Claude Admin and Governance Surfaces - Which API or Setting Answers Which Control Question

First Published: 2026-11-13
Last Updated: 2026-11-13

Administrators managing a Claude organization often have numerous questions. Who belongs to the organization, and with which role? Which credentials can call what? From which networks can Claude be used? Who did what, and how much was used? Where are caps set? Did anyone at Anthropic access the data? Anthropic provides APIs and settings to answer these questions, organized under the "manage-claude" section of the Claude Platform documentation. However, even under the same name, the Admin API takes different keys and offers different endpoints depending on the organization type. On some platforms, a surface is not available at all.

This article starts from control questions and lets you look up which API or setting answers each one. For each surface, it sets out the canonical page, the organization types, the keys and roles, whether it is available on each platform, and its status and dates. It covers 18 surfaces, 3 organization types, and 6 platforms.

To summarize, the Admin API can be accessed using two different keys. Organizations managed through the Claude Console use Admin API keys that begin with sk-ant-admin01-. Claude Enterprise organizations use keys that begin with sk-ant-api01-, created in claude.ai, and choose scopes for them. These two keys are not interchangeable. Claude Platform on AWS organizations can use only four groups of the Admin API, and AWS IAM manages membership. The IP allowlist does not apply to Amazon Bedrock, Claude Platform on AWS, Claude Models on Google Cloud, or Claude in Microsoft Foundry. While organization webhooks can be registered, events are not yet being sent. The Usage and Cost API became legacy, but it remains supported.

This article was written after reviewing the documentation on November 12, 2026 (Japan Standard Time). The status of the admin surfaces changed several times between August and November 2026. Verification dates are included in the tables. This article does not cover pricing, cost reduction, or which product is better.

Related articles on this site:

1. Scope and Terms
2. Control Questions and the Surface That Answers Each
3. Keys and Roles
4. Surfaces by Organization Type
5. Where Each Surface Applies
6. Status, Versions, and Dates
7. The Surface Table
8. Failure Modes
9. Frequently Asked Questions About Claude Admin Surfaces
10. Summary
11. References

1. Scope and Terms

This chapter first sets out this article's readers, scope, sources, and terms. In short, its conclusions are the following eight points.

This article covers 18 admin surfaces, 3 organization types, and 6 platforms (Section 1.2).
The term "Admin API key" refers to two distinct keys: the key of a Console organization and the scoped key of an Enterprise organization (Section 1.4 and Chapter 3).
The Admin API key of a Console organization has no scopes and can call every endpoint that accepts Admin API keys (Section 3.1).
For Enterprise organizations, the primary owner creates the key in claude.ai and selects scopes when creating it. Depending on the page, the key is called a Compliance Access Key, an Analytics API key, or an Admin API key (Section 3.2).
In Claude Platform on AWS organizations, only four groups of the Admin API are available, and AWS IAM manages membership (Section 4.3).
The pages for Amazon Bedrock, Claude Models on Google Cloud (Google managed), and Claude in Microsoft Foundry list the Admin API and the Compliance API as not supported (Chapter 5).
The status of a surface is one of the following: beta, out of beta, legacy, or registrable but not delivering (Chapter 6).
Every row of the surface table gives the status as of the verification date, November 12, 2026 (Chapter 7).

1.1 Intended Audience

This article is intended for the following audiences:

Administrators of organizations using Claude Console or Claude Enterprise.
Security and platform personnel responsible for organizational governance and auditing.
Operators who are starting to use Claude on Claude Platform on AWS or Amazon Bedrock and want to check which admin APIs are available.

This article assumes that readers may hold the following views, and checks each of them against the sources:

There is one kind of Admin API key, and it works the same way in every organization.
Once an IP allowlist is set, it applies no matter which platform a call comes from.
Once an organization webhook is registered, notifications arrive.
An API that has become legacy can no longer be used.
The Spend Limits API is used to set spending limits for organizations in the Console.

1.2 Scope and Exclusions

This article covers the following 18 surfaces. It uses these 18 as the fixed row names in its tables.

Admin API (organization management)
Workspaces and Console limits
Workload Identity Federation
CMEK (customer-managed encryption keys)
Usage and Cost Analytics API
Legacy Usage and Cost API
Claude Enterprise Analytics API
Claude Code Analytics API
Rate Limits API
Spend Limits API
Compliance API
Access Transparency
OpenTelemetry export
IP allowlist
Inference hooks
Organization webhooks
Claude Tag API
Data Retention (ZDR and HIPAA readiness)

This article addresses the following three types of organizations:

Console Organizations: Organizations managed within Claude Console, accessible at platform.claude.com.
Enterprise Organizations: Organizations within Claude Enterprise, managed through claude.ai.
Claude Platform on AWS Organizations: Organizations created from an AWS account, where AWS IAM manages members.

This article covers the following six platforms:

Claude API, accessible at api.anthropic.com.
Claude Platform on AWS
Amazon Bedrock
Claude Models on Google Cloud (Anthropic managed)
Claude Models on Google Cloud (Google managed)
Claude in Microsoft Foundry

For each surface, this article covers the questions it answers, its canonical page, organization types, keys and roles, availability on each platform, and status and dates.

This article does not cover the following.

Pricing and cost reduction. For the Usage and Cost surfaces, this article stops at what can be read and who can read it.
Every parameter of each API, and how to use the SDKs. This article keeps declarations to a minimum.
Design of OpenTelemetry destinations and the corresponding reception on AWS. This site's Receiving Claude API OpenTelemetry Traces on AWS covers it.
Changes to the field names in the Admin API response, as of API version 2026-10-21. This site's Moving a Claude Integration to API Version 2026-10-21 on AWS covers it.
The path for user profiles and the content of organization webhook events. This site's Where a Claude User Profile Travels on AWS covers it.
Defense in depth for Claude Code and Claude Desktop. This site's Hardening and Governance Guide for Claude Code and Claude Desktop covers it.
Choosing between Claude Platform on AWS and Amazon Bedrock. A separate article on this site (Claude Platform on AWS or Amazon Bedrock - Who Operates It, What Differs, and What a Move Breaks) covers it.
Configuration steps on the Identity Provider (IdP) side for SCIM and SSO.
Ways to get around the IP allowlist or auditing. This article stops at whether a surface exists, where it applies, and who sets it up.

1.3 Date of Review and Materials Reviewed

This article was written after reviewing the following materials on November 12, 2026 (Japan Standard Time). Throughout this article, English names are used for the items within parentheses.

