Comparing the Analytics API and Compliance API for security, compliance, and governance use cases.
| Capability / Dimension | Analytics API | Compliance API |
|---|---|---|
| Access & Setup | ||
| NDA required | No | YesVia Anthropic Trust Center |
| API key type | read:analyticsScoped analytics key | read:securityScoped security key |
| Who can enable | Primary Owner | Primary Owner |
| Setup effort | MinutesToggle + create key | Half dayNDA + integration |
| Additional cost | IncludedWith Enterprise plan | IncludedWith Enterprise plan |
| Usage & Adoption Insights | ||
| DAU / WAU / MAU tracking | Yes | No |
| Seat utilizationAssigned vs. active vs. pending invites | Yes | No |
| Project-level breakdownPer-project users, conversations, messages | Yes | No |
| Claude Code metricsCommits, PRs, LOC, sessions, tool actions | Yes | No |
| MCP connector usageWhich connectors, by whom, frequency | Yes | PartialConnection events only |
| Skill usage tracking | Yes | No |
| Web search invocation count | Yes | No |
| Security & Audit Logging | ||
| Login / logout events | No | Yes |
| API key lifecycleCreation, modification, deletion | No | Yes |
| Workspace membership changes | No | Yes |
| Account setting changes | No | Yes |
| Permission / access changes | No | Yes |
| File operationsUpload, download, deletion events | No | Yes |
| Compliance Framework Support | ||
| SOC 2 Type II evidence | PartialUsage data only | YesFull audit trail |
| EU AI ActHigh-risk AI system transparency and logging | PartialUsage metrics only | YesAudit trail for AI oversight |
| NIS2Network and information security directive | PartialAccess pattern visibility | YesIncident detection and logging |
| PCI-DSSPayment card industry data security standard | No | PartialAccess and change logging |
| ISO 27001Information security management systems | PartialAsset and usage inventory | YesA.12 operations security evidence |
| Operational Characteristics | ||
| Data freshness | 3-day delay | Near real-time |
| Historical data availability | 90 daysFrom Jan 1, 2026 | From enablementNo retroactive data |
| Rate limits | 60 req/minAdjustable via CSM | Per NDA docs |
| Unified org viewEnterprise + API org in single feed | NoEnterprise org only | YesParent org consolidation |
| SIEM export capability | ManualBuild your own pipeline | YesDesigned for SIEM ingestion |
| Security, Monitoring & Compliance Use Cases | ||
| Shadow AI detectionIdentify unapproved connector or skill usage across the org | YesConnector + skill endpoints | PartialConnection events only |
| Dormant account identificationFind assigned seats with zero activity for deprovisioning | YesSeat vs. active user delta | No |
| Privilege escalation detectionAlert on unexpected permission or role changes | No | YesPermission change events |
| API key hygiene monitoringTrack key creation, unused keys, and rotation compliance | No | YesKey lifecycle events |
| Insider threat indicatorsUnusual file download patterns or off-hours access | No | YesFile ops + login events |
| Cost attribution and chargebackAllocate usage-based billing to teams or departments | YesPer-user + per-project data | No |
| AI adoption governance reportingBoard-level reporting on AI rollout scope and velocity | YesDAU/WAU/MAU + trends | PartialEvent volume as proxy |
| Unauthorized workspace accessDetect members added to restricted workspaces | No | YesMembership change events |
| Configuration drift detectionMonitor for unexpected org or account setting changes | No | YesSetting change events |
| Third-party integration auditVerify only approved MCP connectors are active | YesNormalized connector list | PartialConnection events |
| Data exfiltration signalAbnormal file download volume or pattern per user | No | YesFile download events |
| Periodic access reviewQuarterly attestation of who has access and what they used | YesUser activity + seat data | YesAccess and login history |
| Incident response supportReconstruct timeline of actions during a security event | PartialDaily aggregates only | YesEvent-level granularity |
| Regulatory audit evidence packageGenerate exportable evidence for external auditors | PartialUsage stats only | YesFull audit trail export |
| Offboarding verificationConfirm revoked access and no residual activity post-departure | PartialCheck for zero activity | YesLogin + access removal events |
Base URL: https://api.anthropic.com/v1/organizations/analytics/
Auth: x-api-key header with read:analytics scoped key
/v1/organizations/analytics/users
Per-user engagement metrics for a single day. Includes chat metrics, Claude Code metrics (commits, PRs, LOC, sessions, tool actions), connector usage, and web search counts.
Params: date (required), limit, page
/v1/organizations/analytics/summaries
High-level org engagement summary per day. DAU, WAU, MAU counts, assigned seats, and pending invites. Max 31-day range per request.
Params: starting_date (required), ending_date
/v1/organizations/analytics/apps/chat/projects
Usage broken down by chat project. Unique users, conversations, messages, creation date, and creator info per project.
Params: date (required), limit, page
/v1/organizations/analytics/skills
Skill usage across Claude chat and Claude Code. Unique users per skill, conversation counts, and remote session counts.
Params: date (required), limit, page
/v1/organizations/analytics/connectors
MCP connector usage across Claude chat and Claude Code. Normalized connector names, unique users, conversation and session counts.
Params: date (required), limit, page
Documentation: trust.anthropic.com (NDA required)
Auth: x-api-key header with admin API key
/v1/organizations/activity
Activity feed of security-relevant events. Filterable by time range, specific users, or API keys. Returns admin/system events and resource events.
Filters: time range, user, API key
The Analytics API returns aggregated usage counts only (number of conversations, messages, sessions, etc.). The Compliance API logs administrative actions and resource events but explicitly excludes inference activities. Neither API exposes, exports, or provides access to user prompts, model responses, conversation threads, or any other interaction content. All data available through both APIs is limited to metadata and event-level telemetry.