_actor"`
103221
103222 default: anthropic_actor
103223
103224 - `email_address: optional string or null`
103225
103226 format: email
103227
103228 - `SystemActor object`
103229
103230 Automated background processing performed by Anthropic systems, acting
103231 without a user or customer credential.
103232
103233 - `type: optional "system_actor"`
103234
103235 default: system_actor
103236
103237 - `service: optional string or null`
103238
103239 Name of the automated process that performed the action, when known.
103240
103241 - `AdminAPIKeyActor object`
103242
103243 - `type: optional "admin_api_key_actor"`
103244
103245 default: admin_api_key_actor
103246
103247 - `admin_api_key_id: string`
103248
103249 - `ip_address: string`
103250
103251 - `user_agent: string`
103252
103253 - `ServiceAccountActor object`
103254
103255 - `type: optional "service_account_actor"`
103256
103257 default: service_account_actor
103258
103259 - `ip_address: string`
103260
103261 - `service_account_id: string`
103262
103263 - `user_agent: string`
103264
103265 - `ScimDirectorySyncActor object`
103266
103267 - `type: optional "scim_directory_sync_actor"`
103268
103269 default: scim_directory_sync_actor
103270
103271 - `directory_id: string`
103272
103273 - `workos_event_id: string`
103274
103275 - `idp_connection_type: optional string or null`
103276
103277 - `FederatedIdentityActor object`
103278
103279 A federated external workload authenticated via a verified OIDC token.
103280
103281 Carries the verified issuer, subject, and audience claims from the
103282 presented JWT.