In the "manage-claude" section of the Claude Platform documentation, the following pages were reviewed:

Admin API overview (Admin API page)
Admin API keys (Admin API keys page)
Authentication (Authentication page)
Workspaces (Workspaces page)
User management (User management page)
Analytics APIs (Analytics APIs page)
Usage and Cost Analytics API (Usage and Cost Analytics API page)
Usage and Cost API (Usage and Cost API page)
Claude Code Analytics API (Claude Code Analytics API page)
Rate Limits API (Rate Limits API page)
Spend Limits API (Spend Limits API page)
Claude Tag API (Claude Tag API page)
Organization webhooks (organization webhooks page)
IP allowlisting (IP allowlist page)
Inference hooks (Inference hooks page)
OpenTelemetry and its API page (OpenTelemetry page)
Customer-managed encryption keys (CMEK page)
Access Transparency and Access Transparency log (Access Transparency page)
Workload Identity Federation (WIF page)
Compliance API and Compliance API access (Compliance API page)
API and data retention (data retention page)

From the platform pages, this article read the following pages.

Claude Platform on AWS (Claude Platform on AWS page)
Claude in Amazon Bedrock and the bedrock-runtime page (Bedrock pages)
Claude Models on Google Cloud (Anthropic managed), and the corresponding IAM permissions page (Google Cloud Anthropic managed page)
Claude Models on Google Cloud (Google managed) (Google Cloud Google managed page)
Claude in Microsoft Foundry (Foundry page)

The status and dates were checked in the Claude Platform release notes (Claude release notes).

From the AWS materials, this article read three pages of the Claude Platform on AWS User Guide: Feature support, Using the Claude Console, and Monitoring and logging (AWS user guide).

Anthropic's pages were reviewed using the original text obtained via curl, and the AWS user guide using the text retrieved through the AWS Knowledge MCP Server. Direct quotes in this article have been verified against the content of these versions.

1.4 Terms, and Different Things with the Same Name

This article will consistently use the following terms:

Surface: An API or a settings page that answers a control question. One of the 18 items described in Section 1.2.
Organization Type: One of the three organization types described in Section 1.2.
Credential: An API key, OAuth token, or cloud credentials used to access a surface.
Platform: One of the six platforms described in Section 1.2.
Role: A name representing a level of permission within an organization, such as "admin," "owner," or "primary owner."

The sources this article read contain different things with the same name.

Admin API key: In Console organizations, this refers to keys that begin with sk-ant-admin01-, created on the Admin keys page. In Enterprise organizations, this refers to keys that begin with sk-ant-api01-, created on the API page in the claude.ai Organization settings. The Spend Limits API page and Claude Tag API page refer to the latter as a Scoped Admin API key. This article will refer to the former as the Console Admin API key and the latter as the Enterprise scoped key.
Usage: The Usage page in Claude Console, the /v1/organizations/analytics/usage endpoint of the Usage and Cost Analytics API, and the /v1/organizations/usage_report/messages endpoint of the legacy Usage and Cost API are all separate systems.
Analytics: The Usage and Cost Analytics API, the Claude Enterprise Analytics API, and the Claude Code Analytics API are three distinct APIs, each requiring a different key.
Workspace: In Claude Console, a workspace is a unit that groups API keys and limits. In Claude Platform on AWS, a workspace is associated with an AWS Region and has an ARN. The Slack workspace used with the Claude Tag API is a Slack unit and is not related to a Claude Console workspace.
Spend limits: The Spend Limits API manages per-member spending limits within Enterprise organizations. Monthly limits for Console organizations and workspaces are configured on the Spend limits page in Claude Console. This article will refer to the former as the Spend Limits API and the latter as Console limits.
Claude Tag: Claude Tag is the name of a claude.ai product that allows users to incorporate Claude into Slack as a colleague. It is not a feature for tagging resources.
IP allowlist: In this article, the IP allowlist refers to the IP allowlist set on an Anthropic organization. The IP allowlist on the side of a remote MCP server is a different thing, and this site's Which MCP Clients a Remote MCP Server Lets In covers it.
Workload Identity Federation: In this article, Workload Identity Federation refers to Anthropic's Workload Identity Federation. Google Cloud's Workload Identity Federation is a separate system.
Webhook: In this article, the organization webhook refers to the Admin API's /v1/organizations/webhooks endpoint. A separate webhook is used for Claude Managed Agents, which sends session and agent events. Claude release notes indicate that the Claude Managed Agents webhook was released on May 6, 2026, and became available on Claude Platform on AWS on May 29, 2026.
Legacy: This article uses the term legacy only when the documentation says legacy. "Legacy" does not mean end of life or deprecation. See Section 6.3.

1.5 Terms for the State of the Sources

This article uses the following six terms to describe the state of the documentation. These terms, including their English spellings, are also used in the tables.

Stated: The documentation contains a statement regarding the matter.
Stated as not supported: The documentation explicitly states that the matter is not supported or cannot be used.
Documentation does not list: While a list or table exists, the specific item is not included. This does not necessarily indicate that the matter is unsupported or unavailable.
No statement found: Despite searching using different keywords and categories of documentation (as described in Section 1.3), no relevant statement could be found. This does not necessarily indicate that the matter is absent or impossible.
Sources disagree: The statements regarding the same matter in two different documents are contradictory. This article presents both statements, along with their sources, without designating either as incorrect.
Inference: This is an inference made by this article, and is not a statement found in any of the documentation. This article says in the same sentence that it is an inference.

All dates referenced in this article are presented with the year. Pages may be rewritten after the verification date.

2. Control Questions and the Surface That Answers Each

This chapter starts from control questions and looks up the surface that answers each.

2.1 From Question to Surface

Table 1 lists ten control questions and the surfaces that answer them. The verification date is November 12, 2026.

Control Question	Surface That Answers It	Organization Type
Who belongs to the organization, and with which role?	Admin API members and invites. For Enterprise organizations, also groups and custom roles.	Console, Enterprise
Which credentials can call the API?	API keys in the Admin API, Workload Identity Federation	Console
From which networks can it be accessed?	IP allowlist	Console, Enterprise
Who did what?	Compliance API Activity Feed	Console, Enterprise, Claude Platform on AWS
How much was used?	Usage and Cost Analytics API, legacy Usage and Cost API, Claude Enterprise Analytics API, Claude Code Analytics API	Varies by surface
Where are caps set?	Console limits, Rate Limits API, Spend Limits API	Varies by surface
Can prompts be routed through your own inspection before inference?	Inference hooks	Enterprise
Can stored data be encrypted with your own keys?	CMEK	Console, Enterprise, Claude Platform on AWS
Did anyone at Anthropic access the data?	Access Transparency	See Section 7.1
Will you be notified if Anthropic restricts a user profile?	Organization webhooks. However, events are not yet being sent.	Console

In Table 1, the organization types are the ones that each surface's page names. Organizations on Claude Platform on AWS have only a subset of the surfaces available to Console organizations (see Section 4.3).

