Query the Activity Feed

The Activity Feed records every authentication, chat, file, project, administrative, and platform action that occurs in your organization, in reverse chronological order. Activities are queryable within 1 minute of occurring and are retained for 6 years.

curl --fail-with-body -sS \
  "https://api.anthropic.com/v1/compliance/activities?limit=1" \
  --header "x-api-key: $ANTHROPIC_COMPLIANCE_ACCESS_KEY"

{
  "data": [
    {
      "id": "activity_01XyDMpzjS89pFZXqSFUBDr6",
      "created_at": "2026-04-10T08:09:10Z",
      "organization_id": "org_01Wv6QeBcDfGhJkLmNpQrSt8",
      "organization_uuid": "abcdef01-2345-6789-abcd-ef0123456789",
      "actor": {
        "type": "user_actor",
        "email_address": "[email protected]",
        "user_id": "user_01TuVwXyZaBcDeFgH2JkLmN4",
        "ip_address": "192.0.2.34",
        "user_agent": "Mozilla/5.0..."
      },
      "type": "claude_chat_created",
      "claude_chat_id": "claude_chat_01XyDMpzjS89pFZXqSFUBDr6",
      "claude_project_id": "claude_proj_01KGp4eZNug9ri4kE35RSppq"
    }
  ],
  "has_more": true,
  "first_id": "activity_01XyDMpzjS89pFZXqSFUBDr6",
  "last_id": "activity_01XyDMpzjS89pFZXqSFUBDr6"
}



Filter activities

Filter by organization, actor, activity type, or a created_at time window using the dotted sub-parameters created_at.gte, .gt, .lte, and .lt. See the API reference for each parameter's type and accepted values.

Repeatable parameters use array-bracket query syntax: pass activity_types[]=..., actor_ids[]=..., or organization_ids[]=... once for each value.

curl --fail-with-body -sS -G \
  "https://api.anthropic.com/v1/compliance/activities" \
  --data-urlencode "activity_types[]=claude_file_uploaded" \
  --data-urlencode "activity_types[]=claude_chat_created" \
  --data-urlencode "created_at.gte=2026-04-01T00:00:00Z" \
  --header "x-api-key: $ANTHROPIC_COMPLIANCE_ACCESS_KEY"

The Activity Feed produces hundreds of distinct activity types. See Query compliance activities in the API reference for the full list of values that activity_types[] accepts.



Paginate results

Activities are returned newest first, with ties in created_at broken by activity ID, and capped at limit results in each response (default 100, max 5,000). See the API reference for the full response schema.

The Compliance API uses two pagination schemes depending on the endpoint family:

Files do not paginate: they are retrieved individually by ID.

Pagination cursors and page tokens are opaque strings: pass them back unchanged. Their internal format is not stable, and parsing them will break without notice. Only one of after_id or before_id may be set in each request, and both schemes return has_more so you know when to stop. The session endpoints (local and remote) are the exception: they return next_page without has_more, so stop when next_page is null.

To page through activities:

• Pass the response's last_id as after_id to advance to the next page in result order. With activities sorted newest first, the next page contains older entries.
• Pass first_id as before_id to return to the previous page.
• Stop when has_more is false.

The cursor parameter sets the page direction; the endpoint's sort order sets the time direction. The same after_id parameter reaches older activities here. Chats sort oldest first; see Retrieve and delete chats, files, and projects for the cursor semantics there.

# Fetch the first page (newest activities first) and capture its trailing cursor.
last_id=$(curl --fail-with-body -sS \
  "https://api.anthropic.com/v1/compliance/activities?limit=2" \
  --header "x-api-key: $ANTHROPIC_COMPLIANCE_ACCESS_KEY" | jq -er '.last_id')

# Pass the cursor back unchanged to fetch the next (older) page.
curl --fail-with-body -sS -G \
  "https://api.anthropic.com/v1/compliance/activities" \
  --header "x-api-key: $ANTHROPIC_COMPLIANCE_ACCESS_KEY" \
  --data-urlencode "limit=2" \
  --data-urlencode "after_id=${last_id}"

A production backfill loop pages through older activities by driving iteration off has_more and last_id:

1. Start from your stored cursor (or omit after_id to start from the beginning).
2. Page through with after_id=<last_id> until has_more is false.
3. Persist the final last_id only after you've stored every page it covers.

cursor = stored_cursor
loop:
  if cursor is not null:
    page = GET /v1/compliance/activities?after_id={cursor}&limit=100
  else:
    page = GET /v1/compliance/activities?limit=100
  store(page.data)
  if page.last_id is not null:
    cursor = page.last_id
  if not page.has_more: break
persist(cursor)



Understand the Activity object

Every entry in data is an Activity with this top-level shape:

The actor field is a discriminated union. The type discriminator tells you which other fields are present: