# Anthropic — Compliance API, Admin compliance settings, Claude Platform on AWS IAM, regions & data residency

Status: DOCUMENTED · ACCOUNT_RESTRICTED (Compliance API requires an Enterprise org + compliance-scoped key; not available to this account — nothing live-tested)

Everything on this page is derived offline from the downloaded official docs (retrieved 2026-09-18). No request was made to any /v1/compliance/*, /v1/organizations/compliance_settings or AWS endpoint. The DELETE endpoints are destructive and permanent and must never be exercised by this project.

Sources

• Compliance API (overview)
• Set up the Compliance API
• Query the Activity Feed
• Retrieve and delete chats, files, and projects
• Retrieve session transcripts
• List organizations, users, roles, groups, and settings
• Design your compliance integration
• Handle Compliance API errors
• Compliance API FAQ
• Access Transparency
• API and data retention
• Data residency
• Inference hooks (adjacent, beta)
• App Attest (adjacent)
• Compliance API reference (36 leaf pages under api/compliance/**)
• Admin API — Get/Update Compliance Settings (beta)
• IAM actions for Claude Platform on AWS
• Claude Platform on AWS (auth sections only)
• Supported regions
• IP addresses

Last verified: 2026-09-18 (docs only)

Machine-readable twins: generated/fragments/endpoints/anthropic-compliance.json (36 compliance + 2 admin endpoints), generated/fragments/parameters/anthropic-compliance.json (146 params), generated/fragments/errors/anthropic-compliance.json (30 errors), generated/fragments/compatibility/anthropic-iam-actions.json (71 IAM actions), tmp/platform-anthropic/objects-compliance.json (27 objects).

# (a) What the Compliance API is

The Compliance API gives Claude Enterprise (and eligible standalone Claude Console) customers programmatic access to their organization's Activity Feed and — for Claude Enterprise tenants — to the directory (organizations, users, roles, groups), the effective settings of each linked organization, the underlying claude.ai chats, files, projects, and the transcripts of sessions run in Claude apps (Cowork, Claude Code, Claude Science, Claude for Microsoft 365, Claude in Chrome — local sessions; cloud Cowork — remote sessions), plus Claude Code Artifacts. Target users: security, legal, compliance (eDiscovery, DLP, SIEM ingestion, account-deletion responses).

Tenant model: a Claude Enterprise tenant = one parent organization (identity/SSO/SCIM) + linked organizations of two kinds (claude.ai orgs and Claude Console orgs). Parent orgs do not appear in Claude Console. A standalone Console org (no parent) can only use Admin API keys and only the Activity Feed.

# Who can use it / entitlement

Turning the Compliance API off stops activity recording and local-session capture (not retroactive, not recoverable), and stops Access Transparency delivery. Recording starts at first enablement — nothing is backfilled.

# Authentication

Scopes

# Rate limits (documented)

• 600 requests / minute per parent organization (per org for standalone Console orgs), one budget shared by every key, every linked org and every /v1/compliance/* endpoint.
• Remote session endpoints carry a second, separate budget on top; its 429 always returns retry-after: 1 and the anthropic-ratelimit-* headers on it describe the shared limit, so back off exponentially.
• Response headers once authenticated: anthropic-ratelimit-requests-limit, anthropic-ratelimit-requests-remaining, anthropic-ratelimit-requests-reset (RFC 3339); 429 adds retry-after (seconds).
• Auth failures are rejected before the limiter (no quota); a 403 (scope) consumes one unit.
• Higher limits: contact Anthropic representative. (No account-specific observations — none available.)

# Pagination model

Cursors and page tokens are opaque; reuse the same cursor on retry (a failed request does not advance position). Local-session messages page tokens expire 24 h after a walk starts; local-session list tokens older than 24 h are re-evaluated against the current retention boundary and may skip sessions. Cursors are scoped to the organization, so they survive key rotation.

# Error catalogue (from Handle Compliance API errors)

Standard Anthropic error body {"error": {"type", "message"}} + request-id header. Match on status + error.type, not on message text (except where noted).

Retry contract summary: 400/401/403/404/409 → fix and resend; 429 → wait retry-after, never advance the cursor; 500 → honour x-should-retry: false; 502/503/504/529 → exponential backoff (1 s → 60 s), except the local-session 503s above.

# (b) Endpoint tables per resource group

36 Compliance endpoints (36 reference leaf pages) + 2 Admin API compliance-settings endpoints. 5 endpoints are DELETE (⚠️ permanent hard-deletes — never call). All statuses are DOCUMENTED · ACCOUNT_RESTRICTED (docs-only; our account has no Enterprise/compliance entitlement).

