> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/connect-your-technology/a-c-integrations/anthropic-claude-enterprise-compliance-api-setup-for-workbench.md).

# Anthropic Claude Enterprise Compliance API Setup for Workbench

Integrating your Anthropic Claude Enterprise Compliance API with Workbench allows Expel to access necessary activity fields to provide security coverage for your Claude.AI / Claude App Enterprise, Claude Cowork, and Claude Code instances. After the integration is configured and the t device onboarded, Expel will be able to filter through your data programmatically, add context, enrich it with intel, assess risk, and alert an Expel analyst for further investigation.

Expel will support Claude Code and Cowork as separate products in late 2026.

Learn more about [Expel MDR for AI](/more-features/expel-mdr-for-ai/about-expel-mdr-for-ai.md).

## About the Anthropic Compliance API

Expel will be able to ingest activity fields, prompt messages, and tool calls for Claude.ai, Claude Code, and Claude Cowork for this API. However, the coverage Expel provides depends on the SKU purchased. These three products have inherently different capabilities and function differently in relation to the machine a user is using with these products. These reasons dictate that the detection coverage between all three are slightly different, implying different levels of security value and cost.

If your organization primarily uses Claude.ai and other tooling similar to that, then the **MDR for AI** product may be the best fit for you. However, if your organization uses Claude Cowork and Claude Code products heavily, then purchasing **MDR for AI Security + AI Workflow and Development** is likely a better fit because it would entitle you to receive detections for all Anthropic products and products similar to them in the future.

## Scope and Limitations

* When provisioning a Claude Compliance Access Key, Expel will require an admin to create an API Key with up to two permission scopes. 
  * Required for **control plane** detections: `read:compliance_activities` scope. This will allow detections to be triggered off the activity fields in the API. 
  * Required for **content plane** detections: `read:compliance_user_data` scope. This will allow Expel to monitor prompts being input by users and resulting agent tool calls and interactions to detect suspicious or malicious commands ,attempts, and processes.

## Prerequisites

1. You must have admin access in Workbench to set up this integration.
2. You must have an active SKU with Expel MDR for On-Prem as well as MDR for SaaS Applications and Identity coverage to receive alerts from this integration.
3. You must have an MDR for AI SKU.
4. You must have the Claude Enterprise plan. This integration does not cover Claude free, Team, or Pro plans.
5. You must have access to an Anthropic account with either the Organizational Admin or Primary Owner role in order to create API keys with the appropriate scope(s).
6. You must have the Anthropic Compliance API enabled for your organization.

## Step 1: Create Compliance API Credentials for Expel

1. [Log in to Claude](https://claude.ai/login) as an Organization Admin or Primary Owner.
2. Navigate to **Organization settings > API**.
3. In the **Keys** section, select **Create Key**.
4. For **Name**, enter "expel-key".
5. Select the following **Scopes**:
   * `read:compliance_activities` 
   * `read:compliance_user_data` <br>

     <div align="left"><figure><img src="https://2371323735-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F82234aPbNfd179j5U4ti%2Fuploads%2Fpdl3rVc5BiBEpRf6EzrZ%2Fanthropic_claude_creatAPIkey.png?alt=media&amp;token=8fc32c46-f2cb-480c-a097-6aae71e7c002" alt="Create API key dialog shows &#x22;expel-key&#x22; entered as the key name, and has the two specified scopes selected." width="375"><figcaption></figcaption></figure></div>
6. Select **Create**.
7. **Copy and save** the displayed API key in a safe place for use in a later step. *The full secret is only shown once.*

## Step 2: Add Claude Anthropic (Compliance API) as a Security Device in Workbench

Now that you have the necessary credentials, you can configure the integration in Workbench.

1. [Log in to Workbench](https://workbench.expel.io/auth/login?orig=%2F).
2. In the side menu, navigate to **Organization Settings > Security Devices**.
3. Select **Add Security Device**.
4. In the search box, type “Anthropic” and then select the **Anthropic (Compliance API)** integration.<br>

