diff --git a/content/.metadata.json b/content/.metadata.json
index 0d3dbb0cd0..1b9fc5de0c 100644
--- a/content/.metadata.json
+++ b/content/.metadata.json
@@ -1,7 +1,7 @@
 {
   "metadata": {
     "version": "2.0",
-    "fetch_date": "2026-09-18T10:10:17.858225Z",
+    "fetch_date": "2026-09-19T05:14:10.661864Z",
     "section": "all"
   },
   "items": [
@@ -65,8 +65,8 @@
       "url": "https://platform.claude.com/docs/en/build-with-claude/refusals-and-fallback",
       "status": "success",
       "path": "en/build-with-claude/refusals-and-fallback.md",
-      "sha256": "a6e39544b8a8ab6c5eb705d79d83b4b99b39a9dab1bd0960ee9ded1a4e5bf648",
-      "size": 57609
+      "sha256": "8709039766227a6ba216a959552bf0fd8aee8835a96603cc680dd9aa73c523ed",
+      "size": 57501
     },
     {
       "url": "https://platform.claude.com/docs/en/build-with-claude/fallback-credit",
@@ -156,8 +156,8 @@
       "url": "https://platform.claude.com/docs/en/build-with-claude/thinking",
       "status": "success",
       "path": "en/build-with-claude/thinking.md",
-      "sha256": "20e28393b937d8436091423bf2afbeabeccd2c97b5d9db72aef2da7858752f00",
-      "size": 72899
+      "sha256": "4eb6ec1207cbdc12be344a6c7f2c58a945cb74f5cb68d6f8eec7438e0c4ee30b",
+      "size": 72887
     },
     {
       "url": "https://platform.claude.com/docs/en/build-with-claude/thinking-steering-and-cost",
@@ -177,8 +177,8 @@
       "url": "https://platform.claude.com/docs/en/build-with-claude/preserved-thinking",
       "status": "success",
       "path": "en/build-with-claude/preserved-thinking.md",
-      "sha256": "b9938c83c6f5f9ff043412edbfe60b3591a1ceff5f0b12949635fcec9ca58731",
-      "size": 90002
+      "sha256": "fdb4924557d628d3a207ec29adb07747306fdf33b5801aa083e75269a45673f8",
+      "size": 89928
     },
     {
       "url": "https://platform.claude.com/docs/en/build-with-claude/thinking-troubleshooting",
@@ -191,8 +191,8 @@
       "url": "https://platform.claude.com/docs/en/build-with-claude/extended-thinking",
       "status": "success",
       "path": "en/build-with-claude/extended-thinking.md",
-      "sha256": "cb6d05be6b84ca90b2f36c1993ef56655d4a47959e190d3ed26437e9bd7aadc6",
-      "size": 22182
+      "sha256": "ea43633786686f4881dc1bbb04c0069e6d75088d21eadd4a7a888e98d228f7e7",
+      "size": 22162
     },
     {
       "url": "https://platform.claude.com/docs/en/agents-and-tools/tool-use/overview",
@@ -471,8 +471,8 @@
       "url": "https://platform.claude.com/docs/en/agents-and-tools/agent-skills/quickstart",
       "status": "success",
       "path": "en/agents-and-tools/agent-skills/quickstart.md",
-      "sha256": "f878c9a34fc19b3104b88ed2393ee1459b2476016b87f7c8d7e61e7244c7d956",
-      "size": 37102
+      "sha256": "cd2529828e1a658d83bfe9555b1ca1fa360d60fcfa09c7a6a0c90ee4815d3edc",
+      "size": 37080
     },
     {
       "url": "https://platform.claude.com/docs/en/agents-and-tools/agent-skills/best-practices",
@@ -492,8 +492,8 @@
       "url": "https://platform.claude.com/docs/en/build-with-claude/skills-guide",
       "status": "success",
       "path": "en/build-with-claude/skills-guide.md",
-      "sha256": "41d76d7668e2553ab90c5d8c7dfad18653a453213c1587fcc8e7dc6dee53544a",
-      "size": 147757
+      "sha256": "d5083a64f44d75fe9fe2955d4bec5f5252aea48746492d15a468f912987361e9",
+      "size": 147647
     },
     {
       "url": "https://platform.claude.com/docs/en/agents-and-tools/remote-mcp-servers",
@@ -590,21 +590,21 @@
       "url": "https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws",
       "status": "success",
       "path": "en/build-with-claude/claude-platform-on-aws.md",
-      "sha256": "95d6892924e5e6dde77da6b2f7fcb1fd38f67985fbe437c7e0efb47f67c2a4ba",
-      "size": 87248
+      "sha256": "bdb738c6445b4be9267271767f647b00b7a25f85f5d2bfe2a02c509cd1bb6ccb",
+      "size": 87274
     },
     {
       "url": "https://platform.claude.com/docs/en/build-with-claude/claude-on-vertex-ai",
       "status": "success",
       "path": "en/build-with-claude/claude-on-vertex-ai.md",
-      "sha256": "4025f2c904a8be00a4525269430287ddf3edb151993df0d71e6f9794e5c7c420",
-      "size": 32635
+      "sha256": "72843c25ca19fa5c5fb76473a225d06da645ec3fd626a2dadd1b2752cdd374e1",
+      "size": 33813
     },
     {
       "url": "https://platform.claude.com/docs/en/build-with-claude/claude-in-microsoft-foundry",
       "status": "success",
       "path": "en/build-with-claude/claude-in-microsoft-foundry.md",
-      "sha256": "6988971f491ba5e1ea14f954454b532d0e9b156f4818f69045e368b222744b5d",
+      "sha256": "db01a9effad13b64fd6f99e617390ef24a54fc189465d3d5869a55be07f0dd16",
       "size": 37482
     },
     {
@@ -625,8 +625,8 @@
       "url": "https://platform.claude.com/docs/en/managed-agents/onboarding",
       "status": "success",
       "path": "en/managed-agents/onboarding.md",
-      "sha256": "b714e2783e3940e7d95b8194fa36de44e329297c6e314321711a1b19a8af1159",
-      "size": 4152
+      "sha256": "f11626f1e51ed477e278c12deb1a356f6c7871a23ed3bba97023a50d546cadaf",
+      "size": 4119
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/migration",
@@ -639,15 +639,15 @@
       "url": "https://platform.claude.com/docs/en/managed-agents/agent-setup",
       "status": "success",
       "path": "en/managed-agents/agent-setup.md",
-      "sha256": "299babcc297f1d5cdd4208a3a76c25e6e965313df5862c248f28684f1d3960bf",
-      "size": 31184
+      "sha256": "870eee664ffb02bd891e1a4c0d9808d343222f3367d1c9bb7035916dfc022a13",
+      "size": 31117
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/tools",
       "status": "success",
       "path": "en/managed-agents/tools.md",
-      "sha256": "b632a7ea1dcba5e12358bbd6e0490b7957045897767846bfb46e75ee10d296b5",
-      "size": 40461
+      "sha256": "e4f61473e4f82712e033b5e1410930be9ff2286def074fb39e09f904d3649bd4",
+      "size": 40417
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/mcp-connector",
@@ -660,22 +660,22 @@
       "url": "https://platform.claude.com/docs/en/managed-agents/permission-policies",
       "status": "success",
       "path": "en/managed-agents/permission-policies.md",
-      "sha256": "51d3e5da655d3f5c9d4409c3c4f1d5bc73ad80f4a51b1806654b7eed5a57c954",
-      "size": 49801
+      "sha256": "ac827a4a89f953f2fb920679ea89eddae0469e9a2ac5b32a811a1b20f5a2f934",
+      "size": 49757
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/skills",
       "status": "success",
       "path": "en/managed-agents/skills.md",
-      "sha256": "9103ef787e4627af1795423fb40622414e5ecc81bfbb79eb135803e5f9689976",
-      "size": 23273
+      "sha256": "6df6edb76335f1cc8e0a13981a01c6c82af4c6925838911eee12e73c61e9af51",
+      "size": 23251
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/environments",
       "status": "success",
       "path": "en/managed-agents/environments.md",
-      "sha256": "e4ae8b510f08e57f81520ac095355c30fe76545e4d2434f5110d15d5895a4442",
-      "size": 23124
+      "sha256": "6c8fc4c80a101873bb294e11432739753f42d332dff9ecfffefcf5132f933ef0",
+      "size": 22914
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/cloud-sandboxes-reference",
@@ -688,8 +688,8 @@
       "url": "https://platform.claude.com/docs/en/managed-agents/self-hosted-sandboxes",
       "status": "success",
       "path": "en/managed-agents/self-hosted-sandboxes.md",
-      "sha256": "753522af27a8ea593fb4b89fb87c7e31d40921286836377f6b4637d733f69dfd",
-      "size": 112540
+      "sha256": "9b20a8970d4d9dc9e4e34aed95bf7d8622173ca4448ac84886ebb681c47c1d22",
+      "size": 112562
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/self-hosted-sandboxes-security",
@@ -702,29 +702,29 @@
       "url": "https://platform.claude.com/docs/en/managed-agents/sessions",
       "status": "success",
       "path": "en/managed-agents/sessions.md",
-      "sha256": "87ee03ac96ccd2cdbf2580206148abc4a7806f5720faf2f9840d0c6b84e83486",
-      "size": 40856
+      "sha256": "2228943f86f656591e5e1812aad89ac0d414a0fb58de1f9a4ae83c3707f76fe3",
+      "size": 40267
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/session-operations",
       "status": "success",
       "path": "en/managed-agents/session-operations.md",
-      "sha256": "a5247ca4820d38083ef629b8d4255b060ef862574aa2936bfd1e8d0b3483366f",
-      "size": 25448
+      "sha256": "7978987d9c8bf934c699559e6d031601b5fb807a673b20ac2666f7ce5eb15ad2",
+      "size": 25272
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/events-and-streaming",
       "status": "success",
       "path": "en/managed-agents/events-and-streaming.md",
-      "sha256": "57357dafc3134675f7d29492382d17a50757b7d94106f931b4c495733f6e5600",
-      "size": 120194
+      "sha256": "ecad674aab19325f9b658ad21fa9a5f5ffea8466adb5391704d4f5dd17e7de0d",
+      "size": 119929
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/budgets",
       "status": "success",
       "path": "en/managed-agents/budgets.md",
-      "sha256": "f1488f686ae59d698628f51cc2b41ede9b34648a8fbca0a049c465b579430e7f",
-      "size": 22329
+      "sha256": "8145fe4d2905055165e38e36cfcaf36fcd24d372dcde8de93b88adfc47e65d62",
+      "size": 22158
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/webhooks",
@@ -737,15 +737,15 @@
       "url": "https://platform.claude.com/docs/en/managed-agents/define-outcomes",
       "status": "success",
       "path": "en/managed-agents/define-outcomes.md",
-      "sha256": "08fd67d4b05d19cf69265a85acc3b9ffe0ebfe44a9e78fe16e00e96ea3e0021e",
-      "size": 32359
+      "sha256": "b565a2d7a0685d2eae3c102c5ddf52a90cbe5c60feb5de27b5561c606ab8e6c7",
+      "size": 32170
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/vaults",
       "status": "success",
       "path": "en/managed-agents/vaults.md",
-      "sha256": "50cdf58be928566dd357a92e960eade32c61bf813966b050500a0d59c9e9ee79",
-      "size": 46540
+      "sha256": "da1ae2d4d62f60340640067bce593ddfd377ec7d21e5411bee8e3e5cdf5fafb4",
+      "size": 45884
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/github",
@@ -758,36 +758,36 @@
       "url": "https://platform.claude.com/docs/en/managed-agents/files",
       "status": "success",
       "path": "en/managed-agents/files.md",
-      "sha256": "6e8298ee92853581cdbbbad3c25c122c6a145f842c3930162d6ee9ffbe547da7",
-      "size": 21939
+      "sha256": "1dc8b70d772e1c242e85e1ea1454f230913f4cc3d255679dc071865908d60846",
+      "size": 21540
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/memory",
       "status": "success",
       "path": "en/managed-agents/memory.md",
-      "sha256": "06ec699223196cd763eaa862c76b883318186b7d8d1fccb9477768003d51ef56",
-      "size": 46383
+      "sha256": "2cdbef9c20407d8773a5c96cae4ba0e8b2fe158b46ced36ede50126eb67b0773",
+      "size": 45349
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/dreams",
       "status": "success",
       "path": "en/managed-agents/dreams.md",
-      "sha256": "97b3d54a8ba3fe98727138ad6e404a36aff3f136feed4deb39030d2e707110d7",
-      "size": 24985
+      "sha256": "a5a79dda83b0cb2894b9f230fb84e97d2c3642b42f2e1fb6965fbb99b6875fc3",
+      "size": 24859
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/multiagent-orchestration",
       "status": "success",
       "path": "en/managed-agents/multiagent-orchestration.md",
-      "sha256": "9a4afa7cd93b30333d3b858e1d17b0bea21362530a0d8e77739be422f488b21f",
-      "size": 61582
+      "sha256": "d32778b2e59d9f20f307051a5b3f8fe418d84642196cd9a464001f93a85bf018",
+      "size": 61981
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/scheduled-deployments",
       "status": "success",
       "path": "en/managed-agents/scheduled-deployments.md",
-      "sha256": "8f24632d566aa3ea531b66e112e1cd060d9fe97a869a00f4af57ffaf6a0de679",
-      "size": 24938
+      "sha256": "0f45535e1062117a373a47ecbf0e1a5147720e7e474be717b7e306264a452c1b",
+      "size": 24699
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/reference",
@@ -961,29 +961,29 @@
       "url": "https://platform.claude.com/docs/en/manage-claude/cmek",
       "status": "success",
       "path": "en/manage-claude/cmek.md",
-      "sha256": "f52b8fd90fdc3124495892bbfb42fe4a908dbdea45c9d0fddffa5d4d0917fc16",
-      "size": 17430
+      "sha256": "5a9e0e82a0e1744e0d38c472cad8129f90c63a2eb0706aaf435e70ffe940c48b",
+      "size": 17455
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms",
       "status": "success",
       "path": "en/manage-claude/cmek-aws-kms.md",
-      "sha256": "d711cf1c8c7c9dc1187204a515dedb48090191d4ad7b5d9aa5489070fb3d68f8",
-      "size": 35081
+      "sha256": "b6e91535d32cc87960c1d4dccb56229b86fc4bc215bf9e25fbd7c59b030df0af",
+      "size": 37472
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms",
       "status": "success",
       "path": "en/manage-claude/cmek-google-cloud-kms.md",
-      "sha256": "6b39fe756aef5b8c7d8b09c27da1e1ecf68397dac0784a0a084a8ab513f80907",
-      "size": 21217
+      "sha256": "0c15ec98df9a72b3ea8df49aa94d4053ab453ec66605fce7403e0691590deee2",
+      "size": 23638
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault",
       "status": "success",
       "path": "en/manage-claude/cmek-azure-key-vault.md",
-      "sha256": "b4ea1ccd17fa1f3caab264bc9b8ba6a7d2a46357cec870e109f3dd7f4ecfdf9d",
-      "size": 23695
+      "sha256": "117fa45def8e20c51446b240989998850f9c8de9e92a4d0cc5a1393fb5975b07",
+      "size": 26182
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/inference-hooks",
@@ -1283,8 +1283,8 @@
       "url": "https://platform.claude.com/docs/en/models/sonnet-5/migration-guide",
       "status": "success",
       "path": "en/models/sonnet-5/migration-guide.md",
-      "sha256": "756681842fe2d97a4873e4abbab03a2e6e8c9668682f1d2573206261bf089b68",
-      "size": 38667
+      "sha256": "b8c29a3eb6bbe5483e794e706d8019383f45ef2db7e089519283e54ec9451437",
+      "size": 38647
     },
     {
       "url": "https://platform.claude.com/docs/en/models/haiku-4-5/overview",
@@ -1395,8 +1395,8 @@
       "url": "https://platform.claude.com/docs/en/about-claude/model-deprecations",
       "status": "success",
       "path": "en/about-claude/model-deprecations.md",
-      "sha256": "0230d571767d0ef6a3f76db87a2e4c9edff9faad8baab36abf69ee0581bd9922",
-      "size": 13514
+      "sha256": "3a2df47b1dd8818789c13f72c5e81c2cd58b539087ee855d52e9e47527075a07",
+      "size": 13826
     },
     {
       "url": "https://platform.claude.com/docs/en/resources/overview",
@@ -1899,14 +1899,14 @@
       "url": "https://platform.claude.com/docs/en/api/skills",
       "status": "success",
       "path": "en/api/skills.md",
-      "sha256": "9a5eac4fb34e925a81dc7a49e29f282a4e5c9220fd3bf351cef25cfaccfe1c0d",
+      "sha256": "58e691ceceb88cce81ee55af2df2fb89360cd964b8a6354c52b45911a32830a7",
       "size": 18997
     },
     {
       "url": "https://platform.claude.com/docs/en/api/skills/create",
       "status": "success",
       "path": "en/api/skills/create.md",
-      "sha256": "92f8f0f2acba9d3bebc180216f273a14199422f68ae7f8c989640037e3ea881b",
+      "sha256": "a671bf1ddcfb144e200c95fc93c4c0bc613067b63df17b51d30484f17b254f8a",
       "size": 2821
     },
     {
@@ -1934,14 +1934,14 @@
       "url": "https://platform.claude.com/docs/en/api/skills/versions",
       "status": "success",
       "path": "en/api/skills/versions.md",
-      "sha256": "c616b15e118a9c656cca98ecbd7fe979435fd0fe16c0fdfca5a4f3a20735a395",
+      "sha256": "29e394fea0d5e53ce6bf3ac3e578745b7ea6899ab0c28ab45ee5aeff7cd1865c",
       "size": 8753
     },
     {
       "url": "https://platform.claude.com/docs/en/api/skills/versions/create",
       "status": "success",
       "path": "en/api/skills/versions/create.md",
-      "sha256": "5b80ec07e84f4a954a59dac1af1592d029d7ebb8c1e2979982ed6e7cdcbf68a5",
+      "sha256": "de480e5105f48ccfb816ffe5180afa5dbb868af9a0c9fa99f5e8ecce3915e9b1",
       "size": 2051
     },
     {
@@ -1969,8 +1969,8 @@
       "url": "https://platform.claude.com/docs/en/api/beta",
       "status": "success",
       "path": "en/api/beta.md",
-      "sha256": "6828640164ed4c850085e242bba3931190506bcbb14b903b5df111736243fbe0",
-      "size": 2553199
+      "sha256": "03c80004e1db6f4896b146bdd2fcdbf83068b302c61a94dd764914a3bf56d34a",
+      "size": 2563359
     },
     {
       "url": "https://platform.claude.com/docs/en/api/beta/models",
@@ -1997,36 +1997,36 @@
       "url": "https://platform.claude.com/docs/en/api/beta/messages",
       "status": "success",
       "path": "en/api/beta/messages.md",
-      "sha256": "2680e5d117874f9691fff21cda1e35b3ab267a9d6819e0dec782e5d7fafddcf0",
-      "size": 1400541
+      "sha256": "ed69f7228cc253e62396f8c52568bf832107ba8e2fad28541a932620981bb3d6",
+      "size": 1400502
     },
     {
       "url": "https://platform.claude.com/docs/en/api/beta/messages/create",
       "status": "success",
       "path": "en/api/beta/messages/create.md",
-      "sha256": "33e1a3e0688f393dce4402859130e4f7f1dfb3842ccabdb4b37d6f854452b6d5",
-      "size": 200839
+      "sha256": "358ed3d5a70127677ce710506641537ca675289dd412cca5b37e5acc62e02a03",
+      "size": 200833
     },
     {
       "url": "https://platform.claude.com/docs/en/api/beta/messages/count_tokens",
       "status": "success",
       "path": "en/api/beta/messages/count_tokens.md",
-      "sha256": "c70854e0d463bbd8726d53650d4a3ef6159bce28df460d47c96f9ac421975c95",
-      "size": 125471
+      "sha256": "a409e8fed684f9b4ab7c1ca1ed02a1f0720f46c8336b232e03088232349ca27b",
+      "size": 125465
     },
     {
       "url": "https://platform.claude.com/docs/en/api/beta/messages/batches",
       "status": "success",
       "path": "en/api/beta/messages/batches.md",
-      "sha256": "687f3707e6330427350298c95489c4b579960ddd9960d22552995cc6c6c8171a",
-      "size": 417836
+      "sha256": "341ea7d3a36f3da19c9514ba6f964427bebfcbb32971cac75fcef209b9813ce4",
+      "size": 417830
     },
     {
       "url": "https://platform.claude.com/docs/en/api/beta/messages/batches/create",
       "status": "success",
       "path": "en/api/beta/messages/batches/create.md",
-      "sha256": "cd90d550939f994bacae8dcbe4dc74abbfc56294126317bf19b2130acb74ffcf",
-      "size": 146648
+      "sha256": "d043430520e16f1fd3ec8e2f4210d576a226f2504f5aaa9f6eee25f9bba905c0",
+      "size": 146642
     },
     {
       "url": "https://platform.claude.com/docs/en/api/beta/messages/batches/retrieve",
@@ -2753,14 +2753,14 @@
       "url": "https://platform.claude.com/docs/en/api/beta/skills",
       "status": "success",
       "path": "en/api/beta/skills.md",
-      "sha256": "f6674c9d5dc20a7c5ac5131037dccdfe383cb3de8e19bdad7a7f79018bd0e39b",
+      "sha256": "862967bc914d483aaf768eb7f1bdaac7480a7e2de4df995f4ba709fcd6099a34",
       "size": 37820
     },
     {
       "url": "https://platform.claude.com/docs/en/api/beta/skills/create",
       "status": "success",
       "path": "en/api/beta/skills/create.md",
-      "sha256": "cfcf4d880cf70549c395dc06555ad843a5e5d821d8888dfc1aff1e67fb2a99f8",
+      "sha256": "cc6db1798568aa5930ea4e5ccbc06ab72a314faba6c12a53fa151826f8f19691",
       "size": 4834
     },
     {
@@ -2788,14 +2788,14 @@
       "url": "https://platform.claude.com/docs/en/api/beta/skills/versions",
       "status": "success",
       "path": "en/api/beta/skills/versions.md",
-      "sha256": "cccc651d146850da9418ed802a3578cd12a1dd6ff8ca1966e405b8b3559e4440",
+      "sha256": "8c848db51328e4d4c2dc23df39f5ef57ca1c9ff66a7c17aee8bf80784b14bd99",
       "size": 19531
     },
     {
       "url": "https://platform.claude.com/docs/en/api/beta/skills/versions/create",
       "status": "success",
       "path": "en/api/beta/skills/versions/create.md",
-      "sha256": "db6da4cc2e0835b21239b086ad8656aa2de57239fca9ea4ace988abc4180b700",
+      "sha256": "7eb368860c735bd33977548dc44ed4db4151b8b3c09bcc12f23fdad4ff961ffb",
       "size": 4060
     },
     {
@@ -2998,8 +2998,8 @@
       "url": "https://platform.claude.com/docs/en/api/beta/organization",
       "status": "success",
       "path": "en/api/beta/organization.md",
-      "sha256": "b9bf409f62222a23c972eaa22dbf6ccd1d29f4cf43f18e2b883b3104982de39e",
-      "size": 537788
+      "sha256": "211149428ec989d2192268da63569128579963bacee86691b02aac92f6f1c68b",
+      "size": 547966
     },
     {
       "url": "https://platform.claude.com/docs/en/api/beta/organization/retrieve",
@@ -3558,78 +3558,78 @@
       "url": "https://platform.claude.com/docs/en/api/beta/organization/mcp_tunnels",
       "status": "success",
       "path": "en/api/beta/organization/mcp_tunnels.md",
-      "sha256": "f2141fb387feb99388e11f9fe7c7d7430581643db6c939c25d77195d4a49b597",
-      "size": 41090
+      "sha256": "cacf0c71f086fd64b29c0c7d3a89f9e38167b25cf8c5b3a304f9fd285f9c2c7e",
+      "size": 41738
     },
     {
       "url": "https://platform.claude.com/docs/en/api/beta/organization/mcp_tunnels/list",
       "status": "success",
       "path": "en/api/beta/organization/mcp_tunnels/list.md",
-      "sha256": "e6b566620052f781139d979d5c000ae8f4f83b2204666e0ab9c5ce96a9837aa1",
-      "size": 5141
+      "sha256": "ebd481c352e654f95ea4a659f5c06fd3d8dd0eee45e7001d65d72d2971cce0f0",
+      "size": 5213
     },
     {
       "url": "https://platform.claude.com/docs/en/api/beta/organization/mcp_tunnels/retrieve",
       "status": "success",
       "path": "en/api/beta/organization/mcp_tunnels/retrieve.md",
-      "sha256": "fbe21971807dbed1728fb11358e40a230096162ad39c893a31ab3964d83dc540",
-      "size": 4248
+      "sha256": "554eeba945856b9cce66dec2dd514183c4ee73c21639acf77f2546b19a61ec7a",
+      "size": 4320
     },
     {
       "url": "https://platform.claude.com/docs/en/api/beta/organization/mcp_tunnels/archive",
       "status": "success",
       "path": "en/api/beta/organization/mcp_tunnels/archive.md",
-      "sha256": "9a0c6ca03175ffca45ed5eddf95ea69fc833742f894c54bd552ea5f3cad35d7e",
-      "size": 4518
+      "sha256": "d4f9a07a3bc9e9017207044df37da29182433d099da36937d91f1c83f5a1cf63",
+      "size": 4590
     },
     {
       "url": "https://platform.claude.com/docs/en/api/beta/organization/mcp_tunnels/reveal_token",
       "status": "success",
       "path": "en/api/beta/organization/mcp_tunnels/reveal_token.md",
-      "sha256": "0b5143e070756db1d63de04209200bf602fba7dc703362b29ac268850f20c2a5",
-      "size": 3782
+      "sha256": "895168719c81f175fb639e8a3903ad5b54c15a7611587a39a4774d91515b6547",
+      "size": 3854
     },
     {
       "url": "https://platform.claude.com/docs/en/api/beta/organization/mcp_tunnels/rotate_token",
       "status": "success",
       "path": "en/api/beta/organization/mcp_tunnels/rotate_token.md",
-      "sha256": "a69694a04d99fb1978bb513402dd45309fde72d98af0bd3b378a4599930b6642",
-      "size": 3925
+      "sha256": "42e90d7f6515a4db428c8d6338cbffcdde3cf903f012f30a8a2e46318a800a4c",
+      "size": 3997
     },
     {
       "url": "https://platform.claude.com/docs/en/api/beta/organization/mcp_tunnels/tunnel_certificates",
       "status": "success",
       "path": "en/api/beta/organization/mcp_tunnels/tunnel_certificates.md",
-      "sha256": "cb5ecc0d7fabacfdff5a22b8bcb987120ac568904dfa2cb21125b99ea450fbba",
-      "size": 19570
+      "sha256": "507ff559093746c7ce61c936d10d100b42aae5f7bacd55914dc14c732c3b17e3",
+      "size": 19858
     },
     {
       "url": "https://platform.claude.com/docs/en/api/beta/organization/mcp_tunnels/tunnel_certificates/create",
       "status": "success",
       "path": "en/api/beta/organization/mcp_tunnels/tunnel_certificates/create.md",
-      "sha256": "a46b3349fbbeb85a8c9a4336879bbdea1da460cc40c4cd73481db250998728ec",
-      "size": 5005
+      "sha256": "f5c957b068ad1008a9d31ecbc9a1c7643bf03bb0ac51367613bf14cb77dafbe8",
+      "size": 5077
     },
     {
       "url": "https://platform.claude.com/docs/en/api/beta/organization/mcp_tunnels/tunnel_certificates/list",
       "status": "success",
       "path": "en/api/beta/organization/mcp_tunnels/tunnel_certificates/list.md",
-      "sha256": "afcde0f93f67aadbd2db8f9a751440c309dd01f5315bab8fd6a44d6d45bd89e7",
-      "size": 4988
+      "sha256": "bab80d4b8eaea453c1b3d839cdc9dcb1d6c83645e6408689e158bb8448ae7eff",
+      "size": 5060
     },
     {
       "url": "https://platform.claude.com/docs/en/api/beta/organization/mcp_tunnels/tunnel_certificates/retrieve",
       "status": "success",
       "path": "en/api/beta/organization/mcp_tunnels/tunnel_certificates/retrieve.md",
-      "sha256": "d1f009d304afe403b2767a69046d79c357342fee35d77257f9af05e7de24d882",
-      "size": 4402
+      "sha256": "03ccfe2ed7e13d5eb3154023bb333125fc839150f928ffc3ffabe5fba88cae48",
+      "size": 4474
     },
     {
       "url": "https://platform.claude.com/docs/en/api/beta/organization/mcp_tunnels/tunnel_certificates/archive",
       "status": "success",
       "path": "en/api/beta/organization/mcp_tunnels/tunnel_certificates/archive.md",
-      "sha256": "516c2fe815c595b13ddfbb61b47f22b3db4aaab4b695adaa1b376d22ee00d634",
-      "size": 4622
+      "sha256": "a65a961e4cbc061ababcad0de2a4a8c4d8edbdcfbd62f81cdc9f60167eee6708",
+      "size": 4694
     },
     {
       "url": "https://platform.claude.com/docs/en/api/beta/organization/analytics",
@@ -3775,71 +3775,71 @@
       "url": "https://platform.claude.com/docs/en/api/beta/organization/spend_limits",
       "status": "success",
       "path": "en/api/beta/organization/spend_limits.md",
-      "sha256": "2ae75671257279dd5fc66fd65a84de8ebce6bd287a1375d457fb0e07174402b3",
-      "size": 48504
+      "sha256": "a967b0bb9c26eb869324198cf2acfd506064a9cc99691d122502238e4324e125",
+      "size": 59779
     },
     {
       "url": "https://platform.claude.com/docs/en/api/beta/organization/spend_limits/create",
       "status": "success",
       "path": "en/api/beta/organization/spend_limits/create.md",
-      "sha256": "d8ad5273e0e20066d11e8d6d9d80de7c8317e10142c7ad5103ca46a4028b0453",
-      "size": 3815
+      "sha256": "8accc33887a02ba19902426fe0ebf261aa783e9d407e757f622ff2e7dd95d75e",
+      "size": 5122
     },
     {
       "url": "https://platform.claude.com/docs/en/api/beta/organization/spend_limits/retrieve",
       "status": "success",
       "path": "en/api/beta/organization/spend_limits/retrieve.md",
-      "sha256": "9ea5a2cb4b08a6f0045a5fdc83d09c26b2f43671995ea82d7972447fe8f819f2",
-      "size": 2766
+      "sha256": "68fc43e70e039ead2141d08d0dd2ed3db5219cb3cedddf5d2842e5e3a3940a45",
+      "size": 3072
     },
     {
       "url": "https://platform.claude.com/docs/en/api/beta/organization/spend_limits/delete",
       "status": "success",
       "path": "en/api/beta/organization/spend_limits/delete.md",
-      "sha256": "cfc282484a3e654b64d55f8a48c683a6acc9d7a621ab36b5c548d3853717a8e4",
-      "size": 843
+      "sha256": "a8d41c000044f5708301f8f2ebc22bd39075711d1c389592475d5c9b40bfe79f",
+      "size": 1043
     },
     {
       "url": "https://platform.claude.com/docs/en/api/beta/organization/spend_limits/list_effective",
       "status": "success",
       "path": "en/api/beta/organization/spend_limits/list_effective.md",
-      "sha256": "ec8d08b3313b8953a685a17ebfdc36b44fcf05df9bdcf0f881a812cfa0a59342",
-      "size": 4902
+      "sha256": "67b04c70235fd57e51da610c12f34b7626dd9117d4117e2a9edf6ce82b5bd4ce",
+      "size": 6341
     },
     {
       "url": "https://platform.claude.com/docs/en/api/beta/organization/spend_limits/increase_requests",
       "status": "success",
       "path": "en/api/beta/organization/spend_limits/increase_requests.md",
-      "sha256": "4210f38b8569d982d1074bfcfd80740a1481cff3b08d979730bfe84b9a0353b9",
-      "size": 44272
+      "sha256": "7fb104400e0010f2f76d08c183bb64c1c67ebb8b3b24ddd832a885eb890de799",
+      "size": 53892
     },
     {
       "url": "https://platform.claude.com/docs/en/api/beta/organization/spend_limits/increase_requests/list",
       "status": "success",
       "path": "en/api/beta/organization/spend_limits/increase_requests/list.md",
-      "sha256": "1184059c6cc8dc0ec16aad550dbb3343ffd0df4b0499104851043221b3fc2ece",
-      "size": 7720
+      "sha256": "4b1cb42cd65cbdf6022afa5607b0322d6bef2afd845c0e312dfba5c45cd19c16",
+      "size": 9231
     },
     {
       "url": "https://platform.claude.com/docs/en/api/beta/organization/spend_limits/increase_requests/retrieve",
       "status": "success",
       "path": "en/api/beta/organization/spend_limits/increase_requests/retrieve.md",
-      "sha256": "01296d1f9d689a2e5aa1be6376eb9ba16af8e42a870b65f5fad72a08fe058572",
-      "size": 7170
+      "sha256": "dcac80434fdddb510eb80527b8234a665668f2a9efe40886f823b86cd16f838e",
+      "size": 8681
     },
     {
       "url": "https://platform.claude.com/docs/en/api/beta/organization/spend_limits/increase_requests/approve",
       "status": "success",
       "path": "en/api/beta/organization/spend_limits/increase_requests/approve.md",
-      "sha256": "989438c6cf8d1b5e0e511b9bca060ec6aaf9d0c8197c4005528e8afcc0d486ef",
-      "size": 9750
+      "sha256": "65ebfd25cf122fb29cf52eed714b87f2f80b27c7366c54939a04bb7f60012088",
+      "size": 11495
     },
     {
       "url": "https://platform.claude.com/docs/en/api/beta/organization/spend_limits/increase_requests/deny",
       "status": "success",
       "path": "en/api/beta/organization/spend_limits/increase_requests/deny.md",
-      "sha256": "3f33f4115836363e70a366370ca9295facb104ab7cca00866d7e4482ca0d4fbd",
-      "size": 7344
+      "sha256": "b2a55b2a15052442150f0f4dc5439089f52e402a0bf316a5ed6a1ad6982a3448",
+      "size": 8855
     },
     {
       "url": "https://platform.claude.com/docs/en/api/beta/organization/rbac_groups",
@@ -3957,22 +3957,22 @@
       "url": "https://platform.claude.com/docs/en/api/compliance",
       "status": "success",
       "path": "en/api/compliance.md",
-      "sha256": "1cc5e548a6a5d7e3e8ecc34205df917ad2a6c8ad04f29ad0ee7eb4ca91238d96",
-      "size": 3339310
+      "sha256": "053d08d9c5eeb2b048c56a82f8d93a24132e79404325888f680d36861636870f",
+      "size": 3352984
     },
     {
       "url": "https://platform.claude.com/docs/en/api/compliance/activities",
       "status": "success",
       "path": "en/api/compliance/activities.md",
-      "sha256": "4a9db70ea3ae44d6eac1e3ba01a9c0343e3c5f937afe3f374e67db0a2729e997",
-      "size": 6309584
+      "sha256": "e3c5c7d3f1053ec24ff9e79d39456c8b455e6443a88613a67639228b2445b5de",
+      "size": 6335910
     },
     {
       "url": "https://platform.claude.com/docs/en/api/compliance/activities/list",
       "status": "success",
       "path": "en/api/compliance/activities/list.md",
-      "sha256": "c56a060996b9cf329a186203be5977e2ea95fc767ae0c183af21ac60e2290b0a",
-      "size": 3215999
+      "sha256": "f2bbe60466239f5658a52413f17074320cdf9b6f639545b34a2154dfb172da76",
+      "size": 3229673
     },
     {
       "url": "https://platform.claude.com/docs/en/api/compliance/organizations",
@@ -4412,8 +4412,8 @@
       "url": "https://code.claude.com/docs/en/overview",
       "status": "success",
       "path": "en/docs/claude-code/overview.md",
-      "sha256": "3e40a3b91b0d01dbde0c5c7d32dec14a90d2ab237c100c50e44b80af6e5ce55a",
-      "size": 16763
+      "sha256": "1e235e1f7d470485720b87f48d03d914796fe6e2ce0c39915f2f7bcb6af744a1",
+      "size": 16926
     },
     {
       "url": "https://code.claude.com/docs/en/quickstart",
@@ -4426,15 +4426,15 @@
       "url": "https://code.claude.com/docs/en/changelog",
       "status": "success",
       "path": "en/docs/claude-code/changelog.md",
-      "sha256": "91154c90ef0f2959a50159a5f76238255d87034bd33fbf4b9423df03d3ebf53c",
-      "size": 767853
+      "sha256": "837a9299c3415beb26ac7a75847154cbb89e996dc7e4f9ab2a8e6609031c85bb",
+      "size": 781912
     },
     {
       "url": "https://code.claude.com/docs/en/how-claude-code-works",
       "status": "success",
       "path": "en/docs/claude-code/how-claude-code-works.md",
-      "sha256": "fd2cf401b1c2b0921cd46dee3c892d3c0d353d72b8c849288ddb5c23e6cc8246",
-      "size": 19615
+      "sha256": "b07472946283485c42cb15990019aa39d636fceb2471abaf7d8282dfb9726c1d",
+      "size": 19761
     },
     {
       "url": "https://code.claude.com/docs/en/features-overview",
@@ -4447,15 +4447,15 @@
       "url": "https://code.claude.com/docs/en/claude-directory",
       "status": "success",
       "path": "en/docs/claude-code/claude-directory.md",
-      "sha256": "808b6a06b86abe4a20cc21002785210b89a08280b47e98f21cf76ffcf3fef626",
-      "size": 102185
+      "sha256": "2665b57430526bbdf0f9b8c9a6e298d7dfe6c195487195c2f7c676d4e589f24a",
+      "size": 103403
     },
     {
       "url": "https://code.claude.com/docs/en/context-window",
       "status": "success",
       "path": "en/docs/claude-code/context-window.md",
-      "sha256": "1ce0cea3bc4090ff1d5d49723a93027fed687cab4a21d0e659976e93ae0a65f2",
-      "size": 62163
+      "sha256": "f334fe44527612b0847e28c0b56a630c9b3f3f33f2c709ee4d1e9a16daa3c2e1",
+      "size": 62259
     },
     {
       "url": "https://code.claude.com/docs/en/prompt-caching",
@@ -4468,8 +4468,8 @@
       "url": "https://code.claude.com/docs/en/memory",
       "status": "success",
       "path": "en/docs/claude-code/memory.md",
-      "sha256": "98c6d06ea754d557011393608849dfbe23eed8634edb3db318f77178b6ce0f1b",
-      "size": 38430
+      "sha256": "1cf44b112e7daa1bc85820c368b8bed40359abc687d962925d4f93b2f54ffb82",
+      "size": 52465
     },
     {
       "url": "https://code.claude.com/docs/en/sessions",
@@ -4559,8 +4559,8 @@
       "url": "https://code.claude.com/docs/en/slack",
       "status": "success",
       "path": "en/docs/claude-code/slack.md",
-      "sha256": "b62a6d0f2f8f174c41ea88ac2475b2c12c584b609fbe4932d5f855b9aee29132",
-      "size": 15641
+      "sha256": "7a58fa817787846249f962a5a17f00a5104b1848172a8ce0df1627bd885bd0f2",
+      "size": 15744
     },
     {
       "url": "https://code.claude.com/docs/en/claude-tag",
@@ -4573,22 +4573,22 @@
       "url": "https://code.claude.com/docs/en/web-quickstart",
       "status": "success",
       "path": "en/docs/claude-code/web-quickstart.md",
-      "sha256": "3e1276fde82eb25e52e8813c6efa212378d3db6b0ee669ecc44a0fa072a41ae7",
-      "size": 26065
+      "sha256": "56b31df35fcb954fd588a4c61e1e936bc79a0b6614b442cc4ae49436a1c5c510",
+      "size": 26226
     },
     {
       "url": "https://code.claude.com/docs/en/claude-code-on-the-web",
       "status": "success",
       "path": "en/docs/claude-code/claude-code-on-the-web.md",
-      "sha256": "167c5456e0649ced062e5fe06757ebf69ae6499e50fd5970db137b90427eec27",
-      "size": 41992
+      "sha256": "bff22aa7961d6269538c6b0522696bbb6955b71feb02b6311b60a5b68566a6e2",
+      "size": 42170
     },
     {
       "url": "https://code.claude.com/docs/en/routines",
       "status": "success",
       "path": "en/docs/claude-code/routines.md",
-      "sha256": "d76aa5af0d53c71ec2496c591db62a2774baf98e4455e5876adc328eaf1e5d2d",
-      "size": 33670
+      "sha256": "a893163ca0f7d804962a6b304a30944fa95c84f781c7d61b59b38de2d3b51fc0",
+      "size": 35382
     },
     {
       "url": "https://code.claude.com/docs/en/ultrareview",
@@ -4608,8 +4608,8 @@
       "url": "https://code.claude.com/docs/en/desktop",
       "status": "success",
       "path": "en/docs/claude-code/desktop.md",
-      "sha256": "bfc2f76c8b2b58d3ad2f02610373670d670439b059e9e2409d0d2532c6d5d8bd",
-      "size": 103453
+      "sha256": "622a094b23496a6dafc308b0ce9e466e96423bd3f5707faff25183313a75ef40",
+      "size": 103817
     },
     {
       "url": "https://code.claude.com/docs/en/desktop-linux",
@@ -4699,8 +4699,8 @@
       "url": "https://code.claude.com/docs/en/sub-agents",
       "status": "success",
       "path": "en/docs/claude-code/sub-agents.md",
-      "sha256": "b6fa1f2099a3df0b5b92a49fe4e42351f4c3aa31227c8d2d8256b9187e650f07",
-      "size": 115439
+      "sha256": "bc5cde1e31c0049ae254f0a65314d4d34072f94c15a173fe98cf52bcf0f553d0",
+      "size": 115522
     },
     {
       "url": "https://code.claude.com/docs/en/agent-view",
@@ -4783,8 +4783,8 @@
       "url": "https://code.claude.com/docs/en/artifacts",
       "status": "success",
       "path": "en/docs/claude-code/artifacts.md",
-      "sha256": "775c2561af3120ddd2552f96bc99e5f99f4a1cc2c354bc44c4c83eee93de1e46",
-      "size": 40823
+      "sha256": "5452dc9afd6f3d30827bdb0186b3d6d966df2381dc8896a9d3efb894345f30e6",
+      "size": 40783
     },
     {
       "url": "https://code.claude.com/docs/en/hooks-guide",
@@ -4818,8 +4818,8 @@
       "url": "https://code.claude.com/docs/en/headless",
       "status": "success",
       "path": "en/docs/claude-code/headless.md",
-      "sha256": "a17fc295554efd8ec6860edf3ea0b45ba60edfe431bb888ff5bc1d86530c759c",
-      "size": 36448
+      "sha256": "5c0a2bc88989093c1c6803f3efaaf27851c8f0bbc41cbfecfc4ac938cfe6292b",
+      "size": 36408
     },
     {
       "url": "https://code.claude.com/docs/en/deep-links",
@@ -4860,8 +4860,8 @@
       "url": "https://code.claude.com/docs/en/errors",
       "status": "success",
       "path": "en/docs/claude-code/errors.md",
-      "sha256": "6a0195a164b013439616064a80b4fcc3296c8475f10fc208742b9571c27cb319",
-      "size": 463543
+      "sha256": "6e9fc3562d08087f694491df1e6c04f293222df3f8a1ae3f1066db1b573bdf8b",
+      "size": 464790
     },
     {
       "url": "https://code.claude.com/docs/en/admin-setup",
@@ -4923,8 +4923,8 @@
       "url": "https://code.claude.com/docs/en/feature-availability",
       "status": "success",
       "path": "en/docs/claude-code/feature-availability.md",
-      "sha256": "a6f2df6a93158947d90142f6c43d0dad448dfec4eeb016552b7caadf80c8b6e0",
-      "size": 23140
+      "sha256": "83284c85d33a8f28c46c0cb27ebe5cd5df4dbd2205170a2cc99efc1c84a04528",
+      "size": 23692
     },
     {
       "url": "https://code.claude.com/docs/en/amazon-bedrock",
@@ -4965,8 +4965,8 @@
       "url": "https://code.claude.com/docs/en/corporate-launcher",
       "status": "success",
       "path": "en/docs/claude-code/corporate-launcher.md",
-      "sha256": "74ea19aa77f523c0db149d4b73314c430c858426f3e59ba8edc62df0f664393e",
-      "size": 13308
+      "sha256": "3e10814e1ec535d3343f1158b378bf11edafe20e49f682c227c7c21c4a957ecb",
+      "size": 13383
     },
     {
       "url": "https://code.claude.com/docs/en/devcontainer",
@@ -4993,8 +4993,8 @@
       "url": "https://code.claude.com/docs/en/claude-apps-gateway-config",
       "status": "success",
       "path": "en/docs/claude-code/claude-apps-gateway-config.md",
-      "sha256": "20bafaa9e2173b5e44bced0c31594b8bf96d6f3c045cc6fa3ff3f54b27bea227",
-      "size": 129051
+      "sha256": "007c141fe2f1b4d7ef7c0f122173398991ade3c5d980200378b1e1a0d25de282",
+      "size": 139116
     },
     {
       "url": "https://code.claude.com/docs/en/claude-apps-gateway-spend-limits",
@@ -5007,29 +5007,29 @@
       "url": "https://code.claude.com/docs/en/claude-apps-gateway-deploy",
       "status": "success",
       "path": "en/docs/claude-code/claude-apps-gateway-deploy.md",
-      "sha256": "3474b661a72413e9040f79e25a8e5906b2c2e78e1b33393840de95409862cba1",
-      "size": 77164
+      "sha256": "4ab7b2a4a5978c2ee53e8834fe69015fc62d15ffeef94f00e6d8bd64ea7d1f71",
+      "size": 89479
     },
     {
       "url": "https://code.claude.com/docs/en/claude-apps-gateway-on-aws",
       "status": "success",
       "path": "en/docs/claude-code/claude-apps-gateway-on-aws.md",
-      "sha256": "f2bfe2859aefd42acffcc4d8e61d3c3fb1572a24bcb3a05ea391a29b877422df",
+      "sha256": "c2116399cda0623f46451fa6c817b11d2b016029b8b5a4858b45aceaf4401252",
       "size": 51083
     },
     {
       "url": "https://code.claude.com/docs/en/claude-apps-gateway-on-gcp",
       "status": "success",
       "path": "en/docs/claude-code/claude-apps-gateway-on-gcp.md",
-      "sha256": "caa7e445cfbc099cddef18f5b448cb245d93c04df03ff514772a395cc1b4ba19",
+      "sha256": "3044537575ca9a8afce6ef1488fe6d586327c6ac1bbe935bd972e1a2200a2044",
       "size": 25008
     },
     {
       "url": "https://code.claude.com/docs/en/llm-gateway",
       "status": "success",
       "path": "en/docs/claude-code/llm-gateway.md",
-      "sha256": "236a7b796b0255310652fa290588809971d92ef4f8b43f2a3da5c1b16544f85f",
-      "size": 6182
+      "sha256": "e863684e59a07b3817483d81dc7ff96d91c96a12edba8fbe41649c6387daa4b5",
+      "size": 6330
     },
     {
       "url": "https://code.claude.com/docs/en/llm-gateway-connect",
@@ -5042,15 +5042,15 @@
       "url": "https://code.claude.com/docs/en/llm-gateway-rollout",
       "status": "success",
       "path": "en/docs/claude-code/llm-gateway-rollout.md",
-      "sha256": "f578fee1c4c8f2d49d89caa66e326179309a4b1e8f06a45f9b532721354f070b",
-      "size": 32752
+      "sha256": "504cc1dbc2264b89c1a9c153e22e848b228464f67d138158d9ecdbd501ad3ad7",
+      "size": 37692
     },
     {
       "url": "https://code.claude.com/docs/en/llm-gateway-protocol",
       "status": "success",
       "path": "en/docs/claude-code/llm-gateway-protocol.md",
-      "sha256": "19c52d46285264754c3e271d8234e98767b5d6fd25201f92ed883ab5a00c2e0e",
-      "size": 35740
+      "sha256": "e82c90fa5f99716521ced55cf2cdb7486cf9adfa2ce4fba7dfb30786c29bca31",
+      "size": 46212
     },
     {
       "url": "https://code.claude.com/docs/en/monitoring-usage",
@@ -5147,8 +5147,8 @@
       "url": "https://code.claude.com/docs/en/settings-reference",
       "status": "success",
       "path": "en/docs/claude-code/settings-reference.md",
-      "sha256": "912a26a5f027e0495aa9ddf1ffc41723c6275efaf083eb6e3c20dfaabdee5219",
-      "size": 443586
+      "sha256": "ac4329e74a5b56185b5b1a0cc65f7b7916463ff7e87a5b3ac62c82a181ce2b17",
+      "size": 443819
     },
     {
       "url": "https://code.claude.com/docs/en/settings-example",
@@ -5168,8 +5168,8 @@
       "url": "https://code.claude.com/docs/en/permission-modes",
       "status": "success",
       "path": "en/docs/claude-code/permission-modes.md",
-      "sha256": "6f3718d5a765fe18e3b8f916dd149ea6fb0a892d3ccbc723c23cc5f898f2fd58",
-      "size": 82151
+      "sha256": "581e2ab28eff24b699a8201d90468437aac16aa6108225646d5d8d41422f913d",
+      "size": 82879
     },
     {
       "url": "https://code.claude.com/docs/en/sandboxing",
@@ -5189,8 +5189,8 @@
       "url": "https://code.claude.com/docs/en/cloud-environments",
       "status": "success",
       "path": "en/docs/claude-code/cloud-environments.md",
-      "sha256": "4ce623ebfa9a19052925c248803d90533076f71ea78eb04346cc64d6ea35f4a4",
-      "size": 65760
+      "sha256": "396efc0ddb0ff3f3f9284900a03645401d039b5cd4759fcc68b5156bf5161dee",
+      "size": 66544
     },
     {
       "url": "https://code.claude.com/docs/en/self-hosted-environments",
@@ -5210,8 +5210,8 @@
       "url": "https://code.claude.com/docs/en/self-hosted-environments-deploy",
       "status": "success",
       "path": "en/docs/claude-code/self-hosted-environments-deploy.md",
-      "sha256": "242c91919cda11088c9746bd21c9ecaaadee7ebe9fd8fa1b71f6c3d39ed9ec4c",
-      "size": 62448
+      "sha256": "559c0fec720c2ed971c18ca44670e70197c250494da93f0ddff4bbb02176db38",
+      "size": 64886
     },
     {
       "url": "https://code.claude.com/docs/en/self-hosted-environments-configuration",
@@ -5231,8 +5231,8 @@
       "url": "https://code.claude.com/docs/en/self-hosted-environments-reference",
       "status": "success",
       "path": "en/docs/claude-code/self-hosted-environments-reference.md",
-      "sha256": "f24d267f6621b9fb2b380e35bc9bca73fd772e93eab7dea6fafde6f1031f8f46",
-      "size": 89954
+      "sha256": "642bceb936e97d57536c3502bda57ba87980c26598dd14c4d959dd3fe0a8c478",
+      "size": 90550
     },
     {
       "url": "https://code.claude.com/docs/en/self-hosted-environments-identity",
@@ -5322,22 +5322,22 @@
       "url": "https://code.claude.com/docs/en/commands",
       "status": "success",
       "path": "en/docs/claude-code/commands.md",
-      "sha256": "1ba21dd2fbe7151da4dbc0a7d78ad82673eda45eea33857763d911e094e1c952",
+      "sha256": "ba8c67752aac27c6a43317bb5f6abc1a26750c84c50e5e5e40fe8a8929e5601a",
       "size": 176593
     },
     {
       "url": "https://code.claude.com/docs/en/env-vars",
       "status": "success",
       "path": "en/docs/claude-code/env-vars.md",
-      "sha256": "4c12354ed5b3015794d2c8868c40f7ccd9dd67a04371e838f93d733a25098509",
-      "size": 496121
+      "sha256": "17c833c69ac7d9c16c48993110880e13cefbf0fb61509fa2f656a87e09d1a834",
+      "size": 496249
     },
     {
       "url": "https://code.claude.com/docs/en/tools-reference",
       "status": "success",
       "path": "en/docs/claude-code/tools-reference.md",
-      "sha256": "db05442248b85c9bd4302e70b86a0ad14ea9d82ee567956694922e323bd85d82",
-      "size": 109948
+      "sha256": "72201e1682f1bdc04bcf7b892e072da1427094c84b2b26c20829e11cc23f2406",
+      "size": 110008
     },
     {
       "url": "https://code.claude.com/docs/en/interactive-mode",
@@ -5357,15 +5357,15 @@
       "url": "https://code.claude.com/docs/en/hooks",
       "status": "success",
       "path": "en/docs/claude-code/hooks.md",
-      "sha256": "84dee417bb2ee0b6a858f5f874ebd9a1690c0ddcfef479abdb49f625cf19a4c1",
-      "size": 328716
+      "sha256": "e0a14dcffd8299c22401f2ba18e577470f4ae25cb3dd6609a68160f1f2fbb390",
+      "size": 329656
     },
     {
       "url": "https://code.claude.com/docs/en/plugins-reference",
       "status": "success",
       "path": "en/docs/claude-code/plugins-reference.md",
-      "sha256": "5c1824cd1851c35e079c72db49e383bac26cd376fddb6b96ca6df2ecf980e544",
-      "size": 141869
+      "sha256": "f0e0bed28ed0adca7d818232a0788607f62965f97f5d3234b884ca1b2b4b18fe",
+      "size": 141682
     },
     {
       "url": "https://code.claude.com/docs/en/channels-reference",
@@ -5378,8 +5378,8 @@
       "url": "https://code.claude.com/docs/en/glossary",
       "status": "success",
       "path": "en/docs/claude-code/glossary.md",
-      "sha256": "00b68b486a912831e613733ffa85344eb9ddd33f324eeea5cd77ea0b77c211aa",
-      "size": 24939
+      "sha256": "1ab3fe3d0f14e34504d4f44ee789b5277c117583601be0550b497aa6a8b8ecf2",
+      "size": 25596
     },
     {
       "url": "https://code.claude.com/docs/en/agent-sdk/overview",
@@ -5875,8 +5875,8 @@
       "url": "https://modelcontextprotocol.io/community/interest-groups/primitive-grouping",
       "status": "success",
       "path": "mcp/community/interest-groups/primitive-grouping.md",
-      "sha256": "51e12068489862a0cfbee50168279cc0931a4a8ef2400d3f89dbe1e7bee96258",
-      "size": 8600
+      "sha256": "bc3545f9085df13d499a1122fbbedbb8aeffef7ed35e57db80bf3cbd1aa46318",
+      "size": 8676
     },
     {
       "url": "https://modelcontextprotocol.io/community/interest-groups/security",
@@ -5931,8 +5931,8 @@
       "url": "https://modelcontextprotocol.io/community/working-groups/filesystems",
       "status": "success",
       "path": "mcp/community/working-groups/filesystems.md",
-      "sha256": "7e6b3cd2e9837b1c38aa66b9b567039dd1e8e23d9aed4fc70702b0ab97a3ff98",
-      "size": 6927
+      "sha256": "2e0c23f29b73facfe1f92fa8202f44931e4f881289ff2b091355260d44d63bf2",
+      "size": 7081
     },
     {
       "url": "https://modelcontextprotocol.io/community/working-groups/inspector-v2",
@@ -5973,8 +5973,8 @@
       "url": "https://modelcontextprotocol.io/community/working-groups/skills-over-mcp",
       "status": "success",
       "path": "mcp/community/working-groups/skills-over-mcp.md",
-      "sha256": "abc94b91aca39660bf8b4c07e23fbe1b552430bc8825e7059d6596efef41d2a1",
-      "size": 12404
+      "sha256": "e32d05f595c143d52eea8995fda64a5976bc716718036fa494bffaf3cbba374a",
+      "size": 12032
     },
     {
       "url": "https://modelcontextprotocol.io/community/working-groups/transports",
@@ -6834,8 +6834,8 @@
       "url": "https://modelcontextprotocol.io/extensions/skills/overview",
       "status": "success",
       "path": "mcp/extensions/skills/overview.md",
-      "sha256": "36ca8a5641cc6e77f0a628d5820c180029c82d4f1ad34fb694b5ca03b50105df",
-      "size": 15672
+      "sha256": "c616c7ab1e93b2d562d41697f25bc92ff65e082cbaeabbe2e2ed3a919a296000",
+      "size": 16129
     },
     {
       "url": "https://modelcontextprotocol.io/extensions/tasks/overview",
@@ -8297,8 +8297,8 @@
       "url": "https://support.claude.com/en/articles/8114491-get-started-with-claude",
       "status": "success",
       "path": "support/8114491-get-started-with-claude.md",
-      "sha256": "d5875112a0d4839c8f78690ffc6910fc3050dd57e759a7d0c0f0480d72ddd519",
-      "size": 5207
+      "sha256": "44271d7b20288c3312a975f093e6f4d7e146abda92f6ff1612f370a5e265209b",
+      "size": 5203
     },
     {
       "url": "https://support.claude.com/en/articles/8114494-how-up-to-date-is-claude-s-training-data",
@@ -8374,8 +8374,8 @@
       "url": "https://support.claude.com/en/articles/8230524-delete-or-rename-a-conversation",
       "status": "success",
       "path": "support/8230524-delete-or-rename-a-conversation.md",
-      "sha256": "238ebc9ffdc58fc2e70c2f27d10a54e421a96b36b98023b0407189d0b4e6d31b",
-      "size": 5873
+      "sha256": "660358cda620d9aba61c6bb127d9c4b40c41812b0f07695947577d4a9297b105",
+      "size": 5885
     },
     {
       "url": "https://support.claude.com/en/articles/8241126-upload-files-to-claude",
@@ -8444,8 +8444,8 @@
       "url": "https://support.claude.com/en/articles/8325618-paid-plan-billing-faqs",
       "status": "success",
       "path": "support/8325618-paid-plan-billing-faqs.md",
-      "sha256": "c57a64a35879c599dbb2866e6ea6cbc56f1363a36bc7198a7269901a0a3f7d04",
-      "size": 4551
+      "sha256": "af74b886782ce5df44d43e54ce67de25de5b32eb8f7ab776ec7f0466afa8d117",
+      "size": 4553
     },
     {
       "url": "https://support.claude.com/en/articles/8325621-i-would-like-to-input-sensitive-data-into-my-chats-with-claude-who-can-view-my-conversations",
@@ -8507,8 +8507,8 @@
       "url": "https://support.claude.com/en/articles/8887527-customizing-your-appearance-settings",
       "status": "success",
       "path": "support/8887527-customizing-your-appearance-settings.md",
-      "sha256": "bb30c020a05527a9795f040660b5b8559ceea68c338a962320f1e50797a5c55e",
-      "size": 1872
+      "sha256": "f363c8a8194f009118982f70f71b4223b39114c6e7096de1ffe989c1bba08bf8",
+      "size": 1874
     },
     {
       "url": "https://support.claude.com/en/articles/8896518-does-anthropic-crawl-data-from-the-web-and-how-can-site-owners-block-the-crawler",
@@ -8682,8 +8682,8 @@
       "url": "https://support.claude.com/en/articles/9267400-move-your-personal-claude-account-to-a-team-or-enterprise-organization",
       "status": "success",
       "path": "support/9267400-move-your-personal-claude-account-to-a-team-or-enterprise-organization.md",
-      "sha256": "150d2c639bb6ea351c0e0b9df7a8d389cf284364732b007490202a3803c2a54d",
-      "size": 9725
+      "sha256": "6e871aca44a8346c9bd4e7c4d27b1ffbc66925e25f3b31e1357762f004fd33a6",
+      "size": 9723
     },
     {
       "url": "https://support.claude.com/en/articles/9301722-updates-to-our-acceptable-use-policy-now-usage-policy-consumer-terms-of-service-and-privacy-policy",
@@ -8717,8 +8717,8 @@
       "url": "https://support.claude.com/en/articles/9487310-what-are-artifacts-and-how-do-i-use-them",
       "status": "success",
       "path": "support/9487310-what-are-artifacts-and-how-do-i-use-them.md",
-      "sha256": "87608738138c78b18fe05dcebe4c618f967e1daa12bffe35183f625944b9fef0",
-      "size": 11900
+      "sha256": "f55195e3cefc3a4206d4eade21e24f01f9c40d3d306ef26d82f3333320287e97",
+      "size": 11945
     },
     {
       "url": "https://support.claude.com/en/articles/9517075-what-are-projects",
@@ -8731,15 +8731,15 @@
       "url": "https://support.claude.com/en/articles/9519177-how-can-i-create-and-manage-projects",
       "status": "success",
       "path": "support/9519177-how-can-i-create-and-manage-projects.md",
-      "sha256": "067be8b20c32df8b3d6f0b1bca9a708d45fd78d72eef933f42a5f1ddbf9b599b",
-      "size": 8855
+      "sha256": "a7101f9ae1e81ee7d0c22b9d470c0fb235faa95bcb22efcc929eac196a29e9d8",
+      "size": 8853
     },
     {
       "url": "https://support.claude.com/en/articles/9519189-manage-project-visibility-and-sharing",
       "status": "success",
       "path": "support/9519189-manage-project-visibility-and-sharing.md",
-      "sha256": "87ab9febd95afc82e1c991286a4614450aab3198e7307bafaf91d61194c0ae21",
-      "size": 8567
+      "sha256": "661086f0b0731f0bd1597dad93f64b0483f20c91cf84d420b38f0c7aa75f6c3e",
+      "size": 8557
     },
     {
       "url": "https://support.claude.com/en/articles/9519291-what-is-anthropic-s-policy-for-handling-governmental-requests-for-user-information",
@@ -8759,7 +8759,7 @@
       "url": "https://support.claude.com/en/articles/9534590-cost-and-usage-reporting-in-the-claude-console",
       "status": "success",
       "path": "support/9534590-cost-and-usage-reporting-in-the-claude-console.md",
-      "sha256": "70316668a7b99acf94678059c394d07b818d54bdbe013e984132c817874d87f0",
+      "sha256": "af5b87111c5e6a2b45a4b2b869e91c837e3e88b9facf2e9289ea7904dbe4ae87",
       "size": 5102
     },
     {
@@ -8843,7 +8843,7 @@
       "url": "https://support.claude.com/en/articles/9927533-disable-public-projects-for-your-organization",
       "status": "success",
       "path": "support/9927533-disable-public-projects-for-your-organization.md",
-      "sha256": "95386d0e0dcec417caaee35477289e151f50a0c2662089e6102760fe6ced4b8a",
+      "sha256": "570eb1f9bbea3ba779c47d1b11df28210d6c29552ab0bf72ebf50ca040fca65e",
       "size": 2580
     },
     {
@@ -8983,15 +8983,15 @@
       "url": "https://support.claude.com/en/articles/10310342-how-do-i-log-out-of-all-active-sessions",
       "status": "success",
       "path": "support/10310342-how-do-i-log-out-of-all-active-sessions.md",
-      "sha256": "61b13cffd50986fddf31cd60cc60de3916b434a8a529e775d093666f1acebcd1",
-      "size": 2496
+      "sha256": "5176e345bf98d21627b1639eaaa80fe9245aaf1770b19fda065f204658fc2429",
+      "size": 2494
     },
     {
       "url": "https://support.claude.com/en/articles/10366376-how-can-i-delete-my-claude-console-account",
       "status": "success",
       "path": "support/10366376-how-can-i-delete-my-claude-console-account.md",
-      "sha256": "6acf9cd9a2b0436a62e8ffbf57968feee11db5f8c5c474f722588669e67a734e",
-      "size": 3163
+      "sha256": "579fe3cf829cb4d5438ef2ee4431a34eb6e7686c3bdb9d4f045fd8e1895ac0f6",
+      "size": 3171
     },
     {
       "url": "https://support.claude.com/en/articles/10366389-how-can-i-get-higher-rate-limits-on-the-claude-api",
@@ -9032,15 +9032,15 @@
       "url": "https://support.claude.com/en/articles/10504844-manage-user-feedback-settings-on-team-and-enterprise-plans",
       "status": "success",
       "path": "support/10504844-manage-user-feedback-settings-on-team-and-enterprise-plans.md",
-      "sha256": "6de03f928c056ddc37ffd9e092f3d281ad713627b76db4ee3870462b9b43c9de",
-      "size": 1036
+      "sha256": "66ffe3dc10ea0e9425752b972c551dba8ceab5ddf734980ff4ed0285f1e4330a",
+      "size": 1038
     },
     {
       "url": "https://support.claude.com/en/articles/10504853-manage-user-feedback-settings-on-claude-console",
       "status": "success",
       "path": "support/10504853-manage-user-feedback-settings-on-claude-console.md",
-      "sha256": "ac035377873cc2cd1e838b2a24efa26a31be2460fb2e23fd437420dce6d155e7",
-      "size": 997
+      "sha256": "6d3fc6701d6f9ef6f1a91ba0893ffd1a95ab961297e14124b84a3f66aa125ca6",
+      "size": 999
     },
     {
       "url": "https://support.claude.com/en/articles/10534883-use-the-claude-widget-on-android",
@@ -9053,8 +9053,8 @@
       "url": "https://support.claude.com/en/articles/10593882-share-and-unshare-chats",
       "status": "success",
       "path": "support/10593882-share-and-unshare-chats.md",
-      "sha256": "2e578536d956ee8139b7a3c9e6d0647bfdc25b96e97d19a192c0ac337de494ba",
-      "size": 4016
+      "sha256": "5bb195e6251deb7f4a511abc8376071dceba702b2a29edc74395e88fcbcd72a6",
+      "size": 4012
     },
     {
       "url": "https://support.claude.com/en/articles/10684626-enable-and-use-web-search",
@@ -9081,7 +9081,7 @@
       "url": "https://support.claude.com/en/articles/10949351-getting-started-with-local-mcp-servers-on-claude-desktop",
       "status": "success",
       "path": "support/10949351-getting-started-with-local-mcp-servers-on-claude-desktop.md",
-      "sha256": "f089a68d699216137e97a376cc7f08a20af2e9a11c7c570e29b2545f6d501ad6",
+      "sha256": "2814b4c316dd5d3ce91bba8c8d5639766bcd267002394ad59bfe10127caf6e26",
       "size": 8267
     },
     {
@@ -9116,7 +9116,7 @@
       "url": "https://support.claude.com/en/articles/11101966-use-voice-mode",
       "status": "success",
       "path": "support/11101966-use-voice-mode.md",
-      "sha256": "5f413b6cf2fdf4be139838f10c0b4d090c94c21dd22014c68e7acec91e924668",
+      "sha256": "f6d49ba31c009be4f6a8fb52f2f8e455da2695ed9689cbd642f2a03ff37fe66e",
       "size": 10555
     },
     {
@@ -9249,8 +9249,8 @@
       "url": "https://support.claude.com/en/articles/11725453-set-up-the-claude-lti-in-canvas-by-instructure",
       "status": "success",
       "path": "support/11725453-set-up-the-claude-lti-in-canvas-by-instructure.md",
-      "sha256": "7b5671656ac4b5dd1e2d04143900a4a1249baf2bbd64ad3882b016eeb470f5e8",
-      "size": 2746
+      "sha256": "b9bc41d21c6d7e3a254098d7370e001866a1eb0010e1a40e26501043d08bcc2a",
+      "size": 2748
     },
     {
       "url": "https://support.claude.com/en/articles/11732894-who-owns-and-manages-the-data-of-my-claude-for-education-account",
@@ -9263,15 +9263,15 @@
       "url": "https://support.claude.com/en/articles/11817273-use-claude-s-chat-search-and-memory-to-build-on-previous-context",
       "status": "success",
       "path": "support/11817273-use-claude-s-chat-search-and-memory-to-build-on-previous-context.md",
-      "sha256": "9bb2bb6dc03581ebcf4e7fb08aab074b759f2052e480c53d3e5665a2cbae7dea",
+      "sha256": "406c662d690ee5b5afdb45b99fb79950afbf6c15d86fe400b538632c3e5a7aac",
       "size": 25858
     },
     {
       "url": "https://support.claude.com/en/articles/11818288-why-am-i-being-asked-to-verify-my-payment-method",
       "status": "success",
       "path": "support/11818288-why-am-i-being-asked-to-verify-my-payment-method.md",
-      "sha256": "7ce52be3cb0f1a1a58502481738dc83dd8b14a2dbe178d14eedbec176e9f9120",
-      "size": 816
+      "sha256": "cd6e399b23d2cbc7feda1158320e7150065e6aff4ca29c4efff2982479457aa4",
+      "size": 818
     },
     {
       "url": "https://support.claude.com/en/articles/11825384-how-to-update-claude-for-ios",
@@ -9305,8 +9305,8 @@
       "url": "https://support.claude.com/en/articles/11869629-use-claude-with-android-apps",
       "status": "success",
       "path": "support/11869629-use-claude-with-android-apps.md",
-      "sha256": "21d93b75864175d00975ad241a2af2f26b0bdf11cc7e8830bd6bd3beb319d90a",
-      "size": 13999
+      "sha256": "a5294fa10c57b4373e0c916e609ffcfd2a19de55ae56b89e9946297101b48d64",
+      "size": 13993
     },
     {
       "url": "https://support.claude.com/en/articles/11932705-automated-security-reviews-in-claude-code",
@@ -9340,15 +9340,15 @@
       "url": "https://support.claude.com/en/articles/12005970-manage-usage-credits-for-team-and-seat-based-enterprise-plans",
       "status": "success",
       "path": "support/12005970-manage-usage-credits-for-team-and-seat-based-enterprise-plans.md",
-      "sha256": "fb0adff83c893a5aa787ba260f918eadf4845ec9e0d9bd51585b9646d4fdaa26",
-      "size": 9709
+      "sha256": "9b50396129c11637e691670c126dd28c4efd681ff2dcaa9bc1e7670bba58dd11",
+      "size": 9699
     },
     {
       "url": "https://support.claude.com/en/articles/12012173-get-started-with-claude-in-chrome",
       "status": "success",
       "path": "support/12012173-get-started-with-claude-in-chrome.md",
-      "sha256": "f0e4588c5fa999075355127722bbf88d8f13fd5397b858712d45a2afd10da5a4",
-      "size": 14853
+      "sha256": "4d88b3a00ad93eae3080f2a6ef684e091538cc5b91bb8aaec7fd7a93a10a7ad7",
+      "size": 14857
     },
     {
       "url": "https://support.claude.com/en/articles/12053672-what-happens-to-a-user-s-data-when-they-are-removed-from-a-team-or-enterprise-organization",
@@ -9361,8 +9361,8 @@
       "url": "https://support.claude.com/en/articles/12083917-change-your-team-plan-from-monthly-to-annual-billing",
       "status": "success",
       "path": "support/12083917-change-your-team-plan-from-monthly-to-annual-billing.md",
-      "sha256": "f574c0bcc9474311ed216ca5662452faedae04d6189ab20edf0ba50660a05f73",
-      "size": 1398
+      "sha256": "26bf095fc58270c6a59f1b4572afb543118a5f58d91388a0ced6495cdff17d2a",
+      "size": 1396
     },
     {
       "url": "https://support.claude.com/en/articles/12109679-creating-a-new-account-after-deletion",
@@ -9375,7 +9375,7 @@
       "url": "https://support.claude.com/en/articles/12111783-create-and-edit-files-with-claude",
       "status": "success",
       "path": "support/12111783-create-and-edit-files-with-claude.md",
-      "sha256": "e0df3aef8ab9212a04586609dd5a076ab116be2b31c0a848801b5543393db980",
+      "sha256": "d2727c6211d572f9ad33103a1b4929979f18da5c4110a1327e380b666fe2457e",
       "size": 17960
     },
     {
@@ -9403,22 +9403,22 @@
       "url": "https://support.claude.com/en/articles/12157520-claude-code-usage-analytics",
       "status": "success",
       "path": "support/12157520-claude-code-usage-analytics.md",
-      "sha256": "72ab6b74f9bafd8dc162119a97e8be30fcb354768d923c4b5b2de572ca65a3a2",
-      "size": 6427
+      "sha256": "60b30d9ca57dc76680cd8cf8a06b18b4ecfe91e33cc97368a1b7798c1944ef18",
+      "size": 6431
     },
     {
       "url": "https://support.claude.com/en/articles/12260368-use-incognito-chats",
       "status": "success",
       "path": "support/12260368-use-incognito-chats.md",
-      "sha256": "e7b30e162cdac55cfd70b29c4721f9ccc72e4ea0a307c5ea368b7611760c3770",
-      "size": 3757
+      "sha256": "25a5da52d7d24e92056c235ae84d8ea55e722f1dfb12bf736e106a569cf353d7",
+      "size": 3753
     },
     {
       "url": "https://support.claude.com/en/articles/12293051-use-claude-in-xcode",
       "status": "success",
       "path": "support/12293051-use-claude-in-xcode.md",
-      "sha256": "5fbb02ff1c13a276ca5c33ba227d2c7f7831ec2b754edeee2058ff5047a2bf42",
-      "size": 1911
+      "sha256": "4c1641d447bf7c1b13eff74bc5352c8b6665557e522f1348b2b74a6b27eb476c",
+      "size": 1905
     },
     {
       "url": "https://support.claude.com/en/articles/12304248-manage-api-key-environment-variables-in-claude-code",
@@ -9459,14 +9459,14 @@
       "url": "https://support.claude.com/en/articles/12429409-manage-usage-credits-for-paid-claude-plans",
       "status": "success",
       "path": "support/12429409-manage-usage-credits-for-paid-claude-plans.md",
-      "sha256": "6899556b59292bc050032f0389b115fd82105858dd0721cb21eaf9b6dafc82b2",
-      "size": 6418
+      "sha256": "d4a42a3014844480a33c4e55b56007875e28645a61b8fa32f57c34dda657603f",
+      "size": 6412
     },
     {
       "url": "https://support.claude.com/en/articles/12466728-troubleshoot-claude-error-messages",
       "status": "success",
       "path": "support/12466728-troubleshoot-claude-error-messages.md",
-      "sha256": "243f330dd2fa3a37fd2aa4ca66e6f1d3d6bfc3d74d6f9e4fc885a2be292ff3f4",
+      "sha256": "485007172536212661b61f07aa0d83eb8622b743da455cda56c07fef94041c0c",
       "size": 4234
     },
     {
@@ -9487,8 +9487,8 @@
       "url": "https://support.claude.com/en/articles/12512180-use-skills-in-claude",
       "status": "success",
       "path": "support/12512180-use-skills-in-claude.md",
-      "sha256": "3186a2b0b903a604392dc483b0c020ece5ef50a6601d5bf7f9cc22fd550f9976",
-      "size": 15920
+      "sha256": "46ee691b40e2d0d0e8271e6ef774b4e498e64069e21017aaa2a300f21935b749",
+      "size": 15918
     },
     {
       "url": "https://support.claude.com/en/articles/12512198-how-to-create-custom-skills",
@@ -9501,15 +9501,15 @@
       "url": "https://support.claude.com/en/articles/12542951-set-up-the-microsoft-365-connector",
       "status": "success",
       "path": "support/12542951-set-up-the-microsoft-365-connector.md",
-      "sha256": "65abb44427b7c54c90c579eeb46caccbaea6accec3cf52bb06af1178ac80bf24",
-      "size": 21753
+      "sha256": "23d6ad280de12ca3866afbd517e4d5c2313c59d0120e4ed32f05b46f2beb64fe",
+      "size": 21824
     },
     {
       "url": "https://support.claude.com/en/articles/12592343-enabling-and-using-the-desktop-extension-allowlist",
       "status": "success",
       "path": "support/12592343-enabling-and-using-the-desktop-extension-allowlist.md",
-      "sha256": "8d959ff55f67f91ba88f6cca3e509b91b56427b9b8d39e12645441e1516dfdf7",
-      "size": 5720
+      "sha256": "2e73fd7d35f8a24a48d7e316f0e11d6ce0aa3d0188ca63b07e756a0964bf581b",
+      "size": 5706
     },
     {
       "url": "https://support.claude.com/en/articles/12611117-deploy-claude-desktop-for-macos",
@@ -9522,8 +9522,8 @@
       "url": "https://support.claude.com/en/articles/12618689-claude-code-on-the-web",
       "status": "success",
       "path": "support/12618689-claude-code-on-the-web.md",
-      "sha256": "ce6d426fbb4d02fe0dc5cd56e4893b69ecd1b99dbca4ce07c7aec237991f7d97",
-      "size": 10966
+      "sha256": "bcd5aa87e95557c2264486925c5e74901ec67b1a9126257a74ffc17fef76e969",
+      "size": 10962
     },
     {
       "url": "https://support.claude.com/en/articles/12622667-enterprise-configuration-for-claude-desktop",
@@ -9543,15 +9543,15 @@
       "url": "https://support.claude.com/en/articles/12626668-use-quick-entry-with-claude-desktop-on-mac",
       "status": "success",
       "path": "support/12626668-use-quick-entry-with-claude-desktop-on-mac.md",
-      "sha256": "fd4b773649314f8e318aa80a0b2a795f56787918ae6cd211c8232f6450dce6e9",
-      "size": 5972
+      "sha256": "230d210cfd7d033185362bf5d1b9dade159d38c8ee40ecec40ccb330c1666468",
+      "size": 5974
     },
     {
       "url": "https://support.claude.com/en/articles/12684923-microsoft-365-connector-security-guide",
       "status": "success",
       "path": "support/12684923-microsoft-365-connector-security-guide.md",
-      "sha256": "f815a93b320cf6aaf872d489f3001c04b260618c5651892cd105badc12b91a27",
-      "size": 26174
+      "sha256": "b8629bdfd92bf6f22e39f749df7e628d9038b97f2dbd9eedc6ef5f96dd7add3f",
+      "size": 26323
     },
     {
       "url": "https://support.claude.com/en/articles/12702546-deploying-enterprise-grade-mcp-servers-with-desktop-extensions",
@@ -9578,8 +9578,8 @@
       "url": "https://support.claude.com/en/articles/12883420-view-usage-analytics-for-team-and-enterprise-plans",
       "status": "success",
       "path": "support/12883420-view-usage-analytics-for-team-and-enterprise-plans.md",
-      "sha256": "9666a09c4e5baa4db86a3f236dd7767ebde9316ab0bedb88b49db542858ff28c",
-      "size": 14517
+      "sha256": "42ac1398bba7ad2560efa2ba09f4e04df4873e97bfba482eec6ce0d9d287376a",
+      "size": 14519
     },
     {
       "url": "https://support.claude.com/en/articles/12902405-claude-in-chrome-troubleshooting",
@@ -9599,7 +9599,7 @@
       "url": "https://support.claude.com/en/articles/12902446-claude-in-chrome-permissions-guide",
       "status": "success",
       "path": "support/12902446-claude-in-chrome-permissions-guide.md",
-      "sha256": "f04832b8317fcf8ab8797643024c9c292fef5b2b1feac5be30165e431461ebd5",
+      "sha256": "474eadd8464b094ca3a02d2f8005b72c82cff55c8760251f8cd284746df3cbec",
       "size": 9563
     },
     {
@@ -9627,7 +9627,7 @@
       "url": "https://support.claude.com/en/articles/12997503-team-plan-billing-faqs",
       "status": "success",
       "path": "support/12997503-team-plan-billing-faqs.md",
-      "sha256": "9ee3f860236269b583d2003cb79cb2616afda5891cf71df6d9454b947bdab7e8",
+      "sha256": "5f68f1206c26971f8c0537d94b848624495f2f3eb96072d8febf81585cb97018",
       "size": 4853
     },
     {
@@ -9676,15 +9676,15 @@
       "url": "https://support.claude.com/en/articles/13132885-set-up-single-sign-on-sso",
       "status": "success",
       "path": "support/13132885-set-up-single-sign-on-sso.md",
-      "sha256": "a12802dc8c8c441da006fe2ac6d9826be8d92f681a67265d9d5e937774615e45",
+      "sha256": "7eb4f999b4dd71167802bedcd5517be4afc0e45a71649151c2831189e6189f91",
       "size": 13337
     },
     {
       "url": "https://support.claude.com/en/articles/13133195-set-up-jit-or-scim-provisioning",
       "status": "success",
       "path": "support/13133195-set-up-jit-or-scim-provisioning.md",
-      "sha256": "40c84cf2183ec56cfb96747020dbf99fd7de7675564f26005a2665f11e21024e",
-      "size": 20340
+      "sha256": "faf34cd27150ec3b881b988014bcfbf977b4b7b9808b4f4ad052e8741f9eab13",
+      "size": 20338
     },
     {
       "url": "https://support.claude.com/en/articles/13133750-manage-members-on-team-and-enterprise-plans",
@@ -9711,8 +9711,8 @@
       "url": "https://support.claude.com/en/articles/13163631-configuring-session-security-settings",
       "status": "success",
       "path": "support/13163631-configuring-session-security-settings.md",
-      "sha256": "62d6256605e7ec64c9833a7e8cbd5d61e56ab7a7466067b298af6e0721d62ff6",
-      "size": 3696
+      "sha256": "eb1768e037a7ddead2fd6eb36b7a4dc1d971b0bb17bf4c718b188b60c0c68bfc",
+      "size": 3698
     },
     {
       "url": "https://support.claude.com/en/articles/13171706-crisis-helpline-support-in-claude",
@@ -9725,7 +9725,7 @@
       "url": "https://support.claude.com/en/articles/13189465-log-in-to-your-claude-account",
       "status": "success",
       "path": "support/13189465-log-in-to-your-claude-account.md",
-      "sha256": "7ae017e6264cc64cb8576926b65947cc882fb8b8901669bea48cf9b47ebcf9b4",
+      "sha256": "9b337ccb8824338f8f16b33caf5d3fbe3fd9bbbf80cfb1cdf7f9afed9a269232",
       "size": 7038
     },
     {
@@ -9753,22 +9753,22 @@
       "url": "https://support.claude.com/en/articles/13325567-account-management-faqs",
       "status": "success",
       "path": "support/13325567-account-management-faqs.md",
-      "sha256": "f8b25c2db44a16840c7d89f0b39c26791f4d4e0770e8a8510a0b3282998c1c4a",
+      "sha256": "218978b70695cbadf423481379cf4d10bbadd49b47e9222971af2872c2982165",
       "size": 2634
     },
     {
       "url": "https://support.claude.com/en/articles/13345190-get-started-with-claude-cowork",
       "status": "success",
       "path": "support/13345190-get-started-with-claude-cowork.md",
-      "sha256": "bb6cfd2c42a33be2e01a74b5e21ae6faa5f92c960eeb86f4f45daadc986a0073",
-      "size": 23097
+      "sha256": "638f0ac8ba38de30ee13e7cbeb2888f4ac3f27f119756db7f851c3dbfb40b0ec",
+      "size": 22657
     },
     {
       "url": "https://support.claude.com/en/articles/13346458-customizing-your-console-appearance-settings",
       "status": "success",
       "path": "support/13346458-customizing-your-console-appearance-settings.md",
-      "sha256": "01b08421432027393ceceac28499dd422f3403bc05ba2b541f6c67f9abd80b35",
-      "size": 605
+      "sha256": "3736968274639268e2278cdb6241669271af81a52946fc3578c9f2c35da66422",
+      "size": 609
     },
     {
       "url": "https://support.claude.com/en/articles/13346720-export-your-organization-s-data",
@@ -9788,8 +9788,8 @@
       "url": "https://support.claude.com/en/articles/13371040-log-in-to-your-console-account",
       "status": "success",
       "path": "support/13371040-log-in-to-your-console-account.md",
-      "sha256": "949f08ddf2721bb1272f682be9d352770c5a83b54594f06c38cb866d5ef855ff",
-      "size": 4609
+      "sha256": "f48c07d20a64083c80ec03be21daa50c957fea2c9fcf4eb63db41535fd8ca0bd",
+      "size": 4611
     },
     {
       "url": "https://support.claude.com/en/articles/13393991-purchase-and-manage-seats-on-enterprise-plans",
@@ -9830,8 +9830,8 @@
       "url": "https://support.claude.com/en/articles/13455879-use-claude-cowork-on-team-and-enterprise-plans",
       "status": "success",
       "path": "support/13455879-use-claude-cowork-on-team-and-enterprise-plans.md",
-      "sha256": "7468c0297ab3eef4c441356b879a1b582d4f2468f6da2f1f9e3e07a348a435f7",
-      "size": 13367
+      "sha256": "fc1d9748e33b7e389fea90ca2bbe05af8fc103d8bb39941c24897a7b2c233d75",
+      "size": 12465
     },
     {
       "url": "https://support.claude.com/en/articles/13566435-find-and-join-a-team-or-enterprise-organization",
@@ -9844,8 +9844,8 @@
       "url": "https://support.claude.com/en/articles/13641943-visual-and-interactive-content",
       "status": "success",
       "path": "support/13641943-visual-and-interactive-content.md",
-      "sha256": "ed9fdda2e7a0ac3600861546e8eb2e02abc32e055eda5382f2472bd5463b3137",
-      "size": 6511
+      "sha256": "1eb3b47ad02599ada09b13c4abc5f7ff43714e06aa2b64b28aa050bbbc216e2b",
+      "size": 6507
     },
     {
       "url": "https://support.claude.com/en/articles/13663666-use-visual-and-interactive-content-on-team-and-enterprise-plans",
@@ -9872,8 +9872,8 @@
       "url": "https://support.claude.com/en/articles/13756069-public-sector-faqs",
       "status": "success",
       "path": "support/13756069-public-sector-faqs.md",
-      "sha256": "cedc876d925ae1c2ed2aee9c5992507fbc6f01dc8a168ecbf1c7c15140d347a5",
-      "size": 8378
+      "sha256": "8a96e8b5c9b1699ba161375205a504004a2167a7225d477bdedea71e51cd05c5",
+      "size": 8382
     },
     {
       "url": "https://support.claude.com/en/articles/13776697-join-an-organization-via-invite-link",
@@ -9893,22 +9893,22 @@
       "url": "https://support.claude.com/en/articles/13799932-manage-groups-and-group-spend-limits-on-enterprise-plans",
       "status": "success",
       "path": "support/13799932-manage-groups-and-group-spend-limits-on-enterprise-plans.md",
-      "sha256": "d4aa6ac51f43a26d2faf8a38d8428e09700ac91bd882e2689dc03ed42e028007",
-      "size": 12953
+      "sha256": "3c60811c36c13e78e1633034b81e5e75cf7a710138fd83fc745565d2ec2f07ed",
+      "size": 12956
     },
     {
       "url": "https://support.claude.com/en/articles/13837433-manage-plugins-for-your-organization",
       "status": "success",
       "path": "support/13837433-manage-plugins-for-your-organization.md",
-      "sha256": "2a9f38296f2b8a9a2f39e202089df7a4a98f3bf2eeb785d266645ea40462f53c",
-      "size": 21285
+      "sha256": "1efc23f8412667a61bed1869b40f58357bf5bc9733ef401d9749dd4f9f20e88b",
+      "size": 21287
     },
     {
       "url": "https://support.claude.com/en/articles/13837440-use-plugins-in-claude",
       "status": "success",
       "path": "support/13837440-use-plugins-in-claude.md",
-      "sha256": "9d4aaede4a5f706ecf4c605132c5824a8c765b9c8e77b431fb3d0c8c9f2a62b1",
-      "size": 10881
+      "sha256": "35c85ef6c63db109fab84af468af8b28be72ac1249ea8b8f4da31646d20ad2ed",
+      "size": 10875
     },
     {
       "url": "https://support.claude.com/en/articles/13854387-schedule-recurring-tasks-in-claude-cowork",
@@ -10005,8 +10005,8 @@
       "url": "https://support.claude.com/en/articles/13947068-assign-tasks-from-anywhere-in-claude-cowork",
       "status": "success",
       "path": "support/13947068-assign-tasks-from-anywhere-in-claude-cowork.md",
-      "sha256": "8f57932e553c78f376a8be22e409e56483d84900a79162a03c9574be4d91be5e",
-      "size": 9229
+      "sha256": "8e48debacd0b40ea9da4cb9c7045a91332948d21dd2508c048654db506763db6",
+      "size": 9231
     },
     {
       "url": "https://support.claude.com/en/articles/13979539-custom-visuals-in-chat-and-cowork",
@@ -10026,8 +10026,8 @@
       "url": "https://support.claude.com/en/articles/14116274-organize-your-tasks-with-projects-in-claude-cowork",
       "status": "success",
       "path": "support/14116274-organize-your-tasks-with-projects-in-claude-cowork.md",
-      "sha256": "acff92eb2e6eef78ac0e4d5f5d0ce2a0751172bae04977c73b3b09adbde0a5d5",
-      "size": 6826
+      "sha256": "893d213e30d7a59ef87b9ffe9a459a475df8c5b7c08628bdb5cb4793785d563d",
+      "size": 6820
     },
     {
       "url": "https://support.claude.com/en/articles/14128542-let-claude-use-your-computer-in-cowork",
@@ -10096,8 +10096,8 @@
       "url": "https://support.claude.com/en/articles/14499648-how-scim-sync-works-for-enterprise-organizations",
       "status": "success",
       "path": "support/14499648-how-scim-sync-works-for-enterprise-organizations.md",
-      "sha256": "14d546a4878e063f68f589ae4edd1e030866e38c6daaa9a5cfb572d906a998ac",
-      "size": 7672
+      "sha256": "31241c5a648ed392ac8d48dc1b3c2c7dca2c437b461b9323e59f1cfa35b4c971",
+      "size": 7674
     },
     {
       "url": "https://support.claude.com/en/articles/14503520-available-beta-and-research-preview-features",
@@ -10110,22 +10110,22 @@
       "url": "https://support.claude.com/en/articles/14503590-get-started-with-claude-for-government",
       "status": "success",
       "path": "support/14503590-get-started-with-claude-for-government.md",
-      "sha256": "5504c2565169112a91e575fc6385acf9ec211ff326eb1878b0a81ae840bc52f1",
-      "size": 4570
+      "sha256": "9cb5edf60213654614cc2e416a8eab4e568f6b91b1ef333d320952423d8bf48b",
+      "size": 1418
     },
     {
       "url": "https://support.claude.com/en/articles/14503613-sso-login",
       "status": "success",
       "path": "support/14503613-sso-login.md",
-      "sha256": "1802d5ee7daf38230842a592bbf930be717224ca857d33039916de1438fc818a",
-      "size": 6684
+      "sha256": "56fd38aa47b634d40abd248b3c97a13094666a4cc616caacc268ecb7dea7ae7e",
+      "size": 6682
     },
     {
       "url": "https://support.claude.com/en/articles/14503643-set-up-scim-in-claude-for-government",
       "status": "success",
       "path": "support/14503643-set-up-scim-in-claude-for-government.md",
-      "sha256": "5ffa90de3b88dddafdd28a4285d85a58dfb6625f555d34aefad610ceb912a737",
-      "size": 6425
+      "sha256": "289d505bffafd45f3c48f1dd8b4efd4e44227ecd7ba23c81b401f5da928b4063",
+      "size": 6417
     },
     {
       "url": "https://support.claude.com/en/articles/14503675-organization-instructions-in-claude-for-government",
@@ -10152,8 +10152,8 @@
       "url": "https://support.claude.com/en/articles/14503775-mcp-web-search",
       "status": "success",
       "path": "support/14503775-mcp-web-search.md",
-      "sha256": "779de7ba14b43792f0298a2ddac97bfeaf9c7aaaaad052270f3f9e48f513efb3",
-      "size": 4677
+      "sha256": "9cc67925182da2e3b27d9dd43d58599a2a1b7e7267605d15d91ea3a65f538282",
+      "size": 4679
     },
     {
       "url": "https://support.claude.com/en/articles/14503794-model-availability-in-claude-for-government",
@@ -10250,8 +10250,8 @@
       "url": "https://support.claude.com/en/articles/14604397-set-up-your-design-system-in-claude-design",
       "status": "success",
       "path": "support/14604397-set-up-your-design-system-in-claude-design.md",
-      "sha256": "9a81d24d80cff34e7c84910fa7262501f1598afabce23f861695adef2b86c4dd",
-      "size": 5764
+      "sha256": "992e7427e76663e9ae3b0695dc291a741df326fc717c2f2b842d20761705b518",
+      "size": 5762
     },
     {
       "url": "https://support.claude.com/en/articles/14604406-claude-design-admin-guide-for-team-and-enterprise-plans",
@@ -10264,8 +10264,8 @@
       "url": "https://support.claude.com/en/articles/14604416-get-started-with-claude-design",
       "status": "success",
       "path": "support/14604416-get-started-with-claude-design.md",
-      "sha256": "8c4093a2e624cc9c25b59c65556cf3fc4490dca72fb51e2cd06745e2c9971b99",
-      "size": 13651
+      "sha256": "e613c97f50e33bbf6b2dea313496a21fe942ff5ca55495c9fe7fc39ab9068781",
+      "size": 13676
     },
     {
       "url": "https://support.claude.com/en/articles/14604842-real-time-cyber-safeguards-on-claude-opus-and-sonnet",
@@ -10390,8 +10390,8 @@
       "url": "https://support.claude.com/en/articles/15330088-set-a-default-model-for-your-organization",
       "status": "success",
       "path": "support/15330088-set-a-default-model-for-your-organization.md",
-      "sha256": "637c45e08a61a06ff73de906437016fe60f819b815527aa47eee77d9fc0e2eb6",
-      "size": 8910
+      "sha256": "3da5e26aef1e78ff443bb14bbab2e328a567759151d0c7a7a11c1388d9c894ac",
+      "size": 8914
     },
     {
       "url": "https://support.claude.com/en/articles/15330651-claude-enterprise-admin-api-reference-guide",
@@ -10502,8 +10502,8 @@
       "url": "https://support.claude.com/en/articles/15694740-manage-model-access-for-your-organization",
       "status": "success",
       "path": "support/15694740-manage-model-access-for-your-organization.md",
-      "sha256": "976739febefd8888733c2237928d666198e6871b601e2639f99ab1971b9851b2",
-      "size": 10143
+      "sha256": "7778900968c27c80a3997ff71c6d63253051ea316c964e3736aa42db8751e359",
+      "size": 10145
     },
     {
       "url": "https://support.claude.com/en/articles/15707726-using-claude-for-legal-work-privilege-confidentiality-and-how-to-think-about-configuration",
@@ -10537,8 +10537,8 @@
       "url": "https://support.claude.com/en/articles/15936181-get-started-with-1password-for-claude",
       "status": "success",
       "path": "support/15936181-get-started-with-1password-for-claude.md",
-      "sha256": "b466af8d5810ec03feed5d4e31122a2fa7a7965fcf958ebac49c910c1a1b36cd",
-      "size": 5056
+      "sha256": "397f0247ebd7107f5a57214bc4e083857000d14d923e50115e849c70a7f21126",
+      "size": 5058
     },
     {
       "url": "https://support.claude.com/en/articles/16049681-why-claude-switched-models-in-your-conversation-with-opus-5",
@@ -10586,8 +10586,8 @@
       "url": "https://support.claude.com/en/articles/16607638-understanding-your-pro-or-max-plan-invoices",
       "status": "success",
       "path": "support/16607638-understanding-your-pro-or-max-plan-invoices.md",
-      "sha256": "f2ba45d095489b902e9c85c8dc75388c03e1d678346680e202065ca8676972be",
-      "size": 5437
+      "sha256": "ac531a1cbe78e235f2c2d782dce55885adb321bba101405ed695166942275bb2",
+      "size": 5435
     },
     {
       "url": "https://support.claude.com/en/articles/16607668-understanding-your-team-plan-invoices",
@@ -10656,8 +10656,8 @@
       "url": "https://support.claude.com/en/articles/16764810-assign-a-program-to-workspaces-in-claude-console",
       "status": "success",
       "path": "support/16764810-assign-a-program-to-workspaces-in-claude-console.md",
-      "sha256": "6bca88eb9bbea044fc42b45566ecd54847034f08f09ea8c5ec46a0bae8092d91",
-      "size": 5099
+      "sha256": "1794b5fc65ebb95fc1e6ba35a54a9cd6f4282823f1316ce7cd1eb1ed37385f77",
+      "size": 5107
     },
     {
       "url": "https://support.claude.com/en/articles/16824617-turn-on-data-retention-for-a-workspace-in-a-zero-data-retention-organization",
@@ -10670,8 +10670,8 @@
       "url": "https://support.claude.com/en/articles/16893491-get-started-with-smart-reports",
       "status": "success",
       "path": "support/16893491-get-started-with-smart-reports.md",
-      "sha256": "bd505d6f8299fda7b39bca7a47f75fcee591fae4f85e7cb5a6900ac586b7d5e0",
-      "size": 14110
+      "sha256": "f52935f6b4ec7e783fcbe87d5b316575c090eae658287a891ee96b4430d42631",
+      "size": 14114
     },
     {
       "url": "https://support.claude.com/en/articles/16923645-get-started-with-claude-docs",
@@ -10701,26 +10701,33 @@
       "sha256": "7956afb76c5f40ad66939492b066be447d92a35034a35ca048b14afb2b46a33a",
       "size": 2812
     },
+    {
+      "url": "https://support.claude.com/en/articles/16989529-invite-people-outside-your-organization-to-an-artifact",
+      "status": "success",
+      "path": "support/16989529-invite-people-outside-your-organization-to-an-artifact.md",
+      "sha256": "8efb13b417cbc692daf3440f5cc5cd96d82e659480815b38d953088bf2de9a1e",
+      "size": 7430
+    },
     {
       "url": "https://claude.com/docs/claude-science/admin-controls",
       "status": "success",
       "path": "claude/claude-science/admin-controls.md",
-      "sha256": "1deeeed1b46c27a0f140a78b84613ca84008ad24471009fa63d9ce52e1668a58",
-      "size": 60406
+      "sha256": "06ed167b61f6cd8448f8f85f8f4d4885be60fb8448ad6162734059261b1a1d65",
+      "size": 60438
     },
     {
       "url": "https://claude.com/docs/claude-science/artifacts",
       "status": "success",
       "path": "claude/claude-science/artifacts.md",
-      "sha256": "35f7d26d1115d1fee394600474e3f71045ad3e959344d46bd62bf3ffc7a9df93",
-      "size": 2914
+      "sha256": "c4a28213dc7e961ab55db2390122edd01a5125b57fd518bc65eff1e2eacfd805",
+      "size": 2945
     },
     {
       "url": "https://claude.com/docs/claude-science/changelog",
       "status": "success",
       "path": "claude/claude-science/changelog.md",
-      "sha256": "c77b98aa131717924043047d95097db69ce3aeb542c4bc7da41b1e014a45f4fe",
-      "size": 12174
+      "sha256": "40150519f2ad3b35bc1cfa2b95f774f5e543978b24c0063f68bbd6a51987242f",
+      "size": 13112
     },
     {
       "url": "https://claude.com/docs/claude-science/cloud-storage",
@@ -10796,8 +10803,8 @@
       "url": "https://claude.com/docs/claude-science/get-started",
       "status": "success",
       "path": "claude/claude-science/get-started.md",
-      "sha256": "23a6c45b184e464881bfc248d16bc05e9f110d2eae3a4db3ae3421568a51689e",
-      "size": 11382
+      "sha256": "56509a0a36760c3129be6c3d0fd8fe0253c4b0e9406b45ef0b75ea2771ea6502",
+      "size": 11414
     },
     {
       "url": "https://claude.com/docs/claude-science/glossary",
@@ -10845,8 +10852,8 @@
       "url": "https://claude.com/docs/claude-science/multiple-computers",
       "status": "success",
       "path": "claude/claude-science/multiple-computers.md",
-      "sha256": "1d9d8f07cd5c546142a16ca949ddd4cb4b5875eba1f3d06041dd74bf0c84aa0b",
-      "size": 4068
+      "sha256": "f1083d87bf232e7734b87303be52fc436679df85ad2c2d454dced0fd04312152",
+      "size": 4145
     },
     {
       "url": "https://claude.com/docs/claude-science/network-requirements",
@@ -11685,8 +11692,8 @@
       "url": "https://claude.com/docs/cowork/changelog",
       "status": "success",
       "path": "claude/cowork/changelog.md",
-      "sha256": "41f057e52e1c84a008fb9caa27f7d8ac270760ebf44940dea43429dcf4198482",
-      "size": 155342
+      "sha256": "7f4b6ace4532ee57dafeab5abbf0a1ba0f431ba3deb5542265d6efd652b9769e",
+      "size": 155328
     },
     {
       "url": "https://claude.com/docs/cowork/guide/dispatch",
@@ -11755,8 +11762,8 @@
       "url": "https://claude.com/docs/government/changelog",
       "status": "success",
       "path": "claude/government/changelog.md",
-      "sha256": "7723c08ba21574a90359e242c1f11aac7a5a5c6d4ee816ad34265b59dbed89c6",
-      "size": 9020
+      "sha256": "57156a27e4f83df07725dcd1d6afc2788edc61dab0b6e3bc60d374867085aca9",
+      "size": 10600
     },
     {
       "url": "https://claude.com/docs/government/config/overview",
@@ -12119,8 +12126,8 @@
       "url": "https://claude.com/docs/third-party/claude-desktop/admin-console",
       "status": "success",
       "path": "claude/third-party/claude-desktop/admin-console.md",
-      "sha256": "751d9b96b5579dd44632f2367614f423a27f7353bc71d47e0bd2be1bfcbfef50",
-      "size": 64208
+      "sha256": "153b1ad87e2eb4023eb692dd305df445b2253281796f46247166242994f673c6",
+      "size": 63826
     },
     {
       "url": "https://claude.com/docs/third-party/claude-desktop/bedrock",
@@ -12140,8 +12147,8 @@
       "url": "https://claude.com/docs/third-party/claude-desktop/browser",
       "status": "success",
       "path": "claude/third-party/claude-desktop/browser.md",
-      "sha256": "4e7223f587b5ce85994cfb559cb27f6be442c9d299c88468248c1493b5224256",
-      "size": 10345
+      "sha256": "e3d10bd35e8b02b82a136ef7cb7bf382422c8660a5c40146e025894e2f0ca5bc",
+      "size": 10368
     },
     {
       "url": "https://claude.com/docs/third-party/claude-desktop/built-in-connectors",
@@ -12301,8 +12308,8 @@
       "url": "https://claude.com/docs/third-party/claude-desktop/local-access",
       "status": "success",
       "path": "claude/third-party/claude-desktop/local-access.md",
-      "sha256": "fbfd7494f9c906c4075db938590336f9d62d5e816187e7a85d25252cf8c26322",
-      "size": 7643
+      "sha256": "90ed98efcb2392fabe55d467f8fbb04bb32f52edff06cbe54c7c3bf823e8b5b2",
+      "size": 7957
     },
     {
       "url": "https://claude.com/docs/third-party/claude-desktop/mantle",
@@ -12322,7 +12329,7 @@
       "url": "https://claude.com/docs/third-party/claude-desktop/mdm",
       "status": "success",
       "path": "claude/third-party/claude-desktop/mdm.md",
-      "sha256": "d8d2219cd8ac4b26bfba49cbd7ae9368e76fb234137f2fe1e040c64a50c9375a",
+      "sha256": "ea6e41e9b18e4dc7d3efe62a0887a76c2781b09fed0066385b083d802bf170c1",
       "size": 17198
     },
     {
@@ -12378,8 +12385,8 @@
       "url": "https://code.claude.com/docs/en/desktop-changelog",
       "status": "success",
       "path": "en/docs/claude-code/desktop-changelog.md",
-      "sha256": "bfc2f76c8b2b58d3ad2f02610373670d670439b059e9e2409d0d2532c6d5d8bd",
-      "size": 103453
+      "sha256": "622a094b23496a6dafc308b0ce9e466e96423bd3f5707faff25183313a75ef40",
+      "size": 103817
     },
     {
       "url": "https://code.claude.com/docs/en/slash-commands",
@@ -12392,8 +12399,8 @@
       "url": "https://code.claude.com/docs/en/web-scheduled-tasks",
       "status": "success",
       "path": "en/docs/claude-code/web-scheduled-tasks.md",
-      "sha256": "d76aa5af0d53c71ec2496c591db62a2774baf98e4455e5876adc328eaf1e5d2d",
-      "size": 33670
+      "sha256": "a893163ca0f7d804962a6b304a30944fa95c84f781c7d61b59b38de2d3b51fc0",
+      "size": 35382
     },
     {
       "url": "https://code.claude.com/docs/en/ultraplan",
@@ -12434,8 +12441,8 @@
       "url": "https://platform.claude.com/docs/en/api/java/beta",
       "status": "success",
       "path": "en/api/java/beta.md",
-      "sha256": "96079b1673582b539b33008c9c787a4540223d865b6c7d29f9807ccce5720e3c",
-      "size": 2421710
+      "sha256": "04dd4cd3f3be8cdcf53898bb29522a24593ed16c1a2b53cb9df5519bd09dbaca",
+      "size": 2421692
     },
     {
       "url": "https://platform.claude.com/docs/en/api/java/models",
@@ -12462,8 +12469,8 @@
       "url": "https://platform.claude.com/docs/en/api/go/beta",
       "status": "success",
       "path": "en/api/go/beta.md",
-      "sha256": "65db7c78d3ccd8e39e5da39a8f6bfab06bd69f454793621d08896a3d69b8caa8",
-      "size": 2861231
+      "sha256": "ef5c84caf507a1f41fbdeec0cffac47962de8cce16c6c4e0a2ed7204b2d7700f",
+      "size": 2861213
     },
     {
       "url": "https://platform.claude.com/docs/en/api/go/models",
@@ -12490,8 +12497,8 @@
       "url": "https://platform.claude.com/docs/en/api/csharp/beta",
       "status": "success",
       "path": "en/api/csharp/beta.md",
-      "sha256": "4e443bbe4305a9608ccec850f74536edb3a2769a7283d0728b7ac5f9c1c0a0be",
-      "size": 2418757
+      "sha256": "006a5d3b7bbe5a6199ca9ce5268fa45ce24890b8ccb70c2ff6c9839bdad11990",
+      "size": 2418739
     },
     {
       "url": "https://platform.claude.com/docs/en/api/csharp/models",
@@ -12518,8 +12525,8 @@
       "url": "https://platform.claude.com/docs/en/api/typescript/beta",
       "status": "success",
       "path": "en/api/typescript/beta.md",
-      "sha256": "740bb7dfa5e78bc0e1fa7331a9dd39df2aeaa77256335c685a3924b3ea68f5bf",
-      "size": 2373543
+      "sha256": "7f782aae74103b65437557c468dc0545ad446f8179d0e46043da538eefdeefe7",
+      "size": 2373525
     },
     {
       "url": "https://platform.claude.com/docs/en/api/typescript/models",
@@ -12546,8 +12553,8 @@
       "url": "https://platform.claude.com/docs/en/api/ruby/beta",
       "status": "success",
       "path": "en/api/ruby/beta.md",
-      "sha256": "a39325514dbd27eba6bd58b52e5a8319e2c3ffd016c0619d48ad104f438d21a3",
-      "size": 2218426
+      "sha256": "e456e19c2d0020f3cbe782fd596ffaee98308f1ac6c9b78d69e5143d03d8878a",
+      "size": 2218408
     },
     {
       "url": "https://platform.claude.com/docs/en/api/ruby/models",
@@ -12602,8 +12609,8 @@
       "url": "https://platform.claude.com/docs/en/api/python/beta",
       "status": "success",
       "path": "en/api/python/beta.md",
-      "sha256": "24459fb5ac974ee28dec22c18780b693674a4d6490f3a18707912107a864d4d4",
-      "size": 2278827
+      "sha256": "5db9c63d612c43021ddb28a4374dafa79c9fcd835c82b26c945be94498582948",
+      "size": 2278809
     },
     {
       "url": "https://platform.claude.com/docs/en/api/python/models",
@@ -13743,8 +13750,8 @@
       "url": "https://platform.claude.com/docs/en/api/python/beta/messages",
       "status": "success",
       "path": "en/api/python/beta/messages.md",
-      "sha256": "987f4ac45d0fbfae7128cef3615fa35a1fb086b4f5799135305df812304afd41",
-      "size": 1428427
+      "sha256": "2ecb31a27a59d77b6a00908bf0138e718929d5ef9fef484564ea4d3072cbe2b7",
+      "size": 1428388
     },
     {
       "url": "https://platform.claude.com/docs/en/api/python/beta/tunnels",
@@ -14191,22 +14198,22 @@
       "url": "https://platform.claude.com/docs/en/api/python/beta/messages/create",
       "status": "success",
       "path": "en/api/python/beta/messages/create.md",
-      "sha256": "63b5f3833b40dea51a23dfe5a98342c0ca869ca7694e168f4643423fcacbfe51",
-      "size": 199212
+      "sha256": "ab99d94ce8d1fb9389554392827981a594c1ba9a2d17efb5b1a6bfd26ec26e0d",
+      "size": 199206
     },
     {
       "url": "https://platform.claude.com/docs/en/api/python/beta/messages/batches",
       "status": "success",
       "path": "en/api/python/beta/messages/batches.md",
-      "sha256": "d330303f472a30727e2d63ebdabc67483551cda375932433b4c0382f7bb805fb",
-      "size": 427297
+      "sha256": "cc9673eb03d2cf347e65a4b69c8686f1bbd68c77e2007291f4ed7f2a879bca93",
+      "size": 427291
     },
     {
       "url": "https://platform.claude.com/docs/en/api/python/beta/messages/count_tokens",
       "status": "success",
       "path": "en/api/python/beta/messages/count_tokens.md",
-      "sha256": "9fdc04a2ebe901dc7c5f84220f59aa39bb814b28ddd734f37b4f3cd3c93b51de",
-      "size": 122905
+      "sha256": "df24f2a15770d266b451e53de193dcb16f6ca307d561193fd1f8e7d8c24e6db4",
+      "size": 122899
     },
     {
       "url": "https://platform.claude.com/docs/en/api/python/beta/deployment_runs/list",
@@ -14548,8 +14555,8 @@
       "url": "https://platform.claude.com/docs/en/api/python/beta/messages/batches/create",
       "status": "success",
       "path": "en/api/python/beta/messages/batches/create.md",
-      "sha256": "af72fa40c4e42c5ce76d6cedb0efb4ebf2abdb1bff2c150c50079495c75c84e1",
-      "size": 142875
+      "sha256": "a191ca48cec2aae3fe645cc172aa5e49643b26156926fff75b4f96d826a2d6c2",
+      "size": 142869
     },
     {
       "url": "https://platform.claude.com/docs/en/api/python/beta/messages/batches/results",
@@ -14814,8 +14821,8 @@
       "url": "https://platform.claude.com/docs/en/api/cli/beta/messages",
       "status": "success",
       "path": "en/api/cli/beta/messages.md",
-      "sha256": "eeba94fb26abd7c6cc424b0b6b7f354a29978fa6eec1dc58cb81f73a88b6c891",
-      "size": 1116046
+      "sha256": "7e7ffbf94295707e66a00e198f1ab1ae25735c9694525e0d2188abaa55271313",
+      "size": 1116025
     },
     {
       "url": "https://platform.claude.com/docs/en/api/cli/beta/tunnels",
@@ -15885,8 +15892,8 @@
       "url": "https://platform.claude.com/docs/en/api/ruby/beta/messages",
       "status": "success",
       "path": "en/api/ruby/beta/messages.md",
-      "sha256": "8a6ee57cf1fdf60b236811fde538719401a6ce9deb139598dc52947b6a4b7a1b",
-      "size": 1314585
+      "sha256": "84a924cc0005f143a8ced2ecd94ec5249d7023a90488ee955fe5af642e20f37a",
+      "size": 1314546
     },
     {
       "url": "https://platform.claude.com/docs/en/api/ruby/beta/tunnels",
@@ -16333,22 +16340,22 @@
       "url": "https://platform.claude.com/docs/en/api/ruby/beta/messages/create",
       "status": "success",
       "path": "en/api/ruby/beta/messages/create.md",
-      "sha256": "6083080110df0e373bf42ab23785b35f848229790c330278e8c6f1cd31f08bc9",
-      "size": 187945
+      "sha256": "d2c719527ba777f28c8b1ed5c0cced55e0bc7f6c5d581516660f15de880b7904",
+      "size": 187939
     },
     {
       "url": "https://platform.claude.com/docs/en/api/ruby/beta/messages/batches",
       "status": "success",
       "path": "en/api/ruby/beta/messages/batches.md",
-      "sha256": "baed10e5493ed91882250446de0e72f63c4f57c37f6e75c75fd46f85643615e6",
-      "size": 389407
+      "sha256": "94b0244893957bda3deb4eaf87ffe81258e5f74a3c5932fb7c3682b0ab20901b",
+      "size": 389401
     },
     {
       "url": "https://platform.claude.com/docs/en/api/ruby/beta/messages/count_tokens",
       "status": "success",
       "path": "en/api/ruby/beta/messages/count_tokens.md",
-      "sha256": "6feed5d184071166775a17e4ee02d750f43ed30f94e81f1c61a23509f081f790",
-      "size": 117321
+      "sha256": "1e7fac71ede8943f75cdd9e05204333e6dccb08a2b86beab257dac92562b3c40",
+      "size": 117315
     },
     {
       "url": "https://platform.claude.com/docs/en/api/ruby/beta/deployment_runs/list",
@@ -16690,8 +16697,8 @@
       "url": "https://platform.claude.com/docs/en/api/ruby/beta/messages/batches/create",
       "status": "success",
       "path": "en/api/ruby/beta/messages/batches/create.md",
-      "sha256": "535c69a592c806ee870c349dc7b4a3093c1cf3ab87bbf68cdfffe22a941ac9c0",
-      "size": 138434
+      "sha256": "4267478862daf9e3f0554499fa4b5abe5f35ab677bc66ece0dca7c387287f52d",
+      "size": 138428
     },
     {
       "url": "https://platform.claude.com/docs/en/api/ruby/beta/messages/batches/results",
@@ -16956,8 +16963,8 @@
       "url": "https://platform.claude.com/docs/en/api/typescript/beta/messages",
       "status": "success",
       "path": "en/api/typescript/beta/messages.md",
-      "sha256": "2df732c4d0e6c3ffa8d51199a58eab82028bc7ee06bc23fd315610b678b12caa",
-      "size": 1410738
+      "sha256": "bd831ca6f93f2c607699aac5be199527f75927ee186d20bc1fbf1d6bf477b29b",
+      "size": 1410699
     },
     {
       "url": "https://platform.claude.com/docs/en/api/typescript/beta/tunnels",
@@ -17404,22 +17411,22 @@
       "url": "https://platform.claude.com/docs/en/api/typescript/beta/messages/create",
       "status": "success",
       "path": "en/api/typescript/beta/messages/create.md",
-      "sha256": "9b3fb55ba36027a1e32049e3f7370e894b0532dde8cdb1520cebcc4d579f8d57",
-      "size": 207917
+      "sha256": "d11490c7272982dbbffeb68c56b3297905ace41bc1eabaf60b20b9d0192734fa",
+      "size": 207911
     },
     {
       "url": "https://platform.claude.com/docs/en/api/typescript/beta/messages/batches",
       "status": "success",
       "path": "en/api/typescript/beta/messages/batches.md",
-      "sha256": "054a13c309765efc907105adf49d93cbfb69f35d6409b2cb890008a040c7483c",
-      "size": 428601
+      "sha256": "b65fe9209212356f63ccd2c58686a529603271d6ffd791b2cff7754cbc876b8e",
+      "size": 428595
     },
     {
       "url": "https://platform.claude.com/docs/en/api/typescript/beta/messages/count_tokens",
       "status": "success",
       "path": "en/api/typescript/beta/messages/count_tokens.md",
-      "sha256": "66b1f202a38674fa64c3dacb86a26fe8a0d626540d6d03e4b06f76df383cab35",
-      "size": 125667
+      "sha256": "a6be4f77da4b7586a76052951c1858160332945dd38364a6688d27a519d6a359",
+      "size": 125661
     },
     {
       "url": "https://platform.claude.com/docs/en/api/typescript/beta/deployment_runs/list",
@@ -17761,8 +17768,8 @@
       "url": "https://platform.claude.com/docs/en/api/typescript/beta/messages/batches/create",
       "status": "success",
       "path": "en/api/typescript/beta/messages/batches/create.md",
-      "sha256": "5f74dba9f30765c49608ae568cd025573acf958dc11a1140215cad2f07b6b04b",
-      "size": 147183
+      "sha256": "6eb550efe66cf4443d32622a5efad21ed2b6e7bbab774f3df38562b4e1b5d0fe",
+      "size": 147177
     },
     {
       "url": "https://platform.claude.com/docs/en/api/typescript/beta/messages/batches/results",
@@ -18027,8 +18034,8 @@
       "url": "https://platform.claude.com/docs/en/api/csharp/beta/messages",
       "status": "success",
       "path": "en/api/csharp/beta/messages.md",
-      "sha256": "ff73717f866cc0a3cd6ed5ced83fb518471d12fc5146612b632c3783a0a13041",
-      "size": 1364941
+      "sha256": "09dc1a9be7828546971f37d613665e24fcdc93afb389ae4278c260dfa49aa38d",
+      "size": 1364902
     },
     {
       "url": "https://platform.claude.com/docs/en/api/csharp/beta/tunnels",
@@ -18475,22 +18482,22 @@
       "url": "https://platform.claude.com/docs/en/api/csharp/beta/messages/create",
       "status": "success",
       "path": "en/api/csharp/beta/messages/create.md",
-      "sha256": "ecf139e8c384e5b58bca77ee6c7c343acabe2259ec25e3a93a8c9e8c2612a67c",
-      "size": 190593
+      "sha256": "ebc0e049834b80044e15b57eac7f7c583abdcab4a07967535d83856b50b39aa5",
+      "size": 190587
     },
     {
       "url": "https://platform.claude.com/docs/en/api/csharp/beta/messages/batches",
       "status": "success",
       "path": "en/api/csharp/beta/messages/batches.md",
-      "sha256": "38daafbb242ea03b2473e7aa4225b01f5f3c1e4f2bbd6e5807cb8bdfb43d329b",
-      "size": 422674
+      "sha256": "264ce310c092482ab7d3247c9191a2ffd13f7f9e813c5b697d3ca3a7ca45aad1",
+      "size": 422668
     },
     {
       "url": "https://platform.claude.com/docs/en/api/csharp/beta/messages/count_tokens",
       "status": "success",
       "path": "en/api/csharp/beta/messages/count_tokens.md",
-      "sha256": "ad93b8d8733e08775aa7179a0893fd7a8aece8138ae2ade970dc805fb616d655",
-      "size": 118051
+      "sha256": "c87b89b741fd8db502bcabe9f2bc1a4dd02246385089f73150060bfffc4e0181",
+      "size": 118045
     },
     {
       "url": "https://platform.claude.com/docs/en/api/csharp/beta/deployment_runs/list",
@@ -18832,8 +18839,8 @@
       "url": "https://platform.claude.com/docs/en/api/csharp/beta/messages/batches/create",
       "status": "success",
       "path": "en/api/csharp/beta/messages/batches/create.md",
-      "sha256": "c2378691986f84d993d45e1acb50d21ef561f375c649d32f7595351744d460d6",
-      "size": 153129
+      "sha256": "cda69a655988ae39d242c08bf29098e7190a4ef07929c247ca1a2142e2199d52",
+      "size": 153123
     },
     {
       "url": "https://platform.claude.com/docs/en/api/csharp/beta/messages/batches/results",
@@ -19098,8 +19105,8 @@
       "url": "https://platform.claude.com/docs/en/api/go/beta/messages",
       "status": "success",
       "path": "en/api/go/beta/messages.md",
-      "sha256": "68915ee9861b81bd9729feb724820c7eef6f50ed64876eed7bbb342fc507adb2",
-      "size": 1561920
+      "sha256": "489f947589e768f31b7020f964e54d75427269c2210cd445cf4c103d52c80422",
+      "size": 1561881
     },
     {
       "url": "https://platform.claude.com/docs/en/api/go/beta/tunnels",
@@ -19546,22 +19553,22 @@
       "url": "https://platform.claude.com/docs/en/api/go/beta/messages/create",
       "status": "success",
       "path": "en/api/go/beta/messages/create.md",
-      "sha256": "503fece798141b204004cd1289527456ed4f2beeb8c47ae82f711d6e035fc002",
-      "size": 216134
+      "sha256": "9a4e937ad67e8332719ea2470b19001ddfdae27c8b6b682f90b83da321b80eb9",
+      "size": 216128
     },
     {
       "url": "https://platform.claude.com/docs/en/api/go/beta/messages/batches",
       "status": "success",
       "path": "en/api/go/beta/messages/batches.md",
-      "sha256": "d7baedcf0b6a83b0554a1fec3a1f263b344438d40da8ef7216129219dead08ce",
-      "size": 482481
+      "sha256": "0cd87979bec233d45620ce3b77b594330c0abd3256a63fd207f2ee2572d56577",
+      "size": 482475
     },
     {
       "url": "https://platform.claude.com/docs/en/api/go/beta/messages/count_tokens",
       "status": "success",
       "path": "en/api/go/beta/messages/count_tokens.md",
-      "sha256": "74cf7c4cb366fa312e1aa351823d7670c909785ebf67972b05865c76bc065a12",
-      "size": 135645
+      "sha256": "68da3dcee598f766064e84c907a81d67458a5c5b4e32632ec7a02969db707521",
+      "size": 135639
     },
     {
       "url": "https://platform.claude.com/docs/en/api/go/beta/deployment_runs/list",
@@ -19903,8 +19910,8 @@
       "url": "https://platform.claude.com/docs/en/api/go/beta/messages/batches/create",
       "status": "success",
       "path": "en/api/go/beta/messages/batches/create.md",
-      "sha256": "f1179b8dd9b97ee1f5bef4bed38189ea41d7a6dd50fe2fa611fd7060558bd9c9",
-      "size": 166049
+      "sha256": "ec79c921163af5ffae7e2d4d644084e91fb812481155ea1be5539e4fea5dd325",
+      "size": 166043
     },
     {
       "url": "https://platform.claude.com/docs/en/api/go/beta/messages/batches/results",
@@ -20169,8 +20176,8 @@
       "url": "https://platform.claude.com/docs/en/api/java/beta/messages",
       "status": "success",
       "path": "en/api/java/beta/messages.md",
-      "sha256": "b772ceeb8a00030d5c7df7ee62bc740fb17e229fdb0a2b93851385d8637b6d6e",
-      "size": 1354064
+      "sha256": "147dfd18fc74a5dbe3ba454a5abc41f45cfeaa6142f49425af52adf2e52817f8",
+      "size": 1354025
     },
     {
       "url": "https://platform.claude.com/docs/en/api/java/beta/tunnels",
@@ -20617,22 +20624,22 @@
       "url": "https://platform.claude.com/docs/en/api/java/beta/messages/create",
       "status": "success",
       "path": "en/api/java/beta/messages/create.md",
-      "sha256": "cd7f3bd908bc9f654183206ffae09ecb217fccdd2b3e357d73fb4dbd4e04fe7e",
-      "size": 190704
+      "sha256": "b6c2bcfdc858e7392514e3644a41ccdabc6123faed9edac1323ac29b8a448da7",
+      "size": 190698
     },
     {
       "url": "https://platform.claude.com/docs/en/api/java/beta/messages/batches",
       "status": "success",
       "path": "en/api/java/beta/messages/batches.md",
-      "sha256": "7665a64b748cbb424c66232dd9cb7b485f02a899f31f43b76603b0df1b93afd6",
-      "size": 412511
+      "sha256": "8173aedf91171376870f25683b519548c07ed5f58002c679c88a91c9b7c80cb0",
+      "size": 412505
     },
     {
       "url": "https://platform.claude.com/docs/en/api/java/beta/messages/count_tokens",
       "status": "success",
       "path": "en/api/java/beta/messages/count_tokens.md",
-      "sha256": "e823486e0f0ba89bef866977b262e850dac68195000d171310e63e3777413280",
-      "size": 119846
+      "sha256": "7028776a111b194deeb9c65c34e325ce054ed66a581ca67114e0045a3c93a5e1",
+      "size": 119840
     },
     {
       "url": "https://platform.claude.com/docs/en/api/java/beta/deployment_runs/list",
@@ -20974,8 +20981,8 @@
       "url": "https://platform.claude.com/docs/en/api/java/beta/messages/batches/create",
       "status": "success",
       "path": "en/api/java/beta/messages/batches/create.md",
-      "sha256": "d3c56e184c0d4104239e3535313d97f85e54d446e712931f6968127b3bd3a99e",
-      "size": 148954
+      "sha256": "8376eb727c83e941b2f035c283bb27660267027e2407108bb251ffb8890f8de4",
+      "size": 148948
     },
     {
       "url": "https://platform.claude.com/docs/en/api/java/beta/messages/batches/results",
@@ -22062,6 +22069,13 @@
       "sha256": "d47af79826c1c84ec7e6be4ea6762e3c2dd5b278c688b8c7529abd1985013955",
       "size": 37001
     },
+    {
+      "url": "https://raw.githubusercontent.com/anthropics/claude-cookbooks/main/misc/admin_api.ipynb",
+      "status": "success",
+      "path": "github/claude-cookbooks/misc/admin_api.ipynb",
+      "sha256": "811d86c13d33c00c8ccdf438503407777e83fd0b3a8141bc8e84bdbf4f828a54",
+      "size": 30006
+    },
     {
       "url": "https://raw.githubusercontent.com/anthropics/claude-cookbooks/main/misc/batch_processing.ipynb",
       "status": "success",
@@ -23361,8 +23375,8 @@
       "url": "https://raw.githubusercontent.com/anthropics/claude-plugins-official/main/.claude-plugin/marketplace.json",
       "status": "success",
       "path": "github/claude-plugins-official/.claude-plugin/marketplace.json",
-      "sha256": "74378cf575a218858e5c14542dd42f5dccf1516eb75c79b6f2d458c222b93671",
-      "size": 184357
+      "sha256": "5b62acfe976404b7479884ddd35cda088b94a3b7ebc1948a1fd593fa21cb668a",
+      "size": 185864
     },
     {
       "url": "https://raw.githubusercontent.com/anthropics/claude-plugins-official/main/.github/bump-tracking.json",
@@ -26028,8 +26042,8 @@
       "url": "https://raw.githubusercontent.com/anthropics/claude-quickstarts/main/README.md",
       "status": "success",
       "path": "github/claude-quickstarts/README.md",
-      "sha256": "bcb8f5071ca1b4e739c8eb1028ba8981e040791779a7d9df63ada1926f9e4f98",
-      "size": 6739
+      "sha256": "d8e370c472227cb0fe99cdc714bf81d69291ccfa9ac9c9cf2c7d6e00a0a4a2b2",
+      "size": 8516
     },
     {
       "url": "https://raw.githubusercontent.com/anthropics/claude-quickstarts/main/agents/README.md",
@@ -26133,8 +26147,8 @@
       "url": "https://raw.githubusercontent.com/anthropics/claude-quickstarts/main/managed-agents/README.md",
       "status": "success",
       "path": "github/claude-quickstarts/managed-agents/README.md",
-      "sha256": "cdfaac934d4a4ca72067be9f3da4ed8567053c92c171f1b3f92eb16e18076d9b",
-      "size": 4013
+      "sha256": "652da57b8fabf1e9925a84d0da31c4cd1ed3ab998f819785d9a8863f5c9a7758",
+      "size": 5625
     },
     {
       "url": "https://raw.githubusercontent.com/anthropics/claude-quickstarts/main/managed-agents/assistant-ui/CLAUDE.md",
@@ -26234,6 +26248,69 @@
       "sha256": "1ba56fcc1e2b3503e21fc54eea7615729ffa7e0d0096363a13ab8c6c97dcb03d",
       "size": 3986
     },
+    {
+      "url": "https://raw.githubusercontent.com/anthropics/claude-quickstarts/main/managed-agents/linear/CLAUDE.md",
+      "status": "success",
+      "path": "github/claude-quickstarts/managed-agents/linear/CLAUDE.md",
+      "sha256": "c045d7859ce73ab5a329f30d9d1e92da35fa38de61cf3e57b15862a08c37ab85",
+      "size": 2546
+    },
+    {
+      "url": "https://raw.githubusercontent.com/anthropics/claude-quickstarts/main/managed-agents/linear/README.md",
+      "status": "success",
+      "path": "github/claude-quickstarts/managed-agents/linear/README.md",
+      "sha256": "2d37e0cea927b4868fea93b847c3409ad48110286745935ac8310dad6dd70ad5",
+      "size": 2989
+    },
+    {
+      "url": "https://raw.githubusercontent.com/anthropics/claude-quickstarts/main/managed-agents/linear/skill.md",
+      "status": "success",
+      "path": "github/claude-quickstarts/managed-agents/linear/skill.md",
+      "sha256": "2cd07930612e7bd4994456d32f60cb8c1f54e92dd4e54a1f24ca855108ac0791",
+      "size": 14655
+    },
+    {
+      "url": "https://raw.githubusercontent.com/anthropics/claude-quickstarts/main/managed-agents/mcp-server-typescript/CLAUDE.md",
+      "status": "success",
+      "path": "github/claude-quickstarts/managed-agents/mcp-server-typescript/CLAUDE.md",
+      "sha256": "ae5ee1acc0ca42e192ca44e9b4a89a5d01c7893a481e9912ebccb0115220ec1b",
+      "size": 1750
+    },
+    {
+      "url": "https://raw.githubusercontent.com/anthropics/claude-quickstarts/main/managed-agents/mcp-server-typescript/README.md",
+      "status": "success",
+      "path": "github/claude-quickstarts/managed-agents/mcp-server-typescript/README.md",
+      "sha256": "dd84c79efdb83e24125fb8d5e3a1ebe5bd1176b6bd2be4c1dba9e0b24580e235",
+      "size": 4965
+    },
+    {
+      "url": "https://raw.githubusercontent.com/anthropics/claude-quickstarts/main/managed-agents/mcp-server-typescript/skill.md",
+      "status": "success",
+      "path": "github/claude-quickstarts/managed-agents/mcp-server-typescript/skill.md",
+      "sha256": "f72bee2abdaf6f84a7b0f5ccec3799fa1614e27112f8e91c7d530d4f6e823e41",
+      "size": 12816
+    },
+    {
+      "url": "https://raw.githubusercontent.com/anthropics/claude-quickstarts/main/managed-agents/roadtrip-planner/CLAUDE.md",
+      "status": "success",
+      "path": "github/claude-quickstarts/managed-agents/roadtrip-planner/CLAUDE.md",
+      "sha256": "918edaa0467819a968e95886f94961662a6db91d5dfeb2763a1f42c0f03f50f8",
+      "size": 4370
+    },
+    {
+      "url": "https://raw.githubusercontent.com/anthropics/claude-quickstarts/main/managed-agents/roadtrip-planner/README.md",
+      "status": "success",
+      "path": "github/claude-quickstarts/managed-agents/roadtrip-planner/README.md",
+      "sha256": "ee318e6c907ce7775fd5877d5e080002866d9435eadbd19d3d1cbb0390c51580",
+      "size": 17613
+    },
+    {
+      "url": "https://raw.githubusercontent.com/anthropics/claude-quickstarts/main/managed-agents/roadtrip-planner/skill.md",
+      "status": "success",
+      "path": "github/claude-quickstarts/managed-agents/roadtrip-planner/skill.md",
+      "sha256": "b2bdde9e87f518410eebe112af8c3986170d71ae49cf2f980cf51c0477866de0",
+      "size": 8470
+    },
     {
       "url": "https://raw.githubusercontent.com/anthropics/claude-quickstarts/main/managed-agents/self-hosted-sandboxes/CLAUDE.md",
       "status": "success",
@@ -26301,8 +26378,8 @@
       "url": "https://raw.githubusercontent.com/anthropics/claude-quickstarts/main/managed-agents/slack/skill.md",
       "status": "success",
       "path": "github/claude-quickstarts/managed-agents/slack/skill.md",
-      "sha256": "433de65f739490d049932bdce54d05c416a4ab0a2cf3a89e54d41b6420b01822",
-      "size": 10641
+      "sha256": "12cc9b69dc48c2698610ba77e53998229dece2c3cb4e1e9fa3831682c7bbfe4c",
+      "size": 12190
     },
     {
       "url": "https://raw.githubusercontent.com/anthropics/claude-code-action/main/.claude/agents/code-quality-reviewer.md",
@@ -26910,8 +26987,8 @@
       "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-python/main/CHANGELOG.md",
       "status": "success",
       "path": "github/anthropic-sdk-python/CHANGELOG.md",
-      "sha256": "ce25b202ed3c8c8e012464ec7eaa06c7c55598e8e52bdf81fe28fee00176058f",
-      "size": 246567
+      "sha256": "5d7a4086d4f054b43e5f66113143fe54502006d9e5a1ca716ad86f21763f0e14",
+      "size": 249526
     },
     {
       "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-python/main/CONTRIBUTING.md",
@@ -26945,8 +27022,8 @@
       "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-python/main/api.md",
       "status": "success",
       "path": "github/anthropic-sdk-python/api.md",
-      "sha256": "6dd7f98696867be4b7282ba493dab7190c9007dd3cc2dae300d797a60731e240",
-      "size": 110286
+      "sha256": "7d56519d194185a5c49d0d141fc40098b2fa640f7d6ddd1fa161c1bd3320956d",
+      "size": 110542
     },
     {
       "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-python/main/examples/greeting-SKILL.md",
@@ -26987,15 +27064,15 @@
       "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-python/main/tools.md",
       "status": "success",
       "path": "github/anthropic-sdk-python/tools.md",
-      "sha256": "9afb94b4bc43d47d9b44e66ab8f13dc032b125fe2f41847e325145a0f57a64c4",
-      "size": 3474
+      "sha256": "b57e8b185f9f3e3fbc5efbc959e9e67e6c670da5347ea942e8a816453198280b",
+      "size": 6407
     },
     {
       "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-typescript/main/CHANGELOG.md",
       "status": "success",
       "path": "github/anthropic-sdk-typescript/CHANGELOG.md",
-      "sha256": "747e8d8a0d97bb9d0ca6e739a8ddf13e2efe3d0e57723f292032244eed3558d2",
-      "size": 222683
+      "sha256": "6f837f68f33971db80413e1c33973a45b90090badd8dd34ecd6cfa455bdde0f6",
+      "size": 226903
     },
     {
       "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-typescript/main/CLAUDE.md",
@@ -27036,8 +27113,8 @@
       "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-typescript/main/api.md",
       "status": "success",
       "path": "github/anthropic-sdk-typescript/api.md",
-      "sha256": "70faba63c3adfc883fab82cd5d7895e9e7d6e38be59bef91dc3d544a89887193",
-      "size": 152382
+      "sha256": "3758abfec2e92882ab413bb49e5473edc2284655aa423b272057e525534ffec2",
+      "size": 153076
     },
     {
       "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-typescript/main/ecosystem-tests/README.md",
@@ -27057,15 +27134,15 @@
       "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-typescript/main/helpers.md",
       "status": "success",
       "path": "github/anthropic-sdk-typescript/helpers.md",
-      "sha256": "6515cd8358cd841f01657d0569d5861abea1110537f678fcf59b49bbc41ea155",
-      "size": 24449
+      "sha256": "8108ef093d89bbb52aad8949e3e3634c816d3b1a5a19a21d5f9c3c282e3f92cf",
+      "size": 28036
     },
     {
       "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-typescript/main/packages/aws-sdk/CHANGELOG.md",
       "status": "success",
       "path": "github/anthropic-sdk-typescript/packages/aws-sdk/CHANGELOG.md",
-      "sha256": "e4d9b1a55b6fdfc117e5a1224831b2bd448bcc2745ca0900fbfecde43de93c0c",
-      "size": 10881
+      "sha256": "54bed17b35bea5581598a5e703303ef385fa462f3d931a4a72386bd723329569",
+      "size": 11411
     },
     {
       "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-typescript/main/packages/aws-sdk/README.md",
@@ -27078,8 +27155,8 @@
       "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-typescript/main/packages/bedrock-sdk/CHANGELOG.md",
       "status": "success",
       "path": "github/anthropic-sdk-typescript/packages/bedrock-sdk/CHANGELOG.md",
-      "sha256": "6c804aff516a2e47faa0066c5bba310905f9c382bfac4e7edf822375c43adc7d",
-      "size": 49421
+      "sha256": "5ca39d9643ce9376f6b81d5b54ab254a69f28f8ac7b10b6db2f477e2338a7418",
+      "size": 50253
     },
     {
       "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-typescript/main/packages/bedrock-sdk/README.md",
@@ -27092,8 +27169,8 @@
       "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-typescript/main/packages/foundry-sdk/CHANGELOG.md",
       "status": "success",
       "path": "github/anthropic-sdk-typescript/packages/foundry-sdk/CHANGELOG.md",
-      "sha256": "53a109dc73972a7985165a4497d5a2b18857003c62df85e920651048e0a3168e",
-      "size": 7118
+      "sha256": "98f1cef0e3a7ec2f41fda56760c0512a8b0ea7a44f0175e0b473ab613f60414b",
+      "size": 7664
     },
     {
       "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-typescript/main/packages/foundry-sdk/README.md",
@@ -27106,8 +27183,8 @@
       "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-typescript/main/packages/google-cloud-sdk/CHANGELOG.md",
       "status": "success",
       "path": "github/anthropic-sdk-typescript/packages/google-cloud-sdk/CHANGELOG.md",
-      "sha256": "31f3126261b8bc7176191afdb04bb722c635c13bd4dcc85f523ee32a23630a71",
-      "size": 5375
+      "sha256": "14521b7dacf2fb0e27efc96026c6cc3f67ef2ded2aafbe14b08fce1228ddaa7b",
+      "size": 5946
     },
     {
       "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-typescript/main/packages/google-cloud-sdk/README.md",
@@ -27120,8 +27197,8 @@
       "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-typescript/main/packages/vertex-sdk/CHANGELOG.md",
       "status": "success",
       "path": "github/anthropic-sdk-typescript/packages/vertex-sdk/CHANGELOG.md",
-      "sha256": "7394c8a458bff349947dad65358542560acf41a53436eaea376e6a6040f24281",
-      "size": 28805
+      "sha256": "70ea8c3db8c58b02bf2069dcc58b50bb7b8fbf6ee938cab8de546d01649791cb",
+      "size": 29355
     },
     {
       "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-typescript/main/packages/vertex-sdk/README.md",
@@ -28130,8 +28207,8 @@
     }
   ],
   "summary": {
-    "total": 4120,
-    "downloaded": 3880,
+    "total": 4131,
+    "downloaded": 3891,
     "skipped": 0,
     "failed": 0,
     "dead": 240,
diff --git a/content/CHANGELOG.md b/content/CHANGELOG.md
index 73440d356f..6d69d78db4 100644
--- a/content/CHANGELOG.md
+++ b/content/CHANGELOG.md
@@ -1,5 +1,100 @@
 # Changelog
 