103283
103284 - `type: optional "federated_identity_actor"`
103285
103286 default: federated_identity_actor
103287
103288 - `issuer: string`
103289
103290 - `subject: string`
103291
103292 - `audience: optional array of string`
103293
103294 - `ip_address: optional string or null`
103295
103296 - `user_agent: optional string or null`
103297
103298 - `FederatedActor object`
103299
103300 An external identity asserted by a trusted provider — a cloud-provider
103301 gateway or a customer-registered federation issuer — acting without an
103302 Anthropic-provisioned account or service account.
103303
103304 - `type: optional "federated_actor"`
103305
103306 default: federated_actor
103307
103308 - `provider: Aws or Azure or Gcp or Oidc`
103309
103310 - `Aws object`
103311
103312 Asserting party: the AWS account the organization is bound to.
103313
103314 - `type: optional "aws"`
103315
103316 default: aws
103317
103318 - `account_id: string`
103319
103320 - `signed_principal: string`
103321
103322 The AWS-signed ARN of the IAM principal that requested the token.
103323
103324 - `Azure object`
103325
103326 Asserting party: the Azure subscription the organization is bound to.
103327
103328 - `type: optional "azure"`
103329
103330 default: azure
103331
103332 - `subscription_id: string`
103333
103334 - `Gcp object`
103335
103336 Asserting party: the GCP project the organization is bound to.
103337
103338 - `type: optional "gcp"`
103339
103340 default: gcp
103341
103342 - `project_number: string`
103343
103344 - `Oidc object`
103345
103346 Asserting party: a customer-registered OIDC federation issuer.
103347
103348 - `type: optional "oidc"`
103349
103350 default: oidc
103351
103352 - `issuer: optional string or null`
103353
103354 The federation issuer's URL. Null when the presented credential failed verification.
103355
103356 - `ip_address: optional string or null`
103357
103358 - `subject: optional string or null`
103359
103360 The provider's verified identifier for the caller; its form depends on the provider.
103361
103362 - `user_agent: optional string or null`
103363
103364 - `AttestedDeviceActor object`
103365
103366 An attested mobile device authenticated via Apple App Attest.
103367
103368 - `type: optional "attested_device_actor"`
103369
103370 default: attested_device_actor
103371
103372 - `external_client_id: string`
103373
103374 - `kid_hash: string`
103375
103376 - `ip_address: optional string or null`
103377
103378 - `user_agent: optional string or null`
103379
103380 - `parent_organization_id: string`
103381
103382 The parent organization whose admin roster was changed.
103383
103384 - `role: string`
103385
103386 The role the user held on the parent organization at the time of removal.
103387
103388 - `user_id: string`
103389
103390 The user whose parent-organization admin role was removed.
103391
103392 - `id: optional string`
103393
103394 Unique identifier for the activity e.g. 'activity_abcd1234'
103395
103396 - `created_at: optional string`
103397
103398 When this activity occurred.
103399
103400 format: date-time
103401
103402 - `organization_id: optional string or null`
103403
103404 Organization ID this activity is associated with
103405
103406 - `organization_uuid: optional string or null`
103407
103408 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
103409
103410 - `ParentOrganizationMemberUpdated object`
103411
103412 A parent-organization admin role was granted or changed for a user.
103413
103414 - `type: optional "parent_organization_member_updated"`
103415
103416 default: parent_organization_member_updated
103417
103418 - `action: "added" or "role_changed" or "unspecified"`
103419
103420 Whether the user was newly granted the role or had an existing role changed.
103421
103422 - `"added"`
103423
103424 - `"role_changed"`
103425
103426 - `"unspecified"`
103427
103428 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
103429
103430 - `APIActor object`
103431
103432 - `type: optional "api_actor"`
103433
103434 default: api_actor
103435
103436 - `api_key_id: string`
103437
103438 - `ip_address: string`
103439
103440 - `user_agent: string`
103441
103442 - `UserActor object`
103443
103444 - `type: optional "user_actor"`
103445
103446 default: user_actor
103447
103448 - `email_address: string`
103449
103450 format: email
103451
103452 - `ip_address: string`
103453
103454 - `user_agent: string`
103455
103456 - `user_id: string`
103457
103458 - `UnauthenticatedUserActor object`
103459
103460 - `type: optional "unauthenticated_user_actor"`
103461
103462 default: unauthenticated_user_actor
103463
103464 - `ip_address: string`
103465
103466 - `user_agent: string`
103467
103468 - `unauthenticated_email_address: optional string or null`
103469
103470 format: email
103471
103472 - `AnthropicActor object`
103473
103474 - `type: optional "anthropic_actor"`
103475
103476 default: anthropic_actor
103477
103478 - `email_address: optional string or null`
103479
103480 format: email
103481
103482 - `SystemActor object`
103483
103484 Automated background processing performed by Anthropic systems, acting
103485 without a user or customer credential.
103486
103487 - `type: optional "system_actor"`
103488
103489 default: system_actor
103490
103491 - `service: optional string or null`
103492
103493 Name of the automated process that performed the action, when known.
103494
103495 - `AdminAPIKeyActor object`
103496
103497 - `type: optional "admin_api_key_actor"`
103498
103499 default: admin_api_key_actor
103500
103501 - `admin_api_key_id: string`
103502
103503 - `ip_address: string`
103504
103505 - `user_agent: string`
103506
103507 - `ServiceAccountActor object`
103508
103509 - `type: optional "service_account_actor"`
103510
103511 default: service_account_actor
103512
103513 - `ip_address: string`
103514
103515 - `service_account_id: string`
103516
103517 - `user_agent: string`
103518
103519 - `ScimDirectorySyncActor object`
103520
103521 - `type: optional "scim_directory_sync_actor"`
103522
103523 default: scim_directory_sync_actor
103524
103525 - `directory_id: string`
103526
103527 - `workos_event_id: string`
103528
103529 - `idp_connection_type: optional string or null`
103530
103531 - `FederatedIdentityActor object`
103532
103533 A federated external workload authenticated via a verified OIDC token.
103534
103535 Carries the verified issuer, subject, and audience claims from the
103536 presented JWT.
103537
103538 - `type: optional "federated_identity_actor"`
103539
103540 default: federated_identity_actor
103541
103542 - `issuer: string`
103543
103544 - `subject: string`
103545
103546 - `audience: optional array of string`
103547
103548 - `ip_address: optional string or null`
103549
103550 - `user_agent: optional string or null`
103551
103552 - `FederatedActor object`
103553
103554 An external identity asserted by a trusted provider — a cloud-provider
103555 gateway or a customer-registered federation issuer — acting without an
103556 Anthropic-provisioned account or service account.
103557
103558 - `type: optional "federated_actor"`
103559
103560 default: federated_actor
103561
103562 - `provider: Aws or Azure or Gcp or Oidc`
103563
103564 - `Aws object`
103565
103566 Asserting party: the AWS account the organization is bound to.
103567
103568 - `type: optional "aws"`
103569
103570 default: aws
103571
103572 - `account_id: string`
103573
103574 - `signed_principal: string`
103575
103576 The AWS-signed ARN of the IAM principal that requested the token.
103577
103578 - `Azure object`
103579
103580 Asserting party: the Azure subscription the organization is bound to.
103581
103582 - `type: optional "azure"`
103583
103584 default: azure
103585
103586 - `subscription_id: string`
103587
103588 - `Gcp object`
103589
103590 Asserting party: the GCP project the organization is bound to.
103591
103592 - `type: optional "gcp"`
103593
103594 default: gcp
103595
103596 - `project_number: string`
103597
103598 - `Oidc object`
103599
103600 Asserting party: a customer-registered OIDC federation issuer.
103601
103602 - `type: optional "oidc"`
103603
103604 default: oidc
103605
103606 - `issuer: optional string or null`
103607
103608 The federation issuer's URL. Null when the presented credential failed verification.
103609
103610 - `ip_address: optional string or null`
103611
103612 - `subject: optional string or null`
103613
103614 The provider's verified identifier for the caller; its form depends on the provider.
103615
103616 - `user_agent: optional string or null`
103617
103618 - `AttestedDeviceActor object`
103619
103620 An attested mobile device authenticated via Apple App Attest.
103621
103622 - `type: optional "attested_device_actor"`
103623
103624 default: attested_device_actor
103625
103626 - `external_client_id: string`
103627
103628 - `kid_hash: string`
103629
103630 - `ip_address: optional string or null`
103631
103632 - `user_agent: optional string or null`
103633
103634 - `parent_organization_id: string`
103635
103636 The parent organization whose admin roster was changed.
103637
103638 - `role: string`
103639
103640 The role the user now holds on the parent organization.
103641
103642 - `user_id: string`
103643
103644 The user whose parent-organization admin role was set.
103645
103646 - `id: optional string`
103647
103648 Unique identifier for the activity e.g. 'activity_abcd1234'
103649
103650 - `created_at: optional string`
103651
103652 When this activity occurred.
103653
103654 format: date-time
103655
103656 - `organization_id: optional string or null`
103657
103658 Organization ID this activity is associated with
103659
103660 - `organization_uuid: optional string or null`
103661
103662 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
103663
103664 - `ParentOrganizationSettingsUpdated object`
103665
103666 Parent organization settings were updated.
103667
103668 - `type: optional "parent_organization_settings_updated"`
103669
103670 default: parent_organization_settings_updated
103671
103672 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
103673
103674 - `APIActor object`
103675
103676 - `type: optional "api_actor"`
103677
103678 default: api_actor
103679
103680 - `api_key_id: string`
103681
103682 - `ip_address: string`
103683
103684 - `user_agent: string`
103685
103686 - `UserActor object`
103687
103688 - `type: optional "user_actor"`
103689
103690 default: user_actor
103691
103692 - `email_address: string`
103693
103694 format: email
103695
103696 - `ip_address: string`
103697
103698 - `user_agent: string`
103699
103700 - `user_id: string`
103701
103702 - `UnauthenticatedUserActor object`
103703
103704 - `type: optional "unauthenticated_user_actor"`
103705
103706 default: unauthenticated_user_actor
103707
103708 - `ip_address: string`
103709
103710 - `user_agent: string`
103711
103712 - `unauthenticated_email_address: optional string or null`
103713
103714 format: email
103715
103716 - `AnthropicActor object`
103717
103718 - `type: optional "anthropic_actor"`
103719
103720 default: anthropic_actor
103721
103722 - `email_address: optional string or null`
103723
103724 format: email
103725
103726 - `SystemActor object`
103727
103728 Automated background processing performed by Anthropic systems, acting
103729 without a user or customer credential.
103730
103731 - `type: optional "system_actor"`
103732
103733 default: system_actor
103734
103735 - `service: optional string or null`
103736
103737 Name of the automated process that performed the action, when known.
103738
103739 - `AdminAPIKeyActor object`
103740
103741 - `type: optional "admin_api_key_actor"`
103742
103743 default: admin_api_key_actor
103744
103745 - `admin_api_key_id: string`
103746
103747 - `ip_address: string`
103748
103749 - `user_agent: string`
103750
103751 - `ServiceAccountActor object`
103752
103753 - `type: optional "service_account_actor"`
103754
103755 default: service_account_actor
103756
103757 - `ip_address: string`
103758
103759 - `service_account_id: string`
103760
103761 - `user_agent: string`
103762
103763 - `ScimDirectorySyncActor object`
103764
103765 - `type: optional "scim_directory_sync_actor"`
103766
103767 default: scim_directory_sync_actor
103768
103769 - `directory_id: string`
103770
103771 - `workos_event_id: string`
103772
103773 - `idp_connection_type: optional string or null`
103774
103775 - `FederatedIdentityActor object`
103776
103777 A federated external workload authenticated via a verified OIDC token.
103778
103779 Carries the verified issuer, subject, and audience claims from the
103780 presented JWT.
