Organizations changedapi/compliance/organizations
Nearest release: v2.1.322, published 2 hours before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+380added
Lines−2removed
From line
631
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits19to this page, all time
## Organizations › Security Posture ### Get an organization's security posture
The whole hunk
from line 631, old and new numbered
/
from line 631
631631
632632The organization must belong to the API key's organization hierarchy;
633633unknown organizations and organizations outside the hierarchy return 404.
634The verified_domains and identity_providers settings describe the whole
635parent organization and are returned only to API keys that are not
636restricted to a single organization.
634637
635638#### Path parameters
636639
from line 699
696699
697700- `organization_id: string`
698701
699- `settings: array of Boolean or Integer or String or 3 more`
702- `settings: array of Boolean or Integer or String or 5 more`
700703
701704 - `Boolean object`
702705
from line 709
706709
707710 default: boolean
708711
709 - `name: "access_transparency_enabled" or "ai_powered_artifacts_enabled" or "api_workbench_feedback_collection_enabled" or 61 more`
712 - `name: "access_transparency_enabled" or "ai_powered_artifacts_enabled" or "api_workbench_feedback_collection_enabled" or 64 more`
710713
711714 - `"access_transparency_enabled"`
712715
from line 731
728731
729732 - `"claude_ai_ccr_support_sharing_enabled"`
730733
734 - `"claude_ai_chat_external_sharing_enabled"`
735
736 - `"claude_ai_chat_org_sharing_enabled"`
737
731738 - `"claude_ai_chat_sharing_enabled"`
732739
733740 - `"claude_ai_feedback_collection_enabled"`
from line 771
764771
765772 - `"claude_in_slack_enabled"`
766773
774 - `"claude_science_auto_mode_enabled"`
775
767776 - `"claude_science_custom_connectors_enabled"`
768777
769778 - `"claude_science_custom_skills_enabled"`
from line 970
961970
962971 default: data_retention_periods
963972
973 - `VerifiedDomains object`
974
975 The domains verified for the organization's parent organization. The
976 same for every organization under that parent, and returned only to API
977 keys that are not restricted to a single organization.
978
979 - `type: optional "verified_domains"`
980
981 default: verified_domains
982
983 - `value: array of object`
984
985 - `domain: string`
986
987 The verified domain name.
988
989 - `sso_claude_ai_enforced: boolean`
990
991 Whether single sign-on is required to sign in to Claude.ai with an email address on this domain.
992
993 - `sso_console_enforced: boolean`
994
995 Whether single sign-on is required to sign in to the Claude Console with an email address on this domain.
996
997 - `name: optional "verified_domains"`
998
999 default: verified_domains
1000
1001 - `IdentityProviders object`
1002
1003 The IdP connections of the organization's parent organization, oldest
1004 first. The same for every organization under that parent, and returned
1005 only to API keys that are not restricted to a single organization.
1006
1007 - `type: optional "identity_providers"`
1008
1009 default: identity_providers
1010
1011 - `value: array of object`
1012
1013 - `id: string`
1014
1015 Unique identifier for the IdP connection.
1016
1017 - `directory_sync_enabled: boolean`
1018
1019 Whether directory sync through this IdP connection is enabled.
1020
1021 - `sso_enabled: boolean`
1022
1023 Whether single sign-on through this IdP connection is enabled.
1024
1025 - `name: optional "identity_providers"`
1026
1027 default: identity_providers
1028
9641029#### Example
9651030
9661031```bash
from line 1061
9961061 }
9971062 ],
9981063 "type": "effective_organization_settings"
1064}
1065```
1066
1067## Organizations › Security Posture
1068
1069### Get an organization's security posture
1070
1071**GET** `/v1/compliance/organizations/{organization_id}/security_posture`
1072
1073Get an organization's security controls and their current results.
1074
1075Returns the organization's security controls, evaluated at the time of the
1076request, each with its attestation when this endpoint returns one. The controls come
1077in one `controls` list, which is not paginated. A control can have no entry, for
1078example when it is about a feature that the organization cannot have, so a missing
1079control is not a pass.
1080
1081The `anthropic-version` header is required: a request without it returns 400.
1082The endpoint takes no query parameters, so there is no filter, and a request with
1083any query parameter also returns 400. A request also returns 400 when the Compliance
1084API is not enabled for the API key's parent organization.
1085The request returns 404 when `organization_id` names no organization, names one
1086that the API key cannot read, or names one whose security controls are not
1087available. A request over a rate limit returns 429.
1088
1089One error has an `error_code` in `error.details`. A 503 with
1090`posture_evaluation_failed` means that the evaluation could not be completed.
1091Wait for the time in the `Retry-After` header before trying again. A 504 means
1092that the evaluation did not finish in time, and the request can be tried again.
