admin-api-keys changedmanage-claude/admin-api-keys
Nearest release: v2.1.322, published 16 hours before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+18added
Lines−18removed
From line
61
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits12to this page, all time
The whole hunk
from line 61, old and new numbered
/
from line 61
6161
6262When you create a Claude Enterprise key, select every scope that the APIs you plan to call require. Scopes are fixed at creation; to add a scope later, create a new key.
6363
64| To call... | Select these scopes |
65| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------- |
66| Admin API [user management](https://platform.claude.com/docs/en/manage-claude/user-management): list and look up members and invites; read custom roles and their permissions | `read:members` |
67| Admin API [user management](https://platform.claude.com/docs/en/manage-claude/user-management): change member roles, remove members, [sign members out everywhere](https://platform.claude.com/docs/en/manage-claude/user-management#sign-a-member-out-everywhere) (beta), and create and withdraw invites (to assign the `managed` role on a role change or an invite, also select `write:rbac_groups`) | `write:members` |
68| Admin API [user management](https://platform.claude.com/docs/en/manage-claude/user-management): read groups and their members | `read:rbac_groups` |
69| Admin API [user management](https://platform.claude.com/docs/en/manage-claude/user-management): create, rename, and delete groups; add and remove group members; with `write:members`, assign the `managed` role (on an invite or a role change) or assign groups on an invite | `write:rbac_groups` |
70| [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api): read plugins, versions, installation settings, shares, and marketplaces; download plugin files, including the files of members’ personal plugins; validate a marketplace before you connect it | `read:plugins` |
71| [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api): upload plugins and versions; choose which version members are served; delete plugins, including members’ personal plugins; set and remove installation settings; set a marketplace’s default installation setting; validate a marketplace before you connect it (to read plugins, also select `read:plugins`) | `write:plugins` |
72| [Claude Tag API](https://platform.claude.com/docs/en/manage-claude/claude-tag-api): read Claude Tag’s settings on Slack channels and Slack workspaces; list Access bundles and where they are attached (no other scope grants access to the Claude Tag API) | `read:claude_tag` |
73| [Claude Tag API](https://platform.claude.com/docs/en/manage-claude/claude-tag-api): set up and remove channels; change settings; attach and detach Access bundles (to read as well, also select `read:claude_tag`) | `write:claude_tag` |
74| [Spend Limits API](https://platform.claude.com/docs/en/manage-claude/spend-limits-api): read members’ effective spend limits and increase requests | `read:spend_limits` |
75| [Spend Limits API](https://platform.claude.com/docs/en/manage-claude/spend-limits-api): set or clear per-user spend limits; approve or deny increase requests | `write:spend_limits` |
76| [Claude Enterprise Analytics API](https://platform.claude.com/docs/en/manage-claude/analytics-api): engagement, adoption, cost, and usage reports; [Usage and Cost Analytics API](https://platform.claude.com/docs/en/manage-claude/usage-cost-analytics-api): token usage and cost reports | `read:analytics` |
77| [Compliance API Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed): organization-wide activity events | `read:compliance_activities` |
78| [Compliance API chat, file, and project endpoints](https://platform.claude.com/docs/en/manage-claude/compliance-content-data) and [Compliance API session endpoints](https://platform.claude.com/docs/en/manage-claude/compliance-sessions): read chats, files, projects, session transcripts, and [organization users](https://platform.claude.com/docs/en/manage-claude/compliance-org-data#list-organization-users) | `read:compliance_user_data` |
79| [Compliance API chat, file, and project endpoints](https://platform.claude.com/docs/en/manage-claude/compliance-content-data): delete chats, files, and projects | `delete:compliance_user_data` |
80| [Compliance API organization endpoints](https://platform.claude.com/docs/en/manage-claude/compliance-org-data): read organization metadata and effective settings; [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api): every `GET` endpoint, including file downloads | `read:compliance_org_data` |
81| Admin API [user management](https://platform.claude.com/docs/en/manage-claude/user-management) read endpoints, every Compliance API read endpoint, and every [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api) `GET` endpoint, including file downloads, with a single read-only scope (for security-audit integrations; does not include the Spend Limits or Analytics APIs) | `read:org_audit` |
64| To call... | Select these scopes |
65| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------- |