103781
103782 - `type: optional "federated_identity_actor"`
103783
103784 default: federated_identity_actor
103785
103786 - `issuer: string`
103787
103788 - `subject: string`
103789
103790 - `audience: optional array of string`
103791
103792 - `ip_address: optional string or null`
103793
103794 - `user_agent: optional string or null`
103795
103796 - `FederatedActor object`
103797
103798 An external identity asserted by a trusted provider — a cloud-provider
103799 gateway or a customer-registered federation issuer — acting without an
103800 Anthropic-provisioned account or service account.
103801
103802 - `type: optional "federated_actor"`
103803
103804 default: federated_actor
103805
103806 - `provider: Aws or Azure or Gcp or Oidc`
103807
103808 - `Aws object`
103809
103810 Asserting party: the AWS account the organization is bound to.
103811
103812 - `type: optional "aws"`
103813
103814 default: aws
103815
103816 - `account_id: string`
103817
103818 - `signed_principal: string`
103819
103820 The AWS-signed ARN of the IAM principal that requested the token.
103821
103822 - `Azure object`
103823
103824 Asserting party: the Azure subscription the organization is bound to.
103825
103826 - `type: optional "azure"`
103827
103828 default: azure
103829
103830 - `subscription_id: string`
103831
103832 - `Gcp object`
103833
103834 Asserting party: the GCP project the organization is bound to.
103835
103836 - `type: optional "gcp"`
103837
103838 default: gcp
103839
103840 - `project_number: string`
103841
103842 - `Oidc object`
103843
103844 Asserting party: a customer-registered OIDC federation issuer.
103845
103846 - `type: optional "oidc"`
103847
103848 default: oidc
103849
103850 - `issuer: optional string or null`
103851
103852 The federation issuer's URL. Null when the presented credential failed verification.
103853
103854 - `ip_address: optional string or null`
103855
103856 - `subject: optional string or null`
103857
103858 The provider's verified identifier for the caller; its form depends on the provider.
103859
103860 - `user_agent: optional string or null`
103861
103862 - `AttestedDeviceActor object`
103863
103864 An attested mobile device authenticated via Apple App Attest.
103865
103866 - `type: optional "attested_device_actor"`
103867
103868 default: attested_device_actor
103869
103870 - `external_client_id: string`
103871
103872 - `kid_hash: string`
103873
103874 - `ip_address: optional string or null`
103875
103876 - `user_agent: optional string or null`
103877
103878 - `parent_organization_id: string`
103879
103880 The parent organization whose settings were updated.
103881
103882 - `updates: array of object`
103883
103884 The setting changes applied in this update.
103885
103886 - `type: optional "name"`
103887
103888 default: name
103889
103890 - `current_value: string`
103891
103892 Setting value immediately after this change
103893
103894 - `previous_value: string`
103895
103896 Setting value immediately before this change
103897
103898 - `id: optional string`
103899
103900 Unique identifier for the activity e.g. 'activity_abcd1234'
103901
103902 - `created_at: optional string`
103903
103904 When this activity occurred.
103905
103906 format: date-time
103907
103908 - `organization_id: optional string or null`
103909
103910 Organization ID this activity is associated with
103911
103912 - `organization_uuid: optional string or null`
103913
103914 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
103915
99044103916 - `PaymentMethodUpdated object`
99045103917
99046103918 The organization's default payment method was updated.
from line 138563
133691138563
133692138564 format: date-time
133693138565
138566 - `idp_connection_id: optional string or null`
138567
138568 Identifies the identity provider connection the sign-in came through. `null` or absent when the sign-in was not matched to one of the parent organization's identity provider connections. Absent on activities recorded before this field was introduced.
138569
133694138570 - `organization_id: optional string or null`
133695138571
133696138572 Organization ID this activity is associated with
from line 138799
133923138799
133924138800 format: date-time
133925138801
138802 - `idp_connection_id: optional string or null`
138803
138804 Identifies the identity provider connection the user was sent to. `null` or absent when the user was not sent to a single connection, for example when they choose one on the next page. Absent on activities recorded before this field was introduced.
138805
133926138806 - `organization_id: optional string or null`
133927138807
133928138808 Organization ID this activity is associated with
from line 139043
134163139043
134164139044 format: date-time
134165139045
139046 - `idp_connection_id: optional string or null`
139047
139048 Identifies the identity provider connection the user signed in through. `null` or absent when the sign-in was not matched to one of the parent organization's identity provider connections. Absent on activities recorded before this field was introduced.
