A Claude Code audit trail is the transcript, not the Activity Feed
A Claude Code audit trail is two stores, not one. The Compliance API returns local session transcripts only for Claude Enterprise sign-in, kept six years by default. Bedrock, Vertex, Foundry, web sessions, HIPAA-ready orgs and ZDR are not captured. Pexon treats the Activity Feed as who-did-what, never as the prompt log.
The feed is not the transcript
No Claude Code audit trail lives in the Activity Feed. The feed tells you who changed a setting. The transcript tells you what the model was asked to read.
Coverage
What a Claude Code audit trail actually has to hold
| Requirement | What the Compliance API covers | Still needed |
|---|---|---|
| Who signed in, who changed settings, when | Activity Feed: six years, queryable within one minute, not backfilled before enablement | A decision to leave the API on. Turning it off stops new events; old events stay, but the gap is permanent |
| Prompts, assistant text, tool calls for Claude Code | Local session messages, product_surface claude_code, only with a Compliance Access Key | Claude Enterprise sign-in on that session. A Console API key or a third-party cloud path is invisible here |
| Sessions on Bedrock, Vertex, Foundry, or Claude Code on the web | Not captured. Anthropic lists these as exclusions | Your cloud audit trail, or a gateway that logs the prompt before it leaves the tenant |
| Files the session never sent to the API | Not captured. Local sessions record what reached the Claude API, not what happened on the device | Endpoint DLP and disk encryption. The JSONL under ~/.claude is a second copy, in plaintext |
| HIPAA-ready orgs and sessions under zero data retention | No local session data. ZDR sessions return 404 on retrieve | A written exception. The Compliance API will not fill this gap later |
Every cell is from Anthropic's Compliance API FAQ and session documentation, read 15 September 2026. Tool inputs default to a 10,000-byte truncation.
Three stores, three owners, one word that keeps being misused
Audit trail, in a Claude Code review, is three different stores that people collapse into one sentence. The Activity Feed is the who-and-when log. The local session endpoints are the prompt-and-tool log for Enterprise-signed-in clients. The JSONL under ~/.claude/projects/ is the copy that never left the laptop. A sign-off that names only the first store has not reviewed Claude Code. It has reviewed the admin console.
Anthropic is explicit about the split. The Activity Feed does not include prompt or message content. Retrieving transcripts takes a Compliance Access Key with read:compliance_user_data. An Admin API key, the kind a Console admin can mint, returns 403 on those endpoints. A standalone Claude Console organisation cannot mint a Compliance Access Key at all, so prompt text is not available to it through this API.
Capture of local sessions is tied to enablement and to sign-in. Requests have to reach the Claude API. Nothing extra is installed on the device. That is the honest limit, not a footnote: a Read of a .env that the model never sent is not in the export, and it is in the JSONL if Claude Code wrote the session to disk. The directory documentation states those transcripts are not encrypted at rest.
Split of duty
Who holds which copy
Anthropic, once you enable the API
- Activity Feed: six years of organisation events, independent of content retention, not retroactive.
- Local transcripts: six years by default, or your shorter conversation retention, while Enterprise sign-in holds.
- Rate limit: 600 requests per minute per parent organisation, shared across /v1/compliance/*.
- Deletes: immediate and permanent. Pull anything you need for legal hold before it is gone.
You, on every path the API will not see
- Identity: force Claude Code onto the Enterprise account, not a Console API key in a developer shell.
- Cloud path: Bedrock, Vertex and Foundry need your own logs. The session endpoints will stay empty.
- Disk: cleanupPeriodDays in managed settings, disk encryption, deny-rules on credential files.
- Gateway: if the tenant must log every prompt, log it before inference. The Compliance API is after the fact.
What has to be true before you call this an audit trail
- Enablement: the primary owner turns the Compliance API on at the Claude Enterprise parent. Recording is not backfilled.
- Key type: a Compliance Access Key from claude.ai with read:compliance_user_data. An Admin API key is the wrong object.
- Sign-in path: Claude Code sessions in terminal, Desktop and the IDE extension while signed into the Enterprise account.
- Retention: either accept the six-year default for captured local content or set a finite conversation retention and live with the shorter archive.
- Local copy: set cleanupPeriodDays in managed settings. The default is 30 days. Zero is rejected. Plaintext is the given.
- Exception list: write down Bedrock, web, HIPAA-ready and ZDR as out of scope for this API, or do not run Claude Code there.
