Anthropic/compliance

@webframp/anthropic/compliancev2026.08.21.2· 1d agoMODELSREPORTS

01README

Observe a Claude Enterprise account via the Compliance API. Covers the 6-year activity audit feed, organization directory (users, roles, groups with SCIM source attribution), and effective runtime settings (retention, redaction, IP allowlist, SSO mode, code execution egress).

Authentication

Requires a Compliance Access Key (sk-ant-api01-...) created by the primary owner in claude.ai → Org settings → API access. Store in a swamp vault.

Usage

swamp extension pull @webframp/anthropic/compliance
swamp model create @webframp/anthropic/compliance claude-compliance \
  --global-arg 'complianceKey=${{ vault.get("anthropic", "COMPLIANCE_KEY") }}'

# Discover org
swamp model method run claude-compliance sync_organizations

# Full directory sync (users + roles + groups)
swamp model method run claude-compliance sync_directory

# Effective settings
swamp model method run claude-compliance sync_effective_settings

# Audit feed
swamp model method run claude-compliance collect_activities
swamp model method run claude-compliance collect_activities \
  --input activity_types=user.login,conversation.create

Methods

sync_organizations — discover orgs visible to the key
sync_users — paginate all directory users
sync_roles — list defined roles
sync_groups — list groups
get_group_members — members with SCIM source attribution
sync_directory — fan-out: users + roles + groups in one call
sync_effective_settings — observe runtime config
collect_activities — filterable audit feed (6-year retention)

Reports

config-snapshot — aggregates effective settings, roles, groups, organizations, and directory user count (never the roster itself) into one JSON artifact, for exporting to a git-tracked config repo. Runs as a default report on every method call.

02Release Notes

2026.08.21.2

Changed: collect_activities's since argument is now validated as a parseable timestamp before being sent to the API — previously a malformed value passed straight through and only surfaced as an opaque upstream 400.

get_group_members's best-effort group-name lookup no longer swallows its failure silently; a failed lookup now logs a message naming the group ID and the underlying error before falling back to using the ID as the display name.

The config-snapshot report's data reads no longer treat a storage-backend failure and "this spec was never collected" identically. A failed getContent call or unparseable JSON now logs a warning naming the spec and model instance before the report falls back to omitting that section.

03Models1

@webframp/anthropic/compliancev2026.07.30.1anthropic/compliance.ts

Global Arguments

Argument	Type	Required	Description
complianceKey	string	yes	Compliance Access Key (sk-ant-api01-...) from claude.ai org settings (use vault reference)
orgId?	string	no	Organization ID to scope queries. Omit to auto-discover from /v1/compliance/organizations.

fn collect_activities(activity_types?: string, since?: string, limit?: string)

Collect recent compliance activities. Use activity_types to filter (e.g. 'user.login', 'conversation.create').

Argument	Type	Required	Description
activity_types?	string	no	Comma-separated activity type filter (e.g. 'user.login,conversation.create')
since?	string	no	ISO-8601 timestamp — collect activities created after this time
limit?	string	no	Max activities to collect per page (default 100, max 5000)

fn sync_organizations()

Discover organizations visible to the compliance key.

fn sync_users()

Sync all directory users for the organization. Paginates automatically.

fn sync_roles()

Sync roles defined for the organization.

fn sync_groups()

Sync groups for the organization. Use get_group_members for member detail with SCIM source attribution.

fn get_group_members(groupId: string)

Get members of a specific group, including SCIM source attribution (direct vs scim).

Argument	Type	Required	Description
groupId	string	yes	Group ID to fetch members for

fn sync_effective_settings()

Observe effective runtime settings: data retention, content redaction, IP allowlist, SSO mode, code execution egress.

fn sync_directory()

Fan-out: sync users, roles, and groups for the organization in one method call.

Resources

activities(1h)— Compliance activity feed (audit trail, 6-year retention)

organizations(24h)— Organizations visible to the compliance key

users(1h)— Directory users for an organization

roles(24h)— Roles defined for an organization

groups(24h)— Groups defined for an organization

groupMembers(1h)— Members of a specific group with SCIM source attribution

effectiveSettings(1h)— Effective runtime settings (retention, redaction, IP allowlist, SSO mode)

04Reports1

@webframp/compliance-config-snapshotmethod

config_snapshot_report.ts

Aggregate effective settings, roles, groups, organizations, and directory user count into one git-diffable config snapshot

anthropiccomplianceconfigsnapshot

05Previous Versions8

2026.08.21.1Aug 21, 2026

2026.08.21.1

Changed: Added descriptions to every previously undocumented field across the activities, organizations, users, roles, groups, groupMembers, and effectiveSettings resource schemas. No behavioral change.

2026.07.30.1

Fixed: sync_groups and sync_directory returned HTTP 404 from the Anthropic Compliance API. The org-scoped groups endpoint (/v1/compliance/organizations/{orgId}/groups) no longer exists; groups are now served at the top-level path /v1/compliance/groups.

