Skip to main content
Theme
Home

Claude Usage & Compliance APIs

Open in ChatGPTOpen in Claude
Enterprise plan required

This integration is available for Anthropic Enterprise organizations only. If you are on the Claude Team plan or using Claude on a third-party platform, use the Claude Code or Claude Cowork client-side integrations instead.

Overview​

This integration polls your Anthropic organization's Admin, Compliance, and Analytics APIs and pulls Claude usage, cost, Claude Code activity, per-user engagement, seat, and governance telemetry into Coralogix as metrics and logs. Use it to track Claude spend and adoption, attribute cost and usage to users and products, and retain a governance trail of organization activity.

Note

The initial version of this integration produces metrics only, with log collection planned for a future release. This page documents the log streams so you can plan ahead.

You configure up to 3 Anthropic API keys, and each key independently unlocks its own data group:

  • Admin API key: API usage and token consumption per API key, Claude Code activity, organization rate limits, and the API key inventory.
  • Compliance API key: the organization activity feed, the user directory, organization settings, chats, and projects.
  • Analytics API key: daily cost and usage reports (organization-wide and per-user), engagement summaries, seats, skills, and connectors.

Install the integration once per Anthropic organization. Coverage extends only to the organization the keys belong to: a user's activity under a different organization requires a separate installation with that organization's keys.

Poll intervals​

DataInterval
API usage report (Admin)Every 10 minutes
Activity feed (Compliance)Every 10 minutes
Claude Code usage (Admin)Every 4 hours
Rate limits and API key inventory (Admin)Daily
Organization directory, settings, chats, and projects (Compliance)Daily
Cost and usage reports (Analytics)Daily
Engagement reports: summaries, users, skills, connectors (Analytics)Daily

The integration does not backfill history. It collects activity events, chats, and chat messages from the moment you turn on the integration (or the relevant opt-in), and analytics reports start from the latest day Anthropic has published.

What you need​

  • Admin access to your Anthropic organization, to create organization API keys in the Anthropic Console.
  • At least 1 of the 3 API keys. Compliance API access is a separate entitlement on the Anthropic side; if your organization doesn't have it, contact Anthropic.
  • Permission to create integrations in your Coralogix account. See Permissions.

Create API keys in the Anthropic Console​

  1. Log in to the Anthropic Console as an organization admin.
  2. In your organization settings, create a key for each data group you plan to collect: an Admin API key (sk-ant-admin...), a Compliance API key, or an Analytics API key. For the exact steps, see the Anthropic Admin API documentation.
  3. Copy each key and store it securely. Anthropic shows a key only once, at creation time.

Set up​

  1. From your Coralogix toolbar, navigate to Data Flow, then Integrations. Select Anthropic (Claude) Usage & Cost, then select Connect.
  2. Select Add New.
  3. Define the integration settings:
    • Integration name: a meaningful name for this integration.
    • Application name: the Coralogix application name for all data from this integration. Defaults to anthropic.
    • Subsystem name: optional. When set, all log streams ingest under this single subsystem instead of their per-stream defaults. Each log body still names its stream; see Log streams.
    • Admin API key, Compliance API key, Analytics API key: the keys you created in the Anthropic Console. Provide at least 1; each key unlocks its own data group, and an absent key skips that group.
    • Collect chat message content: off by default. When turned on, the integration ingests the raw text of Claude chat messages into the anthropic.chat_messages log stream. Turn it on only if capturing conversation content is acceptable for your compliance posture; see Chat message content.
    • Include view activity events: off by default. When turned on, the activity feed also includes the high-volume view events (file, chat, project, artifact, and user-settings views) and the compliance_api_accessed events that the integration otherwise filters out of the logs.
  4. Select Create. The integration tests each supplied key against Anthropic before saving, and reports which key failed if Anthropic rejects any of them.

Collected data​

Log streams​

Note

The initial version does not yet produce log streams. The following reference describes the streams planned for a future release.

All logs ingest under the application name you configured (default anthropic). Each stream is its own subsystem by default, and every log body ships inside an envelope that names its stream and carries dataset-routing attributes:

{
  "stream": "anthropic.activity",
  "data": {
    "organization": "org-1",
    "type": "sso_login_succeeded"
  },
  "resource": {
    "attributes": {
      "cx.integration.source.type": "anthropic_api_integration",
      "cx.integration.source.version": "1.0.0"
    }
  }
}

The record itself sits under data, so query a stream's fields as $d.data.*. The stream key survives a Subsystem name override, so streams stay distinguishable even when they share a single subsystem. The cx.integration.source.type attribute is anthropic_api_integration for every stream except the 2 conversation-content streams (anthropic.chats and anthropic.chat_messages), which carry anthropic_api_integration_sessions and route to the more restricted Claude sessions dataset.

Query a single stream with DataPrime:

source logs | filter $l.applicationname == 'anthropic' && $d.stream == 'anthropic.activity' | limit 50

Log timestamps: anthropic.activity entries take the event's created_at as their timestamp, and anthropic.api_keys_usage takes the start of its usage bucket. Every other stream takes the collection time, with the source times preserved in the record fields (created_at, report_date, and similar). Monetary fields in logs carry Anthropic's decimal cent values verbatim as strings, under keys ending in _cents.