+## 2.1.278
+
+- Changed auto mode for Claude API and Enterprise users, and on Bedrock, Vertex, Foundry and gateways, to default to the server-side classifier, which does not charge for classifier overhead (`CLAUDE_CODE_AUTO_MODE_SERVER=0` opts out on Bedrock, Vertex, Foundry and gateways); warns on billed fallback. See https://code.claude.com/docs/en/auto-mode-classifier-billing
+- Added an `Auto mode server` row to `/status` showing whether this session's auto mode classifier runs on the server
+
+## 2.1.277
+
+- Added AGENTS.md support: in a project with no CLAUDE.md, Claude Code reads AGENTS.md instead; change it under "Project instructions" in `/config` (not yet on Bedrock, Vertex or Foundry)
+- Added `CLAUDE_GATEWAY_PROXY_IS_EGRESS_BOUNDARY=1` for Claude apps gateways whose only egress is a forward proxy: every outbound request hands the proxy the hostname instead of resolving it locally
+- Added an optional `headers:` map on Claude apps gateway upstreams, to send static headers to a proxy you run in front of a provider
+- Added a line saying a background task's update is waiting when it finishes while a panel such as `/tasks` is open
+- Fixed `claude -p` and Agent SDK sessions that could hang with no result after an internal error; they now report the error and exit with code 1
+- Fixed conversations failing every request with "text content blocks must be non-empty" when an earlier assistant turn held an empty text block beside other content, including after `--resume`
+- Fixed being unexpectedly logged out when an older Claude Code build (for example an IDE extension's bundled CLI) runs on the same machine as the current one
+- Fixed interactive start-up hanging or showing an error for `ANTHROPIC_API_KEY` users when `~/.claude.json` holds a malformed `customApiKeyResponses` value
+- Fixed update checks erroring every 30 minutes, and `claude update` hanging when a minimum or maximum version is set, if a proxy returns an invalid version; a malformed `minimumVersion` is now ignored
+- Fixed `claude update` on winget- or apk-managed installs reporting "up to date" when the version lookup failed
+- Fixed `claude plugin install` sometimes failing and breaking the installed copy when reinstalling a plugin version that a session or another program was using; an unchanged copy is now left alone
+- Fixed Grep and Glob reporting no matches when the search could not start because the system was out of processes, memory or file handles; they now return an error saying so
+- Fixed the Write tool silently ending the turn as a declined permission when the target path is an existing directory; it now reports a clear error
+- Fixed the Edit tool treating an escaped backslash followed by `uXXXX` text as a `\uXXXX` escape, which could make an edit of a non-ASCII character rewrite an escaped backslash sequence instead
+- Fixed the Edit tool reporting "Invalid regular expression: regular expression too large" instead of "String not found in file" when a very large edit containing non-ASCII text did not match the file
+- Fixed a turn ending early with "Path contains null bytes" when a tool call's file path contained `\u0000` written as an escape sequence; escaped control characters now stay as literal text
+- Fixed background sessions (`claude --bg`) exiting when a plugin's LSP server exited or closed its stdin
+- Fixed a crash ("Type error") when opening `/mcp` or `/plugin manage` with a malformed `claudeAiMcpEverConnected` value in `~/.claude.json`
+- Fixed a crash at launch when `~/.claude.json` holds a malformed `theme` value
+- Fixed a crash ("unrecoverable interface error") when the prompt held text containing terminal color codes, for example a prompt recalled from history or text loaded from the external editor
+- Fixed a crash when resuming a session whose saved history holds an assistant message stored as a plain string
+- Fixed sessions on slow or heavily loaded machines sometimes exiting with "Claude Code exited after an unrecoverable interface error" when the first spinner appeared
+- Fixed a rare case where the screen could stop updating for the rest of the session after an internal rendering error
+- Fixed a rare case on Windows where a turn could stop with an error such as "Out of memory" right after Claude replied, so that reply's tool calls never ran
+- Fixed sessions continued after `/clear` (restart, `--continue`, `--resume`) missing part of their first message when a SessionStart hook printed output, causing a full prompt-cache miss
+- Fixed messages from other agents (such as a subagent's SendMessage) that arrived mid-turn showing up below the "Ran N shell commands" row instead of where they arrived
+- Fixed the "copied" notice not appearing after drag-selecting text in the fullscreen `/resume` picker and other panels that cover the prompt area
+- Fixed `$TMPDIR` expanding empty in Bash commands that run outside the sandbox while sandboxing is enabled
+- Fixed WebFetch and WebSearch in Cowork cloud sessions not telling Claude why a request was refused, such as a used-up fetch budget or an admin policy
+- Fixed the Claude apps gateway's telemetry relay ignoring a collector hostname or domain listed in `NO_PROXY` when a proxy is set
+- Fixed one malformed `strictKnownMarketplaces` or `blockedMarketplaces` entry silently disabling the whole enterprise marketplace policy
+- Fixed failed auto-updates leaving large staged downloads behind in `~/.cache/claude/staging`
+- Fixed `/plugin` not stripping terminal control characters from messages on the Installed tab, such as the error of a failed plugin update
+- Fixed `/plugin` → Installed and `/skills` crashing when a skill or legacy command is named like a built-in Object property such as `constructor` or `toString`
+- Fixed `/plugin` closing with no message when every install in a multi-select failed
+- Fixed uninstalled plugins reappearing as "failed to load" rows in `/plugin` Installed, and Remove not clearing such a row
+- Fixed plugins from the official marketplace being recorded without their commit in `installed_plugins.json`, and `installed_plugins.json` keeping the old commit after updating a pinned-commit plugin
+- Fixed plugin reload previews keeping every previewed copy of a plugin archive unpacked until exit, and overwriting the cached `--plugin-url` archive a reload falls back to when its download fails
+- Fixed Remote Control session bookkeeping failing when `~/.claude.json` holds a malformed placeholder record
+- Fixed the error after a revoked claude.ai login blaming an expired Anthropic profile; it now leads with `/login`
+- Fixed typed or pasted text occasionally coming out scrambled in the `claude agents` dispatch input during key repeat or very fast input
+- Fixed a crash ("unrecoverable interface error") when resuming a session whose saved transcript contains a stop hook summary without a well-formed hook list
+- Fixed Enter on a selected agent panel row doing nothing when `keybindings.json` rebinds Enter in the Chat context, for example to `chat:queueSubmit`
+- Fixed PDF page reads on Windows failing when the working folder's path is long (about 120 characters or more)
+- Fixed a headless resume (`claude -p --resume`, the SDK, a VS Code extension window reload) starting the session's cost and usage totals at zero; headless sessions now save their totals at exit
+- Fixed project skills from the main repository not loading in `--worktree` sessions when `.claude/skills` is untracked
+- Fixed a `sandbox.excludedCommands` glob exempting an entire compound Bash command from the sandbox when only one part matched; every part must now match
+- Fixed resumed subagents and teammates re-rendering the MCP tool definitions they had loaded, which broke prompt caching for that agent
+- Fixed rate-limited artifact publishes telling Claude to stop retrying; Claude is now told nothing was published and when to send the same publish again
+- Fixed attachments recorded earlier in a conversation being re-rendered after a resume or relaunch, which dropped extended thinking and missed the prompt cache
+- Fixed Console sign-in showing only "Request failed with status code 400" when the server refuses to create an API key; it now shows the server's message
+- Fixed messages typed while Claude is still working sometimes being ignored by the model
+- Improved session start-up for SDK and headless (`-p`) use: the first turn no longer waits on the per-directory CLAUDE.md lookup
+- Improved the Claude apps gateway's loopback error messages to name `CLAUDE_GATEWAY_ALLOW_LOOPBACK`
+- Improved `/plugin` Installed: an MCP server listed apart from its plugin now shows which plugin it belongs to
+- Improved `claude plugin install` on an already-installed plugin: it now says when the marketplace offers a newer version and names the `claude plugin update` command
+- Improved the startup notice overflow line under the logo: it now reads "N more notices hidden" instead of "+N more · /status"
+- Improved prompt handling: invisible Unicode formatting and tag characters in a prompt are removed and the cleaned prompt is shown for review before it is sent
+- Improved `/ultrareview` when there's nothing to review: messages say which case you're in, offer a command that reviews your latest commit, and a new repository's first commit is reviewed in full
+- Improved artifact link handling so Claude reads claude.ai artifact links with the Artifact tool instead of WebFetch when that tool is available
+- Improved the dangerous-rm permission prompt to name the flagged rm command and suggest a `${VAR:?}` guard, so headless runs can recover
+- Improved the Artifact tool's permission prompts: shorter sentences, pages and artifacts named by title or file name, and links listed after the text
+- Changed Fable to always appear in `/model` on the Anthropic API; it is greyed out only when your organization's settings disable it
+- Changed the Bash sandbox instructions on Bedrock, Vertex and Foundry to the first-party wording, which frames the sandbox as the boundary of what the task was given
+- Changed `/ultrareview` in non-interactive sessions to refuse when the repository has no base branch or shared history
+- Changed subagent results to reach the main agent under a header marking them as subagent output, with the result indented, so text in a subagent's result cannot pass as the session's own instructions
+- Changed workflow scripts' computed `agent()` prompts on Bedrock, Vertex and Foundry to reach the subagent framed as script-authored text, so the safety classifier does not read them as the user
+- Removed the background Haiku auto-title request from `claude -p` runs launched outside an SDK or IDE
+- Removed the deprecated TaskOutput tool; Claude reads a background task's output file with Read instead, and the `taskOutputMaxChars` setting and `TASK_MAX_OUTPUT_LENGTH` no longer have any effect
+- [VSCode] Added a Sign out row to the panel menu, with `/logout` in the typed command menu
+- [VSCode] Added background shells and other running tasks to the agent map, each with a Stop, and a typed `/tasks` that opens it
+- [VSCode] Added a Copy response button on responses and a typed `/copy`
+- [VSCode] Added a one-time notice when inactive sessions are archived automatically, and an "Unarchive all" action on the Archived sessions group
+- [VSCode] Added the session's cost and token usage to the Account & usage dialog and the session manager where plan limits do not apply (Vertex, Bedrock, Foundry, API key)
+- [VSCode] Fixed the "General config" menu row showing `/config` usage text instead of opening settings, and made typed `/mcp`, `/hooks`, `/memory`, `/rewind` and similar commands open their dialogs
+- [VSCode] Fixed the effort slider's level not persisting into later sessions on a model that already had a level saved with `/effort`
+- [VSCode] Fixed Auto missing from the mode picker for conversations opened in an already-used panel when the saved model setting is a differently-cased alias such as "Sonnet"
+- [VSCode] Fixed `/fast` not saving fast mode as the default, so it was lost when the extension relaunched Claude Code
+- [Claude Code on the web] Added Personal and Organization sections to the environment picker on Team and Enterprise plans, and admins can now share a personal environment with the organization
+- [Claude Code on the web] Changed organization environments to open as a read-only summary from the Code tab on Team and Enterprise plans, with editing under Admin settings → Cloud environments
+- [Claude Code on the web] Fixed a cloud environment saved with Custom network access and no domains silently reverting to Trusted; the dialog now asks for at least one domain
+- [Claude Code on the web] Changed the admin Claude Code setting labeled "Web" to "Cloud sessions" and removed the redundant read-only Mobile row beneath it
+- [Claude Tag] Fixed routines created in a Slack channel on an Enterprise Grid org-wide install failing to read other public channels in their workspace when they ran
+- [Claude Tag] Fixed the "Learn more" links on credential presets in Claude Tag access bundles to open each vendor's credential-setup page instead of a generic API reference
+- [Claude Tag] Changed the Pylon credential preset in Claude Tag access bundles so admins can point it at Pylon's EU host
+- [Claude Tag] Fixed Google Cloud credential forms in Claude Tag access bundles: a refused key file now says why, the website and scopes stay locked, and a rejected rotation keeps the pasted key
+- [Claude Tag] Fixed the network events log in Claude Tag admin settings showing no response status for requests through connections that use AWS signing, client certificates or a custom CA
+
 ## 2.1.276
 
