Overview

As enterprise teams adopt generative AI models like Anthropic Claude for daily engineering, operational, and business workflows, security and compliance teams require centralized visibility into LLM activity, administrative events, and audit logs.

Swif's Claude Compliance Integration connects directly to Anthropic’s Compliance Activity Feed API via Swif Agentic Security. This integration enables automatic, continuous ingestion of Claude audit logs into your Swif workspace—giving security teams centralized audit trails, risk analysis, and compliance reporting across both local AI agent tools and organization-wide Claude usage.

What Does Claude Compliance Integration Provide?

Automated Audit Event Ingestion: Periodically pulls organization-wide activity feed events directly from Anthropic’s Compliance API (/v1/compliance/activities).
Centralized AI Governance: Correlates Claude workspace actions, user sessions, and administrative modifications alongside endpoint AI agent activities in the Swif console.
Resilient, Checkpointed Syncing: Uses durable cursor-based tracking and automated backoff handling (Retry-After on 429 rate limits) to guarantee zero data loss during network disruptions or API restarts.
Enterprise Data Retention: Ingested compliance and activity logs are securely retained for 6 months with automated, bounded lifecycle purging.
Zero-Credential Exposure: Sensitive API tokens are encrypted, stored in ST-APIs, retrieved at runtime by Agentic Security, and automatically masked across logs and diagnostic endpoints.

What You'll Need

An active Swif Enterprise Workspace with Administrator privileges (app.swif.ai or app.eu.swif.ai).
Swif Agentic Security enabled for your organization. For setup instructions, see Getting Started with Swif's Agentic Security for Enterprise.
An Anthropic Claude Admin API Key (sk-ant-admin01-...) with read:compliance_activities permissions from the Anthropic Console.

Step-by-Step Setup Guide

Step 1: Generate an Admin API Key in Anthropic Claude Console

Log in to your organization's Anthropic Claude Console.
Navigate to Settings → Admin Keys (platform.claude.com/settings/admin-keys).
Generate a new Admin API key (prefixed with sk-ant-admin01-...).
Copy the key securely to your clipboard.

Note: The Compliance Activity Feed requires an Admin API Key. Standard Claude API keys (sk-ant-api03-...) used for completion/inference models do not have permission to query compliance endpoints.

Step 2: Open Integrations in the Swif Console

Sign in to your Swif workspace at app.swif.ai (or app.eu.swif.ai).
In the left navigation menu, go to Settings → Integrations (or visit app.swif.ai/org/account/integration).

Step 3: Connect Claude Compliance

In the Integration Catalog search bar, search for Claude Compliance.
Click on the Claude Compliance card or select Connect.
In the configuration dialog:
- Paste your Anthropic Admin API Key (sk-ant-admin01-...) into the API Key input field.
- Review the notice confirming that Agentic Security is required for event processing.
Click Connect / Save.

Once saved, the integration card will immediately reflect a Connected status.

Step 4: Monitor Activity & Audit Logs

Once configured:

The Swif Agentic Security server securely retrieves the configuration token and initiates periodic polling against the Anthropic Compliance Activity Feed.
Ingested events, actor details, user agents, and timestamps appear directly within your Agentic Security Activity Stream and audit logs.
You can filter events by user, activity type, risk score, and date range.

Managing Your Integration

Updating Your API Key

Navigate to Settings → Integrations → Claude Compliance.
Click Settings / Edit.
Enter your new Claude Admin API key and click Update / Save. The active token will update seamlessly without duplicate records or sync interruptions.

Disconnecting the Integration

Open the Claude Compliance integration card in Settings → Integrations.
Click Disconnect or Remove.
Once removed, Swif Agentic Security immediately halts polling cycles for your organization. Historical logs remain accessible in accordance with your organization's 6-month retention policy.

Frequently Asked Questions (FAQ)

Q: Which Anthropic API key type is required?

A: You must use an Anthropic Admin API Key (sk-ant-admin01-...) generated from the Claude Console Admin Keys section. Standard API keys (sk-ant-api03-...) do not have access to the Compliance API.

Q: How frequently does Swif pull compliance data from Claude?

A: Swif Agentic Security runs automated, sequential polling cycles against the Anthropic /v1/compliance/activities endpoint, using durable cursors to capture new events promptly while respecting Anthropic's rate limits (600 requests/min per parent organization).

Q: How long are Claude Compliance audit logs retained?

A: By default, Claude activity logs are retained for 6 calendar months based on event occurrence time (occurred_at), after which records are automatically pruned via bounded cleanup cycles.

Q: Is the API token exposed in logs or client-side responses?

A: No. Tokens are stored securely in backend credential vaults, retrieved dynamically via authenticated internal service routes, masked in memory, and stripped from all diagnostic outputs and client API responses.

Q: Does Claude Compliance monitoring replace the endpoint Agentic Security agent?

A: No. Claude Compliance monitors organization-level Claude workspace activity and administrative actions via cloud APIs, while the local Agentic Security agent monitors local tool execution, command execution, and file operations on employee machines. Using both provides full-spectrum AI governance.

Integrating Anthropic Claude Compliance with Swif Agentic Security