Query compliance activities changedapi/compliance/activities/list
Nearest release: v2.1.322, published 2 hours before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+4,896added
Lines−12removed
From line
15
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits36to this page, all time
The whole hunk
from line 15, old and new numbered
/
This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.
The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.
from line 15
1515
1616## Query parameters
1717
18- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "account_migration_completed" or 571 more`
18- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "account_migration_completed" or 589 more`
1919
2020 Filter activities by type. See the response `data` schema for the additional fields each type returns. Cannot be combined with `exclude_activity_types[]`.
2121
from line 262
262262
263263 An organization admin allowed one artifact to be shared outside the organization by link while the organization-wide external sharing setting was off, or revoked that permission.
264264
265 - `"claude_artifact_folder_created"`
266
267 A folder for artifacts was created, inside another folder or in none.
268
269 - `"claude_artifact_folder_moved"`
270
271 A folder for artifacts was moved into, out of or between other folders, by its owner or by someone else, whether or not a folder is shared; the artifacts and folders inside it moved with it and were not recorded as moves of their own.
272
265273 - `"claude_artifact_invite_accepted"`
266274
267275 Someone outside the organization signed in with a verified account for the invited address and accepted an invitation to an artifact, and can now open it; recorded in the artifact owner's organization. The person who accepted is identified by `invitee_email` and `invitee_user_id`.
from line 286
278286
279287 A member changed the access level of an email invitation to an artifact for someone outside the organization, whether the invitation was still pending or had been accepted; recorded in the artifact owner's organization with that member as the actor.
280288
289 - `"claude_artifact_moved"`
290
291 An artifact was moved into, out of or between folders, by its owner or by someone else, whether or not a folder is shared; an artifact that leaves its folder as part of another event, such as its own deletion or the erasure of an account, might not be recorded as a move.
292
281293 - `"claude_artifact_published"`
282294
283 A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded when the artifact is saved, including saves of private artifacts, except that automatic saves made while a person keeps editing may be recorded periodically for that person rather than once per save; changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
295 A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded when the artifact is saved, including saves of private artifacts and, for some artifacts, edits to stored content that make no new version, except that such edits, and automatic saves made while a person keeps editing, may be recorded periodically for that person rather than once per save; changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
284296
285297 - `"claude_artifact_sent_to_partner"`
286298
from line 834
822834
823835 An administrator allowed a skill version despite its security scan's verdict, or that allowance was revoked.
824836
837 - `"claude_skill_served_version_updated"`
838
839 A skill's served version, the version that members get, was updated: an administrator or the owner chose a version, a saved version became the served version, or an accepted library submission was published into the skill. A new version that is served as soon as it is saved may appear only as claude_skill_version_created.
840
841 - `"claude_skill_version_created"`
842
843 A new version of a skill was created.
844
825845 - `"claude_survey_closed"`
826846
827847 An organization admin closed an in-app survey before its end date, ending the collection of responses; a survey that reaches its end date records no event.
from line 1410
13901410
13911411 Organization domain was removed.
13921412
1413 - `"org_domain_sso_enforcement_updated"`
1414
1415 A verified domain's single sign-on requirement changed, per surface.
1416
1417 - `"org_domain_sso_routing_updated"`
1418
1419 A verified domain's single sign-on routing was saved or changed. Lists the identity provider connections the domain's users sign in through before and after; the two lists are the same when a save changed nothing.
1420
13931421 - `"org_domain_verified"`
13941422
13951423 Organization domain was verified.
from line 1454
14261454
14271455 A primary owner accepted the Business Associate Agreement and enabled the HIPAA configuration for the organization through the self-serve flow.
14281456
1457 - `"org_idp_connection_created"`
1458
1459 An identity provider connection was added to the parent organization.
1460
1461 - `"org_idp_connection_deleted"`
1462
1463 An identity provider connection was removed from the parent organization, along with the settings that referenced it.
1464
1465 - `"org_idp_connection_updated"`
1466
1467 An identity provider connection's settings were changed.
1468
14291469 - `"org_invite_link_disabled"`
14301470
14311471 Organization invite link was disabled.
from line 1566
15261566
15271567 Organization parent search was performed.
15281568
1569 - `"org_security_control_attestation_updated"`
1570
1571 The organization's attestation for a security control was recorded, changed, renewed or cleared by an administrator, or was ended automatically.
1572
15291573 - `"org_sso_add_initiated"`
15301574
15311575 Organization SSO setup was initiated.
from line 1694
16501694
16511695 Access to owned projects was restored.
16521696
1697 - `"parent_organization_centralized_management_enrolled"`
1698
1699 A parent organization was enrolled in centralized management.
1700
1701 - `"parent_organization_centralized_management_organization_updated"`
1702
1703 An organization's approval of its parent organization's Centralized Management setup changed, or its administrators were reminded to approve.
1704
1705 - `"parent_organization_centralized_management_setup_updated"`
1706
1707 The Centralized Management setup of a parent organization changed: it was started or abandoned, its proposed administrators changed, its remaining organizations were force approved, or it completed.
1708
1709 - `"parent_organization_centralized_management_unenrolled"`
1710
1711 A parent organization was unenrolled from centralized management.
1712
1713 - `"parent_organization_member_removed"`
1714
1715 A parent-organization admin role was removed from a user.
1716
1717 - `"parent_organization_member_updated"`
1718
1719 A parent-organization admin role was granted or changed for a user.
1720
1721 - `"parent_organization_settings_updated"`
1722
1723 Parent organization settings were updated.
1724
16531725 - `"payment_method_updated"`
16541726
16551727 The organization's default payment method was updated.
from line 2445
23732445
23742446 format: date-time
23752447
2376- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "account_migration_completed" or 571 more`
2448- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "account_migration_completed" or 589 more`
23772449
23782450 Exclude activities of these types. Cannot be combined with `activity_types[]`.
23792451
from line 2692
26202692
26212693 An organization admin allowed one artifact to be shared outside the organization by link while the organization-wide external sharing setting was off, or revoked that permission.
26222694
2695 - `"claude_artifact_folder_created"`
2696
2697 A folder for artifacts was created, inside another folder or in none.
2698
2699 - `"claude_artifact_folder_moved"`
2700
2701 A folder for artifacts was moved into, out of or between other folders, by its owner or by someone else, whether or not a folder is shared; the artifacts and folders inside it moved with it and were not recorded as moves of their own.
2702
26232703 - `"claude_artifact_invite_accepted"`
26242704
26252705 Someone outside the organization signed in with a verified account for the invited address and accepted an invitation to an artifact, and can now open it; recorded in the artifact owner's organization. The person who accepted is identified by `invitee_email` and `invitee_user_id`.
from line 2716
26362716
26372717 A member changed the access level of an email invitation to an artifact for someone outside the organization, whether the invitation was still pending or had been accepted; recorded in the artifact owner's organization with that member as the actor.
26382718
2719 - `"claude_artifact_moved"`
2720
2721 An artifact was moved into, out of or between folders, by its owner or by someone else, whether or not a folder is shared; an artifact that leaves its folder as part of another event, such as its own deletion or the erasure of an account, might not be recorded as a move.
2722
26392723 - `"claude_artifact_published"`
26402724
2641 A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded when the artifact is saved, including saves of private artifacts, except that automatic saves made while a person keeps editing may be recorded periodically for that person rather than once per save; changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
2725 A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded when the artifact is saved, including saves of private artifacts and, for some artifacts, edits to stored content that make no new version, except that such edits, and automatic saves made while a person keeps editing, may be recorded periodically for that person rather than once per save; changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
26422726
26432727 - `"claude_artifact_sent_to_partner"`
26442728
from line 3264
31803264
31813265 An administrator allowed a skill version despite its security scan's verdict, or that allowance was revoked.
31823266
3267 - `"claude_skill_served_version_updated"`
3268
3269 A skill's served version, the version that members get, was updated: an administrator or the owner chose a version, a saved version became the served version, or an accepted library submission was published into the skill. A new version that is served as soon as it is saved may appear only as claude_skill_version_created.
3270
3271 - `"claude_skill_version_created"`
3272
3273 A new version of a skill was created.
3274
31833275 - `"claude_survey_closed"`
31843276
31853277 An organization admin closed an in-app survey before its end date, ending the collection of responses; a survey that reaches its end date records no event.
from line 3840
37483840
37493841 Organization domain was removed.
37503842
3843 - `"org_domain_sso_enforcement_updated"`
3844
3845 A verified domain's single sign-on requirement changed, per surface.
3846
3847 - `"org_domain_sso_routing_updated"`
3848
3849 A verified domain's single sign-on routing was saved or changed. Lists the identity provider connections the domain's users sign in through before and after; the two lists are the same when a save changed nothing.
3850
37513851 - `"org_domain_verified"`
37523852
37533853 Organization domain was verified.
from line 3884
37843884
37853885 A primary owner accepted the Business Associate Agreement and enabled the HIPAA configuration for the organization through the self-serve flow.
37863886
3887 - `"org_idp_connection_created"`
3888
3889 An identity provider connection was added to the parent organization.
3890
3891 - `"org_idp_connection_deleted"`
3892
3893 An identity provider connection was removed from the parent organization, along with the settings that referenced it.
3894
3895 - `"org_idp_connection_updated"`
3896
3897 An identity provider connection's settings were changed.
3898
37873899 - `"org_invite_link_disabled"`
37883900
37893901 Organization invite link was disabled.
from line 3996
38843996
38853997 Organization parent search was performed.
38863998
3999 - `"org_security_control_attestation_updated"`
4000
4001 The organization's attestation for a security control was recorded, changed, renewed or cleared by an administrator, or was ended automatically.
4002
38874003 - `"org_sso_add_initiated"`
38884004
38894005 Organization SSO setup was initiated.
from line 4124
40084124
40094125 Access to owned projects was restored.
40104126
4127 - `"parent_organization_centralized_management_enrolled"`
4128
4129 A parent organization was enrolled in centralized management.
4130
4131 - `"parent_organization_centralized_management_organization_updated"`
4132
4133 An organization's approval of its parent organization's Centralized Management setup changed, or its administrators were reminded to approve.
4134
4135 - `"parent_organization_centralized_management_setup_updated"`
4136
4137 The Centralized Management setup of a parent organization changed: it was started or abandoned, its proposed administrators changed, its remaining organizations were force approved, or it completed.
4138
4139 - `"parent_organization_centralized_management_unenrolled"`
4140
4141 A parent organization was unenrolled from centralized management.
4142
4143 - `"parent_organization_member_removed"`
4144
4145 A parent-organization admin role was removed from a user.
4146
4147 - `"parent_organization_member_updated"`
4148
4149 A parent-organization admin role was granted or changed for a user.
4150
4151 - `"parent_organization_settings_updated"`
4152
4153 Parent organization settings were updated.
4154
40114155 - `"payment_method_updated"`
40124156
40134157 The organization's default payment method was updated.
from line 4855
47114855
47124856- `organization_ids: optional array of string`
47134857
4714 Filter activities by organization IDs (accepts `org_...` or organization UUID). Enumerate IDs via `GET /v1/compliance/organizations`.
4858 Filter activities by organization IDs (accepts `org_...` or organization UUID, up to 20). Enumerate IDs via `GET /v1/compliance/organizations`.
47154859
47164860- `user_ids: optional array of string`
47174861
from line 4873
47294873
47304874## Returns
47314875
4732- `data: optional array of AbuseDecisionReceived or AccountDeleted or AccountMigrationCompleted or 571 more`
4876- `data: optional array of AbuseDecisionReceived or AccountDeleted or AccountMigrationCompleted or 589 more`
47334877
47344878 List of activity records. Each element's `type` field identifies which activity it is and which additional fields are present.
47354879
from line 9762
96189762
96199763 - `ClaudeArtifactPublished object`
96209764
9621 A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded when the artifact is saved, including saves of private artifacts, except that automatic saves made while a person keeps editing may be recorded periodically for that person rather than once per save; changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
9765 A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded when the artifact is saved, including saves of private artifacts and, for some artifacts, edits to stored content that make no new version, except that such edits, and automatic saves made while a person keeps editing, may be recorded periodically for that person rather than once per save; changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
96229766
96239767 - `type: optional "claude_artifact_published"`
96249768
from line 10238
1009410238
1009510239 - `audience: array of Organization or Users or AnyoneWithLink`
1009610240
10097 The artifact's sharing audience after the change. If empty, the artifact is visible only to its owner.
10241 The artifact's own sharing audience after the change. If empty, the artifact itself is not shared with named users, its organization or anyone with the link, but people can still have access in other ways, such as through a folder it is in or a folder above that one. Changes people make to a folder's sharing are recorded as `role_assignment_granted` and `role_assignment_revoked` activities on the folder, and moves as `claude_artifact_moved` and `claude_artifact_folder_moved`.
1009810242
1009910243 - `Organization object`
1010010244
from line 22138
2199422138
2199522139 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
2199622140
22141 - `ClaudeArtifactFolderCreated object`
22142
22143 A folder for artifacts was created, inside another folder or in none.
22144
22145 - `type: optional "claude_artifact_folder_created"`
22146
22147 default: claude_artifact_folder_created
22148
22149 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
22150
22151 - `APIActor object`
22152
22153 - `type: optional "api_actor"`
22154
22155 default: api_actor
22156
22157 - `api_key_id: string`
22158
22159 - `ip_address: string`
22160
22161 - `user_agent: string`
22162
22163 - `UserActor object`
22164
22165 - `type: optional "user_actor"`
22166
22167 default: user_actor
22168
22169 - `email_address: string`
22170
22171 format: email
22172
22173 - `ip_address: string`
22174
22175 - `user_agent: string`
22176
22177 - `user_id: string`
22178
22179 - `UnauthenticatedUserActor object`
22180
22181 - `type: optional "unauthenticated_user_actor"`
22182
22183 default: unauthenticated_user_actor
22184
22185 - `ip_address: string`
22186
22187 - `user_agent: string`
22188
22189 - `unauthenticated_email_address: optional string or null`
22190
22191 format: email
22192
22193 - `AnthropicActor object`
22194
22195 - `type: optional "anthropic_actor"`
22196
22197 default: anthropic_actor
22198
22199 - `email_address: optional string or null`
22200
22201 format: email
22202
22203 - `SystemActor object`
22204
22205 Automated background processing performed by Anthropic systems, acting
22206 without a user or customer credential.
22207
22208 - `type: optional "system_actor"`
22209
22210 default: system_actor
22211
22212 - `service: optional string or null`
22213
22214 Name of the automated process that performed the action, when known.
22215
22216 - `AdminAPIKeyActor object`
22217
22218 - `type: optional "admin_api_key_actor"`
22219
22220 default: admin_api_key_actor
22221
22222 - `admin_api_key_id: string`
22223
22224 - `ip_address: string`
22225
22226 - `user_agent: string`
22227
22228 - `ServiceAccountActor object`
22229
22230 - `type: optional "service_account_actor"`
22231
22232 default: service_account_actor
22233
22234 - `ip_address: string`
22235
22236 - `service_account_id: string`
22237
22238 - `user_agent: string`
22239
22240 - `ScimDirectorySyncActor object`
22241
22242 - `type: optional "scim_directory_sync_actor"`
22243
22244 default: scim_directory_sync_actor
22245
22246 - `directory_id: string`
22247
22248 - `workos_event_id: string`
22249
22250 - `idp_connection_type: optional string or null`
22251
22252 - `FederatedIdentityActor object`
22253
22254 A federated external workload authenticated via a verified OIDC token.
22255
22256 Carries the verified issuer, subject, and audience claims from the
22257 presented JWT.