139049
134166139050 - `mfa_method: optional "not_used" or "unspecified" or null`
134167139051
134168139052 The second authentication factor performed during this login, if any. `null` when the second-factor status is not recorded on this event — for example, when authentication was delegated to an external identity provider and any second factor is not visible to Anthropic, or when this event is one step of a multistep login whose MFA is reported on another activity. May be absent on activities recorded before this field was introduced.
from line 153839
148955153839
148956153840The organization must belong to the API key's organization hierarchy;
148957153841unknown organizations and organizations outside the hierarchy return 404.
153842The verified_domains and identity_providers settings describe the whole
153843parent organization and are returned only to API keys that are not
153844restricted to a single organization.
148958153845
148959153846#### Path parameters
148960153847
from line 153907
149020153907
149021153908- `organization_id: string`
149022153909
149023- `settings: array of Boolean or Integer or String or 3 more`
153910- `settings: array of Boolean or Integer or String or 5 more`
149024153911
149025153912 - `Boolean object`
149026153913
from line 153917
149030153917
149031153918 default: boolean
149032153919
149033 - `name: "access_transparency_enabled" or "ai_powered_artifacts_enabled" or "api_workbench_feedback_collection_enabled" or 61 more`
153920 - `name: "access_transparency_enabled" or "ai_powered_artifacts_enabled" or "api_workbench_feedback_collection_enabled" or 64 more`
149034153921
149035153922 - `"access_transparency_enabled"`
149036153923
from line 153939
149052153939
149053153940 - `"claude_ai_ccr_support_sharing_enabled"`
149054153941
153942 - `"claude_ai_chat_external_sharing_enabled"`
153943
153944 - `"claude_ai_chat_org_sharing_enabled"`
153945
149055153946 - `"claude_ai_chat_sharing_enabled"`
149056153947
149057153948 - `"claude_ai_feedback_collection_enabled"`
from line 153979
149088153979
149089153980 - `"claude_in_slack_enabled"`
149090153981
153982 - `"claude_science_auto_mode_enabled"`
153983
149091153984 - `"claude_science_custom_connectors_enabled"`
149092153985
149093153986 - `"claude_science_custom_skills_enabled"`
from line 154178
149285154178
149286154179 default: data_retention_periods
149287154180
154181 - `VerifiedDomains object`
154182
154183 The domains verified for the organization's parent organization. The
154184 same for every organization under that parent, and returned only to API
154185 keys that are not restricted to a single organization.
154186
154187 - `type: optional "verified_domains"`
154188
154189 default: verified_domains
154190
154191 - `value: array of object`
154192
154193 - `domain: string`
154194
154195 The verified domain name.
154196
154197 - `sso_claude_ai_enforced: boolean`
154198
154199 Whether single sign-on is required to sign in to Claude.ai with an email address on this domain.
154200
154201 - `sso_console_enforced: boolean`
154202
154203 Whether single sign-on is required to sign in to the Claude Console with an email address on this domain.
154204
154205 - `name: optional "verified_domains"`
154206
154207 default: verified_domains
154208
154209 - `IdentityProviders object`
154210
154211 The IdP connections of the organization's parent organization, oldest
154212 first. The same for every organization under that parent, and returned
154213 only to API keys that are not restricted to a single organization.
154214
154215 - `type: optional "identity_providers"`
154216
154217 default: identity_providers
154218
154219 - `value: array of object`
154220
154221 - `id: string`
154222
154223 Unique identifier for the IdP connection.
154224
154225 - `directory_sync_enabled: boolean`
154226
154227 Whether directory sync through this IdP connection is enabled.
154228
154229 - `sso_enabled: boolean`
154230
154231 Whether single sign-on through this IdP connection is enabled.
154232
154233 - `name: optional "identity_providers"`
154234
154235 default: identity_providers
154236
149288154237#### Example
149289154238
149290154239```bash
from line 154272
149323154272}
149324154273```
149325154274
154275## Compliance API › Organizations › Security Posture
154276
154277### Get an organization's security posture
154278
154279**GET** `/v1/compliance/organizations/{organization_id}/security_posture`
154280
154281Get an organization's security controls and their current results.
154282
154283Returns the organization's security controls, evaluated at the time of the
154284request, each with its attestation when this endpoint returns one. The controls come
154285in one `controls` list, which is not paginated. A control can have no entry, for
154286example when it is about a feature that the organization cannot have, so a missing
154287control is not a pass.
154288
154289The `anthropic-version` header is required: a request without it returns 400.
154290The endpoint takes no query parameters, so there is no filter, and a request with
154291any query parameter also returns 400. A request also returns 400 when the Compliance
154292API is not enabled for the API key's parent organization.
154293The request returns 404 when `organization_id` names no organization, names one
154294that the API key cannot read, or names one whose security controls are not
154295available. A request over a rate limit returns 429.
