Get access to the Compliance API

The Compliance API uses two key types, and which one you create depends on which Claude product your organization uses. Primary owners create Compliance Access Keys in claude.ai; these keys unlock the full Compliance API. Organization admins create Admin API keys in Claude Console; these keys unlock the Activity Feed only.

Which key do you need?

A Claude Enterprise tenant has one parent organization that centralizes identity, SSO, and SCIM for every workload organization beneath it. These workload organizations are the parent's linked organizations.

Enable the Compliance API for your organization

The enablement path depends on which Claude product your organization uses. Whichever path you use, enablement happens at the parent organization level and cascades to every linked organization, both claude.ai and Claude Console.

Enable for claude.ai organizations

For claude.ai organizations on the Claude Enterprise plan, the primary owner enables the Compliance API in Organization settings > Data and privacy at claude.ai/admin-settings/data-privacy-controls: click Enable under Compliance API. After enablement, a Compliance access keys section appears on the same page.

Enable for Claude Console organizations

Contact your Anthropic representative to request access. Admin API keys created after the Compliance API is enabled carry the read:compliance_activities scope. Admin API keys created before enablement continue to work with the Admin API, but calling the Activity Feed with one returns 403 Forbidden.

Create a Compliance Access Key

Create an Admin API key

Admin API keys carry the read:compliance_activities scope only when the Compliance API was enabled for the organization before the key was created; see Enable for Claude Console organizations. They cannot be granted any other Compliance API scope, so calls to any endpoint other than the Activity Feed return 403 Forbidden.

For the same key's role in managing your Claude Console organization, see Admin API.

Check your key's scopes

To inspect the scopes on a key you already have, use one of the following signals.

• Key prefix. sk-ant-admin01- is an Admin API key (carries read:compliance_activities only, subject to the enablement timing in the preceding section). sk-ant-api01- is a Compliance Access Key; its scopes are the subset you selected at creation.
• Settings UI. Open the Compliance access keys section in claude.ai Organization settings > Data and privacy, or the Admin keys section in Claude Console, and read the Scopes column for the key.
• Error responses. A call that exceeds the key's scopes returns a 403 with a message in the format Missing required scopes. Got: [<scopes the key carries>] Needed: [<scopes the endpoint requires>]. See Handle Compliance API errors for the full error catalog.

{
  "error": {
    "type": "permission_error",
    "message": "Missing required scopes. Got: ['read:compliance_activities'] Needed: ['read:compliance_user_data']"
  }
}

Manage and rotate keys

Delete a Compliance Access Key from the same Compliance access keys panel where you created it: go to claude.ai > Organization settings > Data and privacy. Delete an Admin API key from Claude Console > Settings > Admin keys.

Deleting a key takes effect on the next request: there is no grace period. Compliance Access Keys do not expire on their own.

To rotate a key without an outage:

1. Create a new key with the same scopes.
2. Update your integration to use the new key.
3. Verify the integration succeeds with the new key.
4. Delete the old key.

Pagination cursors stored before a rotation remain valid: cursors are scoped to the organization, not the key.

If a Compliance Access Key leaks, delete it immediately, audit the Activity Feed for compliance_api_accessed activities by the compromised key, and rotate any downstream credentials that the leaked key could reach. Filter on actor.type api_actor and actor.api_key_id to find requests made by the compromised key.

Next steps