1093
1094#### Path parameters
1095
1096- `organization_id: string`
1097
1098 The organization's UUID
1099
1100#### Headers
1101
1102- `"anthropic-version": optional string`
1103
1104 The version of the Claude API you want to use.
1105
1106 Read more about versioning and our version history [here](https://platform.claude.com/docs/en/api/versioning?sdk_languages=http).
1107
1108- `"x-api-key": optional string`
1109
1110#### Returns
1111
1112- `type: "security_posture"`
1113
1114 Always `security_posture`.
1115
1116- `comments_status: "available" or "not_enabled" or "not_permitted" or 2 more`
1117
1118 Whether attestation comments were read. More values can be added; read an unknown one as `unavailable`.
1119
1120 - `"available"`
1121
1122 Comments were read, so a null `comment` means that there is none, or that the attestation was saved moments ago.
1123
1124 - `"not_enabled"`
1125
1126 This endpoint does not return comments for the organization, so every `comment` is null.
1127
1128 - `"not_permitted"`
1129
1130 The API key holds neither `read:compliance_user_data` nor `read:org_audit`, so every `comment` and every `attested_by` is null.
1131
1132 - `"requires_organization_key"`
1133
1134 The API key was not created in the organization, for example because it was created for the parent organization, so no comment is read and every `comment` is null. `attested_by` is returned as it is to a key created in the organization. This value does not say whether this endpoint returns comments for the organization. Retrying does not help: only a key created in the organization can read its comments.
1135
1136 - `"unavailable"`
1137
1138 Comments could not be read for this response. A later request may succeed, but some causes persist, for example when the organization's customer-managed encryption key cannot be used.
1139
1140- `controls: array of object`
1141
1142 The organization's controls, never empty. A control can have no entry, for example when it is about a feature that the organization cannot have, so a missing control is not a pass.
1143
1144 - `id: string`
1145
1146 The control's identifier, which is the same for every organization and never changes.
1147
1148 - `attestation: object or null`
1149
1150 The attestation of this control. It is still returned after it stops being in effect; see its `state`. Null when nobody has attested, when attestations of this kind are not enabled for the organization, and while the status is `descriptive`, `not_applicable` or `not_evaluated`. It is also null when the attestation stored for the control is of a kind that this endpoint does not return, so null does not prove that nobody has attested.
1151
1152 - `attested_at: string`
1153
1154 When the attestation was made.
1155
1156 format: date-time
1157
1158 - `attested_by: object or null`
1159
1160 Who made the attestation. Null when the response's `comments_status` is `not_permitted`, when showing who attested is not enabled for the organization, when the person's account has been deleted, or while Anthropic holds back who attested for every organization.
1161
1162 - `type: "user_actor"`
1163
1164 Always `user_actor`.
1165
1166 - `user_id: string`
1167
1168 User identifier (tagged ID, prefixed `user_`).
1169
1170 - `comment: string or null`
1171
1172 The comment saved with the attestation, of at most 2,000 characters. It is the text of the last save, which can keep words that an earlier administrator wrote. Null if there is none, or if the response's `comments_status` is not `available`.
1173
1174 - `state: "check_passing" or "in_force" or "review_due" or "setting_changed" or null`
1175
1176 Whether the attestation is still in effect. Null only on a manual control, and only when end dates do not apply to the organization; the attestation is then in effect. More values can be added; read an unknown one as not in effect.
1177
1178 - `"check_passing"`
1179
1180 Not in effect: the automatic check passes.
1181
1182 - `"in_force"`
1183
1184 The attestation is in effect.
1185
1186 - `"review_due"`
1187
1188 Not in effect: the attestation's end date, also called its review date, has come, so it is due for review.
1189
1190 - `"setting_changed"`
1191
1192 Not in effect: the automatic check fails, either on a different value from the one whose risk was accepted, or after the accepted risk was recorded as ended.
1193
1194 - `current_value: string or null`
1195
1196 The value read for the control, as display text whose wording can change. It is in English, apart from values taken from the organization's settings, such as its allowed email domains. A list names only the entries that this endpoint recognizes, followed by the number of other entries, if any. Null on a manual control, while the status is `not_evaluated`, and while the status is `not_applicable` because the control applies only when another setting has a certain value.
1197
1198 - `desired_state: string or null`
1199
1200 The recommended value, as display text whose wording can change. It is in English, apart from values such as the organization's ID. Null when there is none for this organization.
1201
1202 - `display_name: string`
1203
1204 The control's display name, in English.
1205
1206 - `rating: "descriptive" or "failed" or "not_attested" or "passed"`
1207
1208 The control's overall result, which follows from `status`. More values can be added; read an unknown one as not passed.
1209
1210 - `"descriptive"`
1211
1212 Descriptive: not rated, which includes controls that do not apply or could not be read.
1213
1214 - `"failed"`
1215
1216 Failed. Because of an attestation that this endpoint does not return, a control can have this rating while the Security posture page shows it as Passed.
