Anthropic Compliance API Adds Unified Chats and Word Document Export

Unified Claude Chats and Word Document Export in the Compliance API

The release notes published on 2026-10-08 introduce two capabilities to the Anthropic Claude Platform Compliance API. First, the chat endpoints now capture interactions from the unified Claude experience. When an end user begins an interaction in Claude and that conversation continues inside a remote cloud session, the Compliance API returns the combined sequence as a single chat record rather than fragmenting it across disconnected logs. Second, the Compliance API now permits automated downloads of Claude Docs documents as Word files. Both capabilities are available in beta for Claude Enterprise organizations.

Prior to this update, organizations monitoring Claude deployments had to parse interactions across different interfaces and storage containers. The unified chat ingestion consolidates cloud agent workflows directly into standard conversation logs. Security, legal, and compliance teams running electronic discovery (eDiscovery) or data loss prevention (DLP) pipelines can ingest these extended interactions without modifying their authentication mechanisms or deploying new credential sets.

Organization Eligibility, Key Types, and Scope Requirements

Access to unified chat ingestion and Claude Docs Word exports is restricted by organization tier and key permission scope. These endpoints require a Claude Enterprise subscription. Organizations operating standalone Claude Console accounts without an enterprise parent organization can only query organizational activity via the Activity Feed and cannot query user chat content, files, or project items.

• Claude Enterprise Parent Organization: Centralizes directory identities and links claude.ai organizations and Claude Console organizations. Content endpoints serve data exclusively from Claude Enterprise environments.
• Compliance Access Key (sk-ant-api01-...): Created inside claude.ai. Required for querying content endpoints, downloading files, listing messages, and inspecting projects.
• Admin API Key (sk-ant-admin01-...): Created in Claude Console. Restricted to the Activity Feed (GET /v1/compliance/activities). Attempting to use this key on chat, file, or project endpoints triggers an HTTP 403 Forbidden error.
• Permission Scope: Content retrieval endpoints require the read:compliance_user_data scope. Programmatic hard deletions require delete:compliance_user_data.

Administrators do not need to issue new Compliance Access Keys to benefit from the 2026-10-08 updates. Any existing key that already possesses the read:compliance_user_data scope can immediately query the updated unified chat payloads and invoke the Word document download endpoint.

Querying Unified Chats: Schema and Tool Payloads

Listing conversations is handled by querying GET /v1/compliance/apps/chats. The default mode covers the entire parent organization without specifying individual user identifiers. Sorting by update timestamp using order_by=updated_at ensures that incremental polling captures newly initialized chats, new replies to older conversations, project reassignments, and chats removed by users in claude.ai.

curl --fail-with-body -sS -G \
  "https://api.anthropic.com/v1/compliance/apps/chats" \
  --header "x-api-key: $ANTHROPIC_COMPLIANCE_ACCESS_KEY" \
  --header "anthropic-version: 2023-06-01" \
  --data-urlencode "order_by=updated_at" \
  --data-urlencode "updated_at.gte=2025-06-01T00:00:00Z" \
  --data-urlencode "limit=100"

When a chat identifier is retrieved, compliance pipelines fetch the complete message list using GET /v1/compliance/apps/chats/{chat_id}/messages. For conversations within the unified Claude experience, work completed by Claude in an Anthropic-managed cloud environment is reflected in the message content array. Actions taken by Claude appear as tool_use blocks with the tool name and input arguments, while execution responses appear as tool_result blocks referencing the matching tool_use_id.

chat_id="claude_chat_01H5CWunD7RpVJ5bHa8RCkja"

curl --fail-with-body -sS \
  "https://api.anthropic.com/v1/compliance/apps/chats/$chat_id/messages" \
  --header "x-api-key: $ANTHROPIC_COMPLIANCE_ACCESS_KEY" \
  --header "anthropic-version: 2023-06-01"

Each message entry contains a chat_messages record with role attributes representing the participant (user or assistant), along with attachment arrays: files for user uploads, generated_files for binary assets produced during execution, and artifacts for markdown or code documents updated across iterative conversation turns.

Downloading Attachments, Artifacts, and Word Files

The Compliance API routes file and document retrieval through specific endpoints determined by the identifier prefix. Attachments, tool-generated binaries, artifacts, and Claude Docs documents are addressed by distinct ID types.