 - Fixed every request failing with `400 … Input tag 'advisor_20260301'` when `ANTHROPIC_BASE_URL` points at a proxy or gateway (2.1.275 regression)
@@ -4421,7 +4516,7 @@
 - Improved `@`-mention typeahead to rank source files above MCP resources with similar names
 - Improved PowerShell tool prompt with version-appropriate syntax guidance (5.1 vs 7+)
 - Changed `Edit` to work on files viewed via `Bash` with `sed -n` or `cat`, without requiring a separate `Read` call first
-- Changed hook output over 50K characters to be saved to disk with a file path + preview instead of being injected directly into context
+- Changed hook output over 10,000 characters to be saved to disk with a file path + a 2,000-character preview instead of being injected directly into context
 - Changed `cleanupPeriodDays: 0` in settings.json to be rejected with a validation error — it previously silently disabled transcript persistence
 - Changed thinking summaries to no longer be generated by default in interactive sessions — set `showThinkingSummaries: true` in settings.json to restore
 - Documented `TaskCreated` hook event and its blocking behavior
diff --git a/content/claude-code-manifest.json b/content/claude-code-manifest.json
index fb44f0aaf7..a653785963 100644
--- a/content/claude-code-manifest.json
+++ b/content/claude-code-manifest.json
@@ -6,25 +6,25 @@
     "url": "https://github.com/anthropics/claude-code/issues"
   },
   "dist": {
-    "shasum": "e79ef89036ba8ed956dd96caefd3d7c33c0d6b2e",
-    "tarball": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-2.1.276.tgz",
+    "shasum": "f4067f95f4925cd3c2ba8dc55f4376e0185c2fc7",
+    "tarball": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-2.1.278.tgz",
     "fileCount": 7,
-    "integrity": "sha512-xgVXCbFdqOhSAcMTSC61gjL1jCQuoAA4TNU1I7Dmf/yuYcDxHf796r6LaB3Jswm1floKnP1V+/zfphtDlPdlkg==",
+    "integrity": "sha512-mfNRqC0GaEXqmP97NiwJBeYBmRuqe2VzgLUreUUaEhyJxJWx2Z6ClW1tBOncGNNXdhj6EY4LPvUIWP+oq311CA==",
     "signatures": [
       {
-        "sig": "MEQCIHpQecH4nUAWz2gdptLi7Hkijv8qqo6w4SpaMQFb8/r4AiB9SAdWawkJ8tZQJcLGtLmcfKgiKJqb/QNWy3VRSKhFPw==",
+        "sig": "MEUCIQC81P1jcplrC28ZU4b5Y3T9Rj1A3p+8CoLXO7HAW7cJvgIgf/SppAye4NZ+E1rjLF6pE2T95KaNtRyicn05mASL5So=",
         "keyid": "SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"
       },
       {
-        "sig": "MEYCIQDpDrFKX+GwAUKAaVUiw28rCktGotEsu5n1A+Y118S4fwIhAJumek2Xs69jPwQAgCvNUL16e+XFW0wGNRS59+UlVUBE",
+        "sig": "MEQCIBeX9mnR4kKUNu3WvxUjI7diymPZpYgGHaYHeRlngVqgAiBig2fuXebNVEYirEx14d6RW8b3G5DU9EeexCkfLaCQxA==",
         "keyid": "SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"
       }
     ],
-    "unpackedSize": 186461
+    "unpackedSize": 184119
   },
   "name": "@anthropic-ai/claude-code",
   "type": "module",
-  "_from": "file:staged-npm/anthropic-ai-claude-code-2.1.276.tgz",
+  "_from": "file:staged-npm/anthropic-ai-claude-code-2.1.278.tgz",
   "author": {
     "name": "Anthropic",
     "email": "support@anthropic.com"
@@ -42,8 +42,8 @@
     "email": "wolffiex@anthropic.com"
   },
   "homepage": "https://github.com/anthropics/claude-code",
-  "_resolved": "/home/runner/work/claude-cli-internal/claude-cli-internal/staged-npm/anthropic-ai-claude-code-2.1.276.tgz",
-  "_integrity": "sha512-xgVXCbFdqOhSAcMTSC61gjL1jCQuoAA4TNU1I7Dmf/yuYcDxHf796r6LaB3Jswm1floKnP1V+/zfphtDlPdlkg==",
+  "_resolved": "/home/runner/work/claude-cli-internal/claude-cli-internal/staged-npm/anthropic-ai-claude-code-2.1.278.tgz",
+  "_integrity": "sha512-mfNRqC0GaEXqmP97NiwJBeYBmRuqe2VzgLUreUUaEhyJxJWx2Z6ClW1tBOncGNNXdhj6EY4LPvUIWP+oq311CA==",
   "_npmVersion": "11.19.0",
   "description": "Use Claude, Anthropic's AI assistant, right from your terminal. Claude can understand your codebase, edit files, run terminal commands, and handle entire workflows for you.",
   "directories": {},
@@ -106,19 +106,19 @@
   "_hasShrinkwrap": false,
   "readmeFilename": "README.md",
   "optionalDependencies": {
-    "@anthropic-ai/claude-code-linux-x64": "2.1.276",
-    "@anthropic-ai/claude-code-win32-x64": "2.1.276",
-    "@anthropic-ai/claude-code-darwin-x64": "2.1.276",
-    "@anthropic-ai/claude-code-linux-arm64": "2.1.276",
-    "@anthropic-ai/claude-code-win32-arm64": "2.1.276",
-    "@anthropic-ai/claude-code-darwin-arm64": "2.1.276",
-    "@anthropic-ai/claude-code-linux-x64-musl": "2.1.276",
-    "@anthropic-ai/claude-code-linux-arm64-musl": "2.1.276"
+    "@anthropic-ai/claude-code-linux-x64": "2.1.278",
+    "@anthropic-ai/claude-code-win32-x64": "2.1.278",
+    "@anthropic-ai/claude-code-darwin-x64": "2.1.278",
+    "@anthropic-ai/claude-code-linux-arm64": "2.1.278",
+    "@anthropic-ai/claude-code-win32-arm64": "2.1.278",
+    "@anthropic-ai/claude-code-darwin-arm64": "2.1.278",
+    "@anthropic-ai/claude-code-linux-x64-musl": "2.1.278",
+    "@anthropic-ai/claude-code-linux-arm64-musl": "2.1.278"
   },
   "_npmOperationalInternal": {
-    "tmp": "tmp/claude-code_2.1.276_1789695571884_0.43057377569820776",
+    "tmp": "tmp/claude-code_2.1.278_1789782539674_0.9072426105006208",
     "host": "s3://npm-registry-packages-npm-production"
   },
-  "_id": "@anthropic-ai/claude-code@2.1.276",
-  "version": "2.1.276"
+  "_id": "@anthropic-ai/claude-code@2.1.278",
+  "version": "2.1.278"
 }
\ No newline at end of file
diff --git a/content/claude/claude-science/admin-controls.md b/content/claude/claude-science/admin-controls.md
index 13bc6f21eb..93a1a5adca 100644
--- a/content/claude/claude-science/admin-controls.md
+++ b/content/claude/claude-science/admin-controls.md
@@ -81,7 +81,7 @@ To stop members from adding their own skills, turn off the **Allow custom skills
 
 A member who used Claude Science under another sign-in on the same computer (for example, a personal plan before joining your organization) can access the projects, sessions, and artifacts from that sign-in and move it into the app's folder for your organization on that computer (see [Access work from another sign-in on your computer](/docs/claude-science/multiple-computers#access-work-from-another-sign-in-on-your-computer)). The **Allow members to access Claude Science work previously saved on their computer** switch decides whether the app offers this access. It's on by default for Team organizations and off by default for Enterprise organizations, and organizations with HIPAA compliance enabled can't turn it on.
 
-The access happens on the member's computer and uploads nothing. Claude Science work the app accesses will follow your organization's settings from then on. Content your organization doesn't allow isn't copied or moved and stays in its original folder, and credentials such as API keys and connector sign-ins are never copied or moved. When the switch is off, the app doesn't offer the access, and its **Import work on this computer** setting is grayed out with a note that it's off for your organization.
+The access happens on the member's computer and uploads nothing. Claude Science work the app accesses will follow your organization's settings from then on. Content your organization doesn't allow isn't copied or moved and stays in its original folder, and credentials such as API keys and connector sign-ins are never copied or moved. When the switch is off, the app doesn't offer the access, and its **Access previously saved Claude Science work on this computer** setting is grayed out with a note that it's off for your organization.
 
 ### Network allowlist
 
diff --git a/content/claude/claude-science/artifacts.md b/content/claude/claude-science/artifacts.md
index 4a017dd975..9ed237f66c 100644
--- a/content/claude/claude-science/artifacts.md
+++ b/content/claude/claude-science/artifacts.md
@@ -12,7 +12,7 @@ An artifact is a file Claude saves into the project: a figure, processed dataset
 
 Click a linked file in the conversation to open it in a tab beside the chat. HTML artifacts have zoom controls, including fit to width; images zoom up to their native resolution. Open **Files** in the sidebar for a searchable grid of every artifact in the project. From an artifact's menu you can: Open, Open beside session, **View in context**, **Provenance**, Versions, **Copy link**, **Star**, **Rename**, **Download**, or **Delete**. Renaming doesn't break links. **Delete** removes all versions permanently.
 
-Files you attach or drop into the composer are listed under **Your uploads**.
+Files you attach or drop into the composer, and images you paste into it, are listed under **Your uploads**.
 
 To copy artifacts outside the app, use **Download** for a single file, or open the project's folder under \~/.claude-science and copy the files directly.
 
diff --git a/content/claude/claude-science/changelog.md b/content/claude/claude-science/changelog.md
index 8bbabd931e..207d2af4cb 100644
--- a/content/claude/claude-science/changelog.md
+++ b/content/claude/claude-science/changelog.md
@@ -6,6 +6,17 @@
 
 > Release notes for Claude Science, including new features, improvements, and bug fixes by version.
 
+<Update label="0.1.50" description="September 17, 2026">
+  * Tables in Markdown files now show as a compact grid; a long table keeps its header row in view, and row labels stay in view when you scroll sideways
+  * Tabs in the right pane can be reordered by dragging, or with Ctrl/Cmd+Shift+Left/Right
+  * Pasted images are now saved to your uploads, so Claude can keep working with them later in the conversation
+  * When Claude redraws a figure several times in one turn, the chat keeps only the newest one open; open an earlier step to see its draft
+  * Closing Settings or Customize by clicking outside it no longer drops an edit you were still typing
+  * "View in context" on a file version that a different session saved now opens the file's own session instead of an empty screen
+  * Project settings are now clearer with helper text
+  * Home screen: project rows now show running sessions in gray like the session cards
+</Update>
+
 <Update label="0.1.49" description="September 16, 2026">
   * If your organization is in Anthropic's Life Sciences Verification Program (beta), you can now [choose a use case](/docs/claude-science/safeguards#choose-a-use-case) for your sessions
   * Saved credentials now reach Claude's code only when it asks for them and you approve. They're no longer present in every cell
diff --git a/content/claude/claude-science/get-started.md b/content/claude/claude-science/get-started.md
index a2edd9cbf8..72df8d603f 100644
--- a/content/claude/claude-science/get-started.md
+++ b/content/claude/claude-science/get-started.md
@@ -92,5 +92,5 @@ After sign-in, a setup wizard walks you through enabling connectors and skills,
 * The Windows app reports that it couldn't set up the app window engine: the first launch downloads that engine from `downloads.claude.ai`, and this usually means the app couldn't reach it. Check the internet connection, and on a corporate network ask IT to allow that domain (see [Network requirements](/docs/claude-science/network-requirements)).
 * Linux refuses to start: a sandbox dependency is missing (install bubblewrap and socat as shown in the Install section), too old, or blocked. Check your bubblewrap version with `bwrap --version`, then match the error message to its fix in the [Linux troubleshooting table](/docs/claude-science/run-on-remote-linux-server#troubleshooting).
 * Projects from another computer don't appear: by design, Claude Science keeps your work on the computer where it's installed, so each computer starts with its own projects. Your earlier projects are still on the other computer. See [Use Claude Science on more than one computer](/docs/claude-science/multiple-computers).
-* Projects you created under another sign-in on this computer don't appear automatically, for example, after you move from a personal plan to your organization's Team plan: your earlier projects are still in that sign-in's folder. Select the **Review** button on the banner at the top of the home screen, or select **Review** next to **Import work on this computer** under **Settings** > **General** > **Account**, to access them. On Team and Enterprise plans, if there's no banner and the setting is grayed out, your admin controls it. See [Access work from another sign-in on your computer](/docs/claude-science/multiple-computers#access-work-from-another-sign-in-on-your-computer).
+* Projects you created under another sign-in on this computer don't appear automatically, for example, after you move from a personal plan to your organization's Team plan: your earlier projects are still in that sign-in's folder. Select the **Review** button on the banner at the top of the home screen, or select **Review** next to **Access previously saved Claude Science work on this computer** under **Settings** > **General** > **Account**, to access them. On Team and Enterprise plans, if there's no banner and the setting is grayed out, your admin controls it. See [Access work from another sign-in on your computer](/docs/claude-science/multiple-computers#access-work-from-another-sign-in-on-your-computer).
 * Sign-in stops at claude.ai: your account is on the Free plan (upgrade required), the redirect couldn't return (use Paste a code), or your Team or Enterprise organization hasn't [enabled Claude Science](/docs/claude-science/enable-claude-science) yet.
diff --git a/content/claude/claude-science/multiple-computers.md b/content/claude/claude-science/multiple-computers.md
index c4ce2f0493..642a4f90c9 100644
--- a/content/claude/claude-science/multiple-computers.md
+++ b/content/claude/claude-science/multiple-computers.md
@@ -20,6 +20,6 @@ To take a single result to another computer, choose **Download** from the artifa
 
 ## Access work from another sign-in on your computer
 
-Claude Science keeps the work from each sign-in in its own folder on your computer. When you sign in to a different organization or personal account on that computer (for example, a Team plan after a personal plan), a banner at the top of the home screen offers to import the earlier work. Select the **Review** button on the banner, select the folders to access, choose **Copy** (the original folder keeps the work too) or **Move** (what's accessed is then removed from the original folder), and select **Import**. To access later instead, select **Review** next to **Import work on this computer** under **Settings** > **General** > **Account**.
+Claude Science keeps the work from each sign-in in its own folder on your computer. When you sign in to a different organization or personal account on that computer (for example, a Team plan after a personal plan), a banner at the top of the home screen offers access to the earlier work. Select the **Review** button on the banner, select the folders to access, choose the **Copy** option (the original folder keeps the work too) or the **Move** option (what's accessed is then removed from the original folder), and select the **Copy** or **Move** button. To access later instead, select **Review** next to **Access previously saved Claude Science work on this computer** under **Settings** > **General** > **Account**.
 
-The access happens entirely on your computer and uploads nothing. Credentials such as API keys and connector sign-ins aren't copied or moved and stay in their original folder. On Team and Enterprise plans, your admin controls whether the app offers importing (it's off by default on Enterprise plans). Content your organization doesn't allow, such as memory, isn't copied or moved and stays in its original folder (see [Previously saved Claude Science work](/docs/claude-science/admin-controls#previously-saved-claude-science-work)).
+The access happens entirely on your computer and uploads nothing. Credentials such as API keys and connector sign-ins aren't copied or moved and stay in their original folder. On Team and Enterprise plans, your admin controls whether the app offers this access (it's off by default on Enterprise plans). Content your organization doesn't allow, such as memory, isn't copied or moved and stays in its original folder (see [Previously saved Claude Science work](/docs/claude-science/admin-controls#previously-saved-claude-science-work)).
diff --git a/content/claude/cowork/changelog.md b/content/claude/cowork/changelog.md
index e0dff5df31..d536012257 100644
--- a/content/claude/cowork/changelog.md
+++ b/content/claude/cowork/changelog.md
@@ -982,7 +982,7 @@
   **Code**
 
   * Added iOS Simulator support: Claude Code can build your iOS app, launch the simulator, and verify the result without leaving the session.
-  * Added iOS Simulator and Android Emulator buttons to the session titlebar when the agent launches an app on a device, so the pane is one click to reopen.
+  * Added an iOS Simulator button to the session titlebar when the agent launches an app in the simulator, so the pane is one click to reopen.
   * Added Pause Project, which pauses a project's coordinator and new session spawning from settings and shows a Resume banner above the composer.
   * Added screenshot annotation in the composer: click a staged image, open the pencil, and draw with pen, shapes, text, and colors before sending.
   * Improved how large sessions open: the newest messages paint first while older history loads in the background.
diff --git a/content/claude/government/changelog.md b/content/claude/government/changelog.md
index 93ebd1ed71..c36981921b 100644
--- a/content/claude/government/changelog.md
+++ b/content/claude/government/changelog.md
@@ -6,6 +6,19 @@
 
 > Release notes for Claude for Government
 
+<Update label="2026.09.16.1">
+  * Fixed members not being reactivated after they are re-enabled in your identity provider.
+  * Changed SCIM provisioning to reject requests to deactivate an organization's primary owner or a tenant's last admin until ownership is transferred or another admin is added.
+  * Changed SCIM provisioning to return an error that says what to do first when an identity provider deactivates or changes the email address of a member who is not yet linked to their directory entry.
+  * Changed sign-in for accounts outside any organization that still held a Primary Owner role without being a tenant admin: they now sign in like any other member.
+  * Changed sign-in: a network that starts sign-ins unusually fast is briefly told to try again.
+  * Added a check of the Issuer against what your identity provider publishes when you save OIDC single sign-on.
+  * Added a Test sign-in button to the Single sign-on settings on the tenant portal's Identity and access page, so a tenant admin can check their own sign-in through their identity provider.
+  * Added **Sign out everywhere** to each member's row menu on the Users page, which ends all of that member's sessions; the Compliance API records it as `user.sessions_revoked`.
+  * Added the option to enforce settings whose values are hidden after saving, such as Telemetry headers, from the Admin Console.
+  * Added the **Claude Desktop home** setting on the Config page, which sets Chat, Advanced file analysis, and Cowork in Claude Desktop together. It needs Claude Desktop 1.52386.0 or later.
+</Update>
+
 <Update label="2026.09.15.1">
   * Fixed directory provisioning (SCIM) rejecting some of the user updates that Microsoft Entra ID sends by default.
   * Changed what removing a tenant admin does for someone who is not yet in an organization: they can no longer request an emailed sign-in link and are placed by the sign-in routing rules at their next single sign-on, like any other member.
diff --git a/content/claude/third-party/claude-desktop/admin-console.md b/content/claude/third-party/claude-desktop/admin-console.md
index b23380556b..7babc9a2c6 100644
--- a/content/claude/third-party/claude-desktop/admin-console.md
+++ b/content/claude/third-party/claude-desktop/admin-console.md
@@ -94,7 +94,7 @@ From the console you can set the same [configuration keys](/docs/third-party/cla
 | Page                    | What you configure there                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
 | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Connection**          | The inference provider ([gateway](/docs/third-party/claude-desktop/gateway), [Amazon Bedrock](/docs/third-party/claude-desktop/bedrock), [Bedrock Mantle](/docs/third-party/claude-desktop/mantle), [Google Cloud's Agent Platform](/docs/third-party/claude-desktop/vertex), or [Microsoft Foundry](/docs/third-party/claude-desktop/foundry)), its endpoint, region, or project, how users authenticate to it, custom request headers, and, under **Models**, the model list, default model, model discovery, and cost-estimate rates. **Desktop sign-in** on this page holds the **Require this organization in Claude Desktop** switch described under [Users in more than one Claude organization](#users-in-more-than-one-claude-organization). |
-| **Workspace**           | Whether Chat, Cowork, and Code are each available, the folders and network hosts the app may use, permission modes and built-in tool policy, whether users may add their own skills and plugins, and organization instructions                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| **Capabilities**        | Whether Chat, Cowork, and Code are each available, the folders and network hosts the app may use, permission modes and built-in tool policy, the [built-in browser](/docs/third-party/claude-desktop/browser#manage-the-built-in-browser-from-the-enterprise-admin-console) and its site permissions, whether users may add their own skills and plugins, and organization instructions                                                                                                                                                                                                                                                                                                                                           |
 | **Connectors**          | Managed MCP servers, including the [built-in connectors](/docs/third-party/claude-desktop/built-in-connectors), whether users may add their own MCP servers, desktop extension policy, and [**Claude.ai data import**](/docs/third-party/claude-desktop/import)                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
 | **Telemetry & updates** | Which telemetry categories go to Anthropic, whether users' apps report [usage analytics](#usage-analytics) to your organization, OpenTelemetry export to your collector, update policy, the [configuration relaunch window](#configuration-updates), and the configuration re-check interval                                                                                                                                                                                                                                                                                                                                                                                                                                 |
 | **Limits**              | A per-user token limit and its window                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
@@ -105,8 +105,6 @@ The console refuses API keys, tokens, and secrets anywhere in the configuration,
 
 Most of these settings can also differ per group of users, on the **Permission policies** page under **People**, as described under [Per-group permission policies](#per-group-permission-policies).
 
-To turn on the built-in browser, open the **Capabilities** page in **Organization settings**, outside the **Desktop 3P** section, and turn on the **Built-in browser** switch under **Data sources**, as described under [Manage the built-in browser from the Enterprise Admin Console](/docs/third-party/claude-desktop/browser#manage-the-built-in-browser-from-the-enterprise-admin-console).
-
 ### Choose how users authenticate to your provider
 
 <Tip>
diff --git a/content/claude/third-party/claude-desktop/browser.md b/content/claude/third-party/claude-desktop/browser.md
index 7ca9a3a7dc..b9c7603158 100644
--- a/content/claude/third-party/claude-desktop/browser.md
+++ b/content/claude/third-party/claude-desktop/browser.md
@@ -34,11 +34,11 @@ Pages load directly from the user's device, so your network's proxy, firewall, a
 
 ### Turn on the built-in browser
 
-The built-in browser is off by default. Set [`builtinBrowserEnabled`](/docs/third-party/claude-desktop/configuration#builtinbrowserenabled) to `true` in your managed configuration, under **General restrictions** in the **Workspace** section of the [in-app configuration window](/docs/third-party/claude-desktop/in-app-configuration). The change takes effect after Claude Desktop restarts.
+The built-in browser is off by default. Set [`builtinBrowserEnabled`](/docs/third-party/claude-desktop/configuration#builtinbrowserenabled) to `true` in your managed configuration, under **Built-in browser** in the **Capabilities** section of the [in-app configuration window](/docs/third-party/claude-desktop/in-app-configuration). The change takes effect after Claude Desktop restarts.
 
 Also allow `releases.claude.com` through your firewall, because Claude Desktop contacts it for the [site safety check](#site-safety-check). If the app can't complete a check, users can keep browsing the site, but Claude can't read or act on it.
 
-If your devices use a [bootstrap server](/docs/third-party/claude-desktop/bootstrap), set the key in the configuration the server returns, because a value set only on the device leaves the browser off. If you manage the app from the Enterprise Admin Console, use [the console's **Built-in browser** switch](#manage-the-built-in-browser-from-the-enterprise-admin-console) instead.
+If your devices use a [bootstrap server](/docs/third-party/claude-desktop/bootstrap), set the key in the configuration the server returns, because a value set only on the device leaves the browser off. If you manage the app from the Enterprise Admin Console, [turn it on from the console](#manage-the-built-in-browser-from-the-enterprise-admin-console) instead.
 
 ### Restrict which sites Claude can open
 
@@ -69,7 +69,7 @@ The example is plain JSON, which is the form a [bootstrap server](/docs/third-pa
 
 ### Manage the built-in browser from the Enterprise Admin Console
 
-If you manage the app from the [Enterprise Admin Console](/docs/third-party/claude-desktop/admin-console), you control the built-in browser from the console instead of with these keys. In **Organization settings** on claude.ai, open the **Capabilities** page and turn on the **Built-in browser** switch under **Data sources**. The change takes effect when users restart Claude Desktop. Also allow `releases.claude.com` through your firewall, because Claude Desktop contacts it for the [site safety check](#site-safety-check).
+If you manage the app from the [Enterprise Admin Console](/docs/third-party/claude-desktop/admin-console), you control the built-in browser from the console instead of with these keys. In **Organization settings** on claude.ai, open the **Capabilities** page in the **Desktop 3P** section. Under **Built-in browser**, turn on the **Allow the built-in browser** switch. The change takes effect when users restart Claude Desktop. Also allow `releases.claude.com` through your firewall, because Claude Desktop contacts it for the [site safety check](#site-safety-check).
 
 Once the switch is on, **Browser site permissions** appears below it. Click the **Manage site permissions** button to choose whether Claude can act on every site except the ones you block, or only on the sites you allow, and add those sites in the same dialog. These are the same site permissions [Claude in Chrome](#claude-in-chrome) uses, and changes to them apply without a restart.
 
diff --git a/content/claude/third-party/claude-desktop/local-access.md b/content/claude/third-party/claude-desktop/local-access.md
index e40c3107e1..8cac00d3ca 100644
--- a/content/claude/third-party/claude-desktop/local-access.md
+++ b/content/claude/third-party/claude-desktop/local-access.md
@@ -53,6 +53,10 @@ The agent cannot attach a network-drive path on its own; only the user can, thro
 
 On macOS, network mounts under `/Volumes/` are currently treated as local folders.
 
+## Removable drives on Windows
+
+Users can attach a folder on a removable drive, such as a USB stick or an SD card, and file tools work there. The sandbox does not mount removable drives, so shell commands cannot reach them. Copy the relevant files to a local folder before running a script or build against them.
+
 ## WSL
 
 You do not need Windows Subsystem for Linux (WSL) to run Claude Desktop or Cowork. On Windows, Cowork's sandbox runs on the operating system's built-in virtualization, which the [readiness check](/docs/third-party/claude-desktop/installation#check-device-readiness) verifies. Install the macOS or Windows package (see [System requirements](/docs/third-party/claude-desktop/installation#system-requirements)); there is no installation path inside WSL. Run the Windows app and work with WSL files from there.
diff --git a/content/claude/third-party/claude-desktop/mdm.md b/content/claude/third-party/claude-desktop/mdm.md
index 822dafce65..fe25b7309a 100644
--- a/content/claude/third-party/claude-desktop/mdm.md
+++ b/content/claude/third-party/claude-desktop/mdm.md
@@ -41,7 +41,7 @@ The window is organized into sections in the left sidebar. Work through them in
 | Section                 | What you set                                                                                                                                                                                                                                                                                       |
 | ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Connection**          | Inference provider (Gateway, Claude API, Google Cloud's Agent Platform, Bedrock, Bedrock Mantle, or Foundry) and its credentials<br />Model list<br />Organization UUID<br />Optional credential-helper script                                                                                     |
-| **Workspace**           | Which of Cowork, Code, and Chat are available<br />Allowed egress hosts for the sandbox<br />Disabled built-in tools<br />Allowed workspace folders                                                                                                                                                |
+| **Capabilities**        | Which of Cowork, Code, and Chat are available<br />Allowed egress hosts for the sandbox<br />Disabled built-in tools<br />Allowed workspace folders                                                                                                                                                |
 | **Connectors**          | Managed MCP servers pushed to all users<br />Whether users can add their own local MCP servers<br />Whether desktop extensions (`.mcpb`) are allowed<br />Whether unsigned extensions are rejected                                                                                                 |
 | **Telemetry & updates** | OpenTelemetry collector endpoint<br />Whether auto-updates are blocked, and the enforcement window if not<br />The three Anthropic-bound telemetry toggles (essential, nonessential, nonessential services)                                                                                        |
 | **Limits**              | Per-device token cap and its window length<br />Retention periods after which idle chats, Cowork tasks, and Code sessions are deleted, and the hold that suspends deletion                                                                                                                         |
diff --git a/content/en/about-claude/model-deprecations.md b/content/en/about-claude/model-deprecations.md
index 921d3da420..bafa7dac4b 100644
--- a/content/en/about-claude/model-deprecations.md
+++ b/content/en/about-claude/model-deprecations.md
@@ -71,9 +71,12 @@ At some point, Anthropic hopes to make past models publicly available again. In
 Current and recently retired models are listed in the following table with their status:
 
 | API model name             | Current state | Deprecated        | Tentative retirement date          |
-| -------------------------- | ------------- | ----------------- | ---------------------------------- |
+| :------------------------- | :------------ | :---------------- | :--------------------------------- |
 | claude-fable-5-1           | Active        | N/A               | Not sooner than September 1, 2027  |
+| claude-mythos-5-1          | Active        | N/A               | Not sooner than September 1, 2027  |
 | claude-fable-5             | Active        | N/A               | Not sooner than June 9, 2027       |
+| claude-mythos-5            | Active        | N/A               | Not sooner than June 9, 2027       |
+| claude-mythos-preview      | Deprecated    | June 9, 2026      | To be announced                    |
 | claude-opus-5              | Active        | N/A               | Not sooner than July 24, 2027      |
 | claude-opus-4-8            | Active        | N/A               | Not sooner than May 28, 2027       |
 | claude-opus-4-7            | Active        | N/A               | Not sooner than April 16, 2027     |
diff --git a/content/en/agents-and-tools/agent-skills/quickstart.md b/content/en/agents-and-tools/agent-skills/quickstart.md
index 361a6097e7..d5278cf397 100644
--- a/content/en/agents-and-tools/agent-skills/quickstart.md
+++ b/content/en/agents-and-tools/agent-skills/quickstart.md
@@ -29,7 +29,7 @@ Pre-built Agent Skills extend Claude's capabilities with specialized expertise f
 
 First, check what Skills are available. Use the Skills API to list all Anthropic-managed Skills. Each language tab is an excerpt from one continuous script, with any imports and client setup at the top:
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   # List Anthropic-managed Skills
   curl --fail-with-body -sS "https://api.anthropic.com/v1/skills?source=anthropic" \
diff --git a/content/en/api/beta.md b/content/en/api/beta.md
index e1decd48b3..f2551da61b 100644
--- a/content/en/api/beta.md
+++ b/content/en/api/beta.md
@@ -2499,7 +2499,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
           - `BetaToolChangeMCPToolReference object`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `type: "mcp_tool_reference"`
@@ -2541,7 +2541,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
           - `BetaToolChangeMCPToolReference object`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
           - `BetaToolChangeMCPToolsetReference object`
@@ -8772,7 +8772,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
           - `BetaToolChangeMCPToolReference object`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `type: "mcp_tool_reference"`
@@ -8814,7 +8814,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
           - `BetaToolChangeMCPToolReference object`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
           - `BetaToolChangeMCPToolsetReference object`
@@ -12733,7 +12733,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
               - `BetaToolChangeMCPToolReference object`
 
-                Reference to a single MCP tool by its server and remote name — the
+                Reference to a single MCP tool by its server and remote name; the
                 same `server_name`/`name` pair `mcp_tool_use` carries.
 
                 - `type: "mcp_tool_reference"`
@@ -12775,7 +12775,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
               - `BetaToolChangeMCPToolReference object`
 
-                Reference to a single MCP tool by its server and remote name — the
+                Reference to a single MCP tool by its server and remote name; the
                 same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `BetaToolChangeMCPToolsetReference object`
@@ -65362,7 +65362,7 @@ curl https://api.anthropic.com/v1/skills \
     -H 'Content-Type: multipart/form-data' \
     -H 'anthropic-version: 2023-06-01' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY" \
-    -F files='["Example data"]'
+    -F 'files[]=@/path/to/file'
 ```
 
 ##### Response (200)
@@ -66166,7 +66166,7 @@ curl https://api.anthropic.com/v1/skills/$SKILL_ID/versions \
     -H 'Content-Type: multipart/form-data' \
     -H 'anthropic-version: 2023-06-01' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY" \
-    -F files='["Example data"]'
+    -F 'files[]=@/path/to/file'
 ```
 
 ##### Response (200)
@@ -83431,7 +83431,7 @@ archived tunnels are excluded unless `include_archived` is set.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -83580,6 +83580,7 @@ archived tunnels are excluded unless `include_archived` is set.
 ```bash
 curl https://api.anthropic.com/v1/organizations/tunnels \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
@@ -83622,7 +83623,7 @@ Retrieve a single tunnel in the caller's organization by ID.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -83767,6 +83768,7 @@ Retrieve a single tunnel in the caller's organization by ID.
 ```bash
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
@@ -83809,7 +83811,7 @@ tunnel returns the existing record unchanged.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -83955,6 +83957,7 @@ tunnel returns the existing record unchanged.
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/archive \
     -X POST \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
@@ -83997,7 +84000,7 @@ access logs.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -84120,6 +84123,7 @@ access logs.
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/reveal_token \
     -X POST \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
@@ -84157,7 +84161,7 @@ restarted after rotation must use the new value. An optional
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -84288,6 +84292,7 @@ restarted after rotation must use the new value. An optional
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/rotate_token \
     -X POST \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
@@ -84328,7 +84333,7 @@ holds at most two non-archived certificates.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -84483,6 +84488,7 @@ holds at most two non-archived certificates.
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \
     -H 'Content-Type: application/json' \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY" \
     -d '{
           "ca_certificate_pem": "-----BEGIN CERTIFICATE-----\nMIIBexampleEXAMPLEexampleEXAMPLEexampleEXAMPLEexampleEXAMPLEexa\n...illustrative placeholder, not a real certificate...\n-----END CERTIFICATE-----\n"
@@ -84545,7 +84551,7 @@ Archived certificates are excluded unless `include_archived` is set.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -84694,6 +84700,7 @@ Archived certificates are excluded unless `include_archived` is set.
 ```bash
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
@@ -84740,7 +84747,7 @@ Retrieve a single certificate registered on a tunnel by ID.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -84885,6 +84892,7 @@ Retrieve a single certificate registered on a tunnel by ID.
 ```bash
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
@@ -84930,7 +84938,7 @@ certificate is added.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -85076,6 +85084,7 @@ certificate is added.
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID/archive \
     -X POST \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
@@ -88374,11 +88383,15 @@ curl https://api.anthropic.com/v1/organizations/analytics/artifacts \
 
 **POST** `/v1/organizations/spend_limits`
 
-Set a per-user spend limit override.
+Set a spend limit.
 
 Upsert keyed on (scope, period): setting a limit that already exists
-overwrites it in place. Only `scope.type: "user"` is accepted; seat-tier,
-group, and organization-level defaults are configured in claude.ai.
+overwrites it in place. A Claude Enterprise organization sets `user`
+limits. Its seat-tier, group, and organization-level defaults are configured
+in claude.ai. A Claude Console organization sets `organization` and
+`workspace` limits, which are monthly and always carry an amount. Setting those
+limits is in an early access preview. To request access, contact your
+Anthropic account team.
 
 #### Body parameters
 
@@ -88386,19 +88399,43 @@ group, and organization-level defaults are configured in claude.ai.
 
   Limit amount as a non-negative integer decimal string in the minor unit of the organization's billing currency (cents for USD): "50000" is $500.00. `null` sets an explicit no-limit override for this scope and `period` only — each period resolves independently, so caps for other periods still apply.
 
-- `scope: object`
+- `scope: User or Organization or Workspace`
 
-  Scope selecting a single member of the organization.
+  What the limit applies to. Claude Enterprise organizations set `user` limits. Claude Console organizations set `organization` and `workspace` limits. Any other combination returns 400. Setting `organization` and `workspace` limits through the API is in an early access preview. To request access, contact your Anthropic account team.
 
-  - `type: "user"`
+  - `User object`
 
-    Scope type. Always `user` for this scope.
+    Scope selecting a single member of the organization.
 
-    default: user
+    - `type: "user"`
 
-  - `user_id: string`
+      Scope type. Always `user` for this scope.
 
-    Tagged ID of the member the spend limit applies to.
+      default: user
+
+    - `user_id: string`
+
+      Tagged ID of the member the spend limit applies to.
+
+  - `Organization object`
+
+    - `type: "organization"`
+
+      default: organization
+
+  - `Workspace object`
+
+    Scope selecting one workspace of a Claude Console organization.
+
+    - `type: "workspace"`
+
+      Scope type. Always `workspace` for this scope.
+
+      default: workspace
+
+    - `workspace_id: string`
+
+      Tagged ID of the workspace the spend limit applies to.
 
 - `period: optional "daily" or "monthly" or "weekly"`
 
@@ -88448,7 +88485,7 @@ group, and organization-level defaults are configured in claude.ai.
 
     - `"weekly"`
 
-  - `scope: User or SeatTier or RBACGroup or 2 more`
+  - `scope: User or SeatTier or RBACGroup or 3 more`
 
     What the limit applies to. A tagged union on `type`; each variant carries the identifier for its scope.
 
@@ -88496,6 +88533,20 @@ group, and organization-level defaults are configured in claude.ai.
 
         default: organization
 
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
+
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
   - `updated_at: string`
 
     RFC 3339 datetime at which the spend limit was last modified.
@@ -88589,7 +88640,7 @@ Retrieve a spend limit by ID.
 
     - `"weekly"`
 
-  - `scope: User or SeatTier or RBACGroup or 2 more`
+  - `scope: User or SeatTier or RBACGroup or 3 more`
 
     What the limit applies to. A tagged union on `type`; each variant carries the identifier for its scope.
 
@@ -88637,6 +88688,20 @@ Retrieve a spend limit by ID.
 
         default: organization
 
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
+
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
   - `updated_at: string`
 
     RFC 3339 datetime at which the spend limit was last modified.
@@ -88673,11 +88738,13 @@ curl https://api.anthropic.com/v1/organizations/spend_limits/$SPEND_LIMIT_ID \
 
 **DELETE** `/v1/organizations/spend_limits/{spend_limit_id}`
 
-Delete a per-user spend limit override.
+Delete a spend limit.
 
-The member falls back to any inherited spend limit at that period.
-Seat-tier, group, and organization-level rows cannot be deleted via
-this endpoint.
+For a Claude Enterprise organization, this deletes a per-user override, and
+the member falls back to any inherited spend limit at that period. Its
+seat-tier, group, and organization-level rows cannot be deleted via this
+endpoint. A Claude Console organization deletes its organization and
+workspace limits. Deleting them through the API is in an early access preview.
 
 #### Path parameters
 
@@ -88755,35 +88822,47 @@ Paginates by member, so a member's periods never split across pages.
 
 - `data: array of BetaSpendSummary`
 
-  - `actor: object`
+  - `actor: UserActor or ScopedAPIKeyActor`
 
-    A user within the organization. `name` and `email_address` are
-    null when the underlying account is unavailable or has been deleted;
-    `deleted` is true only for deleted accounts.
+    - `UserActor object`
 
-    - `type: "user_actor"`
+      A user within the organization. `name` and `email_address` are
+      null when the underlying account is unavailable or has been deleted;
+      `deleted` is true only for deleted accounts.
 
-      Actor type. Always `user_actor`.
+      - `type: "user_actor"`
 
-      default: user_actor
+        Actor type. Always `user_actor`.
 
-    - `deleted: boolean`
+        default: user_actor
 
-      True only when the underlying account has been deleted.
+      - `deleted: boolean`
 
-      default: false
+        True only when the underlying account has been deleted.
 
-    - `email_address: string or null`
+        default: false
 
-      The user's email address. Null when the account is unavailable or has been deleted.
+      - `email_address: string or null`
 
-    - `name: string or null`
+        The user's email address. Null when the account is unavailable or has been deleted.
 
-      The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
+      - `name: string or null`
 
-    - `user_id: string`
+        The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
 
-      Tagged ID of the user.
+      - `user_id: string`
+
+        Tagged ID of the user.
+
+    - `ScopedAPIKeyActor object`
+
+      A scoped Admin API key acting on behalf of the organization.
+
+      - `type: "scoped_api_key_actor"`
+
+        default: scoped_api_key_actor
+
+      - `scoped_api_key_id: string`
 
   - `amount: string or null`
 
@@ -88807,21 +88886,67 @@ Paginates by member, so a member's periods never split across pages.
 
     The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.
 
-  - `scope: object`
+  - `scope: User or SeatTier or RBACGroup or 3 more`
 
-    Scope selecting a single member of the organization.
+    - `User object`
 
-    - `type: "user"`
+      Scope selecting a single member of the organization.
 
-      Scope type. Always `user` for this scope.
+      - `type: "user"`
 
-      default: user
+        Scope type. Always `user` for this scope.
 
-    - `user_id: string`
+        default: user
 
-      Tagged ID of the member the spend limit applies to.
+      - `user_id: string`
+
+        Tagged ID of the member the spend limit applies to.
 
-  - `source: User or SeatTier or RBACGroup or 2 more`
+    - `SeatTier object`
+
+      - `type: "seat_tier"`
+
+        default: seat_tier
+
+      - `seat_tier: string`
+
+    - `RBACGroup object`
+
+      - `type: "rbac_group"`
+
+        default: rbac_group
+
+      - `rbac_group_id: string`
+
+    - `OrganizationService object`
+
+      - `type: "organization_service"`
+
+        default: organization_service
+
+      - `service: string`
+
+    - `Organization object`
+
+      - `type: "organization"`
+
+        default: organization
+
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
+
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
+  - `source: User or SeatTier or RBACGroup or 3 more`
 
     - `User object`
 
@@ -88867,6 +88992,20 @@ Paginates by member, so a member's periods never split across pages.
 
         default: organization
 
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
+
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
   - `spend_limit_id: string`
 
 - `next_page: string or null`
@@ -89048,35 +89187,47 @@ Requests whose requester is no longer a member are excluded.
 
     Per-member effective-limit report row (`GET /spend_limits/effective`).
 
-    - `actor: object`
+    - `actor: UserActor or ScopedAPIKeyActor`
 
-      A user within the organization. `name` and `email_address` are
-      null when the underlying account is unavailable or has been deleted;
-      `deleted` is true only for deleted accounts.
+      - `UserActor object`
 
-      - `type: "user_actor"`
+        A user within the organization. `name` and `email_address` are
+        null when the underlying account is unavailable or has been deleted;
+        `deleted` is true only for deleted accounts.
 
-        Actor type. Always `user_actor`.
+        - `type: "user_actor"`
 
-        default: user_actor
+          Actor type. Always `user_actor`.
 
-      - `deleted: boolean`
+          default: user_actor
 
-        True only when the underlying account has been deleted.
+        - `deleted: boolean`
 
-        default: false
+          True only when the underlying account has been deleted.
 
-      - `email_address: string or null`
+          default: false
 
-        The user's email address. Null when the account is unavailable or has been deleted.
+        - `email_address: string or null`
 
-      - `name: string or null`
+          The user's email address. Null when the account is unavailable or has been deleted.
 
-        The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
+        - `name: string or null`
 
-      - `user_id: string`
+          The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
 
-        Tagged ID of the user.
+        - `user_id: string`
+
+          Tagged ID of the user.
+
+      - `ScopedAPIKeyActor object`
+
+        A scoped Admin API key acting on behalf of the organization.
+
+        - `type: "scoped_api_key_actor"`
+
+          default: scoped_api_key_actor
+
+        - `scoped_api_key_id: string`
 
     - `amount: string or null`
 
@@ -89100,21 +89251,67 @@ Requests whose requester is no longer a member are excluded.
 
       The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.
 
-    - `scope: object`
+    - `scope: User or SeatTier or RBACGroup or 3 more`
 
-      Scope selecting a single member of the organization.
+      - `User object`
 
-      - `type: "user"`
+        Scope selecting a single member of the organization.
 
-        Scope type. Always `user` for this scope.
+        - `type: "user"`
 
-        default: user
+          Scope type. Always `user` for this scope.
 
-      - `user_id: string`
+          default: user
 
-        Tagged ID of the member the spend limit applies to.
+        - `user_id: string`
+
+          Tagged ID of the member the spend limit applies to.
+
+      - `SeatTier object`
 
-    - `source: User or SeatTier or RBACGroup or 2 more`
+        - `type: "seat_tier"`
+
+          default: seat_tier
+
+        - `seat_tier: string`
+
+      - `RBACGroup object`
+
+        - `type: "rbac_group"`
+
+          default: rbac_group
+
+        - `rbac_group_id: string`
+
+      - `OrganizationService object`
+
+        - `type: "organization_service"`
+
+          default: organization_service
+
+        - `service: string`
+
+      - `Organization object`
+
+        - `type: "organization"`
+
+          default: organization
+
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
+    - `source: User or SeatTier or RBACGroup or 3 more`
 
       - `User object`
 
@@ -89160,6 +89357,20 @@ Requests whose requester is no longer a member are excluded.
 
           default: organization
 
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
     - `spend_limit_id: string`
 
   - `status: "approved" or "denied" or "pending"`
@@ -89351,35 +89562,47 @@ requester at the request's period.
 
     Per-member effective-limit report row (`GET /spend_limits/effective`).
 
-    - `actor: object`
+    - `actor: UserActor or ScopedAPIKeyActor`
 
-      A user within the organization. `name` and `email_address` are
-      null when the underlying account is unavailable or has been deleted;
-      `deleted` is true only for deleted accounts.
+      - `UserActor object`
 
-      - `type: "user_actor"`
+        A user within the organization. `name` and `email_address` are
+        null when the underlying account is unavailable or has been deleted;
+        `deleted` is true only for deleted accounts.
 
-        Actor type. Always `user_actor`.
+        - `type: "user_actor"`
 
-        default: user_actor
+          Actor type. Always `user_actor`.
 
-      - `deleted: boolean`
+          default: user_actor
 
-        True only when the underlying account has been deleted.
+        - `deleted: boolean`
 
-        default: false
+          True only when the underlying account has been deleted.
 
-      - `email_address: string or null`
+          default: false
 
-        The user's email address. Null when the account is unavailable or has been deleted.
+        - `email_address: string or null`
 
-      - `name: string or null`
+          The user's email address. Null when the account is unavailable or has been deleted.
 
-        The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
+        - `name: string or null`
 
-      - `user_id: string`
+          The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
 
-        Tagged ID of the user.
+        - `user_id: string`
+
+          Tagged ID of the user.
+
+      - `ScopedAPIKeyActor object`
+
+        A scoped Admin API key acting on behalf of the organization.
+
+        - `type: "scoped_api_key_actor"`
+
+          default: scoped_api_key_actor
+
+        - `scoped_api_key_id: string`
 
     - `amount: string or null`
 
@@ -89403,21 +89626,67 @@ requester at the request's period.
 
       The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.
 
-    - `scope: object`
+    - `scope: User or SeatTier or RBACGroup or 3 more`
 
-      Scope selecting a single member of the organization.
+      - `User object`
 
-      - `type: "user"`
+        Scope selecting a single member of the organization.
 
-        Scope type. Always `user` for this scope.
+        - `type: "user"`
 
-        default: user
+          Scope type. Always `user` for this scope.
 
-      - `user_id: string`
+          default: user
 
-        Tagged ID of the member the spend limit applies to.
+        - `user_id: string`
+
+          Tagged ID of the member the spend limit applies to.
+
+      - `SeatTier object`
 
-    - `source: User or SeatTier or RBACGroup or 2 more`
+        - `type: "seat_tier"`
+
+          default: seat_tier
+
+        - `seat_tier: string`
+
+      - `RBACGroup object`
+
+        - `type: "rbac_group"`
+
+          default: rbac_group
+
+        - `rbac_group_id: string`
+
+      - `OrganizationService object`
+
+        - `type: "organization_service"`
+
+          default: organization_service
+
+        - `service: string`
+
+      - `Organization object`
+
+        - `type: "organization"`
+
+          default: organization
+
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
+    - `source: User or SeatTier or RBACGroup or 3 more`
 
       - `User object`
 
@@ -89463,6 +89732,20 @@ requester at the request's period.
 
           default: organization
 
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
     - `spend_limit_id: string`
 
   - `status: "approved" or "denied" or "pending"`
@@ -89697,7 +89980,7 @@ the member was blocked on. Anthropic emails the requester unless
 
     - `"weekly"`
 
-  - `scope: User or SeatTier or RBACGroup or 2 more`
+  - `scope: User or SeatTier or RBACGroup or 3 more`
 
     What the limit applies to. A tagged union on `type`; each variant carries the identifier for its scope.
 
@@ -89745,6 +90028,20 @@ the member was blocked on. Anthropic emails the requester unless
 
         default: organization
 
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
+
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
   - `updated_at: string`
 
     RFC 3339 datetime at which the spend limit was last modified.
@@ -89755,35 +90052,47 @@ the member was blocked on. Anthropic emails the requester unless
 
   Per-member effective-limit report row (`GET /spend_limits/effective`).
 
-  - `actor: object`
+  - `actor: UserActor or ScopedAPIKeyActor`
 
-    A user within the organization. `name` and `email_address` are
-    null when the underlying account is unavailable or has been deleted;
-    `deleted` is true only for deleted accounts.
+    - `UserActor object`
 
-    - `type: "user_actor"`
+      A user within the organization. `name` and `email_address` are
+      null when the underlying account is unavailable or has been deleted;
+      `deleted` is true only for deleted accounts.
 
-      Actor type. Always `user_actor`.
+      - `type: "user_actor"`
 
-      default: user_actor
+        Actor type. Always `user_actor`.
 
-    - `deleted: boolean`
+        default: user_actor
 
-      True only when the underlying account has been deleted.
+      - `deleted: boolean`
 
-      default: false
+        True only when the underlying account has been deleted.
 
-    - `email_address: string or null`
+        default: false
 
-      The user's email address. Null when the account is unavailable or has been deleted.
+      - `email_address: string or null`
 
-    - `name: string or null`
+        The user's email address. Null when the account is unavailable or has been deleted.
 
-      The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
+      - `name: string or null`
 
-    - `user_id: string`
+        The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
 
-      Tagged ID of the user.
+      - `user_id: string`
+
+        Tagged ID of the user.
+
+    - `ScopedAPIKeyActor object`
+
+      A scoped Admin API key acting on behalf of the organization.
+
+      - `type: "scoped_api_key_actor"`
+
+        default: scoped_api_key_actor
+
+      - `scoped_api_key_id: string`
 
   - `amount: string or null`
 
@@ -89807,21 +90116,67 @@ the member was blocked on. Anthropic emails the requester unless
 
     The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.
 
-  - `scope: object`
+  - `scope: User or SeatTier or RBACGroup or 3 more`
 
-    Scope selecting a single member of the organization.
+    - `User object`
 
-    - `type: "user"`
+      Scope selecting a single member of the organization.
 
-      Scope type. Always `user` for this scope.
+      - `type: "user"`
 
-      default: user
+        Scope type. Always `user` for this scope.
 
-    - `user_id: string`
+        default: user
 
-      Tagged ID of the member the spend limit applies to.
+      - `user_id: string`
+
+        Tagged ID of the member the spend limit applies to.
 
-  - `source: User or SeatTier or RBACGroup or 2 more`
+    - `SeatTier object`
+
+      - `type: "seat_tier"`
+
+        default: seat_tier
+
+      - `seat_tier: string`
+
+    - `RBACGroup object`
+
+      - `type: "rbac_group"`
+
+        default: rbac_group
+
+      - `rbac_group_id: string`
+
+    - `OrganizationService object`
+
+      - `type: "organization_service"`
+
+        default: organization_service
+
+      - `service: string`
+
+    - `Organization object`
+
+      - `type: "organization"`
+
+        default: organization
+
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
+
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
+  - `source: User or SeatTier or RBACGroup or 3 more`
 
     - `User object`
 
@@ -89867,6 +90222,20 @@ the member was blocked on. Anthropic emails the requester unless
 
         default: organization
 
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
+
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
   - `spend_limit_id: string`
 
 - `status: "approved" or "denied" or "pending"`
@@ -90073,35 +90442,47 @@ Idempotent on `denied`; denying an already-`approved` request returns
 
     Per-member effective-limit report row (`GET /spend_limits/effective`).
 
-    - `actor: object`
+    - `actor: UserActor or ScopedAPIKeyActor`
 
-      A user within the organization. `name` and `email_address` are
-      null when the underlying account is unavailable or has been deleted;
-      `deleted` is true only for deleted accounts.
+      - `UserActor object`
 
-      - `type: "user_actor"`
+        A user within the organization. `name` and `email_address` are
+        null when the underlying account is unavailable or has been deleted;
+        `deleted` is true only for deleted accounts.
 
-        Actor type. Always `user_actor`.
+        - `type: "user_actor"`
 
-        default: user_actor
+          Actor type. Always `user_actor`.
 
-      - `deleted: boolean`
+          default: user_actor
 
-        True only when the underlying account has been deleted.
+        - `deleted: boolean`
 
-        default: false
+          True only when the underlying account has been deleted.
 
-      - `email_address: string or null`
+          default: false
 
-        The user's email address. Null when the account is unavailable or has been deleted.
+        - `email_address: string or null`
 
-      - `name: string or null`
+          The user's email address. Null when the account is unavailable or has been deleted.
 
-        The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
+        - `name: string or null`
 
-      - `user_id: string`
+          The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
 
-        Tagged ID of the user.
+        - `user_id: string`
+
+          Tagged ID of the user.
+
+      - `ScopedAPIKeyActor object`
+
+        A scoped Admin API key acting on behalf of the organization.
+
+        - `type: "scoped_api_key_actor"`
+
+          default: scoped_api_key_actor
+
+        - `scoped_api_key_id: string`
 
     - `amount: string or null`
 
@@ -90125,21 +90506,67 @@ Idempotent on `denied`; denying an already-`approved` request returns
 
       The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.
 
-    - `scope: object`
+    - `scope: User or SeatTier or RBACGroup or 3 more`
 
-      Scope selecting a single member of the organization.
+      - `User object`
 
-      - `type: "user"`
+        Scope selecting a single member of the organization.
 
-        Scope type. Always `user` for this scope.
+        - `type: "user"`
 
-        default: user
+          Scope type. Always `user` for this scope.
 