Changed: All three call sites that listed groups (sync_groups, sync_directory, and the name-lookup fallback in get_group_members) now use /v1/compliance/groups instead of the former org-scoped path.

Upgrade note: No action required. The resource schema and instance names are unchanged — only the upstream API path differs. Re-run sync_groups or sync_directory after upgrading to populate the groups resource.

2026.07.30.1Jul 31, 2026

2026.07.30.1

2026.07.18.1Jul 18, 2026

2026.07.17.1

Added:

New config-snapshot report (@webframp/compliance-config-snapshot), registered as a default report on the model type. Aggregates the latest effectiveSettings, roles, groups, and organizations, plus the directory user count (never the roster), into one JSON artifact — swamp report get @webframp/compliance-config-snapshot --model claude-compliance --json. Intended to be exported into a git-tracked config repo so drift and growth are visible via git log/git diff. Individual users and group membership are deliberately excluded: that data is SCIM/Entra-owned, not config, and carries PII.

2026.07.15.1

Fixed:

sync_users, sync_roles, sync_groups, sync_effective_settings, and the sync_directory fan-out all wrote their resource using the organization ID as the instance name. Since every one of those specs shared the same instance name, each sync method's write landed as a new version of the same data artifact rather than its own resource — running sync_roles after sync_effective_settings silently pushed the effective settings snapshot into history, and swamp data get claude-compliance <orgId> would return whichever spec synced most recently, not a specific one.

Changed:

These methods now write to a fixed instance name equal to their own spec name ("users", "roles", "groups", "effectiveSettings") instead of the organization ID, matching the existing pattern used by collect_activities ("recent") and sync_organizations ("all") — each spec's instance name is exclusive to that spec, since swamp's storage key is (modelId, name) and does not include specName. An earlier draft of this fix used a single shared literal ("current") for all four specs, which reproduced the exact same collision under a different name; that was caught in review before release.
get_group_members now writes to member:<groupId> instead of the bare groupId. Since groupId is caller-supplied, an unnamespaced write could collide with one of the new fixed literals above (e.g. a group ID of "users" would have landed on the same data name as sync_users).

Upgrade note: Data written under the old org-ID-keyed name by previous versions is orphaned by this change — it remains in history (subject to each resource's normal GC policy) but is no longer returned by swamp data get claude-compliance <orgId>. Re-run sync_users, sync_roles, sync_groups, and sync_effective_settings (or sync_directory) after upgrading, then read them back with swamp data get claude-compliance users / roles / groups / effectiveSettings. Group member data moves from swamp data get claude-compliance <groupId> to swamp data get claude-compliance member:<groupId> — update any CEL expressions or scripts referencing the old form.

2026.07.07.1

Fixed:

collect_activities since filter: the Compliance API expects the dotted range parameter created_at.gte, not the bracketed created_at[gte], which returned HTTP 400 (Unknown query parameter: 'created_at[gte]'). The since argument now filters activities correctly.

2026.07.03.1

Fixed:

Organization ID mapping: The Anthropic compliance API returns org identifiers in the uuid field, not id. resolveOrgId and sync_organizations now correctly prefer uuid over id, fixing auto-discovery failures.
Activity schema: actor.id, actor.email, actor.name, and details are now nullable+optional, matching actual API response shapes (e.g. api_actor has api_key_id but no id/email/name).

Changed:

collect_activities now writes to the "recent" instance (was "latest"). swamp reserves "latest" for internal use. If you have CEL expressions referencing data.latest("claude-compliance", "latest"), update them to data.latest("claude-compliance", "recent").

2026.07.02.1

Added: Initial release. Compliance API observation model with 8 methods: sync_organizations, sync_users, sync_roles, sync_groups, get_group_members, sync_directory (fan-out), sync_effective_settings, collect_activities. Seven versioned resource specs for CEL queries.

2026.07.17.1Jul 17, 2026

2026.07.17.1

Added:

New config-snapshot report (@webframp/compliance-config-snapshot), registered as a default report on the model type. Aggregates the latest effectiveSettings, roles, groups, and organizations, plus the directory user count (never the roster), into one JSON artifact — swamp report get @webframp/compliance-config-snapshot --model claude-compliance --json. Intended to be exported into a git-tracked config repo so drift and growth are visible via git log/git diff. Individual users and group membership are deliberately excluded: that data is SCIM/Entra-owned, not config, and carries PII.

2026.07.15.1

Fixed:

sync_users, sync_roles, sync_groups, sync_effective_settings, and the sync_directory fan-out all wrote their resource using the organization ID as the instance name. Since every one of those specs shared the same instance name, each sync method's write landed as a new version of the same data artifact rather than its own resource — running sync_roles after sync_effective_settings silently pushed the effective settings snapshot into history, and swamp data get claude-compliance <orgId> would return whichever spec synced most recently, not a specific one.

