Security posture results reference

This endpoint returns an entry for most of an organization’s security controls, evaluated at the time of the request, with the Security posture attestation that the response shows for each control. You need a Compliance Access Key that covers the organization, with the read:compliance_org_data or read:org_audit scope; Security posture availability says which organizations can be read.

Request

Send a GET request to /v1/compliance/organizations/{organization_id}/security_posture. Each call reads one organization, and the response is not paginated.

curl --fail-with-body -sS \
  "https://api.anthropic.com/v1/compliance/organizations/91012d09-e48b-438e-a489-1bebfd8fa6f9/security_posture" \
  -H "x-api-key: $ANTHROPIC_COMPLIANCE_ACCESS_KEY" \
  -H "anthropic-version: 2026-10-21"

Response

The following abridged example shows four of the controls that a response can contain. It is the response to a key that holds read:compliance_org_data and read:compliance_user_data.

{
  "type": "security_posture",
  "organization_id": "91012d09-e48b-438e-a489-1bebfd8fa6f9",
  "evaluated_at": "2027-02-09T09:00:02.417305Z",
  "comments_status": "not_enabled",
  "controls": [
    {
      "id": "sso_enabled",
      "display_name": "Single sign-on (SSO)",
      "section": "identity_access",
      "setting_name": "sso_enabled",
      "status": "passed",
      "rating": "passed",
      "current_value": "On",
      "desired_state": "On",
      "attestation": null
    },
    {
      "id": "directory_sync_enabled",
      "display_name": "Directory sync (SCIM)",
      "section": "identity_access",
      "setting_name": "directory_sync_enabled",
      "status": "failed_check_accepted_risk",
      "rating": "passed",
      "current_value": "Off",
      "desired_state": "On",
      "attestation": {
        "state": "in_force",
        "attested_at": "2026-10-20T15:04:00.220114Z",
        "comment": null,
        "attested_by": {
          "type": "user_actor",
          "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
        }
      }
    },
    {
      "id": "allowed_invite_domains",
      "display_name": "Allowed email domains",
      "section": "identity_access",
      "setting_name": "allowed_invite_domains",
      "status": "descriptive",
      "rating": "descriptive",
      "current_value": "example.com",
      "desired_state": null,
      "attestation": null
    },
    {
      "id": "oauth_conditional_access",
      "display_name": "OAuth conditional access on connected SaaS",
      "section": "connectors_integrations",
      "setting_name": null,
      "status": "not_attested",
      "rating": "not_attested",
      "current_value": null,
      "desired_state": "Completed",
      "attestation": {
        "state": "review_due",
        "attested_at": "2026-11-02T09:30:00.008771Z",
        "comment": null,
        "attested_by": {
          "type": "user_actor",
          "user_id": "user_01AbCdEfGhJkLmNpQrStUvWx"
        }
      }
    }
  ]
}

Every field is always present, and a field with no value is null, never left out. A time has either no fractional digits or six, so compare times as times, not as strings.

Top-level fields

controls[] fields

section is one of identity_access, data_privacy, capabilities, connectors_integrations, chats_desktop_mdm, cowork_admin_console, cowork_desktop_mdm, claude_code_admin_console, claude_code_managed_settings, and healthy_adoption.

To compare values in code, look up setting_name in the effective settings of the same organization. The lookup can find nothing, and two controls can share one setting_name.

attestation fields

attested_by fields

Status values

status gives the reason for a control’s result, and each status has one rating.

No field names the kind of control; for failed, a null current_value marks a manual control. More values can be added, so count a control with an unknown status by its rating and read an unknown rating as not Passed. The status review and the attestation state review_due are not related.

Attestation states

state says whether the attestation that the response shows is in effect.

When more than one reason applies, the response gives the first of check_passing, setting_changed, and review_due. From 00:00 UTC on its end date, an attestation is not in effect. The response has no end date, so state decides; an end date that was saved is the attestation activity’s review_date. Read an unknown state as not in effect.

How an attestation shows in the response

The response shows some attestations and leaves others out, so a null attestation does not prove that nobody attested.

Each row but the last two holds while the attestation is in effect. On an automatic control, an attestation is not in effect while the value that the check reads differs from the one that it was saved on. Every attestation that the response shows on an automatic control is an accepted risk. The Activity Feed also records attestations of the kinds that the response leaves out.

Count results

Check four things when you count controls by rating.

Who attested, and comments

attested_by is filled only for a key that holds read:compliance_user_data together with read:compliance_org_data or that holds read:org_audit. A key with only read:compliance_user_data gets a 403. The user_id in attested_by is the same as the actor’s user_id on the attestation activity. attested_by holds only the user ID: List organization users gives the name and email address of each current member. Before you add these scopes, see Who can see who attested.

The endpoint returns no comments, even when the Security posture page shows one: every comment is null, and comments_status is not_enabled or not_permitted. So not_enabled and a null comment do not mean the attestation has no comment. comments_status says how to read a null comment, and the schema defines these values.

More values can be added; read an unknown one as unavailable.

Errors

Errors use the same body as the rest of the Compliance API; this table lists the ones that this endpoint returns in its own way.

Causes of a 404:

• organization_id is not a UUID, names no organization, or names a deleted one.
• organization_id names the parent organization, an organization under another parent, or one that a single-organization key does not cover.
• The organization is not on Claude Enterprise, or Security posture is not available to it, as with a Claude Console organization.
• The Security posture page has been turned off for the organization (see Security posture availability).
• Security posture is available to the organization, but the endpoint does not serve it.
• Availability could not be checked; a later request can succeed.

Every 404 has the same body, as does a path that does not exist.

Freshness and side effects

The endpoint evaluates every control when you call it, and evaluated_at is that time.

• A change from the last few minutes might not show.
• A result can change with no setting changed, for example when an end date comes or Anthropic changes a recommended value.
• If Anthropic rewords a current value, an accepted risk on it is not in effect.
• A call stores no result and ends no attestation.
• Each request that passes the key, scope, and version checks without a query parameter records one compliance_api_accessed activity, whether it succeeds or fails; its url names the organization read, and organization_uuid is null for a key for the parent organization.