-      - `user_id: string`
+          default: user
 
-        Tagged ID of the member the spend limit applies to.
+        - `user_id: string`
+
+          Tagged ID of the member the spend limit applies to.
+
+      - `SeatTier object`
+
+        - `type: "seat_tier"`
+
+          default: seat_tier
+
+        - `seat_tier: string`
+
+      - `RBACGroup object`
+
+        - `type: "rbac_group"`
 
-    - `source: User or SeatTier or RBACGroup or 2 more`
+          default: rbac_group
+
+        - `rbac_group_id: string`
+
+      - `OrganizationService object`
+
+        - `type: "organization_service"`
+
+          default: organization_service
+
+        - `service: string`
+
+      - `Organization object`
+
+        - `type: "organization"`
+
+          default: organization
+
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
+    - `source: User or SeatTier or RBACGroup or 3 more`
 
       - `User object`
 
@@ -90185,6 +90612,20 @@ Idempotent on `denied`; denying an already-`approved` request returns
 
           default: organization
 
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
     - `spend_limit_id: string`
 
   - `status: "approved" or "denied" or "pending"`
diff --git a/content/en/api/beta/messages.md b/content/en/api/beta/messages.md
index 8d7a48a632..d59eb13535 100644
--- a/content/en/api/beta/messages.md
+++ b/content/en/api/beta/messages.md
@@ -1318,7 +1318,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
           - `BetaToolChangeMCPToolReference object`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `type: "mcp_tool_reference"`
@@ -1360,7 +1360,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
           - `BetaToolChangeMCPToolReference object`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
           - `BetaToolChangeMCPToolsetReference object`
@@ -7591,7 +7591,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
           - `BetaToolChangeMCPToolReference object`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `type: "mcp_tool_reference"`
@@ -7633,7 +7633,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
           - `BetaToolChangeMCPToolReference object`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
           - `BetaToolChangeMCPToolsetReference object`
@@ -16961,7 +16961,7 @@ curl https://api.anthropic.com/v1/messages/count_tokens \
 
       - `BetaToolChangeMCPToolReference object`
 
-        Reference to a single MCP tool by its server and remote name — the
+        Reference to a single MCP tool by its server and remote name; the
         same `server_name`/`name` pair `mcp_tool_use` carries.
 
         - `type: "mcp_tool_reference"`
@@ -17003,7 +17003,7 @@ curl https://api.anthropic.com/v1/messages/count_tokens \
 
       - `BetaToolChangeMCPToolReference object`
 
-        Reference to a single MCP tool by its server and remote name — the
+        Reference to a single MCP tool by its server and remote name; the
         same `server_name`/`name` pair `mcp_tool_use` carries.
 
       - `BetaToolChangeMCPToolsetReference object`
@@ -23603,7 +23603,7 @@ curl https://api.anthropic.com/v1/messages/count_tokens \
 
           - `BetaToolChangeMCPToolReference object`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `type: "mcp_tool_reference"`
@@ -23645,7 +23645,7 @@ curl https://api.anthropic.com/v1/messages/count_tokens \
 
           - `BetaToolChangeMCPToolReference object`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
           - `BetaToolChangeMCPToolsetReference object`
@@ -30434,7 +30434,7 @@ curl https://api.anthropic.com/v1/messages/count_tokens \
 
     - `BetaToolChangeMCPToolReference object`
 
-      Reference to a single MCP tool by its server and remote name — the
+      Reference to a single MCP tool by its server and remote name; the
       same `server_name`/`name` pair `mcp_tool_use` carries.
 
       - `type: "mcp_tool_reference"`
@@ -30501,7 +30501,7 @@ curl https://api.anthropic.com/v1/messages/count_tokens \
 
     - `BetaToolChangeMCPToolReference object`
 
-      Reference to a single MCP tool by its server and remote name — the
+      Reference to a single MCP tool by its server and remote name; the
       same `server_name`/`name` pair `mcp_tool_use` carries.
 
       - `type: "mcp_tool_reference"`
@@ -32401,7 +32401,7 @@ curl https://api.anthropic.com/v1/messages/count_tokens \
 
 - `BetaToolChangeMCPToolReference object`
 
-  Reference to a single MCP tool by its server and remote name — the
+  Reference to a single MCP tool by its server and remote name; the
   same `server_name`/`name` pair `mcp_tool_use` carries.
 
   - `type: "mcp_tool_reference"`
@@ -40138,7 +40138,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
               - `BetaToolChangeMCPToolReference object`
 
-                Reference to a single MCP tool by its server and remote name — the
+                Reference to a single MCP tool by its server and remote name; the
                 same `server_name`/`name` pair `mcp_tool_use` carries.
 
                 - `type: "mcp_tool_reference"`
@@ -40180,7 +40180,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
               - `BetaToolChangeMCPToolReference object`
 
-                Reference to a single MCP tool by its server and remote name — the
+                Reference to a single MCP tool by its server and remote name; the
                 same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `BetaToolChangeMCPToolsetReference object`
diff --git a/content/en/api/beta/messages/batches.md b/content/en/api/beta/messages/batches.md
index 6958c58fd1..2989cf3747 100644
--- a/content/en/api/beta/messages/batches.md
+++ b/content/en/api/beta/messages/batches.md
@@ -1338,7 +1338,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
               - `BetaToolChangeMCPToolReference object`
 
-                Reference to a single MCP tool by its server and remote name — the
+                Reference to a single MCP tool by its server and remote name; the
                 same `server_name`/`name` pair `mcp_tool_use` carries.
 
                 - `type: "mcp_tool_reference"`
@@ -1380,7 +1380,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
               - `BetaToolChangeMCPToolReference object`
 
-                Reference to a single MCP tool by its server and remote name — the
+                Reference to a single MCP tool by its server and remote name; the
                 same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `BetaToolChangeMCPToolsetReference object`
diff --git a/content/en/api/beta/messages/batches/create.md b/content/en/api/beta/messages/batches/create.md
index 5598dedd4a..e00bb46cf4 100644
--- a/content/en/api/beta/messages/batches/create.md
+++ b/content/en/api/beta/messages/batches/create.md
@@ -1336,7 +1336,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
               - `BetaToolChangeMCPToolReference object`
 
-                Reference to a single MCP tool by its server and remote name — the
+                Reference to a single MCP tool by its server and remote name; the
                 same `server_name`/`name` pair `mcp_tool_use` carries.
 
                 - `type: "mcp_tool_reference"`
@@ -1378,7 +1378,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
               - `BetaToolChangeMCPToolReference object`
 
-                Reference to a single MCP tool by its server and remote name — the
+                Reference to a single MCP tool by its server and remote name; the
                 same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `BetaToolChangeMCPToolsetReference object`
diff --git a/content/en/api/beta/messages/count_tokens.md b/content/en/api/beta/messages/count_tokens.md
index 3f3574f855..964ae2a21b 100644
--- a/content/en/api/beta/messages/count_tokens.md
+++ b/content/en/api/beta/messages/count_tokens.md
@@ -1304,7 +1304,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
           - `BetaToolChangeMCPToolReference object`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `type: "mcp_tool_reference"`
@@ -1346,7 +1346,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
           - `BetaToolChangeMCPToolReference object`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
           - `BetaToolChangeMCPToolsetReference object`
diff --git a/content/en/api/beta/messages/create.md b/content/en/api/beta/messages/create.md
index f12624e9d8..676a552bca 100644
--- a/content/en/api/beta/messages/create.md
+++ b/content/en/api/beta/messages/create.md
@@ -1316,7 +1316,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
           - `BetaToolChangeMCPToolReference object`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `type: "mcp_tool_reference"`
@@ -1358,7 +1358,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
           - `BetaToolChangeMCPToolReference object`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
           - `BetaToolChangeMCPToolsetReference object`
diff --git a/content/en/api/beta/organization.md b/content/en/api/beta/organization.md
index b86be03a91..5d114b7293 100644
--- a/content/en/api/beta/organization.md
+++ b/content/en/api/beta/organization.md
@@ -11736,7 +11736,7 @@ archived tunnels are excluded unless `include_archived` is set.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -11885,6 +11885,7 @@ archived tunnels are excluded unless `include_archived` is set.
 ```bash
 curl https://api.anthropic.com/v1/organizations/tunnels \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
@@ -11927,7 +11928,7 @@ Retrieve a single tunnel in the caller's organization by ID.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -12072,6 +12073,7 @@ Retrieve a single tunnel in the caller's organization by ID.
 ```bash
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
@@ -12114,7 +12116,7 @@ tunnel returns the existing record unchanged.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -12260,6 +12262,7 @@ tunnel returns the existing record unchanged.
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/archive \
     -X POST \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
@@ -12302,7 +12305,7 @@ access logs.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -12425,6 +12428,7 @@ access logs.
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/reveal_token \
     -X POST \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
@@ -12462,7 +12466,7 @@ restarted after rotation must use the new value. An optional
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -12593,6 +12597,7 @@ restarted after rotation must use the new value. An optional
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/rotate_token \
     -X POST \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
@@ -12633,7 +12638,7 @@ holds at most two non-archived certificates.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -12788,6 +12793,7 @@ holds at most two non-archived certificates.
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \
     -H 'Content-Type: application/json' \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY" \
     -d '{
           "ca_certificate_pem": "-----BEGIN CERTIFICATE-----\nMIIBexampleEXAMPLEexampleEXAMPLEexampleEXAMPLEexampleEXAMPLEexa\n...illustrative placeholder, not a real certificate...\n-----END CERTIFICATE-----\n"
@@ -12850,7 +12856,7 @@ Archived certificates are excluded unless `include_archived` is set.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -12999,6 +13005,7 @@ Archived certificates are excluded unless `include_archived` is set.
 ```bash
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
@@ -13045,7 +13052,7 @@ Retrieve a single certificate registered on a tunnel by ID.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -13190,6 +13197,7 @@ Retrieve a single certificate registered on a tunnel by ID.
 ```bash
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
@@ -13235,7 +13243,7 @@ certificate is added.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -13381,6 +13389,7 @@ certificate is added.
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID/archive \
     -X POST \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
@@ -16679,11 +16688,15 @@ curl https://api.anthropic.com/v1/organizations/analytics/artifacts \
 
 **POST** `/v1/organizations/spend_limits`
 
-Set a per-user spend limit override.
+Set a spend limit.
 
 Upsert keyed on (scope, period): setting a limit that already exists
-overwrites it in place. Only `scope.type: "user"` is accepted; seat-tier,
-group, and organization-level defaults are configured in claude.ai.
+overwrites it in place. A Claude Enterprise organization sets `user`
+limits. Its seat-tier, group, and organization-level defaults are configured
+in claude.ai. A Claude Console organization sets `organization` and
+`workspace` limits, which are monthly and always carry an amount. Setting those
+limits is in an early access preview. To request access, contact your
+Anthropic account team.
 
 #### Body parameters
 
@@ -16691,19 +16704,43 @@ group, and organization-level defaults are configured in claude.ai.
 
   Limit amount as a non-negative integer decimal string in the minor unit of the organization's billing currency (cents for USD): "50000" is $500.00. `null` sets an explicit no-limit override for this scope and `period` only — each period resolves independently, so caps for other periods still apply.
 
-- `scope: object`
+- `scope: User or Organization or Workspace`
 
-  Scope selecting a single member of the organization.
+  What the limit applies to. Claude Enterprise organizations set `user` limits. Claude Console organizations set `organization` and `workspace` limits. Any other combination returns 400. Setting `organization` and `workspace` limits through the API is in an early access preview. To request access, contact your Anthropic account team.
 
-  - `type: "user"`
+  - `User object`
 
-    Scope type. Always `user` for this scope.
+    Scope selecting a single member of the organization.
 
-    default: user
+    - `type: "user"`
 
-  - `user_id: string`
+      Scope type. Always `user` for this scope.
+
+      default: user
+
+    - `user_id: string`
+
+      Tagged ID of the member the spend limit applies to.
+
+  - `Organization object`
+
+    - `type: "organization"`
+
+      default: organization
 
-    Tagged ID of the member the spend limit applies to.
+  - `Workspace object`
+
+    Scope selecting one workspace of a Claude Console organization.
+
+    - `type: "workspace"`
+
+      Scope type. Always `workspace` for this scope.
+
+      default: workspace
+
+    - `workspace_id: string`
+
+      Tagged ID of the workspace the spend limit applies to.
 
 - `period: optional "daily" or "monthly" or "weekly"`
 
@@ -16753,7 +16790,7 @@ group, and organization-level defaults are configured in claude.ai.
 
     - `"weekly"`
 
-  - `scope: User or SeatTier or RBACGroup or 2 more`
+  - `scope: User or SeatTier or RBACGroup or 3 more`
 
     What the limit applies to. A tagged union on `type`; each variant carries the identifier for its scope.
 
@@ -16801,6 +16838,20 @@ group, and organization-level defaults are configured in claude.ai.
 
         default: organization
 
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
+
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
   - `updated_at: string`
 
     RFC 3339 datetime at which the spend limit was last modified.
@@ -16894,7 +16945,7 @@ Retrieve a spend limit by ID.
 
     - `"weekly"`
 
-  - `scope: User or SeatTier or RBACGroup or 2 more`
+  - `scope: User or SeatTier or RBACGroup or 3 more`
 
     What the limit applies to. A tagged union on `type`; each variant carries the identifier for its scope.
 
@@ -16942,6 +16993,20 @@ Retrieve a spend limit by ID.
 
         default: organization
 
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
+
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
   - `updated_at: string`
 
     RFC 3339 datetime at which the spend limit was last modified.
@@ -16978,11 +17043,13 @@ curl https://api.anthropic.com/v1/organizations/spend_limits/$SPEND_LIMIT_ID \
 
 **DELETE** `/v1/organizations/spend_limits/{spend_limit_id}`
 
-Delete a per-user spend limit override.
+Delete a spend limit.
 
-The member falls back to any inherited spend limit at that period.
-Seat-tier, group, and organization-level rows cannot be deleted via
-this endpoint.
+For a Claude Enterprise organization, this deletes a per-user override, and
+the member falls back to any inherited spend limit at that period. Its
+seat-tier, group, and organization-level rows cannot be deleted via this
+endpoint. A Claude Console organization deletes its organization and
+workspace limits. Deleting them through the API is in an early access preview.
 
 #### Path parameters
 
@@ -17060,35 +17127,47 @@ Paginates by member, so a member's periods never split across pages.
 
 - `data: array of BetaSpendSummary`
 
-  - `actor: object`
+  - `actor: UserActor or ScopedAPIKeyActor`
 
-    A user within the organization. `name` and `email_address` are
-    null when the underlying account is unavailable or has been deleted;
-    `deleted` is true only for deleted accounts.
+    - `UserActor object`
 
-    - `type: "user_actor"`
+      A user within the organization. `name` and `email_address` are
+      null when the underlying account is unavailable or has been deleted;
+      `deleted` is true only for deleted accounts.
 
-      Actor type. Always `user_actor`.
+      - `type: "user_actor"`
 
-      default: user_actor
+        Actor type. Always `user_actor`.
 
-    - `deleted: boolean`
+        default: user_actor
 
-      True only when the underlying account has been deleted.
+      - `deleted: boolean`
 
-      default: false
+        True only when the underlying account has been deleted.
 
-    - `email_address: string or null`
+        default: false
 
-      The user's email address. Null when the account is unavailable or has been deleted.
+      - `email_address: string or null`
 
-    - `name: string or null`
+        The user's email address. Null when the account is unavailable or has been deleted.
 
-      The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
+      - `name: string or null`
 
-    - `user_id: string`
+        The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
 
-      Tagged ID of the user.
+      - `user_id: string`
+
+        Tagged ID of the user.
+
+    - `ScopedAPIKeyActor object`
+
+      A scoped Admin API key acting on behalf of the organization.
+
+      - `type: "scoped_api_key_actor"`
+
+        default: scoped_api_key_actor
+
+      - `scoped_api_key_id: string`
 
   - `amount: string or null`
 
@@ -17112,21 +17191,67 @@ Paginates by member, so a member's periods never split across pages.
 
     The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.
 
-  - `scope: object`
+  - `scope: User or SeatTier or RBACGroup or 3 more`
 
-    Scope selecting a single member of the organization.
+    - `User object`
 
-    - `type: "user"`
+      Scope selecting a single member of the organization.
 
-      Scope type. Always `user` for this scope.
+      - `type: "user"`
 
-      default: user
+        Scope type. Always `user` for this scope.
 
-    - `user_id: string`
+        default: user
 
-      Tagged ID of the member the spend limit applies to.
+      - `user_id: string`
+
+        Tagged ID of the member the spend limit applies to.
+
+    - `SeatTier object`
+
+      - `type: "seat_tier"`
+
+        default: seat_tier
+
+      - `seat_tier: string`
+
+    - `RBACGroup object`
+
+      - `type: "rbac_group"`
+
+        default: rbac_group
+
+      - `rbac_group_id: string`
+
+    - `OrganizationService object`
+
+      - `type: "organization_service"`
+
+        default: organization_service
+
+      - `service: string`
+
+    - `Organization object`
+
+      - `type: "organization"`
+
+        default: organization
+
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
 
-  - `source: User or SeatTier or RBACGroup or 2 more`
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
+  - `source: User or SeatTier or RBACGroup or 3 more`
 
     - `User object`
 
@@ -17172,6 +17297,20 @@ Paginates by member, so a member's periods never split across pages.
 
         default: organization
 
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
+
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
   - `spend_limit_id: string`
 
 - `next_page: string or null`
@@ -17353,35 +17492,47 @@ Requests whose requester is no longer a member are excluded.
 
     Per-member effective-limit report row (`GET /spend_limits/effective`).
 
-    - `actor: object`
+    - `actor: UserActor or ScopedAPIKeyActor`
 
-      A user within the organization. `name` and `email_address` are
-      null when the underlying account is unavailable or has been deleted;
-      `deleted` is true only for deleted accounts.
+      - `UserActor object`
 
-      - `type: "user_actor"`
+        A user within the organization. `name` and `email_address` are
+        null when the underlying account is unavailable or has been deleted;
+        `deleted` is true only for deleted accounts.
 
-        Actor type. Always `user_actor`.
+        - `type: "user_actor"`
 
-        default: user_actor
+          Actor type. Always `user_actor`.
 
-      - `deleted: boolean`
+          default: user_actor
 
-        True only when the underlying account has been deleted.
+        - `deleted: boolean`
 
-        default: false
+          True only when the underlying account has been deleted.
 
-      - `email_address: string or null`
+          default: false
 
-        The user's email address. Null when the account is unavailable or has been deleted.
+        - `email_address: string or null`
 
-      - `name: string or null`
+          The user's email address. Null when the account is unavailable or has been deleted.
 
-        The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
+        - `name: string or null`
 
-      - `user_id: string`
+          The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
 
-        Tagged ID of the user.
+        - `user_id: string`
+
+          Tagged ID of the user.
+
+      - `ScopedAPIKeyActor object`
+
+        A scoped Admin API key acting on behalf of the organization.
+
+        - `type: "scoped_api_key_actor"`
+
+          default: scoped_api_key_actor
+
+        - `scoped_api_key_id: string`
 
     - `amount: string or null`
 
@@ -17405,21 +17556,67 @@ Requests whose requester is no longer a member are excluded.
 
       The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.
 
-    - `scope: object`
+    - `scope: User or SeatTier or RBACGroup or 3 more`
 
-      Scope selecting a single member of the organization.
+      - `User object`
 
-      - `type: "user"`
+        Scope selecting a single member of the organization.
 
-        Scope type. Always `user` for this scope.
+        - `type: "user"`
 
-        default: user
+          Scope type. Always `user` for this scope.
 
-      - `user_id: string`
+          default: user
 
-        Tagged ID of the member the spend limit applies to.
+        - `user_id: string`
+
+          Tagged ID of the member the spend limit applies to.
+
+      - `SeatTier object`
+
+        - `type: "seat_tier"`
+
+          default: seat_tier
+
+        - `seat_tier: string`
+
+      - `RBACGroup object`
+
+        - `type: "rbac_group"`
+
+          default: rbac_group
+
+        - `rbac_group_id: string`
+
+      - `OrganizationService object`
+
+        - `type: "organization_service"`
+
+          default: organization_service
+
+        - `service: string`
+
+      - `Organization object`
+
+        - `type: "organization"`
+
+          default: organization
+
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
 
-    - `source: User or SeatTier or RBACGroup or 2 more`
+    - `source: User or SeatTier or RBACGroup or 3 more`
 
       - `User object`
 
@@ -17465,6 +17662,20 @@ Requests whose requester is no longer a member are excluded.
 
           default: organization
 
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
     - `spend_limit_id: string`
 
   - `status: "approved" or "denied" or "pending"`
@@ -17656,35 +17867,47 @@ requester at the request's period.
 
     Per-member effective-limit report row (`GET /spend_limits/effective`).
 
-    - `actor: object`
+    - `actor: UserActor or ScopedAPIKeyActor`
 
-      A user within the organization. `name` and `email_address` are
-      null when the underlying account is unavailable or has been deleted;
-      `deleted` is true only for deleted accounts.
+      - `UserActor object`
 
-      - `type: "user_actor"`
+        A user within the organization. `name` and `email_address` are
+        null when the underlying account is unavailable or has been deleted;
+        `deleted` is true only for deleted accounts.
 
-        Actor type. Always `user_actor`.
+        - `type: "user_actor"`
 
-        default: user_actor
+          Actor type. Always `user_actor`.
 
-      - `deleted: boolean`
+          default: user_actor
 
-        True only when the underlying account has been deleted.
+        - `deleted: boolean`
 
-        default: false
+          True only when the underlying account has been deleted.
 
-      - `email_address: string or null`
+          default: false
 
-        The user's email address. Null when the account is unavailable or has been deleted.
+        - `email_address: string or null`
 
-      - `name: string or null`
+          The user's email address. Null when the account is unavailable or has been deleted.
 
-        The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
+        - `name: string or null`
 
-      - `user_id: string`
+          The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
 
-        Tagged ID of the user.
+        - `user_id: string`
+
+          Tagged ID of the user.
+
+      - `ScopedAPIKeyActor object`
+
+        A scoped Admin API key acting on behalf of the organization.
+
+        - `type: "scoped_api_key_actor"`
+
+          default: scoped_api_key_actor
+
+        - `scoped_api_key_id: string`
 
     - `amount: string or null`
 
@@ -17708,21 +17931,67 @@ requester at the request's period.
 
       The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.
 
-    - `scope: object`
+    - `scope: User or SeatTier or RBACGroup or 3 more`
 
-      Scope selecting a single member of the organization.
+      - `User object`
 
-      - `type: "user"`
+        Scope selecting a single member of the organization.
 
-        Scope type. Always `user` for this scope.
+        - `type: "user"`
 
-        default: user
+          Scope type. Always `user` for this scope.
 
-      - `user_id: string`
+          default: user
 
-        Tagged ID of the member the spend limit applies to.
+        - `user_id: string`
+
+          Tagged ID of the member the spend limit applies to.
+
+      - `SeatTier object`
+
+        - `type: "seat_tier"`
+
+          default: seat_tier
+
+        - `seat_tier: string`
+
+      - `RBACGroup object`
+
+        - `type: "rbac_group"`
 
-    - `source: User or SeatTier or RBACGroup or 2 more`
+          default: rbac_group
+
+        - `rbac_group_id: string`
+
+      - `OrganizationService object`
+
+        - `type: "organization_service"`
+
+          default: organization_service
+
+        - `service: string`
+
+      - `Organization object`
+
+        - `type: "organization"`
+
+          default: organization
+
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
+    - `source: User or SeatTier or RBACGroup or 3 more`
 
       - `User object`
 
@@ -17768,6 +18037,20 @@ requester at the request's period.
 
           default: organization
 
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
     - `spend_limit_id: string`
 
   - `status: "approved" or "denied" or "pending"`
@@ -18002,7 +18285,7 @@ the member was blocked on. Anthropic emails the requester unless
 
     - `"weekly"`
 
-  - `scope: User or SeatTier or RBACGroup or 2 more`
+  - `scope: User or SeatTier or RBACGroup or 3 more`
 
     What the limit applies to. A tagged union on `type`; each variant carries the identifier for its scope.
 
@@ -18050,6 +18333,20 @@ the member was blocked on. Anthropic emails the requester unless
 
         default: organization
 
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
+
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
   - `updated_at: string`
 
     RFC 3339 datetime at which the spend limit was last modified.
@@ -18060,35 +18357,47 @@ the member was blocked on. Anthropic emails the requester unless
 
   Per-member effective-limit report row (`GET /spend_limits/effective`).
 
-  - `actor: object`
+  - `actor: UserActor or ScopedAPIKeyActor`
 
-    A user within the organization. `name` and `email_address` are
-    null when the underlying account is unavailable or has been deleted;
-    `deleted` is true only for deleted accounts.
+    - `UserActor object`
 
-    - `type: "user_actor"`
+      A user within the organization. `name` and `email_address` are
+      null when the underlying account is unavailable or has been deleted;
+      `deleted` is true only for deleted accounts.
 
-      Actor type. Always `user_actor`.
+      - `type: "user_actor"`
 
-      default: user_actor
+        Actor type. Always `user_actor`.
 
-    - `deleted: boolean`
+        default: user_actor
 
-      True only when the underlying account has been deleted.
+      - `deleted: boolean`
 
-      default: false
+        True only when the underlying account has been deleted.
 
-    - `email_address: string or null`
+        default: false
 
-      The user's email address. Null when the account is unavailable or has been deleted.
+      - `email_address: string or null`
 
-    - `name: string or null`
+        The user's email address. Null when the account is unavailable or has been deleted.
 
-      The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
+      - `name: string or null`
 
-    - `user_id: string`
+        The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
 
-      Tagged ID of the user.
+      - `user_id: string`
+
+        Tagged ID of the user.
+
+    - `ScopedAPIKeyActor object`
+
+      A scoped Admin API key acting on behalf of the organization.
+
+      - `type: "scoped_api_key_actor"`
+
+        default: scoped_api_key_actor
+
+      - `scoped_api_key_id: string`
 
   - `amount: string or null`
 
@@ -18112,21 +18421,67 @@ the member was blocked on. Anthropic emails the requester unless
 
     The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.
 
-  - `scope: object`
+  - `scope: User or SeatTier or RBACGroup or 3 more`
 
-    Scope selecting a single member of the organization.
+    - `User object`
 
-    - `type: "user"`
+      Scope selecting a single member of the organization.
 
-      Scope type. Always `user` for this scope.
+      - `type: "user"`
 
-      default: user
+        Scope type. Always `user` for this scope.
 
-    - `user_id: string`
+        default: user
 
-      Tagged ID of the member the spend limit applies to.
+      - `user_id: string`
+
+        Tagged ID of the member the spend limit applies to.
 
-  - `source: User or SeatTier or RBACGroup or 2 more`
+    - `SeatTier object`
+
+      - `type: "seat_tier"`
+
+        default: seat_tier
+
+      - `seat_tier: string`
+
+    - `RBACGroup object`
+
+      - `type: "rbac_group"`
+
+        default: rbac_group
+
+      - `rbac_group_id: string`
+
+    - `OrganizationService object`
+
+      - `type: "organization_service"`
+
+        default: organization_service
+
+      - `service: string`
+
+    - `Organization object`
+
+      - `type: "organization"`
+
+        default: organization
+
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
+
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
+  - `source: User or SeatTier or RBACGroup or 3 more`
 
     - `User object`
 
@@ -18172,6 +18527,20 @@ the member was blocked on. Anthropic emails the requester unless
 
         default: organization
 
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
+
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
   - `spend_limit_id: string`
 
 - `status: "approved" or "denied" or "pending"`
@@ -18378,35 +18747,47 @@ Idempotent on `denied`; denying an already-`approved` request returns
 
     Per-member effective-limit report row (`GET /spend_limits/effective`).
 
-    - `actor: object`
+    - `actor: UserActor or ScopedAPIKeyActor`
 
-      A user within the organization. `name` and `email_address` are
-      null when the underlying account is unavailable or has been deleted;
-      `deleted` is true only for deleted accounts.
+      - `UserActor object`
 
-      - `type: "user_actor"`
+        A user within the organization. `name` and `email_address` are
+        null when the underlying account is unavailable or has been deleted;
+        `deleted` is true only for deleted accounts.
 
-        Actor type. Always `user_actor`.
+        - `type: "user_actor"`
 
-        default: user_actor
+          Actor type. Always `user_actor`.
 
-      - `deleted: boolean`
+          default: user_actor
 
-        True only when the underlying account has been deleted.
+        - `deleted: boolean`
 
-        default: false
+          True only when the underlying account has been deleted.
 
-      - `email_address: string or null`
+          default: false
 
-        The user's email address. Null when the account is unavailable or has been deleted.
+        - `email_address: string or null`
 
-      - `name: string or null`
+          The user's email address. Null when the account is unavailable or has been deleted.
 
-        The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
+        - `name: string or null`
 
-      - `user_id: string`
+          The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
 
-        Tagged ID of the user.
+        - `user_id: string`
+
+          Tagged ID of the user.
+
+      - `ScopedAPIKeyActor object`
+
+        A scoped Admin API key acting on behalf of the organization.
+
+        - `type: "scoped_api_key_actor"`
+
+          default: scoped_api_key_actor
+
+        - `scoped_api_key_id: string`
 
     - `amount: string or null`
 
@@ -18430,21 +18811,67 @@ Idempotent on `denied`; denying an already-`approved` request returns
 
       The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.
 
-    - `scope: object`
+    - `scope: User or SeatTier or RBACGroup or 3 more`
 
-      Scope selecting a single member of the organization.
+      - `User object`
 
-      - `type: "user"`
+        Scope selecting a single member of the organization.
 
-        Scope type. Always `user` for this scope.
+        - `type: "user"`
 
-        default: user
+          Scope type. Always `user` for this scope.
 
-      - `user_id: string`
+          default: user
 
-        Tagged ID of the member the spend limit applies to.
+        - `user_id: string`
+
+          Tagged ID of the member the spend limit applies to.
+
+      - `SeatTier object`
+
+        - `type: "seat_tier"`
+
+          default: seat_tier
+
+        - `seat_tier: string`
+
+      - `RBACGroup object`
+
+        - `type: "rbac_group"`
 
-    - `source: User or SeatTier or RBACGroup or 2 more`
+          default: rbac_group
+
+        - `rbac_group_id: string`
+
+      - `OrganizationService object`
+
+        - `type: "organization_service"`
+
+          default: organization_service
+
+        - `service: string`
+
+      - `Organization object`
+
+        - `type: "organization"`
+
+          default: organization
+
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
+    - `source: User or SeatTier or RBACGroup or 3 more`
 
       - `User object`
 
@@ -18490,6 +18917,20 @@ Idempotent on `denied`; denying an already-`approved` request returns
 
           default: organization
 
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
     - `spend_limit_id: string`
 
