How to Audit Claude with the Compliance API

Anthropic expanded the Compliance API in August 2026. Remote Cowork sessions arrived on August 3, local Cowork and Claude Code sessions followed on August 11, and the session endpoints left beta on August 26. That sequence changed the enterprise audit picture: supported agent sessions can now have a central transcript, even when the work happened on a user's machine.

The API is still an evidence system rather than a permission boundary. It can tell an investigator what a supported session recorded. It does not, by itself, stop a risky upload, constrain a browser action, or block a tool call. This guide maps the current coverage and the controls needed around it. For the execution side, see How to Secure Claude Cowork; for the product decision, see Claude Cowork vs Claude Code.

API Coverage#

The current Compliance API documentation describes four distinct data sets:

Every endpoint is documented under /v1/compliance/* and uses an API key plus the anthropic-version header. A Compliance Access Key can reach the full API when granted the necessary scopes. An Admin API key from Claude Console reaches the Activity Feed only.

Enablement and Key Scopes#

For a Claude Enterprise tenant, the Primary Owner enables the API at claude.ai → Organization settings → API. The setting applies at the parent organization level and cascades to linked organizations. Anthropic's setup guide distinguishes who can create each key: the Primary Owner can cover every linked organization, while an organization Owner can create a key limited to their own organization. Admins cannot see this API settings page. An Owner can create a key after enablement but cannot toggle capture.

Anthropic's Help Center directs organizations on dedicated government deployments, such as Claude for Government, to a separate Compliance API. Check the API for your deployment before following this setup procedure.

An eligible standalone Claude Console organization follows a different setup path: its organization admin enables the API at Claude Console → Settings → Security, then creates a new Admin API key. According to the Admin key instructions, the API must be enabled when the key is created for it to carry read:compliance_activities. That key reaches only the Activity Feed; it cannot retrieve chats or session transcripts. A Console organization linked to an Enterprise parent instead relies on the parent's enablement.

Use separate read and delete keys when deletion is part of a workflow. Scopes cannot be changed after key creation, and the full secret is displayed once. Store it in a secrets manager, restrict which service can read it, and ingest the compliance_api_accessed activity so queries against compliance data have their own audit trail.

The timing of enablement matters. While the setting is off, new Activity Feed events are not recorded. Local Cowork and Code transcript capture also stops, and those missed transcripts cannot be reconstructed after the setting is turned back on.

Make a first Activity Feed request#

After enablement, supply a key with read:compliance_activities through your approved secret-loading process. This request asks for one activity record. It is adapted from Anthropic's example; we have not run it against a customer tenant.

Code source: Anthropic Compliance API overview

A successful response contains data, an array of activity records, plus has_more, first_id, and last_id. Use the Activity Feed pagination contract when expanding this check into a collector. One response establishes access to that endpoint, not transcript coverage or a complete export.

Budget requests across collectors. The shared limit is 600 requests per minute per parent organization, or per standalone Console organization. Local session requests use that budget; remote session endpoints have an additional request budget. On a 429 response, wait for retry-after and retry without advancing the cursor.

Activity Feed and Content#

The Compliance API includes audit-log events, according to Anthropic's access guide. Use the linked audit-log event list to map the administrative and sign-in actions your team needs to retain. For API ingestion, check the accepted activity_types[] values in the Activity Feed reference; do not assume an export label is an API filter value.

The Activity Feed answers questions such as who changed an organization setting, invited a user, created a resource, or accessed the Compliance API. Use a stable user identifier to correlate events with identity and downstream SIEM records. Poll with an overlap window so late-arriving events are not missed, and preserve source endpoint, query parameters, collection time, and a content hash when chain of custody matters.

Since September 24, 2026, file names, project document names, and artifact titles are absent from the feed. Their filename and title fields are null, empty strings, or omitted, including on older activities. Correlate by resource ID and accept all three cases during ingestion. The Activity object reference documents a separate metadata lookup using a Compliance Access Key with read:compliance_user_data; an Activity Feed-only Admin key cannot supply that access. A missing resource ID or a deleted resource prevents the lookup.

The content endpoints answer a different class of question. They retrieve Claude.ai chats, files, projects, attachments, and supported app-session transcripts. A legal or security workflow can use those records for investigation, eDiscovery, data-subject access, or targeted deletion where the API exposes deletion.

An Activity Feed row cannot stand in for a transcript, and raw event volume says little about completeness. Reconcile the feed and each content collection separately.

Unified chats and Claude Docs exports#

On October 8, 2026, Anthropic added beta coverage for unified Claude chats and Claude Docs downloads. Existing Compliance Access Keys work for unified chats. A chat that continues in the cloud remains one chat; its messages include tool calls and results linked by tool_use_id. Preserve those blocks during ingestion so the export retains the recorded tool activity.

Claude Docs retrieval uses the code-artifact collection, with artifact_type: claude_docs. Its version list is empty. Request GET /v1/compliance/apps/code/artifacts/{artifact_id}/content?multi_file_format=zip to retrieve a ZIP containing a Word file for each text tab. Comments, uploaded files, and edit history are excluded; a successful download does not establish a complete document history.

Deletion needs a separate coverage check. Deleting a unified chat also deletes cloud sessions started for that chat, but leaves sessions those sessions started. Reconcile that remaining scope before recording a deletion request as complete.