Streams collected with the Admin API key:

Streams collected with the Analytics API key. Every record carries report_date (the data day, YYYY-MM-DD), and the cost and usage streams also carry report_starting_at and report_ending_at:

Streams collected with the Compliance API key:

Chat message content​

The integration always collects chat metadata (anthropic.chats) when a Compliance API key is present. It collects the message text itself (anthropic.chat_messages) only while Collect chat message content is on:

  • Turning it on starts message collection from that moment. The integration never collects messages sent before the opt-in.
  • Turning it off stops message collection immediately, including any fetches already queued.
  • Turning it back on starts a new collection floor at that moment. The integration does not backfill the interval it spent off.

Both conversation-content streams route to the restricted Claude sessions dataset through their cx.integration.source.type attribute.

A long conversation can exceed the maximum size of a single log entry. The integration then splits the message losslessly across several entries instead of truncating it:

  • Each part repeats the full message metadata and adds part (1-based) and parts (the total). Messages that fit in a single entry carry no part fields.
  • When a message has no message_id, each part also carries part_group, a stable grouping hash.
  • A content block too large for a single part becomes several segment blocks: copies of the block with its largest string split in place, each carrying cx_segment with index, total, and ptr (the JSON Pointer of the sliced string). A text block stays a text block, and a tool_use block keeps its id and name, so free-text search matches every segment without reassembly. To reconstruct the original string exactly, concatenate the slices at ptr in index order.
  • A block with no dominant string ships whole, serialized as text segments marked cx_segment.encoding: "json". Concatenate the text slices in index order, then parse the result as JSON.

To reassemble a split message, group entries by $d.data.chat_id and $d.data.message_id (falling back to $d.data.part_group) and order them by $d.data.part. All parts share the same envelope timestamp, so ingestion order is not authoritative.

Metrics reference​

All metrics appear in Metrics Explorer under the anthropic_ prefix. Every series carries an organization label and a source label naming the API key group that produced it (admin, compliance, or analytics). All series are gauges except anthropic_compliance_activity_events, which is a counter. Monetary metrics report USD, with the denomination in a currency label. The integration skips absent source fields rather than reporting them as 0, so a gap is distinguishable from a real zero.

Admin metrics. The Claude Code series carry user, actor_type, terminal_type, and customer_type labels:

Compliance metrics, stamped at the source event time:

Analytics metrics. Every series carries a date label with the report day (YYYY-MM-DD, UTC); samples carry the end of that day as their timestamp. Cost series carry an amount_type label distinguishing actual, list, and overage amounts:

Per-user activity metrics, with user_id, user_email, and product labels on every series:

The per-surface session metrics (anthropic_analytics_skill_sessions and anthropic_analytics_connector_sessions) appear only once Anthropic populates their source fields; Anthropic reports them as null.

Labels​

Limits and behavior​

  • Anthropic rate limits. Anthropic allows 60 analytics requests per minute per organization and 600 compliance requests per minute per parent organization. The integration paces itself within these budgets, and when Anthropic returns a rate-limit response it reschedules the poll to the advertised reset time, keeping any data already collected.
  • Report availability lag. Anthropic publishes cost and usage reports a few hours after the UTC day ends, and engagement reports about 2 days later. When a day isn't published yet, the integration retries every 30 minutes without skipping the day, then accepts it as empty after a bounded grace period. A missing day right after setup is normal; it fills in on its own.
  • Metrics ingest window. The metrics pipeline accepts samples up to 48 hours old. Chats older than that appear in the anthropic.chats log stream but not in anthropic_compliance_chats_created. After extended downtime, the integration moves catch-up analytics samples forward into the window, with the date label preserving the true report day.
  • Activity feed filtering. By default the anthropic.activity log stream excludes the high-volume view events (claude_file_viewed, claude_chat_viewed, claude_project_viewed, claude_artifact_viewed, claude_user_settings_updated) and compliance_api_accessed, which the integration's own polling generates. Turn on Include view activity events to log them. The anthropic_compliance_activity_events metric counts every event type regardless of this setting, so overall access volume, including compliance API access with any key, stays queryable.
  • Subsystem name override. Setting Subsystem name collapses all log streams onto that single subsystem. Filter by $d.stream in that case; $l.subsystemname no longer distinguishes streams.
  • Organization settings snapshots. The anthropic.org_settings stream receives a full settings document per daily poll, whether or not the settings changed.

Validate the integration​

Open Metrics Explorer or Grafana and query a series from a data group you collect, for example anthropic_analytics_seats_assigned or anthropic_admin_api_key_usage.

Once your version collects logs, query them in Explore with DataPrime:

source logs | filter $l.applicationname == 'anthropic' | groupby $d.stream aggregate count() as entries

With an Admin API key, the first anthropic.api_keys_usage entries typically appear within about 10 minutes of setup, and the daily snapshots (API keys, rate limits, compliance directory) within a day. Analytics streams appear after the next scheduled report poll and cover the most recent day Anthropic has published.

Permissions​

To set up this integration, your Coralogix account must have the following permissions:

ResourceActionDescription
integrationsReadConfigView deployed integrations.
integrationsManageAdd, remove, or update integrations.

For details, see Roles and permissions.

Last updated on
Need help? Contact Support.
What's new? Find out here.
LLM? Read llms.txt.
On this page
Was this page helpful?