# activities — scope: read:compliance_activities, read:org_audit

# organizations — scope: read:compliance_org_data, read:org_audit

# organizations/users — scope: read:compliance_user_data, read:org_audit

# organizations/roles — scope: read:compliance_org_data, read:org_audit

# organizations/roles/permissions — scope: read:compliance_org_data, read:org_audit

# organizations/settings — scope: read:compliance_org_data, read:org_audit

# groups — scope: read:compliance_org_data, read:org_audit

# groups/members — scope: read:compliance_user_data, read:org_audit

# apps/chats — scope: read:compliance_user_data, read:org_audit · DELETE: delete:compliance_user_data

# apps/chats/messages — scope: read:compliance_user_data, read:org_audit

# apps/chats/files — scope: read:compliance_user_data, read:org_audit · DELETE: delete:compliance_user_data

# apps/chats/generated_files — scope: read:compliance_user_data, read:org_audit

# apps/artifacts — scope: read:compliance_user_data, read:org_audit

# apps/projects — scope: read:compliance_user_data, read:org_audit · DELETE: delete:compliance_user_data

# apps/projects/attachments — scope: read:compliance_user_data, read:org_audit

# apps/projects/collaborators — scope: read:compliance_user_data, read:org_audit

# apps/projects/documents — scope: read:compliance_user_data, read:org_audit · DELETE: delete:compliance_user_data

# apps/sessions/local — scope: read:compliance_user_data, read:org_audit

# apps/sessions/remote — scope: read:compliance_user_data, read:org_audit

# code/artifacts — scope: read:compliance_user_data, read:org_audit · DELETE: delete:compliance_user_data

# admin/compliance_settings — scope: Admin API key (org admin)

# Activity Feed query parameters (GET /v1/compliance/activities)

Repeatable filters use bracket syntax (activity_types[]=a&activity_types[]=b); range filters use dot notation (created_at.gte). Unknown parameters are rejected with 400. activity_types[] and exclude_activity_types[] are mutually exclusive.

# Session transcript parameters

GET …/sessions/local/{id}/messages and GET …/sessions/remote/{id}/messages share: limit (1–1000, default 100), order (asc default / desc), page, tool_use_input_max_bytes and tool_result_max_bytes (default 10 000 bytes; -1 = server maximum ≈ 1 MiB; 0 invalid). Chat messages use tool_use_input_max_chars / tool_result_max_chars instead (chars, not bytes).

# (c) Data model

Identifier prefixes: org_ (tagged org id) / bare UUID (organization_uuid), user_, claude_chat_, claude_chat_msg_, claude_file_, claude_gen_file_, claude_artifact_ / claude_artifact_version_, claude_proj_, claude_proj_doc_, clls_ (local session), clsm_ (local session message), cse_ (remote session), csev_ (remote message), cagt_ (agent owner of a remote session), wrkspc_, apikey_, activity_. user_id is the stable join key (survives email changes and account deletion).

# Activity (Activity Feed event)

Common fields: id, created_at (RFC 3339), organization_id (org_… or null for sign-in/sign-out/Compliance-API-call events), organization_uuid, actor (union), type, plus type-specific fields (e.g. claude_chat_id, claude_project_id, filename). Retained 6 years; queryable within ~1 minute; at-least-once delivery → dedupe on id. claude_*_viewed events mean an app loaded the content, not that a human viewed it.

Actor union (actor.type) — 11 variants documented in the reference:

Activity types — the reference enumerates 506 values for activity_types[] (the guide says "hundreds"). Grouped:

Notable types: compliance_api_accessed (every Compliance API call; actor.api_key_id attributes it to a key), org_compliance_api_settings_updated (toggle on/off), audit_log_export_started/accessed, claude_chat_created/viewed/deleted, claude_file_uploaded/deleted/exported, claude_project_document_uploaded, sso_login_initiated. Access Transparency documents anthropic_access and cmek_preserve event types, but neither string appears in the reference enum — treat as DOCUMENTATION_INCOMPLETE (guide vs reference mismatch).

# Organizations, users, roles, permissions, groups

# Effective organization settings (GET /v1/compliance/organizations/{organization_id}/settings)

Returns {type: "effective_organization_settings", organization_id (bare UUID), settings[], api_keys[]}. Rows reflect the enforced state (after HIPAA/regulatory restrictions, feature availability, org-type defaults, inter-feature dependencies); a setting the org's admins cannot change is omitted (missing ≠ off). api_keys[] lists every Compliance Access Key of the parent (type: compliance_api_key, id, name, scopes[], is_active, created_at, created_by_id, expires_at) — never secrets. Target must be a linked org (not the parent). Unauthenticated requests get 401 here (404 elsewhere).

