Connect the Anthropic Compliance API

​

How it works

• Sync: Endor Labs pulls the organizations, users, groups, and group members from your Claude Enterprise directory on a schedule. It stores one directory entry per user in your namespace, keyed by corporate email.
• Resolve: At the start of a Claude Code session, the hook looks up the developer’s Claude account email in the synced directory. It caches the result for the session, so no later tool call pays for the lookup.
• Match: Session policies with role_matchers or group_matchers evaluate against the resolved roles and groups. A session with no resolved identity skips those policies, so an unknown developer is never blocked by mistake.

​

Before you begin

• Your Claude Enterprise organization has the Compliance API enabled. A primary owner enables it in claude.ai under Organization settings > API.
• You are a primary owner or an organization owner in claude.ai. A primary owner can create a key that covers every organization under the parent organization. An organization owner can create a key for their own organization only.
• You have the Admin role in the Endor Labs namespace that owns your Coding Agent Governance policies, either as a user or through an API key.
• endorctl is installed, or you have a way to call the REST API directly.
• Developers sign in to Claude Code with their Claude Enterprise account. Resolution keys on that account’s email. See How Endor Labs matches a developer to check how a session resolves.

​

Create a Compliance Access Key

1. Decide which organizations the key covers. A parent-organization key reaches every linked organization from one enrollment, and a single-organization key reaches one.
2. Sign in to claude.ai with a role that can create the key you decided on. Only a primary owner of the parent organization can create a parent-organization key.
3. In claude.ai, select Organization settings > API.
4. Under Keys, click Create key.
5. Enter a name, such as endor-labs-directory-sync.
6. Select the scopes read:compliance_org_data and read:compliance_user_data, leave every other scope clear, then click Create.
7. Copy the key, which starts with sk-ant-api01-. claude.ai shows it only once.
8. Store the key in your secret manager until you complete the enrollment.

​

Enroll your organization

endorctl api create -r ComplianceEnrollment -n "<namespace>" --data '{
  "meta": { "name": "anthropic-compliance" },
  "spec": {
    "access_token": "<compliance-access-key>",
    "enabled": true
  }
}'

• spec.access_token: The Compliance Access Key. Required. Endor Labs validates it against the Compliance API before it stores it, encrypts it, and never returns it. Reads show a redacted placeholder instead.
• spec.enabled: Whether the sync runs. Defaults to true. Set it to false later to pause the sync without discarding the key.
• meta.name: Optional. Defaults to Anthropic Compliance Enrollment when you omit it.

• A key that can call the Anthropic model API, or that holds organization admin access, is too broad. Create a compliance key with only the two directory scopes.
• A key that reaches no organization, or that reads organizations but not users, is too narrow. Add the missing scope on a new key.

​

What the sync stores

• meta.name: The user’s corporate email. This is the key the hook resolves against.
• spec.identity.email and spec.identity.display_name: The email and full name from the directory.
• spec.identity.roles: The user’s built-in Anthropic organization role, such as admin, billing, claude_code_user, developer, owner, primary_owner, or user. Endor Labs stores the value Anthropic returns and does not expand custom RBAC role names.
• spec.identity.groups: The names of every Claude organization group the user belongs to.
• spec.organization_uuid: The Claude organization that the entry came from.

​

Verify the sync

endorctl api list -r ComplianceEnrollment -n "<namespace>"

endorctl api list -r AgentDirectoryEntry -n "<namespace>" --filter 'meta.name=="<developer-email>"'

​

How Endor Labs matches a developer

1. The Claude account the developer is signed in to, read from claude auth status. Only a first-party Claude login counts. Sessions authenticated with an API key or a non-Anthropic provider, such as Amazon Bedrock, Google Vertex AI, or Microsoft Foundry, report no account email.
2. The account record in the local Claude Code configuration. The hook reads it only when claude auth status cannot answer at all, because the binary is missing, times out, or returns output the hook cannot parse. It also skips the record when the environment shows Claude Code authenticating with something other than a Claude account login, such as an API key or a cloud provider.
3. The CLAUDE_CODE_USER_EMAIL environment variable, when CLAUDE_CODE_ACCOUNT_UUID and CLAUDE_CODE_ORGANIZATION_UUID are also set.
4. The ENDOR_ACTOR environment variable, which your managed Claude Code settings can set in the same env block that carries the Endor Labs credentials. See Deploy hooks for Claude Code to find that block.
5. The operating system login.

​

Use identity in a policy

endorctl api create -r AgentHookPolicyDefinition -n "<namespace>" --data '{
  "meta": { "name": "alert-contractor-sessions" },
  "spec": {
    "policy": {
      "name": "Alert on contractor sessions",
      "enabled": true,
      "activity": { "session": { "top_level": { "group_matchers": ["^contractors$"] } } },
      "action": {
        "match_type": "MATCH_TYPE_BLOCKLIST",
        "alert": { "message": "A contractor started a governed Claude Code session." }
      }
    }
  },
  "propagate": true
}'

​

Pause, rotate, or remove the enrollment

UUID=$(endorctl api list -r ComplianceEnrollment -n "<namespace>" | jq -r '.list.objects[0].uuid')

​

Pause the sync

endorctl api update -r ComplianceEnrollment -n "<namespace>" --uuid "$UUID" \
  --field-mask spec.enabled --data '{ "spec": { "enabled": false } }'

​

Rotate the key

endorctl api update -r ComplianceEnrollment -n "<namespace>" --uuid "$UUID" \
  --field-mask spec.access_token --data '{ "spec": { "access_token": "<new-compliance-access-key>" } }'

​

Remove the enrollment

endorctl api delete -r ComplianceEnrollment -n "<namespace>" --uuid "$UUID"

​

Limitations

• Identity resolution runs for Claude Code sessions only. Cursor, Codex, and GitHub Copilot sessions carry no organization identity.
• role_matchers and group_matchers apply to session-level policies only. Tool, command, and file events do not match on identity.
• Identity policies fail open. A session with no resolved identity skips them, and the hook never blocks a developer because a lookup failed.
• The developer’s machine asserts the email. Endor Labs does not authenticate it against the directory.
• Role and group changes reach policy evaluation only after the next sync run. See What the sync stores to find the sync schedule.
• One enrollment per namespace. The sync reconciles the whole namespace against one directory.
• The sync reaches only the organizations the key covers. A primary owner’s parent-organization key covers every linked organization, and an organization owner’s key covers one.
• The policy form does not expose identity criteria. Manage identity criteria and enrollment through the REST API.

​

Next steps

• See Match on developer identity to write session policies that use roles and groups.
• See Deploy hooks for Claude Code to put hooks on the developer machines that resolve identity.
• See Triage policy violations to review the sessions your identity policies flag.