154296
154297One error has an `error_code` in `error.details`. A 503 with
154298`posture_evaluation_failed` means that the evaluation could not be completed.
154299Wait for the time in the `Retry-After` header before trying again. A 504 means
154300that the evaluation did not finish in time, and the request can be tried again.
154301
154302#### Path parameters
154303
154304- `organization_id: string`
154305
154306 The organization's UUID
154307
154308#### Headers
154309
154310- `"anthropic-version": optional string`
154311
154312 The version of the Claude API you want to use.
154313
154314 Read more about versioning and our version history [here](https://platform.claude.com/docs/en/api/versioning?sdk_languages=http).
154315
154316- `"x-api-key": optional string`
154317
154318#### Returns
154319
154320- `type: "security_posture"`
154321
154322 Always `security_posture`.
154323
154324- `comments_status: "available" or "not_enabled" or "not_permitted" or 2 more`
154325
154326 Whether attestation comments were read. More values can be added; read an unknown one as `unavailable`.
154327
154328 - `"available"`
154329
154330 Comments were read, so a null `comment` means that there is none, or that the attestation was saved moments ago.
154331
154332 - `"not_enabled"`
154333
154334 This endpoint does not return comments for the organization, so every `comment` is null.
154335
154336 - `"not_permitted"`
154337
154338 The API key holds neither `read:compliance_user_data` nor `read:org_audit`, so every `comment` and every `attested_by` is null.
154339
154340 - `"requires_organization_key"`
154341
154342 The API key was not created in the organization, for example because it was created for the parent organization, so no comment is read and every `comment` is null. `attested_by` is returned as it is to a key created in the organization. This value does not say whether this endpoint returns comments for the organization. Retrying does not help: only a key created in the organization can read its comments.
154343
154344 - `"unavailable"`
154345
154346 Comments could not be read for this response. A later request may succeed, but some causes persist, for example when the organization's customer-managed encryption key cannot be used.
154347
154348- `controls: array of object`
154349
154350 The organization's controls, never empty. A control can have no entry, for example when it is about a feature that the organization cannot have, so a missing control is not a pass.
154351
154352 - `id: string`
154353
154354 The control's identifier, which is the same for every organization and never changes.
154355
154356 - `attestation: object or null`
154357
154358 The attestation of this control. It is still returned after it stops being in effect; see its `state`. Null when nobody has attested, when attestations of this kind are not enabled for the organization, and while the status is `descriptive`, `not_applicable` or `not_evaluated`. It is also null when the attestation stored for the control is of a kind that this endpoint does not return, so null does not prove that nobody has attested.
154359
154360 - `attested_at: string`
154361
154362 When the attestation was made.
154363
154364 format: date-time
154365
154366 - `attested_by: object or null`
154367
154368 Who made the attestation. Null when the response's `comments_status` is `not_permitted`, when showing who attested is not enabled for the organization, when the person's account has been deleted, or while Anthropic holds back who attested for every organization.
154369
154370 - `type: "user_actor"`
154371
154372 Always `user_actor`.
154373
154374 - `user_id: string`
154375
154376 User identifier (tagged ID, prefixed `user_`).
154377
154378 - `comment: string or null`
154379
154380 The comment saved with the attestation, of at most 2,000 characters. It is the text of the last save, which can keep words that an earlier administrator wrote. Null if there is none, or if the response's `comments_status` is not `available`.
154381
154382 - `state: "check_passing" or "in_force" or "review_due" or "setting_changed" or null`
154383
154384 Whether the attestation is still in effect. Null only on a manual control, and only when end dates do not apply to the organization; the attestation is then in effect. More values can be added; read an unknown one as not in effect.
154385
154386 - `"check_passing"`
154387
154388 Not in effect: the automatic check passes.
154389
154390 - `"in_force"`
154391
154392 The attestation is in effect.
154393
154394 - `"review_due"`
154395
154396 Not in effect: the attestation's end date, also called its review date, has come, so it is due for review.
154397
154398 - `"setting_changed"`
154399
154400 Not in effect: the automatic check fails, either on a different value from the one whose risk was accepted, or after the accepted risk was recorded as ended.
154401
154402 - `current_value: string or null`
154403
154404 The value read for the control, as display text whose wording can change. It is in English, apart from values taken from the organization's settings, such as its allowed email domains. A list names only the entries that this endpoint recognizes, followed by the number of other entries, if any. Null on a manual control, while the status is `not_evaluated`, and while the status is `not_applicable` because the control applies only when another setting has a certain value.
