Retrieve session transcripts

The endpoints on this page expose transcripts of the sessions your users run in Claude apps and agents (today, Cowork and Claude Code) from your Claude Enterprise organizations to compliance reviewers. Each session is a single conversation with Claude; its transcript is the sequence of user prompts, assistant responses, and tool calls and results in that conversation. The endpoints support eDiscovery (electronic discovery) exports and data loss prevention (DLP) enforcement.

The Compliance API groups sessions into two endpoint families according to where they run: local session endpoints for sessions on users' machines, and remote session endpoints for sessions that run in the cloud in Anthropic-managed environments. Both families are read-only, and neither is available to Admin API keys (sk-ant-admin01-...): calls authenticated with an Admin API key return 403 Forbidden.

The following table maps each product, and where it runs, to the endpoint family that returns its sessions and the product_surface value that identifies them in responses. Products are added to this table as coverage expands.

Capture of local sessions is tied to the Compliance API being enabled for your organization and applies while users are signed in with their Claude Enterprise account. The session endpoints do not return the following:

• Claude Code sessions authenticated with a Claude Console API key, or run through a third-party cloud platform such as Amazon Bedrock, Google Cloud, or Microsoft Foundry.
• Claude Code on the web. It also runs in the cloud in Anthropic-managed environments, but it is not a remote session; the remote session endpoints return Cowork sessions only.
• Local sessions in organizations with HIPAA readiness enabled. No local session data is captured, so the local session endpoints return no sessions for those organizations.
• Local sessions for which zero data retention (ZDR) is in effect. These sessions are excluded from list results, and the retrieve and messages endpoints return 404 for them.

The following table summarizes how local sessions and remote sessions differ.



Sessions on users' machines (local sessions)

Local sessions run on users' machines while they are signed in with their Claude Enterprise account: today, Cowork in Claude Desktop, and Claude Code in the terminal, in Claude Desktop, or in an IDE extension.

The Compliance API exposes local sessions through three endpoints: GET /v1/compliance/apps/sessions/local lists session metadata, GET /v1/compliance/apps/sessions/local/{session_id} retrieves one session's metadata, and GET /v1/compliance/apps/sessions/local/{session_id}/messages returns one session's transcript. All three require the read:compliance_user_data scope and count only against the shared Compliance API rate limit; they are not subject to the second request budget that applies to the remote session endpoints. See 429 Too Many Requests. If local sessions are not available to your parent organization, all three endpoints return 404 with the message Local sessions are not available. (see Local session not found); while session listings or captured content are temporarily unavailable, they return 503 (see Local sessions temporarily unavailable).

For local sessions, Anthropic records each conversation server-side as its requests reach the Claude API; nothing is installed on the device, and nothing is collected beyond the requests the client already sends to the Claude API. Local session transcripts show what Claude was asked to do and what it returned, not what happened on the device. File and network activity is visible only through the tool calls and tool results in the transcript, so activity that never reaches the API (for example, local files the session never sent) is not captured.

In organizations that use customer-managed encryption keys, local sessions are listed and retrievable as usual, but transcript content is not currently returned; each message comes back with its content marked unavailable (see Retrieve a local session transcript for how such messages are marked).

The list endpoint returns session metadata, with no transcript content, for every linked organization your key can read. Unlike the remote session list, it has no organization or user filters: bound the results in time with the created_at.gte and created_at.lt parameters. Both take RFC 3339 timestamps with a required UTC offset, and when both are supplied, created_at.lt must be strictly after created_at.gte or the request returns 400 Bad Request. New sessions and messages appear in results after a short processing delay, typically within minutes; a session that is missing immediately after it starts is not necessarily uncaptured. The following request lists sessions created since a given date.

curl --fail-with-body -sS -G \
  "https://api.anthropic.com/v1/compliance/apps/sessions/local" \
  --header "x-api-key: $ANTHROPIC_COMPLIANCE_ACCESS_KEY" \
  --data-urlencode "created_at.gte=2026-07-01T00:00:00Z" \
  --data-urlencode "limit=100"

{
  "data": [
    {
      "type": "compliance_local_session",
      "id": "clls_01HxKpLmNoPqRsTuVwXyZaBc",
      "organization_uuid": "9a1e0000-0000-0000-0000-000000000000",
      "workspace_id": "wrkspc_01SvYKoWVRVHoEbwESNvzYdR",
      "user": {
        "id": "user_01GpKpLmNoPqRsTuVwXyZaBc",
        "email_address": "[email protected]"
      },
      "product_surface": "cowork",
      "created_at": "2026-07-09T14:02:11Z"
    },
    {
      "type": "compliance_local_session",
      "id": "clls_01HyLqMnOpQrStUvWxYzAbCd",
      "organization_uuid": "9a1e0000-0000-0000-0000-000000000000",
      "workspace_id": null