Overview

As enterprise teams adopt generative AI models like Anthropic Claude for daily engineering, operational, and business workflows, security and compliance teams require centralized visibility into LLM activity, administrative events, and audit logs.

Swif's Claude Compliance Integration connects directly to Anthropic’s Compliance Activity Feed API via Swif Agentic Security. This integration enables automatic, continuous ingestion of Claude audit logs into your Swif workspace—giving security teams centralized audit trails, risk analysis, and compliance reporting across both local AI agent tools and organization-wide Claude usage.

What Does Claude Compliance Integration Provide?

Automated Audit Event Ingestion: Periodically pulls organization-wide activity feed events directly from Anthropic’s Compliance API (/v1/compliance/activities).
Centralized AI Governance: Correlates Claude workspace actions, user sessions, and administrative modifications alongside endpoint AI agent activities in the Swif console.
Resilient, Checkpointed Syncing: Uses durable cursor-based tracking and automated backoff handling (Retry-After on 429 rate limits) to guarantee zero data loss during network disruptions or API restarts.
Enterprise Data Retention: Ingested compliance and activity logs are securely retained for 6 months with automated, bounded lifecycle purging.
Zero-Credential Exposure: Sensitive API tokens are encrypted, stored in ST-APIs, retrieved at runtime by Agentic Security, and automatically masked across logs and diagnostic endpoints.
Claude Compliance Dashboard: A dedicated Claude Compliance page under Agentic Security. It shows the integration's health, when Swif last checked and will next check, and a searchable log of Claude audit activity.

What You'll Need

An active Swif Enterprise Workspace with Administrator privileges (app.swif.ai or app.eu.swif.ai).
Swif Agentic Security enabled for your organization. For setup instructions, see Getting Started with Swif's Agentic Security for Enterprise.
An Anthropic Claude Admin API Key (sk-ant-admin01-...) with read:compliance_activities permissions from the Anthropic Console.

Step-by-Step Setup Guide

Step 1: Generate an Admin API Key in Anthropic Claude Console

Log in to your organization's Anthropic Claude Console.
Navigate to Settings → Admin Keys (platform.claude.com/settings/admin-keys).
Generate a new Admin API key (prefixed with sk-ant-admin01-...).
Copy the key securely to your clipboard.

Note: The Compliance Activity Feed requires an Admin API Key. Standard Claude API keys (sk-ant-api03-...) used for completion/inference models do not have permission to query compliance endpoints.

Step 2: Open Integrations in the Swif Console

Sign in to your Swif workspace at app.swif.ai (or app.eu.swif.ai).
In the left navigation menu, go to Settings → Integrations (or visit app.swif.ai/org/account/integration).

Step 3: Connect Claude Compliance

In the Integration Catalog search bar, search for Claude Compliance.
Click on the Claude Compliance card or select Connect.
In the configuration dialog:
- Paste your Anthropic Admin API Key (sk-ant-admin01-...) into the API Key input field.
- Review the notice confirming that Agentic Security is required for event processing.
Click Connect / Save.

Once saved, the integration card will immediately reflect a Connected status.

Tip: You can also connect from Agentic Security → Claude Compliance. If the integration isn't set up yet, the page shows a Not Connected status. Click Connect Claude Compliance to open the integration dialog, or Setup Guide to come back to this article.

Step 4: Monitor Activity & Audit Logs

After you connect, Swif Agentic Security gets your configuration token securely and starts checking Anthropic's Compliance Activity Feed on a regular schedule. To see the collected activity:

1) In the left menu, go to Agentic Security → Claude Compliance.

2) Check the connection status in the top-right corner of the page:

Status	What it means
Not Connected	Claude Compliance hasn't been set up yet. Click the status, then Connect Integration.
Connected	Your Admin API key is valid and Swif is collecting events.
Failing	Swif can't collect activity, usually because the Admin API key is invalid, expired, or revoked. An error banner explains the problem.

