Claude Compliance API supportForceAI Security Announces Support for Claude Compliance API
Configure compliance and governance ingestion safely. Learn how to connect Claude Enterprise Compliance APIs for ultimate AI workspace visibility, threat auditing, risk scoring, and evidence automation.
Enterprise SLA response within Under 1 hour
Confidential Customer Setup Guide
Important Credential SafeguardsCustomers should never share API keys over email or screenshots. Keys should be entered only into the secure PineSMITH integration screen and stored according to the customer’s enterprise secrets policy.
Central compliance and security governance plane delivering complete audit telemetry, user scopes, and file metrics for the corporate Claude deployment workspace.
ForceAI PineSMITH helps organizations connect Claude Enterprise compliance and governance data into a centralized AI security control plane. After the connection is configured, PineSMITH can ingest Claude activity, organization metadata, users, roles, groups, chats, files, projects, and project-related evidence based on the scopes granted by the customer.
After setup, customer teams can see Claude activity and governance data in PineSMITH dashboards, including usage activity, users, organizations, project context, file activity, risk signals, and audit-ready evidence.
PineSMITH connects to Anthropic Claude Enterprise through the Anthropic Compliance API. The API is enabled by Anthropic on request. Claude Enterprise organizations have access to the full Compliance API. Claude Console organizations can use Activity Feed access only.
| Connection Area | Customer Data Source | What PineSMITH Can Show |
|---|---|---|
| Activity Feed | GET /v1/compliance/activities | Authentication, chat, file, project, administrative, and platform activity events. |
| Directory inventory | Organizations, users, roles, groups, group members | Who has Claude access, role assignments, group membership, and organization structure. |
| Content review | Chats, messages, files, generated files, artifacts, projects, attachments | Claude.ai content and metadata for audit, eDiscovery, DLP review, and compliance evidence. |
| Governance enrichment | PineSMITH policy engine and risk models | Risk scoring, sensitive data findings, policy decisions, compliance workflow status, and SIEM exports. |
The Claude Compliance API is not the same as a Claude model API key. A Claude API key calls Claude models. A Compliance Access Key is used for compliance, audit, governance, and organization data access.
| Requirement | Why it matters | Owner |
|---|---|---|
| Compliance API enabled | Anthropic must enable the API before keys can be created and used. | Customer + Anthropic representative |
| Primary Owner role | Only the Claude Enterprise Primary Owner can create Compliance Access Keys. | Customer Claude administrator |
| Read-only scopes | PineSMITH needs read scopes to ingest data and display dashboards. | Customer security/compliance team |
| Secure key handling | The Compliance Access Key can access sensitive organizational content based on scopes. | Customer security team |
| PineSMITH admin access | Required to configure, test, and monitor the integration. | Customer PineSMITH administrator |
For a customer-facing, read-only PineSMITH deployment, ForceAI recommends using a Claude Compliance Access Key with the three read scopes listed below. The delete scope should not be granted unless the customer has a separately approved deletion workflow.
| Scope | Purpose | Recommended for PineSMITH |
|---|---|---|
| read:compliance_activities | Reads the Claude Activity Feed. | Required |
| read:compliance_user_data | Reads chats, messages, files, projects, users, and group members. | Recommended for full visibility |
| read:compliance_org_data | Reads organization metadata, roles, and groups. | Recommended for inventory and access governance |
| delete:compliance_user_data | Deletes chats, files, and projects. | Not recommended by default |
read:compliance_user_data and read:compliance_org_data.| Key Type | Created in | What it supports | Use with PineSMITH |
|---|---|---|---|
| Compliance Access Key | claude.ai > Organization settings > Data and privacy | Full Compliance API depending on selected scopes. | Preferred for Claude Enterprise integration |
| Admin API key | Claude Console > Settings > Admin keys | Activity Feed only when created after Compliance API enablement. | Use only for activity-only monitoring |
| Claude API key | Claude Console > Settings > API keys | Calls Claude models. | Do not use for Compliance API ingestion |
| Analytics API key | Claude Analytics | Aggregated usage and cost analytics. | Not used for this connection |
Send a formal enablement request through your designated Anthropic partner account representative.