   <div align="left"><figure><img src="https://2371323735-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F82234aPbNfd179j5U4ti%2Fuploads%2F4S91EViyMASlpN0itl1j%2Fwb_anthropic_claude_add_security_device.png?alt=media&amp;token=a585f693-1555-49b4-a854-5b302839e6b2" alt="Add Security Device screen for Claude Anthropic (Compliance API) includes fields Name, Location, and API key." width="328"><figcaption></figcaption></figure></div>
5. A configuration pane displays. Complete the fields as follows:
   * **Name** - enter a name that might help you more easily identify this integration, such as “CompanyName Anthropic Claude Compliance API”; this name will display in Workbench under the Name column, and is a text string that you can filter on.
   * **Location** - enter the location of your integration, for example “cloud.” This is also a text string that you can filter on, so we recommend being consistent with location naming across your Expel integrations.
   * **API key** - enter the API Key you generated in [Step 1](#step-1-create-compliance-api-credentials-for-expel).
6. Select **Save**.
7. On the console access screen, select **No thanks, I will not provide console access.** from the dropdown.
8. Select **Save**.
9. Your device should be created successfully within a few seconds. A few reminders:
   * After your connection is healthy, it will take some time for your device to begin polling and receiving data.
   * To check on the status, select the downward arrow for your device in the first column and choose **View details**.
   * Polling will happen first; data will be received after that. **You must refresh the page to see updates.**
   * If your device does not begin polling within 15 minutes, and does not begin receiving data within 30 minutes, [contact our support team](/support/how-to-reach-us.md) for help.
   * To check if alerts are coming through, navigate to **Dashboards > Alert Analysis**. Scroll to the device you want to check, and select the **Expel Alerts** tab to reveal more alert information. It can take 36 to 72 hours for alerts to appear after setup, as we [tune your device](/workbench-reference/alerts/how-expel-alerts-work.md#device-tuning).

## Step 3: (Optional) Create Allow Lists for Workbench

If you would like to opt to receive DUET notifications for unsanctioned Model Content Protocol (MCP) servers, Plugins, or Claude Skills, you can do so by supplying Expel with three distinct allow lists for us to enable in Expel Workbench. **Activity outside of these lists will be flagged by our detections.**

You will provide the values for the allow lists to your Customer Success Manager (CSM) or Implementation Engineer and they will configure them in Workbench on your behalf.

{% hint style="warning" %}
Activity **not** allowed-listed will be detected and could result in noise.
{% endhint %}

1. Download the .xlsx file provided below and open it in spreadsheet software like Excel or Google Sheets. Use the following instructions to find and input the values required to create your allow lists.

{% file src="/files/VPLfBULkzMcpiQO2Rmsr" %}

2. Create your **MCP Server Hosts Allowlist**:

* In Claude, navigate to **Settings > Connectors** and select an available Connector.
* Use the three dots menu in the upper right to select **View Details**.
* Locate the **Connector URL** value in the Details section.
* Provide only the **domain name(s)**, and insert each in column A of the spreadsheet.

  <div align="left"><figure><img src="https://2371323735-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F82234aPbNfd179j5U4ti%2Fuploads%2FP7hwLt0CttxtCffE4ddx%2Fanthropic_claude_url_connector_domain_highlight.png?alt=media&amp;token=21b8ebbb-f32e-43d2-b3d5-57b1769c3ae4" alt="In the example, just the domain is highlighted: &#x22;drivemcp.googleapis.com&#x22;." width="329"><figcaption></figcaption></figure></div>

3. Create your **Plugins Allowlist**:
   * In Claude, navigate to **Settings > Plugins**.
   * Provide the plugin names in column B of the spreadsheet. Note that multi-word names should be hyphenated and lowercase, for example: `pdf-viewer` or `bio-research`.
   * Plugins also install **skills**, so be sure to add those to your **skills allow list** in the next step.
4. Create your **Skills Allowlist**:
   1. In Claude, navigate to **Settings > Skills**.
   2. Provide the skill names in column C of the spreadsheet.
5. Your resulting spreadsheet may look something like this:<br>

   <div align="left"><figure><img src="https://2371323735-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F82234aPbNfd179j5U4ti%2Fuploads%2Fuf9WOFgeQv9ua3sKwCtv%2Fanthropic_claude_csv_example.png?alt=media&amp;token=96495a67-b2e1-4999-8a0e-09d263ac804e" alt="Screenshot of spreadsheet shows values in columns titled MCP Server Hosts Allowlist, Plugins Allowlist, Skills Allowlist." width="563"><figcaption></figcaption></figure></div>

   \
   **Save and send** this file to your Expel CSM or Implementation Engineer via your preferred communication method. They will input your lists into Workbench and confirm when it is complete.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.expel.io/connect-your-technology/a-c-integrations/anthropic-claude-enterprise-compliance-api-setup-for-workbench.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.