22258
22259 - `type: optional "federated_identity_actor"`
22260
22261 default: federated_identity_actor
22262
22263 - `issuer: string`
22264
22265 - `subject: string`
22266
22267 - `audience: optional array of string`
22268
22269 - `ip_address: optional string or null`
22270
22271 - `user_agent: optional string or null`
22272
22273 - `FederatedActor object`
22274
22275 An external identity asserted by a trusted provider — a cloud-provider
22276 gateway or a customer-registered federation issuer — acting without an
22277 Anthropic-provisioned account or service account.
22278
22279 - `type: optional "federated_actor"`
22280
22281 default: federated_actor
22282
22283 - `provider: Aws or Azure or Gcp or Oidc`
22284
22285 - `Aws object`
22286
22287 Asserting party: the AWS account the organization is bound to.
22288
22289 - `type: optional "aws"`
22290
22291 default: aws
22292
22293 - `account_id: string`
22294
22295 - `signed_principal: string`
22296
22297 The AWS-signed ARN of the IAM principal that requested the token.
22298
22299 - `Azure object`
22300
22301 Asserting party: the Azure subscription the organization is bound to.
22302
22303 - `type: optional "azure"`
22304
22305 default: azure
22306
22307 - `subscription_id: string`
22308
22309 - `Gcp object`
22310
22311 Asserting party: the GCP project the organization is bound to.
22312
22313 - `type: optional "gcp"`
22314
22315 default: gcp
22316
22317 - `project_number: string`
22318
22319 - `Oidc object`
22320
22321 Asserting party: a customer-registered OIDC federation issuer.
22322
22323 - `type: optional "oidc"`
22324
22325 default: oidc
22326
22327 - `issuer: optional string or null`
22328
22329 The federation issuer's URL. Null when the presented credential failed verification.
22330
22331 - `ip_address: optional string or null`
22332
22333 - `subject: optional string or null`
22334
22335 The provider's verified identifier for the caller; its form depends on the provider.
22336
22337 - `user_agent: optional string or null`
22338
22339 - `AttestedDeviceActor object`
22340
22341 An attested mobile device authenticated via Apple App Attest.
22342
22343 - `type: optional "attested_device_actor"`
22344
22345 default: attested_device_actor
22346
22347 - `external_client_id: string`
22348
22349 - `kid_hash: string`
22350
22351 - `ip_address: optional string or null`
22352
22353 - `user_agent: optional string or null`
22354
22355 - `claude_artifact_folder_id: string`
22356
22357 Tagged ID ("cfld_...") of the folder that was created.
22358
22359 - `id: optional string`
22360
22361 Unique identifier for the activity e.g. 'activity_abcd1234'
22362
22363 - `created_at: optional string`
22364
22365 When this activity occurred.
22366
22367 format: date-time
22368
22369 - `organization_id: optional string or null`
22370
22371 Organization ID this activity is associated with
22372
22373 - `organization_uuid: optional string or null`
22374
22375 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
22376
22377 - `parent_claude_artifact_folder_id: optional string or null`
22378
22379 Tagged ID ("cfld_...") of the folder that the new folder was created directly inside; absent when it was created in no other folder.
22380
22381 - `ClaudeArtifactFolderMoved object`
22382
22383 A folder for artifacts was moved into, out of or between other folders, by its owner or by someone else, whether or not a folder is shared; the artifacts and folders inside it moved with it and were not recorded as moves of their own.
22384
22385 - `type: optional "claude_artifact_folder_moved"`
22386
22387 default: claude_artifact_folder_moved
22388
22389 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
22390
22391 - `APIActor object`
22392
22393 - `type: optional "api_actor"`
22394
22395 default: api_actor
22396
22397 - `api_key_id: string`
22398
22399 - `ip_address: string`
22400
22401 - `user_agent: string`
22402
22403 - `UserActor object`
22404
22405 - `type: optional "user_actor"`
22406
22407 default: user_actor
22408
22409 - `email_address: string`
22410
22411 format: email
22412
22413 - `ip_address: string`
22414
22415 - `user_agent: string`
22416
22417 - `user_id: string`
22418
22419 - `UnauthenticatedUserActor object`
22420
22421 - `type: optional "unauthenticated_user_actor"`
22422
22423 default: unauthenticated_user_actor
22424
22425 - `ip_address: string`
22426
22427 - `user_agent: string`
22428
22429 - `unauthenticated_email_address: optional string or null`
22430
22431 format: email
22432
22433 - `AnthropicActor object`
22434
22435 - `type: optional "anthropic_actor"`
22436
22437 default: anthropic_actor
22438
22439 - `email_address: optional string or null`
22440
22441 format: email
22442
22443 - `SystemActor object`
22444
22445 Automated background processing performed by Anthropic systems, acting
22446 without a user or customer credential.
22447
22448 - `type: optional "system_actor"`
22449
22450 default: system_actor
22451
22452 - `service: optional string or null`
22453
22454 Name of the automated process that performed the action, when known.
22455
22456 - `AdminAPIKeyActor object`
22457
22458 - `type: optional "admin_api_key_actor"`
22459
22460 default: admin_api_key_actor
22461
22462 - `admin_api_key_id: string`
22463
22464 - `ip_address: string`
22465
22466 - `user_agent: string`
22467
22468 - `ServiceAccountActor object`
22469
22470 - `type: optional "service_account_actor"`
22471
22472 default: service_account_actor
22473
22474 - `ip_address: string`
22475
22476 - `service_account_id: string`
22477
22478 - `user_agent: string`
22479
22480 - `ScimDirectorySyncActor object`
22481
22482 - `type: optional "scim_directory_sync_actor"`
22483
22484 default: scim_directory_sync_actor
22485
22486 - `directory_id: string`
22487
22488 - `workos_event_id: string`
22489
22490 - `idp_connection_type: optional string or null`
22491
22492 - `FederatedIdentityActor object`
22493
22494 A federated external workload authenticated via a verified OIDC token.
22495
22496 Carries the verified issuer, subject, and audience claims from the
22497 presented JWT.
22498
22499 - `type: optional "federated_identity_actor"`
22500
22501 default: federated_identity_actor
22502
22503 - `issuer: string`
22504
22505 - `subject: string`
22506
22507 - `audience: optional array of string`
22508
22509 - `ip_address: optional string or null`
22510
22511 - `user_agent: optional string or null`
22512
22513 - `FederatedActor object`
22514
22515 An external identity asserted by a trusted provider — a cloud-provider
22516 gateway or a customer-registered federation issuer — acting without an
22517 Anthropic-provisioned account or service account.
22518
22519 - `type: optional "federated_actor"`
22520
22521 default: federated_actor
22522
22523 - `provider: Aws or Azure or Gcp or Oidc`
22524
22525 - `Aws object`
22526
22527 Asserting party: the AWS account the organization is bound to.
22528
22529 - `type: optional "aws"`
22530
22531 default: aws
22532
22533 - `account_id: string`
22534
22535 - `signed_principal: string`
22536
22537 The AWS-signed ARN of the IAM principal that requested the token.
22538
22539 - `Azure object`
22540
22541 Asserting party: the Azure subscription the organization is bound to.
22542
22543 - `type: optional "azure"`
22544
22545 default: azure
22546
22547 - `subscription_id: string`
22548
22549 - `Gcp object`
22550
22551 Asserting party: the GCP project the organization is bound to.
22552
22553 - `type: optional "gcp"`
22554
22555 default: gcp
22556
22557 - `project_number: string`
22558
22559 - `Oidc object`
22560
22561 Asserting party: a customer-registered OIDC federation issuer.
22562
22563 - `type: optional "oidc"`
22564
22565 default: oidc
22566
22567 - `issuer: optional string or null`
22568
22569 The federation issuer's URL. Null when the presented credential failed verification.
22570
22571 - `ip_address: optional string or null`
22572
22573 - `subject: optional string or null`
22574
22575 The provider's verified identifier for the caller; its form depends on the provider.
22576
22577 - `user_agent: optional string or null`
22578
22579 - `AttestedDeviceActor object`
22580
22581 An attested mobile device authenticated via Apple App Attest.
22582
22583 - `type: optional "attested_device_actor"`
22584
22585 default: attested_device_actor
22586
22587 - `external_client_id: string`
22588
22589 - `kid_hash: string`
22590
22591 - `ip_address: optional string or null`
22592
22593 - `user_agent: optional string or null`
22594
22595 - `claude_artifact_folder_id: string`
22596
22597 Tagged ID ("cfld_...") of the folder that was moved.
22598
22599 - `id: optional string`
22600
22601 Unique identifier for the activity e.g. 'activity_abcd1234'
22602
22603 - `created_at: optional string`
22604
22605 When this activity occurred.
22606
22607 format: date-time
22608
22609 - `member_gained_count: optional number or null`
22610
22611 The number of people with whom a folder containing the moved folder, directly or through other folders, was individually shared after the move and none was before; people who gained access only another way, such as through a group or organization-wide sharing, are not counted, so zero does not mean that nobody gained access, and those counted can already have had access another way, for example through the moved folder's own sharing; absent when it could not be determined.
22612
22613 - `member_lost_count: optional number or null`
22614
22615 The number of people with whom a folder containing the moved folder, directly or through other folders, was individually shared before the move and none was after; people who had access only another way, such as through a group or organization-wide sharing, are not counted, so zero does not mean that nobody lost access, and those counted can still have access another way, for example through the moved folder's own sharing; absent when it could not be determined.
22616
22617 - `member_lowered_count: optional number or null`
22618
22619 The number of people with whom a folder containing the moved folder, directly or through other folders, was individually shared both before and after the move, at a lower access level after than before; a person's level is the highest that any of those folders gave them, and the moved folder's own sharing is not compared; absent when it could not be determined.
22620
22621 - `member_raised_count: optional number or null`
22622
22623 The number of people with whom a folder containing the moved folder, directly or through other folders, was individually shared both before and after the move, at a higher access level after than before; a person's level is the highest that any of those folders gave them, and the moved folder's own sharing is not compared; absent when it could not be determined.
22624
22625 - `moved_by_owner: optional boolean or null`
22626
22627 True when the person who moved the folder was its owner, false when it was someone else.
22628
22629 - `organization_id: optional string or null`
22630
22631 Organization ID this activity is associated with
22632
22633 - `organization_sharing_change: optional "gained" or "lost" or "lowered" or 3 more or null`
22634
22635 How the move changed the sharing with the whole organization of the folders containing the moved folder, directly or through other folders, by the highest access level that any of them gave the whole organization before and after the move: `gained` when none gave any before and one did after, `lost` when one did before and none did after, `raised` or `lowered` when that level was higher or lower after the move, `unchanged` when it was the same or none gave any; this follows the sharing saved on those folders, which can differ from who can open them, for example while sharing with the whole organization is turned off; the moved folder's own sharing is not compared; absent when it could not be determined.
22636
22637 - `"gained"`
22638
22639 - `"lost"`
22640
22641 - `"lowered"`
22642
22643 - `"raised"`
22644
22645 - `"unchanged"`
22646
22647 - `"unspecified"`
22648
22649 - `organization_uuid: optional string or null`
22650
22651 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
22652
22653 - `parent_claude_artifact_folder_id: optional string or null`
22654
22655 Tagged ID ("cfld_...") of the folder that directly contained the moved folder after the move; absent when the moved folder was left in no other folder.
22656
22657 - `previous_parent_claude_artifact_folder_id: optional string or null`
22658
22659 Tagged ID ("cfld_...") of the folder that directly contained the moved folder before the move; absent when the moved folder was in no other folder, or when that could not be determined.
22660
2199722661 - `ClaudeArtifactInviteAccepted object`
2199822662
2199922663 Someone outside the organization signed in with a verified account for the invited address and accepted an invitation to an artifact, and can now open it; recorded in the artifact owner's organization. The person who accepted is identified by `invitee_email` and `invitee_user_id`.
from line 23666
2300223666
2300323667 The access level the invitation granted before the change, for example `commenter`.
2300423668
23669 - `ClaudeArtifactMoved object`
23670
23671 An artifact was moved into, out of or between folders, by its owner or by someone else, whether or not a folder is shared; an artifact that leaves its folder as part of another event, such as its own deletion or the erasure of an account, might not be recorded as a move.
23672
23673 - `type: optional "claude_artifact_moved"`
23674
23675 default: claude_artifact_moved
23676
23677 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
23678
23679 - `APIActor object`
23680
23681 - `type: optional "api_actor"`
23682
23683 default: api_actor
23684
23685 - `api_key_id: string`
23686
23687 - `ip_address: string`
23688
23689 - `user_agent: string`
23690
23691 - `UserActor object`
23692
23693 - `type: optional "user_actor"`
23694
23695 default: user_actor
23696
23697 - `email_address: string`
23698
23699 format: email
23700
23701 - `ip_address: string`
23702
23703 - `user_agent: string`
23704
23705 - `user_id: string`
23706
23707 - `UnauthenticatedUserActor object`
23708
23709 - `type: optional "unauthenticated_user_actor"`
23710
23711 default: unauthenticated_user_actor
23712
23713 - `ip_address: string`
23714
23715 - `user_agent: string`
23716
23717 - `unauthenticated_email_address: optional string or null`
23718
23719 format: email
23720
23721 - `AnthropicActor object`
23722
23723 - `type: optional "anthropic_actor"`
23724
23725 default: anthropic_actor
23726
23727 - `email_address: optional string or null`
23728
23729 format: email
23730
23731 - `SystemActor object`
23732
23733 Automated background processing performed by Anthropic systems, acting
23734 without a user or customer credential.
23735
23736 - `type: optional "system_actor"`
23737
23738 default: system_actor
23739
23740 - `service: optional string or null`
23741
23742 Name of the automated process that performed the action, when known.
23743
23744 - `AdminAPIKeyActor object`
23745
23746 - `type: optional "admin_api_key_actor"`
23747
23748 default: admin_api_key_actor
23749
23750 - `admin_api_key_id: string`
23751
23752 - `ip_address: string`
23753
23754 - `user_agent: string`
23755
23756 - `ServiceAccountActor object`
23757
23758 - `type: optional "service_account_actor"`
23759
23760 default: service_account_actor
23761
23762 - `ip_address: string`
23763
23764 - `service_account_id: string`
23765
23766 - `user_agent: string`
23767
23768 - `ScimDirectorySyncActor object`
23769
23770 - `type: optional "scim_directory_sync_actor"`
23771
23772 default: scim_directory_sync_actor
23773
23774 - `directory_id: string`
23775
23776 - `workos_event_id: string`
23777
23778 - `idp_connection_type: optional string or null`
23779
23780 - `FederatedIdentityActor object`
23781
23782 A federated external workload authenticated via a verified OIDC token.
23783
23784 Carries the verified issuer, subject, and audience claims from the
23785 presented JWT.
23786
23787 - `type: optional "federated_identity_actor"`
23788
23789 default: federated_identity_actor
23790
23791 - `issuer: string`
23792
23793 - `subject: string`
23794
23795 - `audience: optional array of string`
23796
23797 - `ip_address: optional string or null`
23798
23799 - `user_agent: optional string or null`
23800
23801 - `FederatedActor object`
23802
23803 An external identity asserted by a trusted provider — a cloud-provider
23804 gateway or a customer-registered federation issuer — acting without an
23805 Anthropic-provisioned account or service account.
23806
23807 - `type: optional "federated_actor"`
23808
23809 default: federated_actor
23810
23811 - `provider: Aws or Azure or Gcp or Oidc`
23812
23813 - `Aws object`
23814
23815 Asserting party: the AWS account the organization is bound to.
23816
23817 - `type: optional "aws"`
23818
23819 default: aws
23820
23821 - `account_id: string`
23822
23823 - `signed_principal: string`
23824
23825 The AWS-signed ARN of the IAM principal that requested the token.
23826
23827 - `Azure object`
23828
23829 Asserting party: the Azure subscription the organization is bound to.
23830
23831 - `type: optional "azure"`
23832
23833 default: azure
23834
23835 - `subscription_id: string`
23836
23837 - `Gcp object`
23838
23839 Asserting party: the GCP project the organization is bound to.
23840
23841 - `type: optional "gcp"`
23842
23843 default: gcp
23844
23845 - `project_number: string`
23846
23847 - `Oidc object`
23848
23849 Asserting party: a customer-registered OIDC federation issuer.
23850
23851 - `type: optional "oidc"`
23852
23853 default: oidc
23854
23855 - `issuer: optional string or null`
23856
23857 The federation issuer's URL. Null when the presented credential failed verification.
23858
23859 - `ip_address: optional string or null`
23860
23861 - `subject: optional string or null`
23862
23863 The provider's verified identifier for the caller; its form depends on the provider.
23864
23865 - `user_agent: optional string or null`
23866
23867 - `AttestedDeviceActor object`
23868
23869 An attested mobile device authenticated via Apple App Attest.
23870
23871 - `type: optional "attested_device_actor"`
23872
23873 default: attested_device_actor
23874
23875 - `external_client_id: string`
23876
23877 - `kid_hash: string`
23878
23879 - `ip_address: optional string or null`
23880
23881 - `user_agent: optional string or null`
23882
23883 - `claude_artifact_id: string`
23884
23885 Tagged ID of the artifact that was moved.
23886
23887 - `id: optional string`
23888
23889 Unique identifier for the activity e.g. 'activity_abcd1234'
23890
23891 - `created_at: optional string`
23892
23893 When this activity occurred.
23894
23895 format: date-time
23896
23897 - `member_gained_count: optional number or null`
23898
23899 The number of people with whom the folder holding the artifact, or a folder containing that folder, was individually shared after the move and none was before; people reached only through a group or organization-wide sharing are not counted, so zero does not mean that nobody gained access, and all four counts are absent when they could not be determined.
23900
23901 - `member_lost_count: optional number or null`
23902
23903 The number of people with whom the folder holding the artifact, or a folder containing that folder, was individually shared before the move and none was after; people who had access only through a group or organization-wide sharing are not counted, so zero does not mean that nobody lost access, and those counted may still have access to the artifact another way.
23904
23905 - `member_lowered_count: optional number or null`
23906
23907 The number of people whose individually shared access level, through the folder holding the artifact and the folders containing that folder, was lower after the move than before.
23908
23909 - `member_raised_count: optional number or null`
23910
23911 The number of people whose individually shared access level, through the folder holding the artifact and the folders containing that folder, was higher after the move than before.