154405
154406 - `desired_state: string or null`
154407
154408 The recommended value, as display text whose wording can change. It is in English, apart from values such as the organization's ID. Null when there is none for this organization.
154409
154410 - `display_name: string`
154411
154412 The control's display name, in English.
154413
154414 - `rating: "descriptive" or "failed" or "not_attested" or "passed"`
154415
154416 The control's overall result, which follows from `status`. More values can be added; read an unknown one as not passed.
154417
154418 - `"descriptive"`
154419
154420 Descriptive: not rated, which includes controls that do not apply or could not be read.
154421
154422 - `"failed"`
154423
154424 Failed. Because of an attestation that this endpoint does not return, a control can have this rating while the Security posture page shows it as Passed.
154425
154426 - `"not_attested"`
154427
154428 Not attested: a manual control with no attestation in effect.
154429
154430 - `"passed"`
154431
154432 Passed. This includes a control with an accepted risk in effect, whether automatic or manual.
154433
154434 - `section: "capabilities" or "chats_desktop_mdm" or "claude_code_admin_console" or 7 more`
154435
154436 The section that this control belongs to. More values can be added; treat an unknown one as a section of its own.
154437
154438 - `"capabilities"`
154439
154440 Capabilities
154441
154442 - `"chats_desktop_mdm"`
154443
154444 Chats: desktop device management
154445
154446 - `"claude_code_admin_console"`
154447
154448 Claude Code: admin console
154449
154450 - `"claude_code_managed_settings"`
154451
154452 Claude Code: managed settings
154453
154454 - `"connectors_integrations"`
154455
154456 Connectors and integrations
154457
154458 - `"cowork_admin_console"`
154459
154460 Cowork: admin console
154461
154462 - `"cowork_desktop_mdm"`
154463
154464 Cowork: desktop device management
154465
154466 - `"data_privacy"`
154467
154468 Data and privacy
154469
154470 - `"healthy_adoption"`
154471
154472 Healthy adoption
154473
154474 - `"identity_access"`
154475
154476 Identity and access
154477
154478 - `setting_name: string or null`
154479
154480 The `name` of the entry in the organization's effective settings that this control reads. Null when it reads no such entry.
154481
154482 - `status: "attestation_not_enabled" or "attested_accepted_risk" or "attested_completed" or 10 more`
154483
154484 Why the control has its rating. A manual control is one that only a person can check. An automatic control reads a value from the organization, usually one of its settings, and some are checked against a recommended value. The recommended values are those of the standard profile, which every organization is rated under. More values can be added; count a control with an unknown one by its `rating`.
154485
154486 - `"attestation_not_enabled"`
154487
154488 A manual control that nobody in the organization can attest to.
154489
154490 - `"attested_accepted_risk"`
154491
154492 A manual control attested as Accepted risk, with the attestation in effect.
154493
154494 - `"attested_completed"`
154495
154496 A manual control attested as Completed, with the attestation in effect.
154497
154498 - `"descriptive"`
154499
154500 The control is reported for information only.
154501
154502 - `"exceeds_baseline"`
154503
154504 The current value is stricter than the recommended value.
154505
154506 - `"failed"`
154507
154508 The current value does not meet the recommended value. An attestation that this endpoint does not return can also give a control this status.
