Skip to main content
Connect Claude to Oleria to gain continuous visibility into who has access across your Anthropic organization. Oleria reads identity, access, and audit data from the Anthropic Admin API and Compliance API - mapping every member, workspace, API key, and (optionally) directory group and custom role in one place - so you can see where access is over-provisioned and take action directly from Oleria.

​
What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your Claude organization:
  • Accounts - every member of the organization, along with their organization role (user, Claude Code user, developer, billing, admin, owner, or primary owner) and admin status.
  • API keys - every API key in the organization, shown as a non-human account with its status (active or inactive), its workspace, and the member who created it.
  • Workspaces - every workspace and its membership.
  • Directory groups - groups synced from your identity provider through SCIM, or managed directly in Claude, and their members. Requires a Compliance Access Key.
  • Custom roles - the custom roles defined in your organization, the permissions each role grants, and which groups hold each role. Requires a Compliance Access Key.
  • Audit activity - organization audit events such as sign-ins, member and role changes, workspace and API key changes, and SSO or directory sync configuration changes. Requires the Compliance API to be turned on in Claude. See Get your credentials from Claude.
Oleria refreshes this data on its regular sync schedule.
Members, API keys, and workspaces need only an Admin API Key. Audit activity also works with only an Admin API Key, as long as the Compliance API was turned on before you created the key. Directory groups and custom roles are collected only when you also provide a Compliance Access Key, which is available only on Claude Enterprise plans. If no key can read audit activity, Oleria syncs without it and shows no error.
The Admin API Key reads the Claude Console organization it was created in. In a Claude Enterprise tenant, claude.ai and Claude Console organizations are linked under one parent organization but keep separate members. The accounts Oleria discovers may not match your claude.ai seat list.

​
Prerequisites

  • An admin, owner, or primary owner role in your Claude organization. Only these roles can create an Admin API key in the Claude Console.
  • To collect audit activity: the Compliance API turned on for your organization before you create the Admin API key. The Compliance API isn’t available on Team plans.
  • To collect directory groups and custom roles (optional): a Claude Enterprise plan with the Compliance API turned on, and the primary owner role, which is required to create a Compliance Access Key for the parent organization.
  • Admin access on the Oleria platform to add a new integration.
Use a key created by a service account or shared admin mailbox rather than a personal employee account, so the integration keeps working if the employee leaves or changes roles.

​
Get your credentials from Claude

Oleria connects with two keys. The Admin API Key is required. The Compliance Access Key is optional, for Claude Enterprise, and unlocks directory groups, custom roles, and audit activity from every linked organization.
1

Turn on the Compliance API

Do this before you create the Admin API key. An Admin API key reads audit activity only if the Compliance API was on when the key was created, and the Compliance Access Key in the last step can’t be created until it’s on. Skip this step only if you need neither audit activity nor a Compliance Access Key.
  • Claude Console organizations - sign in to the Claude Console as an admin, open Settings -> Security, and turn on Compliance API. If the section isn’t visible, your organization may not be eligible, or it’s linked to a Claude Enterprise parent organization.
  • Claude Enterprise - ask the primary owner to sign in to claude.ai, open Organization settings -> API, and turn on the Compliance API. It applies to every organization linked to the parent organization, including Claude Console organizations.
2

Create an Admin API key

Sign in to the Claude Console as an admin, open Settings -> Admin keys, and create a new key. Give it a recognizable name such as Oleria connector, then copy the key. It is displayed only once.
3

Create a Compliance Access Key (optional)

Requires a Claude Enterprise plan. Ask the primary owner to sign in to claude.ai, open Organization settings -> API, find the Keys section, and select Create key. Create the key for the parent organization so it covers every linked organization. If the page or the compliance scopes aren’t visible, your role can’t create the key or the Compliance API isn’t turned on yet. Select these scopes:
read:compliance_user_data also allows reading chats, files, and projects. Oleria calls only the group members endpoint and never reads conversation content, but the key itself carries that access. Store and rotate it accordingly. Don’t add delete:compliance_user_data. Oleria never needs it. Scopes can’t be changed after a key is created, so if a scope is missing, create a new key.
Only a key for the parent organization covers every linked organization. When you provide a Compliance Access Key, Oleria reads audit activity with it instead of the Admin API Key. A key created by an organization owner for a single organization would limit audit activity to that organization.
Copy the key. It is displayed only once.
Treat both keys like passwords. Anyone with a key can read the data its scopes allow. Oleria stores the keys encrypted and never displays them again after you save the integration.