# Chats, messages, files, generated files, artifacts

• ComplianceChat (list item): id, name, model, organization_uuid, organization_id (deprecated), project_id, user {id, email_address} (null when key is single-org restricted), href, created_at, updated_at, deleted_at (set when the user deleted it in claude.ai — chat stays listed, content gone). List filters: user_ids[] (≤10), organization_ids[], project_ids[] (requires user_ids[]), created_at.*, updated_at.*, order_by. Legacy filter param rejected after 2026-09-22.
• ComplianceChatMessages: chat fields + chat_messages[] (id, role ∈ {user, assistant}, created_at, content[] of text {text, thinking_redacted, truncated} / tool_use {id, name, input (JSON string), integration_name, mcp_server_url, truncated} / tool_result {tool_use_id, name, content[], is_error, integration_name, mcp_server_url, truncated}, files[], generated_files[], artifacts[] {id, version_id, title, artifact_type}) + has_more, first_id, last_id.
• ComplianceFileMetadata: id, filename, mime_type, size_bytes, md5, claude_chat_ids[], message_ids[], created_at. Content endpoint streams the stored variant (may be extracted text for Word/PowerPoint/some PDFs) with Content-Disposition: attachment; filename*=utf-8''…, Content-Type, Content-MD5 (base64), Transfer-Encoding: chunked.
• ComplianceGeneratedFileMetadata: id (claude_gen_file_), claude_chat_id, filename, mime_type, size_bytes, md5, created_at.
• ComplianceArtifactVersionMetadata: id, version_id, claude_chat_id, title, artifact_type (e.g. application/vnd.ant.code), md5, size_bytes, created_at. Content endpoint returns JSON {content, title, artifact_type} for one version.

# Projects

• ComplianceProject / ComplianceProjectDetails: id, name, description, instructions, is_private, organization_uuid, user, created_at, updated_at, deleted_at, chats_count, attachments_count.
• Attachments (union on type): project_file {id claude_file_, filename, mime_type, size_bytes, md5, created_at} → download via the chat-files content endpoint; project_doc {id claude_proj_doc_, filename, mime_type text/plain, updated_at} → GET /v1/compliance/apps/projects/documents/{document_id} (content string) or /metadata (md5, size_bytes, claude_project_id, user).
• Collaborators (union on type): user {user_id}, group {group_id}, organization {organization_uuid}, organization_role {organization_role}; each with role ∈ {owner, admin, editor, viewer} and granted_at.
• DELETE project → 409 while chats are attached.

# Sessions — local vs remote

Both families are read-only (no delete). Coverage is stable for Cowork and Claude Code; Science / Microsoft 365 / Chrome coverage is beta.

# Claude Code Artifacts (/v1/compliance/apps/code/artifacts)

ComplianceCodeArtifact: id, organization_uuid, owner_user_id?, user?, read_mode ∈ {owner, users, org, public}, published_version_id?, updated_at?, versions[] {id, name, created_at} (≈20 most recent). List sorted by identifier (not time) with page/next_page (pages may be short/empty while next_page is set); filters organization_ids[] (≤500), user_ids[] (≤200), updated_at.*. Version content is streamed (Content-MD5; early-terminated chunked transfer is the only truncation signal; 503 while upload in flight). DELETE initiates asynchronous permanent removal.

# (d) Integration patterns

• Window polling: tile with created_at.gte (inclusive) / created_at.lt (exclusive), keep lt ≥ 1 min in the past (documented indexing lag), overlap windows by a few minutes or run reconciliation; dedupe on id. Page inside a window with after_id=last_id while has_more.
• Cursor-driven incremental reads: persist first_id, pass as before_id to get newer events (walk toward the present until has_more is false, then persist); backfill with after_id=last_id. Alternative: order=asc + after_id. Cursors survive key rotation.
• Chats export: omit user_ids[], set order_by=updated_at, paginate with after_id — picks up new, modified and user-deleted chats in one loop.
• SIEM correlation: join on actor.user_id (primary), actor.email_address, actor.ip_address, actor.user_agent, created_at; ingest compliance_api_accessed to audit who queried compliance data.
• Retention horizons: Activity Feed 6 y (Anthropic) · chat/file/project content = org's claude.ai retention policy or until user deletion · local transcripts 6 y or custom period · remote transcripts 6 y or user deletion · hard-deleted content: gone immediately. Export before retention/deletion if your legal hold is longer; the API cannot return removed content.
• Completeness: at-least-once delivery, no total_count/checksum; log start cursor, terminal last_id, record count, run time and final request-id; store provenance + content hash for chain of custody.
• Deletion endpoints (DELETE chat / file / project document / project / Code Artifact): require delete:compliance_user_data, return {id, type: "<resource>_deleted"} (claude_chat_deleted, claude_file_deleted, claude_project_document_deleted, claude_project_deleted, code_artifact_deleted), immediate and irreversible — archive first, use a separate delete-scoped key, never call from this project.
• Sandbox: no test sandbox is documented (FAQ "How do I get a sandbox…" → contact account team).