2.2 When One Question Has Two or More Surfaces

The questions "How much was used?" and "Where are caps set?" each have two or more surfaces. Which surface to use depends on the organization type.

Regarding "How much was used?":

For Console organizations, the Usage and Cost Analytics API is used. The legacy Usage and Cost API continues to be supported.
For Enterprise organizations, both the Usage and Cost Analytics API and the Claude Enterprise Analytics API are used.
For Claude Code usage metrics, Console organizations use the Claude Code Analytics API. The Claude Enterprise Analytics API reports claude.ai usage in Enterprise organizations.

Regarding "Where are caps set?":

Monthly limits for a Console organization and its workspaces are set on the Spend limits page in Claude Console.
Workspace rate limits can also be configured using the Rate Limits API.
For Enterprise organizations, limits per member are configured using the Spend Limits API. The Spend Limits API is not available to Console organizations.

3. Keys and Roles

This chapter shows the credentials for calling each surface and the roles that can create them.

3.1 Console Organization Admin API Key

The Console organization Admin API key is created on the Admin keys page within Claude Console. The key begins with sk-ant-admin01- and only members with the admin role can create it. The Admin API keys page describes the scope of this key as follows:

Claude Console keys do not have selectable scopes; every key carries full access to all endpoints that accept Admin API keys (the service-account and federation endpoints noted at the top of this page do not accept Admin API keys).

In other words, a single Console Admin API key can call the Admin API, the Usage and Cost Analytics API, the legacy Usage and Cost API, the Rate Limits API, the Claude Code Analytics API, and the Compliance API Activity Feed. The table on the Admin API keys page lists these six as the surfaces this key can call.

3.2 The Enterprise Organization's Scoped Key

Enterprise organization keys are created on the API page under Organization settings in claude.ai. These keys begin with sk-ant-api01-. The primary owner of the parent organization can create keys that apply to all linked organizations. Organization owners, on the other hand, can only create keys with the Compliance API scope, and these keys are limited to their own organization.

When creating a key, you must select a scope, and this scope cannot be added later. The table on the Admin API keys page lists the surfaces this key can call: user management, the Plugins API, the Claude Tag API, the Compliance API, the Claude Enterprise Analytics API, the Usage and Cost Analytics API, and the Spend Limits API.

The name of this key differs from page to page. The Compliance API page calls such a key a "Compliance Access Key," while the Analytics APIs page calls it an "Analytics API key." The Spend Limits API page and the Claude Tag API page call it a Scoped Admin API key. The Admin API keys page describes all of them as keys created on the same page in claude.ai, whose scopes decide the surfaces they can call. This article calls them Enterprise scoped keys.

Console Admin API keys and Enterprise scoped keys are not interchangeable. The Analytics APIs page states the following:

The key types are not interchangeable: an Admin API key cannot call the Claude Enterprise Analytics API, and an Analytics API key cannot call the Admin API.

The same page notes, as an exception, that Enterprise organizations can access the Usage and Cost Analytics API using an Analytics API key. The Admin API keys page advises companies with both organization types to create a key in each:

A key created in one organization cannot be used to manage a different organization. If your company uses both Claude Console and Claude Enterprise, create one key in each.

3.3 OAuth Tokens, Personal Keys, and Service Account Keys

The Admin API accepts two types of keys, in addition to the Admin API key from the Console.

OAuth tokens with the org:admin scope, which members with the admin, owner, or primary owner role can obtain.
Personal keys and service account keys that are not scoped to a workspace. They have the same permissions as the linked account.

The Claude release notes state that personal keys and service account keys became available in the Claude Console on August 27, 2026. The same section also mentions that workspace API keys will be maintained as a legacy option.

Endpoints for service accounts, federation issuers, and federation rules only accept OAuth tokens with the org:admin scope. The Admin API page states the following:

An Admin API key covers most endpoints. The service-account, federation-issuer, and federation-rule endpoints accept only an org:admin OAuth token

3.4 Credentials on the Platforms

For Claude Platform on AWS and Claude Models on Google Cloud (Anthropic managed), cloud credentials are used instead of Anthropic-provided keys.

On Claude Platform on AWS, you can use SigV4 signatures with AWS credentials, or use API keys created in the AWS Console. OAuth is not supported.
For Claude Models on Google Cloud (Anthropic managed), Google Cloud credentials are used. For organization-level routes, the roles/claude.admin role is required. The same page notes that API keys are not supported.

The Claude Platform on AWS page states the following regarding OAuth:

OAuth authentication: Not supported. Use SigV4 or API key authentication.

3.5 Quick Reference: Keys and Roles

Table 2 lists, for each credential, where it is created, the roles that can create it, and the surfaces it can call. The information was verified on November 12, 2026.

Credential	Where It Is Created	Roles That Can Create It	Surfaces It Can Call
Console Admin API key (prefix: `sk-ant-admin01-`)	Claude Console, Admin keys page	admin	Admin API, Usage and Cost Analytics API, legacy Usage and Cost API, Rate Limits API, Claude Code Analytics API, Compliance API Activity Feed
Enterprise scoped key (prefix: `sk-ant-api01-`)	claude.ai, Organization settings, API page	primary owner (organization owner if only using the Compliance API scope)	User management, Plugins API, Claude Tag API, Compliance API, Claude Enterprise Analytics API, Usage and Cost Analytics API, Spend Limits API (depending on the selected scope)
`org:admin` OAuth token	Obtained via `ant auth login`, etc.	admin, owner, primary owner	Admin API. This key is the only one that can access service account and federation endpoints.
Personal key, service account key	Claude Console	The permissions of the linked account	Keys not scoped to a workspace can call the Admin API.
AWS credentials	AWS IAM	Based on IAM policies	The four Admin API groups on Claude Platform on AWS, and the Compliance API Activity Feed.
Google Cloud credentials	Google Cloud IAM	`roles/claude.admin`	Organization-level routes on Claude Models on Google Cloud (Anthropic managed).

The Claude API key is a key for calling the models, and it begins with sk-ant-api03-. The table on the Compliance API page lists the Claude API key as one that cannot be used with the Compliance API.

4. Surfaces by Organization Type

This chapter shows the surfaces that each of the three organization types can use.

4.1 Console Organizations

The Admin API page lists the organizations that can utilize the Admin API as follows:

The Admin API is available to Claude Console and Claude Enterprise organizations. It isn’t available to organizations on the claude.ai Team plan or to individual Console accounts.

Within a Console organization, users can access the Admin API for members, invites, workspaces, API keys, rate limits, service accounts, Workload Identity Federation, and external keys for CMEK. The table on the User management page lists workspaces, API keys, and rate limits as endpoints exclusively available within a Console organization.

