The whole hunk
from line 17, old and new numbered
/
lines
This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.
from line 17
1717
1818### Query parameters
1919
20- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 492 more`
20- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 499 more`
2121
2222 Filter activities by type. See the response `data` schema for the additional fields each type returns. Cannot be combined with `exclude_activity_types[]`.
2323
from line 89
8989
9090 A Claude Code agent was deleted.
9191
92 - `"ccr_agent_proxy_anthropic_oidc_token_exchanged"`
93
94 The Claude Code agent proxy exchanged a minted identity token for short-lived credentials in the organization's own cloud. Recorded for exchange targets only (such as "aws" and "gcp"; the "direct" target has no exchange step). One event is recorded per exchange call; a request served from the proxy's exchanged-credential cache does not exchange again and is not recorded here. Per-request detail for traffic the credentials were injected into is available in the agent proxy network events.
95
96 - `"ccr_agent_proxy_anthropic_oidc_token_minted"`
97
98 The Claude Code agent proxy minted a short-lived identity token for an anthropic_oidc credential. One event is recorded per fresh token issuance; a request served from the proxy's short-lived token cache does not mint a new token and is not recorded here. Per-request detail for traffic the credential was injected into is available in the agent proxy network events.
99
92100 - `"ccr_agent_proxy_credential_created"`
93101
94102 A Claude Code agent proxy credential was created. Credentials hold the secrets the agent proxy injects into requests Claude Code sessions send to approved external services; each credential belongs to an agent proxy profile. Audit events carry only credential names and settings, never the secret material itself.
from line 245
237245
238246 A user duplicated an artifact they could view into a new artifact that they own. The actor is the user who created the copy; the source artifact is not modified.
239247
248 - `"claude_artifact_external_sharing_permission_updated"`
249
250 An organization admin allowed one artifact to be shared outside the organization by link while the organization-wide external sharing setting was off, or revoked that permission.
251
240252 - `"claude_artifact_published"`
241253
242254 A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded on every save, including saves of private artifacts, and changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
from line 393
381393
382394 A recurring scan schedule was set or replaced for a Claude Code Security project.
383395
396 - `"claude_code_security_vulnerability_deleted"`
397
398 A Claude Code Security vulnerability finding was permanently deleted.
399
384400 - `"claude_code_security_vulnerability_fix_session_created"`
385401
386402 A Claude Code remediation session was created for a Claude Code Security vulnerability finding.
from line 1537
15211537
15221538 An OIDC federation issuer was archived.
15231539
1540 - `"platform_federation_issuer_created"`
1541
1542 An OIDC federation issuer was created, registering an external identity provider that federation rules can trust for workload authentication.
1543
15241544 - `"platform_federation_issuer_updated"`
15251545
15261546 An OIDC federation issuer was updated.
from line 1549
15291549
15301550 An OIDC federation rule was archived.
15311551
1552 - `"platform_federation_rule_created"`
1553
1554 An OIDC federation rule was created, allowing tokens from a federation issuer to authenticate as a service account or user. Rules may additionally match on token claims or a condition expression, which are not included in this event.
1555
15321556 - `"platform_federation_rule_updated"`
15331557
15341558 An OIDC federation rule was updated.
from line 1637
16131637
16141638 A service account was archived.
16151639
1640 - `"platform_service_account_created"`
1641
1642 A service account was created.
1643
16161644 - `"platform_service_account_updated"`
16171645
16181646 A service account was updated.
from line 2084
20562084
20572085 format: date-time
20582086
2059- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 492 more`
2087- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 499 more`
20602088
20612089 Exclude activities of these types. Cannot be combined with `activity_types[]`.
20622090
from line 2156
21282156
21292157 A Claude Code agent was deleted.
21302158
2159 - `"ccr_agent_proxy_anthropic_oidc_token_exchanged"`
2160
2161 The Claude Code agent proxy exchanged a minted identity token for short-lived credentials in the organization's own cloud. Recorded for exchange targets only (such as "aws" and "gcp"; the "direct" target has no exchange step). One event is recorded per exchange call; a request served from the proxy's exchanged-credential cache does not exchange again and is not recorded here. Per-request detail for traffic the credentials were injected into is available in the agent proxy network events.
2162
2163 - `"ccr_agent_proxy_anthropic_oidc_token_minted"`
2164
2165 The Claude Code agent proxy minted a short-lived identity token for an anthropic_oidc credential. One event is recorded per fresh token issuance; a request served from the proxy's short-lived token cache does not mint a new token and is not recorded here. Per-request detail for traffic the credential was injected into is available in the agent proxy network events.
2166
21312167 - `"ccr_agent_proxy_credential_created"`
21322168
21332169 A Claude Code agent proxy credential was created. Credentials hold the secrets the agent proxy injects into requests Claude Code sessions send to approved external services; each credential belongs to an agent proxy profile. Audit events carry only credential names and settings, never the secret material itself.
from line 2312
22762312
22772313 A user duplicated an artifact they could view into a new artifact that they own. The actor is the user who created the copy; the source artifact is not modified.
22782314
2315 - `"claude_artifact_external_sharing_permission_updated"`
2316
2317 An organization admin allowed one artifact to be shared outside the organization by link while the organization-wide external sharing setting was off, or revoked that permission.
