Anthropic Adds Local Claude Session Transcripts to Its Compliance API
Eligible Claude Enterprise reviewers can now retrieve Claude Code and Cowork conversations, but coverage excludes ZDR, HIPAA-ready tenants, some cloud surfaces and device activity that never reached the API.
Anthropic added beta Compliance API access to local Claude Code and Cowork session transcripts on August 11, 2026. The official release notes limit the feature to Claude Enterprise organizations and say it works with an existing Compliance Access Key carrying the `read:compliance_user_data` scope.
The change gives security, legal and compliance teams a programmatic record of some agent activity that happens on employees' machines. It does not create a complete device history: Anthropic's documentation draws clear boundaries around which sessions are captured, what reaches a transcript and which enterprise configurations are excluded.
What the new endpoints expose
The session-transcript documentation describes three local-session endpoints. One lists sessions across the organization, one retrieves a session's metadata, and one returns its messages. A transcript contains the user prompts, assistant responses, tool calls and tool results from a single conversation. Anthropic says the records can support electronic-discovery exports and data-loss-prevention enforcement.
Current local coverage includes Cowork in Claude Desktop and Claude Code in a terminal, Claude Desktop or an IDE extension. Capture applies while the user is signed in with a Claude Enterprise account and the organization's Compliance API is enabled. The endpoints are read-only, require a Compliance Access Key rather than an Admin API key, and are still in beta.
Where capture stops
Anthropic records these conversations server-side as their requests reach the Claude API. It says nothing is installed on the device for this feature and nothing beyond the requests already sent to the API is collected. That means the transcript can show file or network activity only when it appears in a tool call or tool result; a local file that was never sent is outside the record.
Several product and policy boundaries also matter. Local-session results exclude Claude Code authenticated with a Claude Console API key, Claude Code running through Amazon Bedrock, Google Cloud or Microsoft Foundry, and Claude Code on the web. Anthropic also says it does not capture local sessions for organizations with HIPAA readiness enabled or sessions operating under zero data retention.
The default local-session retention period is six years, unless the organization has set a finite custom conversation-retention period. The API does not provide a deletion operation for either local or remote session transcripts. New sessions and messages may take several minutes to appear, so the surface is a retained audit channel rather than an instantaneous control.
How it differs from adjacent controls
Anthropic's Compliance API overview separates this record from its other enterprise tools. Analytics APIs provide aggregated usage and cost information, while the Compliance API provides event and session-level material for review teams. OpenTelemetry streams activity to a customer-run collector as it happens; the Compliance API retrieves retained transcripts from Anthropic on request. Inference hooks can allow or deny governed prompts before inference, whereas transcript retrieval happens after the fact.
That distinction is practical. The transcript endpoints can improve investigation and evidence collection, but they are not a preventive policy engine and do not independently prove that every local action was observed. Teams evaluating the beta still need to map identity, retention, encryption, access control and collection exclusions to their own governance requirements.
Evidence quality and limits
The feature and its documented boundaries are confirmed by Anthropic's own release notes and technical documentation. Internal confidence is medium because the evidence is entirely first-party. Anthropic has not supplied an independent completeness audit, reliability measurement, security assessment or evidence that use of the API produces a particular compliance outcome.
Status
Confirmed. Anthropic documents the beta endpoints as available to eligible Claude Enterprise organizations; the article does not claim universal coverage or legal sufficiency.
Sources
- Anthropic — Claude Platform release notes
- Anthropic — Retrieve session transcripts
- Anthropic — Compliance API overview
Update note: Last reviewed 2026-08-17. We will revise this post if Anthropic changes eligibility, capture coverage, retention or beta status.
Sources
- Anthropic — Claude Platform release notes — official
- Anthropic — Retrieve session transcripts — official
- Anthropic — Compliance API overview — official
Drafted with AI assistance from source briefs; reviewed for citation completeness and label accuracy.