Changed:

These methods now write to a fixed instance name equal to their own spec name ("users", "roles", "groups", "effectiveSettings") instead of the organization ID, matching the existing pattern used by collect_activities ("recent") and sync_organizations ("all") — each spec's instance name is exclusive to that spec, since swamp's storage key is (modelId, name) and does not include specName. An earlier draft of this fix used a single shared literal ("current") for all four specs, which reproduced the exact same collision under a different name; that was caught in review before release.
get_group_members now writes to member:<groupId> instead of the bare groupId. Since groupId is caller-supplied, an unnamespaced write could collide with one of the new fixed literals above (e.g. a group ID of "users" would have landed on the same data name as sync_users).

2026.07.07.1

Fixed:

collect_activities since filter: the Compliance API expects the dotted range parameter created_at.gte, not the bracketed created_at[gte], which returned HTTP 400 (Unknown query parameter: 'created_at[gte]'). The since argument now filters activities correctly.

2026.07.03.1

Fixed:

Organization ID mapping: The Anthropic compliance API returns org identifiers in the uuid field, not id. resolveOrgId and sync_organizations now correctly prefer uuid over id, fixing auto-discovery failures.
Activity schema: actor.id, actor.email, actor.name, and details are now nullable+optional, matching actual API response shapes (e.g. api_actor has api_key_id but no id/email/name).

Changed:

collect_activities now writes to the "recent" instance (was "latest"). swamp reserves "latest" for internal use. If you have CEL expressions referencing data.latest("claude-compliance", "latest"), update them to data.latest("claude-compliance", "recent").

2026.07.02.1

Added 1 reports

2026.07.15.1Jul 15, 2026

2026.07.15.1

Fixed:

sync_users, sync_roles, sync_groups, sync_effective_settings, and the sync_directory fan-out all wrote their resource using the organization ID as the instance name. Since every one of those specs shared the same instance name, each sync method's write landed as a new version of the same data artifact rather than its own resource — running sync_roles after sync_effective_settings silently pushed the effective settings snapshot into history, and swamp data get claude-compliance <orgId> would return whichever spec synced most recently, not a specific one.

Changed:

These methods now write to a fixed instance name equal to their own spec name ("users", "roles", "groups", "effectiveSettings") instead of the organization ID, matching the existing pattern used by collect_activities ("recent") and sync_organizations ("all") — each spec's instance name is exclusive to that spec, since swamp's storage key is (modelId, name) and does not include specName. An earlier draft of this fix used a single shared literal ("current") for all four specs, which reproduced the exact same collision under a different name; that was caught in review before release.
get_group_members now writes to member:<groupId> instead of the bare groupId. Since groupId is caller-supplied, an unnamespaced write could collide with one of the new fixed literals above (e.g. a group ID of "users" would have landed on the same data name as sync_users).

2026.07.07.1

Fixed:

collect_activities since filter: the Compliance API expects the dotted range parameter created_at.gte, not the bracketed created_at[gte], which returned HTTP 400 (Unknown query parameter: 'created_at[gte]'). The since argument now filters activities correctly.

2026.07.03.1

Fixed:

Organization ID mapping: The Anthropic compliance API returns org identifiers in the uuid field, not id. resolveOrgId and sync_organizations now correctly prefer uuid over id, fixing auto-discovery failures.
Activity schema: actor.id, actor.email, actor.name, and details are now nullable+optional, matching actual API response shapes (e.g. api_actor has api_key_id but no id/email/name).

Changed:

collect_activities now writes to the "recent" instance (was "latest"). swamp reserves "latest" for internal use. If you have CEL expressions referencing data.latest("claude-compliance", "latest"), update them to data.latest("claude-compliance", "recent").

2026.07.02.1

2026.07.07.1Jul 7, 2026

2026.07.07.1

Fixed:

collect_activities since filter: the Compliance API expects the dotted range parameter created_at.gte, not the bracketed created_at[gte], which returned HTTP 400 (Unknown query parameter: 'created_at[gte]'). The since argument now filters activities correctly.

2026.07.03.1

Fixed:

Organization ID mapping: The Anthropic compliance API returns org identifiers in the uuid field, not id. resolveOrgId and sync_organizations now correctly prefer uuid over id, fixing auto-discovery failures.
Activity schema: actor.id, actor.email, actor.name, and details are now nullable+optional, matching actual API response shapes (e.g. api_actor has api_key_id but no id/email/name).

Changed:

collect_activities now writes to the "recent" instance (was "latest"). swamp reserves "latest" for internal use. If you have CEL expressions referencing data.latest("claude-compliance", "latest"), update them to data.latest("claude-compliance", "recent").

2026.07.02.1

2026.07.03.1Jul 3, 2026

2026.07.03.1

Fixed:

Organization ID mapping: The Anthropic compliance API returns org identifiers in the uuid field, not id. resolveOrgId and sync_organizations now correctly prefer uuid over id, fixing auto-discovery failures.
Activity schema: actor.id, actor.email, actor.name, and details are now nullable+optional, matching actual API response shapes (e.g. api_actor has api_key_id but no id/email/name).

Changed:

collect_activities now writes to the "recent" instance (was "latest"). swamp reserves "latest" for internal use. If you have CEL expressions referencing data.latest("claude-compliance", "latest"), update them to data.latest("claude-compliance", "recent").