Console organizations can also utilize the Compliance API's Activity Feed. In a standalone Console organization, an organization admin must enable the Compliance API on the Compliance page in Claude Console and access it using the Console's Admin API key. For Console organizations linked to a Claude Enterprise parent organization, the parent organization's primary owner must enable it. The Compliance API page details the scope of two keys as follows:

Two key types unlock the Compliance API. A Compliance Access Key (created in claude.ai) reaches every endpoint, and an Admin API key (created in Claude Console) reaches the Activity Feed only.

Within a Console organization, the Spend Limits API, Claude Tag API, and endpoints for groups and custom roles are not supported.

4.2 Enterprise Organizations

The Admin API page describes the following regarding Enterprise organizations:

Claude Enterprise (claude.ai) organizations call the Admin API with a scoped API key created in claude.ai. From this page, only the members and invites endpoints apply to them.

The surfaces that only Enterprise organizations can use are groups, reading custom roles, the Spend Limits API, the Claude Tag API, the Plugins API, the Claude Enterprise Analytics API, and Inference hooks. The User management page notes that the endpoints for members and invites are the same for both organization types.

Members and invites are the same endpoints for both organization types; this page documents their Claude Enterprise behavior, including the Claude Enterprise organization roles. The group and custom-role endpoints exist only for Claude Enterprise.

Within Enterprise organizations, the Admin API does not support endpoints related to workspaces, API keys, or rate limits. The table on the User management page marks them Not available for Enterprise organizations.

The Inference hooks page specifies the following limitations for Inference hooks:

Inference hooks are available only to Claude Enterprise organizations.

Configuring Inference hooks requires the organization:manage permission on claude.ai. Only the Owner and Primary owner roles possess this permission.

4.3 Claude Platform on AWS Organizations

Claude Platform on AWS organizations can use only four groups of the Admin API. Both the Admin API page and the Claude Platform on AWS page list these same four groups.

Workspace endpoints: create, get, list, update, and archive on /v1/organizations/workspaces.
External key endpoints: /v1/organizations/external_keys for CMEK. There is no dedicated "validate" endpoint; keys are validated when attached to a workspace.
The telemetry destination endpoints.
The two endpoints of the Usage and Cost Analytics API.

The Claude Platform on AWS page describes the remaining endpoints as follows:

Other Admin API endpoints (organization members, workspace members, invites, API keys, the legacy Usage and Cost API, and rate limit reports) are not available. AWS IAM manages organization membership.

Workspace member management is also unavailable. The AWS IAM policy on the workspace ARN decides access. The Claude Code Analytics API is also unavailable. The Claude Code Analytics API page describes this as follows:

If you’re using Claude Platform on AWS, view Claude Code usage on the Usage page in the Claude Console instead.

The Monitoring and logging page of the AWS user guide directs readers to Anthropic's Usage and Cost API page for programmatic access to usage and cost data. That Usage and Cost API page states the following:

Claude Platform on AWS: The Usage and Cost API endpoints are not available. Use the Usage and Cost Analytics API.

The Feature support page of the AWS user guide also states that the usage report and cost report endpoints are not available (Section 7.2).

The Claude Platform on AWS page states that Claude Platform on AWS organizations can also set monthly spending limits for both the organization and workspaces on the Spend limits page in Claude Console. Its sentence says that you can configure your own limits below the tier-based limits.

You can also set your own monthly spend limits below the cap.

The Available pages table on the same page marks the Through AWS gateway column of the Workspaces row as Yes (except spend limits). The page clarifies the meaning of this column as follows:

The Through AWS gateway column indicates whether the page reads and writes data through the AWS gateway (and is therefore governed by IAM actions for Claude Platform on AWS). Pages marked No read organization-level metadata directly from Anthropic and bypass IAM action checks.

In essence, Yes (except spend limits) indicates that setting workspace limits does not go through the AWS gateway. It does not mean that you are unable to set limits. The same table also shows No in the Through AWS gateway column for the Spend limits row.

In contrast, the Feature support section of the AWS user guide lists Spend limits among the features not available on Claude Platform on AWS.

Spend limits: Not available. Rely on AWS billing controls instead.

The Available pages table on the Using the Claude Console page of the AWS user guide has no Spend limits row. The same table describes the Workspaces page as View per-region workspaces (read-only) and shows No in its Via AWS gateway column.

Anthropic's and AWS's documents disagree on monthly spending limits for Claude Platform on AWS organizations and on the Workspaces page in Claude Console (Section 7.2).

The Rate Limits API page describes the configuration of workspace rate limits as follows:

Setting workspace rate limits is not available on Claude Platform on AWS.

The Compliance API's Activity Feed is also available on Claude Platform on AWS. The Claude release notes state that it became available on Claude Platform on AWS on June 9, 2026. The IAM action ListComplianceActivities authorizes this call.

4.4 Quick Reference by Organization Type

Table 3 lists the main surfaces for the three organization types. The information was verified on November 12, 2026.

Surface	Console Organization	Enterprise Organization	Claude Platform on AWS Organization
Admin API members and invites	Stated	Stated	Stated as not supported. AWS IAM manages members.
Admin API workspaces	Stated	Stated as not supported	Stated
Admin API API keys	Stated	Stated as not supported	Stated as not supported. API keys are managed in the AWS Console.
Groups and custom roles	Stated as not supported	Stated. Custom roles are read-only	No statement found
Usage and Cost Analytics API	Stated	Stated	Stated
Legacy Usage and Cost API	Stated	No statement found	Stated as not supported (Section 7.2)
Claude Enterprise Analytics API	Stated as not supported	Stated	No statement found
Claude Code Analytics API	Stated	No statement found	Stated as not supported
Rate Limits API	Stated	Stated as not supported	Stated as not supported
Spend Limits API	Stated as not supported	Stated	No statement found
Console limits	Stated	No statement found	Sources disagree (Section 7.2)
Compliance API	Activity Feed only	Stated	Activity Feed only
IP allowlist	Stated	Stated	Stated as not supported
Inference hooks	Stated as not supported	Stated	No statement found
Claude Tag API	Stated as not supported	Stated	No statement found
CMEK	Stated	Stated	Stated. AWS KMS keys only

In Table 3, the Stated as not supported for Inference hooks in Console organizations comes from the Inference hooks page (Section 4.2), which makes the feature available only to Enterprise organizations. Likewise, the Stated as not supported for the Claude Enterprise Analytics API in Console organizations comes from the information on the Analytics APIs page, which indicates that the Claude Enterprise Analytics API cannot be accessed using an Admin API key.

5. Where Each Surface Applies

This chapter shows, for each surface, whether it is available on each of the six platforms.

