Sweep 19 Sep 2026 · 02:36Z Build v2.1.278 500 read Stable v2.1.267 Latest v2.1.278 Next v2.1.280 Feeds RSS JSON llms.txt Unofficial
Reading a new release v2.1.280 First look · 1/6 0 findings $0.00 so far
One change · api

Query compliance activities changed

api/compliance/activities/list

Nearest release: v2.1.274, published 7 hours after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.

Recorded here
Lines+4,544added
Lines−2,638removed
From line 15 where the diff opens
First seen 14 Aug 2026 this site's first read of the page
Recorded edits12to this page, all time

The whole hunk

from line 15, old and new numbered
/
lines

This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.

from line 15
1515 
1616## Query parameters
1717 
18- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 492 more`
18- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 499 more`
1919 
2020 Filter activities by type. See the response `data` schema for the additional fields each type returns. Cannot be combined with `exclude_activity_types[]`.
2121 
from line 87
8787 
8888 A Claude Code agent was deleted.
8989 
90 - `"ccr_agent_proxy_anthropic_oidc_token_exchanged"`
91 
92 The Claude Code agent proxy exchanged a minted identity token for short-lived credentials in the organization's own cloud. Recorded for exchange targets only (such as "aws" and "gcp"; the "direct" target has no exchange step). One event is recorded per exchange call; a request served from the proxy's exchanged-credential cache does not exchange again and is not recorded here. Per-request detail for traffic the credentials were injected into is available in the agent proxy network events.
93 
94 - `"ccr_agent_proxy_anthropic_oidc_token_minted"`
95 
96 The Claude Code agent proxy minted a short-lived identity token for an anthropic_oidc credential. One event is recorded per fresh token issuance; a request served from the proxy's short-lived token cache does not mint a new token and is not recorded here. Per-request detail for traffic the credential was injected into is available in the agent proxy network events.
97 
9098 - `"ccr_agent_proxy_credential_created"`
9199 
92100 A Claude Code agent proxy credential was created. Credentials hold the secrets the agent proxy injects into requests Claude Code sessions send to approved external services; each credential belongs to an agent proxy profile. Audit events carry only credential names and settings, never the secret material itself.
from line 243
235243 
236244 A user duplicated an artifact they could view into a new artifact that they own. The actor is the user who created the copy; the source artifact is not modified.
237245 
246 - `"claude_artifact_external_sharing_permission_updated"`
247 
248 An organization admin allowed one artifact to be shared outside the organization by link while the organization-wide external sharing setting was off, or revoked that permission.
249 
238250 - `"claude_artifact_published"`
239251 
240252 A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded on every save, including saves of private artifacts, and changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
from line 391
379391 
380392 A recurring scan schedule was set or replaced for a Claude Code Security project.
381393 
394 - `"claude_code_security_vulnerability_deleted"`
395 
396 A Claude Code Security vulnerability finding was permanently deleted.
397 
382398 - `"claude_code_security_vulnerability_fix_session_created"`
383399 
384400 A Claude Code remediation session was created for a Claude Code Security vulnerability finding.
from line 1535
15191535 
15201536 An OIDC federation issuer was archived.
15211537 
1538 - `"platform_federation_issuer_created"`
1539 
1540 An OIDC federation issuer was created, registering an external identity provider that federation rules can trust for workload authentication.
1541 
15221542 - `"platform_federation_issuer_updated"`
15231543 
15241544 An OIDC federation issuer was updated.
from line 1547
15271547 
15281548 An OIDC federation rule was archived.
15291549 
1550 - `"platform_federation_rule_created"`
1551 
1552 An OIDC federation rule was created, allowing tokens from a federation issuer to authenticate as a service account or user. Rules may additionally match on token claims or a condition expression, which are not included in this event.
1553 
15301554 - `"platform_federation_rule_updated"`
15311555 
15321556 An OIDC federation rule was updated.