The 2026-10-08 release enables downloading Claude Docs files as Word documents. When retrieving binary files via GET /v1/compliance/apps/chats/files/{file_id}/content, the response is delivered as chunked binary data. Systems handling these payloads must inspect the actual bytes rather than relying solely on file extensions or reported headers.

file_id="claude_file_01UaT9wBcDfGhJkLmNpQrSv7"

curl --fail-with-body -sS \
  "https://api.anthropic.com/v1/compliance/apps/chats/files/$file_id/content" \
  --header "x-api-key: $ANTHROPIC_COMPLIANCE_ACCESS_KEY" \
  --header "anthropic-version: 2023-06-01" \
  --output "downloaded_file.bin"

File download responses include several specific headers: Transfer-Encoding: chunked, Content-MD5 (a base64-encoded digest under RFC 1864), Content-Type, and Content-Disposition. The Content-Disposition header utilizes the RFC 5987 extended format (filename*=utf-8''...). Automated ingest tools should extract this value safely, stripping leading slashes, dashes, or relative path dots to prevent directory traversal risks.

Comparing Governance and Telemetry Mechanisms

Anthropic provides multiple governance, logging, and monitoring mechanisms across enterprise deployments. Selecting the appropriate tool depends on whether an integration requires real-time prompt intervention, live operational telemetry, aggregated accounting, or retrospective audit data.

While Inference hooks evaluate prompts before model execution and OpenTelemetry streams live runtime events, the Compliance API remains the definitive interface for downloading stored files, reviewing artifacts, and auditing historical conversation histories.

Operational Constraints, Deprecations, and Gotchas

Integrating the Compliance API requires awareness of rate limits, pagination rules, and critical query deprecations that cause errors if ignored.

• Shared Rate Limit: All /v1/compliance/* endpoints share a throughput ceiling of 600 requests per minute per parent organization (or per organization for standalone Claude Console tenants). Remote session endpoints carry a distinct supplementary budget. When throttled, the API returns HTTP 429 Too Many Requests.
• Deprecated Query Combinations: Combining user_ids[] with updated_at.* range parameters is deprecated and will be rejected with an HTTP 400 Bad Request error after 2026-09-22. To monitor specific users by update time, run an organization-wide query sorted by order_by=updated_at and filter by user ID on the client side.
• Custodian Query Rules: Filtering by user_ids[] supports between 1 and 10 user IDs, but forces order_by=created_at. Specifying order_by=updated_at alongside user_ids[] immediately returns an HTTP 400 error.
• Opaque Cursors: Pagination cursors (first_id and last_id) are cryptographically bound to the chosen sort key. Passing an after_id issued under order_by=updated_at into a query sorting by created_at results in an HTTP 400 error.
• Soft-Deleted Conversations: When users remove conversations inside claude.ai, the chat record is retained in the API with a populated deleted_at timestamp and an empty name. Message text, attached files, and artifacts are purged, meaning message endpoints return records without underlying body content.
• Stored Text vs Raw Uploads: For certain office documents (such as PowerPoint, Word, and text-heavy PDFs), claude.ai stores extracted plain text rather than the original binary bytes. In those cases, the file endpoint streams the extracted text under the original upload name.

Implementation and Migration Checklist

To align compliance and archival pipelines with the 2026-10-08 updates, development and security teams should verify the following architectural steps:

• Verify that ingestion scripts include both the x-api-key header and the mandatory anthropic-version: 2023-06-01 header on every request.
• Confirm that the API key in use is a Compliance Access Key (sk-ant-api01-...) carrying the read:compliance_user_data scope, rather than a Claude Console Admin API key.
• Audit conversation-parsing logic to ensure message processing accommodates tool_use and tool_result blocks generated by the unified Claude experience.
• Update custodian-tracking services ahead of the 2026-09-22 deprecation deadline by replacing user-filtered updated_at calls with organization-wide polling loops.
• Verify that binary download consumers support chunked transfer encoding and correctly parse RFC 5987 filename* parameters to store Word exports and generated files safely.
• Implement exponential backoff and retry handling to account for the shared quota of 600 requests per minute and HTTP 429 response codes.