   - `status: "approved" or "denied" or "pending"`
diff --git a/content/en/api/beta/organization/mcp_tunnels.md b/content/en/api/beta/organization/mcp_tunnels.md
index 4fa85de621..2de3d4d172 100644
--- a/content/en/api/beta/organization/mcp_tunnels.md
+++ b/content/en/api/beta/organization/mcp_tunnels.md
@@ -48,7 +48,7 @@ archived tunnels are excluded unless `include_archived` is set.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -197,6 +197,7 @@ archived tunnels are excluded unless `include_archived` is set.
 ```bash
 curl https://api.anthropic.com/v1/organizations/tunnels \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
@@ -239,7 +240,7 @@ Retrieve a single tunnel in the caller's organization by ID.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -384,6 +385,7 @@ Retrieve a single tunnel in the caller's organization by ID.
 ```bash
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
@@ -426,7 +428,7 @@ tunnel returns the existing record unchanged.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -572,6 +574,7 @@ tunnel returns the existing record unchanged.
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/archive \
     -X POST \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
@@ -614,7 +617,7 @@ access logs.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -737,6 +740,7 @@ access logs.
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/reveal_token \
     -X POST \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
@@ -774,7 +778,7 @@ restarted after rotation must use the new value. An optional
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -905,6 +909,7 @@ restarted after rotation must use the new value. An optional
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/rotate_token \
     -X POST \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
@@ -1008,7 +1013,7 @@ holds at most two non-archived certificates.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -1163,6 +1168,7 @@ holds at most two non-archived certificates.
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \
     -H 'Content-Type: application/json' \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY" \
     -d '{
           "ca_certificate_pem": "-----BEGIN CERTIFICATE-----\nMIIBexampleEXAMPLEexampleEXAMPLEexampleEXAMPLEexampleEXAMPLEexa\n...illustrative placeholder, not a real certificate...\n-----END CERTIFICATE-----\n"
@@ -1225,7 +1231,7 @@ Archived certificates are excluded unless `include_archived` is set.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -1374,6 +1380,7 @@ Archived certificates are excluded unless `include_archived` is set.
 ```bash
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
@@ -1420,7 +1427,7 @@ Retrieve a single certificate registered on a tunnel by ID.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -1565,6 +1572,7 @@ Retrieve a single certificate registered on a tunnel by ID.
 ```bash
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
@@ -1610,7 +1618,7 @@ certificate is added.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -1756,6 +1764,7 @@ certificate is added.
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID/archive \
     -X POST \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
diff --git a/content/en/api/beta/organization/mcp_tunnels/archive.md b/content/en/api/beta/organization/mcp_tunnels/archive.md
index fef4aeb56f..46ba376ed6 100644
--- a/content/en/api/beta/organization/mcp_tunnels/archive.md
+++ b/content/en/api/beta/organization/mcp_tunnels/archive.md
@@ -28,7 +28,7 @@ tunnel returns the existing record unchanged.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -174,6 +174,7 @@ tunnel returns the existing record unchanged.
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/archive \
     -X POST \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
diff --git a/content/en/api/beta/organization/mcp_tunnels/list.md b/content/en/api/beta/organization/mcp_tunnels/list.md
index 16eba312f3..915faeef88 100644
--- a/content/en/api/beta/organization/mcp_tunnels/list.md
+++ b/content/en/api/beta/organization/mcp_tunnels/list.md
@@ -46,7 +46,7 @@ archived tunnels are excluded unless `include_archived` is set.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -195,6 +195,7 @@ archived tunnels are excluded unless `include_archived` is set.
 ```bash
 curl https://api.anthropic.com/v1/organizations/tunnels \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
diff --git a/content/en/api/beta/organization/mcp_tunnels/retrieve.md b/content/en/api/beta/organization/mcp_tunnels/retrieve.md
index 292f499af1..dea3b126e5 100644
--- a/content/en/api/beta/organization/mcp_tunnels/retrieve.md
+++ b/content/en/api/beta/organization/mcp_tunnels/retrieve.md
@@ -23,7 +23,7 @@ Retrieve a single tunnel in the caller's organization by ID.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -168,6 +168,7 @@ Retrieve a single tunnel in the caller's organization by ID.
 ```bash
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
diff --git a/content/en/api/beta/organization/mcp_tunnels/reveal_token.md b/content/en/api/beta/organization/mcp_tunnels/reveal_token.md
index 98f15a0698..965e0d0b18 100644
--- a/content/en/api/beta/organization/mcp_tunnels/reveal_token.md
+++ b/content/en/api/beta/organization/mcp_tunnels/reveal_token.md
@@ -28,7 +28,7 @@ access logs.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -151,6 +151,7 @@ access logs.
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/reveal_token \
     -X POST \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
diff --git a/content/en/api/beta/organization/mcp_tunnels/rotate_token.md b/content/en/api/beta/organization/mcp_tunnels/rotate_token.md
index c08cd16293..185961ad0e 100644
--- a/content/en/api/beta/organization/mcp_tunnels/rotate_token.md
+++ b/content/en/api/beta/organization/mcp_tunnels/rotate_token.md
@@ -27,7 +27,7 @@ restarted after rotation must use the new value. An optional
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -158,6 +158,7 @@ restarted after rotation must use the new value. An optional
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/rotate_token \
     -X POST \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
diff --git a/content/en/api/beta/organization/mcp_tunnels/tunnel_certificates.md b/content/en/api/beta/organization/mcp_tunnels/tunnel_certificates.md
index 78f35e4dfb..85838c965c 100644
--- a/content/en/api/beta/organization/mcp_tunnels/tunnel_certificates.md
+++ b/content/en/api/beta/organization/mcp_tunnels/tunnel_certificates.md
@@ -30,7 +30,7 @@ holds at most two non-archived certificates.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -185,6 +185,7 @@ holds at most two non-archived certificates.
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \
     -H 'Content-Type: application/json' \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY" \
     -d '{
           "ca_certificate_pem": "-----BEGIN CERTIFICATE-----\nMIIBexampleEXAMPLEexampleEXAMPLEexampleEXAMPLEexampleEXAMPLEexa\n...illustrative placeholder, not a real certificate...\n-----END CERTIFICATE-----\n"
@@ -247,7 +248,7 @@ Archived certificates are excluded unless `include_archived` is set.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -396,6 +397,7 @@ Archived certificates are excluded unless `include_archived` is set.
 ```bash
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
@@ -442,7 +444,7 @@ Retrieve a single certificate registered on a tunnel by ID.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -587,6 +589,7 @@ Retrieve a single certificate registered on a tunnel by ID.
 ```bash
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
@@ -632,7 +635,7 @@ certificate is added.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -778,6 +781,7 @@ certificate is added.
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID/archive \
     -X POST \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
diff --git a/content/en/api/beta/organization/mcp_tunnels/tunnel_certificates/archive.md b/content/en/api/beta/organization/mcp_tunnels/tunnel_certificates/archive.md
index 8d7e100235..12f175d0ed 100644
--- a/content/en/api/beta/organization/mcp_tunnels/tunnel_certificates/archive.md
+++ b/content/en/api/beta/organization/mcp_tunnels/tunnel_certificates/archive.md
@@ -31,7 +31,7 @@ certificate is added.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -177,6 +177,7 @@ certificate is added.
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID/archive \
     -X POST \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
diff --git a/content/en/api/beta/organization/mcp_tunnels/tunnel_certificates/create.md b/content/en/api/beta/organization/mcp_tunnels/tunnel_certificates/create.md
index e5d3bc0dc7..0e51716011 100644
--- a/content/en/api/beta/organization/mcp_tunnels/tunnel_certificates/create.md
+++ b/content/en/api/beta/organization/mcp_tunnels/tunnel_certificates/create.md
@@ -28,7 +28,7 @@ holds at most two non-archived certificates.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -183,6 +183,7 @@ holds at most two non-archived certificates.
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \
     -H 'Content-Type: application/json' \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY" \
     -d '{
           "ca_certificate_pem": "-----BEGIN CERTIFICATE-----\nMIIBexampleEXAMPLEexampleEXAMPLEexampleEXAMPLEexampleEXAMPLEexa\n...illustrative placeholder, not a real certificate...\n-----END CERTIFICATE-----\n"
diff --git a/content/en/api/beta/organization/mcp_tunnels/tunnel_certificates/list.md b/content/en/api/beta/organization/mcp_tunnels/tunnel_certificates/list.md
index 05b5fc553a..1c98b7489b 100644
--- a/content/en/api/beta/organization/mcp_tunnels/tunnel_certificates/list.md
+++ b/content/en/api/beta/organization/mcp_tunnels/tunnel_certificates/list.md
@@ -45,7 +45,7 @@ Archived certificates are excluded unless `include_archived` is set.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -194,6 +194,7 @@ Archived certificates are excluded unless `include_archived` is set.
 ```bash
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
diff --git a/content/en/api/beta/organization/mcp_tunnels/tunnel_certificates/retrieve.md b/content/en/api/beta/organization/mcp_tunnels/tunnel_certificates/retrieve.md
index 89dd3f3ac5..7fe952ac44 100644
--- a/content/en/api/beta/organization/mcp_tunnels/tunnel_certificates/retrieve.md
+++ b/content/en/api/beta/organization/mcp_tunnels/tunnel_certificates/retrieve.md
@@ -27,7 +27,7 @@ Retrieve a single certificate registered on a tunnel by ID.
 
 - `"anthropic-beta": array of AnthropicBeta`
 
-  Optional header to specify the beta version(s) you want to use.
+  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.
 
   - `string`
 
@@ -172,6 +172,7 @@ Retrieve a single certificate registered on a tunnel by ID.
 ```bash
 curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID \
     -H 'anthropic-version: 2023-06-01' \
+    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY"
 ```
 
diff --git a/content/en/api/beta/organization/spend_limits.md b/content/en/api/beta/organization/spend_limits.md
index ee041cbe3d..278b2d8a9b 100644
--- a/content/en/api/beta/organization/spend_limits.md
+++ b/content/en/api/beta/organization/spend_limits.md
@@ -9,11 +9,15 @@ url: https://platform.claude.com/docs/en/api/beta/organization/spend_limits
 
 **POST** `/v1/organizations/spend_limits`
 
-Set a per-user spend limit override.
+Set a spend limit.
 
 Upsert keyed on (scope, period): setting a limit that already exists
-overwrites it in place. Only `scope.type: "user"` is accepted; seat-tier,
-group, and organization-level defaults are configured in claude.ai.
+overwrites it in place. A Claude Enterprise organization sets `user`
+limits. Its seat-tier, group, and organization-level defaults are configured
+in claude.ai. A Claude Console organization sets `organization` and
+`workspace` limits, which are monthly and always carry an amount. Setting those
+limits is in an early access preview. To request access, contact your
+Anthropic account team.
 
 ### Body parameters
 
@@ -21,19 +25,43 @@ group, and organization-level defaults are configured in claude.ai.
 
   Limit amount as a non-negative integer decimal string in the minor unit of the organization's billing currency (cents for USD): "50000" is $500.00. `null` sets an explicit no-limit override for this scope and `period` only — each period resolves independently, so caps for other periods still apply.
 
-- `scope: object`
+- `scope: User or Organization or Workspace`
 
-  Scope selecting a single member of the organization.
+  What the limit applies to. Claude Enterprise organizations set `user` limits. Claude Console organizations set `organization` and `workspace` limits. Any other combination returns 400. Setting `organization` and `workspace` limits through the API is in an early access preview. To request access, contact your Anthropic account team.
 
-  - `type: "user"`
+  - `User object`
 
-    Scope type. Always `user` for this scope.
+    Scope selecting a single member of the organization.
 
-    default: user
+    - `type: "user"`
 
-  - `user_id: string`
+      Scope type. Always `user` for this scope.
+
+      default: user
+
+    - `user_id: string`
+
+      Tagged ID of the member the spend limit applies to.
+
+  - `Organization object`
+
+    - `type: "organization"`
+
+      default: organization
+
+  - `Workspace object`
+
+    Scope selecting one workspace of a Claude Console organization.
+
+    - `type: "workspace"`
 
-    Tagged ID of the member the spend limit applies to.
+      Scope type. Always `workspace` for this scope.
+
+      default: workspace
+
+    - `workspace_id: string`
+
+      Tagged ID of the workspace the spend limit applies to.
 
 - `period: optional "daily" or "monthly" or "weekly"`
 
@@ -83,7 +111,7 @@ group, and organization-level defaults are configured in claude.ai.
 
     - `"weekly"`
 
-  - `scope: User or SeatTier or RBACGroup or 2 more`
+  - `scope: User or SeatTier or RBACGroup or 3 more`
 
     What the limit applies to. A tagged union on `type`; each variant carries the identifier for its scope.
 
@@ -131,6 +159,20 @@ group, and organization-level defaults are configured in claude.ai.
 
         default: organization
 
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
+
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
   - `updated_at: string`
 
     RFC 3339 datetime at which the spend limit was last modified.
@@ -224,7 +266,7 @@ Retrieve a spend limit by ID.
 
     - `"weekly"`
 
-  - `scope: User or SeatTier or RBACGroup or 2 more`
+  - `scope: User or SeatTier or RBACGroup or 3 more`
 
     What the limit applies to. A tagged union on `type`; each variant carries the identifier for its scope.
 
@@ -272,6 +314,20 @@ Retrieve a spend limit by ID.
 
         default: organization
 
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
+
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
   - `updated_at: string`
 
     RFC 3339 datetime at which the spend limit was last modified.
@@ -308,11 +364,13 @@ curl https://api.anthropic.com/v1/organizations/spend_limits/$SPEND_LIMIT_ID \
 
 **DELETE** `/v1/organizations/spend_limits/{spend_limit_id}`
 
-Delete a per-user spend limit override.
+Delete a spend limit.
 
-The member falls back to any inherited spend limit at that period.
-Seat-tier, group, and organization-level rows cannot be deleted via
-this endpoint.
+For a Claude Enterprise organization, this deletes a per-user override, and
+the member falls back to any inherited spend limit at that period. Its
+seat-tier, group, and organization-level rows cannot be deleted via this
+endpoint. A Claude Console organization deletes its organization and
+workspace limits. Deleting them through the API is in an early access preview.
 
 ### Path parameters
 
@@ -390,35 +448,47 @@ Paginates by member, so a member's periods never split across pages.
 
 - `data: array of BetaSpendSummary`
 
-  - `actor: object`
+  - `actor: UserActor or ScopedAPIKeyActor`
 
-    A user within the organization. `name` and `email_address` are
-    null when the underlying account is unavailable or has been deleted;
-    `deleted` is true only for deleted accounts.
+    - `UserActor object`
 
-    - `type: "user_actor"`
+      A user within the organization. `name` and `email_address` are
+      null when the underlying account is unavailable or has been deleted;
+      `deleted` is true only for deleted accounts.
 
-      Actor type. Always `user_actor`.
+      - `type: "user_actor"`
 
-      default: user_actor
+        Actor type. Always `user_actor`.
 
-    - `deleted: boolean`
+        default: user_actor
 
-      True only when the underlying account has been deleted.
+      - `deleted: boolean`
 
-      default: false
+        True only when the underlying account has been deleted.
 
-    - `email_address: string or null`
+        default: false
 
-      The user's email address. Null when the account is unavailable or has been deleted.
+      - `email_address: string or null`
 
-    - `name: string or null`
+        The user's email address. Null when the account is unavailable or has been deleted.
 
-      The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
+      - `name: string or null`
 
-    - `user_id: string`
+        The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
 
-      Tagged ID of the user.
+      - `user_id: string`
+
+        Tagged ID of the user.
+
+    - `ScopedAPIKeyActor object`
+
+      A scoped Admin API key acting on behalf of the organization.
+
+      - `type: "scoped_api_key_actor"`
+
+        default: scoped_api_key_actor
+
+      - `scoped_api_key_id: string`
 
   - `amount: string or null`
 
@@ -442,21 +512,67 @@ Paginates by member, so a member's periods never split across pages.
 
     The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.
 
-  - `scope: object`
+  - `scope: User or SeatTier or RBACGroup or 3 more`
 
-    Scope selecting a single member of the organization.
+    - `User object`
 
-    - `type: "user"`
+      Scope selecting a single member of the organization.
 
-      Scope type. Always `user` for this scope.
+      - `type: "user"`
 
-      default: user
+        Scope type. Always `user` for this scope.
 
-    - `user_id: string`
+        default: user
 
-      Tagged ID of the member the spend limit applies to.
+      - `user_id: string`
+
+        Tagged ID of the member the spend limit applies to.
+
+    - `SeatTier object`
+
+      - `type: "seat_tier"`
+
+        default: seat_tier
 
-  - `source: User or SeatTier or RBACGroup or 2 more`
+      - `seat_tier: string`
+
+    - `RBACGroup object`
+
+      - `type: "rbac_group"`
+
+        default: rbac_group
+
+      - `rbac_group_id: string`
+
+    - `OrganizationService object`
+
+      - `type: "organization_service"`
+
+        default: organization_service
+
+      - `service: string`
+
+    - `Organization object`
+
+      - `type: "organization"`
+
+        default: organization
+
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
+
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
+  - `source: User or SeatTier or RBACGroup or 3 more`
 
     - `User object`
 
@@ -502,6 +618,20 @@ Paginates by member, so a member's periods never split across pages.
 
         default: organization
 
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
+
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
   - `spend_limit_id: string`
 
 - `next_page: string or null`
@@ -588,7 +718,7 @@ curl https://api.anthropic.com/v1/organizations/spend_limits/effective \
 
     - `"weekly"`
 
-  - `scope: User or SeatTier or RBACGroup or 2 more`
+  - `scope: User or SeatTier or RBACGroup or 3 more`
 
     What the limit applies to. A tagged union on `type`; each variant carries the identifier for its scope.
 
@@ -636,6 +766,20 @@ curl https://api.anthropic.com/v1/organizations/spend_limits/effective \
 
         default: organization
 
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
+
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
   - `updated_at: string`
 
     RFC 3339 datetime at which the spend limit was last modified.
@@ -648,35 +792,47 @@ curl https://api.anthropic.com/v1/organizations/spend_limits/effective \
 
   Per-member effective-limit report row (`GET /spend_limits/effective`).
 
-  - `actor: object`
+  - `actor: UserActor or ScopedAPIKeyActor`
 
-    A user within the organization. `name` and `email_address` are
-    null when the underlying account is unavailable or has been deleted;
-    `deleted` is true only for deleted accounts.
+    - `UserActor object`
 
-    - `type: "user_actor"`
+      A user within the organization. `name` and `email_address` are
+      null when the underlying account is unavailable or has been deleted;
+      `deleted` is true only for deleted accounts.
 
-      Actor type. Always `user_actor`.
+      - `type: "user_actor"`
 
-      default: user_actor
+        Actor type. Always `user_actor`.
 
-    - `deleted: boolean`
+        default: user_actor
 
-      True only when the underlying account has been deleted.
+      - `deleted: boolean`
 
-      default: false
+        True only when the underlying account has been deleted.
 
-    - `email_address: string or null`
+        default: false
 
-      The user's email address. Null when the account is unavailable or has been deleted.
+      - `email_address: string or null`
 
-    - `name: string or null`
+        The user's email address. Null when the account is unavailable or has been deleted.
 
-      The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
+      - `name: string or null`
 
-    - `user_id: string`
+        The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
 
-      Tagged ID of the user.
+      - `user_id: string`
+
+        Tagged ID of the user.
+
+    - `ScopedAPIKeyActor object`
+
+      A scoped Admin API key acting on behalf of the organization.
+
+      - `type: "scoped_api_key_actor"`
+
+        default: scoped_api_key_actor
+
+      - `scoped_api_key_id: string`
 
   - `amount: string or null`
 
@@ -700,21 +856,67 @@ curl https://api.anthropic.com/v1/organizations/spend_limits/effective \
 
     The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.
 
-  - `scope: object`
+  - `scope: User or SeatTier or RBACGroup or 3 more`
 
-    Scope selecting a single member of the organization.
+    - `User object`
 
-    - `type: "user"`
+      Scope selecting a single member of the organization.
 
-      Scope type. Always `user` for this scope.
+      - `type: "user"`
 
-      default: user
+        Scope type. Always `user` for this scope.
 
-    - `user_id: string`
+        default: user
 
-      Tagged ID of the member the spend limit applies to.
+      - `user_id: string`
+
+        Tagged ID of the member the spend limit applies to.
+
+    - `SeatTier object`
+
+      - `type: "seat_tier"`
+
+        default: seat_tier
+
+      - `seat_tier: string`
+
+    - `RBACGroup object`
+
+      - `type: "rbac_group"`
+
+        default: rbac_group
+
+      - `rbac_group_id: string`
+
+    - `OrganizationService object`
+
+      - `type: "organization_service"`
+
+        default: organization_service
+
+      - `service: string`
+
+    - `Organization object`
 
-  - `source: User or SeatTier or RBACGroup or 2 more`
+      - `type: "organization"`
+
+        default: organization
+
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
+
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
+  - `source: User or SeatTier or RBACGroup or 3 more`
 
     - `User object`
 
@@ -760,6 +962,20 @@ curl https://api.anthropic.com/v1/organizations/spend_limits/effective \
 
         default: organization
 
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
+
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
   - `spend_limit_id: string`
 
 ### Spend Limit Delete Response
@@ -909,35 +1125,47 @@ Requests whose requester is no longer a member are excluded.
 
     Per-member effective-limit report row (`GET /spend_limits/effective`).
 
-    - `actor: object`
+    - `actor: UserActor or ScopedAPIKeyActor`
 
-      A user within the organization. `name` and `email_address` are
-      null when the underlying account is unavailable or has been deleted;
-      `deleted` is true only for deleted accounts.
+      - `UserActor object`
 
-      - `type: "user_actor"`
+        A user within the organization. `name` and `email_address` are
+        null when the underlying account is unavailable or has been deleted;
+        `deleted` is true only for deleted accounts.
 
-        Actor type. Always `user_actor`.
+        - `type: "user_actor"`
 
-        default: user_actor
+          Actor type. Always `user_actor`.
 
-      - `deleted: boolean`
+          default: user_actor
 
-        True only when the underlying account has been deleted.
+        - `deleted: boolean`
 
-        default: false
+          True only when the underlying account has been deleted.
 
-      - `email_address: string or null`
+          default: false
 
-        The user's email address. Null when the account is unavailable or has been deleted.
+        - `email_address: string or null`
 
-      - `name: string or null`
+          The user's email address. Null when the account is unavailable or has been deleted.
 
-        The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
+        - `name: string or null`
 
-      - `user_id: string`
+          The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
 
-        Tagged ID of the user.
+        - `user_id: string`
+
+          Tagged ID of the user.
+
+      - `ScopedAPIKeyActor object`
+
+        A scoped Admin API key acting on behalf of the organization.
+
+        - `type: "scoped_api_key_actor"`
+
+          default: scoped_api_key_actor
+
+        - `scoped_api_key_id: string`
 
     - `amount: string or null`
 
@@ -961,21 +1189,67 @@ Requests whose requester is no longer a member are excluded.
 
       The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.
 
-    - `scope: object`
+    - `scope: User or SeatTier or RBACGroup or 3 more`
 
-      Scope selecting a single member of the organization.
+      - `User object`
 
-      - `type: "user"`
+        Scope selecting a single member of the organization.
 
-        Scope type. Always `user` for this scope.
+        - `type: "user"`
 
-        default: user
+          Scope type. Always `user` for this scope.
 
-      - `user_id: string`
+          default: user
 
-        Tagged ID of the member the spend limit applies to.
+        - `user_id: string`
+
+          Tagged ID of the member the spend limit applies to.
+
+      - `SeatTier object`
+
+        - `type: "seat_tier"`
+
+          default: seat_tier
+
+        - `seat_tier: string`
+
+      - `RBACGroup object`
+
+        - `type: "rbac_group"`
+
+          default: rbac_group
+
+        - `rbac_group_id: string`
+
+      - `OrganizationService object`
+
+        - `type: "organization_service"`
 
-    - `source: User or SeatTier or RBACGroup or 2 more`
+          default: organization_service
+
+        - `service: string`
+
+      - `Organization object`
+
+        - `type: "organization"`
+
+          default: organization
+
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
+    - `source: User or SeatTier or RBACGroup or 3 more`
 
       - `User object`
 
@@ -1021,6 +1295,20 @@ Requests whose requester is no longer a member are excluded.
 
           default: organization
 
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
     - `spend_limit_id: string`
 
   - `status: "approved" or "denied" or "pending"`
@@ -1212,35 +1500,47 @@ requester at the request's period.
 
     Per-member effective-limit report row (`GET /spend_limits/effective`).
 
-    - `actor: object`
+    - `actor: UserActor or ScopedAPIKeyActor`
 
-      A user within the organization. `name` and `email_address` are
-      null when the underlying account is unavailable or has been deleted;
-      `deleted` is true only for deleted accounts.
+      - `UserActor object`
 
-      - `type: "user_actor"`
+        A user within the organization. `name` and `email_address` are
+        null when the underlying account is unavailable or has been deleted;
+        `deleted` is true only for deleted accounts.
 
-        Actor type. Always `user_actor`.
+        - `type: "user_actor"`
 
-        default: user_actor
+          Actor type. Always `user_actor`.
 
-      - `deleted: boolean`
+          default: user_actor
 
-        True only when the underlying account has been deleted.
+        - `deleted: boolean`
 
-        default: false
+          True only when the underlying account has been deleted.
 
-      - `email_address: string or null`
+          default: false
 
-        The user's email address. Null when the account is unavailable or has been deleted.
+        - `email_address: string or null`
 
-      - `name: string or null`
+          The user's email address. Null when the account is unavailable or has been deleted.
 
-        The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
+        - `name: string or null`
 
-      - `user_id: string`
+          The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
 
-        Tagged ID of the user.
+        - `user_id: string`
+
+          Tagged ID of the user.
+
+      - `ScopedAPIKeyActor object`
+
+        A scoped Admin API key acting on behalf of the organization.
+
+        - `type: "scoped_api_key_actor"`
+
+          default: scoped_api_key_actor
+
+        - `scoped_api_key_id: string`
 
     - `amount: string or null`
 
@@ -1264,21 +1564,67 @@ requester at the request's period.
 
       The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.
 
-    - `scope: object`
+    - `scope: User or SeatTier or RBACGroup or 3 more`
 
-      Scope selecting a single member of the organization.
+      - `User object`
 
-      - `type: "user"`
+        Scope selecting a single member of the organization.
 
-        Scope type. Always `user` for this scope.
+        - `type: "user"`
 
-        default: user
+          Scope type. Always `user` for this scope.
 
-      - `user_id: string`
+          default: user
 
-        Tagged ID of the member the spend limit applies to.
+        - `user_id: string`
+
+          Tagged ID of the member the spend limit applies to.
+
+      - `SeatTier object`
+
+        - `type: "seat_tier"`
+
+          default: seat_tier
 
-    - `source: User or SeatTier or RBACGroup or 2 more`
+        - `seat_tier: string`
+
+      - `RBACGroup object`
+
+        - `type: "rbac_group"`
+
+          default: rbac_group
+
+        - `rbac_group_id: string`
+
+      - `OrganizationService object`
+
+        - `type: "organization_service"`
+
+          default: organization_service
+
+        - `service: string`
+
+      - `Organization object`
+
+        - `type: "organization"`
+
+          default: organization
+
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
+    - `source: User or SeatTier or RBACGroup or 3 more`
 
       - `User object`
 
@@ -1324,6 +1670,20 @@ requester at the request's period.
 
           default: organization
 
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
     - `spend_limit_id: string`
 
   - `status: "approved" or "denied" or "pending"`
@@ -1558,7 +1918,7 @@ the member was blocked on. Anthropic emails the requester unless
 
     - `"weekly"`
 
-  - `scope: User or SeatTier or RBACGroup or 2 more`
+  - `scope: User or SeatTier or RBACGroup or 3 more`
 
     What the limit applies to. A tagged union on `type`; each variant carries the identifier for its scope.
 
@@ -1606,6 +1966,20 @@ the member was blocked on. Anthropic emails the requester unless
 
         default: organization
 
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
+
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
   - `updated_at: string`
 
     RFC 3339 datetime at which the spend limit was last modified.
@@ -1616,35 +1990,47 @@ the member was blocked on. Anthropic emails the requester unless
 
   Per-member effective-limit report row (`GET /spend_limits/effective`).
 
-  - `actor: object`
+  - `actor: UserActor or ScopedAPIKeyActor`
 
-    A user within the organization. `name` and `email_address` are
-    null when the underlying account is unavailable or has been deleted;
-    `deleted` is true only for deleted accounts.
+    - `UserActor object`
 
-    - `type: "user_actor"`
+      A user within the organization. `name` and `email_address` are
+      null when the underlying account is unavailable or has been deleted;
+      `deleted` is true only for deleted accounts.
 
-      Actor type. Always `user_actor`.
+      - `type: "user_actor"`
 
-      default: user_actor
+        Actor type. Always `user_actor`.
 
-    - `deleted: boolean`
+        default: user_actor
 
-      True only when the underlying account has been deleted.
+      - `deleted: boolean`
 
-      default: false
+        True only when the underlying account has been deleted.
 
-    - `email_address: string or null`
+        default: false
 
-      The user's email address. Null when the account is unavailable or has been deleted.
+      - `email_address: string or null`
 
-    - `name: string or null`
+        The user's email address. Null when the account is unavailable or has been deleted.
 
-      The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
+      - `name: string or null`
 
-    - `user_id: string`
+        The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
 
-      Tagged ID of the user.
+      - `user_id: string`
+
+        Tagged ID of the user.
+
+    - `ScopedAPIKeyActor object`
+
+      A scoped Admin API key acting on behalf of the organization.
+
+      - `type: "scoped_api_key_actor"`
+
+        default: scoped_api_key_actor
+
+      - `scoped_api_key_id: string`
 
   - `amount: string or null`
 
@@ -1668,21 +2054,67 @@ the member was blocked on. Anthropic emails the requester unless
 
     The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.
 
-  - `scope: object`
+  - `scope: User or SeatTier or RBACGroup or 3 more`
 
-    Scope selecting a single member of the organization.
+    - `User object`
 
-    - `type: "user"`
+      Scope selecting a single member of the organization.
 
-      Scope type. Always `user` for this scope.
+      - `type: "user"`
 
-      default: user
+        Scope type. Always `user` for this scope.
 
-    - `user_id: string`
+        default: user
 
-      Tagged ID of the member the spend limit applies to.
+      - `user_id: string`
+
+        Tagged ID of the member the spend limit applies to.
+
+    - `SeatTier object`
+
+      - `type: "seat_tier"`
+
+        default: seat_tier
+
+      - `seat_tier: string`
+
+    - `RBACGroup object`
+
+      - `type: "rbac_group"`
+
+        default: rbac_group
+
+      - `rbac_group_id: string`
+
+    - `OrganizationService object`
+
+      - `type: "organization_service"`
 
-  - `source: User or SeatTier or RBACGroup or 2 more`
+        default: organization_service
+
+      - `service: string`
+
+    - `Organization object`
+
+      - `type: "organization"`
+
+        default: organization
+
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
+
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
+  - `source: User or SeatTier or RBACGroup or 3 more`
 
     - `User object`
 
@@ -1728,6 +2160,20 @@ the member was blocked on. Anthropic emails the requester unless
 
         default: organization
 
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
+
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
   - `spend_limit_id: string`
 
 - `status: "approved" or "denied" or "pending"`
@@ -1934,35 +2380,47 @@ Idempotent on `denied`; denying an already-`approved` request returns
 
     Per-member effective-limit report row (`GET /spend_limits/effective`).
 
-    - `actor: object`
+    - `actor: UserActor or ScopedAPIKeyActor`
 
-      A user within the organization. `name` and `email_address` are
-      null when the underlying account is unavailable or has been deleted;
-      `deleted` is true only for deleted accounts.
+      - `UserActor object`
 
-      - `type: "user_actor"`
+        A user within the organization. `name` and `email_address` are
+        null when the underlying account is unavailable or has been deleted;
+        `deleted` is true only for deleted accounts.
 
-        Actor type. Always `user_actor`.
+        - `type: "user_actor"`
 
-        default: user_actor
+          Actor type. Always `user_actor`.
 
-      - `deleted: boolean`
+          default: user_actor
 
-        True only when the underlying account has been deleted.
+        - `deleted: boolean`
 
-        default: false
+          True only when the underlying account has been deleted.
 
-      - `email_address: string or null`
+          default: false
 
-        The user's email address. Null when the account is unavailable or has been deleted.
+        - `email_address: string or null`
 
-      - `name: string or null`
+          The user's email address. Null when the account is unavailable or has been deleted.
 
-        The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
+        - `name: string or null`
 
-      - `user_id: string`
+          The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
 
-        Tagged ID of the user.
+        - `user_id: string`
+
+          Tagged ID of the user.
+
+      - `ScopedAPIKeyActor object`
+
+        A scoped Admin API key acting on behalf of the organization.
+
+        - `type: "scoped_api_key_actor"`
+
+          default: scoped_api_key_actor
+
+        - `scoped_api_key_id: string`
 
     - `amount: string or null`
 
@@ -1986,21 +2444,67 @@ Idempotent on `denied`; denying an already-`approved` request returns
 
       The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.
 
-    - `scope: object`
+    - `scope: User or SeatTier or RBACGroup or 3 more`
 
-      Scope selecting a single member of the organization.
+      - `User object`
 
-      - `type: "user"`
+        Scope selecting a single member of the organization.
 
-        Scope type. Always `user` for this scope.
+        - `type: "user"`
 
-        default: user
+          Scope type. Always `user` for this scope.
 
-      - `user_id: string`
+          default: user
 
-        Tagged ID of the member the spend limit applies to.
+        - `user_id: string`
 
-    - `source: User or SeatTier or RBACGroup or 2 more`
+          Tagged ID of the member the spend limit applies to.
+
+      - `SeatTier object`
+
+        - `type: "seat_tier"`
+
+          default: seat_tier
+
+        - `seat_tier: string`
+
+      - `RBACGroup object`
+
+        - `type: "rbac_group"`
+
+          default: rbac_group
+
+        - `rbac_group_id: string`
+
+      - `OrganizationService object`
+
+        - `type: "organization_service"`
+
+          default: organization_service
+
+        - `service: string`
+
+      - `Organization object`
+
+        - `type: "organization"`
+
+          default: organization
+
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
+    - `source: User or SeatTier or RBACGroup or 3 more`
 
       - `User object`
 
@@ -2046,6 +2550,20 @@ Idempotent on `denied`; denying an already-`approved` request returns
 
           default: organization
 
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
     - `spend_limit_id: string`
 
   - `status: "approved" or "denied" or "pending"`
diff --git a/content/en/api/beta/organization/spend_limits/create.md b/content/en/api/beta/organization/spend_limits/create.md
index 2c44b36d6c..b47d752173 100644
--- a/content/en/api/beta/organization/spend_limits/create.md
+++ b/content/en/api/beta/organization/spend_limits/create.md
@@ -7,11 +7,15 @@ url: https://platform.claude.com/docs/en/api/beta/organization/spend_limits/crea
 
 **POST** `/v1/organizations/spend_limits`
 
-Set a per-user spend limit override.
+Set a spend limit.
 
 Upsert keyed on (scope, period): setting a limit that already exists
-overwrites it in place. Only `scope.type: "user"` is accepted; seat-tier,
-group, and organization-level defaults are configured in claude.ai.
+overwrites it in place. A Claude Enterprise organization sets `user`
+limits. Its seat-tier, group, and organization-level defaults are configured
+in claude.ai. A Claude Console organization sets `organization` and
+`workspace` limits, which are monthly and always carry an amount. Setting those
+limits is in an early access preview. To request access, contact your
+Anthropic account team.
 
 ## Body parameters
 
@@ -19,19 +23,43 @@ group, and organization-level defaults are configured in claude.ai.
 
   Limit amount as a non-negative integer decimal string in the minor unit of the organization's billing currency (cents for USD): "50000" is $500.00. `null` sets an explicit no-limit override for this scope and `period` only — each period resolves independently, so caps for other periods still apply.
 
-- `scope: object`
+- `scope: User or Organization or Workspace`
 
-  Scope selecting a single member of the organization.
+  What the limit applies to. Claude Enterprise organizations set `user` limits. Claude Console organizations set `organization` and `workspace` limits. Any other combination returns 400. Setting `organization` and `workspace` limits through the API is in an early access preview. To request access, contact your Anthropic account team.
 
-  - `type: "user"`
+  - `User object`
 
-    Scope type. Always `user` for this scope.
+    Scope selecting a single member of the organization.
 
-    default: user
+    - `type: "user"`
 
-  - `user_id: string`
+      Scope type. Always `user` for this scope.
 
-    Tagged ID of the member the spend limit applies to.
+      default: user
+
+    - `user_id: string`
+
+      Tagged ID of the member the spend limit applies to.
+
+  - `Organization object`
+
+    - `type: "organization"`
+
+      default: organization
+
+  - `Workspace object`
+
+    Scope selecting one workspace of a Claude Console organization.
+
+    - `type: "workspace"`
+
+      Scope type. Always `workspace` for this scope.
+
+      default: workspace
+
+    - `workspace_id: string`
+
+      Tagged ID of the workspace the spend limit applies to.
 
 - `period: optional "daily" or "monthly" or "weekly"`
 
@@ -81,7 +109,7 @@ group, and organization-level defaults are configured in claude.ai.
 
     - `"weekly"`
 
-  - `scope: User or SeatTier or RBACGroup or 2 more`
+  - `scope: User or SeatTier or RBACGroup or 3 more`
 
     What the limit applies to. A tagged union on `type`; each variant carries the identifier for its scope.
 
@@ -129,6 +157,20 @@ group, and organization-level defaults are configured in claude.ai.
 
         default: organization
 
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
+
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
   - `updated_at: string`
 
     RFC 3339 datetime at which the spend limit was last modified.
diff --git a/content/en/api/beta/organization/spend_limits/delete.md b/content/en/api/beta/organization/spend_limits/delete.md
index f09e86ad51..daec575f62 100644
--- a/content/en/api/beta/organization/spend_limits/delete.md
+++ b/content/en/api/beta/organization/spend_limits/delete.md
@@ -7,11 +7,13 @@ url: https://platform.claude.com/docs/en/api/beta/organization/spend_limits/dele
 
 **DELETE** `/v1/organizations/spend_limits/{spend_limit_id}`
 
-Delete a per-user spend limit override.
+Delete a spend limit.
 
-The member falls back to any inherited spend limit at that period.
-Seat-tier, group, and organization-level rows cannot be deleted via
-this endpoint.
+For a Claude Enterprise organization, this deletes a per-user override, and
+the member falls back to any inherited spend limit at that period. Its
+seat-tier, group, and organization-level rows cannot be deleted via this
+endpoint. A Claude Console organization deletes its organization and
+workspace limits. Deleting them through the API is in an early access preview.
 
 ## Path parameters
 
diff --git a/content/en/api/beta/organization/spend_limits/increase_requests.md b/content/en/api/beta/organization/spend_limits/increase_requests.md
index 549edbd512..adb071103b 100644
--- a/content/en/api/beta/organization/spend_limits/increase_requests.md
+++ b/content/en/api/beta/organization/spend_limits/increase_requests.md
@@ -140,35 +140,47 @@ Requests whose requester is no longer a member are excluded.
 
     Per-member effective-limit report row (`GET /spend_limits/effective`).
 
-    - `actor: object`
+    - `actor: UserActor or ScopedAPIKeyActor`
 
-      A user within the organization. `name` and `email_address` are
-      null when the underlying account is unavailable or has been deleted;
-      `deleted` is true only for deleted accounts.
+      - `UserActor object`
 
-      - `type: "user_actor"`
+        A user within the organization. `name` and `email_address` are
+        null when the underlying account is unavailable or has been deleted;
+        `deleted` is true only for deleted accounts.
 
-        Actor type. Always `user_actor`.
+        - `type: "user_actor"`
 
-        default: user_actor
+          Actor type. Always `user_actor`.
 
-      - `deleted: boolean`
+          default: user_actor
 
-        True only when the underlying account has been deleted.
+        - `deleted: boolean`
 
-        default: false
+          True only when the underlying account has been deleted.
 
-      - `email_address: string or null`
+          default: false
 
-        The user's email address. Null when the account is unavailable or has been deleted.
+        - `email_address: string or null`
 
-      - `name: string or null`
+          The user's email address. Null when the account is unavailable or has been deleted.
 
-        The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
+        - `name: string or null`
 
-      - `user_id: string`
+          The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
 
-        Tagged ID of the user.
+        - `user_id: string`
+
+          Tagged ID of the user.
+
+      - `ScopedAPIKeyActor object`
+
+        A scoped Admin API key acting on behalf of the organization.
+
+        - `type: "scoped_api_key_actor"`
+
+          default: scoped_api_key_actor
+
+        - `scoped_api_key_id: string`
 
     - `amount: string or null`
 
@@ -192,21 +204,67 @@ Requests whose requester is no longer a member are excluded.
 
       The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.
 
-    - `scope: object`
+    - `scope: User or SeatTier or RBACGroup or 3 more`
 
-      Scope selecting a single member of the organization.
+      - `User object`
 
-      - `type: "user"`
+        Scope selecting a single member of the organization.
 
-        Scope type. Always `user` for this scope.
+        - `type: "user"`
 
-        default: user
+          Scope type. Always `user` for this scope.
 
-      - `user_id: string`
+          default: user
 
-        Tagged ID of the member the spend limit applies to.
+        - `user_id: string`
+
+          Tagged ID of the member the spend limit applies to.
+
+      - `SeatTier object`
+
+        - `type: "seat_tier"`
+
+          default: seat_tier
+
+        - `seat_tier: string`
+
+      - `RBACGroup object`
+
+        - `type: "rbac_group"`
+
+          default: rbac_group
+
+        - `rbac_group_id: string`
+
+      - `OrganizationService object`
+
+        - `type: "organization_service"`
+
+          default: organization_service
+
+        - `service: string`
+
+      - `Organization object`
+
+        - `type: "organization"`
 
-    - `source: User or SeatTier or RBACGroup or 2 more`
+          default: organization
+
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
+    - `source: User or SeatTier or RBACGroup or 3 more`
 
       - `User object`
 
@@ -252,6 +310,20 @@ Requests whose requester is no longer a member are excluded.
 
           default: organization
 
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
     - `spend_limit_id: string`
 
   - `status: "approved" or "denied" or "pending"`
@@ -443,35 +515,47 @@ requester at the request's period.
 
     Per-member effective-limit report row (`GET /spend_limits/effective`).
 
-    - `actor: object`
+    - `actor: UserActor or ScopedAPIKeyActor`
 
-      A user within the organization. `name` and `email_address` are
-      null when the underlying account is unavailable or has been deleted;
-      `deleted` is true only for deleted accounts.
+      - `UserActor object`
 
-      - `type: "user_actor"`
+        A user within the organization. `name` and `email_address` are
+        null when the underlying account is unavailable or has been deleted;
+        `deleted` is true only for deleted accounts.
 
-        Actor type. Always `user_actor`.
+        - `type: "user_actor"`
 
-        default: user_actor
+          Actor type. Always `user_actor`.
 
-      - `deleted: boolean`
+          default: user_actor
 
-        True only when the underlying account has been deleted.
+        - `deleted: boolean`
 
-        default: false
+          True only when the underlying account has been deleted.
 
-      - `email_address: string or null`
+          default: false
 
-        The user's email address. Null when the account is unavailable or has been deleted.
+        - `email_address: string or null`
 
-      - `name: string or null`
+          The user's email address. Null when the account is unavailable or has been deleted.
 
-        The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
+        - `name: string or null`
 
-      - `user_id: string`
+          The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
 
-        Tagged ID of the user.
+        - `user_id: string`
+
+          Tagged ID of the user.
+
+      - `ScopedAPIKeyActor object`
+
+        A scoped Admin API key acting on behalf of the organization.
+
+        - `type: "scoped_api_key_actor"`
+
+          default: scoped_api_key_actor
+
+        - `scoped_api_key_id: string`
 
     - `amount: string or null`
 
@@ -495,21 +579,67 @@ requester at the request's period.
 
       The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.
 
-    - `scope: object`
+    - `scope: User or SeatTier or RBACGroup or 3 more`
 
-      Scope selecting a single member of the organization.
+      - `User object`
 
-      - `type: "user"`
+        Scope selecting a single member of the organization.
 
-        Scope type. Always `user` for this scope.
+        - `type: "user"`
 
-        default: user
+          Scope type. Always `user` for this scope.
 
-      - `user_id: string`
+          default: user
 
-        Tagged ID of the member the spend limit applies to.
+        - `user_id: string`
+
+          Tagged ID of the member the spend limit applies to.
+
+      - `SeatTier object`
+
+        - `type: "seat_tier"`
 
-    - `source: User or SeatTier or RBACGroup or 2 more`
+          default: seat_tier
+
+        - `seat_tier: string`
+
+      - `RBACGroup object`
+
+        - `type: "rbac_group"`
+
+          default: rbac_group
+
+        - `rbac_group_id: string`
+
+      - `OrganizationService object`
+
+        - `type: "organization_service"`
+
+          default: organization_service
+
+        - `service: string`
+
+      - `Organization object`
+
+        - `type: "organization"`
+
+          default: organization
+
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
+    - `source: User or SeatTier or RBACGroup or 3 more`
 
       - `User object`
 
@@ -555,6 +685,20 @@ requester at the request's period.
 
           default: organization
 
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
     - `spend_limit_id: string`
 
   - `status: "approved" or "denied" or "pending"`
@@ -789,7 +933,7 @@ the member was blocked on. Anthropic emails the requester unless
 
     - `"weekly"`
 
-  - `scope: User or SeatTier or RBACGroup or 2 more`
+  - `scope: User or SeatTier or RBACGroup or 3 more`
 
     What the limit applies to. A tagged union on `type`; each variant carries the identifier for its scope.
 
@@ -837,6 +981,20 @@ the member was blocked on. Anthropic emails the requester unless
 
         default: organization
 
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
+
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
   - `updated_at: string`
 
     RFC 3339 datetime at which the spend limit was last modified.
@@ -847,35 +1005,47 @@ the member was blocked on. Anthropic emails the requester unless
 
   Per-member effective-limit report row (`GET /spend_limits/effective`).
 
-  - `actor: object`
+  - `actor: UserActor or ScopedAPIKeyActor`
 
-    A user within the organization. `name` and `email_address` are
-    null when the underlying account is unavailable or has been deleted;
-    `deleted` is true only for deleted accounts.
+    - `UserActor object`
 
-    - `type: "user_actor"`
+      A user within the organization. `name` and `email_address` are
+      null when the underlying account is unavailable or has been deleted;
+      `deleted` is true only for deleted accounts.
 
-      Actor type. Always `user_actor`.
+      - `type: "user_actor"`
 
-      default: user_actor
+        Actor type. Always `user_actor`.
 
-    - `deleted: boolean`
+        default: user_actor
 
-      True only when the underlying account has been deleted.
+      - `deleted: boolean`
 
-      default: false
+        True only when the underlying account has been deleted.
 
-    - `email_address: string or null`
+        default: false
 
-      The user's email address. Null when the account is unavailable or has been deleted.
+      - `email_address: string or null`
 
-    - `name: string or null`
+        The user's email address. Null when the account is unavailable or has been deleted.
 
-      The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
+      - `name: string or null`
 
-    - `user_id: string`
+        The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
 
-      Tagged ID of the user.
+      - `user_id: string`
+
+        Tagged ID of the user.
+
+    - `ScopedAPIKeyActor object`
+
+      A scoped Admin API key acting on behalf of the organization.
+
+      - `type: "scoped_api_key_actor"`
+
+        default: scoped_api_key_actor
+
+      - `scoped_api_key_id: string`
 
   - `amount: string or null`
 
@@ -899,21 +1069,67 @@ the member was blocked on. Anthropic emails the requester unless
 
     The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.
 
-  - `scope: object`
+  - `scope: User or SeatTier or RBACGroup or 3 more`
 
-    Scope selecting a single member of the organization.
+    - `User object`
 
-    - `type: "user"`
+      Scope selecting a single member of the organization.
 
-      Scope type. Always `user` for this scope.
+      - `type: "user"`
 
-      default: user
+        Scope type. Always `user` for this scope.
 
-    - `user_id: string`
+        default: user
+
+      - `user_id: string`
+
+        Tagged ID of the member the spend limit applies to.
+
+    - `SeatTier object`
+
+      - `type: "seat_tier"`
+
+        default: seat_tier
+
+      - `seat_tier: string`
+
+    - `RBACGroup object`
+
+      - `type: "rbac_group"`
+
+        default: rbac_group
+
+      - `rbac_group_id: string`
+
+    - `OrganizationService object`
+
+      - `type: "organization_service"`
+
+        default: organization_service
+
+      - `service: string`
+
+    - `Organization object`
+
+      - `type: "organization"`
+
+        default: organization
+
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
 
-      Tagged ID of the member the spend limit applies to.
+      - `workspace_id: string`
 
-  - `source: User or SeatTier or RBACGroup or 2 more`
+        Tagged ID of the workspace the spend limit applies to.
+
+  - `source: User or SeatTier or RBACGroup or 3 more`
 
     - `User object`
 
@@ -959,6 +1175,20 @@ the member was blocked on. Anthropic emails the requester unless
 
         default: organization
 
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
+
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
   - `spend_limit_id: string`
 
 - `status: "approved" or "denied" or "pending"`
@@ -1165,35 +1395,47 @@ Idempotent on `denied`; denying an already-`approved` request returns
 
     Per-member effective-limit report row (`GET /spend_limits/effective`).
 
-    - `actor: object`
+    - `actor: UserActor or ScopedAPIKeyActor`
 
-      A user within the organization. `name` and `email_address` are
-      null when the underlying account is unavailable or has been deleted;
-      `deleted` is true only for deleted accounts.
+      - `UserActor object`
 
-      - `type: "user_actor"`
+        A user within the organization. `name` and `email_address` are
+        null when the underlying account is unavailable or has been deleted;
+        `deleted` is true only for deleted accounts.
 
-        Actor type. Always `user_actor`.
+        - `type: "user_actor"`
 
-        default: user_actor
+          Actor type. Always `user_actor`.
 
-      - `deleted: boolean`
+          default: user_actor
 
-        True only when the underlying account has been deleted.
+        - `deleted: boolean`
 
-        default: false
+          True only when the underlying account has been deleted.
 
-      - `email_address: string or null`
+          default: false
 
-        The user's email address. Null when the account is unavailable or has been deleted.
+        - `email_address: string or null`
 
-      - `name: string or null`
+          The user's email address. Null when the account is unavailable or has been deleted.
 
-        The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
+        - `name: string or null`
 
-      - `user_id: string`
+          The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
 
-        Tagged ID of the user.
+        - `user_id: string`
+
+          Tagged ID of the user.
+
+      - `ScopedAPIKeyActor object`
+
+        A scoped Admin API key acting on behalf of the organization.
+
+        - `type: "scoped_api_key_actor"`
+
+          default: scoped_api_key_actor
+
+        - `scoped_api_key_id: string`
 
     - `amount: string or null`
 
@@ -1217,21 +1459,67 @@ Idempotent on `denied`; denying an already-`approved` request returns
 
       The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.
 
-    - `scope: object`
+    - `scope: User or SeatTier or RBACGroup or 3 more`
 
-      Scope selecting a single member of the organization.
+      - `User object`
 
-      - `type: "user"`
+        Scope selecting a single member of the organization.
 
-        Scope type. Always `user` for this scope.
+        - `type: "user"`
 
-        default: user
+          Scope type. Always `user` for this scope.
 
-      - `user_id: string`
+          default: user
 
-        Tagged ID of the member the spend limit applies to.
+        - `user_id: string`
+
+          Tagged ID of the member the spend limit applies to.
+
+      - `SeatTier object`
+
+        - `type: "seat_tier"`
+
+          default: seat_tier
+
+        - `seat_tier: string`
+
+      - `RBACGroup object`
+
+        - `type: "rbac_group"`
+
+          default: rbac_group
+
+        - `rbac_group_id: string`
+
+      - `OrganizationService object`
+
+        - `type: "organization_service"`
 
-    - `source: User or SeatTier or RBACGroup or 2 more`
+          default: organization_service
+
+        - `service: string`
+
+      - `Organization object`
+
+        - `type: "organization"`
+
+          default: organization
+
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
+    - `source: User or SeatTier or RBACGroup or 3 more`
 
       - `User object`
 
@@ -1277,6 +1565,20 @@ Idempotent on `denied`; denying an already-`approved` request returns
 
           default: organization
 
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
     - `spend_limit_id: string`
 
   - `status: "approved" or "denied" or "pending"`
@@ -1450,35 +1752,47 @@ curl https://api.anthropic.com/v1/organizations/spend_limit_increase_requests/$S
 
     Per-member effective-limit report row (`GET /spend_limits/effective`).
 
-    - `actor: object`
+    - `actor: UserActor or ScopedAPIKeyActor`
 
-      A user within the organization. `name` and `email_address` are
-      null when the underlying account is unavailable or has been deleted;
-      `deleted` is true only for deleted accounts.
+      - `UserActor object`
 
-      - `type: "user_actor"`
+        A user within the organization. `name` and `email_address` are
+        null when the underlying account is unavailable or has been deleted;
+        `deleted` is true only for deleted accounts.
 
-        Actor type. Always `user_actor`.
+        - `type: "user_actor"`
 
-        default: user_actor
+          Actor type. Always `user_actor`.
 
-      - `deleted: boolean`
+          default: user_actor
 
-        True only when the underlying account has been deleted.
+        - `deleted: boolean`
 
-        default: false
+          True only when the underlying account has been deleted.
 
-      - `email_address: string or null`
+          default: false
 
-        The user's email address. Null when the account is unavailable or has been deleted.
+        - `email_address: string or null`
 
-      - `name: string or null`
+          The user's email address. Null when the account is unavailable or has been deleted.
 
-        The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
+        - `name: string or null`
 
-      - `user_id: string`
+          The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
 
-        Tagged ID of the user.
+        - `user_id: string`
+
+          Tagged ID of the user.
+
+      - `ScopedAPIKeyActor object`
+
+        A scoped Admin API key acting on behalf of the organization.
+
+        - `type: "scoped_api_key_actor"`
+
+          default: scoped_api_key_actor
+
+        - `scoped_api_key_id: string`
 
     - `amount: string or null`
 
@@ -1502,21 +1816,67 @@ curl https://api.anthropic.com/v1/organizations/spend_limit_increase_requests/$S
 
       The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.
 
-    - `scope: object`
+    - `scope: User or SeatTier or RBACGroup or 3 more`
 
-      Scope selecting a single member of the organization.
+      - `User object`
 
-      - `type: "user"`
+        Scope selecting a single member of the organization.
 
-        Scope type. Always `user` for this scope.
+        - `type: "user"`
 
-        default: user
+          Scope type. Always `user` for this scope.
 
-      - `user_id: string`
+          default: user
 
-        Tagged ID of the member the spend limit applies to.
+        - `user_id: string`
+
+          Tagged ID of the member the spend limit applies to.
 
-    - `source: User or SeatTier or RBACGroup or 2 more`
+      - `SeatTier object`
+
+        - `type: "seat_tier"`
+
+          default: seat_tier
+
+        - `seat_tier: string`
+
+      - `RBACGroup object`
+
+        - `type: "rbac_group"`
+
+          default: rbac_group
+
+        - `rbac_group_id: string`
+
+      - `OrganizationService object`
+
+        - `type: "organization_service"`
+
+          default: organization_service
+
+        - `service: string`
+
+      - `Organization object`
+
+        - `type: "organization"`
+
+          default: organization
+
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
+    - `source: User or SeatTier or RBACGroup or 3 more`
 
       - `User object`
 
@@ -1562,6 +1922,20 @@ curl https://api.anthropic.com/v1/organizations/spend_limit_increase_requests/$S
 
           default: organization
 
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
     - `spend_limit_id: string`
 
   - `status: "approved" or "denied" or "pending"`
@@ -1708,7 +2082,7 @@ curl https://api.anthropic.com/v1/organizations/spend_limit_increase_requests/$S
 
       - `"weekly"`
 
-    - `scope: User or SeatTier or RBACGroup or 2 more`
+    - `scope: User or SeatTier or RBACGroup or 3 more`
 
       What the limit applies to. A tagged union on `type`; each variant carries the identifier for its scope.
 
@@ -1756,6 +2130,20 @@ curl https://api.anthropic.com/v1/organizations/spend_limit_increase_requests/$S
 
           default: organization
 
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
     - `updated_at: string`
 
       RFC 3339 datetime at which the spend limit was last modified.
@@ -1766,35 +2154,47 @@ curl https://api.anthropic.com/v1/organizations/spend_limit_increase_requests/$S
 
     Per-member effective-limit report row (`GET /spend_limits/effective`).
 
-    - `actor: object`
+    - `actor: UserActor or ScopedAPIKeyActor`
 
-      A user within the organization. `name` and `email_address` are
-      null when the underlying account is unavailable or has been deleted;
-      `deleted` is true only for deleted accounts.
+      - `UserActor object`
 
-      - `type: "user_actor"`
+        A user within the organization. `name` and `email_address` are
+        null when the underlying account is unavailable or has been deleted;
+        `deleted` is true only for deleted accounts.
 
-        Actor type. Always `user_actor`.
+        - `type: "user_actor"`
 
-        default: user_actor
+          Actor type. Always `user_actor`.
 
-      - `deleted: boolean`
+          default: user_actor
 
-        True only when the underlying account has been deleted.
+        - `deleted: boolean`
 
-        default: false
+          True only when the underlying account has been deleted.
 
-      - `email_address: string or null`
+          default: false
 
-        The user's email address. Null when the account is unavailable or has been deleted.
+        - `email_address: string or null`
 
-      - `name: string or null`
+          The user's email address. Null when the account is unavailable or has been deleted.
 
-        The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
+        - `name: string or null`
 
-      - `user_id: string`
+          The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
 
-        Tagged ID of the user.
+        - `user_id: string`
+
+          Tagged ID of the user.
+
+      - `ScopedAPIKeyActor object`
+
+        A scoped Admin API key acting on behalf of the organization.
+
+        - `type: "scoped_api_key_actor"`
+
+          default: scoped_api_key_actor
+
+        - `scoped_api_key_id: string`
 
     - `amount: string or null`
 
@@ -1818,21 +2218,67 @@ curl https://api.anthropic.com/v1/organizations/spend_limit_increase_requests/$S
 
       The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.
 
-    - `scope: object`
+    - `scope: User or SeatTier or RBACGroup or 3 more`
 
-      Scope selecting a single member of the organization.
+      - `User object`
 
-      - `type: "user"`
+        Scope selecting a single member of the organization.
 
-        Scope type. Always `user` for this scope.
+        - `type: "user"`
 
-        default: user
+          Scope type. Always `user` for this scope.
 
-      - `user_id: string`
+          default: user
 
-        Tagged ID of the member the spend limit applies to.
+        - `user_id: string`
+
+          Tagged ID of the member the spend limit applies to.
+
+      - `SeatTier object`
+
+        - `type: "seat_tier"`
+
+          default: seat_tier
+
+        - `seat_tier: string`
+
+      - `RBACGroup object`
+
+        - `type: "rbac_group"`
 
-    - `source: User or SeatTier or RBACGroup or 2 more`
+          default: rbac_group
+
+        - `rbac_group_id: string`
+
+      - `OrganizationService object`
+
+        - `type: "organization_service"`
+
+          default: organization_service
+
+        - `service: string`
+
+      - `Organization object`
+
+        - `type: "organization"`
+
+          default: organization
+
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
+    - `source: User or SeatTier or RBACGroup or 3 more`
 
       - `User object`
 
@@ -1878,6 +2324,20 @@ curl https://api.anthropic.com/v1/organizations/spend_limit_increase_requests/$S
 
           default: organization
 
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
     - `spend_limit_id: string`
 
   - `status: "approved" or "denied" or "pending"`
diff --git a/content/en/api/beta/organization/spend_limits/increase_requests/approve.md b/content/en/api/beta/organization/spend_limits/increase_requests/approve.md
index 45d24b476d..065f372053 100644
--- a/content/en/api/beta/organization/spend_limits/increase_requests/approve.md
+++ b/content/en/api/beta/organization/spend_limits/increase_requests/approve.md
@@ -170,7 +170,7 @@ the member was blocked on. Anthropic emails the requester unless
 
     - `"weekly"`
 
-  - `scope: User or SeatTier or RBACGroup or 2 more`
+  - `scope: User or SeatTier or RBACGroup or 3 more`
 
     What the limit applies to. A tagged union on `type`; each variant carries the identifier for its scope.
 
@@ -218,6 +218,20 @@ the member was blocked on. Anthropic emails the requester unless
 
         default: organization
 
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
+
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
   - `updated_at: string`
 
     RFC 3339 datetime at which the spend limit was last modified.
@@ -228,35 +242,47 @@ the member was blocked on. Anthropic emails the requester unless
 
   Per-member effective-limit report row (`GET /spend_limits/effective`).
 
-  - `actor: object`
+  - `actor: UserActor or ScopedAPIKeyActor`
 
-    A user within the organization. `name` and `email_address` are
-    null when the underlying account is unavailable or has been deleted;
-    `deleted` is true only for deleted accounts.
+    - `UserActor object`
 
-    - `type: "user_actor"`
+      A user within the organization. `name` and `email_address` are
+      null when the underlying account is unavailable or has been deleted;
+      `deleted` is true only for deleted accounts.
 
-      Actor type. Always `user_actor`.
+      - `type: "user_actor"`
 
-      default: user_actor
+        Actor type. Always `user_actor`.
 
-    - `deleted: boolean`
+        default: user_actor
 
-      True only when the underlying account has been deleted.
+      - `deleted: boolean`
 
-      default: false
+        True only when the underlying account has been deleted.
 
-    - `email_address: string or null`
+        default: false
 
-      The user's email address. Null when the account is unavailable or has been deleted.
+      - `email_address: string or null`
 
-    - `name: string or null`
+        The user's email address. Null when the account is unavailable or has been deleted.
 
-      The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
+      - `name: string or null`
 
-    - `user_id: string`
+        The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
 
-      Tagged ID of the user.
+      - `user_id: string`
+
+        Tagged ID of the user.
+
+    - `ScopedAPIKeyActor object`
+
+      A scoped Admin API key acting on behalf of the organization.
+
+      - `type: "scoped_api_key_actor"`
+
+        default: scoped_api_key_actor
+
+      - `scoped_api_key_id: string`
 
   - `amount: string or null`
 
@@ -280,21 +306,67 @@ the member was blocked on. Anthropic emails the requester unless
 
     The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.
 
-  - `scope: object`
+  - `scope: User or SeatTier or RBACGroup or 3 more`
+
+    - `User object`
+
+      Scope selecting a single member of the organization.
 
-    Scope selecting a single member of the organization.
+      - `type: "user"`
+
+        Scope type. Always `user` for this scope.
 
-    - `type: "user"`
+        default: user
 
-      Scope type. Always `user` for this scope.
+      - `user_id: string`
 
-      default: user
+        Tagged ID of the member the spend limit applies to.
 
-    - `user_id: string`
+    - `SeatTier object`
 
-      Tagged ID of the member the spend limit applies to.
+      - `type: "seat_tier"`
+
+        default: seat_tier
 
-  - `source: User or SeatTier or RBACGroup or 2 more`
+      - `seat_tier: string`
+
+    - `RBACGroup object`
+
+      - `type: "rbac_group"`
+
+        default: rbac_group
+
+      - `rbac_group_id: string`
+
+    - `OrganizationService object`
+
+      - `type: "organization_service"`
+
+        default: organization_service
+
+      - `service: string`
+
+    - `Organization object`
+
+      - `type: "organization"`
+
+        default: organization
+
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
+
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
+  - `source: User or SeatTier or RBACGroup or 3 more`
 
     - `User object`
 
@@ -340,6 +412,20 @@ the member was blocked on. Anthropic emails the requester unless
 
         default: organization
 
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
+
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
   - `spend_limit_id: string`
 
 - `status: "approved" or "denied" or "pending"`
diff --git a/content/en/api/beta/organization/spend_limits/increase_requests/deny.md b/content/en/api/beta/organization/spend_limits/increase_requests/deny.md
index 2e423a32bd..f42803a6cd 100644
--- a/content/en/api/beta/organization/spend_limits/increase_requests/deny.md
+++ b/content/en/api/beta/organization/spend_limits/increase_requests/deny.md
@@ -124,35 +124,47 @@ Idempotent on `denied`; denying an already-`approved` request returns
 
     Per-member effective-limit report row (`GET /spend_limits/effective`).
 
-    - `actor: object`
+    - `actor: UserActor or ScopedAPIKeyActor`
 
-      A user within the organization. `name` and `email_address` are
-      null when the underlying account is unavailable or has been deleted;
-      `deleted` is true only for deleted accounts.
+      - `UserActor object`
 
-      - `type: "user_actor"`
+        A user within the organization. `name` and `email_address` are
+        null when the underlying account is unavailable or has been deleted;
+        `deleted` is true only for deleted accounts.
 
-        Actor type. Always `user_actor`.
+        - `type: "user_actor"`
 
-        default: user_actor
+          Actor type. Always `user_actor`.
 
-      - `deleted: boolean`
+          default: user_actor
 
-        True only when the underlying account has been deleted.
+        - `deleted: boolean`
 
-        default: false
+          True only when the underlying account has been deleted.
 
-      - `email_address: string or null`
+          default: false
 
-        The user's email address. Null when the account is unavailable or has been deleted.
+        - `email_address: string or null`
 
-      - `name: string or null`
+          The user's email address. Null when the account is unavailable or has been deleted.
 
-        The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
+        - `name: string or null`
 
-      - `user_id: string`
+          The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
 
-        Tagged ID of the user.
+        - `user_id: string`
+
+          Tagged ID of the user.
+
+      - `ScopedAPIKeyActor object`
+
+        A scoped Admin API key acting on behalf of the organization.
+
+        - `type: "scoped_api_key_actor"`
+
+          default: scoped_api_key_actor
+
+        - `scoped_api_key_id: string`
 
     - `amount: string or null`
 
@@ -176,21 +188,67 @@ Idempotent on `denied`; denying an already-`approved` request returns
 
       The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.
 
-    - `scope: object`
+    - `scope: User or SeatTier or RBACGroup or 3 more`
 
-      Scope selecting a single member of the organization.
+      - `User object`
 
-      - `type: "user"`
+        Scope selecting a single member of the organization.
 
-        Scope type. Always `user` for this scope.
+        - `type: "user"`
 
-        default: user
+          Scope type. Always `user` for this scope.
 
-      - `user_id: string`
+          default: user
 
-        Tagged ID of the member the spend limit applies to.
+        - `user_id: string`
 
-    - `source: User or SeatTier or RBACGroup or 2 more`
+          Tagged ID of the member the spend limit applies to.
+
+      - `SeatTier object`
+
+        - `type: "seat_tier"`
+
+          default: seat_tier
+
+        - `seat_tier: string`
+
+      - `RBACGroup object`
+
+        - `type: "rbac_group"`
+
+          default: rbac_group
+
+        - `rbac_group_id: string`
+
+      - `OrganizationService object`
+
+        - `type: "organization_service"`
+
+          default: organization_service
+
+        - `service: string`
+
+      - `Organization object`
+
+        - `type: "organization"`
+
+          default: organization
+
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
+    - `source: User or SeatTier or RBACGroup or 3 more`
 
       - `User object`
 
@@ -236,6 +294,20 @@ Idempotent on `denied`; denying an already-`approved` request returns
 
           default: organization
 
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
     - `spend_limit_id: string`
 
   - `status: "approved" or "denied" or "pending"`
diff --git a/content/en/api/beta/organization/spend_limits/increase_requests/list.md b/content/en/api/beta/organization/spend_limits/increase_requests/list.md
index a9b094b5a2..8b52d639bc 100644
--- a/content/en/api/beta/organization/spend_limits/increase_requests/list.md
+++ b/content/en/api/beta/organization/spend_limits/increase_requests/list.md
@@ -138,35 +138,47 @@ Requests whose requester is no longer a member are excluded.
 
     Per-member effective-limit report row (`GET /spend_limits/effective`).
 
-    - `actor: object`
+    - `actor: UserActor or ScopedAPIKeyActor`
 
-      A user within the organization. `name` and `email_address` are
-      null when the underlying account is unavailable or has been deleted;
-      `deleted` is true only for deleted accounts.
+      - `UserActor object`
 
-      - `type: "user_actor"`
+        A user within the organization. `name` and `email_address` are
+        null when the underlying account is unavailable or has been deleted;
+        `deleted` is true only for deleted accounts.
 
-        Actor type. Always `user_actor`.
+        - `type: "user_actor"`
 
-        default: user_actor
+          Actor type. Always `user_actor`.
 
-      - `deleted: boolean`
+          default: user_actor
 
-        True only when the underlying account has been deleted.
+        - `deleted: boolean`
 
-        default: false
+          True only when the underlying account has been deleted.
 
-      - `email_address: string or null`
+          default: false
 
-        The user's email address. Null when the account is unavailable or has been deleted.
+        - `email_address: string or null`
 
-      - `name: string or null`
+          The user's email address. Null when the account is unavailable or has been deleted.
 
-        The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
+        - `name: string or null`
 
-      - `user_id: string`
+          The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
 
-        Tagged ID of the user.
+        - `user_id: string`
+
+          Tagged ID of the user.
+
+      - `ScopedAPIKeyActor object`
+
+        A scoped Admin API key acting on behalf of the organization.
+
+        - `type: "scoped_api_key_actor"`
+
+          default: scoped_api_key_actor
+
+        - `scoped_api_key_id: string`
 
     - `amount: string or null`
 
@@ -190,21 +202,67 @@ Requests whose requester is no longer a member are excluded.
 
       The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.
 
-    - `scope: object`
+    - `scope: User or SeatTier or RBACGroup or 3 more`
 
-      Scope selecting a single member of the organization.
+      - `User object`
 
-      - `type: "user"`
+        Scope selecting a single member of the organization.
 
-        Scope type. Always `user` for this scope.
+        - `type: "user"`
 
-        default: user
+          Scope type. Always `user` for this scope.
 
-      - `user_id: string`
+          default: user
 
-        Tagged ID of the member the spend limit applies to.
+        - `user_id: string`
 
-    - `source: User or SeatTier or RBACGroup or 2 more`
+          Tagged ID of the member the spend limit applies to.
+
+      - `SeatTier object`
+
+        - `type: "seat_tier"`
+
+          default: seat_tier
+
+        - `seat_tier: string`
+
+      - `RBACGroup object`
+
+        - `type: "rbac_group"`
+
+          default: rbac_group
+
+        - `rbac_group_id: string`
+
+      - `OrganizationService object`
+
+        - `type: "organization_service"`
+
+          default: organization_service
+
+        - `service: string`
+
+      - `Organization object`
+
+        - `type: "organization"`
+
+          default: organization
+
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
+    - `source: User or SeatTier or RBACGroup or 3 more`
 
       - `User object`
 
@@ -250,6 +308,20 @@ Requests whose requester is no longer a member are excluded.
 
           default: organization
 
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
     - `spend_limit_id: string`
 
   - `status: "approved" or "denied" or "pending"`
diff --git a/content/en/api/beta/organization/spend_limits/increase_requests/retrieve.md b/content/en/api/beta/organization/spend_limits/increase_requests/retrieve.md
index 9ad65b3948..83053bc9c5 100644
--- a/content/en/api/beta/organization/spend_limits/increase_requests/retrieve.md
+++ b/content/en/api/beta/organization/spend_limits/increase_requests/retrieve.md
@@ -120,35 +120,47 @@ requester at the request's period.
 
     Per-member effective-limit report row (`GET /spend_limits/effective`).
 
-    - `actor: object`
+    - `actor: UserActor or ScopedAPIKeyActor`
 
-      A user within the organization. `name` and `email_address` are
-      null when the underlying account is unavailable or has been deleted;
-      `deleted` is true only for deleted accounts.
+      - `UserActor object`
 
-      - `type: "user_actor"`
+        A user within the organization. `name` and `email_address` are
+        null when the underlying account is unavailable or has been deleted;
+        `deleted` is true only for deleted accounts.
 
-        Actor type. Always `user_actor`.
+        - `type: "user_actor"`
 
-        default: user_actor
+          Actor type. Always `user_actor`.
 
-      - `deleted: boolean`
+          default: user_actor
 
-        True only when the underlying account has been deleted.
+        - `deleted: boolean`
 
-        default: false
+          True only when the underlying account has been deleted.
 
-      - `email_address: string or null`
+          default: false
 
-        The user's email address. Null when the account is unavailable or has been deleted.
+        - `email_address: string or null`
 
-      - `name: string or null`
+          The user's email address. Null when the account is unavailable or has been deleted.
 
-        The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
+        - `name: string or null`
 
-      - `user_id: string`
+          The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
 
-        Tagged ID of the user.
+        - `user_id: string`
+
+          Tagged ID of the user.
+
+      - `ScopedAPIKeyActor object`
+
+        A scoped Admin API key acting on behalf of the organization.
+
+        - `type: "scoped_api_key_actor"`
+
+          default: scoped_api_key_actor
+
+        - `scoped_api_key_id: string`
 
     - `amount: string or null`
 
@@ -172,21 +184,67 @@ requester at the request's period.
 
       The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.
 
-    - `scope: object`
+    - `scope: User or SeatTier or RBACGroup or 3 more`
 
-      Scope selecting a single member of the organization.
+      - `User object`
 
-      - `type: "user"`
+        Scope selecting a single member of the organization.
 
-        Scope type. Always `user` for this scope.
+        - `type: "user"`
 
-        default: user
+          Scope type. Always `user` for this scope.
 
-      - `user_id: string`
+          default: user
 
-        Tagged ID of the member the spend limit applies to.
+        - `user_id: string`
 
-    - `source: User or SeatTier or RBACGroup or 2 more`
+          Tagged ID of the member the spend limit applies to.
+
+      - `SeatTier object`
+
+        - `type: "seat_tier"`
+
+          default: seat_tier
+
+        - `seat_tier: string`
+
+      - `RBACGroup object`
+
+        - `type: "rbac_group"`
+
+          default: rbac_group
+
+        - `rbac_group_id: string`
+
+      - `OrganizationService object`
+
+        - `type: "organization_service"`
+
+          default: organization_service
+
+        - `service: string`
+
+      - `Organization object`
+
+        - `type: "organization"`
+
+          default: organization
+
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
+    - `source: User or SeatTier or RBACGroup or 3 more`
 
       - `User object`
 
@@ -232,6 +290,20 @@ requester at the request's period.
 
           default: organization
 
+      - `Workspace object`
+
+        Scope selecting one workspace of a Claude Console organization.
+
+        - `type: "workspace"`
+
+          Scope type. Always `workspace` for this scope.
+
+          default: workspace
+
+        - `workspace_id: string`
+
+          Tagged ID of the workspace the spend limit applies to.
+
     - `spend_limit_id: string`
 
   - `status: "approved" or "denied" or "pending"`
diff --git a/content/en/api/beta/organization/spend_limits/list_effective.md b/content/en/api/beta/organization/spend_limits/list_effective.md
index 748477d949..bddbf1903b 100644
--- a/content/en/api/beta/organization/spend_limits/list_effective.md
+++ b/content/en/api/beta/organization/spend_limits/list_effective.md
@@ -47,35 +47,47 @@ Paginates by member, so a member's periods never split across pages.
 
 - `data: array of BetaSpendSummary`
 
-  - `actor: object`
+  - `actor: UserActor or ScopedAPIKeyActor`
 
-    A user within the organization. `name` and `email_address` are
-    null when the underlying account is unavailable or has been deleted;
-    `deleted` is true only for deleted accounts.
+    - `UserActor object`
 
-    - `type: "user_actor"`
+      A user within the organization. `name` and `email_address` are
+      null when the underlying account is unavailable or has been deleted;
+      `deleted` is true only for deleted accounts.
 
-      Actor type. Always `user_actor`.
+      - `type: "user_actor"`
 
-      default: user_actor
+        Actor type. Always `user_actor`.
 
-    - `deleted: boolean`
+        default: user_actor
 
-      True only when the underlying account has been deleted.
+      - `deleted: boolean`
 
-      default: false
+        True only when the underlying account has been deleted.
 
-    - `email_address: string or null`
+        default: false
 
-      The user's email address. Null when the account is unavailable or has been deleted.
+      - `email_address: string or null`
 
-    - `name: string or null`
+        The user's email address. Null when the account is unavailable or has been deleted.
 
-      The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
+      - `name: string or null`
 
-    - `user_id: string`
+        The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
 
-      Tagged ID of the user.
+      - `user_id: string`
+
+        Tagged ID of the user.
+
+    - `ScopedAPIKeyActor object`
+
+      A scoped Admin API key acting on behalf of the organization.
+
+      - `type: "scoped_api_key_actor"`
+
+        default: scoped_api_key_actor
+
+      - `scoped_api_key_id: string`
 
   - `amount: string or null`
 
@@ -99,21 +111,67 @@ Paginates by member, so a member's periods never split across pages.
 
     The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.
 
-  - `scope: object`
+  - `scope: User or SeatTier or RBACGroup or 3 more`
+
+    - `User object`
+
+      Scope selecting a single member of the organization.
+
+      - `type: "user"`
+
+        Scope type. Always `user` for this scope.
+
+        default: user
 
-    Scope selecting a single member of the organization.
+      - `user_id: string`
 
-    - `type: "user"`
+        Tagged ID of the member the spend limit applies to.
 
-      Scope type. Always `user` for this scope.
+    - `SeatTier object`
 
-      default: user
+      - `type: "seat_tier"`
 
-    - `user_id: string`
+        default: seat_tier
 
-      Tagged ID of the member the spend limit applies to.
+      - `seat_tier: string`
 
-  - `source: User or SeatTier or RBACGroup or 2 more`
+    - `RBACGroup object`
+
+      - `type: "rbac_group"`
+
+        default: rbac_group
+
+      - `rbac_group_id: string`
+
+    - `OrganizationService object`
+
+      - `type: "organization_service"`
+
+        default: organization_service
+
+      - `service: string`
+
+    - `Organization object`
+
+      - `type: "organization"`
+
+        default: organization
+
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
+
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
+  - `source: User or SeatTier or RBACGroup or 3 more`
 
     - `User object`
 
@@ -159,6 +217,20 @@ Paginates by member, so a member's periods never split across pages.
 
         default: organization
 
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
+
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
   - `spend_limit_id: string`
 
 - `next_page: string or null`
diff --git a/content/en/api/beta/organization/spend_limits/retrieve.md b/content/en/api/beta/organization/spend_limits/retrieve.md
index 43450323b3..ddd966530a 100644
--- a/content/en/api/beta/organization/spend_limits/retrieve.md
+++ b/content/en/api/beta/organization/spend_limits/retrieve.md
@@ -55,7 +55,7 @@ Retrieve a spend limit by ID.
 
     - `"weekly"`
 
-  - `scope: User or SeatTier or RBACGroup or 2 more`
+  - `scope: User or SeatTier or RBACGroup or 3 more`
 
     What the limit applies to. A tagged union on `type`; each variant carries the identifier for its scope.
 
@@ -103,6 +103,20 @@ Retrieve a spend limit by ID.
 
         default: organization
 
+    - `Workspace object`
+
+      Scope selecting one workspace of a Claude Console organization.
+
+      - `type: "workspace"`
+
+        Scope type. Always `workspace` for this scope.
+
+        default: workspace
+
+      - `workspace_id: string`
+
+        Tagged ID of the workspace the spend limit applies to.
+
   - `updated_at: string`
 
     RFC 3339 datetime at which the spend limit was last modified.
diff --git a/content/en/api/beta/skills.md b/content/en/api/beta/skills.md
index 5bbaee97b5..25434144f4 100644
--- a/content/en/api/beta/skills.md
+++ b/content/en/api/beta/skills.md
@@ -206,7 +206,7 @@ curl https://api.anthropic.com/v1/skills \
     -H 'Content-Type: multipart/form-data' \
     -H 'anthropic-version: 2023-06-01' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY" \
-    -F files='["Example data"]'
+    -F 'files[]=@/path/to/file'
 ```
 
 #### Response (200)
@@ -1123,7 +1123,7 @@ curl https://api.anthropic.com/v1/skills/$SKILL_ID/versions \
     -H 'Content-Type: multipart/form-data' \
     -H 'anthropic-version: 2023-06-01' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY" \
-    -F files='["Example data"]'
+    -F 'files[]=@/path/to/file'
 ```
 
 ##### Response (200)
diff --git a/content/en/api/beta/skills/create.md b/content/en/api/beta/skills/create.md
index fd2febe59c..495fd3fccb 100644
--- a/content/en/api/beta/skills/create.md
+++ b/content/en/api/beta/skills/create.md
@@ -204,7 +204,7 @@ curl https://api.anthropic.com/v1/skills \
     -H 'Content-Type: multipart/form-data' \
     -H 'anthropic-version: 2023-06-01' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY" \
-    -F files='["Example data"]'
+    -F 'files[]=@/path/to/file'
 ```
 
 ### Response (200)
diff --git a/content/en/api/beta/skills/versions.md b/content/en/api/beta/skills/versions.md
index 3c4eb00b8e..9928a8a8d7 100644
--- a/content/en/api/beta/skills/versions.md
+++ b/content/en/api/beta/skills/versions.md
@@ -180,7 +180,7 @@ curl https://api.anthropic.com/v1/skills/$SKILL_ID/versions \
     -H 'Content-Type: multipart/form-data' \
     -H 'anthropic-version: 2023-06-01' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY" \
-    -F files='["Example data"]'
+    -F 'files[]=@/path/to/file'
 ```
 
 #### Response (200)
diff --git a/content/en/api/beta/skills/versions/create.md b/content/en/api/beta/skills/versions/create.md
index 9cce178db8..908257c77b 100644
--- a/content/en/api/beta/skills/versions/create.md
+++ b/content/en/api/beta/skills/versions/create.md
@@ -178,7 +178,7 @@ curl https://api.anthropic.com/v1/skills/$SKILL_ID/versions \
     -H 'Content-Type: multipart/form-data' \
     -H 'anthropic-version: 2023-06-01' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY" \
-    -F files='["Example data"]'
+    -F 'files[]=@/path/to/file'
 ```
 
 ### Response (200)
diff --git a/content/en/api/cli/beta/messages.md b/content/en/api/cli/beta/messages.md
index 7878a7a48b..c12aa9d17c 100644
--- a/content/en/api/cli/beta/messages.md
+++ b/content/en/api/cli/beta/messages.md
@@ -10338,7 +10338,7 @@ ant beta:messages count-tokens \
 
       - `beta_tool_change_mcp_tool_reference: object`
 
-        Reference to a single MCP tool by its server and remote name — the
+        Reference to a single MCP tool by its server and remote name; the
         same `server_name`/`name` pair `mcp_tool_use` carries.
 
         - `type: "mcp_tool_reference"`
@@ -10393,7 +10393,7 @@ ant beta:messages count-tokens \
 
       - `beta_tool_change_mcp_tool_reference: object`
 
-        Reference to a single MCP tool by its server and remote name — the
+        Reference to a single MCP tool by its server and remote name; the
         same `server_name`/`name` pair `mcp_tool_use` carries.
 
       - `beta_tool_change_mcp_toolset_reference: object`
@@ -17739,7 +17739,7 @@ ant beta:messages count-tokens \
 
         - `beta_tool_change_mcp_tool_reference: object`
 
-          Reference to a single MCP tool by its server and remote name — the
+          Reference to a single MCP tool by its server and remote name; the
           same `server_name`/`name` pair `mcp_tool_use` carries.
 
           - `type: "mcp_tool_reference"`
@@ -17794,7 +17794,7 @@ ant beta:messages count-tokens \
 
         - `beta_tool_change_mcp_tool_reference: object`
 
-          Reference to a single MCP tool by its server and remote name — the
+          Reference to a single MCP tool by its server and remote name; the
           same `server_name`/`name` pair `mcp_tool_use` carries.
 
         - `beta_tool_change_mcp_toolset_reference: object`
@@ -25401,7 +25401,7 @@ ant beta:messages count-tokens \
 
     - `beta_tool_change_mcp_tool_reference: object`
 
-      Reference to a single MCP tool by its server and remote name — the
+      Reference to a single MCP tool by its server and remote name; the
       same `server_name`/`name` pair `mcp_tool_use` carries.
 
       - `type: "mcp_tool_reference"`
@@ -25468,7 +25468,7 @@ ant beta:messages count-tokens \
 
     - `beta_tool_change_mcp_tool_reference: object`
 
-      Reference to a single MCP tool by its server and remote name — the
+      Reference to a single MCP tool by its server and remote name; the
       same `server_name`/`name` pair `mcp_tool_use` carries.
 
       - `type: "mcp_tool_reference"`
@@ -27335,7 +27335,7 @@ ant beta:messages count-tokens \
 
 - `beta_tool_change_mcp_tool_reference: object`
 
-  Reference to a single MCP tool by its server and remote name — the
+  Reference to a single MCP tool by its server and remote name; the
   same `server_name`/`name` pair `mcp_tool_use` carries.
 
   - `type: "mcp_tool_reference"`
diff --git a/content/en/api/compliance.md b/content/en/api/compliance.md
index a6c18ee4e9..70b0723a07 100644
--- a/content/en/api/compliance.md
+++ b/content/en/api/compliance.md
@@ -19,7 +19,7 @@ compliance activities that can be filtered by various criteria.
 
 #### Query parameters
 
-- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 501 more`
+- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 503 more`
 
   Filter activities by type. See the response `data` schema for the additional fields each type returns. Cannot be combined with `exclude_activity_types[]`.
 
@@ -823,6 +823,14 @@ compliance activities that can be filtered by various criteria.
 
     Webhook signature validation failed.
 
+  - `"github_app_installation_linked"`
+
+    An installation of the Claude GitHub App (a GitHub organization or user account where the App is installed) was linked to the organization, letting the organization's Claude Code features act on that GitHub account's repositories.
+
+  - `"github_app_installation_unlinked"`
+
+    An installation of the Claude GitHub App was unlinked from the organization, so the organization's Claude Code features can no longer act on that GitHub account's repositories through it.
+
   - `"github_token_import"`
 
     A user attempted to import a personal GitHub access token for use with Claude Code. The `result` field indicates the outcome of the import (imported, rejected, or failed).
@@ -2094,7 +2102,7 @@ compliance activities that can be filtered by various criteria.
 
     format: date-time
 
-- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 501 more`
+- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 503 more`
 
   Exclude activities of these types. Cannot be combined with `activity_types[]`.
 
@@ -2898,6 +2906,14 @@ compliance activities that can be filtered by various criteria.
 
     Webhook signature validation failed.
 
+  - `"github_app_installation_linked"`
+
+    An installation of the Claude GitHub App (a GitHub organization or user account where the App is installed) was linked to the organization, letting the organization's Claude Code features act on that GitHub account's repositories.
+
+  - `"github_app_installation_unlinked"`
+
+    An installation of the Claude GitHub App was unlinked from the organization, so the organization's Claude Code features can no longer act on that GitHub account's repositories through it.
+
   - `"github_token_import"`
 
     A user attempted to import a personal GitHub access token for use with Claude Code. The `result` field indicates the outcome of the import (imported, rejected, or failed).
@@ -4161,7 +4177,7 @@ compliance activities that can be filtered by various criteria.
 
 #### Returns
 
-- `data: optional array of AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 501 more`
+- `data: optional array of AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 503 more`
 
   List of activity records. Each element's `type` field identifies which activity it is and which additional fields are present.
 
@@ -45057,6 +45073,494 @@ compliance activities that can be filtered by various criteria.
 
       Name of the GitHub repository the integration is connected to, when known.
 
+  - `GitHubAppInstallationLinked object`
+
+    An installation of the Claude GitHub App (a GitHub organization or user account where the App is installed) was linked to the organization, letting the organization's Claude Code features act on that GitHub account's repositories.
+
+    - `type: optional "github_app_installation_linked"`
+
+      default: github_app_installation_linked
+
+    - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
+
+      - `APIActor object`
+
+        - `type: optional "api_actor"`
+
+          default: api_actor
+
+        - `api_key_id: string`
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+      - `UserActor object`
+
+        - `type: optional "user_actor"`
+
+          default: user_actor
+
+        - `email_address: string`
+
+          format: email
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+        - `user_id: string`
+
+      - `UnauthenticatedUserActor object`
+
+        - `type: optional "unauthenticated_user_actor"`
+
+          default: unauthenticated_user_actor
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+        - `unauthenticated_email_address: optional string or null`
+
+          format: email
+
+      - `AnthropicActor object`
+
+        - `type: optional "anthropic_actor"`
+
+          default: anthropic_actor
+
+        - `email_address: optional string or null`
+
+          format: email
+
+      - `SystemActor object`
+
+        Automated background processing performed by Anthropic systems, acting
+        without a user or customer credential.
+
+        - `type: optional "system_actor"`
+
+          default: system_actor
+
+        - `service: optional string or null`
+
+          Name of the automated process that performed the action, when known.
+
+      - `AdminAPIKeyActor object`
+
+        - `type: optional "admin_api_key_actor"`
+
+          default: admin_api_key_actor
+
+        - `admin_api_key_id: string`
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+      - `ServiceAccountActor object`
+
+        - `type: optional "service_account_actor"`
+
+          default: service_account_actor
+
+        - `ip_address: string`
+
+        - `service_account_id: string`
+
+        - `user_agent: string`
+
+      - `ScimDirectorySyncActor object`
+
+        - `type: optional "scim_directory_sync_actor"`
+
+          default: scim_directory_sync_actor
+
+        - `directory_id: string`
+
+        - `workos_event_id: string`
+
+        - `idp_connection_type: optional string or null`
+
+      - `FederatedIdentityActor object`
+
+        A federated external workload authenticated via a verified OIDC token.
+
+        Carries the verified issuer, subject, and audience claims from the
+        presented JWT.
+
+        - `type: optional "federated_identity_actor"`
+
+          default: federated_identity_actor
+
+        - `issuer: string`
+
+        - `subject: string`
+
+        - `audience: optional array of string`
+
+        - `ip_address: optional string or null`
+
+        - `user_agent: optional string or null`
+
+      - `FederatedActor object`
+
+        An external identity asserted by a trusted provider — a cloud-provider
+        gateway or a customer-registered federation issuer — acting without an
+        Anthropic-provisioned account or service account.
+
+        - `type: optional "federated_actor"`
+
+          default: federated_actor
+
+        - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
+
+          - `FederatedActorAwsProvider object`
+
+            Asserting party: the AWS account the organization is bound to.
+
+            - `type: optional "aws"`
+
+              default: aws
+
+            - `account_id: string`
+
+            - `signed_principal: string`
+
+              The AWS-signed ARN of the IAM principal that requested the token.
+
+          - `FederatedActorAzureProvider object`
+
+            Asserting party: the Azure subscription the organization is bound to.
+
+            - `type: optional "azure"`
+
+              default: azure
+
+            - `subscription_id: string`
+
+          - `FederatedActorGcpProvider object`
+
+            Asserting party: the GCP project the organization is bound to.
+
+            - `type: optional "gcp"`
+
+              default: gcp
+
+            - `project_number: string`
+
+          - `FederatedActorOidcProvider object`
+
+            Asserting party: a customer-registered OIDC federation issuer.
+
+            - `type: optional "oidc"`
+
+              default: oidc
+
+            - `issuer: optional string or null`
+
+              The federation issuer's URL. Null when the presented credential failed verification.
+
+        - `ip_address: optional string or null`
+
+        - `subject: optional string or null`
+
+          The provider's verified identifier for the caller; its form depends on the provider.
+
+        - `user_agent: optional string or null`
+
+      - `AttestedDeviceActor object`
+
+        An attested mobile device authenticated via Apple App Attest.
+
+        - `type: optional "attested_device_actor"`
+
+          default: attested_device_actor
+
+        - `external_client_id: string`
+
+        - `kid_hash: string`
+
+        - `ip_address: optional string or null`
+
+        - `user_agent: optional string or null`
+
+    - `github_installation_id: number`
+
+      Numeric GitHub ID of the installation that was linked
+
+    - `id: optional string`
+
+      Unique identifier for the activity e.g. 'activity_abcd1234'
+
+    - `created_at: optional string`
+
+      When this activity occurred.
+
+      format: date-time
+
+    - `github_account_login: optional string or null`
+
+      Login of the GitHub organization or user account the App is installed on
+
+    - `github_account_type: optional string or null`
+
+      Whether that GitHub account is an organization or a user account, as reported by GitHub ("Organization" or "User")
+
+    - `organization_id: optional string or null`
+
+      Organization ID this activity is associated with
+
+    - `organization_uuid: optional string or null`
+
+      Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
+
+  - `GitHubAppInstallationUnlinked object`
+
+    An installation of the Claude GitHub App was unlinked from the organization, so the organization's Claude Code features can no longer act on that GitHub account's repositories through it.
+
+    - `type: optional "github_app_installation_unlinked"`
+
+      default: github_app_installation_unlinked
+
+    - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
+
+      - `APIActor object`
+
+        - `type: optional "api_actor"`
+
+          default: api_actor
+
+        - `api_key_id: string`
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+      - `UserActor object`
+
+        - `type: optional "user_actor"`
+
+          default: user_actor
+
+        - `email_address: string`
+
+          format: email
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+        - `user_id: string`
+
+      - `UnauthenticatedUserActor object`
+
+        - `type: optional "unauthenticated_user_actor"`
+
+          default: unauthenticated_user_actor
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+        - `unauthenticated_email_address: optional string or null`
+
+          format: email
+
+      - `AnthropicActor object`
+
+        - `type: optional "anthropic_actor"`
+
+          default: anthropic_actor
+
+        - `email_address: optional string or null`
+
+          format: email
+
+      - `SystemActor object`
+
+        Automated background processing performed by Anthropic systems, acting
+        without a user or customer credential.
+
+        - `type: optional "system_actor"`
+
+          default: system_actor
+
+        - `service: optional string or null`
+
+          Name of the automated process that performed the action, when known.
+
+      - `AdminAPIKeyActor object`
+
+        - `type: optional "admin_api_key_actor"`
+
+          default: admin_api_key_actor
+
+        - `admin_api_key_id: string`
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+      - `ServiceAccountActor object`
+
+        - `type: optional "service_account_actor"`
+
+          default: service_account_actor
+
+        - `ip_address: string`
+
+        - `service_account_id: string`
+
+        - `user_agent: string`
+
+      - `ScimDirectorySyncActor object`
+
+        - `type: optional "scim_directory_sync_actor"`
+
+          default: scim_directory_sync_actor
+
+        - `directory_id: string`
+
+        - `workos_event_id: string`
+
+        - `idp_connection_type: optional string or null`
+
+      - `FederatedIdentityActor object`
+
+        A federated external workload authenticated via a verified OIDC token.
+
+        Carries the verified issuer, subject, and audience claims from the
+        presented JWT.
+
+        - `type: optional "federated_identity_actor"`
+
+          default: federated_identity_actor
+
+        - `issuer: string`
+
+        - `subject: string`
+
+        - `audience: optional array of string`
+
+        - `ip_address: optional string or null`
+
+        - `user_agent: optional string or null`
+
+      - `FederatedActor object`
+
+        An external identity asserted by a trusted provider — a cloud-provider
+        gateway or a customer-registered federation issuer — acting without an
+        Anthropic-provisioned account or service account.
+
+        - `type: optional "federated_actor"`
+
+          default: federated_actor
+
+        - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
+
+          - `FederatedActorAwsProvider object`
+
+            Asserting party: the AWS account the organization is bound to.
+
+            - `type: optional "aws"`
+
+              default: aws
+
+            - `account_id: string`
+
+            - `signed_principal: string`
+
+              The AWS-signed ARN of the IAM principal that requested the token.
+
+          - `FederatedActorAzureProvider object`
+
+            Asserting party: the Azure subscription the organization is bound to.
+
+            - `type: optional "azure"`
+
+              default: azure
+
+            - `subscription_id: string`
+
+          - `FederatedActorGcpProvider object`
+
+            Asserting party: the GCP project the organization is bound to.
+
+            - `type: optional "gcp"`
+
+              default: gcp
+
+            - `project_number: string`
+
+          - `FederatedActorOidcProvider object`
+
+            Asserting party: a customer-registered OIDC federation issuer.
+
+            - `type: optional "oidc"`
+
+              default: oidc
+
+            - `issuer: optional string or null`
+
+              The federation issuer's URL. Null when the presented credential failed verification.
+
+        - `ip_address: optional string or null`
+
+        - `subject: optional string or null`
+
+          The provider's verified identifier for the caller; its form depends on the provider.
+
+        - `user_agent: optional string or null`
+
+      - `AttestedDeviceActor object`
+
+        An attested mobile device authenticated via Apple App Attest.
+
+        - `type: optional "attested_device_actor"`
+
+          default: attested_device_actor
+
+        - `external_client_id: string`
+
+        - `kid_hash: string`
+
+        - `ip_address: optional string or null`
+
+        - `user_agent: optional string or null`
+
+    - `github_installation_id: number`
+
+      Numeric GitHub ID of the installation that was unlinked
+
+    - `id: optional string`
+
+      Unique identifier for the activity e.g. 'activity_abcd1234'
+
+    - `created_at: optional string`
+
+      When this activity occurred.
+
+      format: date-time
+
+    - `github_account_login: optional string or null`
+
+      Login of the GitHub organization or user account the App is installed on
+
+    - `github_account_type: optional string or null`
+
+      Whether that GitHub account is an organization or a user account, as reported by GitHub ("Organization" or "User")
+
+    - `organization_id: optional string or null`
+
+      Organization ID this activity is associated with
+
+    - `organization_uuid: optional string or null`
+
+      Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
+
   - `GitHubTokenImport object`
 
     A user attempted to import a personal GitHub access token for use with Claude Code. The `result` field indicates the outcome of the import (imported, rejected, or failed).
@@ -80321,7 +80825,7 @@ compliance activities that can be filtered by various criteria.
 
       - `ClaudeCodeWebEnabled object`
 
-        The Claude Code on the web setting was changed for the organization.
+        The Claude Code cloud sessions setting was changed for the organization.
 
         - `type: optional "claude_code_web_enabled"`
 
@@ -125050,6 +125554,10 @@ compliance activities that can be filtered by various criteria.
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
+    - `tunnel_token_id: optional string or null`
+
+      Id of the tunnel token issued with the tunnel and returned once in the create response; set only when creating the tunnel also issued its token, and absent for a tunnel whose token is revealed separately
+
   - `TunnelTokenMinted object`
 
     An OAuth bearer token for the tunnel management API was minted.
diff --git a/content/en/api/compliance/activities.md b/content/en/api/compliance/activities.md
index ff912bb86c..4f32147aa9 100644
--- a/content/en/api/compliance/activities.md
+++ b/content/en/api/compliance/activities.md
@@ -17,7 +17,7 @@ compliance activities that can be filtered by various criteria.
 
 ### Query parameters
 
-- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 501 more`
+- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 503 more`
 
   Filter activities by type. See the response `data` schema for the additional fields each type returns. Cannot be combined with `exclude_activity_types[]`.
 
@@ -821,6 +821,14 @@ compliance activities that can be filtered by various criteria.
 
     Webhook signature validation failed.
 
+  - `"github_app_installation_linked"`
+
+    An installation of the Claude GitHub App (a GitHub organization or user account where the App is installed) was linked to the organization, letting the organization's Claude Code features act on that GitHub account's repositories.
+
+  - `"github_app_installation_unlinked"`
+
+    An installation of the Claude GitHub App was unlinked from the organization, so the organization's Claude Code features can no longer act on that GitHub account's repositories through it.
+
   - `"github_token_import"`
 
     A user attempted to import a personal GitHub access token for use with Claude Code. The `result` field indicates the outcome of the import (imported, rejected, or failed).
@@ -2092,7 +2100,7 @@ compliance activities that can be filtered by various criteria.
 
     format: date-time
 
-- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 501 more`
+- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 503 more`
 
   Exclude activities of these types. Cannot be combined with `activity_types[]`.
 
@@ -2896,6 +2904,14 @@ compliance activities that can be filtered by various criteria.
 
     Webhook signature validation failed.
 
+  - `"github_app_installation_linked"`
+
+    An installation of the Claude GitHub App (a GitHub organization or user account where the App is installed) was linked to the organization, letting the organization's Claude Code features act on that GitHub account's repositories.
+
+  - `"github_app_installation_unlinked"`
+
+    An installation of the Claude GitHub App was unlinked from the organization, so the organization's Claude Code features can no longer act on that GitHub account's repositories through it.
+
   - `"github_token_import"`
 
     A user attempted to import a personal GitHub access token for use with Claude Code. The `result` field indicates the outcome of the import (imported, rejected, or failed).
@@ -4159,7 +4175,7 @@ compliance activities that can be filtered by various criteria.
 
 ### Returns
 
-- `data: optional array of AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 501 more`
+- `data: optional array of AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 503 more`
 
   List of activity records. Each element's `type` field identifies which activity it is and which additional fields are present.
 
@@ -45055,13 +45071,13 @@ compliance activities that can be filtered by various criteria.
 
       Name of the GitHub repository the integration is connected to, when known.
 
-  - `GitHubTokenImport object`
+  - `GitHubAppInstallationLinked object`
 
-    A user attempted to import a personal GitHub access token for use with Claude Code. The `result` field indicates the outcome of the import (imported, rejected, or failed).
+    An installation of the Claude GitHub App (a GitHub organization or user account where the App is installed) was linked to the organization, letting the organization's Claude Code features act on that GitHub account's repositories.
 
-    - `type: optional "github_token_import"`
+    - `type: optional "github_app_installation_linked"`
 
-      default: github_token_import
+      default: github_app_installation_linked
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -45269,29 +45285,253 @@ compliance activities that can be filtered by various criteria.
 
         - `user_agent: optional string or null`
 
-    - `result: "failed_internal" or "imported" or "rejected_feature_disabled" or 5 more`
+    - `github_installation_id: number`
 
-      The outcome of the import.
+      Numeric GitHub ID of the installation that was linked
 
-      - `"failed_internal"`
+    - `id: optional string`
 
-      - `"imported"`
+      Unique identifier for the activity e.g. 'activity_abcd1234'
 
-      - `"rejected_feature_disabled"`
+    - `created_at: optional string`
 
-      - `"rejected_invalid_credential"`
+      When this activity occurred.
 
-      - `"rejected_missing_repo_scope"`
+      format: date-time
 
-      - `"rejected_tenant_not_ready"`
+    - `github_account_login: optional string or null`
 
-      - `"rejected_zdr_policy"`
+      Login of the GitHub organization or user account the App is installed on
 
-      - `"unspecified"`
+    - `github_account_type: optional string or null`
 
-    - `source: string`
+      Whether that GitHub account is an organization or a user account, as reported by GitHub ("Organization" or "User")
 
-      How the token was imported.
+    - `organization_id: optional string or null`
+
+      Organization ID this activity is associated with
+
+    - `organization_uuid: optional string or null`
+
+      Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
+
+  - `GitHubAppInstallationUnlinked object`
+
+    An installation of the Claude GitHub App was unlinked from the organization, so the organization's Claude Code features can no longer act on that GitHub account's repositories through it.
+
+    - `type: optional "github_app_installation_unlinked"`
+
+      default: github_app_installation_unlinked
+
+    - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
+
+      - `APIActor object`
+
+        - `type: optional "api_actor"`
+
+          default: api_actor
+
+        - `api_key_id: string`
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+      - `UserActor object`
+
+        - `type: optional "user_actor"`
+
+          default: user_actor
+
+        - `email_address: string`
+
+          format: email
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+        - `user_id: string`
+
+      - `UnauthenticatedUserActor object`
+
+        - `type: optional "unauthenticated_user_actor"`
+
+          default: unauthenticated_user_actor
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+        - `unauthenticated_email_address: optional string or null`
+
+          format: email
+
+      - `AnthropicActor object`
+
+        - `type: optional "anthropic_actor"`
+
+          default: anthropic_actor
+
+        - `email_address: optional string or null`
+
+          format: email
+
+      - `SystemActor object`
+
+        Automated background processing performed by Anthropic systems, acting
+        without a user or customer credential.
+
+        - `type: optional "system_actor"`
+
+          default: system_actor
+
+        - `service: optional string or null`
+
+          Name of the automated process that performed the action, when known.
+
+      - `AdminAPIKeyActor object`
+
+        - `type: optional "admin_api_key_actor"`
+
+          default: admin_api_key_actor
+
+        - `admin_api_key_id: string`
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+      - `ServiceAccountActor object`
+
+        - `type: optional "service_account_actor"`
+
+          default: service_account_actor
+
+        - `ip_address: string`
+
+        - `service_account_id: string`
+
+        - `user_agent: string`
+
+      - `ScimDirectorySyncActor object`
+
+        - `type: optional "scim_directory_sync_actor"`
+
+          default: scim_directory_sync_actor
+
+        - `directory_id: string`
+
+        - `workos_event_id: string`
+
+        - `idp_connection_type: optional string or null`
+
+      - `FederatedIdentityActor object`
+
+        A federated external workload authenticated via a verified OIDC token.
+
+        Carries the verified issuer, subject, and audience claims from the
+        presented JWT.
+
+        - `type: optional "federated_identity_actor"`
+
+          default: federated_identity_actor
+
+        - `issuer: string`
+
+        - `subject: string`
+
+        - `audience: optional array of string`
+
+        - `ip_address: optional string or null`
+
+        - `user_agent: optional string or null`
+
+      - `FederatedActor object`
+
+        An external identity asserted by a trusted provider — a cloud-provider
+        gateway or a customer-registered federation issuer — acting without an
+        Anthropic-provisioned account or service account.
+
+        - `type: optional "federated_actor"`
+
+          default: federated_actor
+
+        - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
+
+          - `FederatedActorAwsProvider object`
+
+            Asserting party: the AWS account the organization is bound to.
+
+            - `type: optional "aws"`
+
+              default: aws
+
+            - `account_id: string`
+
+            - `signed_principal: string`
+
+              The AWS-signed ARN of the IAM principal that requested the token.
+
+          - `FederatedActorAzureProvider object`
+
+            Asserting party: the Azure subscription the organization is bound to.
+
+            - `type: optional "azure"`
+
+              default: azure
+
+            - `subscription_id: string`
+
+          - `FederatedActorGcpProvider object`
+
+            Asserting party: the GCP project the organization is bound to.
+
+            - `type: optional "gcp"`
+
+              default: gcp
+
+            - `project_number: string`
+
+          - `FederatedActorOidcProvider object`
+
+            Asserting party: a customer-registered OIDC federation issuer.
+
+            - `type: optional "oidc"`
+
+              default: oidc
+
+            - `issuer: optional string or null`
+
+              The federation issuer's URL. Null when the presented credential failed verification.
+
+        - `ip_address: optional string or null`
+
+        - `subject: optional string or null`
+
+          The provider's verified identifier for the caller; its form depends on the provider.
+
+        - `user_agent: optional string or null`
+
+      - `AttestedDeviceActor object`
+
+        An attested mobile device authenticated via Apple App Attest.
+
+        - `type: optional "attested_device_actor"`
+
+          default: attested_device_actor
+
+        - `external_client_id: string`
+
+        - `kid_hash: string`
+
+        - `ip_address: optional string or null`
+
+        - `user_agent: optional string or null`
+
+    - `github_installation_id: number`
+
+      Numeric GitHub ID of the installation that was unlinked
 
     - `id: optional string`
 
@@ -45303,13 +45543,13 @@ compliance activities that can be filtered by various criteria.
 
       format: date-time
 
-    - `github_username: optional string or null`
+    - `github_account_login: optional string or null`
 
-      The GitHub username the imported token authenticates as, when known.
+      Login of the GitHub organization or user account the App is installed on
 
-    - `granted_scopes: optional string or null`
+    - `github_account_type: optional string or null`
 
-      The scopes granted to the imported token, when available.
+      Whether that GitHub account is an organization or a user account, as reported by GitHub ("Organization" or "User")
 
     - `organization_id: optional string or null`
 
@@ -45319,17 +45559,281 @@ compliance activities that can be filtered by various criteria.
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `token_fingerprint_sha256: optional string or null`
-
-      Org-scoped SHA-256 of the submitted token: `sha256(org_uuid || 0x00 || token)`, lowercase-hex-encoded, where `org_uuid` is the organization's UUID as a dashed lowercase string, `0x00` is a single zero byte, and `token` is the submitted value's raw bytes. Per-org correlation only — the same token in two orgs produces distinct fingerprints. Set only when the submitted value carries a known GitHub PAT prefix (a high-entropy token format); unset for all other submissions, including rejected non-PAT input.
-
-  - `ClaudeGdriveIntegrationCreated object`
+  - `GitHubTokenImport object`
 
-    A Google Drive integration was enabled for the organization.
+    A user attempted to import a personal GitHub access token for use with Claude Code. The `result` field indicates the outcome of the import (imported, rejected, or failed).
 