from line 1635
16111635 
16121636 A service account was archived.
16131637 
1638 - `"platform_service_account_created"`
1639 
1640 A service account was created.
1641 
16141642 - `"platform_service_account_updated"`
16151643 
16161644 A service account was updated.
from line 2082
20542082 
20552083 format: date-time
20562084 
2057- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 492 more`
2085- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 499 more`
20582086 
20592087 Exclude activities of these types. Cannot be combined with `activity_types[]`.
20602088 
from line 2154
21262154 
21272155 A Claude Code agent was deleted.
21282156 
2157 - `"ccr_agent_proxy_anthropic_oidc_token_exchanged"`
2158 
2159 The Claude Code agent proxy exchanged a minted identity token for short-lived credentials in the organization's own cloud. Recorded for exchange targets only (such as "aws" and "gcp"; the "direct" target has no exchange step). One event is recorded per exchange call; a request served from the proxy's exchanged-credential cache does not exchange again and is not recorded here. Per-request detail for traffic the credentials were injected into is available in the agent proxy network events.
2160 
2161 - `"ccr_agent_proxy_anthropic_oidc_token_minted"`
2162 
2163 The Claude Code agent proxy minted a short-lived identity token for an anthropic_oidc credential. One event is recorded per fresh token issuance; a request served from the proxy's short-lived token cache does not mint a new token and is not recorded here. Per-request detail for traffic the credential was injected into is available in the agent proxy network events.
2164 
21292165 - `"ccr_agent_proxy_credential_created"`
21302166 
21312167 A Claude Code agent proxy credential was created. Credentials hold the secrets the agent proxy injects into requests Claude Code sessions send to approved external services; each credential belongs to an agent proxy profile. Audit events carry only credential names and settings, never the secret material itself.
from line 2310
22742310 
22752311 A user duplicated an artifact they could view into a new artifact that they own. The actor is the user who created the copy; the source artifact is not modified.
22762312 
2313 - `"claude_artifact_external_sharing_permission_updated"`
2314 
2315 An organization admin allowed one artifact to be shared outside the organization by link while the organization-wide external sharing setting was off, or revoked that permission.
2316 
22772317 - `"claude_artifact_published"`
22782318 
22792319 A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded on every save, including saves of private artifacts, and changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
from line 2458
24182458 
24192459 A recurring scan schedule was set or replaced for a Claude Code Security project.
24202460 
2461 - `"claude_code_security_vulnerability_deleted"`
2462 
2463 A Claude Code Security vulnerability finding was permanently deleted.
2464 
24212465 - `"claude_code_security_vulnerability_fix_session_created"`
24222466 
24232467 A Claude Code remediation session was created for a Claude Code Security vulnerability finding.
from line 3602
35583602 
35593603 An OIDC federation issuer was archived.
35603604 
3605 - `"platform_federation_issuer_created"`
3606 
3607 An OIDC federation issuer was created, registering an external identity provider that federation rules can trust for workload authentication.
3608 
35613609 - `"platform_federation_issuer_updated"`
35623610 
35633611 An OIDC federation issuer was updated.
from line 3614
35663614 
35673615 An OIDC federation rule was archived.
35683616 
3617 - `"platform_federation_rule_created"`
3618 
3619 An OIDC federation rule was created, allowing tokens from a federation issuer to authenticate as a service account or user. Rules may additionally match on token claims or a condition expression, which are not included in this event.
3620 
35693621 - `"platform_federation_rule_updated"`
35703622 
35713623 An OIDC federation rule was updated.
from line 3702
36503702 
36513703 A service account was archived.
36523704 
3705 - `"platform_service_account_created"`
3706 
3707 A service account was created.
3708 
36533709 - `"platform_service_account_updated"`
36543710 
36553711 A service account was updated.
from line 4141
40854141 
40864142## Returns
40874143 
4088- `data: optional array of AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 492 more`
