Every figure, endpoint, retention period and coverage claim the finished shots put on screen, chased to a primary source. Anthropic’s own documentation is the primary source for all of it, because the subject is a feature of that product and the wording of the documentation is itself the thing under discussion.
Checked 2026-08-12.
The Compliance API now covers Cowork and Claude Code. Announced 11 August 2026: coverage extends to “Cowork across the desktop app, web, and mobile, as well as Claude Code in the CLI and desktop app”, and it is included with the Compliance API using an existing Compliance Access Key, with no separate integration to build.
Local sessions on a user’s own machine are in scope. The documentation states that the content endpoints serve, among other things, “local session transcripts, from Cowork and Claude Code sessions that run on users’ machines while they are signed in with their Claude Enterprise account”.
This is the sentence beat 032 quotes on screen, and it is the load-bearing claim of the whole video.
Which Claude Code surfaces. “Cowork sessions that run on a user’s machine in Claude Desktop, and Claude Code sessions in the terminal, in Claude Desktop, or in an IDE extension, are captured while the user is signed in with their Claude Enterprise account.”
It is in beta. “The local and remote session endpoints are in beta.”
Security, legal and compliance teams. The documentation’s own framing: the Compliance API gives Claude Enterprise and Claude Console customers programmatic access to their organization’s Activity Feed, and “Security, legal, and compliance teams use it to audit activity, retrieve or delete content, and feed events into downstream tooling.”
This is the source for beat 016, and for the video’s claim that this is a governance feature rather than anything aimed at individual developers.
Access is scoped and keyed. The session endpoints require a Compliance Access Key
carrying read:compliance_user_data. A regular Claude API key does not authenticate
against /v1/compliance/* at all, and an Admin API key reaches the Activity Feed only.
Beats 016 and 017 render real endpoint paths. They are:
GET /v1/compliance/apps/sessions/local — list local sessionsGET /v1/compliance/apps/sessions/local/{session_id} — one session’s metadataGET /v1/compliance/apps/sessions/local/{session_id}/messages — the transcriptSource: https://platform.claude.com/docs/en/manage-claude/compliance-content-data
Beat 017 puts the block types on screen and beat 020 lists what flows. From the coverage table for local sessions:
| On screen | What the documentation says |
|---|---|
| User prompts | Yes, returned as text blocks |
| Assistant responses | Yes, text output only |
| Tool calls and results | Yes; tool_use inputs and tool_result text, truncated to 10,000 bytes per block by default, up to about 1 MiB per block on request |
| File contents and names | Yes; text Claude reads through tools appears in the transcript, subject to the same truncation. File names appear in tool-call inputs and outputs |
| Artifacts | Yes; generated content appears inside tool-call inputs |
| Skills | Yes; skill content appears when the client sends it as message content |
| Session metadata | Owner (user.id and email address), organization, workspace, product_surface and created_at |
And what is not in it, which the video is careful not to overstate: thinking blocks,
tool definitions, token usage, cost and latency, and host or device metadata such as
terminal type and workspace paths. Images, PDFs and other binary content appear only as
placeholder text blocks; raw file bytes are never returned.
Six years by default. Beat 018 puts this figure on screen. For local sessions, the retention row reads “6 years by default, or your organization’s custom conversation retention period, when a finite one is set; held by Anthropic”. The Activity Feed separately retains 6 years of organization activity.
Capture happens at the API, not on the device. “Local sessions are captured as their requests reach the Claude API, so nothing is installed on the device, and on-device activity that never reaches the API is not captured.”
This matters, and the video says it: the mechanism is not an agent watching a machine.
What is not captured at all:
Organizations using customer-managed encryption keys see local session metadata but no transcript content.
The video says a company can already govern its other tools. The documentation makes the narrower, checkable version of that point itself, comparing the Compliance API with OpenTelemetry logging: OTEL streams per-event telemetry to a collector the organization runs, while the Compliance API returns retained per-session transcripts from Anthropic on request.