The whole hunk
from line 19, old and new numbered
/
lines
This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.
from line 19
1919
2020#### Query parameters
2121
22- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 492 more`
22- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 499 more`
2323
2424 Filter activities by type. See the response `data` schema for the additional fields each type returns. Cannot be combined with `exclude_activity_types[]`.
2525
from line 91
9191
9292 A Claude Code agent was deleted.
9393
94 - `"ccr_agent_proxy_anthropic_oidc_token_exchanged"`
95
96 The Claude Code agent proxy exchanged a minted identity token for short-lived credentials in the organization's own cloud. Recorded for exchange targets only (such as "aws" and "gcp"; the "direct" target has no exchange step). One event is recorded per exchange call; a request served from the proxy's exchanged-credential cache does not exchange again and is not recorded here. Per-request detail for traffic the credentials were injected into is available in the agent proxy network events.
97
98 - `"ccr_agent_proxy_anthropic_oidc_token_minted"`
99
100 The Claude Code agent proxy minted a short-lived identity token for an anthropic_oidc credential. One event is recorded per fresh token issuance; a request served from the proxy's short-lived token cache does not mint a new token and is not recorded here. Per-request detail for traffic the credential was injected into is available in the agent proxy network events.
101
94102 - `"ccr_agent_proxy_credential_created"`
95103
96104 A Claude Code agent proxy credential was created. Credentials hold the secrets the agent proxy injects into requests Claude Code sessions send to approved external services; each credential belongs to an agent proxy profile. Audit events carry only credential names and settings, never the secret material itself.
from line 247
239247
240248 A user duplicated an artifact they could view into a new artifact that they own. The actor is the user who created the copy; the source artifact is not modified.
241249
250 - `"claude_artifact_external_sharing_permission_updated"`
251
252 An organization admin allowed one artifact to be shared outside the organization by link while the organization-wide external sharing setting was off, or revoked that permission.
253
242254 - `"claude_artifact_published"`
243255
244256 A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded on every save, including saves of private artifacts, and changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
from line 395
383395
384396 A recurring scan schedule was set or replaced for a Claude Code Security project.
385397
398 - `"claude_code_security_vulnerability_deleted"`
399
400 A Claude Code Security vulnerability finding was permanently deleted.
401
386402 - `"claude_code_security_vulnerability_fix_session_created"`
387403
388404 A Claude Code remediation session was created for a Claude Code Security vulnerability finding.
from line 1539
15231539
15241540 An OIDC federation issuer was archived.
15251541
1542 - `"platform_federation_issuer_created"`
1543
1544 An OIDC federation issuer was created, registering an external identity provider that federation rules can trust for workload authentication.
1545
15261546 - `"platform_federation_issuer_updated"`
15271547
15281548 An OIDC federation issuer was updated.
from line 1551
15311551
15321552 An OIDC federation rule was archived.
15331553
1554 - `"platform_federation_rule_created"`
1555
1556 An OIDC federation rule was created, allowing tokens from a federation issuer to authenticate as a service account or user. Rules may additionally match on token claims or a condition expression, which are not included in this event.
1557
15341558 - `"platform_federation_rule_updated"`
15351559
15361560 An OIDC federation rule was updated.
from line 1639
16151639
16161640 A service account was archived.
16171641
1642 - `"platform_service_account_created"`
1643
1644 A service account was created.
1645
16181646 - `"platform_service_account_updated"`
16191647
16201648 A service account was updated.
from line 2086
20582086
20592087 format: date-time
20602088
2061- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 492 more`
2089- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 499 more`
20622090
20632091 Exclude activities of these types. Cannot be combined with `activity_types[]`.
20642092
from line 2158
21302158
21312159 A Claude Code agent was deleted.
21322160
2161 - `"ccr_agent_proxy_anthropic_oidc_token_exchanged"`
2162
2163 The Claude Code agent proxy exchanged a minted identity token for short-lived credentials in the organization's own cloud. Recorded for exchange targets only (such as "aws" and "gcp"; the "direct" target has no exchange step). One event is recorded per exchange call; a request served from the proxy's exchanged-credential cache does not exchange again and is not recorded here. Per-request detail for traffic the credentials were injected into is available in the agent proxy network events.
2164
2165 - `"ccr_agent_proxy_anthropic_oidc_token_minted"`
2166
2167 The Claude Code agent proxy minted a short-lived identity token for an anthropic_oidc credential. One event is recorded per fresh token issuance; a request served from the proxy's short-lived token cache does not mint a new token and is not recorded here. Per-request detail for traffic the credential was injected into is available in the agent proxy network events.
2168
21332169 - `"ccr_agent_proxy_credential_created"`
21342170
21352171 A Claude Code agent proxy credential was created. Credentials hold the secrets the agent proxy injects into requests Claude Code sessions send to approved external services; each credential belongs to an agent proxy profile. Audit events carry only credential names and settings, never the secret material itself.
from line 2314
22782314
22792315 A user duplicated an artifact they could view into a new artifact that they own. The actor is the user who created the copy; the source artifact is not modified.
22802316
2317 - `"claude_artifact_external_sharing_permission_updated"`
2318
2319 An organization admin allowed one artifact to be shared outside the organization by link while the organization-wide external sharing setting was off, or revoked that permission.