4144- `data: optional array of AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 499 more`
40894145 
40904146 List of activity records. Each element's `type` field identifies which activity it is and which additional fields are present.
40914147 
from line 8497
84418497 
84428498 - `description: optional string or null`
84438499 
8444 Optional gallery-card description supplied at publish time. Same provenance as title (caller-authored, reader-visible).
8500 No longer populated: the gallery-card description supplied at publish time is intentionally omitted from this feed.
84458501 
84468502 - `is_redeploy: optional boolean or null`
84478503 
from line 9920
98649920 
98659921 default: aws
98669922 
9867 - `account_id: string`
9868 
9869 - `signed_principal: string`
9870 
9871 The AWS-signed ARN of the IAM principal that requested the token.
9872 
9873 - `FederatedActorAzureProvider object`
9874 
9875 Asserting party: the Azure subscription the organization is bound to.
9876 
9877 - `type: optional "azure"`
9878 
9879 default: azure
9880 
9881 - `subscription_id: string`
9882 
9883 - `FederatedActorGcpProvider object`
9884 
9885 Asserting party: the GCP project the organization is bound to.
9886 
9887 - `type: optional "gcp"`
9888 
9889 default: gcp
9890 
9891 - `project_number: string`
9892 
9893 - `FederatedActorOidcProvider object`
9894 
9895 Asserting party: a customer-registered OIDC federation issuer.
9896 
9897 - `type: optional "oidc"`
9898 
9899 default: oidc
9900 
9901 - `issuer: optional string or null`
9902 
9903 The federation issuer's URL. Null when the presented credential failed verification.
9904 
9905 - `ip_address: optional string or null`
9906 
9907 - `subject: optional string or null`
9908 
9909 The provider's verified identifier for the caller; its form depends on the provider.
9910 
9911 - `user_agent: optional string or null`
9912 
9913 - `AttestedDeviceActor object`
9914 
9915 An attested mobile device authenticated via Apple App Attest.
9916 
9917 - `type: optional "attested_device_actor"`
9918 
9919 default: attested_device_actor
9920 
9921 - `external_client_id: string`
9922 
9923 - `kid_hash: string`
9924 
9925 - `ip_address: optional string or null`
9926 
9927 - `user_agent: optional string or null`
9928 
9929 - `agent_id: string`
9930 
9931 The agent that was created, e.g. "cagt_01HX...".
9932 
9933 - `default_source_urls_truncated: boolean`
9934 
9935 Whether default_source_urls was capped and omits some of the granted repositories.
9936 
9937 - `display_name: string`
9938 
9939 The agent's display name at creation time.
9940 
9941 - `omitted_source_url_count: number`
9942 
9943 Number of default repository entries that could not be safely rendered as a credential-free URL and were omitted from default_source_urls. A non-zero value with an empty list means repositories were granted but could not be displayed — not that all repositories were removed.
9944 
9945 - `slug: string`
9946 
9947 The agent's URL-safe identifier, unique within the organization.
9948 
9949 - `id: optional string`
9950 
9951 Unique identifier for the activity e.g. 'activity_abcd1234'
9952 
9953 - `created_at: optional string`
9954 
9955 When this activity occurred.
9956 
9957 format: date-time
9958 
9959 - `default_source_urls: optional array of string`
9960 
9961 The repository URLs the agent works on by default, reduced to scheme, host, and path — credentials and query parameters are never included. Empty with a zero omitted_source_url_count means the agent was created without any default repositories; empty with a non-zero count means repositories were granted but could not be safely rendered. At most 100 entries are included; default_source_urls_truncated indicates when more were granted.
9962 
9963 - `guest_policy: optional string or null`
9964 
9965 Whether the agent responds in Slack channels that include guest users, and in Slack Connect channels shared with other organizations: "allow", "restrict", or "channel" (the agent responds, using only that channel's own content and configuration). In Slack Connect channels "allow" gives at most "channel" access. Omitted when the agent inherits the default policy.
9966 
9967 - `organization_id: optional string or null`
9968 
9969 Organization ID this activity is associated with
9970 
9971 - `organization_uuid: optional string or null`
9972 
9973 Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
9974 
9975 - `slack_alias: optional string or nu