Skip to content

Anthropic connector

What this connector reads

The Anthropic connector reads your Anthropic organisation's workspaces and the API key counts associated with each. We see workspace IDs, names, creation dates, and the number of API keys issued per workspace — not request bodies, not response contents, not the prompts your applications send to Claude.

Important: Anthropic is also one of our subprocessors — we use Claude as the LLM that classifies AI artefacts in our control plane. The Anthropic connector documented here is a separate, customer-controlled flow: you grant us read access to your Anthropic org. The two relationships are independent. See subprocessors for the distinction.

What you (the customer) need to do

You will need an Anthropic organisation owner or admin.

  1. In the Anthropic console, go to Settings → API Keys and create an Admin key. Admin keys are distinct from regular sk-ant-api… keys: they grant access to organisation-level endpoints (/v1/organizations/*) but cannot send messages.
  2. Copy the admin key. Treat it as a credential.
  3. In Secruna, open Connections → Connect Anthropic. (screenshot placeholder TODO)
  4. Paste the admin key. We immediately validate by calling GET /v1/organizations/users?limit=1. A 401 here indicates a non-admin key and we reject without storing.
  5. On success, the key is encrypted and stored in our Azure Key Vault under the connection ID; the connection is active.

Permissions / scopes requested

Anthropic admin keys do not have OAuth scopes. The endpoints Secruna actually exercises are:

Endpoint Why
GET /v1/organizations/users?limit=1 Validation only, on connect and every discovery run.
GET /v1/organizations/workspaces (paginated) List workspaces in the org.
GET /v1/organizations/api_keys?workspace_id=… (paginated) Count API keys per workspace.

All requests carry the standard headers x-api-key: <admin-key> and anthropic-version: 2023-06-01.

What we do NOT touch

  • Prompts and completions. We do not call /v1/messages or any inference endpoint.
  • Workspace contents beyond name and ID — we do not enumerate prompts, evaluation runs, or stored artefacts.
  • API key contents — we count keys, we do not read or rotate individual key values.
  • Billing or spend data.

How to revoke access

  1. In the Anthropic console → Settings → API Keys, click Revoke on the admin key you issued to Secruna.
  2. In Secruna, open Connections and click Disconnect on the Anthropic row. We delete the encrypted secret from Key Vault on disconnect.
  3. Within 90 days every artefact collected through this connection is purged. See data retention policy.

Troubleshooting

Error you see Likely cause Fix
Key is not an admin-scoped Anthropic key You pasted a regular sk-ant-api… key, not an admin key. Generate an admin key in Settings → API Keys.
Anthropic key validation failed: 429 The org has hit its admin-API rate limit. Wait and retry.
Connection active but 0 workspaces The org has only the default workspace and listing returns it under a different shape — known edge case in older organisations. Email support so we can adjust the query.