5.1 What the Platform Pages List as Not Supported

Three platform pages list admin surfaces as not supported.

Bedrock pages, encompassing both the Claude in Amazon Bedrock page and the bedrock-runtime page, include the following items in their list of unavailable features:

API endpoints (Message Batches, Models, Admin, Compliance, Usage and Cost)

The Google Cloud Google managed page lists the following items as unavailable:

API endpoints: Message Batches API, Models API, Admin API, Compliance API, and Usage and Cost API

The Foundry page lists the Admin API and Compliance API as unavailable.

The Google Cloud Anthropic managed page does not list admin surfaces among the unsupported features. On this platform, organizations have access to the Claude Console, and workspaces are created in the Claude Console. The IAM permissions page for the same platform lists the following organization-level routes: /v1/organizations/external_keys, /v1/organizations/usage_report/messages, /v1/organizations/analytics/usage, and /v1/organizations/analytics/cost. It grants all of these routes only to roles/claude.admin.

The Claude Platform on AWS page states that the Admin API outside the four groups in Section 4.3 is not available.

5.2 What the Surface Pages Say About Platforms

Some surface pages also say something about platforms.

The IP allowlist page names the platforms where the IP allowlist does not apply:

The allowlist doesn’t apply to Claude in Amazon Bedrock, Claude Platform on AWS, Claude Models on Google Cloud, or Claude in Microsoft Foundry.

The Inference hooks page states the following:

Inference hooks are not available on Amazon Bedrock or Google Cloud.

The Inference hooks page does not mention Claude Platform on AWS or Claude in Microsoft Foundry. Inference hooks are a feature of Enterprise organizations, and this article records Claude Platform on AWS and Foundry as No statement found (Table 3 and Section 7.2).

The OpenTelemetry page separates tracing into two categories. Traces emitted by the Claude SDK can be emitted on any platform. Traces emitted by the API are only available with Claude Platform and Claude Platform on AWS. In the table on the OpenTelemetry page, the Cloud platform support row shows Any for SDK tracing and Claude Platform and Claude Platform on AWS for API tracing. The feature information at the top of the OpenTelemetry page lists seven platforms as beta. As an inference by this article (Inference), this refers to the scope of the traces that the SDK emits.

The table on the Access Transparency page shows the following for each platform:

Claude API and Claude Code used with API keys: Yes
Claude Platform on AWS: Yes. Events are available through the Compliance API but not through AWS CloudTrail.
Microsoft Foundry: No, Not available
Amazon Bedrock and Claude Models on Google Cloud (Google managed): No. The page points to the provider's own transparency controls.

There is no entry for Claude Models on Google Cloud (Anthropic managed) in the same table.

The feature information at the top of the organization webhooks page lists only the Claude API as a platform.

The data retention page states that ZDR is available with the Claude API, Claude Platform on AWS, and Claude Models on Google Cloud (Anthropic managed). On the latter two, ZDR is enabled on request. HIPAA readiness covers the Claude API and Claude in Microsoft Foundry, but is not available on Claude Platform on AWS. Foundry requires a Business Associate Agreement (BAA) with Anthropic, as well as HIPAA configuration within an Azure subscription.

Claude Platform on AWS: HIPAA readiness is not available on Claude Platform on AWS.

Regarding Amazon Bedrock and Google Cloud's Agent Platform, the data retention page directs users to consult the provider's documentation.

5.3 Availability by Platform

Table 4 lists the 13 surfaces that Console organizations and Claude Platform on AWS organizations use, across the six platforms. The verification date is November 12, 2026. In the table, "Google Cloud (AM)" refers to Claude Models on Google Cloud (Anthropic managed), while "Google Cloud (GM)" refers to Claude Models on Google Cloud (Google managed).

Surface	Claude API	Claude Platform on AWS	Amazon Bedrock	Google Cloud (AM)	Google Cloud (GM)	Foundry
Admin API	Stated	Four groups only	Stated as not supported	External key and usage routes (as listed on the IAM page)	Stated as not supported	Stated as not supported
Workspaces and Console limits	Stated	Workspaces: Stated. Console limits: Sources disagree (Section 7.2)	No statement found	Stated	No statement found	No statement found
Workload Identity Federation	Stated	No statement found	No statement found	No statement found	No statement found	No statement found
CMEK	Stated	AWS KMS keys only	No statement found	Google Cloud KMS keys	No statement found	No statement found
Usage and Cost Analytics API	Stated	Stated	No statement found	Stated	No statement found	No statement found
Legacy Usage and Cost API	Stated	Stated as not supported (Section 7.2)	Stated as not supported	Usage endpoint only	Stated as not supported	No statement found
Claude Code Analytics API	Stated	Stated as not supported	Stated as not supported	Documentation does not list	Stated as not supported	Stated as not supported
Rate Limits API	Stated	Stated as not supported	Stated as not supported	Documentation does not list	Stated as not supported	Stated as not supported
Compliance API	Stated	Activity Feed only	Stated as not supported	Stated	Stated as not supported	Stated as not supported
Access Transparency	Stated	Stated	Stated as not supported	Documentation does not list	Stated as not supported	Stated as not supported
OpenTelemetry export	SDK and API	SDK and API	SDK only	SDK only	SDK only	SDK only
IP allowlist	Stated	Stated as not supported	Stated as not supported	Stated as not supported	Stated as not supported	Stated as not supported
Organization webhooks	Stated	Documentation does not list	Documentation does not list	Documentation does not list	Documentation does not list	Documentation does not list

Table 4 is based on the following rationale.

The Stated as not supported status for the Claude Code Analytics API and Rate Limits API within Amazon Bedrock, Google Cloud (GM), and Foundry, is based on combined text from two pages. The platform pages list Admin or Admin API as not supported, while the Claude Code Analytics API page and Rate Limits API page state that their respective endpoints are part of the Admin API.

The Stated as not supported status for Amazon Bedrock and Google Cloud (GM) for the legacy Usage and Cost API comes from the Usage and Cost and Usage and Cost API items on the platform pages.

For Amazon Bedrock and Google Cloud (GM) concerning the Usage and Cost Analytics API, the status is No statement found. The Usage and Cost item on the platform pages does not tell the legacy Usage and Cost API apart from the Usage and Cost Analytics API. The Usage and Cost Analytics API page does not state that its endpoints are part of the Admin API.

The Stated as not supported status for Claude Platform on AWS, Amazon Bedrock, Google Cloud, and Foundry regarding IP allowlisting, is based on the doesn’t apply text on the IP allowlist page. This article writes this status as Stated as not supported in the tables, while the corresponding text in the main body uses the original wording, doesn’t apply.

The Documentation does not list status for organization webhooks, comes from the feature information at the top of the organization webhooks page, which only lists support for the Claude API.

