Claude (Anthropic)
Connect your Anthropic organization to Safeguard. The key each feature needs, why Anthropic's Admin keys are full access, and step-by-step setup.
Availability
The compliance tests and the usage, cost and Claude Code analytics pulls are switched on per workspace. If you do not see the card or the usage panel, ask your Safeguard contact.
What it does
Safeguard reads your own Anthropic organization with your own key. It reads members, invites, API keys and compliance settings for continuous compliance tests, such as access reviews and key age. It also reads usage, cost and Claude Code analytics every day, and builds per-person, per-key and per-workspace baselines. Days well above a baseline become AI Detection & Response (AIDR) detections in Detection & Response. The card is Claude (Anthropic) under Compliance > Connectors (Business Applications); the usage view is the card's Usage, cost and AIDR baselines panel.
Public vs private
| Public | Private | |
|---|---|---|
| What you enter | Nothing; there is no public mode | An Anthropic key |
| Credential needed | None | A Claude Console Admin API key, or a Claude Enterprise Compliance API key |
| What you can read | Nothing | Your organization's members, keys, settings and, with an Admin key, usage, cost and Claude Code analytics |
Supported auth methods
| Method | Use it when | Notes |
|---|---|---|
Claude Console Admin API key (sk-ant-admin01-...) | Your organization uses the Claude Console (platform.claude.com); needed for usage, cost and Claude Code analytics | Full access: Anthropic has no read-only Admin key |
Claude Enterprise Compliance API key (sk-ant-api01-...) | Your organization uses Claude Enterprise (claude.ai) | Scoped at creation; compliance tests only, no usage or cost |
If you use both the Console and Claude Enterprise, make one connection for each.
Permissions required
Safeguard only sends read requests (GET) with either key. Anthropic's Admin keys cannot be narrowed, so least privilege comes from the key's expiry and from who holds it.
Claude Console Admin API key
| Permission / scope | Required? | What Safeguard uses it for |
|---|---|---|
| Admin API key created by an organization admin (no scopes exist; every Admin key is full access) | Required | Members, invites, API keys, workspaces (/v1/organizations/users, /invites, /api_keys, /workspaces), usage (/v1/organizations/usage_report/messages), cost (/v1/organizations/cost_report) and Claude Code analytics (/v1/organizations/usage_report/claude_code) |
| Compliance API turned on (Console > Settings > Security) | Optional | The audit-log test (/v1/organizations/compliance_settings); recording starts when it is turned on and is not retroactive |
Least privilege: Anthropic offers no read-only Admin key. Create a dedicated Admin key named "Safeguard", give it an expiry of 90 days or less, and rotate it.
Claude Enterprise Compliance API key
| Permission / scope | Required? | What Safeguard uses it for |
|---|---|---|
read:members | Required | Members and invites for the access tests |
read:compliance_org_data | Required | Organization settings: SSO enforcement, data retention, Compliance API keys |
read:compliance_activities | Required | The Activity Feed (audit test, and Security Operations events) |
Least privilege: exactly these three scopes. Never add read:compliance_user_data (it reads chats, files and transcripts), read:org_audit, or any write: or delete: scope.
Token types
| Token type | Works? | Notes |
|---|---|---|
Claude Console Admin API key (sk-ant-admin01-...) | Yes (recommended for usage and cost) | Full access; Anthropic has no read-only Admin key |
Claude Enterprise Compliance API key (sk-ant-api01-...) | Yes, compliance tests only | Usage and Claude Code analytics for claude.ai come from Anthropic's Enterprise Analytics API, which this connector does not read yet |
Claude API key for calling models (sk-ant-api03-...) | No | Refused before any call |
| Workspace API keys | No | Cannot read usage, cost or Claude Code analytics |
Expiry: set an expiry of 90 days or less when you create the key. When it expires, the card shows Not working and the panel's last error asks you to reconnect.
What we never need: a key that calls models, read:compliance_user_data, read:org_audit, or any write or delete scope. Safeguard never changes roles, removes members or deactivates keys, even though an Admin key could.
Step-by-step setup
Create the credential in Anthropic
For the Claude Console:
- An organization admin opens Claude Console > Settings > Admin keys and clicks Create key.