2318
22792319 - `"claude_artifact_published"`
22802320
22812321 A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded on every save, including saves of private artifacts, and changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
from line 2460
24202460
24212461 A recurring scan schedule was set or replaced for a Claude Code Security project.
24222462
2463 - `"claude_code_security_vulnerability_deleted"`
2464
2465 A Claude Code Security vulnerability finding was permanently deleted.
2466
24232467 - `"claude_code_security_vulnerability_fix_session_created"`
24242468
24252469 A Claude Code remediation session was created for a Claude Code Security vulnerability finding.
from line 3604
35603604
35613605 An OIDC federation issuer was archived.
35623606
3607 - `"platform_federation_issuer_created"`
3608
3609 An OIDC federation issuer was created, registering an external identity provider that federation rules can trust for workload authentication.
3610
35633611 - `"platform_federation_issuer_updated"`
35643612
35653613 An OIDC federation issuer was updated.
from line 3616
35683616
35693617 An OIDC federation rule was archived.
35703618
3619 - `"platform_federation_rule_created"`
3620
3621 An OIDC federation rule was created, allowing tokens from a federation issuer to authenticate as a service account or user. Rules may additionally match on token claims or a condition expression, which are not included in this event.
3622
35713623 - `"platform_federation_rule_updated"`
35723624
35733625 An OIDC federation rule was updated.
from line 3704
36523704
36533705 A service account was archived.
36543706
3707 - `"platform_service_account_created"`
3708
3709 A service account was created.
3710
36553711 - `"platform_service_account_updated"`
36563712
36573713 A service account was updated.
from line 4143
40874143
40884144### Returns
40894145
4090- `data: optional array of AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 492 more`
4146- `data: optional array of AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 499 more`
40914147
40924148 List of activity records. Each element's `type` field identifies which activity it is and which additional fields are present.
40934149
from line 8499
84438499
84448500 - `description: optional string or null`
84458501
8446 Optional gallery-card description supplied at publish time. Same provenance as title (caller-authored, reader-visible).
8502 No longer populated: the gallery-card description supplied at publish time is intentionally omitted from this feed.
84478503
84488504 - `is_redeploy: optional boolean or null`
84498505
from line 9922
98669922
98679923 default: aws
98689924
9869 - `account_id: string`
9870
9871 - `signed_principal: string`
9872
9873 The AWS-signed ARN of the IAM principal that requested the token.
9874
9875 - `FederatedActorAzureProvider object`
9876
9877 Asserting party: the Azure subscription the organization is bound to.
9878
9879 - `type: optional "azure"`
9880
9881 default: azure
9882
9883 - `subscription_id: string`
9884
9885 - `FederatedActorGcpProvider object`
9886
9887 Asserting party: the GCP project the organization is bound to.
9888
9889 - `type: optional "gcp"`
9890
9891 default: gcp
9892
9893 - `project_number: string`
9894
9895 - `FederatedActorOidcProvider object`
9896
9897 Asserting party: a customer-registered OIDC federation issuer.
9898
9899 - `type: optional "oidc"`
9900
9901 default: oidc
9902
9903 - `issuer: optional string or null`
9904
9905 The federation issuer's URL. Null when the presented credential failed verification.
9906
9907 - `ip_address: optional string or null`
9908
9909 - `subject: optional string or null`
9910
9911 The provider's verified identifier for the caller; its form depends on the provider.
9912
9913 - `user_agent: optional string or null`
9914
9915 - `AttestedDeviceActor object`
9916
9917 An attested mobile device authenticated via Apple App Attest.
9918
9919 - `type: optional "attested_device_actor"`
9920
9921 default: attested_device_actor
9922
9923 - `external_client_id: string`
9924
9925 - `kid_hash: string`
9926
9927 - `ip_address: optional string or null`
9928
9929 - `user_agent: optional string or null`
9930
9931 - `agent_id: string`
9932
9933 The agent that was created, e.g. "cagt_01HX...".
9934
9935 - `default_source_urls_truncated: boolean`
9936
9937 Whether default_source_urls was capped and omits some of the granted repositories.
9938
9939 - `display_name: string`
9940
9941 The agent's display name at creation time.
9942
9943 - `omitted_source_url_count: number`
9944
9945 Number of default repository entries that could not be safely rendered as a credential-free URL and were omitted from default_source_urls. A non-zero value with an empty list means repositories were granted but could not be displayed — not that all repositories were removed.
9946
9947 - `slug: string`
9948
9949 The agent's URL-safe identifier, unique within the organization.
9950
9951 - `id: optional string`
9952
9953 Unique identifier for the activity e.g. 'activity_abcd1234'
9954
9955 - `created_at: optional string`
9956
9957 When this activity occurred.
9958
9959 format: date-time
9960
9961 - `default_source_urls: optional array of string`
9962
9963 The repository URLs the agent works on by default, reduced to scheme, host, and path — credentials and query parameters are never included. Empty with a zero omitted_source_url_count means the agent was created without any default repositories; empty with a non-zero count means repositories were granted but could not be safely rendered. At most 100 entries are included; default_source_urls_truncated indicates when more were granted.
9964
9965 - `guest_policy: optional string or null`
9966
9967 Whether the agent responds in Slack channels that include guest users, and in Slack Connect channels shared with other organizations: "allow", "restrict", or "channel" (the agent responds, using only that channel's own content and configuration). In Slack Connect channels "allow" gives at most "channel" access. Omitted when the agent inherits the default policy.
9968
9969 - `organization_id: optional string or null`
9970
9971 Organization ID this activity is associated with
9972
9973 - `organization_uuid: optional string or null`
9974
9975 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
9976
9977 - `slack_alias: optional string or null`
9978
9925