-    - `type: optional "claude_gdrive_integration_created"`
+    - `type: optional "github_token_import"`
 
-      default: claude_gdrive_integration_created
+      default: github_token_import
+
+    - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
+
+      - `APIActor object`
+
+        - `type: optional "api_actor"`
+
+          default: api_actor
+
+        - `api_key_id: string`
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+      - `UserActor object`
+
+        - `type: optional "user_actor"`
+
+          default: user_actor
+
+        - `email_address: string`
+
+          format: email
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+        - `user_id: string`
+
+      - `UnauthenticatedUserActor object`
+
+        - `type: optional "unauthenticated_user_actor"`
+
+          default: unauthenticated_user_actor
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+        - `unauthenticated_email_address: optional string or null`
+
+          format: email
+
+      - `AnthropicActor object`
+
+        - `type: optional "anthropic_actor"`
+
+          default: anthropic_actor
+
+        - `email_address: optional string or null`
+
+          format: email
+
+      - `SystemActor object`
+
+        Automated background processing performed by Anthropic systems, acting
+        without a user or customer credential.
+
+        - `type: optional "system_actor"`
+
+          default: system_actor
+
+        - `service: optional string or null`
+
+          Name of the automated process that performed the action, when known.
+
+      - `AdminAPIKeyActor object`
+
+        - `type: optional "admin_api_key_actor"`
+
+          default: admin_api_key_actor
+
+        - `admin_api_key_id: string`
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+      - `ServiceAccountActor object`
+
+        - `type: optional "service_account_actor"`
+
+          default: service_account_actor
+
+        - `ip_address: string`
+
+        - `service_account_id: string`
+
+        - `user_agent: string`
+
+      - `ScimDirectorySyncActor object`
+
+        - `type: optional "scim_directory_sync_actor"`
+
+          default: scim_directory_sync_actor
+
+        - `directory_id: string`
+
+        - `workos_event_id: string`
+
+        - `idp_connection_type: optional string or null`
+
+      - `FederatedIdentityActor object`
+
+        A federated external workload authenticated via a verified OIDC token.
+
+        Carries the verified issuer, subject, and audience claims from the
+        presented JWT.
+
+        - `type: optional "federated_identity_actor"`
+
+          default: federated_identity_actor
+
+        - `issuer: string`
+
+        - `subject: string`
+
+        - `audience: optional array of string`
+
+        - `ip_address: optional string or null`
+
+        - `user_agent: optional string or null`
+
+      - `FederatedActor object`
+
+        An external identity asserted by a trusted provider — a cloud-provider
+        gateway or a customer-registered federation issuer — acting without an
+        Anthropic-provisioned account or service account.
+
+        - `type: optional "federated_actor"`
+
+          default: federated_actor
+
+        - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
+
+          - `FederatedActorAwsProvider object`
+
+            Asserting party: the AWS account the organization is bound to.
+
+            - `type: optional "aws"`
+
+              default: aws
+
+            - `account_id: string`
+
+            - `signed_principal: string`
+
+              The AWS-signed ARN of the IAM principal that requested the token.
+
+          - `FederatedActorAzureProvider object`
+
+            Asserting party: the Azure subscription the organization is bound to.
+
+            - `type: optional "azure"`
+
+              default: azure
+
+            - `subscription_id: string`
+
+          - `FederatedActorGcpProvider object`
+
+            Asserting party: the GCP project the organization is bound to.
+
+            - `type: optional "gcp"`
+
+              default: gcp
+
+            - `project_number: string`
+
+          - `FederatedActorOidcProvider object`
+
+            Asserting party: a customer-registered OIDC federation issuer.
+
+            - `type: optional "oidc"`
+
+              default: oidc
+
+            - `issuer: optional string or null`
+
+              The federation issuer's URL. Null when the presented credential failed verification.
+
+        - `ip_address: optional string or null`
+
+        - `subject: optional string or null`
+
+          The provider's verified identifier for the caller; its form depends on the provider.
+
+        - `user_agent: optional string or null`
+
+      - `AttestedDeviceActor object`
+
+        An attested mobile device authenticated via Apple App Attest.
+
+        - `type: optional "attested_device_actor"`
+
+          default: attested_device_actor
+
+        - `external_client_id: string`
+
+        - `kid_hash: string`
+
+        - `ip_address: optional string or null`
+
+        - `user_agent: optional string or null`
+
+    - `result: "failed_internal" or "imported" or "rejected_feature_disabled" or 5 more`
+
+      The outcome of the import.
+
+      - `"failed_internal"`
+
+      - `"imported"`
+
+      - `"rejected_feature_disabled"`
+
+      - `"rejected_invalid_credential"`
+
+      - `"rejected_missing_repo_scope"`
+
+      - `"rejected_tenant_not_ready"`
+
+      - `"rejected_zdr_policy"`
+
+      - `"unspecified"`
+
+    - `source: string`
+
+      How the token was imported.
+
+    - `id: optional string`
+
+      Unique identifier for the activity e.g. 'activity_abcd1234'
+
+    - `created_at: optional string`
+
+      When this activity occurred.
+
+      format: date-time
+
+    - `github_username: optional string or null`
+
+      The GitHub username the imported token authenticates as, when known.
+
+    - `granted_scopes: optional string or null`
+
+      The scopes granted to the imported token, when available.
+
+    - `organization_id: optional string or null`
+
+      Organization ID this activity is associated with
+
+    - `organization_uuid: optional string or null`
+
+      Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
+
+    - `token_fingerprint_sha256: optional string or null`
+
+      Org-scoped SHA-256 of the submitted token: `sha256(org_uuid || 0x00 || token)`, lowercase-hex-encoded, where `org_uuid` is the organization's UUID as a dashed lowercase string, `0x00` is a single zero byte, and `token` is the submitted value's raw bytes. Per-org correlation only — the same token in two orgs produces distinct fingerprints. Set only when the submitted value carries a known GitHub PAT prefix (a high-entropy token format); unset for all other submissions, including rejected non-PAT input.
+
+  - `ClaudeGdriveIntegrationCreated object`
+
+    A Google Drive integration was enabled for the organization.
+
+    - `type: optional "claude_gdrive_integration_created"`
+
+      default: claude_gdrive_integration_created
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -80319,7 +80823,7 @@ compliance activities that can be filtered by various criteria.
 
       - `ClaudeCodeWebEnabled object`
 
-        The Claude Code on the web setting was changed for the organization.
+        The Claude Code cloud sessions setting was changed for the organization.
 
         - `type: optional "claude_code_web_enabled"`
 
@@ -125048,6 +125552,10 @@ compliance activities that can be filtered by various criteria.
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
+    - `tunnel_token_id: optional string or null`
+
+      Id of the tunnel token issued with the tunnel and returned once in the create response; set only when creating the tunnel also issued its token, and absent for a tunnel whose token is revealed separately
+
   - `TunnelTokenMinted object`
 
     An OAuth bearer token for the tunnel management API was minted.
@@ -125498,20 +126006,977 @@ compliance activities that can be filtered by various criteria.
 
         - `user_agent: optional string or null`
 
-    - `tunnel_id: string`
-
-    - `tunnel_token_id: string`
-
+    - `tunnel_id: string`
+
+    - `tunnel_token_id: string`
+
+    - `id: optional string`
+
+      Unique identifier for the activity e.g. 'activity_abcd1234'
+
+    - `created_at: optional string`
+
+      When this activity occurred.
+
+      format: date-time
+
+    - `organization_id: optional string or null`
+
+      Organization ID this activity is associated with
+
+    - `organization_uuid: optional string or null`
+
+      Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
+
+  - `TunnelTokenRevoked object`
+
+    An OAuth bearer token for the tunnel management API was revoked.
+
+    - `type: optional "tunnel_token_revoked"`
+
+      default: tunnel_token_revoked
+
+    - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
+
+      - `APIActor object`
+
+        - `type: optional "api_actor"`
+
+          default: api_actor
+
+        - `api_key_id: string`
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+      - `UserActor object`
+
+        - `type: optional "user_actor"`
+
+          default: user_actor
+
+        - `email_address: string`
+
+          format: email
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+        - `user_id: string`
+
+      - `UnauthenticatedUserActor object`
+
+        - `type: optional "unauthenticated_user_actor"`
+
+          default: unauthenticated_user_actor
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+        - `unauthenticated_email_address: optional string or null`
+
+          format: email
+
+      - `AnthropicActor object`
+
+        - `type: optional "anthropic_actor"`
+
+          default: anthropic_actor
+
+        - `email_address: optional string or null`
+
+          format: email
+
+      - `SystemActor object`
+
+        Automated background processing performed by Anthropic systems, acting
+        without a user or customer credential.
+
+        - `type: optional "system_actor"`
+
+          default: system_actor
+
+        - `service: optional string or null`
+
+          Name of the automated process that performed the action, when known.
+
+      - `AdminAPIKeyActor object`
+
+        - `type: optional "admin_api_key_actor"`
+
+          default: admin_api_key_actor
+
+        - `admin_api_key_id: string`
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+      - `ServiceAccountActor object`
+
+        - `type: optional "service_account_actor"`
+
+          default: service_account_actor
+
+        - `ip_address: string`
+
+        - `service_account_id: string`
+
+        - `user_agent: string`
+
+      - `ScimDirectorySyncActor object`
+
+        - `type: optional "scim_directory_sync_actor"`
+
+          default: scim_directory_sync_actor
+
+        - `directory_id: string`
+
+        - `workos_event_id: string`
+
+        - `idp_connection_type: optional string or null`
+
+      - `FederatedIdentityActor object`
+
+        A federated external workload authenticated via a verified OIDC token.
+
+        Carries the verified issuer, subject, and audience claims from the
+        presented JWT.
+
+        - `type: optional "federated_identity_actor"`
+
+          default: federated_identity_actor
+
+        - `issuer: string`
+
+        - `subject: string`
+
+        - `audience: optional array of string`
+
+        - `ip_address: optional string or null`
+
+        - `user_agent: optional string or null`
+
+      - `FederatedActor object`
+
+        An external identity asserted by a trusted provider — a cloud-provider
+        gateway or a customer-registered federation issuer — acting without an
+        Anthropic-provisioned account or service account.
+
+        - `type: optional "federated_actor"`
+
+          default: federated_actor
+
+        - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
+
+          - `FederatedActorAwsProvider object`
+
+            Asserting party: the AWS account the organization is bound to.
+
+            - `type: optional "aws"`
+
+              default: aws
+
+            - `account_id: string`
+
+            - `signed_principal: string`
+
+              The AWS-signed ARN of the IAM principal that requested the token.
+
+          - `FederatedActorAzureProvider object`
+
+            Asserting party: the Azure subscription the organization is bound to.
+
+            - `type: optional "azure"`
+
+              default: azure
+
+            - `subscription_id: string`
+
+          - `FederatedActorGcpProvider object`
+
+            Asserting party: the GCP project the organization is bound to.
+
+            - `type: optional "gcp"`
+
+              default: gcp
+
+            - `project_number: string`
+
+          - `FederatedActorOidcProvider object`
+
+            Asserting party: a customer-registered OIDC federation issuer.
+
+            - `type: optional "oidc"`
+
+              default: oidc
+
+            - `issuer: optional string or null`
+
+              The federation issuer's URL. Null when the presented credential failed verification.
+
+        - `ip_address: optional string or null`
+
+        - `subject: optional string or null`
+
+          The provider's verified identifier for the caller; its form depends on the provider.
+
+        - `user_agent: optional string or null`
+
+      - `AttestedDeviceActor object`
+
+        An attested mobile device authenticated via Apple App Attest.
+
+        - `type: optional "attested_device_actor"`
+
+          default: attested_device_actor
+
+        - `external_client_id: string`
+
+        - `kid_hash: string`
+
+        - `ip_address: optional string or null`
+
+        - `user_agent: optional string or null`
+
+    - `token_id: string`
+
+    - `id: optional string`
+
+      Unique identifier for the activity e.g. 'activity_abcd1234'
+
+    - `created_at: optional string`
+
+      When this activity occurred.
+
+      format: date-time
+
+    - `organization_id: optional string or null`
+
+      Organization ID this activity is associated with
+
+    - `organization_uuid: optional string or null`
+
+      Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
+
+    - `token_name: optional string or null`
+
+      Name the administrator gave the token when it was created, if any
+
+  - `TunnelTokenRotated object`
+
+    The Cloudflare connector secret for a tunnel was rotated.
+
+    `tunnel_token_id` is the id of the *newly-issued* token. The previous
+    token is invalidated by the rotation and its id is not recorded here.
+
+    - `type: optional "tunnel_token_rotated"`
+
+      default: tunnel_token_rotated
+
+    - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
+
+      - `APIActor object`
+
+        - `type: optional "api_actor"`
+
+          default: api_actor
+
+        - `api_key_id: string`
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+      - `UserActor object`
+
+        - `type: optional "user_actor"`
+
+          default: user_actor
+
+        - `email_address: string`
+
+          format: email
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+        - `user_id: string`
+
+      - `UnauthenticatedUserActor object`
+
+        - `type: optional "unauthenticated_user_actor"`
+
+          default: unauthenticated_user_actor
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+        - `unauthenticated_email_address: optional string or null`
+
+          format: email
+
+      - `AnthropicActor object`
+
+        - `type: optional "anthropic_actor"`
+
+          default: anthropic_actor
+
+        - `email_address: optional string or null`
+
+          format: email
+
+      - `SystemActor object`
+
+        Automated background processing performed by Anthropic systems, acting
+        without a user or customer credential.
+
+        - `type: optional "system_actor"`
+
+          default: system_actor
+
+        - `service: optional string or null`
+
+          Name of the automated process that performed the action, when known.
+
+      - `AdminAPIKeyActor object`
+
+        - `type: optional "admin_api_key_actor"`
+
+          default: admin_api_key_actor
+
+        - `admin_api_key_id: string`
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+      - `ServiceAccountActor object`
+
+        - `type: optional "service_account_actor"`
+
+          default: service_account_actor
+
+        - `ip_address: string`
+
+        - `service_account_id: string`
+
+        - `user_agent: string`
+
+      - `ScimDirectorySyncActor object`
+
+        - `type: optional "scim_directory_sync_actor"`
+
+          default: scim_directory_sync_actor
+
+        - `directory_id: string`
+
+        - `workos_event_id: string`
+
+        - `idp_connection_type: optional string or null`
+
+      - `FederatedIdentityActor object`
+
+        A federated external workload authenticated via a verified OIDC token.
+
+        Carries the verified issuer, subject, and audience claims from the
+        presented JWT.
+
+        - `type: optional "federated_identity_actor"`
+
+          default: federated_identity_actor
+
+        - `issuer: string`
+
+        - `subject: string`
+
+        - `audience: optional array of string`
+
+        - `ip_address: optional string or null`
+
+        - `user_agent: optional string or null`
+
+      - `FederatedActor object`
+
+        An external identity asserted by a trusted provider — a cloud-provider
+        gateway or a customer-registered federation issuer — acting without an
+        Anthropic-provisioned account or service account.
+
+        - `type: optional "federated_actor"`
+
+          default: federated_actor
+
+        - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
+
+          - `FederatedActorAwsProvider object`
+
+            Asserting party: the AWS account the organization is bound to.
+
+            - `type: optional "aws"`
+
+              default: aws
+
+            - `account_id: string`
+
+            - `signed_principal: string`
+
+              The AWS-signed ARN of the IAM principal that requested the token.
+
+          - `FederatedActorAzureProvider object`
+
+            Asserting party: the Azure subscription the organization is bound to.
+
+            - `type: optional "azure"`
+
+              default: azure
+
+            - `subscription_id: string`
+
+          - `FederatedActorGcpProvider object`
+
+            Asserting party: the GCP project the organization is bound to.
+
+            - `type: optional "gcp"`
+
+              default: gcp
+
+            - `project_number: string`
+
+          - `FederatedActorOidcProvider object`
+
+            Asserting party: a customer-registered OIDC federation issuer.
+
+            - `type: optional "oidc"`
+
+              default: oidc
+
+            - `issuer: optional string or null`
+
+              The federation issuer's URL. Null when the presented credential failed verification.
+
+        - `ip_address: optional string or null`
+
+        - `subject: optional string or null`
+
+          The provider's verified identifier for the caller; its form depends on the provider.
+
+        - `user_agent: optional string or null`
+
+      - `AttestedDeviceActor object`
+
+        An attested mobile device authenticated via Apple App Attest.
+
+        - `type: optional "attested_device_actor"`
+
+          default: attested_device_actor
+
+        - `external_client_id: string`
+
+        - `kid_hash: string`
+
+        - `ip_address: optional string or null`
+
+        - `user_agent: optional string or null`
+
+    - `tunnel_id: string`
+
+    - `tunnel_token_id: string`
+
+    - `id: optional string`
+
+      Unique identifier for the activity e.g. 'activity_abcd1234'
+
+    - `created_at: optional string`
+
+      When this activity occurred.
+
+      format: date-time
+
+    - `organization_id: optional string or null`
+
+      Organization ID this activity is associated with
+
+    - `organization_uuid: optional string or null`
+
+      Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
+
+    - `reason: optional string or null`
+
+  - `UserConsentRecorded object`
+
+    User granted a consent for a specific entity (e.g. consumer health consent for an MCP server).
+
+    - `type: optional "user_consent_recorded"`
+
+      default: user_consent_recorded
+
+    - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
+
+      - `APIActor object`
+
+        - `type: optional "api_actor"`
+
+          default: api_actor
+
+        - `api_key_id: string`
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+      - `UserActor object`
+
+        - `type: optional "user_actor"`
+
+          default: user_actor
+
+        - `email_address: string`
+
+          format: email
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+        - `user_id: string`
+
+      - `UnauthenticatedUserActor object`
+
+        - `type: optional "unauthenticated_user_actor"`
+
+          default: unauthenticated_user_actor
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+        - `unauthenticated_email_address: optional string or null`
+
+          format: email
+
+      - `AnthropicActor object`
+
+        - `type: optional "anthropic_actor"`
+
+          default: anthropic_actor
+
+        - `email_address: optional string or null`
+
+          format: email
+
+      - `SystemActor object`
+
+        Automated background processing performed by Anthropic systems, acting
+        without a user or customer credential.
+
+        - `type: optional "system_actor"`
+
+          default: system_actor
+
+        - `service: optional string or null`
+
+          Name of the automated process that performed the action, when known.
+
+      - `AdminAPIKeyActor object`
+
+        - `type: optional "admin_api_key_actor"`
+
+          default: admin_api_key_actor
+
+        - `admin_api_key_id: string`
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+      - `ServiceAccountActor object`
+
+        - `type: optional "service_account_actor"`
+
+          default: service_account_actor
+
+        - `ip_address: string`
+
+        - `service_account_id: string`
+
+        - `user_agent: string`
+
+      - `ScimDirectorySyncActor object`
+
+        - `type: optional "scim_directory_sync_actor"`
+
+          default: scim_directory_sync_actor
+
+        - `directory_id: string`
+
+        - `workos_event_id: string`
+
+        - `idp_connection_type: optional string or null`
+
+      - `FederatedIdentityActor object`
+
+        A federated external workload authenticated via a verified OIDC token.
+
+        Carries the verified issuer, subject, and audience claims from the
+        presented JWT.
+
+        - `type: optional "federated_identity_actor"`
+
+          default: federated_identity_actor
+
+        - `issuer: string`
+
+        - `subject: string`
+
+        - `audience: optional array of string`
+
+        - `ip_address: optional string or null`
+
+        - `user_agent: optional string or null`
+
+      - `FederatedActor object`
+
+        An external identity asserted by a trusted provider — a cloud-provider
+        gateway or a customer-registered federation issuer — acting without an
+        Anthropic-provisioned account or service account.
+
+        - `type: optional "federated_actor"`
+
+          default: federated_actor
+
+        - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
+
+          - `FederatedActorAwsProvider object`
+
+            Asserting party: the AWS account the organization is bound to.
+
+            - `type: optional "aws"`
+
+              default: aws
+
+            - `account_id: string`
+
+            - `signed_principal: string`
+
+              The AWS-signed ARN of the IAM principal that requested the token.
+
+          - `FederatedActorAzureProvider object`
+
+            Asserting party: the Azure subscription the organization is bound to.
+
+            - `type: optional "azure"`
+
+              default: azure
+
+            - `subscription_id: string`
+
+          - `FederatedActorGcpProvider object`
+
+            Asserting party: the GCP project the organization is bound to.
+
+            - `type: optional "gcp"`
+
+              default: gcp
+
+            - `project_number: string`
+
+          - `FederatedActorOidcProvider object`
+
+            Asserting party: a customer-registered OIDC federation issuer.
+
+            - `type: optional "oidc"`
+
+              default: oidc
+
+            - `issuer: optional string or null`
+
+              The federation issuer's URL. Null when the presented credential failed verification.
+
+        - `ip_address: optional string or null`
+
+        - `subject: optional string or null`
+
+          The provider's verified identifier for the caller; its form depends on the provider.
+
+        - `user_agent: optional string or null`
+
+      - `AttestedDeviceActor object`
+
+        An attested mobile device authenticated via Apple App Attest.
+
+        - `type: optional "attested_device_actor"`
+
+          default: attested_device_actor
+
+        - `external_client_id: string`
+
+        - `kid_hash: string`
+
+        - `ip_address: optional string or null`
+
+        - `user_agent: optional string or null`
+
+    - `consent_type: string`
+
+    - `entity_id: string`
+
+    - `entity_type: string`
+
+    - `id: optional string`
+
+      Unique identifier for the activity e.g. 'activity_abcd1234'
+
+    - `created_at: optional string`
+
+      When this activity occurred.
+
+      format: date-time
+
+    - `organization_id: optional string or null`
+
+      Organization ID this activity is associated with
+
+    - `organization_uuid: optional string or null`
+
+      Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
+
+  - `UserConsentRevoked object`
+
+    User revoked a previously granted consent for a specific entity.
+
+    - `type: optional "user_consent_revoked"`
+
+      default: user_consent_revoked
+
+    - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
+
+      - `APIActor object`
+
+        - `type: optional "api_actor"`
+
+          default: api_actor
+
+        - `api_key_id: string`
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+      - `UserActor object`
+
+        - `type: optional "user_actor"`
+
+          default: user_actor
+
+        - `email_address: string`
+
+          format: email
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+        - `user_id: string`
+
+      - `UnauthenticatedUserActor object`
+
+        - `type: optional "unauthenticated_user_actor"`
+
+          default: unauthenticated_user_actor
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+        - `unauthenticated_email_address: optional string or null`
+
+          format: email
+
+      - `AnthropicActor object`
+
+        - `type: optional "anthropic_actor"`
+
+          default: anthropic_actor
+
+        - `email_address: optional string or null`
+
+          format: email
+
+      - `SystemActor object`
+
+        Automated background processing performed by Anthropic systems, acting
+        without a user or customer credential.
+
+        - `type: optional "system_actor"`
+
+          default: system_actor
+
+        - `service: optional string or null`
+
+          Name of the automated process that performed the action, when known.
+
+      - `AdminAPIKeyActor object`
+
+        - `type: optional "admin_api_key_actor"`
+
+          default: admin_api_key_actor
+
+        - `admin_api_key_id: string`
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+      - `ServiceAccountActor object`
+
+        - `type: optional "service_account_actor"`
+
+          default: service_account_actor
+
+        - `ip_address: string`
+
+        - `service_account_id: string`
+
+        - `user_agent: string`
+
+      - `ScimDirectorySyncActor object`
+
+        - `type: optional "scim_directory_sync_actor"`
+
+          default: scim_directory_sync_actor
+
+        - `directory_id: string`
+
+        - `workos_event_id: string`
+
+        - `idp_connection_type: optional string or null`
+
+      - `FederatedIdentityActor object`
+
+        A federated external workload authenticated via a verified OIDC token.
+
+        Carries the verified issuer, subject, and audience claims from the
+        presented JWT.
+
+        - `type: optional "federated_identity_actor"`
+
+          default: federated_identity_actor
+
+        - `issuer: string`
+
+        - `subject: string`
+
+        - `audience: optional array of string`
+
+        - `ip_address: optional string or null`
+
+        - `user_agent: optional string or null`
+
+      - `FederatedActor object`
+
+        An external identity asserted by a trusted provider — a cloud-provider
+        gateway or a customer-registered federation issuer — acting without an
+        Anthropic-provisioned account or service account.
+
+        - `type: optional "federated_actor"`
+
+          default: federated_actor
+
+        - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
+
+          - `FederatedActorAwsProvider object`
+
+            Asserting party: the AWS account the organization is bound to.
+
+            - `type: optional "aws"`
+
+              default: aws
+
+            - `account_id: string`
+
+            - `signed_principal: string`
+
+              The AWS-signed ARN of the IAM principal that requested the token.
+
+          - `FederatedActorAzureProvider object`
+
+            Asserting party: the Azure subscription the organization is bound to.
+
+            - `type: optional "azure"`
+
+              default: azure
+
+            - `subscription_id: string`
+
+          - `FederatedActorGcpProvider object`
+
+            Asserting party: the GCP project the organization is bound to.
+
+            - `type: optional "gcp"`
+
+              default: gcp
+
+            - `project_number: string`
+
+          - `FederatedActorOidcProvider object`
+
+            Asserting party: a customer-registered OIDC federation issuer.
+
+            - `type: optional "oidc"`
+
+              default: oidc
+
+            - `issuer: optional string or null`
+
+              The federation issuer's URL. Null when the presented credential failed verification.
+
+        - `ip_address: optional string or null`
+
+        - `subject: optional string or null`
+
+          The provider's verified identifier for the caller; its form depends on the provider.
+
+        - `user_agent: optional string or null`
+
+      - `AttestedDeviceActor object`
+
+        An attested mobile device authenticated via Apple App Attest.
+
+        - `type: optional "attested_device_actor"`
+
+          default: attested_device_actor
+
+        - `external_client_id: string`
+
+        - `kid_hash: string`
+
+        - `ip_address: optional string or null`
+
+        - `user_agent: optional string or null`
+
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
+    - `consent_id: optional string or null`
+
+    - `consent_type: optional string or null`
+
     - `created_at: optional string`
 
       When this activity occurred.
 
       format: date-time
 
+    - `entity_id: optional string or null`
+
+    - `entity_type: optional string or null`
+
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -125520,13 +126985,13 @@ compliance activities that can be filtered by various criteria.
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `TunnelTokenRevoked object`
+  - `ClaudeUserRoleUpdated object`
 
-    An OAuth bearer token for the tunnel management API was revoked.
+    A user's role within the organization was changed, or the user was added to or removed from the organization.
 
-    - `type: optional "tunnel_token_revoked"`
+    - `type: optional "claude_user_role_updated"`
 
-      default: tunnel_token_revoked
+      default: claude_user_role_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -125734,7 +127199,13 @@ compliance activities that can be filtered by various criteria.
 
         - `user_agent: optional string or null`
 
-    - `token_id: string`
+    - `user_email: string`
+
+      Email of the user whose role was changed
+
+    - `user_id: string`
+
+      ID of the user whose role was changed
 
     - `id: optional string`
 
@@ -125746,6 +127217,10 @@ compliance activities that can be filtered by various criteria.
 
       format: date-time
 
+    - `current_role: optional string or null`
+
+      If null, then user was removed from the Organization
+
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -125754,20 +127229,17 @@ compliance activities that can be filtered by various criteria.
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `token_name: optional string or null`
-
-      Name the administrator gave the token when it was created, if any
+    - `previous_role: optional string or null`
 
-  - `TunnelTokenRotated object`
+      If null, then user was added to the Organization
 
-    The Cloudflare connector secret for a tunnel was rotated.
+  - `ClaudeUserSettingsUpdated object`
 
-    `tunnel_token_id` is the id of the *newly-issued* token. The previous
-    token is invalidated by the rotation and its id is not recorded here.
+    User updated their personal settings.
 
-    - `type: optional "tunnel_token_rotated"`
+    - `type: optional "claude_user_settings_updated"`
 
-      default: tunnel_token_rotated
+      default: claude_user_settings_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -125975,249 +127447,359 @@ compliance activities that can be filtered by various criteria.
 
         - `user_agent: optional string or null`
 
-    - `tunnel_id: string`
+    - `updates: array of FullName or DisplayName or ArtifactsEnabled or 19 more`
 
-    - `tunnel_token_id: string`
+      - `FullName object`
 
-    - `id: optional string`
+        The full name setting was changed.
 
-      Unique identifier for the activity e.g. 'activity_abcd1234'
+        - `type: optional "full_name"`
 
-    - `created_at: optional string`
+          default: full_name
 
-      When this activity occurred.
+        - `current_value: optional string or null`
 
-      format: date-time
+          Setting value immediately after this change
 
-    - `organization_id: optional string or null`
+        - `previous_value: optional string or null`
 
-      Organization ID this activity is associated with
+          Setting value immediately before this change
 
-    - `organization_uuid: optional string or null`
+      - `DisplayName object`
 
-      Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
+        The display name setting was changed.
 
-    - `reason: optional string or null`
+        - `type: optional "display_name"`
 
-  - `UserConsentRecorded object`
+          default: display_name
 
-    User granted a consent for a specific entity (e.g. consumer health consent for an MCP server).
+        - `current_value: optional string or null`
 
-    - `type: optional "user_consent_recorded"`
+          Setting value immediately after this change
 
-      default: user_consent_recorded
+        - `previous_value: optional string or null`
 
-    - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
+          Setting value immediately before this change
 
-      - `APIActor object`
+      - `ArtifactsEnabled object`
 
-        - `type: optional "api_actor"`
+        The artifacts setting was changed.
 
-          default: api_actor
+        - `type: optional "artifacts_enabled"`
 
-        - `api_key_id: string`
+          default: artifacts_enabled
 
-        - `ip_address: string`
+        - `current_value: optional boolean or null`
 
-        - `user_agent: string`
+          Setting value immediately after this change
 
-      - `UserActor object`
+        - `previous_value: optional boolean or null`
 
-        - `type: optional "user_actor"`
+          Setting value immediately before this change
 
-          default: user_actor
+      - `LatexEnabled object`
 
-        - `email_address: string`
+        The LaTeX setting was changed.
 
-          format: email
+        - `type: optional "latex_enabled"`
 
-        - `ip_address: string`
+          default: latex_enabled
 
-        - `user_agent: string`
+        - `current_value: optional boolean or null`
 
-        - `user_id: string`
+          Setting value immediately after this change
 
-      - `UnauthenticatedUserActor object`
+        - `previous_value: optional boolean or null`
 
-        - `type: optional "unauthenticated_user_actor"`
+          Setting value immediately before this change
 
-          default: unauthenticated_user_actor
+      - `AnalysisToolEnabled object`
 
-        - `ip_address: string`
+        The analysis tool setting was changed.
 
-        - `user_agent: string`
+        - `type: optional "analysis_tool_enabled"`
 
-        - `unauthenticated_email_address: optional string or null`
+          default: analysis_tool_enabled
 
-          format: email
+        - `current_value: optional boolean or null`
 
-      - `AnthropicActor object`
+          Setting value immediately after this change
 
-        - `type: optional "anthropic_actor"`
+        - `previous_value: optional boolean or null`
 
-          default: anthropic_actor
+          Setting value immediately before this change
 
-        - `email_address: optional string or null`
+      - `ChatSuggestionsEnabled object`
 
-          format: email
+        The chat suggestions setting was changed.
 
-      - `SystemActor object`
+        - `type: optional "chat_suggestions_enabled"`
 
-        Automated background processing performed by Anthropic systems, acting
-        without a user or customer credential.
+          default: chat_suggestions_enabled
 
-        - `type: optional "system_actor"`
+        - `current_value: optional boolean or null`
 
-          default: system_actor
+          Setting value immediately after this change
 
-        - `service: optional string or null`
+        - `previous_value: optional boolean or null`
 
-          Name of the automated process that performed the action, when known.
+          Setting value immediately before this change
 
-      - `AdminAPIKeyActor object`
+      - `MultimodalPdfsEnabled object`
 
-        - `type: optional "admin_api_key_actor"`
+        The multimodal PDFs setting was changed.
 
-          default: admin_api_key_actor
+        - `type: optional "multimodal_pdfs_enabled"`
 
-        - `admin_api_key_id: string`
+          default: multimodal_pdfs_enabled
 
-        - `ip_address: string`
+        - `current_value: optional boolean or null`
 
-        - `user_agent: string`
+          Setting value immediately after this change
 
-      - `ServiceAccountActor object`
+        - `previous_value: optional boolean or null`
 
-        - `type: optional "service_account_actor"`
+          Setting value immediately before this change
 
-          default: service_account_actor
+      - `GdriveEnabled object`
 
-        - `ip_address: string`
+        The Google Drive setting was changed.
 
-        - `service_account_id: string`
+        - `type: optional "gdrive_enabled"`
 
-        - `user_agent: string`
+          default: gdrive_enabled
 
-      - `ScimDirectorySyncActor object`
+        - `current_value: optional boolean or null`
 
-        - `type: optional "scim_directory_sync_actor"`
+          Setting value immediately after this change
 
-          default: scim_directory_sync_actor
+        - `previous_value: optional boolean or null`
 
-        - `directory_id: string`
+          Setting value immediately before this change
 
-        - `workos_event_id: string`
+      - `WebSearchEnabled object`
 
-        - `idp_connection_type: optional string or null`
+        The web search setting was changed.
 
-      - `FederatedIdentityActor object`
+        - `type: optional "web_search_enabled"`
 
-        A federated external workload authenticated via a verified OIDC token.
+          default: web_search_enabled
 
-        Carries the verified issuer, subject, and audience claims from the
-        presented JWT.
+        - `current_value: optional boolean or null`
 
-        - `type: optional "federated_identity_actor"`
+          Setting value immediately after this change
 
-          default: federated_identity_actor
+        - `previous_value: optional boolean or null`
 
-        - `issuer: string`
+          Setting value immediately before this change
 
-        - `subject: string`
+      - `GeolocationEnabled object`
 
-        - `audience: optional array of string`
+        The geolocation setting was changed.
 
-        - `ip_address: optional string or null`
+        - `type: optional "geolocation_enabled"`
 
-        - `user_agent: optional string or null`
+          default: geolocation_enabled
 
-      - `FederatedActor object`
+        - `current_value: optional boolean or null`
 
-        An external identity asserted by a trusted provider — a cloud-provider
-        gateway or a customer-registered federation issuer — acting without an
-        Anthropic-provisioned account or service account.
+          Setting value immediately after this change
 
-        - `type: optional "federated_actor"`
+        - `previous_value: optional boolean or null`
 
-          default: federated_actor
+          Setting value immediately before this change
 
-        - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
+      - `EnabledSaffron object`
 
-          - `FederatedActorAwsProvider object`
+        The memory setting was changed for the user.
 
-            Asserting party: the AWS account the organization is bound to.
+        - `type: optional "enabled_saffron"`
 
-            - `type: optional "aws"`
+          default: enabled_saffron
 
-              default: aws
+        - `current_value: optional boolean or null`
 
-            - `account_id: string`
+          Setting value immediately after this change
 
-            - `signed_principal: string`
+        - `previous_value: optional boolean or null`
 
-              The AWS-signed ARN of the IAM principal that requested the token.
+          Setting value immediately before this change
 
-          - `FederatedActorAzureProvider object`
+      - `McpToolsEnabled object`
 
-            Asserting party: the Azure subscription the organization is bound to.
+        The MCP tools setting was changed.
 
-            - `type: optional "azure"`
+        - `type: optional "mcp_tools_enabled"`
 
-              default: azure
+          default: mcp_tools_enabled
 
-            - `subscription_id: string`
+        - `current_value: optional map[boolean] or null`
 
-          - `FederatedActorGcpProvider object`
+          Setting value immediately after this change
 
-            Asserting party: the GCP project the organization is bound to.
+        - `previous_value: optional map[boolean] or null`
 
-            - `type: optional "gcp"`
+          Setting value immediately before this change
 
-              default: gcp
+      - `CliOpPermissionsEnabled object`
 
-            - `project_number: string`
+        The CLI operation permissions setting was changed.
 
-          - `FederatedActorOidcProvider object`
+        - `type: optional "cli_op_permissions_enabled"`
 
-            Asserting party: a customer-registered OIDC federation issuer.
+          default: cli_op_permissions_enabled
 
-            - `type: optional "oidc"`
+        - `current_value: optional map[string] or null`
 
-              default: oidc
+          Setting value immediately after this change
 
-            - `issuer: optional string or null`
+        - `previous_value: optional map[string] or null`
 
-              The federation issuer's URL. Null when the presented credential failed verification.
+          Setting value immediately before this change
 
-        - `ip_address: optional string or null`
+      - `GoogleDriveSearchEnabled object`
 
-        - `subject: optional string or null`
+        The Google Drive search setting was changed.
 
-          The provider's verified identifier for the caller; its form depends on the provider.
+        - `type: optional "google_drive_search_enabled"`
 
-        - `user_agent: optional string or null`
+          default: google_drive_search_enabled
 
-      - `AttestedDeviceActor object`
+        - `current_value: optional boolean or null`
 
-        An attested mobile device authenticated via Apple App Attest.
+          Setting value immediately after this change
 
-        - `type: optional "attested_device_actor"`
+        - `previous_value: optional boolean or null`
 
-          default: attested_device_actor
+          Setting value immediately before this change
 
-        - `external_client_id: string`
+      - `GmailIntegrationEnabled object`
 
-        - `kid_hash: string`
+        The Gmail integration setting was changed.
 
-        - `ip_address: optional string or null`
+        - `type: optional "gmail_integration_enabled"`
 
-        - `user_agent: optional string or null`
+          default: gmail_integration_enabled
 
-    - `consent_type: string`
+        - `current_value: optional boolean or null`
 
-    - `entity_id: string`
+          Setting value immediately after this change
 
-    - `entity_type: string`
+        - `previous_value: optional boolean or null`
+
+          Setting value immediately before this change
+
+      - `GoogleCalendarIntegrationEnabled object`
+
+        The Google Calendar integration setting was changed.
+
+        - `type: optional "google_calendar_integration_enabled"`
+
+          default: google_calendar_integration_enabled
+
+        - `current_value: optional boolean or null`
+
+          Setting value immediately after this change
+
+        - `previous_value: optional boolean or null`
+
+          Setting value immediately before this change
+
+      - `ThinkingModeEnabled object`
+
+        The thinking mode setting was changed.
+
+        - `type: optional "thinking_mode_enabled"`
+
+          default: thinking_mode_enabled
+
+        - `current_value: optional "adaptive" or "extended" or "off" or "unspecified" or null`
+
+          Setting value immediately after this change
+
+          - `"adaptive"`
+
+          - `"extended"`
+
+          - `"off"`
+
+          - `"unspecified"`
+
+        - `previous_value: optional "adaptive" or "extended" or "off" or "unspecified" or null`
+
+          Setting value immediately before this change
+
+          - `"adaptive"`
+
+          - `"extended"`
+
+          - `"off"`
+
+          - `"unspecified"`
+
+      - `ResearchModeEnabled object`
+
+        The research mode setting was changed.
+
+        - `type: optional "research_mode_enabled"`
+
+          default: research_mode_enabled
+
+        - `current_value: optional boolean or null`
+
+          Setting value immediately after this change
+
+        - `previous_value: optional boolean or null`
+
+          Setting value immediately before this change
+
+      - `ComputerUseEnabled object`
+
+        The computer use setting was changed.
+
+        - `type: optional "computer_use_enabled"`
+
+          default: computer_use_enabled
+
+        - `current_value: optional boolean or null`
+
+          Setting value immediately after this change
+
+        - `previous_value: optional boolean or null`
+
+          Setting value immediately before this change
+
+      - `ClaudeAPIInArtifactsEnabled object`
+
+        The Claude API in Artifacts setting was changed.
+
+        - `type: optional "claude_api_in_artifacts_enabled"`
+
+          default: claude_api_in_artifacts_enabled
+
+        - `current_value: optional boolean or null`
+
+          Setting value immediately after this change
+
+        - `previous_value: optional boolean or null`
+
+          Setting value immediately before this change
+
+      - `ConversationPreferences object`
+
+        The 'conversation_preferences' for the user were updated. Values omitted.
+
+        - `type: optional "conversation_preferences"`
+
+          default: conversation_preferences
+
+      - `CoworkGlobalInstructions object`
+
+        The Cowork global instructions were updated. Values omitted.
+
+        - `type: optional "cowork_global_instructions"`
+
+          default: cowork_global_instructions
 
     - `id: optional string`
 
@@ -126237,13 +127819,13 @@ compliance activities that can be filtered by various criteria.
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `UserConsentRevoked object`
+  - `VerificationEvidenceSubmitted object`
 
-    User revoked a previously granted consent for a specific entity.
+    Verification evidence was submitted for an organization's verification.
 
-    - `type: optional "user_consent_revoked"`
+    - `type: optional "verification_evidence_submitted"`
 
-      default: user_consent_revoked
+      default: verification_evidence_submitted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -126451,13 +128033,17 @@ compliance activities that can be filtered by various criteria.
 
         - `user_agent: optional string or null`
 
-    - `id: optional string`
+    - `verification_id: string`
 
-      Unique identifier for the activity e.g. 'activity_abcd1234'
+      Tagged ID of the verification the evidence was submitted for.
 
-    - `consent_id: optional string or null`
+    - `verification_type: string`
 
-    - `consent_type: optional string or null`
+      The type of verification the evidence was submitted for.
+
+    - `id: optional string`
+
+      Unique identifier for the activity e.g. 'activity_abcd1234'
 
     - `created_at: optional string`
 
@@ -126465,10 +128051,6 @@ compliance activities that can be filtered by various criteria.
 
       format: date-time
 
-    - `entity_id: optional string or null`
-
-    - `entity_type: optional string or null`
-
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -126477,13 +128059,13 @@ compliance activities that can be filtered by various criteria.
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeUserRoleUpdated object`
+  - `VerificationProgramApplicationCreated object`
 
-    A user's role within the organization was changed, or the user was added to or removed from the organization.
+    An organization applied to a verification program.
 
-    - `type: optional "claude_user_role_updated"`
+    - `type: optional "verification_program_application_created"`
 
-      default: claude_user_role_updated
+      default: verification_program_application_created
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -126691,13 +128273,9 @@ compliance activities that can be filtered by various criteria.
 
         - `user_agent: optional string or null`
 
-    - `user_email: string`
-
-      Email of the user whose role was changed
-
-    - `user_id: string`
+    - `program_slug: string`
 
-      ID of the user whose role was changed
+      The verification program the organization applied to.
 
     - `id: optional string`
 
@@ -126709,10 +128287,6 @@ compliance activities that can be filtered by various criteria.
 
       format: date-time
 
-    - `current_role: optional string or null`
-
-      If null, then user was removed from the Organization
-
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -126721,17 +128295,13 @@ compliance activities that can be filtered by various criteria.
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `previous_role: optional string or null`
-
-      If null, then user was added to the Organization
-
-  - `ClaudeUserSettingsUpdated object`
+  - `WorkspaceMemberSpendLimitCreated object`
 
-    User updated their personal settings.
+    A per-member or workspace-default Claude Code spend limit was created.
 
-    - `type: optional "claude_user_settings_updated"`
+    - `type: optional "workspace_member_spend_limit_created"`
 
-      default: claude_user_settings_updated
+      default: workspace_member_spend_limit_created
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -126939,364 +128509,262 @@ compliance activities that can be filtered by various criteria.
 
         - `user_agent: optional string or null`
 
-    - `updates: array of FullName or DisplayName or ArtifactsEnabled or 19 more`
-
-      - `FullName object`
-
-        The full name setting was changed.
-
-        - `type: optional "full_name"`
-
-          default: full_name
-
-        - `current_value: optional string or null`
-
-          Setting value immediately after this change
-
-        - `previous_value: optional string or null`
-
-          Setting value immediately before this change
-
-      - `DisplayName object`
-
-        The display name setting was changed.
-
-        - `type: optional "display_name"`
-
-          default: display_name
-
-        - `current_value: optional string or null`
-
-          Setting value immediately after this change
-
-        - `previous_value: optional string or null`
-
-          Setting value immediately before this change
-
-      - `ArtifactsEnabled object`
-
-        The artifacts setting was changed.
-
-        - `type: optional "artifacts_enabled"`
-
-          default: artifacts_enabled
-
-        - `current_value: optional boolean or null`
-
-          Setting value immediately after this change
-
-        - `previous_value: optional boolean or null`
-
-          Setting value immediately before this change
-
-      - `LatexEnabled object`
-
-        The LaTeX setting was changed.
-
-        - `type: optional "latex_enabled"`
-
-          default: latex_enabled
-
-        - `current_value: optional boolean or null`
-
-          Setting value immediately after this change
-
-        - `previous_value: optional boolean or null`
-
-          Setting value immediately before this change
-
-      - `AnalysisToolEnabled object`
-
-        The analysis tool setting was changed.
-
-        - `type: optional "analysis_tool_enabled"`
-
-          default: analysis_tool_enabled
-
-        - `current_value: optional boolean or null`
-
-          Setting value immediately after this change
-
-        - `previous_value: optional boolean or null`
-
-          Setting value immediately before this change
-
-      - `ChatSuggestionsEnabled object`
-
-        The chat suggestions setting was changed.
-
-        - `type: optional "chat_suggestions_enabled"`
-
-          default: chat_suggestions_enabled
-
-        - `current_value: optional boolean or null`
-
-          Setting value immediately after this change
-
-        - `previous_value: optional boolean or null`
-
-          Setting value immediately before this change
-
-      - `MultimodalPdfsEnabled object`
-
-        The multimodal PDFs setting was changed.
-
-        - `type: optional "multimodal_pdfs_enabled"`
-
-          default: multimodal_pdfs_enabled
-
-        - `current_value: optional boolean or null`
-
-          Setting value immediately after this change
-
-        - `previous_value: optional boolean or null`
+    - `id: optional string`
 
-          Setting value immediately before this change
+      Unique identifier for the activity e.g. 'activity_abcd1234'
 
-      - `GdriveEnabled object`
+    - `account_id: optional string or null`
 
-        The Google Drive setting was changed.
+      Tagged ID of the user (null for workspace-wide default).
 
-        - `type: optional "gdrive_enabled"`
+    - `created_at: optional string`
 
-          default: gdrive_enabled
+      When this activity occurred.
 
-        - `current_value: optional boolean or null`
+      format: date-time
 
-          Setting value immediately after this change
+    - `limit_action: optional string or null`
 
-        - `previous_value: optional boolean or null`
+      The action taken when the limit is reached.
 
-          Setting value immediately before this change
+    - `limit_usd: optional number or null`
 
-      - `WebSearchEnabled object`
+      The spend limit threshold in USD cents.
 
-        The web search setting was changed.
+    - `organization_id: optional string or null`
 
-        - `type: optional "web_search_enabled"`
+      Organization ID this activity is associated with
 
-          default: web_search_enabled
+    - `organization_uuid: optional string or null`
 
-        - `current_value: optional boolean or null`
+      Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-          Setting value immediately after this change
+    - `workspace_id: optional string or null`
 
-        - `previous_value: optional boolean or null`
+      Tagged ID of the workspace.
 
-          Setting value immediately before this change
+  - `WorkspaceMemberSpendLimitDeleted object`
 
-      - `GeolocationEnabled object`
+    A per-member or workspace-default Claude Code spend limit was deleted.
 
-        The geolocation setting was changed.
+    - `type: optional "workspace_member_spend_limit_deleted"`
 
-        - `type: optional "geolocation_enabled"`
+      default: workspace_member_spend_limit_deleted
 
-          default: geolocation_enabled
+    - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
-        - `current_value: optional boolean or null`
+      - `APIActor object`
 
-          Setting value immediately after this change
+        - `type: optional "api_actor"`
 
-        - `previous_value: optional boolean or null`
+          default: api_actor
 
-          Setting value immediately before this change
+        - `api_key_id: string`
 
-      - `EnabledSaffron object`
+        - `ip_address: string`
 
-        The memory setting was changed for the user.
+        - `user_agent: string`
 
-        - `type: optional "enabled_saffron"`
+      - `UserActor object`
 
-          default: enabled_saffron
+        - `type: optional "user_actor"`
 
-        - `current_value: optional boolean or null`
+          default: user_actor
 
-          Setting value immediately after this change
+        - `email_address: string`
 
-        - `previous_value: optional boolean or null`
+          format: email
 
-          Setting value immediately before this change
+        - `ip_address: string`
 
-      - `McpToolsEnabled object`
+        - `user_agent: string`
 
-        The MCP tools setting was changed.
+        - `user_id: string`
 
-        - `type: optional "mcp_tools_enabled"`
+      - `UnauthenticatedUserActor object`
 
-          default: mcp_tools_enabled
+        - `type: optional "unauthenticated_user_actor"`
 
-        - `current_value: optional map[boolean] or null`
+          default: unauthenticated_user_actor
 
-          Setting value immediately after this change
+        - `ip_address: string`
 
-        - `previous_value: optional map[boolean] or null`
+        - `user_agent: string`
 
-          Setting value immediately before this change
+        - `unauthenticated_email_address: optional string or null`
 
-      - `CliOpPermissionsEnabled object`
+          format: email
 
-        The CLI operation permissions setting was changed.
+      - `AnthropicActor object`
 
-        - `type: optional "cli_op_permissions_enabled"`
+        - `type: optional "anthropic_actor"`
 
-          default: cli_op_permissions_enabled
+          default: anthropic_actor
 
-        - `current_value: optional map[string] or null`
+        - `email_address: optional string or null`
 
-          Setting value immediately after this change
+          format: email
 
-        - `previous_value: optional map[string] or null`
+      - `SystemActor object`
 
-          Setting value immediately before this change
+        Automated background processing performed by Anthropic systems, acting
+        without a user or customer credential.
 
-      - `GoogleDriveSearchEnabled object`
+        - `type: optional "system_actor"`
 
-        The Google Drive search setting was changed.
+          default: system_actor
 
-        - `type: optional "google_drive_search_enabled"`
+        - `service: optional string or null`
 
-          default: google_drive_search_enabled
+          Name of the automated process that performed the action, when known.
 
-        - `current_value: optional boolean or null`
+      - `AdminAPIKeyActor object`
 
-          Setting value immediately after this change
+        - `type: optional "admin_api_key_actor"`
 
-        - `previous_value: optional boolean or null`
+          default: admin_api_key_actor
 
-          Setting value immediately before this change
+        - `admin_api_key_id: string`
 
-      - `GmailIntegrationEnabled object`
+        - `ip_address: string`
 
-        The Gmail integration setting was changed.
+        - `user_agent: string`
 
-        - `type: optional "gmail_integration_enabled"`
+      - `ServiceAccountActor object`
 
-          default: gmail_integration_enabled
+        - `type: optional "service_account_actor"`
 
-        - `current_value: optional boolean or null`
+          default: service_account_actor
 
-          Setting value immediately after this change
+        - `ip_address: string`
 
-        - `previous_value: optional boolean or null`
+        - `service_account_id: string`
 
-          Setting value immediately before this change
+        - `user_agent: string`
 
-      - `GoogleCalendarIntegrationEnabled object`
+      - `ScimDirectorySyncActor object`
 
-        The Google Calendar integration setting was changed.
+        - `type: optional "scim_directory_sync_actor"`
 
-        - `type: optional "google_calendar_integration_enabled"`
+          default: scim_directory_sync_actor
 
-          default: google_calendar_integration_enabled
+        - `directory_id: string`
 
-        - `current_value: optional boolean or null`
+        - `workos_event_id: string`
 
-          Setting value immediately after this change
+        - `idp_connection_type: optional string or null`
 
-        - `previous_value: optional boolean or null`
+      - `FederatedIdentityActor object`
 
-          Setting value immediately before this change
+        A federated external workload authenticated via a verified OIDC token.
 
-      - `ThinkingModeEnabled object`
+        Carries the verified issuer, subject, and audience claims from the
+        presented JWT.
 
-        The thinking mode setting was changed.
+        - `type: optional "federated_identity_actor"`
 
-        - `type: optional "thinking_mode_enabled"`
+          default: federated_identity_actor
 
-          default: thinking_mode_enabled
+        - `issuer: string`
 
-        - `current_value: optional "adaptive" or "extended" or "off" or "unspecified" or null`
+        - `subject: string`
 
-          Setting value immediately after this change
+        - `audience: optional array of string`
 
-          - `"adaptive"`
+        - `ip_address: optional string or null`
 
-          - `"extended"`
+        - `user_agent: optional string or null`
 
-          - `"off"`
+      - `FederatedActor object`
 
-          - `"unspecified"`
+        An external identity asserted by a trusted provider — a cloud-provider
+        gateway or a customer-registered federation issuer — acting without an
+        Anthropic-provisioned account or service account.
 
-        - `previous_value: optional "adaptive" or "extended" or "off" or "unspecified" or null`
+        - `type: optional "federated_actor"`
 
-          Setting value immediately before this change
+          default: federated_actor
 
-          - `"adaptive"`
+        - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
 
-          - `"extended"`
+          - `FederatedActorAwsProvider object`
 
-          - `"off"`
+            Asserting party: the AWS account the organization is bound to.
 
-          - `"unspecified"`
+            - `type: optional "aws"`
 
-      - `ResearchModeEnabled object`
+              default: aws
 
-        The research mode setting was changed.
+            - `account_id: string`
 
-        - `type: optional "research_mode_enabled"`
+            - `signed_principal: string`
 
-          default: research_mode_enabled
+              The AWS-signed ARN of the IAM principal that requested the token.
 
-        - `current_value: optional boolean or null`
+          - `FederatedActorAzureProvider object`
 
-          Setting value immediately after this change
+            Asserting party: the Azure subscription the organization is bound to.
 
-        - `previous_value: optional boolean or null`
+            - `type: optional "azure"`
 
-          Setting value immediately before this change
+              default: azure
 
-      - `ComputerUseEnabled object`
+            - `subscription_id: string`
 
-        The computer use setting was changed.
+          - `FederatedActorGcpProvider object`
 
-        - `type: optional "computer_use_enabled"`
+            Asserting party: the GCP project the organization is bound to.
 
-          default: computer_use_enabled
+            - `type: optional "gcp"`
 
-        - `current_value: optional boolean or null`
+              default: gcp
 
-          Setting value immediately after this change
+            - `project_number: string`
 
-        - `previous_value: optional boolean or null`
+          - `FederatedActorOidcProvider object`
 
-          Setting value immediately before this change
+            Asserting party: a customer-registered OIDC federation issuer.
 
-      - `ClaudeAPIInArtifactsEnabled object`
+            - `type: optional "oidc"`
 
-        The Claude API in Artifacts setting was changed.
+              default: oidc
 
-        - `type: optional "claude_api_in_artifacts_enabled"`
+            - `issuer: optional string or null`
 
-          default: claude_api_in_artifacts_enabled
+              The federation issuer's URL. Null when the presented credential failed verification.
 
-        - `current_value: optional boolean or null`
+        - `ip_address: optional string or null`
 
-          Setting value immediately after this change
+        - `subject: optional string or null`
 
-        - `previous_value: optional boolean or null`
+          The provider's verified identifier for the caller; its form depends on the provider.
 
-          Setting value immediately before this change
+        - `user_agent: optional string or null`
 
-      - `ConversationPreferences object`
+      - `AttestedDeviceActor object`
 
-        The 'conversation_preferences' for the user were updated. Values omitted.
+        An attested mobile device authenticated via Apple App Attest.
 
-        - `type: optional "conversation_preferences"`
+        - `type: optional "attested_device_actor"`
 
-          default: conversation_preferences
+          default: attested_device_actor
 
-      - `CoworkGlobalInstructions object`
+        - `external_client_id: string`
 
-        The Cowork global instructions were updated. Values omitted.
+        - `kid_hash: string`
 
-        - `type: optional "cowork_global_instructions"`
+        - `ip_address: optional string or null`
 
-          default: cowork_global_instructions
+        - `user_agent: optional string or null`
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
+    - `account_id: optional string or null`
+
+      Tagged ID of the user (null for workspace-wide default).
+
     - `created_at: optional string`
 
       When this activity occurred.
@@ -127311,13 +128779,21 @@ compliance activities that can be filtered by various criteria.
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `VerificationEvidenceSubmitted object`
+    - `spend_limit_id: optional string or null`
 
-    Verification evidence was submitted for an organization's verification.
+      UUID of the deleted spend limit.
 
-    - `type: optional "verification_evidence_submitted"`
+    - `workspace_id: optional string or null`
 
-      default: verification_evidence_submitted
+      Tagged ID of the workspace.
+
+  - `WorkspaceMemberSpendLimitUpdated object`
+
+    A per-member Claude Code spend limit amount was updated.
+
+    - `type: optional "workspace_member_spend_limit_updated"`
+
+      default: workspace_member_spend_limit_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -127525,24 +129001,24 @@ compliance activities that can be filtered by various criteria.
 
         - `user_agent: optional string or null`
 
-    - `verification_id: string`
-
-      Tagged ID of the verification the evidence was submitted for.
-
-    - `verification_type: string`
-
-      The type of verification the evidence was submitted for.
-
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
+    - `account_id: optional string or null`
+
+      Tagged ID of the user (null for workspace-wide default).
+
     - `created_at: optional string`
 
       When this activity occurred.
 
       format: date-time
 
+    - `new_limit_usd: optional number or null`
+
+      The new spend limit threshold in USD cents.
+
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -127551,13 +129027,21 @@ compliance activities that can be filtered by various criteria.
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `VerificationProgramApplicationCreated object`
+    - `spend_limit_id: optional string or null`
 
-    An organization applied to a verification program.
+      UUID of the spend limit.
 
-    - `type: optional "verification_program_application_created"`
+    - `workspace_id: optional string or null`
 
-      default: verification_program_application_created
+      Tagged ID of the workspace.
+
+  - `WorkspaceSpendLimitAlertEmailsUpdated object`
+
+    Spend limit alert email recipients were updated for a workspace.
+
+    - `type: optional "workspace_spend_limit_alert_emails_updated"`
+
+      default: workspace_spend_limit_alert_emails_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -127765,14 +129249,14 @@ compliance activities that can be filtered by various criteria.
 
         - `user_agent: optional string or null`
 
-    - `program_slug: string`
-
-      The verification program the organization applied to.
-
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
+    - `alert_emails: optional array of string or null`
+
+      Updated list of alert email addresses.
+
     - `created_at: optional string`
 
       When this activity occurred.
@@ -127787,13 +129271,17 @@ compliance activities that can be filtered by various criteria.
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `WorkspaceMemberSpendLimitCreated object`
+    - `workspace_id: optional string or null`
 
-    A per-member or workspace-default Claude Code spend limit was created.
+      Tagged ID of the workspace.
 
-    - `type: optional "workspace_member_spend_limit_created"`
+  - `WorkspaceSpendLimitCreated object`
 
-      default: workspace_member_spend_limit_created
+    A workspace-level API spend limit was created.
+
+    - `type: optional "workspace_spend_limit_created"`
+
+      default: workspace_spend_limit_created
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -128005,10 +129493,6 @@ compliance activities that can be filtered by various criteria.
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `account_id: optional string or null`
-
-      Tagged ID of the user (null for workspace-wide default).
-
     - `created_at: optional string`
 
       When this activity occurred.
@@ -128017,7 +129501,7 @@ compliance activities that can be filtered by various criteria.
 
     - `limit_action: optional string or null`
 
-      The action taken when the limit is reached.
+      The action taken when the limit is reached (notify_only or notify_and_pause).
 
     - `limit_usd: optional number or null`
 
@@ -128035,13 +129519,302 @@ compliance activities that can be filtered by various criteria.
 
       Tagged ID of the workspace.
 
-  - `WorkspaceMemberSpendLimitDeleted object`
+  - `WorkspaceSpendLimitDeleted object`
 
-    A per-member or workspace-default Claude Code spend limit was deleted.
+    A workspace-level API spend limit was deleted.
 
-    - `type: optional "workspace_member_spend_limit_deleted"`
+    - `type: optional "workspace_spend_limit_deleted"`
 
-      default: workspace_member_spend_limit_deleted
+      default: workspace_spend_limit_deleted
+
+    - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
+
+      - `APIActor object`
+
+        - `type: optional "api_actor"`
+
+          default: api_actor
+
+        - `api_key_id: string`
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+      - `UserActor object`
+
+        - `type: optional "user_actor"`
+
+          default: user_actor
+
+        - `email_address: string`
+
+          format: email
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+        - `user_id: string`
+
+      - `UnauthenticatedUserActor object`
+
+        - `type: optional "unauthenticated_user_actor"`
+
+          default: unauthenticated_user_actor
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+        - `unauthenticated_email_address: optional string or null`
+
+          format: email
+
+      - `AnthropicActor object`
+
+        - `type: optional "anthropic_actor"`
+
+          default: anthropic_actor
+
+        - `email_address: optional string or null`
+
+          format: email
+
+      - `SystemActor object`
+
+        Automated background processing performed by Anthropic systems, acting
+        without a user or customer credential.
+
+        - `type: optional "system_actor"`
+
+          default: system_actor
+
+        - `service: optional string or null`
+
+          Name of the automated process that performed the action, when known.
+
+      - `AdminAPIKeyActor object`
+
+        - `type: optional "admin_api_key_actor"`
+
+          default: admin_api_key_actor
+
+        - `admin_api_key_id: string`
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+      - `ServiceAccountActor object`
+
+        - `type: optional "service_account_actor"`
+
+          default: service_account_actor
+
+        - `ip_address: string`
+
+        - `service_account_id: string`
+
+        - `user_agent: string`
+
+      - `ScimDirectorySyncActor object`
+
+        - `type: optional "scim_directory_sync_actor"`
+
+          default: scim_directory_sync_actor
+
+        - `directory_id: string`
+
+        - `workos_event_id: string`
+
+        - `idp_connection_type: optional string or null`
+
+      - `FederatedIdentityActor object`
+
+        A federated external workload authenticated via a verified OIDC token.
+
+        Carries the verified issuer, subject, and audience claims from the
+        presented JWT.
+
+        - `type: optional "federated_identity_actor"`
+
+          default: federated_identity_actor
+
+        - `issuer: string`
+
+        - `subject: string`
+
+        - `audience: optional array of string`
+
+        - `ip_address: optional string or null`
+
+        - `user_agent: optional string or null`
+
+      - `FederatedActor object`
+
+        An external identity asserted by a trusted provider — a cloud-provider
+        gateway or a customer-registered federation issuer — acting without an
+        Anthropic-provisioned account or service account.
+
+        - `type: optional "federated_actor"`
+
+          default: federated_actor
+
+        - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
+
+          - `FederatedActorAwsProvider object`
+
+            Asserting party: the AWS account the organization is bound to.
+
+            - `type: optional "aws"`
+
+              default: aws
+
+            - `account_id: string`
+
+            - `signed_principal: string`
+
+              The AWS-signed ARN of the IAM principal that requested the token.
+
+          - `FederatedActorAzureProvider object`
+
+            Asserting party: the Azure subscription the organization is bound to.
+
+            - `type: optional "azure"`
+
+              default: azure
+
+            - `subscription_id: string`
+
+          - `FederatedActorGcpProvider object`
+
+            Asserting party: the GCP project the organization is bound to.
+
+            - `type: optional "gcp"`
+
+              default: gcp
+
+            - `project_number: string`
+
+          - `FederatedActorOidcProvider object`
+
+            Asserting party: a customer-registered OIDC federation issuer.
+
+            - `type: optional "oidc"`
+
+              default: oidc
+
+            - `issuer: optional string or null`
+
+              The federation issuer's URL. Null when the presented credential failed verification.
+
+        - `ip_address: optional string or null`
+
+        - `subject: optional string or null`
+
+          The provider's verified identifier for the caller; its form depends on the provider.
+
+        - `user_agent: optional string or null`
+
+      - `AttestedDeviceActor object`
+
+        An attested mobile device authenticated via Apple App Attest.
+
+        - `type: optional "attested_device_actor"`
+
+          default: attested_device_actor
+
+        - `external_client_id: string`
+
+        - `kid_hash: string`
+
+        - `ip_address: optional string or null`
+
+        - `user_agent: optional string or null`
+
+    - `id: optional string`
+
+      Unique identifier for the activity e.g. 'activity_abcd1234'
+
+    - `created_at: optional string`
+
+      When this activity occurred.
+
+      format: date-time
+
+    - `organization_id: optional string or null`
+
+      Organization ID this activity is associated with
+
+    - `organization_uuid: optional string or null`
+
+      Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
+
+    - `spend_limit_id: optional string or null`
+
+      UUID of the deleted spend limit.
+
+    - `workspace_id: optional string or null`
+
+      Tagged ID of the workspace.
+
+- `first_id: optional string or null`
+
+- `has_more: optional boolean`
+
+  default: false
+
+- `last_id: optional string or null`
+
+### Example
+
+```bash
+curl https://api.anthropic.com/v1/compliance/activities \
+    -H 'anthropic-version: 2023-06-01' \
+    -H "Authorization: Bearer $ANTHROPIC_COMPLIANCE_API_KEY"
+```
+
+#### Response (200)
+
+```json
+{
+  "data": [
+    {
+      "actor": {
+        "api_key_id": "api_key_id",
+        "ip_address": "ip_address",
+        "user_agent": "user_agent",
+        "type": "api_actor"
+      },
+      "decision": "blocked",
+      "id": "id",
+      "abuse_session_id": "abuse_session_id",
+      "created_at": "2019-12-27T18:11:19.117Z",
+      "organization_id": "organization_id",
+      "organization_uuid": "organization_uuid",
+      "type": "abuse_decision_received"
+    }
+  ],
+  "first_id": "first_id",
+  "has_more": true,
+  "last_id": "last_id"
+}
+```
+
+## Domain types
+
+### Activity List Response
+
+- `ActivityListResponse = AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 503 more`
+
+  - `AbuseDecisionReceived object`
+
+    An external anti-abuse service reported a consequential decision about a sign-in or sign-up attempt.
+
+    - `type: optional "abuse_decision_received"`
+
+      default: abuse_decision_received
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -128249,257 +130022,21 @@ compliance activities that can be filtered by various criteria.
 