- Name it "Safeguard" and set an expiration.
- Copy the key (it starts
sk-ant-admin01-). The Console shows it only once. - Optional: turn on Settings > Security > Compliance API for the audit-log test.
For Claude Enterprise:
- The primary owner opens claude.ai > Organization settings > API and turns on the Compliance API.
- Under Keys, click Create key and choose only
read:members,read:compliance_org_dataandread:compliance_activities. - Copy the key (it starts
sk-ant-api01-). It is shown only once.
Or with the Anthropic CLI
Anthropic has no CLI for creating Admin or Compliance API keys.
Connect it in Safeguard
- Open Compliance > Connectors and find Claude (Anthropic) under Business Applications.
- Choose API token and paste the key. Leave Organization ID blank to cover every linked organization (Claude Enterprise only).
- Save. The card shows Verified after the first successful read.
- With an Admin key, open the card's Usage, cost and AIDR baselines panel and click Sync now. The first pull reads the last 35 days.
Webhooks and triggers
This integration has no webhooks. Usage, cost and Claude Code analytics are pulled once a day (the last two days are re-read each time, because Anthropic finalizes recent buckets late), compliance tests run on their schedule, and Sync now pulls on demand.
What we read and store
- Read: members and invites (email, role, dates), API key metadata (name, status, created by, expiry; never the secret), workspaces, daily usage per model, key, workspace and account (tokens and requests), daily cost per workspace and line item, and Claude Code analytics per person (sessions, lines added and removed, commits, pull requests, tool acceptance, estimated cost). Every list is read to the end.
- Stored: daily usage and cost rows, the Claude Code daily rows, the baselines, compliance test results and evidence, and AIDR detections for usage spikes. The key is encrypted at rest, never logged and never shown again after you save it.
- Not stored: prompts, completions, chats, files or transcripts. Safeguard does not read them.
- No customer data from this integration is sent to third-party LLMs. These are reads of your own Anthropic account with your own key; nothing is sent to any AI model.
Not covered: Priority Tier costs (Anthropic leaves them out of the cost report), and usage through Amazon Bedrock, Google Vertex AI or Microsoft Foundry, which Anthropic does not report.
Troubleshooting
| Message you see | Cause | Fix |
|---|---|---|
Reconnect the Claude (Anthropic) connector with a current Admin API key (sk-ant-admin01-...) from Claude Console > Settings > Admin keys; the stored one was revoked, expired or mistyped. | Anthropic answered 401 | Create a new Admin key and reconnect |
Use an Admin API key (sk-ant-admin01-...) created by an organization admin. Workspace API keys cannot read usage, cost or Claude Code analytics. | Anthropic answered 403, or the key is a model key | Use an Admin key |
These reports need a Claude Console organization (not an individual account and not Claude Platform on AWS). | The organization has no usage or cost reports | Connect a Claude Console organization |
For a Claude Console organization, add a second connection with an Admin API key (sk-ant-admin01-...). | The connection holds a Claude Enterprise key, which cannot read usage | Add an Admin key connection for usage; keep the Enterprise one for compliance |
AI vendor usage for this provider is not enabled for this account. | Usage pulls are not switched on for your workspace | Ask your Safeguard contact |
Rotation and disconnect
- Rotate: create a new key in Anthropic, edit the connection in Compliance > Connectors, paste the new key and save. Then delete the old key in Claude Console > Settings > Admin keys (or claude.ai > Organization settings > API).
- Disconnect: delete the connection in Compliance > Connectors, then delete the key in Anthropic. Pulled rows and evidence stay for your audit trail until your retention removes them.
Vendor references
- Admin API overview, checked 2026-10-16.
- Admin API keys, checked 2026-10-16.
- Usage and Cost API, checked 2026-10-16.
- Claude Code Analytics API, checked 2026-10-16.
- Compliance API access, checked 2026-10-16.
- List workspaces, checked 2026-10-16.
OpenTelemetry (OTLP)
Connect Claude Code, Codex and any OpenTelemetry Collector to Safeguard. The ingest token each exporter needs, which settings work, and step-by-step setup.
OpenAI API Platform
Connect your OpenAI organization to Safeguard. The Admin key it needs, why OpenAI's Admin keys are full access, and step-by-step setup.