1217
1218 - `"not_attested"`
1219
1220 Not attested: a manual control with no attestation in effect.
1221
1222 - `"passed"`
1223
1224 Passed. This includes a control with an accepted risk in effect, whether automatic or manual.
1225
1226 - `section: "capabilities" or "chats_desktop_mdm" or "claude_code_admin_console" or 7 more`
1227
1228 The section that this control belongs to. More values can be added; treat an unknown one as a section of its own.
1229
1230 - `"capabilities"`
1231
1232 Capabilities
1233
1234 - `"chats_desktop_mdm"`
1235
1236 Chats: desktop device management
1237
1238 - `"claude_code_admin_console"`
1239
1240 Claude Code: admin console
1241
1242 - `"claude_code_managed_settings"`
1243
1244 Claude Code: managed settings
1245
1246 - `"connectors_integrations"`
1247
1248 Connectors and integrations
1249
1250 - `"cowork_admin_console"`
1251
1252 Cowork: admin console
1253
1254 - `"cowork_desktop_mdm"`
1255
1256 Cowork: desktop device management
1257
1258 - `"data_privacy"`
1259
1260 Data and privacy
1261
1262 - `"healthy_adoption"`
1263
1264 Healthy adoption
1265
1266 - `"identity_access"`
1267
1268 Identity and access
1269
1270 - `setting_name: string or null`
1271
1272 The `name` of the entry in the organization's effective settings that this control reads. Null when it reads no such entry.
1273
1274 - `status: "attestation_not_enabled" or "attested_accepted_risk" or "attested_completed" or 10 more`
1275
1276 Why the control has its rating. A manual control is one that only a person can check. An automatic control reads a value from the organization, usually one of its settings, and some are checked against a recommended value. The recommended values are those of the standard profile, which every organization is rated under. More values can be added; count a control with an unknown one by its `rating`.
1277
1278 - `"attestation_not_enabled"`
1279
1280 A manual control that nobody in the organization can attest to.
1281
1282 - `"attested_accepted_risk"`
1283
1284 A manual control attested as Accepted risk, with the attestation in effect.
1285
1286 - `"attested_completed"`
1287
1288 A manual control attested as Completed, with the attestation in effect.
1289
1290 - `"descriptive"`
1291
1292 The control is reported for information only.
1293
1294 - `"exceeds_baseline"`
1295
1296 The current value is stricter than the recommended value.
1297
1298 - `"failed"`
1299
1300 The current value does not meet the recommended value. An attestation that this endpoint does not return can also give a control this status.
1301
1302 - `"failed_check_accepted_risk"`
1303
1304 The automatic check fails, and an accepted risk is in effect.
1305
1306 - `"matches_profile"`
1307
1308 The current value equals the recommended value.
1309
1310 - `"not_applicable"`
1311
1312 The control does not apply to the organization.
1313
1314 - `"not_attested"`
1315
1316 A manual control that can be attested to, with no attestation in effect.
1317
1318 - `"not_evaluated"`
1319
1320 The setting behind the control, or another setting that decides whether the control applies, could not be read.
1321
1322 - `"passed"`
1323
1324 The current value meets the recommended value.
1325
1326 - `"review"`
1327
1328 The current value is looser than the recommended value.
1329
1330- `evaluated_at: string`
1331
1332 The time at which every control was evaluated.
1333
1334 format: date-time
1335
1336- `organization_id: string`
1337
1338 The organization's UUID.
1339
1340#### Example
1341
1342```bash
1343curl https://api.anthropic.com/v1/compliance/organizations/$ORGANIZATION_ID/security_posture \
1344 -H 'anthropic-version: 2023-06-01' \
1345 -H "Authorization: Bearer $ANTHROPIC_COMPLIANCE_API_KEY"
1346```
1347
1348##### Response (200)
1349
1350```json
1351{
1352 "comments_status": "not_enabled",
1353 "controls": [
1354 {
1355 "id": "sso_enabled",
1356 "attestation": {
1357 "attested_at": "2025-03-12T18:22:41.123456Z",
1358 "attested_by": {
1359 "type": "user_actor",
1360 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
1361 },
1362 "comment": null,
1363 "state": "in_force"
1364 },
1365 "current_value": "On",
1366 "desired_state": "On",
1367 "display_name": "Single sign-on (SSO)",
1368 "rating": "passed",
1369 "section": "identity_access",
1370 "setting_name": "sso_enabled",
1371 "status": "passed"
1372 }
1373 ],
1374 "evaluated_at": "2025-03-12T18:22:41.123456Z",
1375 "organization_id": "a1b2c3d4-e5f6-4789-a012-3456789abcde",
1376 "type": "security_posture"
9991377}
10001378```
10011379
No line in this hunk matches that.