23912
23913 - `moved_by_owner: optional boolean or null`
23914
23915 True when the person who moved the artifact was its owner, false when it was someone else.
23916
23917 - `organization_id: optional string or null`
23918
23919 Organization ID this activity is associated with
23920
23921 - `organization_uuid: optional string or null`
23922
23923 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
23924
23925 - `parent_claude_artifact_folder_id: optional string or null`
23926
23927 Tagged ID ("cfld_...") of the folder the artifact was in after the move; absent when it was left in no folder.
23928
23929 - `previous_parent_claude_artifact_folder_id: optional string or null`
23930
23931 Tagged ID ("cfld_...") of the folder the artifact was in before the move; absent when it was in no folder, or when that could not be determined.
23932
2300523933 - `ClaudeArtifactSentToPartner object`
2300623934
2300723935 A member sent an export of an artifact to a partner application ("Send to …" on the artifact; a partner is a third-party application listed in Claude's connector directory): a file exported from the artifact was made available over a temporary link for the chosen partner to fetch. One activity is recorded per send, in the artifact owner's organization with the sending member as actor, whether or not the partner then retrieved the file; the partner's own import of the file is not part of this record. The file's name and contents are not recorded.
from line 32626
3169832626
3169932627 format: date-time
3170032628
32629 - `finding_id: optional string or null`
32630
32631 Tagged ID of the finding the session was created for, omitted from some events, such as those recorded before this field was introduced.
32632
3170132633 - `organization_id: optional string or null`
3170232634
3170332635 Organization ID this activity is associated with
from line 32638
3170632638
3170732639 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
3170832640
32641 - `scan_project_id: optional string or null`
32642
32643 Tagged ID of the scan project the finding belongs to, omitted from some events, such as those recorded before this field was introduced.
32644
3170932645 - `ClaudeCodeSecurityVulnerabilityUpdated object`
3171032646
3171132647 A Claude Code Security vulnerability finding was dismissed, restored, marked fixed, or reopened.
from line 44916
4398044916
4398144917 - `marketplace_id: optional string or null`
4398244918
43983 The marketplace of the plugin that carries the skill; unset for a standalone skill.
44919 The marketplace of the plugin that carries the skill, if any.
4398444920
4398544921 - `organization_id: optional string or null`
4398644922
from line 44932
4399644932
4399744933 - `plugin_id: optional string or null`
4399844934
43999 The plugin that carries the skill; unset for a standalone skill.
44935 The plugin that carries the skill, if any.
4400044936
4400144937 - `scope: optional "organization" or "personal" or "unspecified" or null`
4400244938
from line 45278
4434245278
4434345279 Name of the skill (its SKILL.md name, as on the other skill activities).
4434445280
45281 - `ClaudeSkillServedVersionUpdated object`
45282
45283 A skill's served version, the version that members get, was updated: an administrator or the owner chose a version, a saved version became the served version, or an accepted library submission was published into the skill. A new version that is served as soon as it is saved may appear only as claude_skill_version_created.
45284
45285 - `type: optional "claude_skill_served_version_updated"`
45286
45287 default: claude_skill_served_version_updated
45288
45289 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
45290
45291 - `APIActor object`
45292
45293 - `type: optional "api_actor"`
45294
45295 default: api_actor
45296
45297 - `api_key_id: string`
45298
45299 - `ip_address: string`
45300
45301 - `user_agent: string`
45302
45303 - `UserActor object`
45304
45305 - `type: optional "user_actor"`
45306
45307 default: user_actor
45308
45309 - `email_address: string`
45310
45311 format: email
45312
45313 - `ip_address: string`
45314
45315 - `user_agent: string`
45316
45317 - `user_id: string`
45318
45319 - `UnauthenticatedUserActor object`
45320
45321 - `type: optional "unauthenticated_user_actor"`
45322
45323 default: unauthenticated_user_actor
45324
45325 - `ip_address: string`
45326
45327 - `user_agent: string`
45328
45329 - `unauthenticated_email_address: optional string or null`
45330
45331 format: email
45332
45333 - `AnthropicActor object`
45334
45335 - `type: optional "anthropic_actor"`
45336
45337 default: anthropic_actor
45338
45339 - `email_address: optional string or null`
45340
45341 format: email
45342
45343 - `SystemActor object`
45344
45345 Automated background processing performed by Anthropic systems, acting
45346 without a user or customer credential.
45347
45348 - `type: optional "system_actor"`
45349
45350 default: system_actor
45351
45352 - `service: optional string or null`
45353
45354 Name of the automated process that performed the action, when known.
45355
45356 - `AdminAPIKeyActor object`
45357
45358 - `type: optional "admin_api_key_actor"`
45359
45360 default: admin_api_key_actor
45361
45362 - `admin_api_key_id: string`
45363
45364 - `ip_address: string`
45365
45366 - `user_agent: string`
45367
45368 - `ServiceAccountActor object`
45369
45370 - `type: optional "service_account_actor"`
45371
45372 default: service_account_actor
45373
45374 - `ip_address: string`
45375
45376 - `service_account_id: string`
45377
45378 - `user_agent: string`
45379
45380 - `ScimDirectorySyncActor object`
45381
45382 - `type: optional "scim_directory_sync_actor"`
45383
45384 default: scim_directory_sync_actor
45385
45386 - `directory_id: string`
45387
45388 - `workos_event_id: string`
45389
45390 - `idp_connection_type: optional string or null`
45391
45392 - `FederatedIdentityActor object`
45393
45394 A federated external workload authenticated via a verified OIDC token.
45395
45396 Carries the verified issuer, subject, and audience claims from the
45397 presented JWT.
45398
45399 - `type: optional "federated_identity_actor"`
45400
45401 default: federated_identity_actor
45402
45403 - `issuer: string`
45404
45405 - `subject: string`
45406
45407 - `audience: optional array of string`
45408
45409 - `ip_address: optional string or null`
45410
45411 - `user_agent: optional string or null`
45412
45413 - `FederatedActor object`
45414
45415 An external identity asserted by a trusted provider — a cloud-provider
45416 gateway or a customer-registered federation issuer — acting without an
45417 Anthropic-provisioned account or service account.
45418
45419 - `type: optional "federated_actor"`
45420
45421 default: federated_actor
45422
45423 - `provider: Aws or Azure or Gcp or Oidc`
45424
45425 - `Aws object`
45426
45427 Asserting party: the AWS account the organization is bound to.
45428
45429 - `type: optional "aws"`
45430
45431 default: aws
45432
45433 - `account_id: string`
45434
45435 - `signed_principal: string`
45436
45437 The AWS-signed ARN of the IAM principal that requested the token.
45438
45439 - `Azure object`
45440
45441 Asserting party: the Azure subscription the organization is bound to.
45442
45443 - `type: optional "azure"`
45444
45445 default: azure
45446
45447 - `subscription_id: string`
45448
45449 - `Gcp object`
45450
45451 Asserting party: the GCP project the organization is bound to.
45452
45453 - `type: optional "gcp"`
45454
45455 default: gcp
45456
45457 - `project_number: string`
45458
45459 - `Oidc object`
45460
45461 Asserting party: a customer-registered OIDC federation issuer.
45462
45463 - `type: optional "oidc"`
45464
45465 default: oidc
45466
45467 - `issuer: optional string or null`
45468
45469 The federation issuer's URL. Null when the presented credential failed verification.
45470
45471 - `ip_address: optional string or null`
45472
45473 - `subject: optional string or null`
45474
45475 The provider's verified identifier for the caller; its form depends on the provider.
45476
45477 - `user_agent: optional string or null`
45478
45479 - `AttestedDeviceActor object`
45480
45481 An attested mobile device authenticated via Apple App Attest.
45482
45483 - `type: optional "attested_device_actor"`
45484
45485 default: attested_device_actor
45486
45487 - `external_client_id: string`
45488
45489 - `kid_hash: string`
45490
45491 - `ip_address: optional string or null`
45492
45493 - `user_agent: optional string or null`
45494
45495 - `scope: "organization" or "personal" or "unspecified"`
45496
45497 Whether the skill is the member's own or the organization's.
45498
45499 - `"organization"`
45500
45501 - `"personal"`
45502
45503 - `"unspecified"`
45504
45505 - `to_skill_version: string`
45506
45507 The number of the served version after the update.
45508
45509 - `trigger: "library_publish" or "manual" or "save" or "unspecified"`
45510
45511 What caused the update.
45512
45513 - `"library_publish"`
45514
45515 - `"manual"`
45516
45517 - `"save"`
45518
45519 - `"unspecified"`
45520
45521 - `id: optional string`
45522
45523 Unique identifier for the activity e.g. 'activity_abcd1234'
45524
45525 - `created_at: optional string`
45526
45527 When this activity occurred.
45528
45529 format: date-time
45530
45531 - `from_skill_version: optional string or null`
45532
45533 The number of the served version before the update; the same as to_skill_version when that version was already being served. Unset when the skill had no served version or the number could not be read.
45534
45535 - `organization_id: optional string or null`
45536
45537 Organization ID this activity is associated with
45538
45539 - `organization_uuid: optional string or null`
45540
45541 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
45542
45543 - `owner_user_id: optional string or null`
45544
45545 The member who owns the skill; unset for an organization-owned skill.
45546
45547 - `skill_id: optional string or null`
45548
45549 The skill whose served version was updated.
45550
45551 - `skill_name: optional string or null`
45552
45553 The name of the skill whose served version was updated.
45554
45555 - `ClaudeSkillVersionCreated object`
45556
45557 A new version of a skill was created.
45558
45559 - `type: optional "claude_skill_version_created"`
45560
45561 default: claude_skill_version_created
45562
45563 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
45564
45565 - `APIActor object`
45566
45567 - `type: optional "api_actor"`
45568
45569 default: api_actor
45570
45571 - `api_key_id: string`
45572
45573 - `ip_address: string`
45574
45575 - `user_agent: string`
45576
45577 - `UserActor object`
45578
45579 - `type: optional "user_actor"`
45580
45581 default: user_actor
45582
45583 - `email_address: string`
45584
45585 format: email
45586
45587 - `ip_address: string`
45588
45589 - `user_agent: string`
45590
45591 - `user_id: string`
45592
45593 - `UnauthenticatedUserActor object`
45594
45595 - `type: optional "unauthenticated_user_actor"`
45596
45597 default: unauthenticated_user_actor
45598
45599 - `ip_address: string`
45600
45601 - `user_agent: string`
45602
45603 - `unauthenticated_email_address: optional string or null`
45604
45605 format: email
45606
45607 - `AnthropicActor object`
45608
45609 - `type: optional "anthropic_actor"`
45610
45611 default: anthropic_actor
45612
45613 - `email_address: optional string or null`
45614
45615 format: email
45616
45617 - `SystemActor object`
45618
45619 Automated background processing performed by Anthropic systems, acting
45620 without a user or customer credential.
45621
45622 - `type: optional "system_actor"`
45623
45624 default: system_actor
45625
45626 - `service: optional string or null`
45627
45628 Name of the automated process that performed the action, when known.
45629
45630 - `AdminAPIKeyActor object`
45631
45632 - `type: optional "admin_api_key_actor"`
45633
45634 default: admin_api_key_actor
45635
45636 - `admin_api_key_id: string`
45637
45638 - `ip_address: string`
45639
45640 - `user_agent: string`
45641
45642 - `ServiceAccountActor object`
45643
45644 - `type: optional "service_account_actor"`
45645
45646 default: service_account_actor
45647
45648 - `ip_address: string`
45649
45650 - `service_account_id: string`
45651
45652 - `user_agent: string`
45653
45654 - `ScimDirectorySyncActor object`
45655
45656 - `type: optional "scim_directory_sync_actor"`
45657
45658 default: scim_directory_sync_actor
45659
45660 - `directory_id: string`
45661
45662 - `workos_event_id: string`
45663
45664 - `idp_connection_type: optional string or null`
45665
45666 - `FederatedIdentityActor object`
45667
45668 A federated external workload authenticated via a verified OIDC token.
45669
45670 Carries the verified issuer, subject, and audience claims from the
45671 presented JWT.
45672
45673 - `type: optional "federated_identity_actor"`
45674
45675 default: federated_identity_actor
45676
45677 - `issuer: string`
45678
45679 - `subject: string`
45680
45681 - `audience: optional array of string`
45682
45683 - `ip_address: optional string or null`
45684
45685 - `user_agent: optional string or null`
45686
45687 - `FederatedActor object`
45688
45689 An external identity asserted by a trusted provider — a cloud-provider
45690 gateway or a customer-registered federation issuer — acting without an
45691 Anthropic-provisioned account or service account.
45692
45693 - `type: optional "federated_actor"`
45694
45695 default: federated_actor
45696
45697 - `provider: Aws or Azure or Gcp or Oidc`
45698
45699 - `Aws object`
45700
45701 Asserting party: the AWS account the organization is bound to.
45702
45703 - `type: optional "aws"`
45704
45705 default: aws
45706
45707 - `account_id: string`
45708
45709 - `signed_principal: string`
45710
45711 The AWS-signed ARN of the IAM principal that requested the token.
45712
45713 - `Azure object`
45714
45715 Asserting party: the Azure subscription the organization is bound to.
45716
45717 - `type: optional "azure"`
45718
45719 default: azure
45720
45721 - `subscription_id: string`
45722
45723 - `Gcp object`
45724
45725 Asserting party: the GCP project the organization is bound to.
45726
45727 - `type: optional "gcp"`
45728
45729 default: gcp
45730
45731 - `project_number: string`
45732
45733 - `Oidc object`
45734
45735 Asserting party: a customer-registered OIDC federation issuer.
45736
45737 - `type: optional "oidc"`
45738
45739 default: oidc
45740
45741 - `issuer: optional string or null`
45742
45743 The federation issuer's URL. Null when the presented credential failed verification.
45744
45745 - `ip_address: optional string or null`
45746
45747 - `subject: optional string or null`
45748
45749 The provider's verified identifier for the caller; its form depends on the provider.
45750
45751 - `user_agent: optional string or null`
45752
45753 - `AttestedDeviceActor object`
45754
45755 An attested mobile device authenticated via Apple App Attest.
45756
45757 - `type: optional "attested_device_actor"`
45758
45759 default: attested_device_actor
45760
45761 - `external_client_id: string`
45762
45763 - `kid_hash: string`
45764
45765 - `ip_address: optional string or null`
45766
45767 - `user_agent: optional string or null`
45768
45769 - `scope: "organization" or "personal" or "unspecified"`
45770
45771 Whether the skill is the member's own or the organization's.
45772
45773 - `"organization"`
45774
45775 - `"personal"`
45776
45777 - `"unspecified"`
45778
45779 - `skill_version: string`
45780
45781 The number of the new version.
45782
45783 - `id: optional string`
45784
45785 Unique identifier for the activity e.g. 'activity_abcd1234'
45786
45787 - `created_at: optional string`
45788
45789 When this activity occurred.
45790
45791 format: date-time
45792
45793 - `organization_id: optional string or null`
45794
45795 Organization ID this activity is associated with
45796
45797 - `organization_uuid: optional string or null`
45798
45799 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
45800
45801 - `owner_user_id: optional string or null`
45802
45803 The member who owns the skill; unset for an organization-owned skill.
45804
45805 - `skill_id: optional string or null`
45806
45807 The skill that gained a version.
45808
45809 - `skill_name: optional string or null`
45810
45811 The name of the skill that gained a version.
45812
4434545813 - `ClaudeSurveyClosed object`
4434645814
4434745815 An organization admin closed an in-app survey before its end date, ending the collection of responses; a survey that reaches its end date records no event.
from line 53896
5242853896
5242953897 - `rbac_inclusion_enabled: optional boolean or null`
5243053898
52431 Whether Inference hooks apply only to members whose role grants the Inference hooks inspection permission, as configured after this change. Null means the setting is off: either nothing has been saved for it, or it is not available to the organization. When on, requests from members whose roles do not grant that permission are not sent to the organization's endpoint. Only a custom role that this permission was added to grants it; a role set to grant all capabilities, or all generally available capabilities, does not grant it. Members on one of the organization's built-in roles (such as User, Admin, or Owner) rather than a custom role never have this permission. Requests not tied to a member, such as those made with an API key, are not sent either, and neither are requests from Claude in Slack conversations.
53899 Whether Inference hooks apply only to members whose role grants the Inference hooks inspection permission, as configured after this change. Null means the setting is off: either nothing has been saved for it, or it is not available to the organization. When on, requests from members whose roles do not grant that permission are not sent to the organization's endpoint. Only a custom role that this permission was added to grants it; setting a role's "Capability access" to "All capabilities" or "All generally available" does not grant it. Members on one of the organization's built-in roles (such as User, Admin, or Owner) rather than a custom role never have this permission. Requests not tied to a member, such as those made with an API key, are not sent either, and neither are requests from Claude in Slack conversations.
