The whole hunk
from line 2, old and new numbered
/
lines
from line 2
22
33> Stream your organization's audit events into a SIEM or log management system.
44
5> **Who this is for:** Organization owners and the security or compliance teams who connect Claude for Government to their agency's log management or SIEM platform.
5> **Who this is for:** Organization owners, tenant administrators, and the security or compliance teams who connect Claude for Government to their agency's log management or SIEM platform.
66
77The Compliance API is a read-only HTTP endpoint that lets your security tools pull a continuous feed of audit events covering administrative activity across your organization, such as sign-ins, role changes, key creations, and seat assignments. A scheduled job can poll the endpoint and forward each event to a SIEM such as Splunk or Microsoft Sentinel.
88
from line 10
1010
1111## Managing API keys
1212
13Open **Compliance API** in the organization admin portal to create and manage keys. The page lists every key that has been issued for your organization, showing its name, a hint with the last few characters of the key so you can tell them apart, when it was created, and whether it is active or revoked.
13To create and manage keys for your organization, open **Compliance API** under **Settings** in the organization admin portal. To create and manage keys that return events for every organization in your tenant, open **Compliance API keys** under **Settings** in the [tenant admin portal](/docs/government/tenant-admin/overview). Only tenant administrators can open the tenant admin portal.
1414
15Both pages list only their own keys, showing each key's name, a hint with the last few characters of the key so you can tell keys apart, when the key was created, and whether it is active or revoked.
16
1517To create a key, enter a name and click **Create key**. The full value is shown once, immediately after creation. Copy it somewhere safe before clicking **Done**.
1618
1719<Warning>
from line 22
2022
2123Keys never expire on their own, so rotate them on whatever schedule your agency's policy requires. You can keep more than one key active at a time, which lets you rotate without interrupting your SIEM feed: create a new key, update your collector to use it, confirm events are still arriving, and then revoke the old key. Revoking a key takes effect immediately, and the next request made with it returns a 401.
2224
23Each key is scoped to the organization it was created in. A request can only ever return events for that one organization, regardless of who holds the key.
25Each key is scoped to the organization or tenant it was created in. A key created in the organization admin portal returns events for that one organization only, regardless of who holds the key. A key that a tenant administrator creates in the tenant admin portal returns the events of every organization in the tenant, together with tenant-level activity such as changes to single sign-on, to the list of tenant administrators, and to tenant-wide settings.
2426
2527## Calling the API
2628
from line 126
124126* **Credentials** such as `api_key.created` and `api_key.revoked`.
125127* **Seats and tiers** such as `seat_allocation.set`, `seat_allocation.tier_assigned`, `seat_tier.created`, and `seat_tier.updated`.
126128* **Configuration** such as `org_config.capabilities_set`.
129* **Tenant** such as `tenant.sso_configured`, `tenant.admin_added`, and `tenant.config_set`. Only keys created in the tenant admin portal return these types.
127130
128131New types may be added over time, so a collector should forward unfamiliar types rather than reject them.
129132
from line 138
135138
136139## When the API is disabled
137140
138Your tenant administrator can turn off the **Compliance API** setting on the [tenant Config page](/docs/government/tenant-admin/configuration). When that setting is off, the Create key button is hidden in the portal, and every call to `/v1/compliance/activities` returns a 400 error, including calls made with keys that were valid before the setting changed.
141Your tenant administrator can turn off the **Compliance API** setting on the [tenant Config page](/docs/government/tenant-admin/configuration). When that setting is off, the **Create key** button is hidden in the organization and tenant admin portals, and every call to `/gateway-api/v1/compliance/activities` returns a 400 error, including calls made with keys that were valid before the setting changed.
139142
140Listing and revoking existing keys in the portal remains available even when the setting is off, so an exposed key can still be revoked.
143Listing and revoking existing keys in either portal remains available even when the setting is off, so an exposed key can still be revoked.
141144
142145## Things to know
143146
from line 148
145148* There is no separate Splunk add-on. The polling pattern described under [Connecting to your SIEM](#connecting-to-your-siem) is the reference implementation for a Splunk HTTP Event Collector job.
146149* The desktop application's OpenTelemetry export is a separate log stream configured with **Telemetry endpoint** on the [Config](/docs/government/config/settings#telemetry-endpoint) page. It carries per-session tool and telemetry events to a collector you specify, while this API carries administrative audit events. See [Telemetry and egress](/docs/third-party/claude-desktop/telemetry) for what the OpenTelemetry export includes.
147150* The Compliance API returns governance and audit events only. It does not return conversation content, files, or anything your users type into Claude.
148* Each organization can hold up to 50 active keys at once. Revoked keys do not count toward this limit.
151* Each organization can hold up to 50 active keys at once, and keys created in the tenant admin portal have a separate limit of 50 active keys. Revoked keys do not count toward either limit.
149152* Events are returned newest first within each page.
150153* `first_id` and `last_id` are opaque cursors. Pass them back exactly as received rather than constructing them yourself.
151154* If your network enforces a [tenant restriction](/docs/government/tenant-admin/tenant-restrictions), the same restriction applies to Compliance API requests.