Anthropic / Claude coverage

The Admin API connector brings every Claude API key, workspace, member, daily cost and audit event at your company under Trefur, without code changes. OpenTelemetry traces from your own agents, and Claude Code's own telemetry, add per-call detail.

Anthropic does NOT support OAuth for the Admin API. The connector authenticates with a scoped admin key (sk-ant-admin01-…). Functionally that's a service-account equivalent — same trust model, no per-user grant layer, and no way to narrow the key to fewer capabilities. Treat the admin key like any high-privilege service credential: store it in your secret manager, rotate it on cadence, and audit which Trefur operators can read it.

Choose your path

What the connector gives you, at a glance.

Path	Setup effort	Latency	What we see	User attribution	Best for
Admin API connector	Admin API key (no OAuth)	15 min poll cadence	Metadata only (no prompt/completion text)	principal email via workspace_members	Inventory + discovery — every key, every workspace, every member, daily cost

Path 1 — Admin API connector

The CISO mints an Anthropic Admin API key in the Console once and pastes it into Trefur. Every 15 minutes Trefur polls the 5 Admin API surfaces, records each Claude API key as an observed agent, attributes daily token + cost roll-ups to a principal email via the workspace_members map, and writes audit events (member.invited, api_key.created, api_key.rotated, etc.) into the activity record with canonical event types.

# 1. Mint an Admin API key in the Anthropic Console:
#    Settings → API Keys → "Create Key" → role: Admin
#    The key prefix will be sk-ant-admin01-...
#
# 2. Trefur stores the key in its AES-256-GCM credential vault.
#    Paste it under Sources → Connections → Anthropic Admin.
#
# 3. The connector pulls 5 surfaces every 15 minutes:
#    GET /v1/organizations/{org_id}/audit_logs
#    GET /v1/organizations/{org_id}/usage_report/messages
#    GET /v1/organizations/{org_id}/workspaces
#    GET /v1/organizations/{org_id}/workspace_members
#    GET /v1/organizations/{org_id}/api_keys
#
# 4. Per call, we capture:
#    - workspace_id           -> tenant-scope inventory
#    - api_key_id + name      -> recorded as observed agents
#    - principal email        -> resolved via workspace_members
#    - daily token + cost     -> aggregate per (api_key, model, day)
#    - audit events           -> mapped to canonical event types
#                                (team_member_invited, agent_key_minted, etc.)

Requires an Anthropic Enterprise or Teams plan. The Admin API does not include prompt or completion text — Anthropic doesn't expose them at all. For per-call content scanning, layer OpenTelemetry traces from your agents on top.

Per-call content: OpenTelemetry traces

For prompt, completion and tool-call detail from the agents you own, send their OpenTelemetry traces to Trefur over OTLP/HTTP. Spans that follow the OpenTelemetry GenAI semantic conventions need no mapping; the quickstart shows the exporter settings.