5243253900
5243353901 - `reset_circuit_breaker: optional boolean or null`
5243453902
from line 82566
8109882566
8109982567 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
8110082568
82569 - `OrgDomainSSOEnforcementUpdated object`
82570
82571 A verified domain's single sign-on requirement changed, per surface.
82572
82573 - `type: optional "org_domain_sso_enforcement_updated"`
82574
82575 default: org_domain_sso_enforcement_updated
82576
82577 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
82578
82579 - `APIActor object`
82580
82581 - `type: optional "api_actor"`
82582
82583 default: api_actor
82584
82585 - `api_key_id: string`
82586
82587 - `ip_address: string`
82588
82589 - `user_agent: string`
82590
82591 - `UserActor object`
82592
82593 - `type: optional "user_actor"`
82594
82595 default: user_actor
82596
82597 - `email_address: string`
82598
82599 format: email
82600
82601 - `ip_address: string`
82602
82603 - `user_agent: string`
82604
82605 - `user_id: string`
82606
82607 - `UnauthenticatedUserActor object`
82608
82609 - `type: optional "unauthenticated_user_actor"`
82610
82611 default: unauthenticated_user_actor
82612
82613 - `ip_address: string`
82614
82615 - `user_agent: string`
82616
82617 - `unauthenticated_email_address: optional string or null`
82618
82619 format: email
82620
82621 - `AnthropicActor object`
82622
82623 - `type: optional "anthropic_actor"`
82624
82625 default: anthropic_actor
82626
82627 - `email_address: optional string or null`
82628
82629 format: email
82630
82631 - `SystemActor object`
82632
82633 Automated background processing performed by Anthropic systems, acting
82634 without a user or customer credential.
82635
82636 - `type: optional "system_actor"`
82637
82638 default: system_actor
82639
82640 - `service: optional string or null`
82641
82642 Name of the automated process that performed the action, when known.
82643
82644 - `AdminAPIKeyActor object`
82645
82646 - `type: optional "admin_api_key_actor"`
82647
82648 default: admin_api_key_actor
82649
82650 - `admin_api_key_id: string`
82651
82652 - `ip_address: string`
82653
82654 - `user_agent: string`
82655
82656 - `ServiceAccountActor object`
82657
82658 - `type: optional "service_account_actor"`
82659
82660 default: service_account_actor
82661
82662 - `ip_address: string`
82663
82664 - `service_account_id: string`
82665
82666 - `user_agent: string`
82667
82668 - `ScimDirectorySyncActor object`
82669
82670 - `type: optional "scim_directory_sync_actor"`
82671
82672 default: scim_directory_sync_actor
82673
82674 - `directory_id: string`
82675
82676 - `workos_event_id: string`
82677
82678 - `idp_connection_type: optional string or null`
82679
82680 - `FederatedIdentityActor object`
82681
82682 A federated external workload authenticated via a verified OIDC token.
82683
82684 Carries the verified issuer, subject, and audience claims from the
82685 presented JWT.
82686
82687 - `type: optional "federated_identity_actor"`
82688
82689 default: federated_identity_actor
82690
82691 - `issuer: string`
82692
82693 - `subject: string`
82694
82695 - `audience: optional array of string`
82696
82697 - `ip_address: optional string or null`
82698
82699 - `user_agent: optional string or null`
82700
82701 - `FederatedActor object`
82702
82703 An external identity asserted by a trusted provider — a cloud-provider
82704 gateway or a customer-registered federation issuer — acting without an
82705 Anthropic-provisioned account or service account.
82706
82707 - `type: optional "federated_actor"`
82708
82709 default: federated_actor
82710
82711 - `provider: Aws or Azure or Gcp or Oidc`
82712
82713 - `Aws object`
82714
82715 Asserting party: the AWS account the organization is bound to.
82716
82717 - `type: optional "aws"`
82718
82719 default: aws
82720
82721 - `account_id: string`
82722
82723 - `signed_principal: string`
82724
82725 The AWS-signed ARN of the IAM principal that requested the token.
82726
82727 - `Azure object`
82728
82729 Asserting party: the Azure subscription the organization is bound to.
82730
82731 - `type: optional "azure"`
82732
82733 default: azure
82734
82735 - `subscription_id: string`
82736
82737 - `Gcp object`
82738
82739 Asserting party: the GCP project the organization is bound to.
82740
82741 - `type: optional "gcp"`
82742
82743 default: gcp
82744
82745 - `project_number: string`
82746
82747 - `Oidc object`
82748
82749 Asserting party: a customer-registered OIDC federation issuer.
82750
82751 - `type: optional "oidc"`
82752
82753 default: oidc
82754
82755 - `issuer: optional string or null`
82756
82757 The federation issuer's URL. Null when the presented credential failed verification.
82758
82759 - `ip_address: optional string or null`
82760
82761 - `subject: optional string or null`
82762
82763 The provider's verified identifier for the caller; its form depends on the provider.
82764
82765 - `user_agent: optional string or null`
82766
82767 - `AttestedDeviceActor object`
82768
82769 An attested mobile device authenticated via Apple App Attest.
82770
82771 - `type: optional "attested_device_actor"`
82772
82773 default: attested_device_actor
82774
82775 - `external_client_id: string`
82776
82777 - `kid_hash: string`
82778
82779 - `ip_address: optional string or null`
82780
82781 - `user_agent: optional string or null`
82782
82783 - `claudeai_sso_enforced: boolean`
82784
82785 Whether single sign-on is required on claude.ai after the change.
82786
82787 - `console_sso_enforced: boolean`
82788
82789 Whether single sign-on is required on the Console after the change.
82790
82791 - `domain: string`
82792
82793 The verified domain whose requirement changed.
82794
82795 - `previous_claudeai_sso_enforced: boolean`
82796
82797 Whether single sign-on was required on claude.ai before the change.
82798
82799 - `previous_console_sso_enforced: boolean`
82800
82801 Whether single sign-on was required on the Console before the change.
82802
82803 - `id: optional string`
82804
82805 Unique identifier for the activity e.g. 'activity_abcd1234'
82806
82807 - `created_at: optional string`
82808
82809 When this activity occurred.
82810
82811 format: date-time
82812
82813 - `idp_connection_ids: optional array of string`
82814
82815 The identity provider connections (e.g. "idpc_01Ab...") the domain routes to at the time of the change, in the order they were added to the domain. Empty if it routes to none.
82816
82817 - `organization_id: optional string or null`
82818
82819 Organization ID this activity is associated with
82820
82821 - `organization_uuid: optional string or null`
82822
82823 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
82824
82825 - `OrgDomainSSORoutingUpdated object`
82826
82827 A verified domain's single sign-on routing was saved or changed. Lists the identity provider connections the domain's users sign in through before and after; the two lists are the same when a save changed nothing.
82828
82829 - `type: optional "org_domain_sso_routing_updated"`
82830
82831 default: org_domain_sso_routing_updated
82832
82833 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
82834
82835 - `APIActor object`
82836
82837 - `type: optional "api_actor"`
82838
82839 default: api_actor
82840
82841 - `api_key_id: string`
82842
82843 - `ip_address: string`
82844
82845 - `user_agent: string`
82846
82847 - `UserActor object`
82848
82849 - `type: optional "user_actor"`
82850
82851 default: user_actor
82852
82853 - `email_address: string`
82854
82855 format: email
82856
82857 - `ip_address: string`
82858
82859 - `user_agent: string`
82860
82861 - `user_id: string`
82862
82863 - `UnauthenticatedUserActor object`
82864
82865 - `type: optional "unauthenticated_user_actor"`
82866
82867 default: unauthenticated_user_actor
82868
82869 - `ip_address: string`
82870
82871 - `user_agent: string`
82872
82873 - `unauthenticated_email_address: optional string or null`
82874
82875 format: email
82876
82877 - `AnthropicActor object`
82878
82879 - `type: optional "anthropic_actor"`
82880
82881 default: anthropic_actor
82882
82883 - `email_address: optional string or null`
82884
82885 format: email
82886
82887 - `SystemActor object`
82888
82889 Automated background processing performed by Anthropic systems, acting
82890 without a user or customer credential.
82891
82892 - `type: optional "system_actor"`
82893
82894 default: system_actor
82895
82896 - `service: optional string or null`
82897
82898 Name of the automated process that performed the action, when known.
82899
82900 - `AdminAPIKeyActor object`
82901
82902 - `type: optional "admin_api_key_actor"`
82903
82904 default: admin_api_key_actor
82905
82906 - `admin_api_key_id: string`
82907
82908 - `ip_address: string`
82909
82910 - `user_agent: string`
82911
82912 - `ServiceAccountActor object`
82913
82914 - `type: optional "service_account_actor"`
82915
82916 default: service_account_actor
82917
82918 - `ip_address: string`
82919
82920 - `service_account_id: string`
82921
82922 - `user_agent: string`
82923
82924 - `ScimDirectorySyncActor object`
82925
82926 - `type: optional "scim_directory_sync_actor"`
82927
82928 default: scim_directory_sync_actor
82929
82930 - `directory_id: string`
82931
82932 - `workos_event_id: string`
82933
82934 - `idp_connection_type: optional string or null`
82935
82936 - `FederatedIdentityActor object`
82937
82938 A federated external workload authenticated via a verified OIDC token.
82939
82940 Carries the verified issuer, subject, and audience claims from the
82941 presented JWT.
82942
82943 - `type: optional "federated_identity_actor"`
82944
82945 default: federated_identity_actor
82946
82947 - `issuer: string`
82948
82949 - `subject: string`
82950
82951 - `audience: optional array of string`
82952
82953 - `ip_address: optional string or null`
82954
82955 - `user_agent: optional string or null`
82956
82957 - `FederatedActor object`
82958
82959 An external identity asserted by a trusted provider — a cloud-provider
82960 gateway or a customer-registered federation issuer — acting without an
82961 Anthropic-provisioned account or service account.
82962
82963 - `type: optional "federated_actor"`
82964
82965 default: federated_actor
82966
82967 - `provider: Aws or Azure or Gcp or Oidc`
82968
82969 - `Aws object`
82970
82971 Asserting party: the AWS account the organization is bound to.
82972
82973 - `type: optional "aws"`
82974
82975 default: aws
82976
82977 - `account_id: string`
82978
82979 - `signed_principal: string`
82980
82981 The AWS-signed ARN of the IAM principal that requested the token.
82982
82983 - `Azure object`
82984
82985 Asserting party: the Azure subscription the organization is bound to.
82986
82987 - `type: optional "azure"`
82988
82989 default: azure
82990
82991 - `subscription_id: string`
82992
82993 - `Gcp object`
82994
82995 Asserting party: the GCP project the organization is bound to.
82996
82997 - `type: optional "gcp"`
82998
82999 default: gcp
83000
83001 - `project_number: string`
83002
83003 - `Oidc object`
83004
83005 Asserting party: a customer-registered OIDC federation issuer.
83006
83007 - `type: optional "oidc"`
83008
83009 default: oidc
83010
83011 - `issuer: optional string or null`
83012
83013 The federation issuer's URL. Null when the presented credential failed verification.
83014
83015 - `ip_address: optional string or null`
83016
83017 - `subject: optional string or null`
83018
83019 The provider's verified identifier for the caller; its form depends on the provider.
83020
83021 - `user_agent: optional string or null`
83022
83023 - `AttestedDeviceActor object`
83024
83025 An attested mobile device authenticated via Apple App Attest.
83026
83027 - `type: optional "attested_device_actor"`
83028
83029 default: attested_device_actor
83030
83031 - `external_client_id: string`
83032
83033 - `kid_hash: string`
83034
83035 - `ip_address: optional string or null`
83036
83037 - `user_agent: optional string or null`
83038
83039 - `domain: string`
83040
83041 The verified domain whose routing changed.
83042
83043 - `id: optional string`
83044
83045 Unique identifier for the activity e.g. 'activity_abcd1234'
83046
83047 - `created_at: optional string`
83048
83049 When this activity occurred.
83050
83051 format: date-time
83052
83053 - `idp_connection_ids: optional array of string`
83054
83055 The identity provider connections (e.g. "idpc_01Ab...") the domain routes to after, in the order they were added to the domain. Empty if it routes to none.
83056
83057 - `organization_id: optional string or null`
83058
83059 Organization ID this activity is associated with
83060
83061 - `organization_uuid: optional string or null`
83062
83063 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
83064
83065 - `previous_idp_connection_ids: optional array of string`
83066
83067 The identity provider connections (e.g. "idpc_01Ab...") the domain routed to before, in the order they were added to the domain. Empty if it routed to none.
83068
8110183069 - `OrgDomainVerified object`
8110283070
8110383071 Organization domain was verified.
from line 85982
8401485982
8401585983 The IP range before this change; absent unless the range itself was changed.
8401685984
85985 - `OrgIdpConnectionCreated object`
85986
85987 An identity provider connection was added to the parent organization.
85988
85989 - `type: optional "org_idp_connection_created"`
85990
85991 default: org_idp_connection_created
85992
85993 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
85994
85995 - `APIActor object`
85996
85997 - `type: optional "api_actor"`
85998
85999 default: api_actor
86000
86001 - `api_key_id: string`
86002
86003 - `ip_address: string`
86004
86005 - `user_agent: string`
86006
86007 - `UserActor object`
86008
86009 - `type: optional "user_actor"`
86010
86011 default: user_actor
86012
86013 - `email_address: string`
86014
86015 format: email
86016
86017 - `ip_address: string`
86018
86019 - `user_agent: string`
86020
86021 - `user_id: string`
86022
86023 - `UnauthenticatedUserActor object`
86024
86025 - `type: optional "unauthenticated_user_actor"`
86026
86027 default: unauthenticated_user_actor
86028
86029 - `ip_address: string`
86030
86031 - `user_agent: string`
86032
86033 - `unauthenticated_email_address: optional string or null`
86034
86035 format: email
86036
86037 - `AnthropicActor object`
86038
86039 - `type: optional "anthropic_actor"`
86040
86041 default: anthropic_actor
86042
86043 - `email_address: optional string or null`
86044
86045 format: email
86046
86047 - `SystemActor object`
86048
86049 Automated background processing performed by Anthropic systems, acting
86050 without a user or customer credential.
86051
86052 - `type: optional "system_actor"`
86053
86054 default: system_actor
86055
86056 - `service: optional string or null`
86057
86058 Name of the automated process that performed the action, when known.
86059
86060 - `AdminAPIKeyActor object`
86061
86062 - `type: optional "admin_api_key_actor"`
86063
86064 default: admin_api_key_actor
86065
86066 - `admin_api_key_id: string`
86067
86068 - `ip_address: string`
86069
86070 - `user_agent: string`
86071
86072 - `ServiceAccountActor object`
86073
86074 - `type: optional "service_account_actor"`
86075
86076 default: service_account_actor
86077
86078 - `ip_address: string`
86079
86080 - `service_account_id: string`
86081
86082 - `user_agent: string`
86083
86084 - `ScimDirectorySyncActor object`
86085
86086 - `type: optional "scim_directory_sync_actor"`
86087
86088 default: scim_directory_sync_actor
86089
86090 - `directory_id: string`
86091
86092 - `workos_event_id: string`
86093
86094 - `idp_connection_type: optional string or null`
86095
86096 - `FederatedIdentityActor object`
86097
86098 A federated external workload authenticated via a verified OIDC token.
86099
86100 Carries the verified issuer, subject, and audience claims from the
86101 presented JWT.
86102
86103 - `type: optional "federated_identity_actor"`
86104
86105 default: federated_identity_actor
86106
86107 - `issuer: string`
86108
86109 - `subject: string`
86110
86111 - `audience: optional array of string`
86112
86113 - `ip_address: optional string or null`
86114
86115 - `user_agent: optional string or null`
86116
86117 - `FederatedActor object`
86118
86119 An external identity asserted by a trusted provider — a cloud-provider
86120 gateway or a customer-registered federation issuer — acting without an
86121 Anthropic-provisioned account or service account.
86122
86123 - `type: optional "federated_actor"`
86124
86125 default: federated_actor
86126
86127 - `provider: Aws or Azure or Gcp or Oidc`
86128
86129 - `Aws object`
86130
86131 Asserting party: the AWS account the organization is bound to.
86132
86133 - `type: optional "aws"`
86134
86135 default: aws
86136
86137 - `account_id: string`
86138
86139 - `signed_principal: string`
86140
86141 The AWS-signed ARN of the IAM principal that requested the token.
86142
86143 - `Azure object`
86144
86145 Asserting party: the Azure subscription the organization is bound to.
86146
86147 - `type: optional "azure"`
86148
86149 default: azure
86150
86151 - `subscription_id: string`
86152
86153 - `Gcp object`
86154
86155 Asserting party: the GCP project the organization is bound to.
86156
86157 - `type: optional "gcp"`
86158
86159 default: gcp
86160
86161 - `project_number: string`
86162
86163 - `Oidc object`
86164
86165 Asserting party: a customer-registered OIDC federation issuer.
86166
86167 - `type: optional "oidc"`
86168
86169 default: oidc
86170
86171 - `issuer: optional string or null`
86172
86173 The federation issuer's URL. Null when the presented credential failed verification.
86174
86175 - `ip_address: optional string or null`
86176
86177 - `subject: optional string or null`
86178
86179 The provider's verified identifier for the caller; its form depends on the provider.
86180
86181 - `user_agent: optional string or null`
86182
86183 - `AttestedDeviceActor object`
86184
86185 An attested mobile device authenticated via Apple App Attest.
86186
86187 - `type: optional "attested_device_actor"`
86188
86189 default: attested_device_actor
86190
86191 - `external_client_id: string`
86192
86193 - `kid_hash: string`
86194
86195 - `ip_address: optional string or null`
86196
86197 - `user_agent: optional string or null`
86198
86199 - `display_name: string`
86200
86201 The display name the administrator gave the connection.
86202
86203 - `idp_connection_id: string`
86204
86205 The identity provider connection that was created, e.g. "idpc_01Ab...".
86206
86207 - `id: optional string`
86208
86209 Unique identifier for the activity e.g. 'activity_abcd1234'
86210
86211 - `created_at: optional string`
86212
86213 When this activity occurred.
86214
86215 format: date-time
86216
86217 - `organization_id: optional string or null`
86218
86219 Organization ID this activity is associated with
86220
86221 - `organization_uuid: optional string or null`
86222
86223 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
86224
86225 - `OrgIdpConnectionDeleted object`
86226
86227 An identity provider connection was removed from the parent organization, along with the settings that referenced it.