154509
154510 - `"failed_check_accepted_risk"`
154511
154512 The automatic check fails, and an accepted risk is in effect.
154513
154514 - `"matches_profile"`
154515
154516 The current value equals the recommended value.
154517
154518 - `"not_applicable"`
154519
154520 The control does not apply to the organization.
154521
154522 - `"not_attested"`
154523
154524 A manual control that can be attested to, with no attestation in effect.
154525
154526 - `"not_evaluated"`
154527
154528 The setting behind the control, or another setting that decides whether the control applies, could not be read.
154529
154530 - `"passed"`
154531
154532 The current value meets the recommended value.
154533
154534 - `"review"`
154535
154536 The current value is looser than the recommended value.
154537
154538- `evaluated_at: string`
154539
154540 The time at which every control was evaluated.
154541
154542 format: date-time
154543
154544- `organization_id: string`
154545
154546 The organization's UUID.
154547
154548#### Example
154549
154550```bash
154551curl https://api.anthropic.com/v1/compliance/organizations/$ORGANIZATION_ID/security_posture \
154552 -H 'anthropic-version: 2023-06-01' \
154553 -H "Authorization: Bearer $ANTHROPIC_COMPLIANCE_API_KEY"
154554```
154555
154556##### Response (200)
154557
154558```json
154559{
154560 "comments_status": "not_enabled",
154561 "controls": [
154562 {
154563 "id": "sso_enabled",
154564 "attestation": {
154565 "attested_at": "2025-03-12T18:22:41.123456Z",
154566 "attested_by": {
154567 "type": "user_actor",
154568 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
154569 },
154570 "comment": null,
154571 "state": "in_force"
154572 },
154573 "current_value": "On",
154574 "desired_state": "On",
154575 "display_name": "Single sign-on (SSO)",
154576 "rating": "passed",
154577 "section": "identity_access",
154578 "setting_name": "sso_enabled",
154579 "status": "passed"
154580 }
154581 ],
154582 "evaluated_at": "2025-03-12T18:22:41.123456Z",
154583 "organization_id": "a1b2c3d4-e5f6-4789-a012-3456789abcde",
154584 "type": "security_posture"
154585}
154586```
154587
149326154588## Compliance API › Groups
149327154589
149328154590### List Compliance Groups
from line 157713
152451157713forward-only: pass the response's `next_page` value back as `page` to
152452157714retrieve the next page, and stop when `next_page` is null.
152453157715
157716Returns 403 with the `error_code` `organization_compliance_restricted` in
157717`error.details` when an organization the request covers, or the key's own
157718organization, has compliance settings that do not allow its remote
157719sessions to be listed through the Compliance API. No sessions are
157720returned, and the error does not say which organization it is.
157721
152454157722#### Query parameters
152455157723
152456157724- `created_at: optional object`
from line 157807
152539157807
152540157808 - `product_surface: string or null`
152541157809
152542 The Claude product the session was created from. Currently `cowork_remote`, for Cowork sessions started on claude.ai web or mobile. More values will appear as other surfaces launch, so treat any unrecognized value as an unclassified surface rather than an error. Null for sessions created before this field was recorded, for surfaces that do not stamp it, and for unrecognized tag values.
157810 The Claude product the session was created from. Currently `cowork_remote`, for Cowork sessions started on claude.ai web or mobile, and `claude_tag`, for Claude Tag sessions started in Slack. More values will appear as other surfaces launch, so treat any unrecognized value as an unclassified surface rather than an error. Null for sessions created before this field was recorded, for surfaces that do not stamp it, and for unrecognized tag values.
152543157811
152544157812 - `started_by_user: object or null`
152545157813
from line 157905
152637157905and for sessions outside the organizations the key may read. A
152638157906malformed session identifier returns 400.
152639157907
157908Returns 403 with the `error_code` `organization_compliance_restricted` in
157909`error.details` when the session's organization, or the key's own
157910organization, has compliance settings that do not allow its remote
157911sessions to be read through the Compliance API. A retry does not help
157912until those settings change.
157913
152640157914#### Path parameters
152641157915
152642157916- `claude_remote_session_id: string`
from line 158113
152839158113
152840158114 - `product_surface: string or null`
152841158115
152842 The Claude product the session was created from. Currently `cowork_remote`, for Cowork sessions started on claude.ai web or mobile. More values will appear as other surfaces launch, so treat any unrecognized value as an unclassified surface rather than an error. Null for sessions created before this field was recorded, for surfaces that do not stamp it, and for unrecognized tag values.
158116 The Claude product the session was created from. Currently `cowork_remote`, for Cowork sessions started on claude.ai web or mobile, and `claude_tag`, for Claude Tag sessions started in Slack. More values will appear as other surfaces launch, so treat any unrecognized value as an unclassified surface rather than an error. Null for sessions created before this field was recorded, for surfaces that do not stamp it, and for unrecognized tag values.
152843158117
152844158118 - `started_by_user: object or null`
152845158119
from line 158246
152972158246
152973158247 - `gte: optional string`
152974158248
152975 Return only Artifacts updated at or after this time (RFC 3339 format). Time filters match an eventually-consistent index and Artifacts published before this field was recorded never match — omit the time filter for compliance-complete enumeration. For incremental export, apply a generous overlap margin between windows and dedupe by `id`: adjacent tiling silently misses items whose index update lagged their publish.
158249 Return only Artifacts updated at or after this time (RFC 3339 format). Time filters match an eventually-consistent index and Artifacts published before this field was recorded never match — omit the time filter for compliance-complete enumeration. For incremental export, apply a generous overlap margin between windows and dedupe by `id`: adjacent tiling silently misses items whose index update lagged their publish. Folder changes, such as sharing or unsharing a folder or moving an Artifact or folder, can change `read_mode` without changing `updated_at`, so time filters do not pick up those changes. To see an Artifact's current `read_mode`, omit the time filter.
152976158250
152977158251 format: date-time
152978158252
152979158253
No line in this hunk matches that.