Anthropic/compliance

Observe a Claude Enterprise account via the Compliance API. Covers the 6-year activity audit feed, organization directory (users, roles, groups with SCIM source attribution), and effective runtime settings (retention, redaction, IP allowlist, SSO mode, code execution egress).

Authentication

Requires a Compliance Access Key (sk-ant-api01-...) created by the primary owner in claude.ai → Org settings → API access. Store in a swamp vault.

Usage

swamp extension pull @webframp/anthropic/compliance
swamp model create @webframp/anthropic/compliance claude-compliance \
  --global-arg 'complianceKey=${{ vault.get("anthropic", "COMPLIANCE_KEY") }}'

# Discover org
swamp model method run claude-compliance sync_organizations

# Full directory sync (users + roles + groups)
swamp model method run claude-compliance sync_directory

# Effective settings
swamp model method run claude-compliance sync_effective_settings

# Audit feed
swamp model method run claude-compliance collect_activities
swamp model method run claude-compliance collect_activities \
  --input activity_types=user.login,conversation.create

Methods

• sync_organizations — discover orgs visible to the key
• sync_users — paginate all directory users
• sync_roles — list defined roles
• sync_groups — list groups
• get_group_members — members with SCIM source attribution
• sync_directory — fan-out: users + roles + groups in one call
• sync_effective_settings — observe runtime config
• collect_activities — filterable audit feed (6-year retention)

2026.07.07.1

Fixed:

• collect_activities since filter: the Compliance API expects the dotted range parameter created_at.gte, not the bracketed created_at[gte], which returned HTTP 400 (Unknown query parameter: 'created_at[gte]'). The since argument now filters activities correctly.

2026.07.03.1

Fixed:

• Organization ID mapping: The Anthropic compliance API returns org identifiers in the uuid field, not id. resolveOrgId and sync_organizations now correctly prefer uuid over id, fixing auto-discovery failures.
• Activity schema: actor.id, actor.email, actor.name, and details are now nullable+optional, matching actual API response shapes (e.g. api_actor has api_key_id but no id/email/name).

Changed:

• collect_activities now writes to the "recent" instance (was "latest"). swamp reserves "latest" for internal use. If you have CEL expressions referencing data.latest("claude-compliance", "latest"), update them to data.latest("claude-compliance", "recent").

2026.07.02.1

Added: Initial release. Compliance API observation model with 8 methods: sync_organizations, sync_users, sync_roles, sync_groups, get_group_members, sync_directory (fan-out), sync_effective_settings, collect_activities. Seven versioned resource specs for CEL queries.