86228
86229 - `type: optional "org_idp_connection_deleted"`
86230
86231 default: org_idp_connection_deleted
86232
86233 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
86234
86235 - `APIActor object`
86236
86237 - `type: optional "api_actor"`
86238
86239 default: api_actor
86240
86241 - `api_key_id: string`
86242
86243 - `ip_address: string`
86244
86245 - `user_agent: string`
86246
86247 - `UserActor object`
86248
86249 - `type: optional "user_actor"`
86250
86251 default: user_actor
86252
86253 - `email_address: string`
86254
86255 format: email
86256
86257 - `ip_address: string`
86258
86259 - `user_agent: string`
86260
86261 - `user_id: string`
86262
86263 - `UnauthenticatedUserActor object`
86264
86265 - `type: optional "unauthenticated_user_actor"`
86266
86267 default: unauthenticated_user_actor
86268
86269 - `ip_address: string`
86270
86271 - `user_agent: string`
86272
86273 - `unauthenticated_email_address: optional string or null`
86274
86275 format: email
86276
86277 - `AnthropicActor object`
86278
86279 - `type: optional "anthropic_actor"`
86280
86281 default: anthropic_actor
86282
86283 - `email_address: optional string or null`
86284
86285 format: email
86286
86287 - `SystemActor object`
86288
86289 Automated background processing performed by Anthropic systems, acting
86290 without a user or customer credential.
86291
86292 - `type: optional "system_actor"`
86293
86294 default: system_actor
86295
86296 - `service: optional string or null`
86297
86298 Name of the automated process that performed the action, when known.
86299
86300 - `AdminAPIKeyActor object`
86301
86302 - `type: optional "admin_api_key_actor"`
86303
86304 default: admin_api_key_actor
86305
86306 - `admin_api_key_id: string`
86307
86308 - `ip_address: string`
86309
86310 - `user_agent: string`
86311
86312 - `ServiceAccountActor object`
86313
86314 - `type: optional "service_account_actor"`
86315
86316 default: service_account_actor
86317
86318 - `ip_address: string`
86319
86320 - `service_account_id: string`
86321
86322 - `user_agent: string`
86323
86324 - `ScimDirectorySyncActor object`
86325
86326 - `type: optional "scim_directory_sync_actor"`
86327
86328 default: scim_directory_sync_actor
86329
86330 - `directory_id: string`
86331
86332 - `workos_event_id: string`
86333
86334 - `idp_connection_type: optional string or null`
86335
86336 - `FederatedIdentityActor object`
86337
86338 A federated external workload authenticated via a verified OIDC token.
86339
86340 Carries the verified issuer, subject, and audience claims from the
86341 presented JWT.
86342
86343 - `type: optional "federated_identity_actor"`
86344
86345 default: federated_identity_actor
86346
86347 - `issuer: string`
86348
86349 - `subject: string`
86350
86351 - `audience: optional array of string`
86352
86353 - `ip_address: optional string or null`
86354
86355 - `user_agent: optional string or null`
86356
86357 - `FederatedActor object`
86358
86359 An external identity asserted by a trusted provider — a cloud-provider
86360 gateway or a customer-registered federation issuer — acting without an
86361 Anthropic-provisioned account or service account.
86362
86363 - `type: optional "federated_actor"`
86364
86365 default: federated_actor
86366
86367 - `provider: Aws or Azure or Gcp or Oidc`
86368
86369 - `Aws object`
86370
86371 Asserting party: the AWS account the organization is bound to.
86372
86373 - `type: optional "aws"`
86374
86375 default: aws
86376
86377 - `account_id: string`
86378
86379 - `signed_principal: string`
86380
86381 The AWS-signed ARN of the IAM principal that requested the token.
86382
86383 - `Azure object`
86384
86385 Asserting party: the Azure subscription the organization is bound to.
86386
86387 - `type: optional "azure"`
86388
86389 default: azure
86390
86391 - `subscription_id: string`
86392
86393 - `Gcp object`
86394
86395 Asserting party: the GCP project the organization is bound to.
86396
86397 - `type: optional "gcp"`
86398
86399 default: gcp
86400
86401 - `project_number: string`
86402
86403 - `Oidc object`
86404
86405 Asserting party: a customer-registered OIDC federation issuer.
86406
86407 - `type: optional "oidc"`
86408
86409 default: oidc
86410
86411 - `issuer: optional string or null`
86412
86413 The federation issuer's URL. Null when the presented credential failed verification.
86414
86415 - `ip_address: optional string or null`
86416
86417 - `subject: optional string or null`
86418
86419 The provider's verified identifier for the caller; its form depends on the provider.
86420
86421 - `user_agent: optional string or null`
86422
86423 - `AttestedDeviceActor object`
86424
86425 An attested mobile device authenticated via Apple App Attest.
86426
86427 - `type: optional "attested_device_actor"`
86428
86429 default: attested_device_actor
86430
86431 - `external_client_id: string`
86432
86433 - `kid_hash: string`
86434
86435 - `ip_address: optional string or null`
86436
86437 - `user_agent: optional string or null`
86438
86439 - `directory_removed: boolean`
86440
86441 Whether a directory sync connection was removed with the connection.
86442
86443 - `display_name: string`
86444
86445 The connection's display name at the time of deletion.
86446
86447 - `idp_connection_id: string`
86448
86449 The identity provider connection that was deleted, e.g. "idpc_01Ab...".
86450
86451 - `id: optional string`
86452
86453 Unique identifier for the activity e.g. 'activity_abcd1234'
86454
86455 - `created_at: optional string`
86456
86457 When this activity occurred.
86458
86459 format: date-time
86460
86461 - `organization_id: optional string or null`
86462
86463 Organization ID this activity is associated with
86464
86465 - `organization_uuid: optional string or null`
86466
86467 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
86468
86469 - `role_mappings_removed: optional array of object`
86470
86471 Group-to-role mappings that were removed with the connection.
86472
86473 - `idp_group_name: string`
86474
86475 Name of the identity provider group the mapping matched.
86476
86477 - `organization_id: string`
86478
86479 The organization the mapping belonged to, e.g. "org_01Ab...".
86480
86481 - `role: string`
86482
86483 The role members of the group were given.
86484
86485 - `seat_tier_mappings_removed: optional array of object`
86486
86487 Group-to-seat-tier mappings that were removed with the connection.
86488
86489 - `idp_group_name: string`
86490
86491 Name of the identity provider group the mapping matched.
86492
86493 - `organization_id: string`
86494
86495 The organization the mapping belonged to, e.g. "org_01Ab...".
86496
86497 - `seat_tier: string`
86498
86499 The seat tier members of the group were given.
86500
86501 - `unrouted_domains: optional array of string`
86502
86503 Verified domains whose single sign-on was routed through this connection; they no longer route anywhere.
86504
86505 - `OrgIdpConnectionUpdated object`
86506
86507 An identity provider connection's settings were changed.
86508
86509 - `type: optional "org_idp_connection_updated"`
86510
86511 default: org_idp_connection_updated
86512
86513 - `action: "renamed" or "shown_at_sign_in_changed" or "sso_restricted_to_scim_directory_members_changed" or "unspecified"`
86514
86515 Which setting was changed.
86516
86517 - `"renamed"`
86518
86519 - `"shown_at_sign_in_changed"`
86520
86521 - `"sso_restricted_to_scim_directory_members_changed"`
86522
86523 - `"unspecified"`
86524
86525 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
86526
86527 - `APIActor object`
86528
86529 - `type: optional "api_actor"`
86530
86531 default: api_actor
86532
86533 - `api_key_id: string`
86534
86535 - `ip_address: string`
86536
86537 - `user_agent: string`
86538
86539 - `UserActor object`
86540
86541 - `type: optional "user_actor"`
86542
86543 default: user_actor
86544
86545 - `email_address: string`
86546
86547 format: email
86548
86549 - `ip_address: string`
86550
86551 - `user_agent: string`
86552
86553 - `user_id: string`
86554
86555 - `UnauthenticatedUserActor object`
86556
86557 - `type: optional "unauthenticated_user_actor"`
86558
86559 default: unauthenticated_user_actor
86560
86561 - `ip_address: string`
86562
86563 - `user_agent: string`
86564
86565 - `unauthenticated_email_address: optional string or null`
86566
86567 format: email
86568
86569 - `AnthropicActor object`
86570
86571 - `type: optional "anthropic_actor"`
86572
86573 default: anthropic_actor
86574
86575 - `email_address: optional string or null`
86576
86577 format: email
86578
86579 - `SystemActor object`
86580
86581 Automated background processing performed by Anthropic systems, acting
86582 without a user or customer credential.
86583
86584 - `type: optional "system_actor"`
86585
86586 default: system_actor
86587
86588 - `service: optional string or null`
86589
86590 Name of the automated process that performed the action, when known.
86591
86592 - `AdminAPIKeyActor object`
86593
86594 - `type: optional "admin_api_key_actor"`
86595
86596 default: admin_api_key_actor
86597
86598 - `admin_api_key_id: string`
86599
86600 - `ip_address: string`
86601
86602 - `user_agent: string`
86603
86604 - `ServiceAccountActor object`
86605
86606 - `type: optional "service_account_actor"`
86607
86608 default: service_account_actor
86609
86610 - `ip_address: string`
86611
86612 - `service_account_id: string`
86613
86614 - `user_agent: string`
86615
86616 - `ScimDirectorySyncActor object`
86617
86618 - `type: optional "scim_directory_sync_actor"`
86619
86620 default: scim_directory_sync_actor
86621
86622 - `directory_id: string`
86623
86624 - `workos_event_id: string`
86625
86626 - `idp_connection_type: optional string or null`
86627
86628 - `FederatedIdentityActor object`
86629
86630 A federated external workload authenticated via a verified OIDC token.
86631
86632 Carries the verified issuer, subject, and audience claims from the
86633 presented JWT.
86634
86635 - `type: optional "federated_identity_actor"`
86636
86637 default: federated_identity_actor
86638
86639 - `issuer: string`
86640
86641 - `subject: string`
86642
86643 - `audience: optional array of string`
86644
86645 - `ip_address: optional string or null`
86646
86647 - `user_agent: optional string or null`
86648
86649 - `FederatedActor object`
86650
86651 An external identity asserted by a trusted provider — a cloud-provider
86652 gateway or a customer-registered federation issuer — acting without an
86653 Anthropic-provisioned account or service account.
86654
86655 - `type: optional "federated_actor"`
86656
86657 default: federated_actor
86658
86659 - `provider: Aws or Azure or Gcp or Oidc`
86660
86661 - `Aws object`
86662
86663 Asserting party: the AWS account the organization is bound to.
86664
86665 - `type: optional "aws"`
86666
86667 default: aws
86668
86669 - `account_id: string`
86670
86671 - `signed_principal: string`
86672
86673 The AWS-signed ARN of the IAM principal that requested the token.
86674
86675 - `Azure object`
86676
86677 Asserting party: the Azure subscription the organization is bound to.
86678
86679 - `type: optional "azure"`
86680
86681 default: azure
86682
86683 - `subscription_id: string`
86684
86685 - `Gcp object`
86686
86687 Asserting party: the GCP project the organization is bound to.
86688
86689 - `type: optional "gcp"`
86690
86691 default: gcp
86692
86693 - `project_number: string`
86694
86695 - `Oidc object`
86696
86697 Asserting party: a customer-registered OIDC federation issuer.
86698
86699 - `type: optional "oidc"`
86700
86701 default: oidc
86702
86703 - `issuer: optional string or null`
86704
86705 The federation issuer's URL. Null when the presented credential failed verification.
86706
86707 - `ip_address: optional string or null`
86708
86709 - `subject: optional string or null`
86710
86711 The provider's verified identifier for the caller; its form depends on the provider.
86712
86713 - `user_agent: optional string or null`
86714
86715 - `AttestedDeviceActor object`
86716
86717 An attested mobile device authenticated via Apple App Attest.
86718
86719 - `type: optional "attested_device_actor"`
86720
86721 default: attested_device_actor
86722
86723 - `external_client_id: string`
86724
86725 - `kid_hash: string`
86726
86727 - `ip_address: optional string or null`
86728
86729 - `user_agent: optional string or null`
86730
86731 - `display_name: string`
86732
86733 The connection's display name after the change.
86734
86735 - `idp_connection_id: string`
86736
86737 The identity provider connection that was changed, e.g. "idpc_01Ab...".
86738
86739 - `id: optional string`
86740
86741 Unique identifier for the activity e.g. 'activity_abcd1234'
86742
86743 - `created_at: optional string`
86744
86745 When this activity occurred.
86746
86747 format: date-time
86748
86749 - `organization_id: optional string or null`
86750
86751 Organization ID this activity is associated with
86752
86753 - `organization_uuid: optional string or null`
86754
86755 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
86756
86757 - `shown_at_sign_in: optional boolean or null`
86758
86759 After the change, whether the sign-in page offers the connection. Set only when action is shown_at_sign_in_changed.
86760
86761 - `sso_restricted_to_scim_directory_members: optional boolean or null`
86762
86763 After the change, whether sign-in with the connection is limited to the people its SCIM directory lists as active, apart from primary owners and parent organization owners. Set only when action is sso_restricted_to_scim_directory_members_changed.
86764
8401786765 - `OrgInviteLinkDisabled object`
8401886766
8401986767 Organization invite link was disabled.
from line 94466
9171894466
9171994467 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
9172094468
94469 - `OrgSecurityControlAttestationUpdated object`
94470
94471 The organization's attestation for a security control was recorded, changed, renewed or cleared by an administrator, or was ended automatically.
94472
94473 - `type: optional "org_security_control_attestation_updated"`
94474
94475 default: org_security_control_attestation_updated
94476
94477 - `action: "attested" or "changed" or "cleared" or 3 more`
94478
94479 What happened to the attestation.
94480
94481 - `"attested"`
94482
94483 An administrator recorded an attestation for a control that had none.
94484
94485 - `"changed"`
94486
94487 An administrator replaced the attestation, either with another status or, when `status` and `previous_status` are equal, with the same status, as with `renewed`.
94488
94489 - `"cleared"`
94490
94491 An administrator removed the attestation.
94492
94493 - `"lapsed"`
94494
94495 The attestation was ended automatically, not by an administrator. This activity can be later than the change that ended the attestation, and a change that could end an attestation was not always followed by this activity.
94496
94497 - `"renewed"`
94498
94499 An administrator saved the attestation again with the same status. Such a save can also be recorded as `changed`.
94500
94501 - `"unspecified"`
94502
94503 Not used. No activity is recorded with this value.
94504
94505 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
94506
94507 - `APIActor object`
94508
94509 - `type: optional "api_actor"`
94510
94511 default: api_actor
94512
94513 - `api_key_id: string`
94514
94515 - `ip_address: string`
94516
94517 - `user_agent: string`
94518
94519 - `UserActor object`
94520
94521 - `type: optional "user_actor"`
94522
94523 default: user_actor
94524
94525 - `email_address: string`
94526
94527 format: email
94528
94529 - `ip_address: string`
94530
94531 - `user_agent: string`
94532
94533 - `user_id: string`
94534
94535 - `UnauthenticatedUserActor object`
94536
94537 - `type: optional "unauthenticated_user_actor"`
94538
94539 default: unauthenticated_user_actor
94540
94541 - `ip_address: string`
94542
94543 - `user_agent: string`
94544
94545 - `unauthenticated_email_address: optional string or null`
94546
94547 format: email
94548
94549 - `AnthropicActor object`
94550
94551 - `type: optional "anthropic_actor"`
94552
94553 default: anthropic_actor
94554
94555 - `email_address: optional string or null`
94556
94557 format: email
94558
94559 - `SystemActor object`
94560
94561 Automated background processing performed by Anthropic systems, acting
94562 without a user or customer credential.