# (e) Admin API compliance settings (beta)

Singleton per Console organization, Admin API key (org admin). Not available on Claude Platform on AWS (workspace/external-key routes are the only Admin routes there).

Semantics: enabled turns the Compliance API on and starts capturing events; disabled stops both; setting the current value is a no-op success; a disabled state is overridden by a later provisioning action that enables Access Transparency (which re-enables the Compliance API); automated provisioning never disables. Reference example uses X-Api-Key + anthropic-version; SDK surfaces route it as …/compliance_settings?beta=true; no anthropic-beta header value is documented (uncertain).

# (f) Claude Platform on AWS — IAM

What it is. Claude Platform on AWS is the full Anthropic platform (Messages API, Files, Skills, Batches, Managed Agents, beta features) operated by Anthropic but reached through your AWS account: AWS supplies authentication (SigV4 or API key), IAM-based access control, CloudTrail and Marketplace billing. Unlike Bedrock (AWS runs inference; SigV4 service bedrock/bedrock-mantle), here the base URL is https://aws-external-anthropic.{region}.api.aws/v1/…, request/response shapes are the first-party Claude API, and every request carries anthropic-workspace-id: wrkspc_…. Available in all AWS commercial regions; the workspace's AWS region scopes the gateway endpoint, IAM, CloudTrail and billing — not where inference runs (use inference_geo).

Auth flow

Credential precedence in SDKs: apiKey arg → awsAccessKey+awsSecretAccessKey → awsProfile → ANTHROPIC_AWS_API_KEY → default provider chain. OAuth is not supported. Organization membership = AWS IAM (no Admin API member endpoints).

Service details: IAM prefix aws-external-anthropic; single resource type workspace; ARN arn:aws:aws-external-anthropic:{region}:{account-id}:workspace/{workspace-id} (resource segment = the wrkspc_ id). 71 actions; beta variants of a route need no extra action; every unlisted route is denied. No service-specific IAM condition keys are documented. IAM matching is case-insensitive and *File also matches *UserProfile — enumerate Files actions explicitly.

Managed policies (all on Resource: "*"): AnthropicFullAccess (*), AnthropicReadOnlyAccess (Get*, List*, CallWithBearerToken), AnthropicInferenceAccess (Get*, List*, CreateInference, CreateBatchInference, CancelBatchInference, DeleteBatchInference, CountTokens, CallWithBearerToken), AnthropicLimitedAccess (InferenceAccess + all Managed Agents actions), AnthropicSelfHostedEnvironmentAccess (GetEnvironment, ProcessEnvironmentWork, GetSession, UpdateSession, GetSkill, CallWithBearerToken). Get*/List* wildcards grant content reads (file bytes, skill content, batch results, session history, memories, key metadata) and ListComplianceActivities; AssumeConsole is only in FullAccess. Wildcard gotchas: Archive*, ProcessEnvironmentWork, RotateWebhookSecret, RegisterKey, DisableKey are not matched by Create*/Update*/Delete*; sub-resource create/delete maps to Update<Parent>.

Complete IAM action table (condition keys: none documented for any action)

CloudTrail: Management events (default-on) = workspace, external key, compliance, vault, webhook actions; Data events (opt-in, extra cost) = inference, batch, model, file, skill, user profile and other Managed Agents actions. Access Transparency for this platform is delivered via the Compliance API (not CloudTrail).

# (g) Regions, IP addresses, data residency, retention, access transparency

# Supported regions (access from)

The official list enumerates 175 countries/territories (page: Supported regions) — including Canada, USA, UK, EU member states, Japan, South Korea, Australia, India, Brazil, Mexico, Israel, UAE, Saudi Arabia, South Africa, Ukraine (except Crimea, Donetsk, Luhansk). Notably absent: China, Russia, Iran, North Korea, Belarus, Venezuela, Cuba, Syria, Afghanistan, Ethiopia, Hong Kong, Macau. Full list reproduced in sources/anthropic/pages/api/supported-regions.md.

