Anthropic Claude Compliance API Integration

TL;DR

Overview

Anthropic's Claude Compliance API provides Enterprise organizations with an activity feed documenting user and administrative actions across Claude.ai, Claude Console, and the Claude API. Each record is an "Activity" object describing a discrete event — such as viewing or creating a chat, uploading or viewing a file, or viewing a project — performed by an actor (typically a human user, identified by email and user ID) from a given IP address and user agent. This feed is the primary audit trail for Claude Enterprise usage, and is accessible via the GET /v1/compliance/activities endpoint using an API key. These logs are valuable for security operations because they reveal who accessed what AI resources (chats, files, projects), from where, and when, enabling insider-risk monitoring, data-exfiltration detection, account-compromise investigation (e.g., anomalous IP/geo for a user), and compliance/audit-trail requirements. Integrating these logs into Hunters allows security teams to correlate Claude usage activity with other data sources for broader threat detection and investigation.

Supported data types

Anthropic Claude Compliance Activities

Table name: anthropic_claude_compliance_activities

This data type contains the activity audit trail for Claude Enterprise usage, capturing actions taken by users and administrators across Claude.ai, Claude Console, and the Claude API. Each event records the actor (email, user ID, IP address, user agent), the type of action performed (e.g., chat viewed/created, file viewed/uploaded, project viewed), and associated resource identifiers such as chat, file, and project IDs. These events support insider-risk monitoring, data-exfiltration detection, and account-compromise investigation for AI resource access.

Expected format

Logs are expected in JSON format.

{"actor": {"email_address": "alice.jensen@examplecorp.com", "ip_address": "185.22.64.101", "type": "user_actor", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Claude/4.16336.0 Chrome/152.0.7977.167 Electron/44.9.3 Safari/537.36", "user_id": "user_01A1B2C3D4E5F6G7H8I9J0K1"}, "claude_chat_id": "claude_chat_01L2M3N4O5P6Q7R8S9T0U1V2", "created_at": "2026-11-05T04:24:21.681061Z", "id": "activity_01W3X4Y5Z6A7B8C9D0E1F2G3", "organization_id": "org_01H4I5J6K7L8M9N0O1P2Q3R4", "type": "claude_chat_viewed", "organization_uuid": "b3e618d6-56a4-4bc4-92d4-ee6f93386cac"}

Send data to Hunters

Hunters supports the collection of Anthropic logs using API, S3 List, S3 Notifications, GCP Bucket List, and Azure Block Storage List.

To connect Anthropic logs:

Connect using S3

1. Route Anthropic logs into an AWS S3 bucket.
2. Once logs are in S3, follow the steps in this section.

Connect using Azure Block Storage List

1. Route Anthropic logs into an Azure Storage container as block blobs.
2. Once logs are in the container, follow the steps in this section.

Connect using GCP Bucket List

1. Route Anthropic logs into a Google Cloud Storage bucket.
2. Once logs are in the bucket, follow the steps in this section.

Connect using API

1. In the Anthropic Console, create a Compliance Access Key with the read:compliance_activities scope under Organization settings -> API, following Anthropic's own Compliance API documentation.
2. Connect the data source in the Hunters portal with those credentials, as described in this section. Hunters pulls the data from the vendor API on a schedule.