66| Admin API [user management](https://platform.claude.com/docs/en/manage-claude/user-management): list and look up members and invites; read custom roles and their permissions | `read:members` |
67| Admin API [user management](https://platform.claude.com/docs/en/manage-claude/user-management): change member roles, remove members, [sign members out everywhere](https://platform.claude.com/docs/en/manage-claude/user-management#sign-a-member-out-everywhere) (beta), and create and withdraw invites (to assign the `managed` role on a role change or an invite, also select `write:rbac_groups`) | `write:members` |
68| Admin API [user management](https://platform.claude.com/docs/en/manage-claude/user-management): read groups and their members | `read:rbac_groups` |
69| Admin API [user management](https://platform.claude.com/docs/en/manage-claude/user-management): create, rename, and delete groups; add and remove group members; with `write:members`, assign the `managed` role (on an invite or a role change) or assign groups on an invite | `write:rbac_groups` |
70| [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api): read plugins, versions, installation settings, shares, and marketplaces; download plugin files, including the files of members’ personal plugins; validate a marketplace before you connect it | `read:plugins` |
71| [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api): upload plugins and versions; choose which version members are served; delete plugins, including members’ personal plugins; set and remove installation settings; set a marketplace’s default installation setting; validate a marketplace before you connect it (to read plugins, also select `read:plugins`) | `write:plugins` |
72| [Claude Tag API](https://platform.claude.com/docs/en/manage-claude/claude-tag-api): read Claude Tag’s settings on Slack channels and Slack workspaces; list Access bundles and where they are attached (no other scope grants access to the Claude Tag API) | `read:claude_tag` |
73| [Claude Tag API](https://platform.claude.com/docs/en/manage-claude/claude-tag-api): set up and remove channels; change settings; attach and detach Access bundles (to read as well, also select `read:claude_tag`) | `write:claude_tag` |
74| [Spend Limits API](https://platform.claude.com/docs/en/manage-claude/spend-limits-api): read members’ effective spend limits and increase requests | `read:spend_limits` |
75| [Spend Limits API](https://platform.claude.com/docs/en/manage-claude/spend-limits-api): set or clear per-user spend limits; approve or deny increase requests | `write:spend_limits` |
76| [Claude Enterprise Analytics API](https://platform.claude.com/docs/en/manage-claude/analytics-api): engagement, adoption, cost, and usage reports; [Usage and Cost Analytics API](https://platform.claude.com/docs/en/manage-claude/usage-cost-analytics-api): token usage and cost reports | `read:analytics` |
77| [Compliance API Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed): organization-wide activity events | `read:compliance_activities` |
78| [Compliance API chat, file, and project endpoints](https://platform.claude.com/docs/en/manage-claude/compliance-content-data) and [Compliance API session endpoints](https://platform.claude.com/docs/en/manage-claude/compliance-sessions): read chats, files, projects, session transcripts, and [organization users](https://platform.claude.com/docs/en/manage-claude/compliance-org-data#list-organization-users); together with `read:compliance_org_data`, also who made a [Security posture attestation](https://platform.claude.com/docs/en/manage-claude/compliance-security-posture/results-reference#who-attested-and-comments), where the endpoint returns it: a user ID | `read:compliance_user_data` |
79| [Compliance API chat, file, and project endpoints](https://platform.claude.com/docs/en/manage-claude/compliance-content-data): delete chats, files, and projects | `delete:compliance_user_data` |
80| [Compliance API organization endpoints](https://platform.claude.com/docs/en/manage-claude/compliance-org-data): read organization metadata and effective settings, and an organization’s [Security posture](https://platform.claude.com/docs/en/manage-claude/compliance-security-posture/results-reference); [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api): every `GET` endpoint, including file downloads | `read:compliance_org_data` |
81| Admin API [user management](https://platform.claude.com/docs/en/manage-claude/user-management) read endpoints, every Compliance API read endpoint, and every [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api) `GET` endpoint, including file downloads, with a single read-only scope (for security-audit integrations; does not include the Spend Limits or Analytics APIs) | `read:org_audit` |
8282
8383The Compliance and Analytics APIs must be enabled for your organization before keys with those scopes can be used. See [Set up the Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api-access#set-up-the-compliance-api) and [Get access to the Claude Enterprise Analytics API](https://platform.claude.com/docs/en/manage-claude/analytics-api#get-access-to-the-claude-enterprise-analytics-api).
8484
No line in this hunk matches that.