The "SDK only" designation for OpenTelemetry export, is based on the API tracing row in the table on the OpenTelemetry page, which only lists support for Claude Platform and Claude Platform on AWS.

The cells for Admin API, Claude Code Analytics API, and Rate Limits API for Google Cloud (AM), are based on the IAM permissions page for Google Cloud Anthropic managed services. The organization-level routes this page lists are only the external key and usage routes.

For Claude Platform on AWS regarding the Compliance API, the designation "Activity Feed only" is based on the IAM actions page for Claude Platform on AWS. The Compliance section on this page only lists ListComplianceActivities and GET /v1/compliance/activities.

5.4 Surfaces Only for Enterprise Organizations

The Spend Limits API, Claude Tag API, Claude Enterprise Analytics API, Inference hooks, and endpoints for groups and custom roles are surfaces only for Enterprise organizations. These surfaces apply to claude.ai organizations. Whether they apply depends not on which of the six platforms you call Claude from, but on whether the organization is a claude.ai organization.

Of the pages for these surfaces, two say something about platforms. The Inference hooks page specifies that this feature is not available with Amazon Bedrock or Google Cloud. The Analytics APIs page clarifies that the Claude Enterprise Analytics API does not provide data for Claude Code usage accessed through Amazon Bedrock.

If your organization uses Claude Code through Amazon Bedrock, the Claude Enterprise Analytics API does not return Claude Code activity for that usage.

6. Status, Versions, and Dates

This chapter shows the status of each surface and the dates when it changed.

6.1 Beta Surfaces and Beta Headers

The following surfaces are in beta as of the verification date. For surfaces that require a beta header, the header name is listed below.

Usage and Cost Analytics API: Released in beta on October 29, 2026. The header is analytics-usage-cost-2026-08-24.
Organization webhooks: Added to the Admin API in beta on October 20, 2026. The header is webhooks-2026-10-07.
Claude Tag API: Released in beta on October 23, 2026. The header is experimental-claude-tag-2026-10-21.
OpenTelemetry export: Released in beta on October 14, 2026.
IP allowlist: Became available in beta in the Claude Console on November 5, 2026. The feature information at the top of the IP allowlist page also indicates a beta status.
Access Transparency log: The feature information at the top of the page indicates a beta status.
Plugins API: The Admin API page describes it as in beta and for Enterprise organizations only.

The Usage and Cost Analytics API page describes the header as follows:

The Usage and Cost Analytics API is in beta. Send the anthropic-beta: analytics-usage-cost-2026-08-24 header and an anthropic-version header on every request.

The Claude Tag API page describes the behavior when no header is included:

A request without it returns 404, exactly as if the endpoint did not exist.

In essence, if you forget to include the header when using the Claude Tag API, the endpoint looks as if it does not exist.

6.2 Surfaces That Came Out of Beta

The following surfaces came out of beta. This article follows the language in the Claude release notes, specifically the term out of beta.

User management endpoints for Enterprise organizations (members, invites, groups, and custom roles): Released in beta on July 14, 2026, and came out of beta on August 19, 2026.
Compliance API session endpoints: Came out of beta on August 26, 2026, for sessions with Cowork and Claude Code.
Admin API SDK Methods: Added to the SDKs under client.beta.organization on August 26, 2026. On September 30, 2026, methods related to organization information, members, invites, workspaces, API keys, rate limits, service accounts, Workload Identity Federation, CMEK, and compliance settings came out of beta and became accessible via client.organization.
Inference hooks: Released in beta for Enterprise organizations on August 5, 2026, and came out of beta on October 20, 2026.

According to the Claude release notes, the Admin API itself was released on November 21, 2024. The change on September 30, 2026, is that SDK methods came out of beta; it does not reflect a change in the status of the Admin API's REST endpoints.

6.3 Legacy Surfaces

The following two are legacy. Both remain supported.

The legacy Usage and Cost API and four endpoints of the Claude Enterprise Analytics API: became legacy on October 29, 2026.
Workspace API keys: remain available as a legacy option as of August 27, 2026.

The Claude release notes, dated October 29, 2026, describe the change as follows:

The Usage and Cost API is now a legacy API, and so are the usage_report, cost_report, user_usage_report, and user_cost_report endpoints of the Claude Enterprise Analytics API. All of them remain supported.

The Usage and Cost API page also states:

The Usage and Cost API (/v1/organizations/usage_report/messages and /v1/organizations/cost_report) is a legacy API and remains supported.

No statement of an end date for the legacy APIs was found in the pages this article read (No statement found). This article does not describe legacy as end of life or deprecation. For new integrations, the Usage and Cost API page recommends the Usage and Cost Analytics API.

6.4 Registrable, but Not Delivering

Organization webhooks can be registered through the Admin API at /v1/organizations/webhooks. There are two event types: when Anthropic restricts or bans one of the organization's user profiles, and when that restriction is lifted. However, the organization webhooks page states the following:

Event delivery isn’t live: Anthropic doesn’t send the two events, so an endpoint you register receives nothing.

In other words, even if you register an endpoint, you will not receive any notifications as of the current verification date. To use organization webhooks, you must request access from your Anthropic account team. Organizations that have enabled HIPAA readiness cannot use them.

All members of an organization can view and list organization webhooks. Only users with the admin, owner, or primary owner roles can create, modify, delete them, or replace the signing secret.

Any member of your organization can list and view organization webhook endpoints with the API, but only members with the admin, owner, or primary owner role can create, change, or delete them, or replace their signing secret.

6.5 Surfaces Without a Status Word, and Surfaces Without a Release Date

The pages of the following surfaces have no status word such as beta or legacy.

Claude Code Analytics API: The Claude release notes indicate that this was released on September 10, 2025. The page has no status word (No statement found).
Rate Limits API: The Claude release notes indicate that this was released on April 24, 2026. The page has no status word.
Workload Identity Federation: The Claude release notes indicate that this was released on May 4, 2026. The page has no status word.
Spend Limits API: The page has no status word.
Compliance API: The page has no status word for the whole API. For each endpoint, the Claude release notes give the dates when it entered beta and came out of beta.

For the following surfaces, no statement of the release date was found in the Claude release notes (No statement found).

Spend Limits API
CMEK
Compliance API
Claude Enterprise Analytics API
Access Transparency
The IP allowlist for Enterprise organizations. The IP allowlist for Claude Console is listed as November 5, 2026.

This article does not say whether these surfaces are new or old.

7. The Surface Table

This chapter summarizes the content from Chapters 2 through 6 in a single table.

7.1 The 18 Surfaces

Table 5 lists the 18 surfaces with the questions they answer, organization types, credentials and roles, and status and dates. The verification date is November 12, 2026. Availability on each platform is in Table 4.

