Claude Usage & Compliance APIs
This integration is available for Anthropic Enterprise organizations only. If you are on the Claude Team plan or using Claude on a third-party platform, use the Claude Code or Claude Cowork client-side integrations instead.
Overview
This integration polls your Anthropic organization's Admin, Compliance, and Analytics APIs and pulls Claude usage, cost, Claude Code activity, per-user engagement, seat, and governance telemetry into Coralogix as metrics. Use it to track Claude spend and adoption, attribute cost and usage to users and products, and retain a governance trail of organization activity.
You configure up to 3 Anthropic API keys, and each key independently unlocks its own data group:
- Admin API key: API usage and token consumption per API key, Claude Code activity, organization rate limits, and the API key inventory.
- Compliance API key: the organization activity feed, the user directory, organization settings, chats, and projects.
- Analytics API key: daily cost and usage reports (organization-wide and per-user), engagement summaries, seats, skills, and connectors.
Install the integration once per Anthropic organization. Coverage extends only to the organization the keys belong to: a user's activity under a different organization requires a separate installation with that organization's keys.
Poll intervals
| Data | Interval |
|---|---|
| API usage report (Admin) | Every 10 minutes |
| Activity feed (Compliance) | Every 10 minutes |
| Claude Code usage (Admin) | Every 4 hours |
| Rate limits and API key inventory (Admin) | Daily |
| Organization directory, settings, chats, and projects (Compliance) | Daily |
| Cost and usage reports (Analytics) | Daily |
| Engagement reports: summaries, users, skills, connectors (Analytics) | Daily |
The integration does not backfill history. It collects activity events, chats, and chat messages from the moment you turn on the integration (or the relevant opt-in), and analytics reports start from the latest day Anthropic has published.
What you need
- Admin access to your Anthropic organization, to create organization API keys in the Anthropic Console.
- At least 1 of the 3 API keys. Compliance API access is a separate entitlement on the Anthropic side; if your organization doesn't have it, contact Anthropic.
- Permission to create integrations in your Coralogix account. See Permissions.
Create API keys in the Anthropic Console
- Log in to the Anthropic Console as an organization admin.
- In your organization settings, create a key for each data group you plan to collect: an Admin API key (
sk-ant-admin...), a Compliance API key, or an Analytics API key. For the exact steps, see the Anthropic Admin API documentation. - Copy each key and store it securely. Anthropic shows a key only once, at creation time.
Set up
- From your Coralogix toolbar, navigate to Data Flow, then Integrations. Select Anthropic (Claude) Usage & Cost, then select Connect.
- Select Add New.
- Define the integration settings:
- Integration name: a meaningful name for this integration.
- Application name: the Coralogix application name for all data from this integration. Defaults to
anthropic. - Subsystem name: optional. When set, all metrics ingest under this single subsystem instead of their per-group defaults.
- Admin API key, Compliance API key, Analytics API key: the keys you created in the Anthropic Console. Provide at least 1; each key unlocks its own data group, and an absent key skips that group.
- Select Create. The integration tests each supplied key against Anthropic before saving, and reports which key failed if Anthropic rejects any of them.
Collected data
Metrics reference
All metrics appear in Metrics Explorer under the anthropic_ prefix. Every series carries an organization label and a source label naming the API key group that produced it (admin, compliance, or analytics). All series are gauges except anthropic_compliance_activity_events, which is a counter. Monetary metrics report USD, with the denomination in a currency label. The integration skips absent source fields rather than reporting them as 0, so a gap is distinguishable from a real zero.
Admin metrics. The Claude Code series carry user, actor_type, terminal_type, and customer_type labels:
| Metric | What it tracks | Additional labels |
|---|---|---|
anthropic_admin_rate_limit_value | Configured organization rate-limit values. | model or group_type, limit_type |
anthropic_admin_api_key_usage | Tokens consumed per API key in 1-minute buckets, stamped at the bucket start. | api_key_id, workspace_id, account_id, model, service_tier, context_window, token_type |
anthropic_claude_code_sessions | Claude Code sessions per actor. | None |
anthropic_claude_code_lines_added | Lines of code added. | None |
anthropic_claude_code_lines_removed | Lines of code removed. | None |
anthropic_claude_code_commits | Commits created. | None |
anthropic_claude_code_pull_requests | Pull requests created. | None |
anthropic_claude_code_tool_actions | Tool suggestions by outcome. | tool, decision |
anthropic_claude_code_tokens | Tokens consumed per model. | model, token_type |
anthropic_claude_code_cost | Estimated cost per model, in USD. | model, currency |
Compliance metrics, stamped at the source event time:
| Metric | What it tracks | Additional labels |
|---|---|---|
anthropic_compliance_org_users_total | Directory user count per role. | role |
anthropic_compliance_activity_events | Counter of activity events by type and actor, including high-volume view events. | type, api_key_id, user_id, user_email, user_type |
anthropic_compliance_login_method | Successful logins by authentication method. | type, auth_method, mfa_method, user_id, user_ip, user_type, user_email |
anthropic_compliance_ip_events | Security-relevant events with a source IP: failed and initiated logins, access failures, logouts, and session revocations and shares. | type, user_ip, user_email, user_id |
anthropic_compliance_chats_created | Chats created. | model, user_id, user_email, project_id |
Analytics metrics. Every series carries a date label with the report day (YYYY-MM-DD, UTC); samples carry the end of that day as their timestamp. Cost series carry an amount_type label distinguishing actual, list, and overage amounts:
| Metric | What it tracks | Additional labels |
|---|---|---|
anthropic_analytics_cost | Organization cost, in USD. | product, model, cost_type, token_type, context_window, speed, currency, amount_type |
anthropic_analytics_user_cost | Per-user cost, in USD. | user_id, user_email, user_name, product, model, currency, amount_type |
anthropic_analytics_user_requests | Per-user request count. | user_id, user_email, user_name, product, model, currency |
anthropic_analytics_tokens | Organization token counts by type. | product, model, context_window, speed, token_type |
anthropic_organization_usage | Total tokens across all token types. | product, model, context_window, speed |
anthropic_org_cache_creation | Cache-creation tokens by cache lifetime. | product, model, context_window, speed, token_type |
anthropic_org_requests_total | Organization request count. | product, model, context_window, speed |
anthropic_analytics_user_tokens | Per-user token counts by type. | user_id, user_email, user_name, product, model, token_type |
| Metric | What it tracks | Additional labels |
|---|---|---|
anthropic_analytics_seats_assigned | Assigned seats. | None |
anthropic_analytics_pending_invites | Pending seat invites. | None |
anthropic_analytics_active_users | Active users per product and window. | product, window |
anthropic_analytics_adoption_rate | Adoption rate per window. | window |
| Metric | What it tracks | Additional labels |
|---|---|---|
anthropic_analytics_skill_users | Distinct users per skill. | skill_name, skill_display_name, share_status |
anthropic_analytics_skill_invocations | Skill invocations. | skill_name, skill_display_name, share_status |
anthropic_analytics_skill_sessions | Skill sessions per surface. | skill_name, skill_display_name, share_status, surface |
anthropic_analytics_skill_cost | Attributed skill cost, in USD. | skill_name, skill_display_name, share_status, currency, amount_type |
anthropic_analytics_connector_users | Distinct users per connector. | connector_name |
anthropic_analytics_connector_calls | Connector calls by type (read, write, unclassified). | connector_name, call_type |
anthropic_analytics_connector_sessions | Connector sessions per surface. | connector_name, surface |
Per-user activity metrics, with user_id, user_email, and product labels on every series:
| Metric | What it tracks | Additional labels |
|---|---|---|
anthropic_analytics_user_sessions | Sessions per user and product. | None |
anthropic_analytics_user_lines_added | Lines of code added. | None |
anthropic_analytics_user_lines_removed | Lines of code removed. | None |
anthropic_analytics_user_commits | Commits created. | None |
anthropic_analytics_user_pull_requests | Pull requests created. | None |
anthropic_analytics_user_tool_decisions | Tool suggestions by outcome. | tool, decision |
anthropic_analytics_user_chat_activity | Chat activity. | None |
anthropic_analytics_user_skills_used | Skill uses. | None |
anthropic_analytics_user_distinct_skills_used | Distinct skills used. | None |
anthropic_analytics_user_connectors_used | Connector uses. | None |
anthropic_analytics_user_distinct_connectors_used | Distinct connectors used. | None |
anthropic_analytics_user_office_distinct_connectors_used | Distinct connectors used from office products. | None |
The per-surface session metrics (anthropic_analytics_skill_sessions and anthropic_analytics_connector_sessions) appear only once Anthropic populates their source fields; Anthropic reports them as null.
Labels
| Label | On | Meaning |
|---|---|---|
organization | Every series | The Anthropic organization ID. |
source | Every series | The API key group that produced the series: admin, compliance, or analytics. |
date | Analytics series | The report day the value describes (YYYY-MM-DD, UTC). |
currency | Cost series | The denomination of the reported value. |
product | Usage, cost, and engagement series | The Claude product, for example claude_code, chat, or cowork. |
window | Active-user and adoption series | The aggregation window: daily, weekly, or monthly. |
token_type | Token series | The token category, for example uncached_input_tokens, cache_read_input_tokens, or output_tokens. |
user_id, user_email, user_name | Per-user series | The Anthropic user the value belongs to. |
Limits and behavior
- Anthropic rate limits. Anthropic allows 60 analytics requests per minute per organization and 600 compliance requests per minute per parent organization. The integration paces itself within these budgets, and when Anthropic returns a rate-limit response it reschedules the poll to the advertised reset time, keeping any data already collected.
- Report availability lag. Anthropic publishes cost and usage reports a few hours after the UTC day ends, and engagement reports about 2 days later. When a day isn't published yet, the integration retries every 30 minutes without skipping the day, then accepts it as empty after a bounded grace period. A missing day right after setup is normal; it fills in on its own.
- Metrics ingest window. The metrics pipeline accepts samples up to 48 hours old. After extended downtime, the integration moves catch-up analytics samples forward into the window, with the
datelabel preserving the true report day. - Activity events. The
anthropic_compliance_activity_eventsmetric counts every event type, so overall access volume, including compliance API access with any key, stays queryable.
Validate the integration
Open Metrics Explorer or Grafana and query a series from a data group you collect, for example anthropic_analytics_seats_assigned or anthropic_admin_api_key_usage.
With an Admin API key, the first anthropic_admin_api_key_usage samples typically appear within about 10 minutes of setup, and the daily snapshots (API keys, rate limits, compliance directory) within a day. Analytics series appear after the next scheduled report poll and cover the most recent day Anthropic has published.
Permissions
To set up this integration, your Coralogix account must have the following permissions:
| Resource | Action | Description |
|---|---|---|
integrations | ReadConfig | View deployed integrations. |
integrations | Manage | Add, remove, or update integrations. |
For details, see Roles and permissions.