The whole hunk
from line 15, old and new numbered
/
lines
This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.
from line 15
1515
1616## Query parameters
1717
18- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 492 more`
18- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 499 more`
1919
2020 Filter activities by type. See the response `data` schema for the additional fields each type returns. Cannot be combined with `exclude_activity_types[]`.
2121
from line 87
8787
8888 A Claude Code agent was deleted.
8989
90 - `"ccr_agent_proxy_anthropic_oidc_token_exchanged"`
91
92 The Claude Code agent proxy exchanged a minted identity token for short-lived credentials in the organization's own cloud. Recorded for exchange targets only (such as "aws" and "gcp"; the "direct" target has no exchange step). One event is recorded per exchange call; a request served from the proxy's exchanged-credential cache does not exchange again and is not recorded here. Per-request detail for traffic the credentials were injected into is available in the agent proxy network events.
93
94 - `"ccr_agent_proxy_anthropic_oidc_token_minted"`
95
96 The Claude Code agent proxy minted a short-lived identity token for an anthropic_oidc credential. One event is recorded per fresh token issuance; a request served from the proxy's short-lived token cache does not mint a new token and is not recorded here. Per-request detail for traffic the credential was injected into is available in the agent proxy network events.
97
9098 - `"ccr_agent_proxy_credential_created"`
9199
92100 A Claude Code agent proxy credential was created. Credentials hold the secrets the agent proxy injects into requests Claude Code sessions send to approved external services; each credential belongs to an agent proxy profile. Audit events carry only credential names and settings, never the secret material itself.
from line 243
235243
236244 A user duplicated an artifact they could view into a new artifact that they own. The actor is the user who created the copy; the source artifact is not modified.
237245
246 - `"claude_artifact_external_sharing_permission_updated"`
247
248 An organization admin allowed one artifact to be shared outside the organization by link while the organization-wide external sharing setting was off, or revoked that permission.
249
238250 - `"claude_artifact_published"`
239251
240252 A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded on every save, including saves of private artifacts, and changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
from line 391
379391
380392 A recurring scan schedule was set or replaced for a Claude Code Security project.
381393
394 - `"claude_code_security_vulnerability_deleted"`
395
396 A Claude Code Security vulnerability finding was permanently deleted.
397
382398 - `"claude_code_security_vulnerability_fix_session_created"`
383399
384400 A Claude Code remediation session was created for a Claude Code Security vulnerability finding.
from line 1535
15191535
15201536 An OIDC federation issuer was archived.
15211537
1538 - `"platform_federation_issuer_created"`
1539
1540 An OIDC federation issuer was created, registering an external identity provider that federation rules can trust for workload authentication.
1541
15221542 - `"platform_federation_issuer_updated"`
15231543
15241544 An OIDC federation issuer was updated.
from line 1547
15271547
15281548 An OIDC federation rule was archived.
15291549
1550 - `"platform_federation_rule_created"`
1551
1552 An OIDC federation rule was created, allowing tokens from a federation issuer to authenticate as a service account or user. Rules may additionally match on token claims or a condition expression, which are not included in this event.
1553
15301554 - `"platform_federation_rule_updated"`
15311555
15321556 An OIDC federation rule was updated.
from line 1635
16111635
16121636 A service account was archived.
16131637
1638 - `"platform_service_account_created"`
1639
1640 A service account was created.
1641
16141642 - `"platform_service_account_updated"`
16151643
16161644 A service account was updated.
from line 2082
20542082
20552083 format: date-time
20562084
2057- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 492 more`
2085- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 499 more`
20582086
20592087 Exclude activities of these types. Cannot be combined with `activity_types[]`.
20602088
from line 2154
21262154
21272155 A Claude Code agent was deleted.
21282156
2157 - `"ccr_agent_proxy_anthropic_oidc_token_exchanged"`
2158
2159 The Claude Code agent proxy exchanged a minted identity token for short-lived credentials in the organization's own cloud. Recorded for exchange targets only (such as "aws" and "gcp"; the "direct" target has no exchange step). One event is recorded per exchange call; a request served from the proxy's exchanged-credential cache does not exchange again and is not recorded here. Per-request detail for traffic the credentials were injected into is available in the agent proxy network events.
2160
2161 - `"ccr_agent_proxy_anthropic_oidc_token_minted"`
2162
2163 The Claude Code agent proxy minted a short-lived identity token for an anthropic_oidc credential. One event is recorded per fresh token issuance; a request served from the proxy's short-lived token cache does not mint a new token and is not recorded here. Per-request detail for traffic the credential was injected into is available in the agent proxy network events.
2164
21292165 - `"ccr_agent_proxy_credential_created"`
21302166
21312167 A Claude Code agent proxy credential was created. Credentials hold the secrets the agent proxy injects into requests Claude Code sessions send to approved external services; each credential belongs to an agent proxy profile. Audit events carry only credential names and settings, never the secret material itself.
from line 2310
22742310
22752311 A user duplicated an artifact they could view into a new artifact that they own. The actor is the user who created the copy; the source artifact is not modified.
22762312
2313 - `"claude_artifact_external_sharing_permission_updated"`
2314
2315 An organization admin allowed one artifact to be shared outside the organization by link while the organization-wide external sharing setting was off, or revoked that permission.