94563
94564 - `type: optional "system_actor"`
94565
94566 default: system_actor
94567
94568 - `service: optional string or null`
94569
94570 Name of the automated process that performed the action, when known.
94571
94572 - `AdminAPIKeyActor object`
94573
94574 - `type: optional "admin_api_key_actor"`
94575
94576 default: admin_api_key_actor
94577
94578 - `admin_api_key_id: string`
94579
94580 - `ip_address: string`
94581
94582 - `user_agent: string`
94583
94584 - `ServiceAccountActor object`
94585
94586 - `type: optional "service_account_actor"`
94587
94588 default: service_account_actor
94589
94590 - `ip_address: string`
94591
94592 - `service_account_id: string`
94593
94594 - `user_agent: string`
94595
94596 - `ScimDirectorySyncActor object`
94597
94598 - `type: optional "scim_directory_sync_actor"`
94599
94600 default: scim_directory_sync_actor
94601
94602 - `directory_id: string`
94603
94604 - `workos_event_id: string`
94605
94606 - `idp_connection_type: optional string or null`
94607
94608 - `FederatedIdentityActor object`
94609
94610 A federated external workload authenticated via a verified OIDC token.
94611
94612 Carries the verified issuer, subject, and audience claims from the
94613 presented JWT.
94614
94615 - `type: optional "federated_identity_actor"`
94616
94617 default: federated_identity_actor
94618
94619 - `issuer: string`
94620
94621 - `subject: string`
94622
94623 - `audience: optional array of string`
94624
94625 - `ip_address: optional string or null`
94626
94627 - `user_agent: optional string or null`
94628
94629 - `FederatedActor object`
94630
94631 An external identity asserted by a trusted provider — a cloud-provider
94632 gateway or a customer-registered federation issuer — acting without an
94633 Anthropic-provisioned account or service account.
94634
94635 - `type: optional "federated_actor"`
94636
94637 default: federated_actor
94638
94639 - `provider: Aws or Azure or Gcp or Oidc`
94640
94641 - `Aws object`
94642
94643 Asserting party: the AWS account the organization is bound to.
94644
94645 - `type: optional "aws"`
94646
94647 default: aws
94648
94649 - `account_id: string`
94650
94651 - `signed_principal: string`
94652
94653 The AWS-signed ARN of the IAM principal that requested the token.
94654
94655 - `Azure object`
94656
94657 Asserting party: the Azure subscription the organization is bound to.
94658
94659 - `type: optional "azure"`
94660
94661 default: azure
94662
94663 - `subscription_id: string`
94664
94665 - `Gcp object`
94666
94667 Asserting party: the GCP project the organization is bound to.
94668
94669 - `type: optional "gcp"`
94670
94671 default: gcp
94672
94673 - `project_number: string`
94674
94675 - `Oidc object`
94676
94677 Asserting party: a customer-registered OIDC federation issuer.
94678
94679 - `type: optional "oidc"`
94680
94681 default: oidc
94682
94683 - `issuer: optional string or null`
94684
94685 The federation issuer's URL. Null when the presented credential failed verification.
94686
94687 - `ip_address: optional string or null`
94688
94689 - `subject: optional string or null`
94690
94691 The provider's verified identifier for the caller; its form depends on the provider.
94692
94693 - `user_agent: optional string or null`
94694
94695 - `AttestedDeviceActor object`
94696
94697 An attested mobile device authenticated via Apple App Attest.
94698
94699 - `type: optional "attested_device_actor"`
94700
94701 default: attested_device_actor
94702
94703 - `external_client_id: string`
94704
94705 - `kid_hash: string`
94706
94707 - `ip_address: optional string or null`
94708
94709 - `user_agent: optional string or null`
94710
94711 - `control: string`
94712
94713 The identifier of the security control the attestation applies to, for example "oauth_conditional_access".
94714
94715 - `id: optional string`
94716
94717 Unique identifier for the activity e.g. 'activity_abcd1234'
94718
94719 - `created_at: optional string`
94720
94721 When this activity occurred.
94722
94723 format: date-time
94724
94725 - `organization_id: optional string or null`
94726
94727 Organization ID this activity is associated with
94728
94729 - `organization_uuid: optional string or null`
94730
94731 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
94732
94733 - `previous_status: optional "accepted_risk" or "completed" or "unspecified" or null`
94734
94735 The status before this change; absent when action is "attested".
94736
94737 - `"accepted_risk"`
94738
94739 An administrator attested that the organization accepts the risk of not meeting the control.
94740
94741 - `"completed"`
94742
94743 An administrator attested that the organization meets the control.
94744
94745 - `"unspecified"`
94746
94747 Not used. No activity is recorded with this value.
94748
94749 - `review_date: optional string or null`
94750
94751 The UTC day (ISO 8601 date) on which the attestation was due to stop taking effect; absent when it had no end date or was cleared.
94752
94753 - `status: optional "accepted_risk" or "completed" or "unspecified" or null`
94754
94755 The attested status; absent when the attestation was cleared.
94756
94757 - `"accepted_risk"`
94758
94759 An administrator attested that the organization accepts the risk of not meeting the control.
94760
94761 - `"completed"`
94762
94763 An administrator attested that the organization meets the control.
94764
94765 - `"unspecified"`
94766
94767 Not used. No activity is recorded with this value.
94768
9172194769 - `OrgSyncDeletingSynchronizedFilesStarted object`
9172294770
9172394771 Organization started deleting synchronized files.
from line 99772
9672499772
9672599773 - `user_agent: optional string or null`
9672699774
96727 - `updates: array of Name or Capabilities or RedactContent or 112 more`
99775 - `updates: array of Name or Capabilities or RedactContent or 114 more`
9672899776
9672999777 - `Name object`
9673099778
from line 100206
97158100206
97159100207 Setting value immediately before this change
97160100208
100209 - `ClaudeAIChatExternalSharingEnabled object`
100210
100211 The Claude.ai external chat sharing setting (inviting addresses outside the organization) was changed for the organization.
100212
100213 - `type: optional "claude_ai_chat_external_sharing_enabled"`
100214
100215 default: claude_ai_chat_external_sharing_enabled
100216
100217 - `current_value: optional boolean or null`
100218
100219 Setting value immediately after this change
100220
100221 - `previous_value: optional boolean or null`
100222
100223 Setting value immediately before this change
100224
97161100225 - `ClaudeAICcrSharingEnabled object`
97162100226
97163100227 The Claude.ai remote Claude Code session sharing setting was changed for the organization.
from line 101739
98675101739
98676101740 Setting value immediately before this change. Null means the setting had not been set for the organization, so the plan default applied.
98677101741
101742 - `ClaudeAIChatOrgSharingEnabled object`
101743
101744 The Claude.ai setting that lets members share a chat with everyone in the organization was changed for the organization.
101745
101746 - `type: optional "claude_ai_chat_org_sharing_enabled"`
101747
101748 default: claude_ai_chat_org_sharing_enabled
101749
101750 - `current_value: optional boolean or null`
101751
101752 Setting value immediately after this change
101753
101754 - `previous_value: optional boolean or null`
101755
101756 Setting value immediately before this change. Null means the setting had not been set for the organization, so the default (on) applied.
101757
98678101758 - `ArtifactTypeDashboardsEnabled object`
98679101759
98680101760 The setting that lets members create Dashboards, one of Anthropic's built-in Artifact types, was changed for the organization.
from line 102117
99037102117
99038102118 Tagged ID of the member whose access to their owned projects was restored, when known.
99039102119
102120 - `ParentOrganizationCentralizedManagementEnrolled object`
102121
102122 A parent organization was enrolled in centralized management.
102123
102124 - `type: optional "parent_organization_centralized_management_enrolled"`
102125
102126 default: parent_organization_centralized_management_enrolled
102127
102128 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
102129
102130 - `APIActor object`
102131
102132 - `type: optional "api_actor"`
102133
102134 default: api_actor
102135
102136 - `api_key_id: string`
102137
102138 - `ip_address: string`
102139
102140 - `user_agent: string`
102141
102142 - `UserActor object`
102143
102144 - `type: optional "user_actor"`
102145
102146 default: user_actor
102147
102148 - `email_address: string`
102149
102150 format: email
102151
102152 - `ip_address: string`
102153
102154 - `user_agent: string`
102155
102156 - `user_id: string`
102157
102158 - `UnauthenticatedUserActor object`
102159
102160 - `type: optional "unauthenticated_user_actor"`
102161
102162 default: unauthenticated_user_actor
102163
102164 - `ip_address: string`
102165
102166 - `user_agent: string`
102167
102168 - `unauthenticated_email_address: optional string or null`
102169
102170 format: email
102171
102172 - `AnthropicActor object`
102173
102174 - `type: optional "anthropic_actor"`
102175
102176 default: anthropic_actor
102177
102178 - `email_address: optional string or null`
102179
102180 format: email
102181
102182 - `SystemActor object`
102183
102184 Automated background processing performed by Anthropic systems, acting
102185 without a user or customer credential.
102186
102187 - `type: optional "system_actor"`
102188
102189 default: system_actor
102190
102191 - `service: optional string or null`
102192
102193 Name of the automated process that performed the action, when known.
102194
102195 - `AdminAPIKeyActor object`
102196
102197 - `type: optional "admin_api_key_actor"`
102198
102199 default: admin_api_key_actor
102200
102201 - `admin_api_key_id: string`
102202
102203 - `ip_address: string`
102204
102205 - `user_agent: string`
102206
102207 - `ServiceAccountActor object`
102208
102209 - `type: optional "service_account_actor"`
102210
102211 default: service_account_actor
102212
102213 - `ip_address: string`
102214
102215 - `service_account_id: string`
102216
102217 - `user_agent: string`
102218
102219 - `ScimDirectorySyncActor object`
102220
102221 - `type: optional "scim_directory_sync_actor"`
102222
102223 default: scim_directory_sync_actor
102224
102225 - `directory_id: string`
102226
102227 - `workos_event_id: string`
102228
102229 - `idp_connection_type: optional string or null`
102230
102231 - `FederatedIdentityActor object`
102232
102233 A federated external workload authenticated via a verified OIDC token.
102234
102235 Carries the verified issuer, subject, and audience claims from the
102236 presented JWT.
102237
102238 - `type: optional "federated_identity_actor"`
102239
102240 default: federated_identity_actor
102241
102242 - `issuer: string`
102243
102244 - `subject: string`
102245
102246 - `audience: optional array of string`
102247
102248 - `ip_address: optional string or null`
102249
102250 - `user_agent: optional string or null`
102251
102252 - `FederatedActor object`
102253
102254 An external identity asserted by a trusted provider — a cloud-provider
102255 gateway or a customer-registered federation issuer — acting without an
102256 Anthropic-provisioned account or service account.
102257
102258 - `type: optional "federated_actor"`
102259
102260 default: federated_actor
102261
102262 - `provider: Aws or Azure or Gcp or Oidc`
102263
102264 - `Aws object`
102265
102266 Asserting party: the AWS account the organization is bound to.
102267
102268 - `type: optional "aws"`
102269
102270 default: aws
102271
102272 - `account_id: string`
102273
102274 - `signed_principal: string`
102275
102276 The AWS-signed ARN of the IAM principal that requested the token.
102277
102278 - `Azure object`
102279
102280 Asserting party: the Azure subscription the organization is bound to.
102281
102282 - `type: optional "azure"`
102283
102284 default: azure
102285
102286 - `subscription_id: string`
102287
102288 - `Gcp object`
102289
102290 Asserting party: the GCP project the organization is bound to.
102291
102292 - `type: optional "gcp"`
102293
102294 default: gcp
102295
102296 - `project_number: string`
102297
102298 - `Oidc object`
102299
102300 Asserting party: a customer-registered OIDC federation issuer.
102301
102302 - `type: optional "oidc"`
102303
102304 default: oidc
102305
102306 - `issuer: optional string or null`
102307
102308 The federation issuer's URL. Null when the presented credential failed verification.
102309
102310 - `ip_address: optional string or null`
102311
102312 - `subject: optional string or null`
102313
102314 The provider's verified identifier for the caller; its form depends on the provider.
102315
102316 - `user_agent: optional string or null`
102317
102318 - `AttestedDeviceActor object`
102319
102320 An attested mobile device authenticated via Apple App Attest.
102321
102322 - `type: optional "attested_device_actor"`
102323
102324 default: attested_device_actor
102325
102326 - `external_client_id: string`
102327
102328 - `kid_hash: string`
102329
102330 - `ip_address: optional string or null`
102331
102332 - `user_agent: optional string or null`
102333
102334 - `parent_organization_id: string`
102335
102336 The parent organization that was enrolled in centralized management.
102337
102338 - `id: optional string`
102339
102340 Unique identifier for the activity e.g. 'activity_abcd1234'
102341
102342 - `created_at: optional string`
102343
102344 When this activity occurred.
102345
102346 format: date-time
102347
102348 - `members: optional array of object`
102349
102350 The members granted parent-organization roles at enrollment.
102351
102352 - `role: "admin" or "owner" or "unspecified"`
102353
102354 The parent-organization role held.
102355
102356 - `"admin"`
102357
102358 - `"owner"`
102359
102360 - `"unspecified"`
102361
102362 - `user_id: string`
102363
102364 Tagged ID of the member's account.
102365
102366 - `organization_id: optional string or null`
102367
102368 Organization ID this activity is associated with
102369
102370 - `organization_uuid: optional string or null`
102371
102372 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
102373
102374 - `ParentOrganizationCentralizedManagementOrganizationUpdated object`
102375
102376 An organization's approval of its parent organization's Centralized Management setup changed, or its administrators were reminded to approve.
102377
102378 - `type: optional "parent_organization_centralized_management_organization_updated"`
102379
102380 default: parent_organization_centralized_management_organization_updated
102381
102382 - `action: "approval_withdrawn" or "approved" or "force_included" or 3 more`
102383
102384 How the organization's approval changed.
102385
102386 - `"approval_withdrawn"`
102387
102388 - `"approved"`
102389
102390 - `"force_included"`
102391
102392 - `"joined"`
102393
102394 - `"reminder_sent"`
102395
102396 - `"unspecified"`
102397
102398 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
102399
102400 - `APIActor object`
102401
102402 - `type: optional "api_actor"`
102403
102404 default: api_actor
102405
102406 - `api_key_id: string`
102407
102408 - `ip_address: string`
102409
102410 - `user_agent: string`
102411
102412 - `UserActor object`
102413
102414 - `type: optional "user_actor"`
102415
102416 default: user_actor
102417
102418 - `email_address: string`
102419
102420 format: email
102421
102422 - `ip_address: string`
102423
102424 - `user_agent: string`
102425
102426 - `user_id: string`
102427
102428 - `UnauthenticatedUserActor object`
102429
102430 - `type: optional "unauthenticated_user_actor"`
102431
102432 default: unauthenticated_user_actor
102433
102434 - `ip_address: string`
102435
102436 - `user_agent: string`
102437
102438 - `unauthenticated_email_address: optional string or null`
102439
102440 format: email
102441
102442 - `AnthropicActor object`
102443
102444 - `type: optional "anthropic_actor"`
102445
102446 default: anthropic_actor
102447
102448 - `email_address: optional string or null`
102449
102450 format: email
102451
102452 - `SystemActor object`
102453
102454 Automated background processing performed by Anthropic systems, acting
102455 without a user or customer credential.
102456
102457 - `type: optional "system_actor"`
102458
102459 default: system_actor
102460
102461 - `service: optional string or null`
102462
102463 Name of the automated process that performed the action, when known.
102464
102465 - `AdminAPIKeyActor object`
102466
102467 - `type: optional "admin_api_key_actor"`
102468
102469 default: admin_api_key_actor
102470
102471 - `admin_api_key_id: string`
102472
102473 - `ip_address: string`
102474
102475 - `user_agent: string`
102476
102477 - `ServiceAccountActor object`
102478
102479 - `type: optional "service_account_actor"`
102480
102481 default: service_account_actor
102482
102483 - `ip_address: string`
102484
102485 - `service_account_id: string`
102486
102487 - `user_agent: string`
102488
102489 - `ScimDirectorySyncActor object`
102490
102491 - `type: optional "scim_directory_sync_actor"`
102492
102493 default: scim_directory_sync_actor
102494
102495 - `directory_id: string`
102496
102497 - `workos_event_id: string`
102498
102499 - `idp_connection_type: optional string or null`
102500
102501 - `FederatedIdentityActor object`
102502
102503 A federated external workload authenticated via a verified OIDC token.
102504
102505 Carries the verified issuer, subject, and audience claims from the
102506 presented JWT.