Surface	Question It Answers	Organization Type	Credentials and Roles	Status and Dates (Verified November 12, 2026)
Admin API	Who joins the organization and what roles they have. What keys are available.	Console, Enterprise (members and invites), Claude Platform on AWS (four groups)	Console Admin API key, `org:admin` scope, Enterprise scoped key, AWS credentials	Released on November 21, 2024. SDK methods came out of beta on September 30, 2026.
Workspaces and Console limits	Where usage is separated, and where monthly limits are set.	Console, Claude Platform on AWS	Claude Console admin	Added workspace support on September 10, 2024.
Workload Identity Federation	Can you authenticate using tokens from an Identity Provider (IdP) instead of static keys?	Console	Configurable by admin, owner, and primary owner. Use `org:admin` when configuring via the Admin API.	Released on May 4, 2026.
CMEK	Can you encrypt stored data using your own keys?	Console, Enterprise, Claude Platform on AWS	Organization Admin, Owner, or Primary Owner; Claude Platform on AWS Admin	No statement found regarding release date. Contact your account team to enable.
Usage and Cost Analytics API	How much usage has occurred?	Console, Enterprise, Claude Platform on AWS	Console Admin API key, key with `read:analytics` scope, AWS credentials	Beta. Released on October 29, 2026.
Legacy Usage and Cost API	How much usage has occurred?	Console	Console Admin API key	Legacy. Effective as of October 29, 2026. Support continues.
Claude Enterprise Analytics API	Usage and adoption of claude.ai.	Enterprise	Analytics API key (Enterprise scoped key)	4 endpoints are legacy as of October 29, 2026. Support continues.
Claude Code Analytics API	Daily metrics for Claude Code.	Console	Console Admin API key	Released on September 10, 2025. No statement found regarding status.
Rate Limits API	What are the rate limits? How are workspace limits configured?	Console	Console Admin API key, `org:admin`	Released on April 24, 2026.
Spend Limits API	How are member-specific spending limits defined?	Enterprise	Enterprise scoped key with the `read:spend_limits` or `write:spend_limits` scope	No statement found regarding release date.
Compliance API	Who did what?	Console and Claude Platform on AWS (Activity Feed only); Enterprise (all actions)	Compliance Access Key, Console Admin API key	Varies by endpoint. Sessions came out of beta on August 26, 2026.
Access Transparency	Has an Anthropic representative accessed your data?	See Table 4	Read via Compliance API Activity Feed	On request. The log is in beta.
OpenTelemetry export	Can you export API and Managed Agents traces to your own infrastructure?	Console, Claude Platform on AWS	Claude Console admin can add destinations.	Beta. Released on October 14, 2026.
IP allowlist	From which networks can you access?	Console, Enterprise	Console: admin and owner; Enterprise: owners and primary owners	Beta. Available on Claude Console from November 5, 2026.
Inference hooks	Can you route prompts through your own inspection process before inference?	Enterprise	`organization:manage` (Owner and Primary owner)	Came out of beta on October 20, 2026.
Organization webhooks	Can you be notified when a user profile is restricted?	Console	Admin, owner, and primary owner can create and modify.	Beta. Available from October 20, 2026. Events are not currently sent.
Claude Tag API	Can you manage Claude settings within Slack using code?	Enterprise	Enterprise scoped key with the `read:claude_tag` or `write:claude_tag` scope	Beta. Available from October 23, 2026.
Data Retention (ZDR and HIPAA readiness)	Are there agreements regarding data retention and handling of Protected Health Information (PHI)?	Console, Claude Platform on AWS (ZDR only)	ZDR is enabled on an organization-by-organization basis by your account team.	No statement found regarding status.

In Table 5, the organization types are the ones that each surface's page names. For Access Transparency, the table on the Access Transparency page is written by platform and product, so Table 5 refers to Table 4. That table marks claude.ai Enterprise seats as Not covered.

The organization type for organization webhooks is given as "Console" because the organization webhooks page lists Claude API organizations as a prerequisite for use.

7.2 Where the Sources Disagree, and Where No Statement Was Found

This article identified two points where the sources disagree.

The first is monthly spending limits for Claude Platform on AWS organizations. The Claude Platform on AWS page states that they can be set (Section 4.3), while the Feature support page of the AWS user guide states Not available. The table on the Using the Claude Console page of the AWS user guide has no Spend limits row, and the same table describes the Workspaces page as read-only and as not passing through the AWS gateway.

The second is the legacy Usage and Cost API on Claude Platform on AWS. The Usage and Cost API page and the Feature support page of the AWS user guide state that it is not available. The Monitoring and logging page of the AWS user guide directs readers to the Usage and Cost API page for programmatic access to usage and cost data (Section 4.3).

This article does not conclude that any of these documents is incorrect.

Separately, the entry Yes (except spend limits) in the Available pages table on the Claude Platform on AWS page appears to conflict with the text describing spending limits on the same page. However, as shown in Section 4.3, this refers to the value in the "Through AWS gateway" column, and therefore does not represent a discrepancy.

The matters for which this article found no statement (No statement found) are the following:

The launch dates for the Spend Limits API, CMEK, Compliance API, Claude Enterprise Analytics API, and Access Transparency (Section 6.5).
The date when the Enterprise organization's IP allowlist became available (Section 6.5).
The status descriptions for the Claude Code Analytics API, Rate Limits API, Workload Identity Federation, and Spend Limits API (Section 6.5).
The end dates for legacy APIs (Section 6.3).
Whether Workload Identity Federation is available on platforms other than the Claude API (Table 4).
Whether Inference hooks are available with Claude Platform on AWS and Foundry (Section 5.2).

Regarding Workload Identity Federation, the Claude Platform on AWS page states that it does not support OAuth. From this statement, this article does not conclude that Claude Platform on AWS does not support Workload Identity Federation.

8. Failure Modes

This chapter lists mix-ups that are easy to make when choosing and using the admin surfaces.