3) Click the status to see collection health:

Last Check: When Swif last checked your Anthropic connection.
Next Check: When the next connection check is due.
Last Worked: Shown only when the status is Failing. This is the last time the connection worked.
Manage Integration or Update API Key: Opens the integration dialog.

Activity Log

The activity table lists Claude audit events, newest first. Events are kept for 6 months. Each row shows:

Timestamp
Event Type (for example, compliance_api_accessed)
Category (for example, compliance)
Actor (email or ID)
IP Address
User Agent
Affected Resource IDs
Org

If you've just connected and no events have arrived yet, the table shows No activity yet. Events appear after the next collection runs.

Filtering Activity

Use the filters above the table to narrow results by Category, Actor Type, Event Type, Org, and Date/Time range. Results are split into pages.

Viewing Event Details

Click any row to open the Event Details panel. Details are grouped into:

Actor: Who did the action (user or API key), with their type and ID or email
Request: IP address and user agent
Affected Resources: IDs of the resources involved
Identifiers: Activity ID, organization ID, and timestamps

Note: Event Details shows the standard fields Swif collects from Anthropic. It doesn't show the raw API payload.

Managing Your Integration

Updating Your API Key

If your status is Failing: You don't need to disconnect and reconnect. On Agentic Security → Claude Compliance, click Update API Key in the error banner or the status popover. The integration dialog opens with the Admin API key field ready. Paste a new sk-ant-admin01-... key and save. Collection picks up where it stopped.
Navigate to Settings → Integrations → Claude Compliance.
Click Settings / Edit.
Enter your new Claude Admin API key and click Update / Save. The active token will update seamlessly without duplicate records or sync interruptions.

Disconnecting the Integration

Open the Claude Compliance integration card in Settings → Integrations.
Click Disconnect or Remove.
Once removed, Swif Agentic Security immediately halts polling cycles for your organization. Historical logs remain accessible in accordance with your organization's 6-month retention policy.

Troubleshooting Connection Status

Status is Failing: Anthropic rejected the Admin API key (invalid, expired, or revoked). Make a new Admin API key in the Anthropic Console and use Update API Key.
Next Check is blank: This is expected while the status is Failing. It fills in again once a valid key is saved.
Connected, but no activity: New integrations can take a short time to collect their first events. Also check that your Anthropic organization has activity in the time range you've filtered.

Frequently Asked Questions (FAQ)

Q: Which Anthropic API key type is required?

A: You must use an Anthropic Admin API Key (sk-ant-admin01-...) generated from the Claude Console Admin Keys section. Standard API keys (sk-ant-api03-...) do not have access to the Compliance API.

Q: How frequently does Swif pull compliance data from Claude?

A: Swif Agentic Security runs automated, sequential polling cycles against the Anthropic /v1/compliance/activities endpoint, using durable cursors to capture new events promptly while respecting Anthropic's rate limits (600 requests/min per parent organization).

Q: How long are Claude Compliance audit logs retained?

A: By default, Claude activity logs are retained for 6 calendar months based on event occurrence time (occurred_at), after which records are automatically pruned via bounded cleanup cycles.

Q: Is the API token exposed in logs or client-side responses?

A: No. Tokens are stored securely in backend credential vaults, retrieved dynamically via authenticated internal service routes, masked in memory, and stripped from all diagnostic outputs and client API responses.

Q: Does Claude Compliance monitoring replace the endpoint Agentic Security agent?

A: No. Claude Compliance monitors organization-level Claude workspace activity and administrative actions via cloud APIs, while the local Agentic Security agent monitors local tool execution, command execution, and file operations on employee machines. Using both provides full-spectrum AI governance.

Q: What's the difference between Last Check and Next Check?

A: Last Check is the last time Swif checked your Anthropic connection. Next Check is when the next connection check is due. Swif collects activity events more often than it checks the connection, so new events can show up between checks.

Q: Why is my status Connected even though some events seem delayed?

A: The status changes to Failing only when Anthropic rejects your Admin API key. Short delays from network problems or rate limits are retried automatically and don't change the status.

Integrating Anthropic Claude Compliance with Swif Agentic Security