         - `user_agent: optional string or null`
 
-    - `id: optional string`
-
-      Unique identifier for the activity e.g. 'activity_abcd1234'
-
-    - `account_id: optional string or null`
-
-      Tagged ID of the user (null for workspace-wide default).
-
-    - `created_at: optional string`
-
-      When this activity occurred.
-
-      format: date-time
-
-    - `organization_id: optional string or null`
-
-      Organization ID this activity is associated with
-
-    - `organization_uuid: optional string or null`
-
-      Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
-
-    - `spend_limit_id: optional string or null`
-
-      UUID of the deleted spend limit.
-
-    - `workspace_id: optional string or null`
-
-      Tagged ID of the workspace.
-
-  - `WorkspaceMemberSpendLimitUpdated object`
-
-    A per-member Claude Code spend limit amount was updated.
-
-    - `type: optional "workspace_member_spend_limit_updated"`
-
-      default: workspace_member_spend_limit_updated
-
-    - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
-
-      - `APIActor object`
-
-        - `type: optional "api_actor"`
-
-          default: api_actor
-
-        - `api_key_id: string`
-
-        - `ip_address: string`
-
-        - `user_agent: string`
-
-      - `UserActor object`
-
-        - `type: optional "user_actor"`
-
-          default: user_actor
-
-        - `email_address: string`
-
-          format: email
-
-        - `ip_address: string`
-
-        - `user_agent: string`
-
-        - `user_id: string`
-
-      - `UnauthenticatedUserActor object`
-
-        - `type: optional "unauthenticated_user_actor"`
-
-          default: unauthenticated_user_actor
-
-        - `ip_address: string`
-
-        - `user_agent: string`
-
-        - `unauthenticated_email_address: optional string or null`
-
-          format: email
-
-      - `AnthropicActor object`
-
-        - `type: optional "anthropic_actor"`
-
-          default: anthropic_actor
-
-        - `email_address: optional string or null`
-
-          format: email
-
-      - `SystemActor object`
-
-        Automated background processing performed by Anthropic systems, acting
-        without a user or customer credential.
-
-        - `type: optional "system_actor"`
-
-          default: system_actor
-
-        - `service: optional string or null`
-
-          Name of the automated process that performed the action, when known.
-
-      - `AdminAPIKeyActor object`
-
-        - `type: optional "admin_api_key_actor"`
-
-          default: admin_api_key_actor
-
-        - `admin_api_key_id: string`
-
-        - `ip_address: string`
-
-        - `user_agent: string`
-
-      - `ServiceAccountActor object`
-
-        - `type: optional "service_account_actor"`
-
-          default: service_account_actor
-
-        - `ip_address: string`
-
-        - `service_account_id: string`
-
-        - `user_agent: string`
-
-      - `ScimDirectorySyncActor object`
-
-        - `type: optional "scim_directory_sync_actor"`
-
-          default: scim_directory_sync_actor
-
-        - `directory_id: string`
-
-        - `workos_event_id: string`
-
-        - `idp_connection_type: optional string or null`
-
-      - `FederatedIdentityActor object`
-
-        A federated external workload authenticated via a verified OIDC token.
-
-        Carries the verified issuer, subject, and audience claims from the
-        presented JWT.
-
-        - `type: optional "federated_identity_actor"`
-
-          default: federated_identity_actor
-
-        - `issuer: string`
-
-        - `subject: string`
-
-        - `audience: optional array of string`
-
-        - `ip_address: optional string or null`
-
-        - `user_agent: optional string or null`
-
-      - `FederatedActor object`
-
-        An external identity asserted by a trusted provider — a cloud-provider
-        gateway or a customer-registered federation issuer — acting without an
-        Anthropic-provisioned account or service account.
-
-        - `type: optional "federated_actor"`
-
-          default: federated_actor
-
-        - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
-
-          - `FederatedActorAwsProvider object`
-
-            Asserting party: the AWS account the organization is bound to.
-
-            - `type: optional "aws"`
-
-              default: aws
-
-            - `account_id: string`
-
-            - `signed_principal: string`
-
-              The AWS-signed ARN of the IAM principal that requested the token.
-
-          - `FederatedActorAzureProvider object`
-
-            Asserting party: the Azure subscription the organization is bound to.
-
-            - `type: optional "azure"`
-
-              default: azure
-
-            - `subscription_id: string`
-
-          - `FederatedActorGcpProvider object`
-
-            Asserting party: the GCP project the organization is bound to.
-
-            - `type: optional "gcp"`
-
-              default: gcp
-
-            - `project_number: string`
-
-          - `FederatedActorOidcProvider object`
-
-            Asserting party: a customer-registered OIDC federation issuer.
-
-            - `type: optional "oidc"`
-
-              default: oidc
-
-            - `issuer: optional string or null`
-
-              The federation issuer's URL. Null when the presented credential failed verification.
-
-        - `ip_address: optional string or null`
-
-        - `subject: optional string or null`
-
-          The provider's verified identifier for the caller; its form depends on the provider.
-
-        - `user_agent: optional string or null`
-
-      - `AttestedDeviceActor object`
-
-        An attested mobile device authenticated via Apple App Attest.
-
-        - `type: optional "attested_device_actor"`
-
-          default: attested_device_actor
-
-        - `external_client_id: string`
+    - `decision: "blocked" or "unspecified"`
 
-        - `kid_hash: string`
+      The decision applied to the session.
 
-        - `ip_address: optional string or null`
+      - `"blocked"`
 
-        - `user_agent: optional string or null`
+      - `"unspecified"`
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `account_id: optional string or null`
+    - `abuse_session_id: optional string or null`
 
-      Tagged ID of the user (null for workspace-wide default).
+      The anti-abuse service's opaque session identifier for correlation.
 
     - `created_at: optional string`
 
@@ -128507,10 +130044,6 @@ compliance activities that can be filtered by various criteria.
 
       format: date-time
 
-    - `new_limit_usd: optional number or null`
-
-      The new spend limit threshold in USD cents.
-
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -128519,21 +130052,13 @@ compliance activities that can be filtered by various criteria.
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `spend_limit_id: optional string or null`
-
-      UUID of the spend limit.
-
-    - `workspace_id: optional string or null`
-
-      Tagged ID of the workspace.
-
-  - `WorkspaceSpendLimitAlertEmailsUpdated object`
+  - `AccountDeleted object`
 
-    Spend limit alert email recipients were updated for a workspace.
+    User-initiated self-service account deletion.
 
-    - `type: optional "workspace_spend_limit_alert_emails_updated"`
+    - `type: optional "account_deleted"`
 
-      default: workspace_spend_limit_alert_emails_updated
+      default: account_deleted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -128745,10 +130270,6 @@ compliance activities that can be filtered by various criteria.
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `alert_emails: optional array of string or null`
-
-      Updated list of alert email addresses.
-
     - `created_at: optional string`
 
       When this activity occurred.
@@ -128763,17 +130284,13 @@ compliance activities that can be filtered by various criteria.
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `workspace_id: optional string or null`
-
-      Tagged ID of the workspace.
-
-  - `WorkspaceSpendLimitCreated object`
+  - `AdminAPIKeyCreated object`
 
-    A workspace-level API spend limit was created.
+    An admin API key was created.
 
-    - `type: optional "workspace_spend_limit_created"`
+    - `type: optional "admin_api_key_created"`
 
-      default: workspace_spend_limit_created
+      default: admin_api_key_created
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -128981,6 +130498,10 @@ compliance activities that can be filtered by various criteria.
 
         - `user_agent: optional string or null`
 
+    - `admin_api_key_id: string`
+
+      Tagged ID of the created admin API key
+
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
@@ -128991,14 +130512,6 @@ compliance activities that can be filtered by various criteria.
 
       format: date-time
 
-    - `limit_action: optional string or null`
-
-      The action taken when the limit is reached (notify_only or notify_and_pause).
-
-    - `limit_usd: optional number or null`
-
-      The spend limit threshold in USD cents.
-
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -129007,17 +130520,17 @@ compliance activities that can be filtered by various criteria.
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `workspace_id: optional string or null`
+    - `scopes: optional array of string`
 
-      Tagged ID of the workspace.
+      Scopes granted to the key (empty for legacy non-scoped admin keys)
 
-  - `WorkspaceSpendLimitDeleted object`
+  - `AdminAPIKeyDeleted object`
 
-    A workspace-level API spend limit was deleted.
+    An admin API key was deleted.
 
-    - `type: optional "workspace_spend_limit_deleted"`
+    - `type: optional "admin_api_key_deleted"`
 
-      default: workspace_spend_limit_deleted
+      default: admin_api_key_deleted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -129225,6 +130738,10 @@ compliance activities that can be filtered by various criteria.
 
         - `user_agent: optional string or null`
 
+    - `admin_api_key_id: string`
+
+      Tagged ID of the deleted admin API key
+
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
@@ -129243,70 +130760,13 @@ compliance activities that can be filtered by various criteria.
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `spend_limit_id: optional string or null`
-
-      UUID of the deleted spend limit.
-
-    - `workspace_id: optional string or null`
-
-      Tagged ID of the workspace.
-
-- `first_id: optional string or null`
-
-- `has_more: optional boolean`
-
-  default: false
-
-- `last_id: optional string or null`
-
-### Example
-
-```bash
-curl https://api.anthropic.com/v1/compliance/activities \
-    -H 'anthropic-version: 2023-06-01' \
-    -H "Authorization: Bearer $ANTHROPIC_COMPLIANCE_API_KEY"
-```
-
-#### Response (200)
-
-```json
-{
-  "data": [
-    {
-      "actor": {
-        "api_key_id": "api_key_id",
-        "ip_address": "ip_address",
-        "user_agent": "user_agent",
-        "type": "api_actor"
-      },
-      "decision": "blocked",
-      "id": "id",
-      "abuse_session_id": "abuse_session_id",
-      "created_at": "2019-12-27T18:11:19.117Z",
-      "organization_id": "organization_id",
-      "organization_uuid": "organization_uuid",
-      "type": "abuse_decision_received"
-    }
-  ],
-  "first_id": "first_id",
-  "has_more": true,
-  "last_id": "last_id"
-}
-```
-
-## Domain types
-
-### Activity List Response
-
-- `ActivityListResponse = AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 501 more`
-
-  - `AbuseDecisionReceived object`
+  - `AdminAPIKeyUpdated object`
 
-    An external anti-abuse service reported a consequential decision about a sign-in or sign-up attempt.
+    An admin API key was updated (renamed or activated/deactivated).
 
-    - `type: optional "abuse_decision_received"`
+    - `type: optional "admin_api_key_updated"`
 
-      default: abuse_decision_received
+      default: admin_api_key_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -129514,22 +130974,14 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `decision: "blocked" or "unspecified"`
-
-      The decision applied to the session.
-
-      - `"blocked"`
+    - `admin_api_key_id: string`
 
-      - `"unspecified"`
+      Tagged ID of the updated admin API key
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `abuse_session_id: optional string or null`
-
-      The anti-abuse service's opaque session identifier for correlation.
-
     - `created_at: optional string`
 
       When this activity occurred.
@@ -129544,13 +130996,35 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `AccountDeleted object`
+    - `updates: optional array of object`
 
-    User-initiated self-service account deletion.
+      The field-level changes applied in this update
 
-    - `type: optional "account_deleted"`
+      - `type: "name" or "status" or "unspecified"`
 
-      default: account_deleted
+        The admin API key field that changed
+
+        - `"name"`
+
+        - `"status"`
+
+        - `"unspecified"`
+
+      - `current_value: string`
+
+        Field value immediately after this change
+
+      - `previous_value: string`
+
+        Field value immediately before this change
+
+  - `AdminConnectorRequestResolved object`
+
+    Admin approved or dismissed pending member requests to enable an MCP connector.
+
+    - `type: optional "admin_connector_request_resolved"`
+
+      default: admin_connector_request_resolved
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -129758,6 +131232,18 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
+    - `decision: "approved" or "dismissed" or "unspecified"`
+
+      - `"approved"`
+
+      - `"dismissed"`
+
+      - `"unspecified"`
+
+    - `mcp_server_id: string`
+
+    - `resolved_count: number`
+
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
@@ -129776,13 +131262,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `AdminAPIKeyCreated object`
+  - `AdminRequestCreated object`
 
-    An admin API key was created.
+    Admin request created by an org member (seat upgrade, limit increase, join org, end-user invite).
 
-    - `type: optional "admin_api_key_created"`
+    - `type: optional "admin_request_created"`
 
-      default: admin_api_key_created
+      default: admin_request_created
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -129990,9 +131476,7 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `admin_api_key_id: string`
-
-      Tagged ID of the created admin API key
+    - `request_type: string`
 
     - `id: optional string`
 
@@ -130012,17 +131496,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `scopes: optional array of string`
-
-      Scopes granted to the key (empty for legacy non-scoped admin keys)
-
-  - `AdminAPIKeyDeleted object`
+  - `AdminSetupChecklistStepDelegated object`
 
-    An admin API key was deleted.
+    A step of the Claude Enterprise admin setup checklist was delegated to a teammate — an organization member, or an email address that has not joined the organization yet — replacing any earlier delegation of that step.
 
-    - `type: optional "admin_api_key_deleted"`
+    - `type: optional "admin_setup_checklist_step_delegated"`
 
-      default: admin_api_key_deleted
+      default: admin_setup_checklist_step_delegated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -130230,9 +131710,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `admin_api_key_id: string`
+    - `step: string`
 
-      Tagged ID of the deleted admin API key
+      The checklist step that was delegated, for example `enable_sso` or `verify_domain`.
 
     - `id: optional string`
 
@@ -130244,6 +131724,14 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
+    - `delegate_email: optional string or null`
+
+      Email address the step was delegated to; present only when the delegate is not yet an organization member.
+
+    - `delegate_user_id: optional string or null`
+
+      Tagged ID of the organization member the step was delegated to; absent when the step was delegated to an email address that has not joined the organization.
+
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -130252,13 +131740,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `AdminAPIKeyUpdated object`
+  - `AdminSetupChecklistStepDelegationCancelled object`
 
-    An admin API key was updated (renamed or activated/deactivated).
+    The delegation of a Claude Enterprise admin setup checklist step was cancelled.
 
-    - `type: optional "admin_api_key_updated"`
+    - `type: optional "admin_setup_checklist_step_delegation_cancelled"`
 
-      default: admin_api_key_updated
+      default: admin_setup_checklist_step_delegation_cancelled
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -130466,9 +131954,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `admin_api_key_id: string`
+    - `step: string`
 
-      Tagged ID of the updated admin API key
+      The checklist step whose delegation was cancelled.
 
     - `id: optional string`
 
@@ -130488,35 +131976,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `updates: optional array of object`
-
-      The field-level changes applied in this update
-
-      - `type: "name" or "status" or "unspecified"`
-
-        The admin API key field that changed
-
-        - `"name"`
-
-        - `"status"`
-
-        - `"unspecified"`
-
-      - `current_value: string`
-
-        Field value immediately after this change
-
-      - `previous_value: string`
-
-        Field value immediately before this change
-
-  - `AdminConnectorRequestResolved object`
+  - `AgeVerified object`
 
-    Admin approved or dismissed pending member requests to enable an MCP connector.
+    User age was verified.
 
-    - `type: optional "admin_connector_request_resolved"`
+    - `type: optional "age_verified"`
 
-      default: admin_connector_request_resolved
+      default: age_verified
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -130724,18 +132190,6 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `decision: "approved" or "dismissed" or "unspecified"`
-
-      - `"approved"`
-
-      - `"dismissed"`
-
-      - `"unspecified"`
-
-    - `mcp_server_id: string`
-
-    - `resolved_count: number`
-
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
@@ -130754,13 +132208,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `AdminRequestCreated object`
+  - `AnonymousMobileLoginAttempted object`
 
-    Admin request created by an org member (seat upgrade, limit increase, join org, end-user invite).
+    Anonymous mobile login was attempted.
 
-    - `type: optional "admin_request_created"`
+    - `type: optional "anonymous_mobile_login_attempted"`
 
-      default: admin_request_created
+      default: anonymous_mobile_login_attempted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -130968,8 +132422,6 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `request_type: string`
-
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
@@ -130988,13 +132440,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `AdminSetupChecklistStepDelegated object`
+  - `APIKeyCreated object`
 
-    A step of the Claude Enterprise admin setup checklist was delegated to a teammate — an organization member, or an email address that has not joined the organization yet — replacing any earlier delegation of that step.
+    Activity logged when a new API key is created.
 
-    - `type: optional "admin_setup_checklist_step_delegated"`
+    - `type: optional "api_key_created"`
 
-      default: admin_setup_checklist_step_delegated
+      default: api_key_created
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -131202,9 +132654,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `step: string`
+    - `api_key_id: string`
 
-      The checklist step that was delegated, for example `enable_sso` or `verify_domain`.
+      The tagged ID of the created API key
 
     - `id: optional string`
 
@@ -131216,14 +132668,6 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
-    - `delegate_email: optional string or null`
-
-      Email address the step was delegated to; present only when the delegate is not yet an organization member.
-
-    - `delegate_user_id: optional string or null`
-
-      Tagged ID of the organization member the step was delegated to; absent when the step was delegated to an email address that has not joined the organization.
-
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -131232,13 +132676,21 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `AdminSetupChecklistStepDelegationCancelled object`
+    - `restricted_to_organization: optional boolean or null`
 
-    The delegation of a Claude Enterprise admin setup checklist step was cancelled.
+      Whether the key was restricted to the creating organization, rather than granted access across the whole parent organization
 
-    - `type: optional "admin_setup_checklist_step_delegation_cancelled"`
+    - `scopes: optional array of string`
 
-      default: admin_setup_checklist_step_delegation_cancelled
+      The scopes for this API key
+
+  - `ClaudeArtifactAccessFailed object`
+
+    An attempt to access an artifact failed.
+
+    - `type: optional "claude_artifact_access_failed"`
+
+      default: claude_artifact_access_failed
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -131446,14 +132898,18 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `step: string`
-
-      The checklist step whose delegation was cancelled.
-
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
+    - `claude_artifact_id: optional string or null`
+
+      The artifact's identifier, when known.
+
+    - `claude_artifact_version_id: optional string or null`
+
+      The version of the artifact the user attempted to access, when known.
+
     - `created_at: optional string`
 
       When this activity occurred.
@@ -131468,13 +132924,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `AgeVerified object`
+    - `reason: optional string or null`
 
-    User age was verified.
+      The reason access was denied, when recorded.
 
-    - `type: optional "age_verified"`
+  - `ClaudeArtifactCommented object`
 
-      default: age_verified
+    Comment activity on a published artifact: a comment was added, a thread's resolved state was changed, or a thread was deleted. The actor is the user who performed the action; the comment text itself is stored with the artifact and is not part of this record.
+
+    - `type: optional "claude_artifact_commented"`
+
+      default: claude_artifact_commented
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -131682,10 +133142,56 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
+    - `claude_artifact_id: string`
+
+      The artifact's identifier.
+
+    - `comment_action: "activate_thread" or "create_thread" or "deactivate_thread" or 10 more`
+
+      The action recorded: for example a new comment thread, a reply to an existing thread, a thread resolved, reopened, or deleted, a thread's Claude activation granted or revoked, a comment's text rewritten by its author, an existing comment sent to Claude or withdrawn from Claude, or a thread resolved by a Claude session.
+
+      - `"activate_thread"`
+
+      - `"create_thread"`
+
+      - `"deactivate_thread"`
+
+      - `"delete_thread"`
+
+      - `"edit_comment"`
+
+      - `"move_thread"`
+
+      - `"reopen"`
+
+      - `"reply"`
+
+      - `"resolve"`
+
+      - `"send_to_claude"`
+
+      - `"session_resolve"`
+
+      - `"unsend_to_claude"`
+
+      - `"unspecified"`
+
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
+    - `claude_artifact_comment_id: optional string or null`
+
+      The comment's identifier. Present when the activity relates to a specific comment, for example a new comment, an author's edit of one, or an existing comment sent to Claude or withdrawn from Claude; absent for thread-level actions performed without a comment, such as resolve, reopen, deletion, an activation change, or a resolve by a Claude session.
+
+    - `claude_artifact_comment_thread_id: optional string or null`
+
+      The comment thread's identifier.
+
+    - `claude_artifact_version_id: optional string or null`
+
+      The artifact version the comment activity applied to, when known.
+
     - `created_at: optional string`
 
       When this activity occurred.
@@ -131700,13 +133206,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `AnonymousMobileLoginAttempted object`
+  - `ClaudeArtifactCommentsViewed object`
 
-    Anonymous mobile login was attempted.
+    An artifact's comments were viewed.
 
-    - `type: optional "anonymous_mobile_login_attempted"`
+    - `type: optional "claude_artifact_comments_viewed"`
 
-      default: anonymous_mobile_login_attempted
+      default: claude_artifact_comments_viewed
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -131914,10 +133420,18 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
+    - `claude_artifact_id: string`
+
+      The artifact's identifier.
+
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
+    - `claude_artifact_version_id: optional string or null`
+
+      The version of the artifact whose comments were served, when known.
+
     - `created_at: optional string`
 
       When this activity occurred.
@@ -131932,13 +133446,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `APIKeyCreated object`
+  - `ClaudeArtifactCreated object`
 
-    Activity logged when a new API key is created.
+    An artifact was created.
 
-    - `type: optional "api_key_created"`
+    - `type: optional "claude_artifact_created"`
 
-      default: api_key_created
+      default: claude_artifact_created
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -132146,9 +133660,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `api_key_id: string`
+    - `claude_artifact_id: string`
 
-      The tagged ID of the created API key
+      Tagged ID of the artifact that was created, e.g. "claude_artifact_01HX...".
 
     - `id: optional string`
 
@@ -132168,21 +133682,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `restricted_to_organization: optional boolean or null`
-
-      Whether the key was restricted to the creating organization, rather than granted access across the whole parent organization
-
-    - `scopes: optional array of string`
-
-      The scopes for this API key
-
-  - `ClaudeArtifactAccessFailed object`
+  - `ClaudePublishedArtifactDeleted object`
 
-    An attempt to access an artifact failed.
+    A published artifact was deleted or unpublished — by its creator, by an organization admin, or by Anthropic (for example, when it was removed for a policy violation).
 
-    - `type: optional "claude_artifact_access_failed"`
+    - `type: optional "claude_published_artifact_deleted"`
 
-      default: claude_artifact_access_failed
+      default: claude_published_artifact_deleted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -132390,17 +133896,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `id: optional string`
-
-      Unique identifier for the activity e.g. 'activity_abcd1234'
-
-    - `claude_artifact_id: optional string or null`
+    - `claude_published_artifact_id: string`
 
-      The artifact's identifier, when known.
+      The published artifact's identifier.
 
-    - `claude_artifact_version_id: optional string or null`
+    - `id: optional string`
 
-      The version of the artifact the user attempted to access, when known.
+      Unique identifier for the activity e.g. 'activity_abcd1234'
 
     - `created_at: optional string`
 
@@ -132416,17 +133918,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `reason: optional string or null`
-
-      The reason access was denied, when recorded.
-
-  - `ClaudeArtifactCommented object`
+  - `ClaudeArtifactPublished object`
 
-    Comment activity on a published artifact: a comment was added, a thread's resolved state was changed, or a thread was deleted. The actor is the user who performed the action; the comment text itself is stored with the artifact and is not part of this record.
+    A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded on every save, including saves of private artifacts, and changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
 
-    - `type: optional "claude_artifact_commented"`
+    - `type: optional "claude_artifact_published"`
 
-      default: claude_artifact_commented
+      default: claude_artifact_published
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -132634,55 +134132,25 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `claude_artifact_id: string`
-
-      The artifact's identifier.
-
-    - `comment_action: "activate_thread" or "create_thread" or "deactivate_thread" or 10 more`
-
-      The action recorded: for example a new comment thread, a reply to an existing thread, a thread resolved, reopened, or deleted, a thread's Claude activation granted or revoked, a comment's text rewritten by its author, an existing comment sent to Claude or withdrawn from Claude, or a thread resolved by a Claude session.
-
-      - `"activate_thread"`
-
-      - `"create_thread"`
-
-      - `"deactivate_thread"`
-
-      - `"delete_thread"`
-
-      - `"edit_comment"`
-
-      - `"move_thread"`
-
-      - `"reopen"`
-
-      - `"reply"`
+    - `artifact_type: string`
 
-      - `"resolve"`
+      Artifact type (code, html, react, etc.)
 
-      - `"send_to_claude"`
+    - `claude_published_artifact_id: string`
 
-      - `"session_resolve"`
+      The published artifact's identifier.
 
-      - `"unsend_to_claude"`
+    - `title: string`
 
-      - `"unspecified"`
+      Title of the published artifact
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `claude_artifact_comment_id: optional string or null`
-
-      The comment's identifier. Present when the activity relates to a specific comment, for example a new comment, an author's edit of one, or an existing comment sent to Claude or withdrawn from Claude; absent for thread-level actions performed without a comment, such as resolve, reopen, deletion, an activation change, or a resolve by a Claude session.
-
-    - `claude_artifact_comment_thread_id: optional string or null`
-
-      The comment thread's identifier.
-
     - `claude_artifact_version_id: optional string or null`
 
-      The artifact version the comment activity applied to, when known.
+      The version identifier recorded as live by this publish.
 
     - `created_at: optional string`
 
@@ -132690,6 +134158,14 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
+    - `description: optional string or null`
+
+      No longer populated: the gallery-card description supplied at publish time is intentionally omitted from this feed.
+
+    - `is_redeploy: optional boolean or null`
+
+      True when the publish updated an existing artifact; false when the publish created the artifact.
+
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -132698,13 +134174,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeArtifactCommentsViewed object`
+  - `ClaudeArtifactSharingUpdated object`
 
-    An artifact's comments were viewed.
+    An artifact's sharing settings were updated.
 
-    - `type: optional "claude_artifact_comments_viewed"`
+    - `type: optional "claude_artifact_sharing_updated"`
 
-      default: claude_artifact_comments_viewed
+      default: claude_artifact_sharing_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -132912,17 +134388,45 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
+    - `audience: array of Organization or Users or AnyoneWithLink`
+
+      The artifact's sharing audience after the change. If empty, the artifact is visible only to its owner.
+
+      - `Organization object`
+
+        Sharing audience: visible to the owning organization.
+
+        - `type: optional "organization"`
+
+          default: organization
+
+      - `Users object`
+
+        Sharing audience: visible to an explicit allowlist of users.
+
+        - `type: optional "users"`
+
+          default: users
+
+      - `AnyoneWithLink object`
+
+        Sharing audience: anyone with the link, including anonymous viewers (an artifact shared to the open internet).
+
+        - `type: optional "anyone_with_link"`
+
+          default: anyone_with_link
+
     - `claude_artifact_id: string`
 
       The artifact's identifier.
 
-    - `id: optional string`
+    - `claude_artifact_version_id: string`
 
-      Unique identifier for the activity e.g. 'activity_abcd1234'
+      The artifact version's identifier.
 
-    - `claude_artifact_version_id: optional string or null`
+    - `id: optional string`
 
-      The version of the artifact whose comments were served, when known.
+      Unique identifier for the activity e.g. 'activity_abcd1234'
 
     - `created_at: optional string`
 
@@ -132930,6 +134434,22 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
+    - `new_mode: optional string or null`
+
+      The read-axis sharing mode after the change: `owner`, `users`, `org`, or `public` (anyone on the internet).
+
+    - `new_user_count: optional number or null`
+
+      The number of accounts on the explicit read allowlist after the change. Only meaningful when `new_mode` is `users`.
+
+    - `new_write_mode: optional string or null`
+
+      The write-axis sharing mode after the change: `owner`, `users`, or `org`.
+
+    - `new_write_user_count: optional number or null`
+
+      The number of accounts on the explicit write allowlist after the change. Only meaningful when `new_write_mode` is `users`.
+
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -132938,13 +134458,29 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeArtifactCreated object`
+    - `previous_mode: optional string or null`
 
-    An artifact was created.
+      The read-axis sharing mode before the change: `owner`, `users`, `org`, or `public` (anyone on the internet).
 
-    - `type: optional "claude_artifact_created"`
+    - `previous_user_count: optional number or null`
 
-      default: claude_artifact_created
+      The number of accounts on the explicit read allowlist before the change. Only meaningful when `previous_mode` is `users`.
+
+    - `previous_write_mode: optional string or null`
+
+      The write-axis sharing mode before the change: `owner`, `users`, or `org`.
+
+    - `previous_write_user_count: optional number or null`
+
+      The number of accounts on the explicit write allowlist before the change. Only meaningful when `previous_write_mode` is `users`.
+
+  - `ClaudeArtifactViewed object`
+
+    An artifact was viewed.
+
+    - `type: optional "claude_artifact_viewed"`
+
+      default: claude_artifact_viewed
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -133154,12 +134690,16 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
     - `claude_artifact_id: string`
 
-      Tagged ID of the artifact that was created, e.g. "claude_artifact_01HX...".
+      The artifact's identifier.
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
+    - `claude_artifact_version_id: optional string or null`
+
+      The version of the artifact the user was served, when known.
+
     - `created_at: optional string`
 
       When this activity occurred.
@@ -133174,13 +134714,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudePublishedArtifactDeleted object`
+  - `AuditLogExportAccessed object`
 
-    A published artifact was deleted or unpublished — by its creator, by an organization admin, or by Anthropic (for example, when it was removed for a policy violation).
+    Audit log export file was accessed/downloaded via signed URL.
 
-    - `type: optional "claude_published_artifact_deleted"`
+    - `type: optional "audit_log_export_accessed"`
 
-      default: claude_published_artifact_deleted
+      default: audit_log_export_accessed
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -133388,10 +134928,6 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `claude_published_artifact_id: string`
-
-      The published artifact's identifier.
-
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
@@ -133410,13 +134946,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeArtifactPublished object`
+  - `AuditLogExportStarted object`
 
-    A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded on every save, including saves of private artifacts, and changes to who can access the artifact are recorded separately as claude_artifact_sharing_updated.
+    Audit log export was initiated.
 
-    - `type: optional "claude_artifact_published"`
+    - `type: optional "audit_log_export_started"`
 
-      default: claude_artifact_published
+      default: audit_log_export_started
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -133624,25 +135160,253 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `artifact_type: string`
+    - `id: optional string`
 
-      Artifact type (code, html, react, etc.)
+      Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `claude_published_artifact_id: string`
+    - `created_at: optional string`
 
-      The published artifact's identifier.
+      When this activity occurred.
 
-    - `title: string`
+      format: date-time
 
-      Title of the published artifact
+    - `from_date: optional string or null`
+
+      Start date of the export range
+
+    - `organization_id: optional string or null`
+
+      Organization ID this activity is associated with
+
+    - `organization_uuid: optional string or null`
+
+      Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
+
+    - `to_date: optional string or null`
+
+      End date of the export range
+
+  - `BillingEmailsUpdated object`
+
+    The organization's billing email recipients were updated.
+
+    - `type: optional "billing_emails_updated"`
+
+      default: billing_emails_updated
+
+    - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
+
+      - `APIActor object`
+
+        - `type: optional "api_actor"`
+
+          default: api_actor
+
+        - `api_key_id: string`
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+      - `UserActor object`
+
+        - `type: optional "user_actor"`
+
+          default: user_actor
+
+        - `email_address: string`
+
+          format: email
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+        - `user_id: string`
+
+      - `UnauthenticatedUserActor object`
+
+        - `type: optional "unauthenticated_user_actor"`
+
+          default: unauthenticated_user_actor
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+        - `unauthenticated_email_address: optional string or null`
+
+          format: email
+
+      - `AnthropicActor object`
+
+        - `type: optional "anthropic_actor"`
+
+          default: anthropic_actor
+
+        - `email_address: optional string or null`
+
+          format: email
+
+      - `SystemActor object`
+
+        Automated background processing performed by Anthropic systems, acting
+        without a user or customer credential.
+
+        - `type: optional "system_actor"`
+
+          default: system_actor
+
+        - `service: optional string or null`
+
+          Name of the automated process that performed the action, when known.
+
+      - `AdminAPIKeyActor object`
+
+        - `type: optional "admin_api_key_actor"`
+
+          default: admin_api_key_actor
+
+        - `admin_api_key_id: string`
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+      - `ServiceAccountActor object`
+
+        - `type: optional "service_account_actor"`
+
+          default: service_account_actor
+
+        - `ip_address: string`
+
+        - `service_account_id: string`
+
+        - `user_agent: string`
+
+      - `ScimDirectorySyncActor object`
+
+        - `type: optional "scim_directory_sync_actor"`
+
+          default: scim_directory_sync_actor
+
+        - `directory_id: string`
+
+        - `workos_event_id: string`
+
+        - `idp_connection_type: optional string or null`
+
+      - `FederatedIdentityActor object`
+
+        A federated external workload authenticated via a verified OIDC token.
+
+        Carries the verified issuer, subject, and audience claims from the
+        presented JWT.
+
+        - `type: optional "federated_identity_actor"`
+
+          default: federated_identity_actor
+
+        - `issuer: string`
+
+        - `subject: string`
+
+        - `audience: optional array of string`
+
+        - `ip_address: optional string or null`
+
+        - `user_agent: optional string or null`
+
+      - `FederatedActor object`
+
+        An external identity asserted by a trusted provider — a cloud-provider
+        gateway or a customer-registered federation issuer — acting without an
+        Anthropic-provisioned account or service account.
+
+        - `type: optional "federated_actor"`
+
+          default: federated_actor
+
+        - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
+
+          - `FederatedActorAwsProvider object`
+
+            Asserting party: the AWS account the organization is bound to.
+
+            - `type: optional "aws"`
+
+              default: aws
+
+            - `account_id: string`
+
+            - `signed_principal: string`
+
+              The AWS-signed ARN of the IAM principal that requested the token.
+
+          - `FederatedActorAzureProvider object`
+
+            Asserting party: the Azure subscription the organization is bound to.
+
+            - `type: optional "azure"`
+
+              default: azure
+
+            - `subscription_id: string`
+
+          - `FederatedActorGcpProvider object`
+
+            Asserting party: the GCP project the organization is bound to.
+
+            - `type: optional "gcp"`
+
+              default: gcp
+
+            - `project_number: string`
+
+          - `FederatedActorOidcProvider object`
+
+            Asserting party: a customer-registered OIDC federation issuer.
+
+            - `type: optional "oidc"`
+
+              default: oidc
+
+            - `issuer: optional string or null`
+
+              The federation issuer's URL. Null when the presented credential failed verification.
+
+        - `ip_address: optional string or null`
+
+        - `subject: optional string or null`
+
+          The provider's verified identifier for the caller; its form depends on the provider.
+
+        - `user_agent: optional string or null`
+
+      - `AttestedDeviceActor object`
+
+        An attested mobile device authenticated via Apple App Attest.
+
+        - `type: optional "attested_device_actor"`
+
+          default: attested_device_actor
+
+        - `external_client_id: string`
+
+        - `kid_hash: string`
+
+        - `ip_address: optional string or null`
+
+        - `user_agent: optional string or null`
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `claude_artifact_version_id: optional string or null`
+    - `cc_email_count: optional number or null`
 
-      The version identifier recorded as live by this publish.
+      Number of 'cc' email recipients.
 
     - `created_at: optional string`
 
@@ -133650,14 +135414,6 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
-    - `description: optional string or null`
-
-      No longer populated: the gallery-card description supplied at publish time is intentionally omitted from this feed.
-
-    - `is_redeploy: optional boolean or null`
-
-      True when the publish updated an existing artifact; false when the publish created the artifact.
-
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -133666,13 +135422,21 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeArtifactSharingUpdated object`
+    - `primary_email_set: optional boolean or null`
 
-    An artifact's sharing settings were updated.
+      Whether a primary billing email is configured.
 
-    - `type: optional "claude_artifact_sharing_updated"`
+    - `to_email_count: optional number or null`
 
-      default: claude_artifact_sharing_updated
+      Number of 'to' email recipients.
+
+  - `CcrAgentCreated object`
+
+    A Claude Code agent was created.
+
+    - `type: optional "ccr_agent_created"`
+
+      default: ccr_agent_created
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -133880,41 +135644,25 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `audience: array of Organization or Users or AnyoneWithLink`
-
-      The artifact's sharing audience after the change. If empty, the artifact is visible only to its owner.
-
-      - `Organization object`
-
-        Sharing audience: visible to the owning organization.
-
-        - `type: optional "organization"`
-
-          default: organization
-
-      - `Users object`
-
-        Sharing audience: visible to an explicit allowlist of users.
-
-        - `type: optional "users"`
+    - `agent_id: string`
 
-          default: users
+      The agent that was created, e.g. "cagt_01HX...".
 
-      - `AnyoneWithLink object`
+    - `default_source_urls_truncated: boolean`
 
-        Sharing audience: anyone with the link, including anonymous viewers (an artifact shared to the open internet).
+      Whether default_source_urls was capped and omits some of the granted repositories.
 
-        - `type: optional "anyone_with_link"`
+    - `display_name: string`
 
-          default: anyone_with_link
+      The agent's display name at creation time.
 
-    - `claude_artifact_id: string`
+    - `omitted_source_url_count: number`
 
-      The artifact's identifier.
+      Number of default repository entries that could not be safely rendered as a credential-free URL and were omitted from default_source_urls. A non-zero value with an empty list means repositories were granted but could not be displayed — not that all repositories were removed.
 
-    - `claude_artifact_version_id: string`
+    - `slug: string`
 
-      The artifact version's identifier.
+      The agent's URL-safe identifier, unique within the organization.
 
     - `id: optional string`
 
@@ -133926,21 +135674,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
-    - `new_mode: optional string or null`
-
-      The read-axis sharing mode after the change: `owner`, `users`, `org`, or `public` (anyone on the internet).
-
-    - `new_user_count: optional number or null`
-
-      The number of accounts on the explicit read allowlist after the change. Only meaningful when `new_mode` is `users`.
-
-    - `new_write_mode: optional string or null`
+    - `default_source_urls: optional array of string`
 
-      The write-axis sharing mode after the change: `owner`, `users`, or `org`.
+      The repository URLs the agent works on by default, reduced to scheme, host, and path — credentials and query parameters are never included. Empty with a zero omitted_source_url_count means the agent was created without any default repositories; empty with a non-zero count means repositories were granted but could not be safely rendered. At most 100 entries are included; default_source_urls_truncated indicates when more were granted.
 
-    - `new_write_user_count: optional number or null`
+    - `guest_policy: optional string or null`
 
-      The number of accounts on the explicit write allowlist after the change. Only meaningful when `new_write_mode` is `users`.
+      Whether the agent responds in Slack channels that include guest users, and in Slack Connect channels shared with other organizations: "allow", "restrict", or "channel" (the agent responds, using only that channel's own content and configuration). In Slack Connect channels "allow" gives at most "channel" access. Omitted when the agent inherits the default policy.
 
     - `organization_id: optional string or null`
 
@@ -133950,29 +135690,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `previous_mode: optional string or null`
-
-      The read-axis sharing mode before the change: `owner`, `users`, `org`, or `public` (anyone on the internet).
-
-    - `previous_user_count: optional number or null`
-
-      The number of accounts on the explicit read allowlist before the change. Only meaningful when `previous_mode` is `users`.
-
-    - `previous_write_mode: optional string or null`
-
-      The write-axis sharing mode before the change: `owner`, `users`, or `org`.
-
-    - `previous_write_user_count: optional number or null`
+    - `slack_alias: optional string or null`
 
-      The number of accounts on the explicit write allowlist before the change. Only meaningful when `previous_write_mode` is `users`.
+      The Slack trigger word that routes mentions to this agent. An empty value means the agent responds to bare "@Claude" mentions. Omitted when the agent is not addressable from Slack.
 
-  - `ClaudeArtifactViewed object`
+  - `CcrAgentDeleted object`
 
-    An artifact was viewed.
+    A Claude Code agent was deleted.
 
-    - `type: optional "claude_artifact_viewed"`
+    - `type: optional "ccr_agent_deleted"`
 
-      default: claude_artifact_viewed
+      default: ccr_agent_deleted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -134180,17 +135908,25 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `claude_artifact_id: string`
+    - `agent_id: string`
 
-      The artifact's identifier.
+      The agent that was deleted, e.g. "cagt_01HX...".
+
+    - `cascaded_agent_ids_truncated: boolean`
+
+      True when more agents were deleted in this cascade than are individually recorded. On a cascade parent event (cascaded_from_agent_id unset), cascaded_agent_ids is capped at 100. On a cascade child event (cascaded_from_agent_id set, emitted when the parent deletion failed after committing child deletions), one event is emitted per deleted child up to 100, and this field indicates additional children were deleted in the same cascade.
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `claude_artifact_version_id: optional string or null`
+    - `cascaded_agent_ids: optional array of string`
 
-      The version of the artifact the user was served, when known.
+      Agents assigned to individual Slack channels that were also deleted because agent_id was the agent assigned to their entire Slack workspace. Empty when no such agents were deleted, and always empty on a cascade child event (cascaded_from_agent_id set) — the child's siblings are recorded as their own events, not listed here. Capped at 100 entries; cascaded_agent_ids_truncated is set when the actual count exceeded the cap.
+
+    - `cascaded_from_agent_id: optional string or null`
+
+      When set, the Slack workspace's dedicated agent whose deletion attempt caused this agent to be deleted. The parent's own deletion may have failed after the cascade committed — check for a separate event with agent_id = cascaded_from_agent_id to confirm. Unset on a direct deletion.
 
     - `created_at: optional string`
 
@@ -134206,13 +135942,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `AuditLogExportAccessed object`
+  - `CcrAgentProxyAnthropicOidcTokenExchanged object`
 
-    Audit log export file was accessed/downloaded via signed URL.
+    The Claude Code agent proxy exchanged a minted identity token for short-lived credentials in the organization's own cloud. Recorded for exchange targets only (such as "aws" and "gcp"; the "direct" target has no exchange step). One event is recorded per exchange call; a request served from the proxy's exchanged-credential cache does not exchange again and is not recorded here. Per-request detail for traffic the credentials were injected into is available in the agent proxy network events.
 
-    - `type: optional "audit_log_export_accessed"`
+    - `type: optional "ccr_agent_proxy_anthropic_oidc_token_exchanged"`
 
-      default: audit_log_export_accessed
+      default: ccr_agent_proxy_anthropic_oidc_token_exchanged
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -134420,6 +136156,38 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
+    - `agent_id: string`
+
+      The Claude Code agent that owns the session, e.g. "cagt_01HX...". Empty when the session is not owned by an agent.
+
+    - `credential_id: string`
+
+      The credential row the exchange ran for, e.g. "apc_01HX...".
+
+    - `profile_id: string`
+
+      The agent proxy profile the credential belongs to, e.g. "capp_01HX...".
+
+    - `role_arn: string`
+
+      The IAM role the token was exchanged for ("aws" target), e.g. "arn:aws:iam::123456789012:role/example-role". Empty for other targets.
+
+    - `role_session_name: string`
+
+      The role session name the temporary credentials were issued under ("aws" target), matching the session name recorded in the organization's own AWS CloudTrail log. Empty for other targets.
+
+    - `service_account: string`
+
+      The Google Cloud service account the federated token was exchanged into ("gcp" target), e.g. "example@example-project.iam.gserviceaccount.com". Empty when the federated token was used directly, and for other targets.
+
+    - `session_id: string`
+
+      The Claude Code session whose request triggered the exchange, e.g. "cse_01HX..." or "session_01HX..." (the session's ID is carried in whichever tagged form the session's credential presented).
+
+    - `target: string`
+
+      The credential's configured target, e.g. "aws" or "gcp".
+
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
@@ -134430,6 +136198,12 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
+    - `credentials_expire_at: optional string or null`
+
+      When the exchanged cloud credentials expire. Unset when the cloud provider did not return a lifetime; such credentials were used for the single triggering request and not cached.
+
+      format: date-time
+
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -134438,13 +136212,33 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `AuditLogExportStarted object`
+    - `slack_threads: optional array of object`
 
-    Audit log export was initiated.
+      The Slack threads in the session's provenance, when the session originated from Slack. At most 64 entries are included.
 
-    - `type: optional "audit_log_export_started"`
+      - `channel_id: string`
 
-      default: audit_log_export_started
+        The Slack channel ID, e.g. "C0123ABCDE".
+
+      - `enterprise_id: string`
+
+        The Slack Enterprise Grid organization ID, e.g. "E0123ABCDE". Empty for workspaces that are not part of an Enterprise Grid.
+
+      - `team_id: string`
+
+        The Slack workspace (team) ID, e.g. "T0123ABCDE".
+
+      - `thread_ts: string`
+
+        The Slack thread timestamp within the channel, e.g. "1714000000.123456". Empty for a session bound to a whole channel rather than to one thread.
+
+  - `CcrAgentProxyAnthropicOidcTokenMinted object`
+
+    The Claude Code agent proxy minted a short-lived identity token for an anthropic_oidc credential. One event is recorded per fresh token issuance; a request served from the proxy's short-lived token cache does not mint a new token and is not recorded here. Per-request detail for traffic the credential was injected into is available in the agent proxy network events.
+
+    - `type: optional "ccr_agent_proxy_anthropic_oidc_token_minted"`
+
+      default: ccr_agent_proxy_anthropic_oidc_token_minted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -134652,6 +136446,54 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
+    - `agent_id: string`
+
+      The Claude Code agent that owns the session, e.g. "cagt_01HX...". Empty when the session is not owned by an agent.
+
+    - `audience: string`
+
+      The minted token's audience: the fixed token-exchange audience for the "aws" target, the credential row's Google workload identity pool provider URL for the "gcp" target, or the row's configured audience for the "direct" target.
+
+    - `credential_id: string`
+
+      The credential row the token was minted for, e.g. "apc_01HX...".
+
+    - `issuance_path: "broker_report" or "direct" or "proxy_record" or "unspecified"`
+
+      Which record of the issuance this event is. Unspecified on events published before this field existed.
+
+      - `"broker_report"`
+
+      - `"direct"`
+
+      - `"proxy_record"`
+
+      - `"unspecified"`
+
+    - `mint_jti: string`
+
+      The identifier of the mint attempt, a bare UUID. One mint through the Claude Tag mint broker produces two minted events that carry the same value, the broker's own report and the agent proxy's record. A reader counts issuances from the broker's reports by distinct report_id, and several distinct reports that share one mint_jti are the accepted mints of a replayed token. Empty on events for mints that did not travel through the broker.
+
+    - `profile_id: string`
+
+      The agent proxy profile the credential belongs to, e.g. "capp_01HX...".
+
+    - `report_id: string`
+
+      The identity of the mint broker's report itself, a bare UUID. The broker mints it once per report and delivery retries repeat it, so several events carrying one report_id are duplicates of one report and collapse to one issuance. Present on broker_report events only.
+
+    - `session_id: string`
+
+      The Claude Code session whose request triggered the mint, e.g. "cse_01HX..." or "session_01HX..." (the session's ID is carried in whichever tagged form the session's credential presented).
+
+    - `target: string`
+
+      The credential's configured target, e.g. "aws", "gcp", or "direct".
+
+    - `test_mint: string`
+
+      Set when the token was minted by the gateway verification test that runs while an admin registers a custom-gateway audience: "wrong_subject" for the probe token the gateway must reject, "right_subject" for the control token it must accept. Empty for tokens minted for live sessions.
+
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
@@ -134662,10 +136504,6 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
-    - `from_date: optional string or null`
-
-      Start date of the export range
-
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -134674,17 +136512,39 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `to_date: optional string or null`
+    - `slack_threads: optional array of object`
 
-      End date of the export range
+      The Slack threads in the session's provenance, when the session originated from Slack. At most 64 entries are included.
 
-  - `BillingEmailsUpdated object`
+      - `channel_id: string`
 
-    The organization's billing email recipients were updated.
+        The Slack channel ID, e.g. "C0123ABCDE".
 
-    - `type: optional "billing_emails_updated"`
+      - `enterprise_id: string`
 
-      default: billing_emails_updated
+        The Slack Enterprise Grid organization ID, e.g. "E0123ABCDE". Empty for workspaces that are not part of an Enterprise Grid.
+
+      - `team_id: string`
+
+        The Slack workspace (team) ID, e.g. "T0123ABCDE".
+
+      - `thread_ts: string`
+
+        The Slack thread timestamp within the channel, e.g. "1714000000.123456". Empty for a session bound to a whole channel rather than to one thread.
+
+    - `token_expires_at: optional string or null`
+
+      When the minted token expires.
+
+      format: date-time
+
+  - `CcrAgentProxyCredentialCreated object`
+
+    A Claude Code agent proxy credential was created. Credentials hold the secrets the agent proxy injects into requests Claude Code sessions send to approved external services; each credential belongs to an agent proxy profile. Audit events carry only credential names and settings, never the secret material itself.
+
+    - `type: optional "ccr_agent_proxy_credential_created"`
+
+      default: ccr_agent_proxy_credential_created
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -134892,13 +136752,61 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
+    - `credential_id: string`
+
+      The credential that was created, e.g. "apc_01HX...".
+
+    - `credential_type: string`
+
+      The kind of credential, e.g. "bearer", "basic", "github_app", "mtls".
+
+    - `display_name: string`
+
+      The credential's display name.
+
+    - `host_constraint_truncated: boolean`
+
+      Whether host_constraint was capped and omits some of the configured host name patterns.
+
+    - `profile_id: string`
+
+      The agent proxy profile the credential belongs to, e.g. "capp_01HX...".
+
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `cc_email_count: optional number or null`
+    - `authorization_basis: optional object or null`
 
-      Number of 'cc' email recipients.
+      CcrAgentProxyCredentialAuthorizationBasis records how the actor was authorized to perform a Claude Code agent proxy credential operation. Populated only when the operation was authorized against a specific actor's permissions; absent on system-initiated operations (for example, an automatic token rotation) and on operations authorized by a provisioning link rather than the actor's own permissions.
+
+      - `slack_channel_id: string`
+
+        The Slack channel the credential's agent proxy profile is bound to, e.g. "C01ABC...".
+
+      - `slack_enterprise_id: string`
+
+        The Slack Enterprise Grid organization containing the workspace, e.g. "E01ABC...". Empty when the workspace does not belong to an Enterprise Grid organization.
+
+      - `slack_team_id: string`
+
+        The Slack workspace the credential's agent proxy profile is bound to, e.g. "T01ABC...".
+
+      - `via_entitlement_leg: boolean`
+
+        True when the actor's permission came from a custom role assigned in Roles & permissions. False when it came from a built-in Owner or Admin role.
+
+      - `via_full_manage: boolean`
+
+        True when the actor held the organization-wide Claude Tag management permission. False when the actor was instead authorized for the Slack channel identified below, either via the per-channel `claude_tag_channel:manage` permission or, when `via_account_assignment` is true, via a direct channel-manager assignment.
+
+      - `granting_role_ids: optional array of string`
+
+        The tagged IDs of the custom roles that granted the actor the per-channel `claude_tag_channel:manage` permission, e.g. "rbac_role_01HX...". Empty when `via_full_manage` is true (the actor was authorized by the organization-wide permission, so no per-channel role grant was evaluated) and when `via_account_assignment` is true (no role stands behind a direct assignment).
+
+      - `via_account_assignment: optional boolean or null`
+
+        True when the actor was authorized because an owner or admin assigned them directly as a manager of the Slack channel identified below (see ccr_channel_manager_added), rather than through a permission held via a role. When true, `via_full_manage` and `via_entitlement_leg` are false and `granting_role_ids` is empty. Absent on events recorded before direct channel-manager assignments existed; treat absence as false.
 
     - `created_at: optional string`
 
@@ -134906,6 +136814,10 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
+    - `host_constraint: optional array of string`
+
+      The host name patterns the credential may be sent to, e.g. "api.example.com" or "*.example.com". At most 100 entries are included; host_constraint_truncated indicates when the configured set is larger.
+
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -134914,21 +136826,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `primary_email_set: optional boolean or null`
-
-      Whether a primary billing email is configured.
-
-    - `to_email_count: optional number or null`
-
-      Number of 'to' email recipients.
-
-  - `CcrAgentCreated object`
+  - `CcrAgentProxyCredentialDeleted object`
 
-    A Claude Code agent was created.
+    A Claude Code agent proxy credential was deleted. Its secret material was removed and can no longer be sent to any host.
 
-    - `type: optional "ccr_agent_created"`
+    - `type: optional "ccr_agent_proxy_credential_deleted"`
 
-      default: ccr_agent_created
+      default: ccr_agent_proxy_credential_deleted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -135136,43 +137040,55 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `agent_id: string`
+    - `credential_id: string`
 
-      The agent that was created, e.g. "cagt_01HX...".
+      The credential that was deleted, e.g. "apc_01HX...".
 
-    - `default_source_urls_truncated: boolean`
+    - `profile_id: string`
 
-      Whether default_source_urls was capped and omits some of the granted repositories.
+      The agent proxy profile the credential belonged to, e.g. "capp_01HX...". Carried so the deletion can be correlated with the profile's other audit events after the credential row no longer exists.
 
-    - `display_name: string`
+    - `id: optional string`
 
-      The agent's display name at creation time.
+      Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `omitted_source_url_count: number`
+    - `authorization_basis: optional object or null`
 
-      Number of default repository entries that could not be safely rendered as a credential-free URL and were omitted from default_source_urls. A non-zero value with an empty list means repositories were granted but could not be displayed — not that all repositories were removed.
+      CcrAgentProxyCredentialAuthorizationBasis records how the actor was authorized to perform a Claude Code agent proxy credential operation. Populated only when the operation was authorized against a specific actor's permissions; absent on system-initiated operations (for example, an automatic token rotation) and on operations authorized by a provisioning link rather than the actor's own permissions.
 
-    - `slug: string`
+      - `slack_channel_id: string`
 
-      The agent's URL-safe identifier, unique within the organization.
+        The Slack channel the credential's agent proxy profile is bound to, e.g. "C01ABC...".
 
-    - `id: optional string`
+      - `slack_enterprise_id: string`
 
-      Unique identifier for the activity e.g. 'activity_abcd1234'
+        The Slack Enterprise Grid organization containing the workspace, e.g. "E01ABC...". Empty when the workspace does not belong to an Enterprise Grid organization.
 
-    - `created_at: optional string`
+      - `slack_team_id: string`
 
-      When this activity occurred.
+        The Slack workspace the credential's agent proxy profile is bound to, e.g. "T01ABC...".
 
-      format: date-time
+      - `via_entitlement_leg: boolean`
 
-    - `default_source_urls: optional array of string`
+        True when the actor's permission came from a custom role assigned in Roles & permissions. False when it came from a built-in Owner or Admin role.
 
-      The repository URLs the agent works on by default, reduced to scheme, host, and path — credentials and query parameters are never included. Empty with a zero omitted_source_url_count means the agent was created without any default repositories; empty with a non-zero count means repositories were granted but could not be safely rendered. At most 100 entries are included; default_source_urls_truncated indicates when more were granted.
+      - `via_full_manage: boolean`
 
-    - `guest_policy: optional string or null`
+        True when the actor held the organization-wide Claude Tag management permission. False when the actor was instead authorized for the Slack channel identified below, either via the per-channel `claude_tag_channel:manage` permission or, when `via_account_assignment` is true, via a direct channel-manager assignment.
 
-      Whether the agent responds in Slack channels that include guest users, and in Slack Connect channels shared with other organizations: "allow", "restrict", or "channel" (the agent responds, using only that channel's own content and configuration). In Slack Connect channels "allow" gives at most "channel" access. Omitted when the agent inherits the default policy.
+      - `granting_role_ids: optional array of string`
+
+        The tagged IDs of the custom roles that granted the actor the per-channel `claude_tag_channel:manage` permission, e.g. "rbac_role_01HX...". Empty when `via_full_manage` is true (the actor was authorized by the organization-wide permission, so no per-channel role grant was evaluated) and when `via_account_assignment` is true (no role stands behind a direct assignment).
+
+      - `via_account_assignment: optional boolean or null`
+
+        True when the actor was authorized because an owner or admin assigned them directly as a manager of the Slack channel identified below (see ccr_channel_manager_added), rather than through a permission held via a role. When true, `via_full_manage` and `via_entitlement_leg` are false and `granting_role_ids` is empty. Absent on events recorded before direct channel-manager assignments existed; treat absence as false.
+
+    - `created_at: optional string`
+
+      When this activity occurred.
+
+      format: date-time
 
     - `organization_id: optional string or null`
 
@@ -135182,17 +137098,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `slack_alias: optional string or null`
-
-      The Slack trigger word that routes mentions to this agent. An empty value means the agent responds to bare "@Claude" mentions. Omitted when the agent is not addressable from Slack.
-
-  - `CcrAgentDeleted object`
+  - `CcrAgentProxyCredentialRotated object`
 
-    A Claude Code agent was deleted.
+    A Claude Code agent proxy credential's secret material was replaced. The replacement keeps the same name, profile, and allowed hosts under a new credential identifier, and everything that referenced the old credential now uses the replacement.
 
-    - `type: optional "ccr_agent_deleted"`
+    - `type: optional "ccr_agent_proxy_credential_rotated"`
 
-      default: ccr_agent_deleted
+      default: ccr_agent_proxy_credential_rotated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -135400,25 +137312,69 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `agent_id: string`
+    - `credential_id: string`
 
-      The agent that was deleted, e.g. "cagt_01HX...".
+      The replacement credential, e.g. "apc_01HX...".
 
-    - `cascaded_agent_ids_truncated: boolean`
+    - `credential_type: string`
 
-      True when more agents were deleted in this cascade than are individually recorded. On a cascade parent event (cascaded_from_agent_id unset), cascaded_agent_ids is capped at 100. On a cascade child event (cascaded_from_agent_id set, emitted when the parent deletion failed after committing child deletions), one event is emitted per deleted child up to 100, and this field indicates additional children were deleted in the same cascade.
+      The kind of credential, e.g. "bearer", "basic", "github_app", "mtls".
+
+    - `destinations_repointed: number`
+
+      The number of agent proxy destinations that referenced the old credential and now reference the replacement.
+
+    - `display_name: string`
+
+      The credential's display name.
+
+    - `previous_credential_id: string`
+
+      The credential that was replaced, e.g. "apc_01HX...".
+
+    - `profile_id: string`
+
+      The agent proxy profile the credential belongs to, e.g. "capp_01HX...".
+
+    - `rules_repointed: number`
+
+      The number of agent proxy rules that referenced the old credential and now reference the replacement.
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `cascaded_agent_ids: optional array of string`
+    - `authorization_basis: optional object or null`
 
-      Agents assigned to individual Slack channels that were also deleted because agent_id was the agent assigned to their entire Slack workspace. Empty when no such agents were deleted, and always empty on a cascade child event (cascaded_from_agent_id set) — the child's siblings are recorded as their own events, not listed here. Capped at 100 entries; cascaded_agent_ids_truncated is set when the actual count exceeded the cap.
+      CcrAgentProxyCredentialAuthorizationBasis records how the actor was authorized to perform a Claude Code agent proxy credential operation. Populated only when the operation was authorized against a specific actor's permissions; absent on system-initiated operations (for example, an automatic token rotation) and on operations authorized by a provisioning link rather than the actor's own permissions.
 
-    - `cascaded_from_agent_id: optional string or null`
+      - `slack_channel_id: string`
 
-      When set, the Slack workspace's dedicated agent whose deletion attempt caused this agent to be deleted. The parent's own deletion may have failed after the cascade committed — check for a separate event with agent_id = cascaded_from_agent_id to confirm. Unset on a direct deletion.
+        The Slack channel the credential's agent proxy profile is bound to, e.g. "C01ABC...".
+
+      - `slack_enterprise_id: string`
+
+        The Slack Enterprise Grid organization containing the workspace, e.g. "E01ABC...". Empty when the workspace does not belong to an Enterprise Grid organization.
+
+      - `slack_team_id: string`
+
+        The Slack workspace the credential's agent proxy profile is bound to, e.g. "T01ABC...".
+
+      - `via_entitlement_leg: boolean`
+
+        True when the actor's permission came from a custom role assigned in Roles & permissions. False when it came from a built-in Owner or Admin role.
+
+      - `via_full_manage: boolean`
+
+        True when the actor held the organization-wide Claude Tag management permission. False when the actor was instead authorized for the Slack channel identified below, either via the per-channel `claude_tag_channel:manage` permission or, when `via_account_assignment` is true, via a direct channel-manager assignment.
+
+      - `granting_role_ids: optional array of string`
+
+        The tagged IDs of the custom roles that granted the actor the per-channel `claude_tag_channel:manage` permission, e.g. "rbac_role_01HX...". Empty when `via_full_manage` is true (the actor was authorized by the organization-wide permission, so no per-channel role grant was evaluated) and when `via_account_assignment` is true (no role stands behind a direct assignment).
+
+      - `via_account_assignment: optional boolean or null`
+
+        True when the actor was authorized because an owner or admin assigned them directly as a manager of the Slack channel identified below (see ccr_channel_manager_added), rather than through a permission held via a role. When true, `via_full_manage` and `via_entitlement_leg` are false and `granting_role_ids` is empty. Absent on events recorded before direct channel-manager assignments existed; treat absence as false.
 
     - `created_at: optional string`
 
@@ -135434,13 +137390,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `CcrAgentProxyAnthropicOidcTokenExchanged object`
+  - `CcrAgentProxyCredentialUpdated object`
 
-    The Claude Code agent proxy exchanged a minted identity token for short-lived credentials in the organization's own cloud. Recorded for exchange targets only (such as "aws" and "gcp"; the "direct" target has no exchange step). One event is recorded per exchange call; a request served from the proxy's exchanged-credential cache does not exchange again and is not recorded here. Per-request detail for traffic the credentials were injected into is available in the agent proxy network events.
+    A Claude Code agent proxy credential's settings were updated. Only the display name and the allowed host patterns can be updated; the secret material can only be replaced through a rotation.
 
-    - `type: optional "ccr_agent_proxy_anthropic_oidc_token_exchanged"`
+    - `type: optional "ccr_agent_proxy_credential_updated"`
 
-      default: ccr_agent_proxy_anthropic_oidc_token_exchanged
+      default: ccr_agent_proxy_credential_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -135648,41 +137604,57 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `agent_id: string`
+    - `credential_id: string`
 
-      The Claude Code agent that owns the session, e.g. "cagt_01HX...". Empty when the session is not owned by an agent.
+      The credential that was updated, e.g. "apc_01HX...".
 
-    - `credential_id: string`
+    - `display_name: string`
 
-      The credential row the exchange ran for, e.g. "apc_01HX...".
+      The credential's display name after the update.
+
+    - `host_constraint_truncated: boolean`
+
+      Whether host_constraint was capped and omits some of the configured host name patterns.
 
     - `profile_id: string`
 
       The agent proxy profile the credential belongs to, e.g. "capp_01HX...".
 
-    - `role_arn: string`
+    - `id: optional string`
 
-      The IAM role the token was exchanged for ("aws" target), e.g. "arn:aws:iam::123456789012:role/example-role". Empty for other targets.
+      Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `role_session_name: string`
+    - `authorization_basis: optional object or null`
 
-      The role session name the temporary credentials were issued under ("aws" target), matching the session name recorded in the organization's own AWS CloudTrail log. Empty for other targets.
+      CcrAgentProxyCredentialAuthorizationBasis records how the actor was authorized to perform a Claude Code agent proxy credential operation. Populated only when the operation was authorized against a specific actor's permissions; absent on system-initiated operations (for example, an automatic token rotation) and on operations authorized by a provisioning link rather than the actor's own permissions.
 
-    - `service_account: string`
+      - `slack_channel_id: string`
 
-      The Google Cloud service account the federated token was exchanged into ("gcp" target), e.g. "example@example-project.iam.gserviceaccount.com". Empty when the federated token was used directly, and for other targets.
+        The Slack channel the credential's agent proxy profile is bound to, e.g. "C01ABC...".
 
-    - `session_id: string`
+      - `slack_enterprise_id: string`
 
-      The Claude Code session whose request triggered the exchange, e.g. "cse_01HX..." or "session_01HX..." (the session's ID is carried in whichever tagged form the session's credential presented).
+        The Slack Enterprise Grid organization containing the workspace, e.g. "E01ABC...". Empty when the workspace does not belong to an Enterprise Grid organization.
 
-    - `target: string`
+      - `slack_team_id: string`
 
-      The credential's configured target, e.g. "aws" or "gcp".
+        The Slack workspace the credential's agent proxy profile is bound to, e.g. "T01ABC...".
 
-    - `id: optional string`
+      - `via_entitlement_leg: boolean`
 
-      Unique identifier for the activity e.g. 'activity_abcd1234'
+        True when the actor's permission came from a custom role assigned in Roles & permissions. False when it came from a built-in Owner or Admin role.
+
+      - `via_full_manage: boolean`
+
+        True when the actor held the organization-wide Claude Tag management permission. False when the actor was instead authorized for the Slack channel identified below, either via the per-channel `claude_tag_channel:manage` permission or, when `via_account_assignment` is true, via a direct channel-manager assignment.
+
+      - `granting_role_ids: optional array of string`
+
+        The tagged IDs of the custom roles that granted the actor the per-channel `claude_tag_channel:manage` permission, e.g. "rbac_role_01HX...". Empty when `via_full_manage` is true (the actor was authorized by the organization-wide permission, so no per-channel role grant was evaluated) and when `via_account_assignment` is true (no role stands behind a direct assignment).
+
+      - `via_account_assignment: optional boolean or null`
+
+        True when the actor was authorized because an owner or admin assigned them directly as a manager of the Slack channel identified below (see ccr_channel_manager_added), rather than through a permission held via a role. When true, `via_full_manage` and `via_entitlement_leg` are false and `granting_role_ids` is empty. Absent on events recorded before direct channel-manager assignments existed; treat absence as false.
 
     - `created_at: optional string`
 
@@ -135690,11 +137662,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
-    - `credentials_expire_at: optional string or null`
-
-      When the exchanged cloud credentials expire. Unset when the cloud provider did not return a lifetime; such credentials were used for the single triggering request and not cached.
+    - `host_constraint: optional array of string`
 
-      format: date-time
+      The host name patterns the credential may be sent to after the update, e.g. "api.example.com" or "*.example.com". Populated only when the update changed them. At most 100 entries are included; host_constraint_truncated indicates when the configured set is larger.
 
     - `organization_id: optional string or null`
 
@@ -135704,33 +137674,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `slack_threads: optional array of object`
-
-      The Slack threads in the session's provenance, when the session originated from Slack. At most 64 entries are included.
-
-      - `channel_id: string`
-
-        The Slack channel ID, e.g. "C0123ABCDE".
-
-      - `enterprise_id: string`
-
-        The Slack Enterprise Grid organization ID, e.g. "E0123ABCDE". Empty for workspaces that are not part of an Enterprise Grid.
-
-      - `team_id: string`
-
-        The Slack workspace (team) ID, e.g. "T0123ABCDE".
-
-      - `thread_ts: string`
+    - `updated_fields: optional array of string`
 
-        The Slack thread timestamp within the channel, e.g. "1714000000.123456". Empty for a session bound to a whole channel rather than to one thread.
+      Names of the settings included in the update: "display_name", "host_constraint".
 
-  - `CcrAgentProxyAnthropicOidcTokenMinted object`
+  - `CcrAgentProxyDestinationDeleted object`
 
-    The Claude Code agent proxy minted a short-lived identity token for an anthropic_oidc credential. One event is recorded per fresh token issuance; a request served from the proxy's short-lived token cache does not mint a new token and is not recorded here. Per-request detail for traffic the credential was injected into is available in the agent proxy network events.
+    An agent proxy destination was deleted.
 
-    - `type: optional "ccr_agent_proxy_anthropic_oidc_token_minted"`
+    - `type: optional "ccr_agent_proxy_destination_deleted"`
 
-      default: ccr_agent_proxy_anthropic_oidc_token_minted
+      default: ccr_agent_proxy_destination_deleted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -135938,58 +137892,26 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `agent_id: string`
-
-      The Claude Code agent that owns the session, e.g. "cagt_01HX...". Empty when the session is not owned by an agent.
-
-    - `audience: string`
-
-      The minted token's audience: the fixed token-exchange audience for the "aws" target, the credential row's Google workload identity pool provider URL for the "gcp" target, or the row's configured audience for the "direct" target.
-
-    - `credential_id: string`
-
-      The credential row the token was minted for, e.g. "apc_01HX...".
-
-    - `issuance_path: "broker_report" or "direct" or "proxy_record" or "unspecified"`
-
-      Which record of the issuance this event is. Unspecified on events published before this field existed.
-
-      - `"broker_report"`
-
-      - `"direct"`
-
-      - `"proxy_record"`
+    - `deleted_with_profile: boolean`
 
-      - `"unspecified"`
+      True when this deletion happened as part of deleting the whole profile (profile_id names the deleted profile). At most one of deleted_with_profile / cascade_trigger_credential_id is set; both unset means a direct DeleteAgentProxyDestination call.
 
