Connectors Anthropic
Anthropic
The Anthropic connector reads one Claude Console (API) organisation with its Admin API key: members, invites, workspaces, API keys, rate limits and usage, and, if you opt in, costs, Claude Code usage and the Compliance activity feed. How the connect flow works is on How connectors work.
Who can do it
Connecting needs connections:manage (Manage connections), held by Owner, Admin and Fleet operator. At Anthropic, only organisation members with the admin role can create an Admin API key.
Connect
- Go to Collection › Connectors and choose Connect on Anthropic. There is one mode, Claude Console: "One Claude Console (API) organisation, read with its Admin API key."
- Give the connection a Name.
- Paste the Admin API key into the password field. The hint reads "From Claude Console › Settings › Admin keys (sk-ant-admin…); only an organisation admin can create one." A key that does not start with
sk-ant-adminis refused beside the field: "A sk-ant-admin token, please." - Continue through Check and Rules, then choose Create connection.
On Anthropic's side
Anthropic's steps for a Claude Console organisation: sign in as an organisation admin, open the Admin keys page of the Claude Console, choose Create admin key, name it, select an expiration and choose Add. Copy the secret, which starts sk-ant-admin01-. It is shown only once. Console keys have no selectable scopes. A key from a Claude Enterprise organisation on claude.ai starts sk-ant-api01- and is not accepted here.
Vendor documentation: https://platform.claude.com/docs/en/manage-claude/admin-api-keys and https://platform.claude.com/docs/en/manage-claude/admin-api
What it reads
| Records | What you get |
|---|---|
| Members | The organisation's members and their role. |
| Invites | Pending, accepted and expired invitations. |
| Workspaces | Every workspace, archived ones included. |
| Workspace members | Who is in each workspace, and with which role. |
| API keys | Every API key the organisation holds, working or not. |
| Rate limits | The organisation's Messages API limits and each workspace's overrides. |
| Compliance settings | Whether the Compliance API is recording this organisation's activity. |
| Usage | Tokens used per workspace and model, day by day. |
| Costs | Off by default. "Stores what the organisation spends, per workspace and line, every day." |
| Claude Code usage | Off by default. "Stores each person's Claude Code activity by email — sessions, commits and lines of code — per day." |
| Activity feed | Off by default. "Stores who did what, with their email and the IP address it came from." |
Anthropic's own word workspace is a part of a Claude Console organisation. It is not an Oxelone workspace.
What it can do
All need the Admin API key.
| Action | Consequence | Reversible |
|---|---|---|
| Remove from organisation | The person loses access and their personal keys are archived. "Workspace API keys continue to work." | No |
| Demote to user | The person keeps access and drops to the user role, which "Can use playground". | Yes |
| Withdraw invite | "Delete a pending invite." Re-inviting creates a new invitation, not this one. | No |
| Invite again | A new invitation goes to the same address with the same role. "When no seat is free the request fails with a 400 error rather than purchasing a seat." | Yes |
| Deactivate API key | The key stops working until it is re-enabled. | Yes |
| Archive workspace | Every API key created for this workspace is archived within seconds. "Cannot be undone." | No |
| Remove from workspace | The person leaves this workspace and keeps their organisation membership. "Organization admins and billing members cannot be removed from workspaces while they hold those organization roles." | Yes |
What it checks
Nine posture checks, no inspections.
| Rule | Severity | Action offered |
|---|---|---|
| API key with no expiry | Medium | Deactivate API key |
| Expired API key still listed | Low | None |
| Workspace API key bound to no person | Medium | Deactivate API key |
| Organisation admin | Low | None |
| Pending invite carrying the admin role | Low | Withdraw invite |
| Compliance API switched off | High | None |
| Admin API key created | Medium | None |
| Audit log export downloaded | Medium | None |
| Account deleted | Low | None |
The last three read the Activity feed, so they run only if you switch that record kind on.
What it needs to be Readable
An Admin API key. The Activity feed also needs the read:compliance_activities scope on the key, and the Compliance API turned on. The row then reads one of:
- "the Compliance API is not enabled for this organisation — "An organization admin turns on the Compliance API toggle at Claude Console > Settings > Security""
- "the Compliance API is enabled, but "Admin API keys carry the
read:compliance_activitiesscope only if the Compliance API was enabled for the organization at the time the key was created" — create a new Admin API key and replace this connection's credential"
Sync period
1 h, 6 h and 1 d. There is no 15-minute period.
When it goes wrong
The messages are the shared ones on How connectors work, for example "the vendor refused this credential (code). Check that it has the permissions this connector asks for, and that it has not expired."
With the API
Not available with an API key.