2316
22772317 - `"claude_artifact_published"`
22782318
22792319 A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded on every save, including saves of private artifacts, and changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
from line 2458
24182458
24192459 A recurring scan schedule was set or replaced for a Claude Code Security project.
24202460
2461 - `"claude_code_security_vulnerability_deleted"`
2462
2463 A Claude Code Security vulnerability finding was permanently deleted.
2464
24212465 - `"claude_code_security_vulnerability_fix_session_created"`
24222466
24232467 A Claude Code remediation session was created for a Claude Code Security vulnerability finding.
from line 3602
35583602
35593603 An OIDC federation issuer was archived.
35603604
3605 - `"platform_federation_issuer_created"`
3606
3607 An OIDC federation issuer was created, registering an external identity provider that federation rules can trust for workload authentication.
3608
35613609 - `"platform_federation_issuer_updated"`
35623610
35633611 An OIDC federation issuer was updated.
from line 3614
35663614
35673615 An OIDC federation rule was archived.
35683616
3617 - `"platform_federation_rule_created"`
3618
3619 An OIDC federation rule was created, allowing tokens from a federation issuer to authenticate as a service account or user. Rules may additionally match on token claims or a condition expression, which are not included in this event.
3620
35693621 - `"platform_federation_rule_updated"`
35703622
35713623 An OIDC federation rule was updated.
from line 3702
36503702
36513703 A service account was archived.
36523704
3705 - `"platform_service_account_created"`
3706
3707 A service account was created.
3708
36533709 - `"platform_service_account_updated"`
36543710
36553711 A service account was updated.
from line 4141
40854141
40864142## Returns
40874143
4088- `data: optional array of AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 492 more`
4144- `data: optional array of AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 499 more`
40894145
40904146 List of activity records. Each element's `type` field identifies which activity it is and which additional fields are present.
40914147
from line 8497
84418497
84428498 - `description: optional string or null`
84438499
8444 Optional gallery-card description supplied at publish time. Same provenance as title (caller-authored, reader-visible).
8500 No longer populated: the gallery-card description supplied at publish time is intentionally omitted from this feed.
84458501
84468502 - `is_redeploy: optional boolean or null`
84478503
from line 9920
98649920
98659921 default: aws
98669922
9867 - `account_id: string`
9868
9869 - `signed_principal: string`
9870
9871 The AWS-signed ARN of the IAM principal that requested the token.
9872
9873 - `FederatedActorAzureProvider object`
9874
9875 Asserting party: the Azure subscription the organization is bound to.
9876
9877 - `type: optional "azure"`
9878
9879 default: azure
9880
9881 - `subscription_id: string`
9882
9883 - `FederatedActorGcpProvider object`
9884
9885 Asserting party: the GCP project the organization is bound to.
9886
9887 - `type: optional "gcp"`
9888
9889 default: gcp
9890
9891 - `project_number: string`
9892
9893 - `FederatedActorOidcProvider object`
9894
9895 Asserting party: a customer-registered OIDC federation issuer.
9896
9897 - `type: optional "oidc"`
9898
9899 default: oidc
9900
9901 - `issuer: optional string or null`
9902
9903 The federation issuer's URL. Null when the presented credential failed verification.
9904
9905 - `ip_address: optional string or null`
9906
9907 - `subject: optional string or null`
9908
9909 The provider's verified identifier for the caller; its form depends on the provider.
9910
9911 - `user_agent: optional string or null`
9912
9913 - `AttestedDeviceActor object`
9914
9915 An attested mobile device authenticated via Apple App Attest.
9916
9917 - `type: optional "attested_device_actor"`
9918
9919 default: attested_device_actor
9920
9921 - `external_client_id: string`
9922
9923 - `kid_hash: string`
9924
9925 - `ip_address: optional string or null`
9926
9927 - `user_agent: optional string or null`
9928
9929 - `agent_id: string`
9930
9931 The agent that was created, e.g. "cagt_01HX...".
9932
9933 - `default_source_urls_truncated: boolean`
9934
9935 Whether default_source_urls was capped and omits some of the granted repositories.
9936
9937 - `display_name: string`
9938
9939 The agent's display name at creation time.
9940
9941 - `omitted_source_url_count: number`
9942
9943 Number of default repository entries that could not be safely rendered as a credential-free URL and were omitted from default_source_urls. A non-zero value with an empty list means repositories were granted but could not be displayed — not that all repositories were removed.
9944
9945 - `slug: string`
9946
9947 The agent's URL-safe identifier, unique within the organization.
9948
9949 - `id: optional string`
9950
9951 Unique identifier for the activity e.g. 'activity_abcd1234'
9952
9953 - `created_at: optional string`
9954
9955 When this activity occurred.
9956
9957 format: date-time
9958
9959 - `default_source_urls: optional array of string`
9960
9961 The repository URLs the agent works on by default, reduced to scheme, host, and path — credentials and query parameters are never included. Empty with a zero omitted_source_url_count means the agent was created without any default repositories; empty with a non-zero count means repositories were granted but could not be safely rendered. At most 100 entries are included; default_source_urls_truncated indicates when more were granted.
9962
9963 - `guest_policy: optional string or null`
9964
9965 Whether the agent responds in Slack channels that include guest users, and in Slack Connect channels shared with other organizations: "allow", "restrict", or "channel" (the agent responds, using only that channel's own content and configuration). In Slack Connect channels "allow" gives at most "channel" access. Omitted when the agent inherits the default policy.
9966
9967 - `organization_id: optional string or null`
9968
9969 Organization ID this activity is associated with
9970
9971 - `organization_uuid: optional string or null`
9972
9973 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
9974
9975 - `slack_alias: optional string or nu