2320
22812321 - `"claude_artifact_published"`
22822322
22832323 A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded on every save, including saves of private artifacts, and changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
from line 2462
24222462
24232463 A recurring scan schedule was set or replaced for a Claude Code Security project.
24242464
2465 - `"claude_code_security_vulnerability_deleted"`
2466
2467 A Claude Code Security vulnerability finding was permanently deleted.
2468
24252469 - `"claude_code_security_vulnerability_fix_session_created"`
24262470
24272471 A Claude Code remediation session was created for a Claude Code Security vulnerability finding.
from line 3606
35623606
35633607 An OIDC federation issuer was archived.
35643608
3609 - `"platform_federation_issuer_created"`
3610
3611 An OIDC federation issuer was created, registering an external identity provider that federation rules can trust for workload authentication.
3612
35653613 - `"platform_federation_issuer_updated"`
35663614
35673615 An OIDC federation issuer was updated.
from line 3618
35703618
35713619 An OIDC federation rule was archived.
35723620
3621 - `"platform_federation_rule_created"`
3622
3623 An OIDC federation rule was created, allowing tokens from a federation issuer to authenticate as a service account or user. Rules may additionally match on token claims or a condition expression, which are not included in this event.
3624
35733625 - `"platform_federation_rule_updated"`
35743626
35753627 An OIDC federation rule was updated.
from line 3706
36543706
36553707 A service account was archived.
36563708
3709 - `"platform_service_account_created"`
3710
3711 A service account was created.
3712
36573713 - `"platform_service_account_updated"`
36583714
36593715 A service account was updated.
from line 4145
40894145
40904146#### Returns
40914147
4092- `data: optional array of AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 492 more`
4148- `data: optional array of AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 499 more`
40934149
40944150 List of activity records. Each element's `type` field identifies which activity it is and which additional fields are present.
40954151
from line 8501
84458501
84468502 - `description: optional string or null`
84478503
8448 Optional gallery-card description supplied at publish time. Same provenance as title (caller-authored, reader-visible).
8504 No longer populated: the gallery-card description supplied at publish time is intentionally omitted from this feed.
84498505
84508506 - `is_redeploy: optional boolean or null`
84518507
from line 9920
98649920
98659921 Asserting party: the AWS account the organization is bound to.
98669922
9867 - `type: optional "aws"`
9868
9869 default: aws
9870
9871 - `account_id: string`
9872
9873 - `signed_principal: string`
9874
9875 The AWS-signed ARN of the IAM principal that requested the token.
9876
9877 - `FederatedActorAzureProvider object`
9878
9879 Asserting party: the Azure subscription the organization is bound to.
9880
9881 - `type: optional "azure"`
9882
9883 default: azure
9884
9885 - `subscription_id: string`
9886
9887 - `FederatedActorGcpProvider object`
9888
9889 Asserting party: the GCP project the organization is bound to.
9890
9891 - `type: optional "gcp"`
9892
9893 default: gcp
9894
9895 - `project_number: string`
9896
9897 - `FederatedActorOidcProvider object`
9898
9899 Asserting party: a customer-registered OIDC federation issuer.
9900
9901 - `type: optional "oidc"`
9902
9903 default: oidc
9904
9905 - `issuer: optional string or null`
9906
9907 The federation issuer's URL. Null when the presented credential failed verification.
9908
9909 - `ip_address: optional string or null`
9910
9911 - `subject: optional string or null`
9912
9913 The provider's verified identifier for the caller; its form depends on the provider.
9914
9915 - `user_agent: optional string or null`
9916
9917 - `AttestedDeviceActor object`
9918
9919 An attested mobile device authenticated via Apple App Attest.
9920
9921 - `type: optional "attested_device_actor"`
9922
9923 default: attested_device_actor
9924
9925 - `external_client_id: string`
9926
9927 - `kid_hash: string`
9928
9929 - `ip_address: optional string or null`
9930
9931 - `user_agent: optional string or null`
9932
9933 - `agent_id: string`
9934
9935 The agent that was created, e.g. "cagt_01HX...".
9936
9937 - `default_source_urls_truncated: boolean`
9938
9939 Whether default_source_urls was capped and omits some of the granted repositories.
9940
9941 - `display_name: string`
9942
9943 The agent's display name at creation time.
9944
9945 - `omitted_source_url_count: number`
9946
9947 Number of default repository entries that could not be safely rendered as a credential-free URL and were omitted from default_source_urls. A non-zero value with an empty list means repositories were granted but could not be displayed — not that all repositories were removed.
9948
9949 - `slug: string`
9950
9951 The agent's URL-safe identifier, unique within the organization.
9952
9953 - `id: optional string`
9954
9955 Unique identifier for the activity e.g. 'activity_abcd1234'
9956
9957 - `created_at: optional string`
9958
9959 When this activity occurred.
9960
9961 format: date-time
9962
9963 - `default_source_urls: optional array of string`
9964
9965 The repository URLs the agent works on by default, reduced to scheme, host, and path — credentials and query parameters are never included. Empty with a zero omitted_source_url_count means the agent was created without any default repositories; empty with a non-zero count means repositories were granted but could not be safely rendered. At most 100 entries are included; default_source_urls_truncated indicates when more were granted.
9966
9967 - `guest_policy: optional string or null`
9968
9969 Whether the agent responds in Slack channels that include guest users, and in Slack Connect channels shared with other organizations: "allow", "restrict", or "channel" (the agent responds, using only that channel's own content and configuration). In Slack Connect channels "allow" gives at most "channel" access. Omitted when the agent inherits the default policy.
9970
9971 - `organization_id: optional string or null`
9972
9973 Organization ID this activity is associated with
9974
9975 - `organization_uuid: optional string or null`
9976
9977 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
9978
9979 - `sla
9923 - `type: optional "aws