Steps to follow:
Sign-in to management portal to set API visibility scopes.
claude.ai as the Primary Owner of the Claude Enterprise organization.ForceAI PineSMITH or another customer-approved name.read:compliance_activities, read:compliance_user_data, and read:compliance_org_data.delete:compliance_user_data unless your organization has explicitly approved deletion workflows.Compliance Access Keys may grant access to sensitive organizational content. Do not send keys through email, chat, ticket comments, screenshots, or shared documents.
Activate connection via the central Console dashboard.
During initial ingestion, PineSMITH validates the key and collects data according to the enabled scopes and selected ingestion mode:
| Step | PineSMITH Action | Expected Result |
|---|---|---|
| 1 | Validate key format and API reachability. | Connection is accepted or a clear error is shown. |
| 2 | Read Activity Feed access. | Recent Claude activity appears in the PineSMITH audit trail. |
| 3 | Read organizations. | Claude organizations appear in inventory. |
| 4 | Read users, roles, groups, and memberships. | User and access governance views populate. |
| 5 | Read chats, projects, files, and attachments if enabled. | Content review and project evidence views populate. |
| 6 | Run PineSMITH enrichment. | Risk levels, policy findings, and evidence statuses appear. |
After the first snapshot, PineSMITH can refresh data based on the customer’s configuration. Common options include manual refresh, scheduled refresh, or cursor-based incremental ingestion for ongoing monitoring:
The audit trail provides a searchable record of Claude activity events. Customers can filter by user, organization, activity type, project, time range, risk level, and policy status.
| Field | Example / Description |
|---|---|
| Time | Timestamp when the activity occurred. |
| User / actor | User email, user ID, API actor, or administrative actor when available. |
| Organization | Claude organization where the activity occurred. |
| Activity type | Examples include chat created, file uploaded, project activity, sign-in, admin action, or Compliance API access. |
| Source IP / user agent | Useful for correlation with VPN, endpoint, and SIEM logs. |
| Chat or project ID | Linked resource identifiers when the activity relates to a Claude chat or project. |
| Risk level | PineSMITH-computed risk level based on policy, context, and data sensitivity. |
| Status | Observed, allowed, flagged, held for review, or escalated depending on customer policy. |
If the customer enables content review scopes and selects the appropriate PineSMITH ingestion mode, PineSMITH can display chat metadata, messages, uploaded files, generated files, artifacts, and project context:
| Content Type | What Customer Can See | Use Case |
|---|---|---|
| Chat metadata | Chat name, user, model, project, created/updated timestamps, deleted status. | eDiscovery, audit scoping, usage visibility |
| Messages | Prompt and response content when content ingestion is enabled. | DLP review, legal review, regulated communication oversight |
| Uploaded files | File name, MIME type, file ID, source chat or project. | Sensitive data detection, incident review |
| Generated files | Files created by Claude/tooling during the conversation. | Output review and compliance evidence |
| Artifacts | Versioned text/code/markdown outputs created by Claude. | Versioned evidence and change review |
| Projects | Project metadata, instructions, attachments, and related chats. | Project-level governance and knowledge-base review |
Where data is available, PineSMITH can help customers understand which Claude models, projects, and MCP-related assets are active. This supports AI inventory, governance, and risk analysis:
After connecting Claude Enterprise to PineSMITH, customers should validate the integration before relying on the data operationally:
| Validation Item | Expected Result | Status |
|---|---|---|
| Connection test passes | PineSMITH confirms API reachability and key validity. | To verify |
| Scopes visible | PineSMITH shows read:compliance_activities, read:compliance_user_data, and read:compliance_org_data if enabled. | To verify |
| Activity Feed data appears | Recent Claude activity appears in the audit trail. | To verify |
| Organizations populate | Claude linked organizations appear in inventory. | To verify |
| Users populate | Users appear with email, ID, role, and organization mapping. | To verify |
| Roles/groups populate | Roles and groups appear if the scope permits access. | To verify |
| Chats/projects appear | Content metadata appears if user-data scope and mode permit it. | To verify |
| Risk enrichment appears | PineSMITH assigns risk levels and policy findings where applicable. | To verify |
