Anthropic Compliance API Activity Feed: What’s Emitted, Blindspots, and Security Use Cases

TL;DR

Anthropic’s Compliance API Activity Feed records authentication, resource, administrative, and platform activity. Depending on the event, it can show who acted, when, from where, and against which resource. It does not include prompts, responses, chat or file contents, or intent.

Separate Compliance API endpoints can retrieve chats, files, projects, and supported Cowork and Claude Code transcripts. They require read:compliance_user_data, have coverage limits, and are not part of the Activity Feed.

This is part six of Monad’s AI Tooling Visibility series. We cover Claude Code separately in Detection Engineering for Claude Code, Part 1. If you want the full series in one place, the book is free and ungated. Monad can collect the Activity Feed and route it alongside the rest of your security data.

Why This Feed Is Key For Security

The Activity Feed gives you a security timeline: actor, time, organization, resource, source IP, user agent, and event-specific details. It shows that something happened. It does not prove why or what the impact was.

Standard activities are queryable within one minute and retained for six years. Access Transparency events can arrive up to two business days later. Recording stops when the Compliance API is disabled, and missed events cannot be recovered.

What the Activity Feed Records

The feed covers authentication and identity, chat and file activity, administrative changes, Compliance API access, MCP servers, and Code Review configuration. Each record has a common shape:

• id uniquely identifies the activity.
• created_at records when a standard activity occurred. For Access Transparency events, it records when the event became visible; accessed_at is the occurrence time.
• organization_id and organization_uuid identify the affected organization when available. Both are null for sign-in, sign-out, and Compliance API calls.
• actor.type identifies who or what acted, including users, keys, SCIM sync, service accounts, federated identities, attested devices, and Anthropic systems.
• type names the activity. Additional fields identify the affected resource.

Sample record

This sanitized example records the creation of a Claude chat:

{
  "id": "activity_564447",
  "created_at": "2026-07-26T15:07:52.316385Z",
  "organization_id": "org_9600",
  "organization_uuid": "550e8400-e29b-41d4-a716-446655440000",
  "actor": {
    "type": "user_actor",
    "email_address": "bob.williams@example.com",
    "user_id": "user_920574",
    "ip_address": "77.136.81.9",
    "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"
  },
  "type": "claude_chat_created",
  "claude_chat_id": "claude_chat_557075",
  "claude_project_id": null
}

A few details matter:

• type names the activity. The activity-type reference is the source of truth. Resource IDs identify the affected object, not its content.
• Fields vary by activity and actor type. Check actor.type before assuming user, key, IP, or user-agent fields exist.
• actor.user_id is the stable user join key. Anthropic documents it as consistent across Compliance API endpoints and unchanged when a user’s email or display name changes.

What the Activity Feed Does Not Show

The Activity Feed does not reveal:

• Prompts, responses, chat text, or file contents.
• Intent, legitimacy, or impact.
• Complete endpoint activity, effective permissions, or downstream results.

Claude Enterprise organizations can retrieve supported chats, files, projects, and Cowork and Claude Code transcripts through separate endpoints. ZDR, HIPAA, CMEK, third-party cloud, and Claude Console API key usage introduce limits or exclusions. That is a separate, more sensitive access path.

High-Signal Detections

Routine chat creation is usually low signal. Three areas are more useful:

• Control-plane changes: privileged role, SSO, IP restriction, Compliance API, or administrative key changes. This also covers MCP and Code Review configuration changes by an unexpected actor.
• Suspicious Compliance API access: compliance_api_accessed can include key ID, IP, user agent, method, URL, status, request ID, and serialized request body. Useful checks are an unfamiliar key, IP, or user agent; an unexpected endpoint or method; or use of a retired key.
• Destructive activity: spikes in claude_chat_deleted, claude_file_deleted, or claude_project_deleted, especially when one actor deletes across resource types.

These events are leads, not verdicts.

Collecting the Activity Feed

Monad’s Compliance Activities input supports incremental collection, optional backfill, and organization filters. With no backfill date, the first run looks back 90 days. Monad can filter, enrich, and route the records to a SIEM, data lake, or other destination.

GET /v1/compliance/activities is available to Claude Enterprise and eligible standalone Claude Console organizations. It uses the x-api-key header and requires read:compliance_activities. Anthropic accepts Compliance Access Keys and Admin API keys; Monad’s input currently expects a Compliance Access Key. Admin API keys created before the Compliance API was enabled do not carry the required scope.

The endpoint returns newest records first, supports organization, actor, type, and time filters, and allows up to 5,000 records per page. The collection details that matter:

• Advance its cursor only after every page in the run is stored.
• Deduplicate on activity id because retries can redeliver records.
• End time windows at least one minute in the past and use overlap or reconciliation.
• Keep unknown fields, event types, and actor types.

Start in Monad or book a walkthrough, and we can help you get the Activity Feed into your existing security stack.

‍