102507
102508 - `type: optional "federated_identity_actor"`
102509
102510 default: federated_identity_actor
102511
102512 - `issuer: string`
102513
102514 - `subject: string`
102515
102516 - `audience: optional array of string`
102517
102518 - `ip_address: optional string or null`
102519
102520 - `user_agent: optional string or null`
102521
102522 - `FederatedActor object`
102523
102524 An external identity asserted by a trusted provider — a cloud-provider
102525 gateway or a customer-registered federation issuer — acting without an
102526 Anthropic-provisioned account or service account.
102527
102528 - `type: optional "federated_actor"`
102529
102530 default: federated_actor
102531
102532 - `provider: Aws or Azure or Gcp or Oidc`
102533
102534 - `Aws object`
102535
102536 Asserting party: the AWS account the organization is bound to.
102537
102538 - `type: optional "aws"`
102539
102540 default: aws
102541
102542 - `account_id: string`
102543
102544 - `signed_principal: string`
102545
102546 The AWS-signed ARN of the IAM principal that requested the token.
102547
102548 - `Azure object`
102549
102550 Asserting party: the Azure subscription the organization is bound to.
102551
102552 - `type: optional "azure"`
102553
102554 default: azure
102555
102556 - `subscription_id: string`
102557
102558 - `Gcp object`
102559
102560 Asserting party: the GCP project the organization is bound to.
102561
102562 - `type: optional "gcp"`
102563
102564 default: gcp
102565
102566 - `project_number: string`
102567
102568 - `Oidc object`
102569
102570 Asserting party: a customer-registered OIDC federation issuer.
102571
102572 - `type: optional "oidc"`
102573
102574 default: oidc
102575
102576 - `issuer: optional string or null`
102577
102578 The federation issuer's URL. Null when the presented credential failed verification.
102579
102580 - `ip_address: optional string or null`
102581
102582 - `subject: optional string or null`
102583
102584 The provider's verified identifier for the caller; its form depends on the provider.
102585
102586 - `user_agent: optional string or null`
102587
102588 - `AttestedDeviceActor object`
102589
102590 An attested mobile device authenticated via Apple App Attest.
102591
102592 - `type: optional "attested_device_actor"`
102593
102594 default: attested_device_actor
102595
102596 - `external_client_id: string`
102597
102598 - `kid_hash: string`
102599
102600 - `ip_address: optional string or null`
102601
102602 - `user_agent: optional string or null`
102603
102604 - `parent_organization_id: string`
102605
102606 The parent organization running the setup, e.g. "parent_org_01HX...".
102607
102608 - `target_organization_id: string`
102609
102610 The organization whose approval changed, e.g. "org_01HX...".
102611
102612 - `id: optional string`
102613
102614 Unique identifier for the activity e.g. 'activity_abcd1234'
102615
102616 - `created_at: optional string`
102617
102618 When this activity occurred.
102619
102620 format: date-time
102621
102622 - `organization_id: optional string or null`
102623
102624 Organization ID this activity is associated with
102625
102626 - `organization_uuid: optional string or null`
102627
102628 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
102629
102630 - `set_changed_at: optional string or null`
102631
102632 The version of the proposed administrators the approval, withdrawal or inclusion applied to (absent for reminders).
102633
102634 format: date-time
102635
102636 - `ParentOrganizationCentralizedManagementSetupUpdated object`
102637
102638 The Centralized Management setup of a parent organization changed: it was started or abandoned, its proposed administrators changed, its remaining organizations were force approved, or it completed.
102639
102640 - `type: optional "parent_organization_centralized_management_setup_updated"`
102641
102642 default: parent_organization_centralized_management_setup_updated
102643
102644 - `action: "abandoned" or "child_joined" or "completed" or 6 more`
102645
102646 How the setup changed.
102647
102648 - `"abandoned"`
102649
102650 - `"child_joined"`
102651
102652 - `"completed"`
102653
102654 - `"force_approved"`
102655
102656 - `"nominee_added"`
102657
102658 - `"nominee_removed"`
102659
102660 - `"restarted"`
102661
102662 - `"started"`
102663
102664 - `"unspecified"`
102665
102666 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
102667
102668 - `APIActor object`
102669
102670 - `type: optional "api_actor"`
102671
102672 default: api_actor
102673
102674 - `api_key_id: string`
102675
102676 - `ip_address: string`
102677
102678 - `user_agent: string`
102679
102680 - `UserActor object`
102681
102682 - `type: optional "user_actor"`
102683
102684 default: user_actor
102685
102686 - `email_address: string`
102687
102688 format: email
102689
102690 - `ip_address: string`
102691
102692 - `user_agent: string`
102693
102694 - `user_id: string`
102695
102696 - `UnauthenticatedUserActor object`
102697
102698 - `type: optional "unauthenticated_user_actor"`
102699
102700 default: unauthenticated_user_actor
102701
102702 - `ip_address: string`
102703
102704 - `user_agent: string`
102705
102706 - `unauthenticated_email_address: optional string or null`
102707
102708 format: email
102709
102710 - `AnthropicActor object`
102711
102712 - `type: optional "anthropic_actor"`
102713
102714 default: anthropic_actor
102715
102716 - `email_address: optional string or null`
102717
102718 format: email
102719
102720 - `SystemActor object`
102721
102722 Automated background processing performed by Anthropic systems, acting
102723 without a user or customer credential.
102724
102725 - `type: optional "system_actor"`
102726
102727 default: system_actor
102728
102729 - `service: optional string or null`
102730
102731 Name of the automated process that performed the action, when known.
102732
102733 - `AdminAPIKeyActor object`
102734
102735 - `type: optional "admin_api_key_actor"`
102736
102737 default: admin_api_key_actor
102738
102739 - `admin_api_key_id: string`
102740
102741 - `ip_address: string`
102742
102743 - `user_agent: string`
102744
102745 - `ServiceAccountActor object`
102746
102747 - `type: optional "service_account_actor"`
102748
102749 default: service_account_actor
102750
102751 - `ip_address: string`
102752
102753 - `service_account_id: string`
102754
102755 - `user_agent: string`
102756
102757 - `ScimDirectorySyncActor object`
102758
102759 - `type: optional "scim_directory_sync_actor"`
102760
102761 default: scim_directory_sync_actor
102762
102763 - `directory_id: string`
102764
102765 - `workos_event_id: string`
102766
102767 - `idp_connection_type: optional string or null`
102768
102769 - `FederatedIdentityActor object`
102770
102771 A federated external workload authenticated via a verified OIDC token.
102772
102773 Carries the verified issuer, subject, and audience claims from the
102774 presented JWT.
102775
102776 - `type: optional "federated_identity_actor"`
102777
102778 default: federated_identity_actor
102779
102780 - `issuer: string`
102781
102782 - `subject: string`
102783
102784 - `audience: optional array of string`
102785
102786 - `ip_address: optional string or null`
102787
102788 - `user_agent: optional string or null`
102789
102790 - `FederatedActor object`
102791
102792 An external identity asserted by a trusted provider — a cloud-provider
102793 gateway or a customer-registered federation issuer — acting without an
102794 Anthropic-provisioned account or service account.
102795
102796 - `type: optional "federated_actor"`
102797
102798 default: federated_actor
102799
102800 - `provider: Aws or Azure or Gcp or Oidc`
102801
102802 - `Aws object`
102803
102804 Asserting party: the AWS account the organization is bound to.
102805
102806 - `type: optional "aws"`
102807
102808 default: aws
102809
102810 - `account_id: string`
102811
102812 - `signed_principal: string`
102813
102814 The AWS-signed ARN of the IAM principal that requested the token.
102815
102816 - `Azure object`
102817
102818 Asserting party: the Azure subscription the organization is bound to.
102819
102820 - `type: optional "azure"`
102821
102822 default: azure
102823
102824 - `subscription_id: string`
102825
102826 - `Gcp object`
102827
102828 Asserting party: the GCP project the organization is bound to.
102829
102830 - `type: optional "gcp"`
102831
102832 default: gcp
102833
102834 - `project_number: string`
102835
102836 - `Oidc object`
102837
102838 Asserting party: a customer-registered OIDC federation issuer.
102839
102840 - `type: optional "oidc"`
102841
102842 default: oidc
102843
102844 - `issuer: optional string or null`
102845
102846 The federation issuer's URL. Null when the presented credential failed verification.
102847
102848 - `ip_address: optional string or null`
102849
102850 - `subject: optional string or null`
102851
102852 The provider's verified identifier for the caller; its form depends on the provider.
102853
102854 - `user_agent: optional string or null`
102855
102856 - `AttestedDeviceActor object`
102857
102858 An attested mobile device authenticated via Apple App Attest.
102859
102860 - `type: optional "attested_device_actor"`
102861
102862 default: attested_device_actor
102863
102864 - `external_client_id: string`
102865
102866 - `kid_hash: string`
102867
102868 - `ip_address: optional string or null`
102869
102870 - `user_agent: optional string or null`
102871
102872 - `parent_organization_id: string`
102873
102874 The parent organization whose setup changed, e.g. "parent_org_01HX...".
102875
102876 - `id: optional string`
102877
102878 Unique identifier for the activity e.g. 'activity_abcd1234'
102879
102880 - `created_at: optional string`
102881
102882 When this activity occurred.
102883
102884 format: date-time
102885
102886 - `nominated_via_organization_id: optional string or null`
102887
102888 The organization the administrator was proposed through (nominee_added), e.g. "org_01HX...".
102889
102890 - `nominee_account_id: optional string or null`
102891
102892 The administrator added to or removed from the proposed administrators (nominee_added, nominee_removed), e.g. "user_01HX...".
102893
102894 - `organization_id: optional string or null`
102895
102896 Organization ID this activity is associated with
102897
102898 - `organization_uuid: optional string or null`
102899
102900 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
102901
102902 - `set_changed_at: optional string or null`
102903
102904 When the proposed administrators last changed as of this event; events sharing this value belong to the same version of the proposed administrators.
102905
102906 format: date-time
102907
102908 - `ParentOrganizationCentralizedManagementUnenrolled object`
102909
102910 A parent organization was unenrolled from centralized management.
102911
102912 - `type: optional "parent_organization_centralized_management_unenrolled"`
102913
102914 default: parent_organization_centralized_management_unenrolled
102915
102916 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
102917
102918 - `APIActor object`
102919
102920 - `type: optional "api_actor"`
102921
102922 default: api_actor
102923
102924 - `api_key_id: string`
102925
102926 - `ip_address: string`
102927
102928 - `user_agent: string`
102929
102930 - `UserActor object`
102931
102932 - `type: optional "user_actor"`
102933
102934 default: user_actor
102935
102936 - `email_address: string`
102937
102938 format: email
102939
102940 - `ip_address: string`
102941
102942 - `user_agent: string`
102943
102944 - `user_id: string`
102945
102946 - `UnauthenticatedUserActor object`
102947
102948 - `type: optional "unauthenticated_user_actor"`
102949
102950 default: unauthenticated_user_actor
102951
102952 - `ip_address: string`
102953
102954 - `user_agent: string`
102955
102956 - `unauthenticated_email_address: optional string or null`
102957
102958 format: email
102959
102960 - `AnthropicActor object`
102961
102962 - `type: optional "anthropic_actor"`
102963
102964 default: anthropic_actor
102965
102966 - `email_address: optional string or null`
102967
102968 format: email
102969
102970 - `SystemActor object`
102971
102972 Automated background processing performed by Anthropic systems, acting
102973 without a user or customer credential.
102974
102975 - `type: optional "system_actor"`
102976
102977 default: system_actor
102978
102979 - `service: optional string or null`
102980
102981 Name of the automated process that performed the action, when known.
102982
102983 - `AdminAPIKeyActor object`
102984
102985 - `type: optional "admin_api_key_actor"`
102986
102987 default: admin_api_key_actor
102988
102989 - `admin_api_key_id: string`
102990
102991 - `ip_address: string`
102992
102993 - `user_agent: string`
102994
102995 - `ServiceAccountActor object`
102996
102997 - `type: optional "service_account_actor"`
102998
102999 default: service_account_actor
103000
103001 - `ip_address: string`
103002
103003 - `service_account_id: string`
103004
103005 - `user_agent: string`
103006
103007 - `ScimDirectorySyncActor object`
103008
103009 - `type: optional "scim_directory_sync_actor"`
103010
103011 default: scim_directory_sync_actor
103012
103013 - `directory_id: string`
103014
103015 - `workos_event_id: string`
103016
103017 - `idp_connection_type: optional string or null`
103018
103019 - `FederatedIdentityActor object`
103020
103021 A federated external workload authenticated via a verified OIDC token.
103022
103023 Carries the verified issuer, subject, and audience claims from the
103024 presented JWT.
103025
103026 - `type: optional "federated_identity_actor"`
103027
103028 default: federated_identity_actor
103029
103030 - `issuer: string`
103031
103032 - `subject: string`
103033
103034 - `audience: optional array of string`
103035
103036 - `ip_address: optional string or null`
103037
103038 - `user_agent: optional string or null`
103039
103040 - `FederatedActor object`
103041
103042 An external identity asserted by a trusted provider — a cloud-provider
103043 gateway or a customer-registered federation issuer — acting without an
103044 Anthropic-provisioned account or service account.
103045
103046 - `type: optional "federated_actor"`
103047
103048 default: federated_actor
103049
103050 - `provider: Aws or Azure or Gcp or Oidc`
103051
103052 - `Aws object`
103053
103054 Asserting party: the AWS account the organization is bound to.
103055
103056 - `type: optional "aws"`
103057
103058 default: aws
103059
103060 - `account_id: string`
103061
103062 - `signed_principal: string`
103063
103064 The AWS-signed ARN of the IAM principal that requested the token.
103065
103066 - `Azure object`
103067
103068 Asserting party: the Azure subscription the organization is bound to.
103069
103070 - `type: optional "azure"`
103071
103072 default: azure
103073
103074 - `subscription_id: string`
103075
103076 - `Gcp object`
103077
103078 Asserting party: the GCP project the organization is bound to.
103079
103080 - `type: optional "gcp"`
103081
103082 default: gcp
103083
103084 - `project_number: string`
103085
103086 - `Oidc object`
103087
103088 Asserting party: a customer-registered OIDC federation issuer.
103089
103090 - `type: optional "oidc"`
103091
103092 default: oidc
103093
103094 - `issuer: optional string or null`
103095
103096 The federation issuer's URL. Null when the presented credential failed verification.
103097
103098 - `ip_address: optional string or null`
103099
103100 - `subject: optional string or null`
103101
103102 The provider's verified identifier for the caller; its form depends on the provider.
103103
103104 - `user_agent: optional string or null`
103105
103106 - `AttestedDeviceActor object`
103107
103108 An attested mobile device authenticated via Apple App Attest.
103109
103110 - `type: optional "attested_device_actor"`
103111
103112 default: attested_device_actor
103113
103114 - `external_client_id: string`
103115
103116 - `kid_hash: string`
103117
103118 - `ip_address: optional string or null`
103119
103120 - `user_agent: optional string or null`
103121
103122 - `parent_organization_id: string`
103123
103124 The parent organization that was unenrolled from centralized management.
103125
103126 - `id: optional string`
103127
103128 Unique identifier for the activity e.g. 'activity_abcd1234'
103129
103130 - `created_at: optional string`
103131
103132 When this activity occurred.
103133
103134 format: date-time
103135
103136 - `members: optional array of object`
103137
103138 The members whose parent-organization roles were revoked at unenrollment.
103139
103140 - `role: "admin" or "owner" or "unspecified"`
103141
103142 The parent-organization role held.
103143
103144 - `"admin"`
103145
103146 - `"owner"`
103147
103148 - `"unspecified"`
103149
103150 - `user_id: string`
103151
103152 Tagged ID of the member's account.
103153
103154 - `organization_id: optional string or null`
103155
103156 Organization ID this activity is associated with
103157
103158 - `organization_uuid: optional string or null`
103159
103160 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
103161
103162 - `ParentOrganizationMemberRemoved object`
103163
103164 A parent-organization admin role was removed from a user.
103165
103166 - `type: optional "parent_organization_member_removed"`
103167
103168 default: parent_organization_member_removed
103169
103170 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
103171
103172 - `APIActor object`
103173
103174 - `type: optional "api_actor"`
103175
103176 default: api_actor
103177
103178 - `api_key_id: string`
103179
103180 - `ip_address: string`
103181
103182 - `user_agent: string`
103183
103184 - `UserActor object`
103185
103186 - `type: optional "user_actor"`
103187
103188 default: user_actor
103189
103190 - `email_address: string`
103191
103192 format: email
103193
103194 - `ip_address: string`
103195
103196 - `user_agent: string`
103197
103198 - `user_id: string`
103199
103200 - `UnauthenticatedUserActor object`
103201
103202 - `type: optional "unauthenticated_user_actor"`
103203
103204 default: unauthenticated_user_actor
103205
103206 - `ip_address: string`
103207
103208 - `user_agent: string`
103209
103210 - `unauthenticated_email_address: optional string or null`
103211
103212 format: email
103213
103214 - `AnthropicActor object`
103215
103216 - `type: optional "anthropic_actor"`
103217
103218 default: anthropic_actor
103219
103220 - `email_address: optional string or null`
103221
103222 format: email
103223
103224 - `SystemActor object`
103225
103226 Automated background processing performed by Anthropic systems, acting
103227 without a user or customer credential.
103228
103229 - `type: optional "system_actor"`
103230
103231 default: system_actor
103232
103233 - `service: optional string or null`
103234
103235 Name of the automated process that performed the action, when known.
103236
103237 - `AdminAPIKeyActor object`
103238
103239 - `type: optional "admin_api_key_actor"`
103240
103241 default: admin_api_key_actor
103242
103243 - `admin_api_key_id: string`
103244
103245 - `ip_address: string`
103246
103247 - `user_agent: string`
103248
103249 - `ServiceAccountActor object`
103250
103251 - `type: optional "service_account_actor"`
103252
103253 default: service_account_actor
103254
103255 - `ip_address: string`
103256
103257 - `service_account_id: string`
103258
103259 - `user_agent: string`
103260
103261 - `ScimDirectorySyncActor object`
103262
103263 - `type: optional "scim_directory_sync_actor"`
103264
103265 default: scim_directory_sync_actor
103266
103267 - `directory_id: string`
103268
103269 - `workos_event_id: string`
103270
103271 - `idp_connection_type: optional string or null`
103272
103273 - `FederatedIdentityActor object`
103274
103275 A federated external workload authenticated via a verified OIDC token.
103276
103277 Carries the verified issuer, subject, and audience claims from the
103278 presented JWT.