App and agent session transcripts#

The session endpoints split local and remote execution:

Anthropic added Chrome transcript coverage on September 18, 2026. The session reference specifies the extension's built-in chat, Enterprise sign-in, and enabled capture. Existing Compliance Access Keys with read:compliance_user_data work without a new key, scope, setting, or client update. Keep accepting unfamiliar product_surface values so an ingestion allowlist does not silently drop a newly supported app.

Microsoft 365 session coverage left beta on September 24, 2026; Chrome, Science, and Google add-in session coverage remain in beta. The existing key and scope still apply; no client update is required. A Chrome transcript records requests sent to Claude, not a complete browser activity log. Keep browser and downstream records for actions the transcript cannot establish.

The session reference uses bare office_agents when the individual app is unknown; that value can represent Microsoft 365 or a Google add-in. Preserve it as unknown app identity. Remote endpoints return Cowork sessions only, so do not route Claude Code cloud sessions or routines there.

A session transcript can contain user prompts, assistant responses, and tool activity. It does not contain every piece of execution context. Anthropic's integration design guide lists exclusions including thinking blocks, images and other binary content, the local system prompt, tool definitions, MCP server configuration, and local activity never sent to Anthropic.

Privacy settings change capture. The session reference excludes local sessions under ZDR. In HIPAA-ready organizations, it returns local Cowork and Claude Code sessions only; other local products are excluded. Captured content lasts 30 days, or a shorter configured conversation-retention period.

Transcript access and BAA eligibility require separate checks. Anthropic now documents coverage for configured local Cowork and Code. An Enterprise organization with an account team must have Anthropic enable the local HIPAA configuration; the Primary Owner applies it and accepts the BAA. Enabling HIPAA for chat alone is insufficient. Applying the configuration turns off Cowork and Desktop Code until an Owner re-enables them. Cloud Cowork, Dispatch, beta features, and third-party integrations do not gain coverage from local-session capture. Review the documented eligible services for the actual workflow before processing PHI.

Retention#

Do not carry the audit-log export's old retention assumption into the API. Anthropic's retention overview and session reference distinguish these horizons:

Shortening a finite retention period can make older local transcript messages unavailable immediately. Increasing it later does not restore expired content. Export records that must outlive the source retention period, then preserve provenance and access controls around the copy.

Compliance API, OpenTelemetry, and Enforcement#

Each layer answers a different operational question:

Cowork OpenTelemetry can include sensitive prompt and tool data. Route it through a collector that can redact fields before wider distribution. Correlate its prompt and session identifiers with Compliance API records, endpoint timestamps, and downstream application events.

For real-time policy, use a control that participates before the effect. Anthropic's inference hooks can hold governed prompts for an external allow-or-deny verdict. Our inference-hooks enforcement guide covers checking denials, tool-call validation, and endpoint failure handling before rollout. Gateways and proxies can decide on network and tool traffic they actually see. Endpoint and browser controls cover device actions. Human approval remains appropriate for irreversible actions, external sends, permission changes, and production operations.

Known Coverage Gaps#

One successful API request establishes access to that endpoint. It does not prove that every relevant session or action is present. Check the exclusions that apply to the deployment:

• Capture must be enabled before local activity occurs.
• Unsupported product and authentication paths remain outside the session endpoints.
• Local-only actions that never reach Anthropic are absent.
• Session transcripts omit thinking blocks, binary content, some system context, tool definitions, and MCP configuration.
• Content can disappear under retention policy or user and administrator deletion.
• The API records activity after the fact and cannot replace runtime policy enforcement.
• Transcript availability does not establish BAA coverage: verify the local HIPAA configuration, eligible client, and enabled features separately.

Turn each applicable gap into a test. Start a known session, run representative file, browser, connector, MCP, and computer-use actions, then prove which records appear in the API, OTel collector, endpoint platform, proxy, and downstream SaaS logs.

Rollout Plan#

1. Map surfaces and identities. Inventory Claude.ai, Cowork, Code, API, cloud-provider, mobile, and beta-product use. Record how each user authenticates.
2. Enable capture before the pilot. Have the Primary Owner enable the Compliance API, then confirm a test activity and local session appear.
3. Create least-privilege keys. Separate Activity Feed ingestion, content retrieval, and deletion duties where possible.
4. Build overlapping ingestion. Poll the Activity Feed with a cursor and overlap window. Alert on gaps, repeated failures, unexpected disablement, and use of compliance keys.
5. Export session evidence. Retrieve representative local and remote sessions, record provenance, and validate retention behavior.
6. Correlate live telemetry. Stream Cowork and Code OpenTelemetry into a controlled collector and join it to session, user, device, and downstream-system identifiers.
7. Test enforcement separately. Exercise inference hooks, proxy or gateway policy, MCP controls, browser management, endpoint restrictions, and approval flows.
8. Write the exceptions down. Document unsupported paths, retention choices, BAA exclusions, and the owner who accepts each remaining risk.

Key Takeaways#

The August 2026 session endpoints changed the Cowork audit story. Supported Cowork and Claude Code sessions now have a central retrieval path through the Compliance API, and the endpoint reference is public.

What an investigator can reconstruct still depends on when capture began, how the user authenticated, the retention setting, transcript omissions, local-only activity, and downstream effects. Use the Compliance API for retained evidence, OpenTelemetry for a live agent stream, and inline plus endpoint controls for enforcement.

Runtime Enforcement#

General Analysis AIDR joins Compliance API and OpenTelemetry records with prompts, file access, browser actions, MCP and plugin calls, shell commands, approvals, and downstream effects. It uses that context for detection and to stop risky actions before they complete.