# IP addresses (fixed, "will not change without notice")

Claude Platform on AWS inbound endpoint aws-external-anthropic.{region}.api.aws resolves to AWS IP ranges.

# Data residency

Two independent controls (exact names from Data residency):

Limitations: rate limits shared across geos; only us/global inference geos; only us workspace geo.

# Retention (API and data retention)

• Anthropic is the data processor for Claude API, Claude Platform on AWS and Claude in Microsoft Foundry (Bedrock / Vertex: cloud provider). Conversation content is not retained by default, except Covered Models (Claude Fable 5.1, Claude Mythos 5.1, Claude Fable 5, Claude Mythos 5) which require 30-day retention — a ZDR org gets 400 invalid_request_error: "In order to access this model, your organization or workspace must have data retention enabled." unless 30-day retention is enabled for the workspace (Console › Workspaces › Privacy controls).
• ZDR (per org, via sales): covers Messages + Token Counting for eligible features, Claude Code with Commercial-org keys / Enterprise+ZDR, Claude Platform on AWS (on request). Not covered: Console/playground, Managed Agents (stateful), consumer plans, Teams/Enterprise UIs, Claude for Excel, Covered Models, third-party integrations, CORS (unsupported under ZDR), flagged content/legal holds (up to 2 years).
• HIPAA readiness (BAA + HIPAA-enabled org, self-service in Console for eligible orgs): API blocks ineligible features with 400; HIPAA orgs have no local-session capture.
• Feature eligibility (ZDR / HIPAA): Yes/Yes — Messages, token counting, thinking, adaptive thinking, effort, fast mode, 1M context, citations, PDF (inline), prompt caching (in-memory KV/hashes), search results, computer use, bash, text editor, memory tool, web search, fine-grained tool streaming, mid-conversation system messages, data residency. ZDR Yes / HIPAA No — advisor tool, browser use, context editing, compaction, tool search, web fetch, cache diagnostics (qualified). Qualified/Yes — structured outputs (schema cached ≤24 h). No/No — Batch (29-day retention), Files API, Skills, code execution & programmatic tool calling (containers ≤30 days), MCP connector, MCP tunnels, Managed Agents.
• Compliance API data has its own retention model (Activity Feed 6 y; claude.ai content per org policy; session transcripts 6 y/custom).

# Access Transparency

• Not self-serve; enabled per org (all workspaces) by the account team; enabling it also enables the Compliance API.
• Each human view of covered content by Anthropic personnel writes an anthropic_access activity to the Activity Feed (filter activity_types[]=anthropic_access); automated processing does not, except cmek_preserve preservation records. Extra fields: accessed_at, accessor_department (e.g. Safeguards), reason_code ∈ {safety_review, incident_response, policy_violation_investigation, csae_report}, resource_details {type: "message", id, parent}, workspace_id; actor is always {type: "anthropic_actor", email_address: null}.
• Covered: Claude API (api.anthropic.com) prompts/responses, Claude Code via API key, Claude Platform on AWS (events via Compliance API, not CloudTrail). Not covered: Batch & Files APIs, claude.ai Enterprise seats, Claude for Work, consumer plans, Console playground, Foundry, Bedrock, Vertex.
• The anthropic_access / cmek_preserve strings are absent from the 506-value reference enum (see §c) — likely a reference-page lag.

# Adjacent (skimmed, not compliance endpoints)

• Inference hooks (beta, Enterprise, organization:manage): inline allow/deny of each governed prompt by the org's own AI-security HTTPS server (prompt event only); complements the after-the-fact Compliance API. Toggles surface in effective settings / inference_* activity types.
• App Attest: device-attested one-hour tokens for iOS/macOS apps calling /v1/messages (Claude API only); appears in the Activity Feed as attested_device_actor.

# Uncertainties / not verifiable offline

1. Nothing was called: whether our key type would receive 404 Not found (documented for non-compliance keys) is inferred from docs, not observed.
2. Scope for GET …/projects/{id}/collaborators and the Code Artifacts endpoints is not stated on their reference pages; recorded as read:compliance_user_data by resource family.
3. anthropic_access / cmek_preserve activity types documented in Access Transparency are missing from the reference activity_types[] enum.
4. anthropic-beta header value for the Admin compliance_settings endpoints is not documented (SDKs use ?beta=true).
5. The reference pages' curl examples use Authorization: Bearer … while every guide uses x-api-key; both are recorded, x-api-key treated as canonical.
6. Second rate-limit budget for remote-session endpoints has no documented numeric value.
7. IAM: the page documents no condition keys; condition_keys is [] everywhere (not "none exist" — just none documented).