| SIEM export works | Events arrive in the customer’s SIEM if forwarding is enabled. | Optional |
| Issue | Likely cause | Customer Action |
|---|---|---|
| Connection test fails with invalid key | Key was copied incorrectly, revoked, or missing. | Create or rotate the key and paste it again. |
| 403 missing scope | The key does not include the required scope for the requested data. | Create a new Compliance Access Key with the approved scopes. |
| Activity Feed works but users/chats do not appear | Admin API key or activity-only scope is being used. | Use a Compliance Access Key with read:compliance_user_data and read:compliance_org_data. |
| Models or projects show limited data | No recent activity or limited access scope. | Generate approved test activity and run a new ingestion. |
| Files are missing | File content is unavailable, deleted, or outside retention. | Confirm the file exists and retention policy has not removed it. |
| Rate limit warning | Too many Compliance API calls are being made across the parent organization. | Allow PineSMITH backoff to complete or reduce sync frequency. |
| No Claude Console content appears | Compliance API content endpoints cover claude.ai content, not Claude API prompt-response payloads. | Use PineSMITH runtime monitoring, API gateway, endpoint, or SIEM telemetry for Claude API workloads. |
| Deleted content cannot be retrieved | Content was hard-deleted or retention removed it. | Use existing evidence archive if previously enabled. |
No. A Claude API key is used to call Claude models. PineSMITH requires a Compliance Access Key for full Claude Enterprise Compliance API ingestion, or an Admin API key for Activity Feed-only ingestion.
No. Delete permissions are not recommended for a standard read-only monitoring deployment.
Yes. Customers can start with read:compliance_activities and later expand to organization and user-data scopes when ready.
Only if the customer grants the required user-data scope and enables a PineSMITH ingestion mode that retrieves content.
No. Claude API workloads may require additional PineSMITH runtime monitoring, API gateway logging, endpoint sensor, browser monitoring, IDE monitoring, or SIEM ingestion.
Activity events are typically available shortly after they occur. PineSMITH display timing depends on the customer’s configured sync frequency and ingestion mode.
Yes. The customer can delete or rotate the Compliance Access Key from Claude settings at any time.
Yes, if enabled. PineSMITH can normalize events and forward them to supported SIEM or data platforms.
| PineSMITH Field | Claude Compliance API Source | Purpose |
|---|---|---|
| Event ID | activity.id | Unique event tracking and deduplication. |
| Event time | created_at | Time-window filtering and SIEM correlation. |
| Organization | organization_uuid / organization_id | Organization-level reporting and filtering. |
| Actor type | actor.type | User, API key, admin key, or system actor classification. |
| User email | actor.email_address | User-friendly identity display. |
| User ID | actor.user_id | Stable identity correlation across events. |
| IP address | actor.ip_address | Network and endpoint investigation. |
| User agent | actor.user_agent | Device/browser context. |
| Activity type | type | Event category and workflow routing. |
| Chat ID | claude_chat_id | Join activity to chat metadata and messages. |
| Project ID | claude_project_id | Join activity to project metadata and attachments. |
| Risk level | PineSMITH computed | Policy and investigation prioritization. |
| Policy status | PineSMITH computed | Observed, flagged, held, escalated, or allowed. |
| Phase | Recommended Action | Outcome |
|---|---|---|
| Phase 1: Connect | Enable Compliance API, create read-only key, connect PineSMITH, run test ingestion. | Initial visibility into Claude activity. |
| Phase 2: Validate | Confirm users, organizations, Activity Feed, projects, and content mode. | Trusted baseline and operational readiness. |
| Phase 3: Govern | Enable risk policies, review queues, SIEM forwarding, and reporting. | Actionable governance workflows. |
| Phase 4: Expand | Add runtime monitoring for API workloads, IDEs, browsers, agents, and other AI providers. | Unified AI security control plane. |
For ForceAI PineSMITH integration support, contact your ForceAI Security representative or designated support channel. Provide the integration name, PineSMITH tenant, approximate timestamp of the issue, and any non-sensitive error details. Do not include Compliance Access Keys or secrets in support tickets. Email us directly at [email protected].
For customer safety, blur keys in screenshots, do not email secrets, and validate all data handling decisions with the customer’s security and privacy teams before enabling full content ingestion.