103279
103280 - `type: optional "federated_identity_actor"`
103281
103282 default: federated_identity_actor
103283
103284 - `issuer: string`
103285
103286 - `subject: string`
103287
103288 - `audience: optional array of string`
103289
103290 - `ip_address: optional string or null`
103291
103292 - `user_agent: optional string or null`
103293
103294 - `FederatedActor object`
103295
103296 An external identity asserted by a trusted provider — a cloud-provider
103297 gateway or a customer-registered federation issuer — acting without an
103298 Anthropic-provisioned account or service account.
103299
103300 - `type: optional "federated_actor"`
103301
103302 default: federated_actor
103303
103304 - `provider: Aws or Azure or Gcp or Oidc`
103305
103306 - `Aws object`
103307
103308 Asserting party: the AWS account the organization is bound to.
103309
103310 - `type: optional "aws"`
103311
103312 default: aws
103313
103314 - `account_id: string`
103315
103316 - `signed_principal: string`
103317
103318 The AWS-signed ARN of the IAM principal that requested the token.
103319
103320 - `Azure object`
103321
103322 Asserting party: the Azure subscription the organization is bound to.
103323
103324 - `type: optional "azure"`
103325
103326 default: azure
103327
103328 - `subscription_id: string`
103329
103330 - `Gcp object`
103331
103332 Asserting party: the GCP project the organization is bound to.
103333
103334 - `type: optional "gcp"`
103335
103336 default: gcp
103337
103338 - `project_number: string`
103339
103340 - `Oidc object`
103341
103342 Asserting party: a customer-registered OIDC federation issuer.
103343
103344 - `type: optional "oidc"`
103345
103346 default: oidc
103347
103348 - `issuer: optional string or null`
103349
103350 The federation issuer's URL. Null when the presented credential failed verification.
103351
103352 - `ip_address: optional string or null`
103353
103354 - `subject: optional string or null`
103355
103356 The provider's verified identifier for the caller; its form depends on the provider.
103357
103358 - `user_agent: optional string or null`
103359
103360 - `AttestedDeviceActor object`
103361
103362 An attested mobile device authenticated via Apple App Attest.
103363
103364 - `type: optional "attested_device_actor"`
103365
103366 default: attested_device_actor
103367
103368 - `external_client_id: string`
103369
103370 - `kid_hash: string`
103371
103372 - `ip_address: optional string or null`
103373
103374 - `user_agent: optional string or null`
103375
103376 - `parent_organization_id: string`
103377
103378 The parent organization whose admin roster was changed.
103379
103380 - `role: string`
103381
103382 The role the user held on the parent organization at the time of removal.
103383
103384 - `user_id: string`
103385
103386 The user whose parent-organization admin role was removed.
103387
103388 - `id: optional string`
103389
103390 Unique identifier for the activity e.g. 'activity_abcd1234'
103391
103392 - `created_at: optional string`
103393
103394 When this activity occurred.
103395
103396 format: date-time
103397
103398 - `organization_id: optional string or null`
103399
103400 Organization ID this activity is associated with
103401
103402 - `organization_uuid: optional string or null`
103403
103404 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
103405
103406 - `ParentOrganizationMemberUpdated object`
103407
103408 A parent-organization admin role was granted or changed for a user.
103409
103410 - `type: optional "parent_organization_member_updated"`
103411
103412 default: parent_organization_member_updated
103413
103414 - `action: "added" or "role_changed" or "unspecified"`
103415
103416 Whether the user was newly granted the role or had an existing role changed.
103417
103418 - `"added"`
103419
103420 - `"role_changed"`
103421
103422 - `"unspecified"`
103423
103424 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
103425
103426 - `APIActor object`
103427
103428 - `type: optional "api_actor"`
103429
103430 default: api_actor
103431
103432 - `api_key_id: string`
103433
103434 - `ip_address: string`
103435
103436 - `user_agent: string`
103437
103438 - `UserActor object`
103439
103440 - `type: optional "user_actor"`
103441
103442 default: user_actor
103443
103444 - `email_address: string`
103445
103446 format: email
103447
103448 - `ip_address: string`
103449
103450 - `user_agent: string`
103451
103452 - `user_id: string`
103453
103454 - `UnauthenticatedUserActor object`
103455
103456 - `type: optional "unauthenticated_user_actor"`
103457
103458 default: unauthenticated_user_actor
103459
103460 - `ip_address: string`
103461
103462 - `user_agent: string`
103463
103464 - `unauthenticated_email_address: optional string or null`
103465
103466 format: email
103467
103468 - `AnthropicActor object`
103469
103470 - `type: optional "anthropic_actor"`
103471
103472 default: anthropic_actor
103473
103474 - `email_address: optional string or null`
103475
103476 format: email
103477
103478 - `SystemActor object`
103479
103480 Automated background processing performed by Anthropic systems, acting
103481 without a user or customer credential.
103482
103483 - `type: optional "system_actor"`
103484
103485 default: system_actor
103486
103487 - `service: optional string or null`
103488
103489 Name of the automated process that performed the action, when known.
103490
103491 - `AdminAPIKeyActor object`
103492
103493 - `type: optional "admin_api_key_actor"`
103494
103495 default: admin_api_key_actor
103496
103497 - `admin_api_key_id: string`
103498
103499 - `ip_address: string`
103500
103501 - `user_agent: string`
103502
103503 - `ServiceAccountActor object`
103504
103505 - `type: optional "service_account_actor"`
103506
103507 default: service_account_actor
103508
103509 - `ip_address: string`
103510
103511 - `service_account_id: string`
103512
103513 - `user_agent: string`
103514
103515 - `ScimDirectorySyncActor object`
103516
103517 - `type: optional "scim_directory_sync_actor"`
103518
103519 default: scim_directory_sync_actor
103520
103521 - `directory_id: string`
103522
103523 - `workos_event_id: string`
103524
103525 - `idp_connection_type: optional string or null`
103526
103527 - `FederatedIdentityActor object`
103528
103529 A federated external workload authenticated via a verified OIDC token.
103530
103531 Carries the verified issuer, subject, and audience claims from the
103532 presented JWT.
103533
103534 - `type: optional "federated_identity_actor"`
103535
103536 default: federated_identity_actor
103537
103538 - `issuer: string`
103539
103540 - `subject: string`
103541
103542 - `audience: optional array of string`
103543
103544 - `ip_address: optional string or null`
103545
103546 - `user_agent: optional string or null`
103547
103548 - `FederatedActor object`
103549
103550 An external identity asserted by a trusted provider — a cloud-provider
103551 gateway or a customer-registered federation issuer — acting without an
103552 Anthropic-provisioned account or service account.
103553
103554 - `type: optional "federated_actor"`
103555
103556 default: federated_actor
103557
103558 - `provider: Aws or Azure or Gcp or Oidc`
103559
103560 - `Aws object`
103561
103562 Asserting party: the AWS account the organization is bound to.
103563
103564 - `type: optional "aws"`
103565
103566 default: aws
103567
103568 - `account_id: string`
103569
103570 - `signed_principal: string`
103571
103572 The AWS-signed ARN of the IAM principal that requested the token.
103573
103574 - `Azure object`
103575
103576 Asserting party: the Azure subscription the organization is bound to.
103577
103578 - `type: optional "azure"`
103579
103580 default: azure
103581
103582 - `subscription_id: string`
103583
103584 - `Gcp object`
103585
103586 Asserting party: the GCP project the organization is bound to.
103587
103588 - `type: optional "gcp"`
103589
103590 default: gcp
103591
103592 - `project_number: string`
103593
103594 - `Oidc object`
103595
103596 Asserting party: a customer-registered OIDC federation issuer.
103597
103598 - `type: optional "oidc"`
103599
103600 default: oidc
103601
103602 - `issuer: optional string or null`
103603
103604 The federation issuer's URL. Null when the presented credential failed verification.
103605
103606 - `ip_address: optional string or null`
103607
103608 - `subject: optional string or null`
103609
103610 The provider's verified identifier for the caller; its form depends on the provider.
103611
103612 - `user_agent: optional string or null`
103613
103614 - `AttestedDeviceActor object`
103615
103616 An attested mobile device authenticated via Apple App Attest.
103617
103618 - `type: optional "attested_device_actor"`
103619
103620 default: attested_device_actor
103621
103622 - `external_client_id: string`
103623
103624 - `kid_hash: string`
103625
103626 - `ip_address: optional string or null`
103627
103628 - `user_agent: optional string or null`
103629
103630 - `parent_organization_id: string`
103631
103632 The parent organization whose admin roster was changed.
103633
103634 - `role: string`
103635
103636 The role the user now holds on the parent organization.
103637
103638 - `user_id: string`
103639
103640 The user whose parent-organization admin role was set.
103641
103642 - `id: optional string`
103643
103644 Unique identifier for the activity e.g. 'activity_abcd1234'
103645
103646 - `created_at: optional string`
103647
103648 When this activity occurred.
103649
103650 format: date-time
103651
103652 - `organization_id: optional string or null`
103653
103654 Organization ID this activity is associated with
103655
103656 - `organization_uuid: optional string or null`
103657
103658 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
103659
103660 - `ParentOrganizationSettingsUpdated object`
103661
103662 Parent organization settings were updated.
103663
103664 - `type: optional "parent_organization_settings_updated"`
103665
103666 default: parent_organization_settings_updated
103667
103668 - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
103669
103670 - `APIActor object`
103671
103672 - `type: optional "api_actor"`
103673
103674 default: api_actor
103675
103676 - `api_key_id: string`
103677
103678 - `ip_address: string`
103679
103680 - `user_agent: string`
103681
103682 - `UserActor object`
103683
103684 - `type: optional "user_actor"`
103685
103686 default: user_actor
103687
103688 - `email_address: string`
103689
103690 format: email
103691
103692 - `ip_address: string`
103693
103694 - `user_agent: string`
103695
103696 - `user_id: string`
103697
103698 - `UnauthenticatedUserActor object`
103699
103700 - `type: optional "unauthenticated_user_actor"`
103701
103702 default: unauthenticated_user_actor
103703
103704 - `ip_address: string`
103705
103706 - `user_agent: string`
103707
103708 - `unauthenticated_email_address: optional string or null`
103709
103710 format: email
103711
103712 - `AnthropicActor object`
103713
103714 - `type: optional "anthropic_actor"`
103715
103716 default: anthropic_actor
103717
103718 - `email_address: optional string or null`
103719
103720 format: email
103721
103722 - `SystemActor object`
103723
103724 Automated background processing performed by Anthropic systems, acting
103725 without a user or customer credential.
103726
103727 - `type: optional "system_actor"`
103728
103729 default: system_actor
103730
103731 - `service: optional string or null`
103732
103733 Name of the automated process that performed the action, when known.
103734
103735 - `AdminAPIKeyActor object`
103736
103737 - `type: optional "admin_api_key_actor"`
103738
103739 default: admin_api_key_actor
103740
103741 - `admin_api_key_id: string`
103742
103743 - `ip_address: string`
103744
103745 - `user_agent: string`
103746
103747 - `ServiceAccountActor object`
103748
103749 - `type: optional "service_account_actor"`
103750
103751 default: service_account_actor
103752
103753 - `ip_address: string`
103754
103755 - `service_account_id: string`
103756
103757 - `user_agent: string`
103758
103759 - `ScimDirectorySyncActor object`
103760
103761 - `type: optional "scim_directory_sync_actor"`
103762
103763 default: scim_directory_sync_actor
103764
103765 - `directory_id: string`
103766
103767 - `workos_event_id: string`
103768
103769 - `idp_connection_type: optional string or null`
103770
103771 - `FederatedIdentityActor object`
103772
103773 A federated external workload authenticated via a verified OIDC token.
103774
103775 Carries the verified issuer, subject, and audience claims from the
103776 presented JWT.
103777
103778 - `type: optional "federated_identity_actor"`
103779
103780 default: federated_identity_actor
103781
103782 - `issuer: string`
103783
103784 - `subject: string`
103785
103786 - `audience: optional array of string`
103787
103788 - `ip_address: optional string or null`
103789
103790 - `user_agent: optional string or null`
103791
103792 - `FederatedActor object`
103793
103794 An external identity asserted by a trusted provider — a cloud-provider
103795 gateway or a customer-registered federation issuer — acting without an
103796 Anthropic-provisioned account or service account.
103797
103798 - `type: optional "federated_actor"`
103799
103800 default: federated_actor
103801
103802 - `provider: Aws or Azure or Gcp or Oidc`
103803
103804 - `Aws object`
103805
103806 Asserting party: the AWS account the organization is bound to.
103807
103808 - `type: optional "aws"`
103809
103810 default: aws
103811
103812 - `account_id: string`
103813
103814 - `signed_principal: string`
103815
103816 The AWS-signed ARN of the IAM principal that requested the token.
103817
103818 - `Azure object`
103819
103820 Asserting party: the Azure subscription the organization is bound to.
103821
103822 - `type: optional "azure"`
103823
103824 default: azure
103825
103826 - `subscription_id: string`
103827
103828 - `Gcp object`
103829
103830 Asserting party: the GCP project the organization is bound to.
103831
103832 - `type: optional "gcp"`
103833
103834 default: gcp
103835
103836 - `project_number: string`
103837
103838 - `Oidc object`
103839
103840 Asserting party: a customer-registered OIDC federation issuer.
103841
103842 - `type: optional "oidc"`
103843
103844 default: oidc
103845
103846 - `issuer: optional string or null`
103847
103848 The federation issuer's URL. Null when the presented credential failed verification.
103849
103850 - `ip_address: optional string or null`
103851
103852 - `subject: optional string or null`
103853
103854 The provider's verified identifier for the caller; its form depends on the provider.
103855
103856 - `user_agent: optional string or null`
103857
103858 - `AttestedDeviceActor object`
103859
103860 An attested mobile device authenticated via Apple App Attest.
103861
103862 - `type: optional "attested_device_actor"`
103863
103864 default: attested_device_actor
103865
103866 - `external_client_id: string`
103867
103868 - `kid_hash: string`
103869
103870 - `ip_address: optional string or null`
103871
103872 - `user_agent: optional string or null`
103873
103874 - `parent_organization_id: string`
103875
103876 The parent organization whose settings were updated.
103877
103878 - `updates: array of object`
103879
103880 The setting changes applied in this update.
103881
103882 - `type: optional "name"`
103883
103884 default: name
103885
103886 - `current_value: string`
103887
103888 Setting value immediately after this change
103889
103890 - `previous_value: string`
103891
103892 Setting value immediately before this change
103893
103894 - `id: optional string`
103895
103896 Unique identifier for the activity e.g. 'activity_abcd1234'
103897
103898 - `created_at: optional string`
103899
103900 When this activity occurred.
103901
103902 format: date-time
103903
103904 - `organization_id: optional string or null`
103905
103906 Organization ID this activity is associated with
103907
103908 - `organization_uuid: optional string or null`
103909
103910 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
103911
99040103912 - `PaymentMethodUpdated object`
99041103913
99042103914 The organization's default payment method was updated.
from line 138559
133687138559
133688138560 format: date-time
133689138561
138562 - `idp_connection_id: optional string or null`
138563
138564 Identifies the identity provider connection the sign-in came through. `null` or absent when the sign-in was not matched to one of the parent organization's identity provider connections. Absent on activities recorded before this field was introduced.
138565
133690138566 - `organization_id: optional string or null`
133691138567
133692138568 Organization ID this activity is associated with
from line 138795
133919138795
133920138796 format: date-time
133921138797
138798 - `idp_connection_id: optional string or null`
138799
138800 Identifies the identity provider connection the user was sent to. `null` or absent when the user was not sent to a single connection, for example when they choose one on the next page. Absent on activities recorded before this field was introduced.
138801
133922138802 - `organization_id: optional string or null`
133923138803
133924138804 Organization ID this activity is associated with
from line 139039
134159139039
134160139040 format: date-time
134161139041
139042 - `idp_connection_id: optional string or null`
139043
139044 Identifies the identity provider connection the user signed in through. `null` or absent when the sign-in was not matched to one of the parent organization's identity provider connections. Absent on activities recorded before this field was introduced.
139045
134162139046 - `mfa_method: optional "not_used" or "unspecified" or null`
134163139047
134164139048 The second authentication factor performed during this login, if any. `null` when the second-factor status is not recorded on this event — for example, when authentication was delegated to an external identity provider and any second factor is not visible to Anthropic, or when this event is one step of a multistep login whose MFA is reported on another activity. May be absent on activities recorded before this field was introduced.
134165139049
No line in this hunk matches that.