Skip to main content
The Anthropic Claude integration collects the Compliance API Activity Feed for security monitoring and detection. It covers sign-ins, SSO and IP restriction changes, API and service key lifecycle, MCP connectors, role grants, sharing changes, and organization settings without requiring software on employee devices.
Wirespeed reads activity metadata only. It does not request chat, file, project, or session content, and it never uses the read:compliance_user_data or delete:compliance_user_data scopes.

​
Prerequisites

Choose the path that matches your organization: A Claude Console organization linked to a Claude Enterprise parent is covered by the parent’s Compliance Access Key; use the Claude Enterprise path.

​
Step 1: Enable the Compliance API

Claude Enterprise: sign in as the primary owner, open claude.ai → Organization settings → API, and turn on the Compliance API. Enablement applies to the parent organization and every linked claude.ai and Claude Console organization. Standalone Claude Console: open Claude Console → Settings → Security and turn on the Compliance API toggle.
Activity is recorded only while the Compliance API is on. Anthropic does not backfill activity from before it was enabled, and turning it off stops recording until it is turned back on.

​
Step 2: Create a Key

​
Claude Enterprise: Compliance Access Key

  1. Open claude.ai → Organization settings → API and find Keys
  2. Click Create key and enter a name, such as Wirespeed Activity Feed
  3. Choose whether the key covers the parent organization (all linked organizations) or a single organization
  4. Select read:compliance_activities
  5. Optionally, also select read:compliance_org_data so Wirespeed records the effective organization settings in force (see Effective Organization Settings)
  6. Click Create and copy the key, which starts with sk-ant-api01-
Compliance Access Key scopes cannot be changed after creation. To add or remove a scope later, create a new key and replace it in Wirespeed.

​
Standalone Claude Console: Admin API key

  1. Confirm the Compliance API is already enabled (Step 1)
  2. Open Claude Console → Settings → Admin keys and create a key
  3. Copy the key, which starts with sk-ant-admin01-
An Admin API key can read the Activity Feed only if it was created after the Compliance API was enabled. If an older key returns a missing-scope error, create a new one.
Anthropic displays the key once. Store it securely.

​
Step 3: Connect Anthropic Claude to Wirespeed

  1. In Wirespeed, open Integrations → Add Integration
  2. Search for and select Anthropic Claude
  3. Paste the key
  4. Click Integrate
Wirespeed validates the key against the Activity Feed before enabling the integration. A successful connection proves the key can read the feed; it does not mean activity exists yet. The integration page shows which scopes the key carries as entitlements: Organization Settings: Disabled is normal for Admin API keys and for Compliance Access Keys created without that scope; activity collection is not affected. Wirespeed rechecks both scopes when the integration is enabled and once a day.

​
What Events Are Collected?

Wirespeed imports every activity type the Activity Feed returns, including:
  • SSO, magic link, and social sign-ins and failures
  • SSO, SCIM, IP restriction, and organization setting changes
  • Admin API key, service key, and API key lifecycle
  • User, invite, role, and group changes
  • MCP server, connector, and integration changes
  • Chat, project, file, and artifact sharing activity
  • Compliance API access by each key
The first sync requests up to seven days of available history. Each poll then collects activity from the previous window onward. Anthropic makes activity queryable within about a minute, so Wirespeed reads up to two minutes behind real time and re-reads a short overlap to catch late-indexed activity.
The Activity Feed does not include prompts or model responses, and it does not cover Claude Code usage authenticated with a Claude Console API key or run through Amazon Bedrock, Google Cloud, or Microsoft Foundry.

​
Effective Organization Settings

When a Compliance Access Key also carries read:compliance_org_data, Wirespeed reads the settings actually in force for each organization the key covers (every linked organization for a parent-organization key, or the one organization for a single-organization key), after HIPAA restrictions, feature availability, and dependencies are applied. This includes SSO enforcement, IP allowlisting, data retention, sharing, Claude Code controls, and the inventory of Compliance Access Keys with their scopes. Wirespeed records a snapshot when the integration connects and again whenever an organization’s settings change. Snapshots appear in the same log table as activity, with the type wirespeed_effective_settings_snapshot. Settings that an organization’s administrators cannot change are omitted by Anthropic, so a missing setting means “not controllable”, not “off”. Wirespeed checks for the scope when the integration connects and once a day. Admin API keys cannot carry read:compliance_org_data, so standalone Claude Console organizations collect activity only.

​
Managed Detections

Wirespeed evaluates the collected activity for configuration and posture changes. These are informational unless noted: Successful and failed sign-ins are also normalized as authentication events for SIEM searches and cross-platform login detections.

​
Troubleshooting

​
Compliance API Not Enabled

A 400 error reading Compliance API is not enabled for this organization means Step 1 has not been completed, or the Compliance API was turned off. Enable it, then wait for the next sync.

​
Invalid or Deactivated Key

For 401 errors (API key is invalid., API key has been deactivated., or API key has expired.):
  1. Confirm the entire key was pasted without spaces
  2. Confirm the key was not deleted in claude.ai or Claude Console
  3. Create a replacement key and update Wirespeed

​
Missing Scope

A 403 error reading Missing required scopes means the key lacks read:compliance_activities. Create a new Compliance Access Key with that scope, or a new Admin API key after the Compliance API is enabled.

​
Wrong Key Type

A 404 error reading Not found means the key is not a Compliance Access Key or Admin API key. Standard Claude API keys (sk-ant-api03-...) and Analytics API keys cannot read the Activity Feed.

​
Integration Connects but No Events Appear

A healthy integration logs 0 new logs ingested on each poll when the feed is empty. Confirm activity exists before expecting it in Wirespeed:
"data": [] means there is nothing for Wirespeed to ingest. Recording begins when the Compliance API is enabled, so sign out and back in to Claude, wait a few minutes, and rerun the request.

​
Effective Settings Not Available

A warning that effective settings are not available for an organization means Anthropic has not enabled the settings endpoint for your parent organization. Anthropic enables it separately from the rest of the Compliance API; contact your Anthropic representative. Activity collection continues unaffected.

​
Rate Limiting

The Compliance API allows 600 requests per minute per parent organization, shared across every key and integration. On a 429 response, Wirespeed keeps its position and retries on the next sync.

​
Additional Resources