Documented request
This is Anthropic's own list call for local sessions, copied from the session documentation. A 200 with product_surface claude_code means capture is on. A 403 means you brought the Admin key.
# Local session metadata. Compliance Access Key, not a model key.
# Copied from Anthropic's session documentation; not run against a Pexon tenant.
curl --fail-with-body -sS -G \
"https://api.anthropic.com/v1/compliance/apps/sessions/local" \
--header "x-api-key: $ANTHROPIC_COMPLIANCE_ACCESS_KEY" \
--data-urlencode "created_at.gte=2026-07-01T00:00:00Z" \
--data-urlencode "limit=100"IDs look like clls_…. Messages are a second call: GET /v1/compliance/apps/sessions/local/{session_id}/messages. New sessions appear after a short delay, typically minutes, not instantly.
When this API is the wrong tool
If the workload is Bedrock, Foundry, HIPAA-ready or under zero data retention, the session endpoints will not grow a trail later. You need logs in your tenant, or you need to move the workload onto Enterprise sign-in. If the question is whether the works council will accept reviewers reading prompts, that is a people decision, not a curl. The evidence pack for the rest of Claude Code — sandbox, MCP inventory, permission policy — is the 12-artefact security review, not this page.
From trail to the rest of the review
- Claude Code security review: the 12-artefact evidence pack — the money page this clearance sits under
- LLM gateway for Claude: one audit trail for every call — the path when Bedrock or API keys make the Compliance API blind
- Claude GDPR checklist: 14 checks before you roll out — processor, retention and ZDR, which this page does not re-argue
- Claude Code cost per developer: the eight OpenTelemetry metrics — cost telemetry is a different API family; Anthropic says so
What the reviewer will ask
Is the Activity Feed a Claude Code audit trail?
No. Anthropic's Compliance API FAQ states that the Activity Feed records who did what and when — authentication, chat creation, administrative changes — and does not capture prompt text or model responses. The transcript of a Claude Code session is a different endpoint family, and it needs a Compliance Access Key with read:compliance_user_data, not the Admin API key that can only read the feed.
Does an Admin API key retrieve Claude Code transcripts?
No. An Admin API key carries read:compliance_activities and reaches the Activity Feed only. Calling a session or chat endpoint with it returns 403 naming the missing scope. Transcripts require a Compliance Access Key created in claude.ai. A standalone Claude Console organisation cannot create that key, so it cannot retrieve prompt text through the Compliance API at all.
Are Claude Code sessions on Bedrock or Vertex in the Compliance API?
No. Anthropic lists the exclusions explicitly: Claude Code authenticated with a Console API key, Claude Code through Amazon Bedrock, Google Cloud or Microsoft Foundry, and Claude Code on the web are not captured. Those paths need your own gateway logs, cloud audit trails, or they are invisible. The local session endpoints only see requests that reached Anthropic's Claude API while the user was signed in with a Claude Enterprise account.
Where does the local Claude Code transcript live on disk?
In plaintext JSONL under ~/.claude/projects/, one file per session. Anthropic's Claude directory documentation states that transcripts are not encrypted at rest and that OS file permissions are the only protection. cleanupPeriodDays defaults to 30 and cannot be 0. Setting CLAUDE_CODE_SKIP_PROMPT_HISTORY skips writes entirely; that also means there is no local copy for your own DLP.
Is the Compliance API enough for production eDiscovery?
No, not on its own. Local sessions are captured as requests hit the Claude API, so on-device activity that never left the machine is not in the export. Tool inputs are truncated to 10,000 bytes by default. Thinking blocks, images and the system prompt are omitted. HIPAA-ready organisations get no local session data. Treat the API as the Enterprise-login path, then add disk controls and a gateway for every other path.
What does Pexon actually do here?
A two-week Readiness Blueprint at €4,900 net. We map which Claude Code path you actually run — Enterprise login, Console API key, Bedrock, or mixed — against the three stores (Activity Feed, session transcripts, ~/.claude JSONL), and hand back the enablement steps, the key-scope decision and the gap list your data protection officer can sign. This page is not legal advice.
Next step
Map the three stores against the path you actually run
Two weeks, €4,900 net. We take one real Claude Code workload — Enterprise login, Console API key, or Bedrock — and hand back which of the three stores it hits, which key scope you need, and the gap list a data protection officer can sign. Not legal advice.