Trying to manage an Enterprise organization with a Console organization's Admin API key. The Admin API keys page states that these keys only function in the organization that created them (Section 3.2).
Calling the Admin API with an Analytics API key, or calling the Claude Enterprise Analytics API with a Console Admin API key. The Analytics APIs page states that these two keys are not interchangeable (Section 3.2).
Trying to create service accounts and federation rules with a Console Admin API key. These endpoints only accept OAuth tokens with the org:admin scope (Section 3.3).
Inviting members with the Admin API in a Claude Platform on AWS organization. The Claude Platform on AWS page states that members are managed through AWS IAM (Section 4.3).
Reading Yes (except spend limits) on the Claude Platform on AWS page as meaning that spend limits cannot be set. This is the value in the "Through AWS gateway" column (Section 4.3). The AWS user guide's Not available for spend limits is a separate disagreement between the sources (Section 7.2).
Calling the legacy Usage and Cost API in a Claude Platform on AWS organization by following the Monitoring and logging page of the AWS user guide. The Usage and Cost API page states that it is not available on Claude Platform on AWS and points to the Usage and Cost Analytics API (Section 4.3).
Assuming that the IP allowlist also restricts calls from Amazon Bedrock and Claude Platform on AWS. The IP allowlist page states that it does not apply to these services (Section 5.2).
Expecting notifications of user profile restrictions after registering an organization webhook. The organization webhooks page states that these events are not yet being sent (Section 6.4).
Assuming that the Usage and Cost API can no longer be used because it became legacy. The Claude release notes state that it remains supported (Section 6.3).
Trying to set spend limits for a Console organization with the Spend Limits API. The Spend Limits API page states that it cannot be used with Console organizations (Section 2.2).
Leaving out the beta header on a Claude Tag API request, getting a 404, and concluding that the endpoint does not exist (Section 6.1).
Taking the Claude Tag API for an API that adds tags to resources. The Claude Tag API page describes it as an API for configuring Slack product settings.

Claude Tag is a claude.ai product. This API manages it for a Claude Enterprise organization and has nothing to do with Claude Platform workspaces, API usage, or the Claude Console.

Assuming that Access Transparency also covers claude.ai Enterprise seats. The table on the Access Transparency page marks them Not covered (Section 7.1).
Expecting Claude Code usage through Amazon Bedrock to appear in the Claude Enterprise Analytics API. The Analytics APIs page states that this is not the case (Section 5.4).

9. Frequently Asked Questions About Claude Admin Surfaces

Q1. Are the Admin API keys the same for Console organizations and Enterprise organizations?

No, they are not. Console organizations create Admin API keys that begin with sk-ant-admin01- on the Admin keys page within Claude Console. These keys do not have a scope. Enterprise organizations create keys that begin with sk-ant-api01- on the API page in the Organization settings on claude.ai, and they must select a scope when creating the key. The two types of keys are not interchangeable and only work in the organization in which they were created.

Q2. Can a Claude Platform on AWS organization use the Admin API?

Only partly. It can use four groups: workspaces, external keys for CMEK, telemetry destinations, and the Usage and Cost Analytics API. The following are not available: members, workspace members, invites, API keys, the legacy Usage and Cost API, and rate limit reporting. Member management is handled through AWS IAM. Calls are authenticated using either SigV4 signatures with AWS credentials or API keys created in the AWS Console (Section 3.4).

Q3. Does the IP allowlist apply to calls made from Amazon Bedrock?

No, it does not. The IP allowlist page states that it does not apply to Claude in Amazon Bedrock, Claude Platform on AWS, Claude Models on Google Cloud, or Claude in Microsoft Foundry. In a Console organization, the IP allowlist applies to the Claude Console UI, the Claude API's Messages, Message Batches, Token Counting, Models, Files, and Skills endpoints, five Claude Managed Agents endpoints, and the Admin API and Compliance API. For Enterprise organizations, the IP allowlist applies to claude.ai in a browser and the apps, Claude Code, and Cowork. However, even within Enterprise organizations, it does not apply to Claude Design, Claude in Slack, or Claude Academy.

Q4. Does registering an organization webhook bring notifications of user profile restrictions?

Currently, you will not be notified. The organization webhooks page states that Anthropic does not send the two events, and nothing is delivered to the registered endpoint. It is possible to register an endpoint and create a receiver to handle the format of the events.

Q5. Is the legacy Usage and Cost API still available?

Yes, it is. According to the Claude release notes, the Usage and Cost API became legacy on October 29, 2026, and it remains supported. For new integrations, the Usage and Cost API page recommends the Usage and Cost Analytics API, which is in beta and requires the analytics-usage-cost-2026-08-24 header. However, in Claude Platform on AWS organizations, the legacy Usage and Cost API is not available (Q2 and Section 7.2).

Q6. Can a Console organization set a cap for each member?

The Spend Limits API does not allow this. The Spend Limits API is only available for Enterprise organizations. Within a Console organization, you can set monthly spending limits for both the organization and workspaces on the Spend limits page in Claude Console. Workspace rate limits can also be configured using the Rate Limits API.

Q7. Where can you see whether anyone at Anthropic accessed the data?

In organizations that have enabled Access Transparency, records will appear in the Compliance API's Activity Feed. Access Transparency is enabled on request; an organization cannot turn it on by itself. The table on the Access Transparency page applies to the Claude API and Claude Platform on AWS, and excludes claude.ai Enterprise seats, Microsoft Foundry, Amazon Bedrock, and Claude Models on Google Cloud (Google managed).

Access Transparency is available to eligible customers on request and is not self-serve.

Q8. Can a Console organization use Inference hooks?

No, it cannot. The Inference hooks page explicitly states that this feature is only available to Enterprise organizations and cannot be used with Amazon Bedrock or Google Cloud. Inference hooks came out of beta for Enterprise organizations on October 20, 2026. Setting up Inference hooks requires the Owner or Primary owner role.

10. Summary

Look up Claude's admin surfaces by the following five points:

Keys: The term "Admin API key" refers to two distinct keys: the key of Console organizations, which begins with sk-ant-admin01-, and the scoped key of Enterprise organizations, which begins with sk-ant-api01-. These keys are not interchangeable. The service account and federation endpoints only accept OAuth tokens with the org:admin scope.
Organization Types: Console organizations manage workspaces, API keys, and rate limits. Enterprise organizations have access to groups, the Spend Limits API, the Claude Tag API, and Inference hooks. Organizations using Claude Platform on AWS utilize only four specific groups of the Admin API, and membership is managed through AWS IAM.
Platforms: Amazon Bedrock, Claude Models on Google Cloud (Google managed), and Foundry are listed as platforms where the Admin API and Compliance API are not available. The IP allowlist does not apply to the five platforms other than the Claude API. On Claude Platform on AWS, Anthropic's and AWS's documents disagree on monthly spending limits and the legacy Usage and Cost API (Section 7.2).
Status: The Usage and Cost Analytics API, organization webhooks, the Claude Tag API, OpenTelemetry export, and the IP allowlist are currently in beta. Inference hooks and Enterprise user management have moved out of beta. The legacy Usage and Cost API remains supported. While organization webhooks can be registered, no events are currently being sent.
Verification Date: The status of the surfaces changed several times between August and November 2026. Tables 4 and 5 reflect the status as of November 12, 2026.

11. References

References:
Tech Blog with curated related content

Written by Hidekazu Konishi