​
Connect Claude to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations, then select the Claude tile.
2

Complete the connection form

Fill in the connection form:
3

Save the integration

Select Authenticate to validate and save the integration. Oleria runs a quick check against Claude to confirm the Admin API Key, and the Compliance Access Key if you provided one, are valid before saving.
When you connect, Oleria rejects a Compliance Access Key that is wrong or is missing read:compliance_org_data. Two other scopes are checked only when data syncs:
  • Missing read:compliance_user_data - directory groups sync without their members.
  • Missing read:compliance_activities - Oleria reads audit activity with the Admin API Key instead, which covers only the Claude Console organization the Admin key was created in. If activity from claude.ai or other linked organizations is missing, check this scope first.
Scopes can’t be changed after a key is created. To fix a missing scope, create a new Compliance Access Key in claude.ai, then edit the integration in Oleria and paste in the new key. If you revoke the Compliance Access Key, directory group and custom role sync fails until you replace it.
If you didn’t provide a Compliance Access Key and audit activity is empty, the Admin API Key was probably created before the Compliance API was turned on. Turn on the Compliance API, create a new Admin API key, then edit the integration in Oleria and paste in the new key. Activity Oleria couldn’t read before the new key isn’t collected later.

​
Verify the integration

Confirm the new instance appears on the Connected tab of your Oleria Integrations page with a status of Healthy. After the first sync completes, you can review the discovered accounts, API keys, workspaces, audit activity, and (with a Compliance Access Key) groups and roles in your Oleria workspace. Each Claude organization can be connected once. To connect more than one organization, add a separate integration with that organization’s keys.
If you rotate or revoke a key in Claude, update it in Oleria by editing the integration. When you edit the integration, re-enter the Admin API Key, and the Compliance Access Key if you use one, even if you’re changing only another field. Oleria re-validates the keys on every update. If you leave the Compliance Access Key blank, it’s removed, and directory groups and custom roles stop syncing. A revoked key stops discovery.

​
Migrate from the SCIM-based integration

Earlier versions of this integration connected through SCIM with a SCIM Base URL and Authentication Token. That connection type is no longer supported, and existing SCIM-based Claude integrations show as unhealthy. To migrate:
  1. Delete the existing Claude integration in Oleria.
  2. Follow the steps on this page to connect with an Admin API Key and, optionally, a Compliance Access Key.
  3. Optionally, turn off SCIM directory sync for Oleria in your Claude organization settings.

​
Remediation actions

Beyond discovery, Oleria can act on Claude access to remediate risk. Remediation actions use the Admin API Key, so the key must belong to an admin who can manage members. You don’t need a Compliance Access Key. How each action works:
  • Remove user from the organization - Claude has no disabled state, so removal deletes the member from the organization. Members with the admin role can’t be removed through the API. Remove them in Claude instead.
  • Invite user - sends an organization invite with the User role. The account appears in Oleria after the person accepts the invite and the next sync runs.
  • Assign or reset an organization role - sets one of the built-in organization roles: User, Claude Code User, Developer, Billing, or Admin. Resetting returns the member to User. Claude doesn’t allow setting the owner or primary owner role through the API.
  • Add or remove a workspace member - new members join with the Workspace User role.
Oleria checks that an action is valid before it runs, but it doesn’t check the Admin API Key’s permissions until the action executes. If an action fails, confirm the key was created by an admin who can manage members.

​
Known limitations

  • Directory groups can’t be changed from Oleria - groups synced from your identity provider are managed there. Oleria rejects workspace membership actions on them. Change group membership in your identity provider.
  • Custom roles can’t be assigned from Oleria - custom roles are held by groups, and Claude has no API to assign them to individual users. The role actions in Oleria set only the built-in organization roles.
  • No disabled state - Claude has no concept of a disabled member. Removing a member is the only deprovisioning path, and every member Oleria lists is shown as enabled.
  • MFA and SSO enrollment - per-member multi-factor authentication (MFA) and SSO status aren’t available from the Claude API. Oleria reports these fields as unavailable, not as a false negative. API keys show them as not applicable.
  • Audit activity needs the Compliance API - Claude records audit activity only while the Compliance API is on. Activity from before it was turned on doesn’t exist, so Oleria can’t collect it. If no key can read audit activity, Oleria skips it without an error.
  • Audit activity attribution - Oleria attributes an audit event to a person only when a signed-in member performed it. Events performed by API keys, SCIM directory sync, Anthropic, or the system are still collected but have no member attached.
  • Not collected - service accounts and workload identity federation, usage and cost reports, and conversation content.

​
Contact us

For questions about this integration, contact us at support@oleria.com.