-    - `mint_jti: string`
+    - `destination_id: string`
 
-      The identifier of the mint attempt, a bare UUID. One mint through the Claude Tag mint broker produces two minted events that carry the same value, the broker's own report and the agent proxy's record. A reader counts issuances from the broker's reports by distinct report_id, and several distinct reports that share one mint_jti are the accepted mints of a replayed token. Empty on events for mints that did not travel through the broker.
+      The destination that was deleted, e.g. "apd_01HX...".
 
     - `profile_id: string`
 
-      The agent proxy profile the credential belongs to, e.g. "capp_01HX...".
-
-    - `report_id: string`
-
-      The identity of the mint broker's report itself, a bare UUID. The broker mints it once per report and delivery retries repeat it, so several events carrying one report_id are duplicates of one report and collapse to one issuance. Present on broker_report events only.
-
-    - `session_id: string`
-
-      The Claude Code session whose request triggered the mint, e.g. "cse_01HX..." or "session_01HX..." (the session's ID is carried in whichever tagged form the session's credential presented).
-
-    - `target: string`
-
-      The credential's configured target, e.g. "aws", "gcp", or "direct".
-
-    - `test_mint: string`
-
-      Set when the token was minted by the gateway verification test that runs while an admin registers a custom-gateway audience: "wrong_subject" for the probe token the gateway must reject, "right_subject" for the control token it must accept. Empty for tokens minted for live sessions.
+      The agent proxy profile the destination belonged to, e.g. "capp_01HX...".
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
+    - `cascade_trigger_credential_id: optional string or null`
+
+      Set when this deletion was triggered by a cascading DeleteAgentProxyCredential (the destination's client_tls_credential was the deleted credential). Unset for a direct DeleteAgentProxyDestination call and for the profile-delete cascade (see deleted_with_profile).
+
     - `created_at: optional string`
 
       When this activity occurred.
@@ -136004,39 +137926,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `slack_threads: optional array of object`
-
-      The Slack threads in the session's provenance, when the session originated from Slack. At most 64 entries are included.
-
-      - `channel_id: string`
-
-        The Slack channel ID, e.g. "C0123ABCDE".
-
-      - `enterprise_id: string`
-
-        The Slack Enterprise Grid organization ID, e.g. "E0123ABCDE". Empty for workspaces that are not part of an Enterprise Grid.
-
-      - `team_id: string`
-
-        The Slack workspace (team) ID, e.g. "T0123ABCDE".
-
-      - `thread_ts: string`
-
-        The Slack thread timestamp within the channel, e.g. "1714000000.123456". Empty for a session bound to a whole channel rather than to one thread.
-
-    - `token_expires_at: optional string or null`
-
-      When the minted token expires.
-
-      format: date-time
-
-  - `CcrAgentProxyCredentialCreated object`
+  - `CcrAgentProxyNetworkEventsListed object`
 
-    A Claude Code agent proxy credential was created. Credentials hold the secrets the agent proxy injects into requests Claude Code sessions send to approved external services; each credential belongs to an agent proxy profile. Audit events carry only credential names and settings, never the secret material itself.
+    A Claude Code network activity export was accessed for the given hour.
 
-    - `type: optional "ccr_agent_proxy_credential_created"`
+    - `type: optional "ccr_agent_proxy_network_events_listed"`
 
-      default: ccr_agent_proxy_credential_created
+      default: ccr_agent_proxy_network_events_listed
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -136244,71 +138140,25 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `credential_id: string`
-
-      The credential that was created, e.g. "apc_01HX...".
-
-    - `credential_type: string`
-
-      The kind of credential, e.g. "bearer", "basic", "github_app", "mtls".
-
-    - `display_name: string`
-
-      The credential's display name.
-
-    - `host_constraint_truncated: boolean`
-
-      Whether host_constraint was capped and omits some of the configured host name patterns.
-
-    - `profile_id: string`
+    - `failed: boolean`
 
-      The agent proxy profile the credential belongs to, e.g. "capp_01HX...".
+      True when the export request did not complete successfully.
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `authorization_basis: optional object or null`
-
-      CcrAgentProxyCredentialAuthorizationBasis records how the actor was authorized to perform a Claude Code agent proxy credential operation. Populated only when the operation was authorized against a specific actor's permissions; absent on system-initiated operations (for example, an automatic token rotation) and on operations authorized by a provisioning link rather than the actor's own permissions.
-
-      - `slack_channel_id: string`
-
-        The Slack channel the credential's agent proxy profile is bound to, e.g. "C01ABC...".
-
-      - `slack_enterprise_id: string`
-
-        The Slack Enterprise Grid organization containing the workspace, e.g. "E01ABC...". Empty when the workspace does not belong to an Enterprise Grid organization.
-
-      - `slack_team_id: string`
-
-        The Slack workspace the credential's agent proxy profile is bound to, e.g. "T01ABC...".
-
-      - `via_entitlement_leg: boolean`
-
-        True when the actor's permission came from a custom role assigned in Roles & permissions. False when it came from a built-in Owner or Admin role.
-
-      - `via_full_manage: boolean`
-
-        True when the actor held the organization-wide Claude Tag management permission. False when the actor was instead authorized for the Slack channel identified below, either via the per-channel `claude_tag_channel:manage` permission or, when `via_account_assignment` is true, via a direct channel-manager assignment.
-
-      - `granting_role_ids: optional array of string`
-
-        The tagged IDs of the custom roles that granted the actor the per-channel `claude_tag_channel:manage` permission, e.g. "rbac_role_01HX...". Empty when `via_full_manage` is true (the actor was authorized by the organization-wide permission, so no per-channel role grant was evaluated) and when `via_account_assignment` is true (no role stands behind a direct assignment).
-
-      - `via_account_assignment: optional boolean or null`
-
-        True when the actor was authorized because an owner or admin assigned them directly as a manager of the Slack channel identified below (see ccr_channel_manager_added), rather than through a permission held via a role. When true, `via_full_manage` and `via_entitlement_leg` are false and `granting_role_ids` is empty. Absent on events recorded before direct channel-manager assignments existed; treat absence as false.
-
     - `created_at: optional string`
 
       When this activity occurred.
 
       format: date-time
 
-    - `host_constraint: optional array of string`
+    - `hour: optional string or null`
 
-      The host name patterns the credential may be sent to, e.g. "api.example.com" or "*.example.com". At most 100 entries are included; host_constraint_truncated indicates when the configured set is larger.
+      The UTC hour that was exported.
+
+      format: date-time
 
     - `organization_id: optional string or null`
 
@@ -136318,13 +138168,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `CcrAgentProxyCredentialDeleted object`
+  - `CcrAgentProxyProfileBound object`
 
-    A Claude Code agent proxy credential was deleted. Its secret material was removed and can no longer be sent to any host.
+    A Claude Code agent proxy profile was bound to a scope, applying its policy to Claude Code sessions in that scope.
 
-    - `type: optional "ccr_agent_proxy_credential_deleted"`
+    - `type: optional "ccr_agent_proxy_profile_bound"`
 
-      default: ccr_agent_proxy_credential_deleted
+      default: ccr_agent_proxy_profile_bound
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -136532,49 +138382,21 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `credential_id: string`
-
-      The credential that was deleted, e.g. "apc_01HX...".
-
     - `profile_id: string`
 
-      The agent proxy profile the credential belonged to, e.g. "capp_01HX...". Carried so the deletion can be correlated with the profile's other audit events after the credential row no longer exists.
-
-    - `id: optional string`
-
-      Unique identifier for the activity e.g. 'activity_abcd1234'
-
-    - `authorization_basis: optional object or null`
-
-      CcrAgentProxyCredentialAuthorizationBasis records how the actor was authorized to perform a Claude Code agent proxy credential operation. Populated only when the operation was authorized against a specific actor's permissions; absent on system-initiated operations (for example, an automatic token rotation) and on operations authorized by a provisioning link rather than the actor's own permissions.
-
-      - `slack_channel_id: string`
-
-        The Slack channel the credential's agent proxy profile is bound to, e.g. "C01ABC...".
-
-      - `slack_enterprise_id: string`
-
-        The Slack Enterprise Grid organization containing the workspace, e.g. "E01ABC...". Empty when the workspace does not belong to an Enterprise Grid organization.
-
-      - `slack_team_id: string`
-
-        The Slack workspace the credential's agent proxy profile is bound to, e.g. "T01ABC...".
-
-      - `via_entitlement_leg: boolean`
-
-        True when the actor's permission came from a custom role assigned in Roles & permissions. False when it came from a built-in Owner or Admin role.
+      The profile that was bound, e.g. "capp_01HX...".
 
-      - `via_full_manage: boolean`
+    - `scope_id: string`
 
-        True when the actor held the organization-wide Claude Tag management permission. False when the actor was instead authorized for the Slack channel identified below, either via the per-channel `claude_tag_channel:manage` permission or, when `via_account_assignment` is true, via a direct channel-manager assignment.
+      The identifier of the scope the profile was bound to.
 
-      - `granting_role_ids: optional array of string`
+    - `scope_kind: string`
 
-        The tagged IDs of the custom roles that granted the actor the per-channel `claude_tag_channel:manage` permission, e.g. "rbac_role_01HX...". Empty when `via_full_manage` is true (the actor was authorized by the organization-wide permission, so no per-channel role grant was evaluated) and when `via_account_assignment` is true (no role stands behind a direct assignment).
+      The kind of scope the profile was bound to: "organization", "environment", "account", or "agent".
 
-      - `via_account_assignment: optional boolean or null`
+    - `id: optional string`
 
-        True when the actor was authorized because an owner or admin assigned them directly as a manager of the Slack channel identified below (see ccr_channel_manager_added), rather than through a permission held via a role. When true, `via_full_manage` and `via_entitlement_leg` are false and `granting_role_ids` is empty. Absent on events recorded before direct channel-manager assignments existed; treat absence as false.
+      Unique identifier for the activity e.g. 'activity_abcd1234'
 
     - `created_at: optional string`
 
@@ -136590,13 +138412,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `CcrAgentProxyCredentialRotated object`
+  - `CcrAgentProxyProfileCreated object`
 
-    A Claude Code agent proxy credential's secret material was replaced. The replacement keeps the same name, profile, and allowed hosts under a new credential identifier, and everything that referenced the old credential now uses the replacement.
+    A Claude Code agent proxy profile was created. Agent proxy profiles are named, reusable bundles of access policy that administrators bind to parts of the organization.
 
-    - `type: optional "ccr_agent_proxy_credential_rotated"`
+    - `type: optional "ccr_agent_proxy_profile_created"`
 
-      default: ccr_agent_proxy_credential_rotated
+      default: ccr_agent_proxy_profile_created
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -136804,75 +138626,59 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `credential_id: string`
-
-      The replacement credential, e.g. "apc_01HX...".
-
-    - `credential_type: string`
-
-      The kind of credential, e.g. "bearer", "basic", "github_app", "mtls".
-
-    - `destinations_repointed: number`
-
-      The number of agent proxy destinations that referenced the old credential and now reference the replacement.
-
     - `display_name: string`
 
-      The credential's display name.
-
-    - `previous_credential_id: string`
-
-      The credential that was replaced, e.g. "apc_01HX...".
+      The profile's display name at creation time.
 
     - `profile_id: string`
 
-      The agent proxy profile the credential belongs to, e.g. "capp_01HX...".
+      The profile that was created, e.g. "capp_01HX...".
 
-    - `rules_repointed: number`
+    - `slug: string`
 
-      The number of agent proxy rules that referenced the old credential and now reference the replacement.
+      The profile's URL-safe identifier, unique within the organization.
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `authorization_basis: optional object or null`
+    - `created_at: optional string`
 
-      CcrAgentProxyCredentialAuthorizationBasis records how the actor was authorized to perform a Claude Code agent proxy credential operation. Populated only when the operation was authorized against a specific actor's permissions; absent on system-initiated operations (for example, an automatic token rotation) and on operations authorized by a provisioning link rather than the actor's own permissions.
+      When this activity occurred.
 
-      - `slack_channel_id: string`
+      format: date-time
 
-        The Slack channel the credential's agent proxy profile is bound to, e.g. "C01ABC...".
+    - `github_access: optional array of object`
 
-      - `slack_enterprise_id: string`
+      The GitHub repository access the profile grants, one entry per GitHub App installation. Empty when the profile grants no GitHub access.
 
-        The Slack Enterprise Grid organization containing the workspace, e.g. "E01ABC...". Empty when the workspace does not belong to an Enterprise Grid organization.
+      - `access_mode: string`
 
-      - `slack_team_id: string`
+        How repository access is granted: "none" (no access), "list" (exactly the repositories in repos), or "all" — a legacy value for policies created before per-repository grants were required; it can no longer be assigned.
 
-        The Slack workspace the credential's agent proxy profile is bound to, e.g. "T01ABC...".
+      - `github_installation_id: number`
 
-      - `via_entitlement_leg: boolean`
+        The GitHub App installation the access applies to.
 
-        True when the actor's permission came from a custom role assigned in Roles & permissions. False when it came from a built-in Owner or Admin role.
+      - `repo_count: number`
 
-      - `via_full_manage: boolean`
+        The total number of repositories granted, including any omitted from repos.
 
-        True when the actor held the organization-wide Claude Tag management permission. False when the actor was instead authorized for the Slack channel identified below, either via the per-channel `claude_tag_channel:manage` permission or, when `via_account_assignment` is true, via a direct channel-manager assignment.
+      - `repos_truncated: boolean`
 
-      - `granting_role_ids: optional array of string`
+        Whether repos was capped and omits some of the granted repositories.
 
-        The tagged IDs of the custom roles that granted the actor the per-channel `claude_tag_channel:manage` permission, e.g. "rbac_role_01HX...". Empty when `via_full_manage` is true (the actor was authorized by the organization-wide permission, so no per-channel role grant was evaluated) and when `via_account_assignment` is true (no role stands behind a direct assignment).
+      - `ghe_configuration_id: optional number or null`
 
-      - `via_account_assignment: optional boolean or null`
+        The GitHub host configuration this installation belongs to. Distinguishes installations with the same numeric installation ID across github.com and GitHub Enterprise Server hosts. Absent for github.com installations.
 
-        True when the actor was authorized because an owner or admin assigned them directly as a manager of the Slack channel identified below (see ccr_channel_manager_added), rather than through a permission held via a role. When true, `via_full_manage` and `via_entitlement_leg` are false and `granting_role_ids` is empty. Absent on events recorded before direct channel-manager assignments existed; treat absence as false.
+      - `repo_ids: optional array of number`
 
-    - `created_at: optional string`
+        The numeric GitHub repository IDs the profile grants access to, in the same order as repos (and subject to the same 100-entry cap). These IDs are the authoritative identity of the granted repositories — access is enforced against them, not against the display names in repos.
 
-      When this activity occurred.
+      - `repos: optional array of string`
 
-      format: date-time
+        Repository names (owner/name) the profile grants access to, populated when access_mode is "list". Names are display-only labels resolved when the event was recorded and may lag a repository rename; the entries in repo_ids are the authoritative identity of the granted repositories. A repository whose name is unavailable is listed as its numeric GitHub repository ID instead. At most 100 entries are included; repos_truncated indicates when the granted set is larger.
 
     - `organization_id: optional string or null`
 
@@ -136882,13 +138688,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `CcrAgentProxyCredentialUpdated object`
+  - `CcrAgentProxyProfileDeleted object`
 
-    A Claude Code agent proxy credential's settings were updated. Only the display name and the allowed host patterns can be updated; the secret material can only be replaced through a rotation.
+    A Claude Code agent proxy profile was deleted, removing its policy from everything it was bound to.
 
-    - `type: optional "ccr_agent_proxy_credential_updated"`
+    - `type: optional "ccr_agent_proxy_profile_deleted"`
 
-      default: ccr_agent_proxy_credential_updated
+      default: ccr_agent_proxy_profile_deleted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -137096,57 +138902,37 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `credential_id: string`
-
-      The credential that was updated, e.g. "apc_01HX...".
-
-    - `display_name: string`
-
-      The credential's display name after the update.
-
-    - `host_constraint_truncated: boolean`
-
-      Whether host_constraint was capped and omits some of the configured host name patterns.
-
-    - `profile_id: string`
-
-      The agent proxy profile the credential belongs to, e.g. "capp_01HX...".
-
-    - `id: optional string`
-
-      Unique identifier for the activity e.g. 'activity_abcd1234'
-
-    - `authorization_basis: optional object or null`
+    - `deleted_credential_count: number`
 
-      CcrAgentProxyCredentialAuthorizationBasis records how the actor was authorized to perform a Claude Code agent proxy credential operation. Populated only when the operation was authorized against a specific actor's permissions; absent on system-initiated operations (for example, an automatic token rotation) and on operations authorized by a provisioning link rather than the actor's own permissions.
+      Number of credentials deleted together with the profile — deleting a profile also deletes the credentials attached to it. Each deleted credential additionally emits its own ccr_agent_proxy_credential_deleted activity, at most 100 per profile deletion. Best-effort: when deleted_credentials_unknown is true the count could not be determined and 0 here does not mean the profile had no credentials.
 
-      - `slack_channel_id: string`
+    - `deleted_credentials_unknown: boolean`
 
-        The Slack channel the credential's agent proxy profile is bound to, e.g. "C01ABC...".
+      Whether the number of credentials deleted with the profile could not be determined. When true, deleted_credential_count is 0 and no per-credential deletion activities were emitted, even though the deletion may have destroyed credentials.
 
-      - `slack_enterprise_id: string`
+    - `deleted_destination_count: number`
 
-        The Slack Enterprise Grid organization containing the workspace, e.g. "E01ABC...". Empty when the workspace does not belong to an Enterprise Grid organization.
+      Number of destinations deleted together with the profile. Each deleted destination additionally emits its own ccr_agent_proxy_destination_deleted activity with deleted_with_profile set, at most 100 per profile deletion. Best-effort: when deleted_destinations_unknown is true the count could not be determined and 0 here does not mean the profile had no destinations.
 
-      - `slack_team_id: string`
+    - `deleted_destinations_unknown: boolean`
 
-        The Slack workspace the credential's agent proxy profile is bound to, e.g. "T01ABC...".
+      Whether the number of destinations deleted with the profile could not be determined. Same semantics as deleted_credentials_unknown.
 
-      - `via_entitlement_leg: boolean`
+    - `deleted_rule_count: number`
 
-        True when the actor's permission came from a custom role assigned in Roles & permissions. False when it came from a built-in Owner or Admin role.
+      Number of rules deleted together with the profile. Each deleted rule additionally emits its own ccr_agent_proxy_rule_deleted activity with deleted_with_profile set, at most 100 per profile deletion. Best-effort: when deleted_rules_unknown is true the count could not be determined and 0 here does not mean the profile had no rules.
 
-      - `via_full_manage: boolean`
+    - `deleted_rules_unknown: boolean`
 
-        True when the actor held the organization-wide Claude Tag management permission. False when the actor was instead authorized for the Slack channel identified below, either via the per-channel `claude_tag_channel:manage` permission or, when `via_account_assignment` is true, via a direct channel-manager assignment.
+      Whether the number of rules deleted with the profile could not be determined. Same semantics as deleted_credentials_unknown.
 
-      - `granting_role_ids: optional array of string`
+    - `profile_id: string`
 
-        The tagged IDs of the custom roles that granted the actor the per-channel `claude_tag_channel:manage` permission, e.g. "rbac_role_01HX...". Empty when `via_full_manage` is true (the actor was authorized by the organization-wide permission, so no per-channel role grant was evaluated) and when `via_account_assignment` is true (no role stands behind a direct assignment).
+      The profile that was deleted, e.g. "capp_01HX...".
 
-      - `via_account_assignment: optional boolean or null`
+    - `id: optional string`
 
-        True when the actor was authorized because an owner or admin assigned them directly as a manager of the Slack channel identified below (see ccr_channel_manager_added), rather than through a permission held via a role. When true, `via_full_manage` and `via_entitlement_leg` are false and `granting_role_ids` is empty. Absent on events recorded before direct channel-manager assignments existed; treat absence as false.
+      Unique identifier for the activity e.g. 'activity_abcd1234'
 
     - `created_at: optional string`
 
@@ -137154,10 +138940,6 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
-    - `host_constraint: optional array of string`
-
-      The host name patterns the credential may be sent to after the update, e.g. "api.example.com" or "*.example.com". Populated only when the update changed them. At most 100 entries are included; host_constraint_truncated indicates when the configured set is larger.
-
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -137166,17 +138948,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `updated_fields: optional array of string`
-
-      Names of the settings included in the update: "display_name", "host_constraint".
-
-  - `CcrAgentProxyDestinationDeleted object`
+  - `CcrAgentProxyProfileUnbound object`
 
-    An agent proxy destination was deleted.
+    A Claude Code agent proxy profile was unbound from a scope, removing its policy from Claude Code sessions in that scope.
 
-    - `type: optional "ccr_agent_proxy_destination_deleted"`
+    - `type: optional "ccr_agent_proxy_profile_unbound"`
 
-      default: ccr_agent_proxy_destination_deleted
+      default: ccr_agent_proxy_profile_unbound
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -137384,26 +139162,22 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `deleted_with_profile: boolean`
+    - `profile_id: string`
 
-      True when this deletion happened as part of deleting the whole profile (profile_id names the deleted profile). At most one of deleted_with_profile / cascade_trigger_credential_id is set; both unset means a direct DeleteAgentProxyDestination call.
+      The profile that was unbound, e.g. "capp_01HX...".
 
-    - `destination_id: string`
+    - `scope_id: string`
 
-      The destination that was deleted, e.g. "apd_01HX...".
+      The identifier of the scope the profile was unbound from.
 
-    - `profile_id: string`
+    - `scope_kind: string`
 
-      The agent proxy profile the destination belonged to, e.g. "capp_01HX...".
+      The kind of scope the profile was unbound from: "organization", "environment", "account", or "agent".
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `cascade_trigger_credential_id: optional string or null`
-
-      Set when this deletion was triggered by a cascading DeleteAgentProxyCredential (the destination's client_tls_credential was the deleted credential). Unset for a direct DeleteAgentProxyDestination call and for the profile-delete cascade (see deleted_with_profile).
-
     - `created_at: optional string`
 
       When this activity occurred.
@@ -137418,13 +139192,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `CcrAgentProxyNetworkEventsListed object`
+  - `CcrAgentProxyProfileUpdated object`
 
-    A Claude Code network activity export was accessed for the given hour.
+    A Claude Code agent proxy profile's configuration was updated.
 
-    - `type: optional "ccr_agent_proxy_network_events_listed"`
+    - `type: optional "ccr_agent_proxy_profile_updated"`
 
-      default: ccr_agent_proxy_network_events_listed
+      default: ccr_agent_proxy_profile_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -137632,9 +139406,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `failed: boolean`
+    - `profile_id: string`
 
-      True when the export request did not complete successfully.
+      The profile that was updated, e.g. "capp_01HX...".
 
     - `id: optional string`
 
@@ -137646,11 +139420,49 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
-    - `hour: optional string or null`
+    - `github_access_changes: optional array of object`
 
-      The UTC hour that was exported.
+      How the profile's GitHub repository access changed, one entry per GitHub App installation whose access changed. Empty when the update did not change GitHub access.
 
-      format: date-time
+      - `access_mode: string`
+
+        How repository access is granted after the change: "none" (no access), "list" (access is restricted to an explicit repository list — repos_added/repos_removed carry this change's delta and repo_count the post-change total), or "all" — a legacy value for policies created before per-repository grants were required; it can no longer be assigned.
+
+      - `github_installation_id: number`
+
+        The GitHub App installation the change applies to.
+
+      - `repo_count: number`
+
+        The total number of repositories granted after the change.
+
+      - `repos_truncated: boolean`
+
+        Whether repos_added or repos_removed was capped and omits some of the changed repositories.
+
+      - `ghe_configuration_id: optional number or null`
+
+        The GitHub host configuration this installation belongs to. Distinguishes installations with the same numeric installation ID across github.com and GitHub Enterprise Server hosts. Absent for github.com installations.
+
+      - `previous_access_mode: optional string or null`
+
+        How repository access was granted before the change. Present only when the access mode changed.
+
+      - `repo_ids_added: optional array of number`
+
+        The numeric GitHub repository IDs added to the granted set, in the same order as repos_added (and subject to the same 100-entry cap). These IDs are the authoritative identity of the added repositories — access is enforced against them, not against the display names in repos_added.
+
+      - `repo_ids_removed: optional array of number`
+
+        The numeric GitHub repository IDs removed from the granted set, in the same order as repos_removed (and subject to the same 100-entry cap). These IDs are the authoritative identity of the removed repositories.
+
+      - `repos_added: optional array of string`
+
+        Repository names (owner/name) added to the granted set. Names are display-only labels resolved when the event was recorded and may lag a repository rename; the entries in repo_ids_added are the authoritative identity of the added repositories. A repository whose name is unavailable is listed as its numeric GitHub repository ID instead. At most 100 entries are included; repos_truncated indicates when more were added. Empty when the change involves "all" access, which grants every repository regardless of any explicit list.
+
+      - `repos_removed: optional array of string`
+
+        Repository names (owner/name) removed from the granted set. Same rendering, cap, and "all" handling as repos_added; repo_ids_removed carries the authoritative identity of the removed repositories.
 
     - `organization_id: optional string or null`
 
@@ -137660,13 +139472,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `CcrAgentProxyProfileBound object`
+    - `updated_fields: optional array of string`
 
-    A Claude Code agent proxy profile was bound to a scope, applying its policy to Claude Code sessions in that scope.
+      Names of the configuration fields included in the update, e.g. "display_name", "github_installation_permissions".
 
-    - `type: optional "ccr_agent_proxy_profile_bound"`
+  - `CcrAgentProxyProvisioningCredentialRejected object`
 
-      default: ccr_agent_proxy_profile_bound
+    An organization owner rejected a credential that a teammate submitted via an agent proxy provisioning link: the credential and its disabled rule were deleted and the link was revoked. The actor is the owner; the submitter is recorded for attribution.
+
+    - `type: optional "ccr_agent_proxy_provisioning_credential_rejected"`
+
+      default: ccr_agent_proxy_provisioning_credential_rejected
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -137874,17 +139690,25 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
+    - `credential_id: string`
+
+      The credential the member submitted, e.g. "apc_01HX...".
+
+    - `link_id: string`
+
+      The provisioning link's identifier.
+
     - `profile_id: string`
 
-      The profile that was bound, e.g. "capp_01HX...".
+      The agent proxy profile the credential lived in, e.g. "capp_01HX...".
 
-    - `scope_id: string`
+    - `rule_id: string`
 
-      The identifier of the scope the profile was bound to.
+      The disabled rule that was deleted alongside the credential, e.g. "apr_01HX...".
 
-    - `scope_kind: string`
+    - `submitted_by_user_id: string`
 
-      The kind of scope the profile was bound to: "organization", "environment", "account", or "agent".
+      The tagged account ID of the user who originally submitted the credential, e.g. "user_01HX...".
 
     - `id: optional string`
 
@@ -137904,13 +139728,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `CcrAgentProxyProfileCreated object`
+  - `CcrAgentProxyProvisioningLinkEnabled object`
 
-    A Claude Code agent proxy profile was created. Agent proxy profiles are named, reusable bundles of access policy that administrators bind to parts of the organization.
+    An organization owner enabled a credential that a teammate submitted via an agent proxy provisioning link: the disabled rule created at submission was switched to enforce, so the credential now takes traffic. The actor is the owner; the submitter is the actor on the prior ccr_agent_proxy_provisioning_link_submitted event.
 
-    - `type: optional "ccr_agent_proxy_profile_created"`
+    - `type: optional "ccr_agent_proxy_provisioning_link_enabled"`
 
-      default: ccr_agent_proxy_profile_created
+      default: ccr_agent_proxy_provisioning_link_enabled
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -138118,17 +139942,21 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `display_name: string`
+    - `credential_id: string`
 
-      The profile's display name at creation time.
+      The credential the member submitted, e.g. "apc_01HX...".
+
+    - `link_id: string`
+
+      The provisioning link's identifier.
 
     - `profile_id: string`
 
-      The profile that was created, e.g. "capp_01HX...".
+      The agent proxy profile the credential lives in, e.g. "capp_01HX...".
 
-    - `slug: string`
+    - `rule_id: string`
 
-      The profile's URL-safe identifier, unique within the organization.
+      The rule that was flipped to enforce, e.g. "apr_01HX...".
 
     - `id: optional string`
 
@@ -138140,38 +139968,6 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
-    - `github_access: optional array of object`
-
-      The GitHub repository access the profile grants, one entry per GitHub App installation. Empty when the profile grants no GitHub access.
-
-      - `access_mode: string`
-
-        How repository access is granted: "none" (no access), "list" (exactly the repositories in repos), or "all" — a legacy value for policies created before per-repository grants were required; it can no longer be assigned.
-
-      - `github_installation_id: number`
-
-        The GitHub App installation the access applies to.
-
-      - `repo_count: number`
-
-        The total number of repositories granted, including any omitted from repos.
-
-      - `repos_truncated: boolean`
-
-        Whether repos was capped and omits some of the granted repositories.
-
-      - `ghe_configuration_id: optional number or null`
-
-        The GitHub host configuration this installation belongs to. Distinguishes installations with the same numeric installation ID across github.com and GitHub Enterprise Server hosts. Absent for github.com installations.
-
-      - `repo_ids: optional array of number`
-
-        The numeric GitHub repository IDs the profile grants access to, in the same order as repos (and subject to the same 100-entry cap). These IDs are the authoritative identity of the granted repositories — access is enforced against them, not against the display names in repos.
-
-      - `repos: optional array of string`
-
-        Repository names (owner/name) the profile grants access to, populated when access_mode is "list". Names are display-only labels resolved when the event was recorded and may lag a repository rename; the entries in repo_ids are the authoritative identity of the granted repositories. A repository whose name is unavailable is listed as its numeric GitHub repository ID instead. At most 100 entries are included; repos_truncated indicates when the granted set is larger.
-
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -138180,13 +139976,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `CcrAgentProxyProfileDeleted object`
+  - `CcrAgentProxyProvisioningLinkGenerated object`
 
-    A Claude Code agent proxy profile was deleted, removing its policy from everything it was bound to.
+    An organization owner generated a one-time agent proxy credential provisioning link so a teammate can submit a credential into the target agent proxy profile without holding the owner role.
 
-    - `type: optional "ccr_agent_proxy_profile_deleted"`
+    - `type: optional "ccr_agent_proxy_provisioning_link_generated"`
 
-      default: ccr_agent_proxy_profile_deleted
+      default: ccr_agent_proxy_provisioning_link_generated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -138394,33 +140190,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `deleted_credential_count: number`
-
-      Number of credentials deleted together with the profile — deleting a profile also deletes the credentials attached to it. Each deleted credential additionally emits its own ccr_agent_proxy_credential_deleted activity, at most 100 per profile deletion. Best-effort: when deleted_credentials_unknown is true the count could not be determined and 0 here does not mean the profile had no credentials.
-
-    - `deleted_credentials_unknown: boolean`
-
-      Whether the number of credentials deleted with the profile could not be determined. When true, deleted_credential_count is 0 and no per-credential deletion activities were emitted, even though the deletion may have destroyed credentials.
-
-    - `deleted_destination_count: number`
-
-      Number of destinations deleted together with the profile. Each deleted destination additionally emits its own ccr_agent_proxy_destination_deleted activity with deleted_with_profile set, at most 100 per profile deletion. Best-effort: when deleted_destinations_unknown is true the count could not be determined and 0 here does not mean the profile had no destinations.
-
-    - `deleted_destinations_unknown: boolean`
-
-      Whether the number of destinations deleted with the profile could not be determined. Same semantics as deleted_credentials_unknown.
-
-    - `deleted_rule_count: number`
-
-      Number of rules deleted together with the profile. Each deleted rule additionally emits its own ccr_agent_proxy_rule_deleted activity with deleted_with_profile set, at most 100 per profile deletion. Best-effort: when deleted_rules_unknown is true the count could not be determined and 0 here does not mean the profile had no rules.
-
-    - `deleted_rules_unknown: boolean`
+    - `link_id: string`
 
-      Whether the number of rules deleted with the profile could not be determined. Same semantics as deleted_credentials_unknown.
+      The provisioning link's identifier. Correlation only; redemption requires an org-member session, so this is not a bearer credential.
 
     - `profile_id: string`
 
-      The profile that was deleted, e.g. "capp_01HX...".
+      The agent proxy profile the submitted credential will be created in, e.g. "capp_01HX...".
 
     - `id: optional string`
 
@@ -138440,13 +140216,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `CcrAgentProxyProfileUnbound object`
+  - `CcrAgentProxyProvisioningLinkRevoked object`
 
-    A Claude Code agent proxy profile was unbound from a scope, removing its policy from Claude Code sessions in that scope.
+    An organization owner revoked an unfilled agent proxy provisioning link.
 
-    - `type: optional "ccr_agent_proxy_profile_unbound"`
+    - `type: optional "ccr_agent_proxy_provisioning_link_revoked"`
 
-      default: ccr_agent_proxy_profile_unbound
+      default: ccr_agent_proxy_provisioning_link_revoked
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -138654,17 +140430,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `profile_id: string`
-
-      The profile that was unbound, e.g. "capp_01HX...".
-
-    - `scope_id: string`
+    - `link_id: string`
 
-      The identifier of the scope the profile was unbound from.
+      The provisioning link's identifier.
 
-    - `scope_kind: string`
+    - `profile_id: string`
 
-      The kind of scope the profile was unbound from: "organization", "environment", "account", or "agent".
+      The agent proxy profile the link targeted, e.g. "capp_01HX...".
 
     - `id: optional string`
 
@@ -138684,13 +140456,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `CcrAgentProxyProfileUpdated object`
+  - `CcrAgentProxyProvisioningLinkSubmitted object`
 
-    A Claude Code agent proxy profile's configuration was updated.
+    A teammate submitted a credential via an agent proxy provisioning link. The credential and a disabled rule are created; the credential takes traffic only after an organization owner enables the submitted credential. This event records the link-mediated lifecycle; the credential itself additionally emits ccr_agent_proxy_credential_created.
 
-    - `type: optional "ccr_agent_proxy_profile_updated"`
+    - `type: optional "ccr_agent_proxy_provisioning_link_submitted"`
 
-      default: ccr_agent_proxy_profile_updated
+      default: ccr_agent_proxy_provisioning_link_submitted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -138898,63 +140670,35 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `profile_id: string`
-
-      The profile that was updated, e.g. "capp_01HX...".
-
-    - `id: optional string`
-
-      Unique identifier for the activity e.g. 'activity_abcd1234'
-
-    - `created_at: optional string`
-
-      When this activity occurred.
-
-      format: date-time
-
-    - `github_access_changes: optional array of object`
-
-      How the profile's GitHub repository access changed, one entry per GitHub App installation whose access changed. Empty when the update did not change GitHub access.
-
-      - `access_mode: string`
-
-        How repository access is granted after the change: "none" (no access), "list" (access is restricted to an explicit repository list — repos_added/repos_removed carry this change's delta and repo_count the post-change total), or "all" — a legacy value for policies created before per-repository grants were required; it can no longer be assigned.
-
-      - `github_installation_id: number`
-
-        The GitHub App installation the change applies to.
-
-      - `repo_count: number`
-
-        The total number of repositories granted after the change.
+    - `credential_id: string`
 
-      - `repos_truncated: boolean`
+      The credential that was created, e.g. "apc_01HX...".
 
-        Whether repos_added or repos_removed was capped and omits some of the changed repositories.
+    - `credential_type: string`
 
-      - `ghe_configuration_id: optional number or null`
+      The kind of credential, e.g. "bearer" or "basic".
 
-        The GitHub host configuration this installation belongs to. Distinguishes installations with the same numeric installation ID across github.com and GitHub Enterprise Server hosts. Absent for github.com installations.
+    - `link_id: string`
 
-      - `previous_access_mode: optional string or null`
+      The provisioning link's identifier.
 
-        How repository access was granted before the change. Present only when the access mode changed.
+    - `profile_id: string`
 
-      - `repo_ids_added: optional array of number`
+      The agent proxy profile the credential was created in, e.g. "capp_01HX...".
 
-        The numeric GitHub repository IDs added to the granted set, in the same order as repos_added (and subject to the same 100-entry cap). These IDs are the authoritative identity of the added repositories — access is enforced against them, not against the display names in repos_added.
+    - `id: optional string`
 
-      - `repo_ids_removed: optional array of number`
+      Unique identifier for the activity e.g. 'activity_abcd1234'
 
-        The numeric GitHub repository IDs removed from the granted set, in the same order as repos_removed (and subject to the same 100-entry cap). These IDs are the authoritative identity of the removed repositories.
+    - `created_at: optional string`
 
-      - `repos_added: optional array of string`
+      When this activity occurred.
 
-        Repository names (owner/name) added to the granted set. Names are display-only labels resolved when the event was recorded and may lag a repository rename; the entries in repo_ids_added are the authoritative identity of the added repositories. A repository whose name is unavailable is listed as its numeric GitHub repository ID instead. At most 100 entries are included; repos_truncated indicates when more were added. Empty when the change involves "all" access, which grants every repository regardless of any explicit list.
+      format: date-time
 
-      - `repos_removed: optional array of string`
+    - `host_constraint: optional array of string`
 
-        Repository names (owner/name) removed from the granted set. Same rendering, cap, and "all" handling as repos_added; repo_ids_removed carries the authoritative identity of the removed repositories.
+      The host name patterns the credential may be sent to.
 
     - `organization_id: optional string or null`
 
@@ -138964,17 +140708,25 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `updated_fields: optional array of string`
+  - `CcrAgentProxyRuleCreated object`
 
-      Names of the configuration fields included in the update, e.g. "display_name", "github_installation_permissions".
+    An agent proxy rule was created. A rule decides what happens to a session's outbound requests that match it.
 
-  - `CcrAgentProxyProvisioningCredentialRejected object`
+    - `type: optional "ccr_agent_proxy_rule_created"`
 
-    An organization owner rejected a credential that a teammate submitted via an agent proxy provisioning link: the credential and its disabled rule were deleted and the link was revoked. The actor is the owner; the submitter is recorded for attribution.
+      default: ccr_agent_proxy_rule_created
 
-    - `type: optional "ccr_agent_proxy_provisioning_credential_rejected"`
+    - `action: "allow" or "deny" or "require_approval" or "unspecified"`
 
-      default: ccr_agent_proxy_provisioning_credential_rejected
+      What the rule does with a matching request.
+
+      - `"allow"`
+
+      - `"deny"`
+
+      - `"require_approval"`
+
+      - `"unspecified"`
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -139182,25 +140934,65 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `credential_id: string`
+    - `has_condition: boolean`
 
-      The credential the member submitted, e.g. "apc_01HX...".
+      Whether the rule carries a custom condition expression that further narrows the requests it matches beyond the host name patterns, ports, methods and paths.
 
-    - `link_id: string`
+    - `hosts_truncated: boolean`
 
-      The provisioning link's identifier.
+      Whether hosts was capped and omits some of the configured host name patterns.
+
+    - `injects_credential: boolean`
+
+      Whether the rule adds a managed credential to the requests it allows.
+
+    - `mode: "disabled" or "enforce" or "shadow" or "unspecified"`
+
+      Whether the rule is enforced, only observed, or switched off.
+
+      - `"disabled"`
+
+      - `"enforce"`
+
+      - `"shadow"`
+
+      - `"unspecified"`
+
+    - `path_pattern_count: number`
+
+      How many request path patterns (prefixes or regular expressions) narrow the requests the rule matches; 0 when the rule matches every path.
+
+    - `ports_truncated: boolean`
+
+      Whether ports was capped and omits some of the configured ports.
+
+    - `priority: number`
+
+      Where the rule is evaluated among the profile's rules: a lower number is evaluated first, and the first matching rule decides the request.
 
     - `profile_id: string`
 
-      The agent proxy profile the credential lived in, e.g. "capp_01HX...".
+      The agent proxy profile the rule belongs to, e.g. "capp_01HX...".
 
-    - `rule_id: string`
+    - `protocol: "http" or "mysql" or "postgres" or 3 more`
 
-      The disabled rule that was deleted alongside the credential, e.g. "apr_01HX...".
+      The kind of connection the rule applies to.
 
-    - `submitted_by_user_id: string`
+      - `"http"`
 
-      The tagged account ID of the user who originally submitted the credential, e.g. "user_01HX...".
+      - `"mysql"`
+
+      - `"postgres"`
+
+      - `"ssh"`
+
+      - `"tcp"`
+
+      - `"unspecified"`
+
+    - `rule_id: string`
+
+      The rule that was created, e.g. "apr_01HX...".
 
     - `id: optional string`
 
@@ -139212,6 +141004,32 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
+    - `hosts: optional array of string`
+
+      The host name patterns the rule matches, in canonical form (lowercase, internationalized names in their ASCII encoding), e.g. "api.example.com" or "*.example.com". At most 100 entries are included; hosts_truncated indicates when the configured set is larger.
+
+    - `injected_credential_id: optional string or null`
+
+      The managed credential the rule adds to the requests it allows, e.g. "apc_01HX...". Unset when the rule adds none.
+
+    - `methods: optional array of string`
+
+      The HTTP methods the rule matches, e.g. `GET`. Empty when the rule matches every method.
+
+    - `mutation_kinds: optional array of "inject_credential" or "route_to" or "set_header" or 2 more`
+
+      The kinds of change the rule makes to the requests it allows, each listed once.
+
+      - `"inject_credential"`
+
+      - `"route_to"`
+
+      - `"set_header"`
+
+      - `"strip_header"`
+
+      - `"unspecified"`
+
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -139220,13 +141038,21 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `CcrAgentProxyProvisioningLinkEnabled object`
+    - `ports: optional array of number`
 
-    An organization owner enabled a credential that a teammate submitted via an agent proxy provisioning link: the disabled rule created at submission was switched to enforce, so the credential now takes traffic. The actor is the owner; the submitter is the actor on the prior ccr_agent_proxy_provisioning_link_submitted event.
+      The TCP ports the rule matches, e.g. 443. At most 100 entries are included; ports_truncated indicates when the configured set is larger.
 
-    - `type: optional "ccr_agent_proxy_provisioning_link_enabled"`
+    - `route_to_destination_id: optional string or null`
 
-      default: ccr_agent_proxy_provisioning_link_enabled
+      The configured destination the rule sends allowed requests to instead of the host they name, e.g. "apd_01HX...". Unset when the rule reroutes nothing.
+
+  - `CcrAgentProxyRuleDeleted object`
+
+    An agent proxy rule was deleted.
+
+    - `type: optional "ccr_agent_proxy_rule_deleted"`
+
+      default: ccr_agent_proxy_rule_deleted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -139434,26 +141260,26 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `credential_id: string`
-
-      The credential the member submitted, e.g. "apc_01HX...".
-
-    - `link_id: string`
+    - `deleted_with_profile: boolean`
 
-      The provisioning link's identifier.
+      True when this deletion happened as part of deleting the whole profile (profile_id names the deleted profile). At most one of deleted_with_profile / cascade_trigger_credential_id is set; both unset means a direct DeleteAgentProxyRule call or a provisioning-link reject (RejectAgentProxyProvisionedCredential) — the reject case also emits CcrAgentProxyProvisioningCredentialRejected with the same rule_id in the same batch.
 
     - `profile_id: string`
 
-      The agent proxy profile the credential lives in, e.g. "capp_01HX...".
+      The agent proxy profile the rule belonged to, e.g. "capp_01HX...".
 
     - `rule_id: string`
 
-      The rule that was flipped to enforce, e.g. "apr_01HX...".
+      The rule that was deleted, e.g. "apr_01HX...".
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
+    - `cascade_trigger_credential_id: optional string or null`
+
+      Set when this deletion was triggered by a cascading DeleteAgentProxyCredential (the rule inject_credential-referenced the deleted credential). Unset for a direct DeleteAgentProxyRule call, for the profile-delete cascade (see deleted_with_profile), and for a provisioning-link reject that removed the provisioned rule.
+
     - `created_at: optional string`
 
       When this activity occurred.
@@ -139468,13 +141294,25 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `CcrAgentProxyProvisioningLinkGenerated object`
+  - `CcrAgentProxyRuleUpdated object`
 
-    An organization owner generated a one-time agent proxy credential provisioning link so a teammate can submit a credential into the target agent proxy profile without holding the owner role.
+    An agent proxy rule was updated. An update replaces everything the rule matches and does, so the host name patterns here are the rule's complete set after the update.
 
-    - `type: optional "ccr_agent_proxy_provisioning_link_generated"`
+    - `type: optional "ccr_agent_proxy_rule_updated"`
 
-      default: ccr_agent_proxy_provisioning_link_generated
+      default: ccr_agent_proxy_rule_updated
+
+    - `action: "allow" or "deny" or "require_approval" or "unspecified"`
+
+      What the rule does with a matching request.
+
+      - `"allow"`
+
+      - `"deny"`
+
+      - `"require_approval"`
+
+      - `"unspecified"`
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -139682,13 +141520,69 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `link_id: string`
+    - `has_condition: boolean`
 
-      The provisioning link's identifier. Correlation only; redemption requires an org-member session, so this is not a bearer credential.
+      Whether the rule carries a custom condition expression that further narrows the requests it matches beyond the host name patterns, ports, methods and paths.
+
+    - `hosts_truncated: boolean`
+
+      Whether hosts was capped and omits some of the configured host name patterns.
+
+    - `injects_credential: boolean`
+
+      Whether the rule adds a managed credential to the requests it allows.
+
+    - `mode: "disabled" or "enforce" or "shadow" or "unspecified"`
+
+      Whether the rule is enforced, only observed, or switched off.
+
+      - `"disabled"`
+
+      - `"enforce"`
+
+      - `"shadow"`
+
+      - `"unspecified"`
+
+    - `path_pattern_count: number`
+
+      How many request path patterns (prefixes or regular expressions) narrow the requests the rule matches after the update; 0 when the rule matches every path.
+
+    - `ports_truncated: boolean`
+
+      Whether ports was capped and omits some of the configured ports.
+
+    - `priority: number`
+
+      Where the rule is evaluated among the profile's rules: a lower number is evaluated first, and the first matching rule decides the request.
 
     - `profile_id: string`
 
-      The agent proxy profile the submitted credential will be created in, e.g. "capp_01HX...".
+      The agent proxy profile the rule belongs to, e.g. "capp_01HX...".
+
+    - `protocol: "http" or "mysql" or "postgres" or 3 more`
+
+      The kind of connection the rule applies to.
+
+      - `"http"`
+
+      - `"mysql"`
+
+      - `"postgres"`
+
+      - `"ssh"`
+
+      - `"tcp"`
+
+      - `"unspecified"`
+
+    - `rule_id: string`
+
+      The rule that was updated, e.g. "apr_01HX...".
+
+    - `version: number`
+
+      The rule's version after the update; it increases by one on every update.
 
     - `id: optional string`
 
@@ -139700,6 +141594,32 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
+    - `hosts: optional array of string`
+
+      The host name patterns the rule matches after the update, in canonical form (lowercase, internationalized names in their ASCII encoding). At most 100 entries are included; hosts_truncated indicates when the configured set is larger.
+
+    - `injected_credential_id: optional string or null`
+
+      The managed credential the rule adds to the requests it allows, e.g. "apc_01HX...". Unset when the rule adds none.
+
+    - `methods: optional array of string`
+
+      The HTTP methods the rule matches after the update, e.g. `GET`. Empty when the rule matches every method.
+
+    - `mutation_kinds: optional array of "inject_credential" or "route_to" or "set_header" or 2 more`
+
+      The kinds of change the rule makes to the requests it allows after the update, each listed once.
+
+      - `"inject_credential"`
+
+      - `"route_to"`
+
+      - `"set_header"`
+
+      - `"strip_header"`
+
+      - `"unspecified"`
+
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -139708,13 +141628,21 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `CcrAgentProxyProvisioningLinkRevoked object`
+    - `ports: optional array of number`
 
-    An organization owner revoked an unfilled agent proxy provisioning link.
+      The TCP ports the rule matches, e.g. 443. At most 100 entries are included; ports_truncated indicates when the configured set is larger.
 
-    - `type: optional "ccr_agent_proxy_provisioning_link_revoked"`
+    - `route_to_destination_id: optional string or null`
 
-      default: ccr_agent_proxy_provisioning_link_revoked
+      The configured destination the rule sends allowed requests to instead of the host they name, e.g. "apd_01HX...". Unset when the rule reroutes nothing.
+
+  - `CcrAgentSlackAccessScopeCreated object`
+
+    A Claude Code agent was granted access to read or write in an additional Slack channel beyond the one it is assigned to.
+
+    - `type: optional "ccr_agent_slack_access_scope_created"`
+
+      default: ccr_agent_slack_access_scope_created
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -139922,13 +141850,21 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `link_id: string`
+    - `agent_id: string`
 
-      The provisioning link's identifier.
+      The agent that was granted access, e.g. "cagt_01HX...".
 
-    - `profile_id: string`
+    - `can_write: boolean`
 
-      The agent proxy profile the link targeted, e.g. "capp_01HX...".
+      Whether the grant includes permission to post messages in the channel, in addition to reading it.
+
+    - `slack_channel_id: string`
+
+      The Slack channel the agent was granted access to, e.g. "C01ABC...". Empty when the grant covers the entire workspace.
+
+    - `slack_team_id: string`
+
+      The Slack workspace containing the channel, e.g. "T01ABC...".
 
     - `id: optional string`
 
@@ -139948,13 +141884,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `CcrAgentProxyProvisioningLinkSubmitted object`
+  - `CcrAgentSlackAccessScopeDeleted object`
 
-    A teammate submitted a credential via an agent proxy provisioning link. The credential and a disabled rule are created; the credential takes traffic only after an organization owner enables the submitted credential. This event records the link-mediated lifecycle; the credential itself additionally emits ccr_agent_proxy_credential_created.
+    A Claude Code agent's access to an additional Slack channel was revoked.
 
-    - `type: optional "ccr_agent_proxy_provisioning_link_submitted"`
+    - `type: optional "ccr_agent_slack_access_scope_deleted"`
 
-      default: ccr_agent_proxy_provisioning_link_submitted
+      default: ccr_agent_slack_access_scope_deleted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -140162,21 +142098,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `credential_id: string`
-
-      The credential that was created, e.g. "apc_01HX...".
-
-    - `credential_type: string`
+    - `agent_id: string`
 
-      The kind of credential, e.g. "bearer" or "basic".
+      The agent whose access was revoked, e.g. "cagt_01HX...".
 
-    - `link_id: string`
+    - `slack_channel_id: string`
 
-      The provisioning link's identifier.
+      The Slack channel the agent's access was revoked from, e.g. "C01ABC...". Empty when the revoked grant covered the entire workspace.
 
-    - `profile_id: string`
+    - `slack_team_id: string`
 
-      The agent proxy profile the credential was created in, e.g. "capp_01HX...".
+      The Slack workspace containing the channel, e.g. "T01ABC...".
 
     - `id: optional string`
 
@@ -140188,10 +142120,6 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
-    - `host_constraint: optional array of string`
-
-      The host name patterns the credential may be sent to.
-
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -140200,25 +142128,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `CcrAgentProxyRuleCreated object`
-
-    An agent proxy rule was created. A rule decides what happens to a session's outbound requests that match it.
-
-    - `type: optional "ccr_agent_proxy_rule_created"`
-
-      default: ccr_agent_proxy_rule_created
-
-    - `action: "allow" or "deny" or "require_approval" or "unspecified"`
-
-      What the rule does with a matching request.
-
-      - `"allow"`
+  - `CcrAgentSlackBindingCreated object`
 
-      - `"deny"`
+    A Claude Code agent was assigned to a Slack channel or workspace as its dedicated agent.
 
-      - `"require_approval"`
+    - `type: optional "ccr_agent_slack_binding_created"`
 
-      - `"unspecified"`
+      default: ccr_agent_slack_binding_created
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -140426,65 +142342,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `has_condition: boolean`
-
-      Whether the rule carries a custom condition expression that further narrows the requests it matches beyond the host name patterns, ports, methods and paths.
-
-    - `hosts_truncated: boolean`
-
-      Whether hosts was capped and omits some of the configured host name patterns.
-
-    - `injects_credential: boolean`
-
-      Whether the rule adds a managed credential to the requests it allows.
-
-    - `mode: "disabled" or "enforce" or "shadow" or "unspecified"`
-
-      Whether the rule is enforced, only observed, or switched off.
-
-      - `"disabled"`
-
-      - `"enforce"`
-
-      - `"shadow"`
-
-      - `"unspecified"`
-
-    - `path_pattern_count: number`
-
-      How many request path patterns (prefixes or regular expressions) narrow the requests the rule matches; 0 when the rule matches every path.
-
-    - `ports_truncated: boolean`
-
-      Whether ports was capped and omits some of the configured ports.
-
-    - `priority: number`
-
-      Where the rule is evaluated among the profile's rules: a lower number is evaluated first, and the first matching rule decides the request.
-
-    - `profile_id: string`
-
-      The agent proxy profile the rule belongs to, e.g. "capp_01HX...".
-
-    - `protocol: "http" or "mysql" or "postgres" or 3 more`
-
-      The kind of connection the rule applies to.
-
-      - `"http"`
-
-      - `"mysql"`
-
-      - `"postgres"`
+    - `agent_id: string`
 
-      - `"ssh"`
+      The agent the binding was created for, e.g. "cagt_01HX...".
 
-      - `"tcp"`
+    - `slack_channel_id: string`
 
-      - `"unspecified"`
+      The Slack channel the agent was assigned to, e.g. "C01ABC...". Empty when the agent was assigned to the entire workspace.
 
-    - `rule_id: string`
+    - `slack_team_id: string`
 
-      The rule that was created, e.g. "apr_01HX...".
+      The Slack workspace the agent was assigned to, e.g. "T01ABC...".
 
     - `id: optional string`
 
@@ -140496,32 +142364,6 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
-    - `hosts: optional array of string`
-
-      The host name patterns the rule matches, in canonical form (lowercase, internationalized names in their ASCII encoding), e.g. "api.example.com" or "*.example.com". At most 100 entries are included; hosts_truncated indicates when the configured set is larger.
-
-    - `injected_credential_id: optional string or null`
-
-      The managed credential the rule adds to the requests it allows, e.g. "apc_01HX...". Unset when the rule adds none.
-
-    - `methods: optional array of string`
-
-      The HTTP methods the rule matches, e.g. `GET`. Empty when the rule matches every method.
-
-    - `mutation_kinds: optional array of "inject_credential" or "route_to" or "set_header" or 2 more`
-
-      The kinds of change the rule makes to the requests it allows, each listed once.
-
-      - `"inject_credential"`
-
-      - `"route_to"`
-
-      - `"set_header"`
-
-      - `"strip_header"`
-
-      - `"unspecified"`
-
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -140530,21 +142372,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `ports: optional array of number`
-
-      The TCP ports the rule matches, e.g. 443. At most 100 entries are included; ports_truncated indicates when the configured set is larger.
-
-    - `route_to_destination_id: optional string or null`
-
-      The configured destination the rule sends allowed requests to instead of the host they name, e.g. "apd_01HX...". Unset when the rule reroutes nothing.
-
-  - `CcrAgentProxyRuleDeleted object`
+  - `CcrAgentSlackBindingDeleted object`
 
-    An agent proxy rule was deleted.
+    A Claude Code agent's assignment to a Slack channel or workspace was removed.
 
-    - `type: optional "ccr_agent_proxy_rule_deleted"`
+    - `type: optional "ccr_agent_slack_binding_deleted"`
 
-      default: ccr_agent_proxy_rule_deleted
+      default: ccr_agent_slack_binding_deleted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -140752,26 +142586,22 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `deleted_with_profile: boolean`
+    - `agent_id: string`
 
-      True when this deletion happened as part of deleting the whole profile (profile_id names the deleted profile). At most one of deleted_with_profile / cascade_trigger_credential_id is set; both unset means a direct DeleteAgentProxyRule call or a provisioning-link reject (RejectAgentProxyProvisionedCredential) — the reject case also emits CcrAgentProxyProvisioningCredentialRejected with the same rule_id in the same batch.
+      The agent the binding was removed from, e.g. "cagt_01HX...".
 
-    - `profile_id: string`
+    - `slack_channel_id: string`
 
-      The agent proxy profile the rule belonged to, e.g. "capp_01HX...".
+      The Slack channel the agent was unassigned from, e.g. "C01ABC...". Empty when the assignment covered the entire workspace.
 
-    - `rule_id: string`
+    - `slack_team_id: string`
 
-      The rule that was deleted, e.g. "apr_01HX...".
+      The Slack workspace the agent was unassigned from, e.g. "T01ABC...".
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `cascade_trigger_credential_id: optional string or null`
-
-      Set when this deletion was triggered by a cascading DeleteAgentProxyCredential (the rule inject_credential-referenced the deleted credential). Unset for a direct DeleteAgentProxyRule call, for the profile-delete cascade (see deleted_with_profile), and for a provisioning-link reject that removed the provisioned rule.
-
     - `created_at: optional string`
 
       When this activity occurred.
@@ -140786,25 +142616,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `CcrAgentProxyRuleUpdated object`
-
-    An agent proxy rule was updated. An update replaces everything the rule matches and does, so the host name patterns here are the rule's complete set after the update.
-
-    - `type: optional "ccr_agent_proxy_rule_updated"`
-
-      default: ccr_agent_proxy_rule_updated
-
-    - `action: "allow" or "deny" or "require_approval" or "unspecified"`
-
-      What the rule does with a matching request.
-
-      - `"allow"`
+  - `CcrAgentUpdated object`
 
-      - `"deny"`
+    A Claude Code agent's configuration was updated. Also emitted with updated_fields ["is_virtual"] alone when an auto-provisioned agent is promoted to a configured one, whether by an update request targeting it or by binding an agent proxy profile to it.
 
-      - `"require_approval"`
+    - `type: optional "ccr_agent_updated"`
 
-      - `"unspecified"`
+      default: ccr_agent_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -141012,69 +142830,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `has_condition: boolean`
-
-      Whether the rule carries a custom condition expression that further narrows the requests it matches beyond the host name patterns, ports, methods and paths.
-
-    - `hosts_truncated: boolean`
-
-      Whether hosts was capped and omits some of the configured host name patterns.
-
-    - `injects_credential: boolean`
-
-      Whether the rule adds a managed credential to the requests it allows.
-
-    - `mode: "disabled" or "enforce" or "shadow" or "unspecified"`
-
-      Whether the rule is enforced, only observed, or switched off.
-
-      - `"disabled"`
-
-      - `"enforce"`
-
-      - `"shadow"`
-
-      - `"unspecified"`
-
-    - `path_pattern_count: number`
-
-      How many request path patterns (prefixes or regular expressions) narrow the requests the rule matches after the update; 0 when the rule matches every path.
-
-    - `ports_truncated: boolean`
-
-      Whether ports was capped and omits some of the configured ports.
-
-    - `priority: number`
-
-      Where the rule is evaluated among the profile's rules: a lower number is evaluated first, and the first matching rule decides the request.
-
-    - `profile_id: string`
-
-      The agent proxy profile the rule belongs to, e.g. "capp_01HX...".
-
-    - `protocol: "http" or "mysql" or "postgres" or 3 more`
-
-      The kind of connection the rule applies to.
-
-      - `"http"`
-
-      - `"mysql"`
-
-      - `"postgres"`
-
-      - `"ssh"`
-
-      - `"tcp"`
+    - `agent_id: string`
 
-      - `"unspecified"`
+      The agent that was updated, e.g. "cagt_01HX...".
 
-    - `rule_id: string`
+    - `default_source_urls_truncated: boolean`
 
-      The rule that was updated, e.g. "apr_01HX...".
+      Whether default_source_urls was capped and omits some of the granted repositories.
 
-    - `version: number`
+    - `omitted_source_url_count: number`
 
-      The rule's version after the update; it increases by one on every update.
+      Number of default repository entries that could not be safely rendered as a credential-free URL and were omitted from default_source_urls. A non-zero value with an empty list means repositories were granted but could not be displayed — not that all repositories were removed.
 
     - `id: optional string`
 
@@ -141086,31 +142852,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
-    - `hosts: optional array of string`
-
-      The host name patterns the rule matches after the update, in canonical form (lowercase, internationalized names in their ASCII encoding). At most 100 entries are included; hosts_truncated indicates when the configured set is larger.
-
-    - `injected_credential_id: optional string or null`
-
-      The managed credential the rule adds to the requests it allows, e.g. "apc_01HX...". Unset when the rule adds none.
-
-    - `methods: optional array of string`
-
-      The HTTP methods the rule matches after the update, e.g. `GET`. Empty when the rule matches every method.
-
-    - `mutation_kinds: optional array of "inject_credential" or "route_to" or "set_header" or 2 more`
-
-      The kinds of change the rule makes to the requests it allows after the update, each listed once.
-
-      - `"inject_credential"`
-
-      - `"route_to"`
+    - `default_source_urls: optional array of string`
 
-      - `"set_header"`
+      The agent's default repository URLs after the update, reduced to scheme, host, and path — credentials and query parameters are never included. Populated only when the update changed them — "default_source_urls" appears in updated_fields. Empty while listed in updated_fields AND omitted_source_url_count is 0 means all default repositories were removed. At most 100 entries are included; default_source_urls_truncated indicates when more were granted.
 
-      - `"strip_header"`
+    - `guest_policy: optional string or null`
 
-      - `"unspecified"`
+      The agent's response policy for Slack channels that include guest users and Slack Connect channels shared with other organizations, after the update: "allow", "restrict", "channel" (the agent responds, using only that channel's own content and configuration), or "default" when the update removed the agent-specific policy so the agent inherits the surrounding default. In Slack Connect channels "allow" gives at most "channel" access. Present only when the update changed it.
 
     - `organization_id: optional string or null`
 
@@ -141120,21 +142868,21 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `ports: optional array of number`
+    - `slack_alias: optional string or null`
 
-      The TCP ports the rule matches, e.g. 443. At most 100 entries are included; ports_truncated indicates when the configured set is larger.
+      The agent's Slack trigger word after the update. Present only when the update changed it. An empty value means the agent responds to bare "@Claude" mentions.
 
-    - `route_to_destination_id: optional string or null`
+    - `updated_fields: optional array of string`
 
-      The configured destination the rule sends allowed requests to instead of the host they name, e.g. "apd_01HX...". Unset when the rule reroutes nothing.
+      Names of the configuration fields included in the update, e.g. "display_name", "system_prompt_addendum", "guest_policy". Includes "is_virtual" when this update was the first administrator action on an auto-provisioned agent — a durable state change even when no other field was supplied.
 
-  - `CcrAgentSlackAccessScopeCreated object`
+  - `CcrChannelManagerAdded object`
 
-    A Claude Code agent was granted access to read or write in an additional Slack channel beyond the one it is assigned to.
+    An org owner/admin assigned an organization member to manage the Claude-in-Slack configuration of one Slack channel.
 
-    - `type: optional "ccr_agent_slack_access_scope_created"`
+    - `type: optional "ccr_channel_manager_added"`
 
-      default: ccr_agent_slack_access_scope_created
+      default: ccr_channel_manager_added
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -141344,20 +143092,20 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
     - `agent_id: string`
 
-      The agent that was granted access, e.g. "cagt_01HX...".
-
-    - `can_write: boolean`
-
-      Whether the grant includes permission to post messages in the channel, in addition to reading it.
+      The channel's Claude agent (cagt_...) the assignment is recorded against.
 
     - `slack_channel_id: string`
 
-      The Slack channel the agent was granted access to, e.g. "C01ABC...". Empty when the grant covers the entire workspace.
+      The Slack channel the member may now manage, e.g. "C01ABC...".
 
     - `slack_team_id: string`
 
       The Slack workspace containing the channel, e.g. "T01ABC...".
 
+    - `user_id: string`
+
+      Tagged ID of the member who was assigned.
+
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
@@ -141376,13 +143124,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `CcrAgentSlackAccessScopeDeleted object`
+  - `CcrChannelManagerRemoved object`
 
-    A Claude Code agent's access to an additional Slack channel was revoked.
+    An org owner/admin removed an organization member's assignment to manage the Claude-in-Slack configuration of one Slack channel.
 
-    - `type: optional "ccr_agent_slack_access_scope_deleted"`
+    - `type: optional "ccr_channel_manager_removed"`
 
-      default: ccr_agent_slack_access_scope_deleted
+      default: ccr_channel_manager_removed
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -141592,259 +143340,19 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
     - `agent_id: string`
 
-      The agent whose access was revoked, e.g. "cagt_01HX...".
+      The channel's Claude agent (cagt_...) the assignment was recorded against.
 
     - `slack_channel_id: string`
 
-      The Slack channel the agent's access was revoked from, e.g. "C01ABC...". Empty when the revoked grant covered the entire workspace.
+      The Slack channel the member managed, e.g. "C01ABC...".
 
     - `slack_team_id: string`
 
       The Slack workspace containing the channel, e.g. "T01ABC...".
 
-    - `id: optional string`
-
-      Unique identifier for the activity e.g. 'activity_abcd1234'
-
-    - `created_at: optional string`
-
-      When this activity occurred.
-
-      format: date-time
-
-    - `organization_id: optional string or null`
-
-      Organization ID this activity is associated with
-
-    - `organization_uuid: optional string or null`
-
-      Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
-
-  - `CcrAgentSlackBindingCreated object`
-
-    A Claude Code agent was assigned to a Slack channel or workspace as its dedicated agent.
-
-    - `type: optional "ccr_agent_slack_binding_created"`
-
-      default: ccr_agent_slack_binding_created
-
-    - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
-
-      - `APIActor object`
-
-        - `type: optional "api_actor"`
-
-          default: api_actor
-
-        - `api_key_id: string`
-
-        - `ip_address: string`
-
-        - `user_agent: string`
-
-      - `UserActor object`
-
-        - `type: optional "user_actor"`
-
-          default: user_actor
-
-        - `email_address: string`
-
-          format: email
-
-        - `ip_address: string`
-
-        - `user_agent: string`
-
-        - `user_id: string`
-
-      - `UnauthenticatedUserActor object`
-
-        - `type: optional "unauthenticated_user_actor"`
-
-          default: unauthenticated_user_actor
-
-        - `ip_address: string`
-
-        - `user_agent: string`
-
-        - `unauthenticated_email_address: optional string or null`
-
-          format: email
-
-      - `AnthropicActor object`
-
-        - `type: optional "anthropic_actor"`
-
-          default: anthropic_actor
-
-        - `email_address: optional string or null`
-
-          format: email
-
-      - `SystemActor object`
-
-        Automated background processing performed by Anthropic systems, acting
-        without a user or customer credential.
-
-        - `type: optional "system_actor"`
-
-          default: system_actor
-
-        - `service: optional string or null`
-
-          Name of the automated process that performed the action, when known.
-
-      - `AdminAPIKeyActor object`
-
-        - `type: optional "admin_api_key_actor"`
-
-          default: admin_api_key_actor
-
-        - `admin_api_key_id: string`
-
-        - `ip_address: string`
-
-        - `user_agent: string`
-
-      - `ServiceAccountActor object`
-
-        - `type: optional "service_account_actor"`
-
-          default: service_account_actor
-
-        - `ip_address: string`
-
-        - `service_account_id: string`
-
-        - `user_agent: string`
-
-      - `ScimDirectorySyncActor object`
-
-        - `type: optional "scim_directory_sync_actor"`
-
-          default: scim_directory_sync_actor
-
-        - `directory_id: string`
-
-        - `workos_event_id: string`
-
-        - `idp_connection_type: optional string or null`
-
-      - `FederatedIdentityActor object`
-
-        A federated external workload authenticated via a verified OIDC token.
-
-        Carries the verified issuer, subject, and audience claims from the
-        presented JWT.
-
-        - `type: optional "federated_identity_actor"`
-
-          default: federated_identity_actor
-
-        - `issuer: string`
-
-        - `subject: string`
-
-        - `audience: optional array of string`
-
-        - `ip_address: optional string or null`
-
-        - `user_agent: optional string or null`
-
-      - `FederatedActor object`
-
-        An external identity asserted by a trusted provider — a cloud-provider
-        gateway or a customer-registered federation issuer — acting without an
-        Anthropic-provisioned account or service account.
-
-        - `type: optional "federated_actor"`
-
-          default: federated_actor
-
-        - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
-
-          - `FederatedActorAwsProvider object`
-
-            Asserting party: the AWS account the organization is bound to.
-
-            - `type: optional "aws"`
-
-              default: aws
-
-            - `account_id: string`
-
-            - `signed_principal: string`
-
-              The AWS-signed ARN of the IAM principal that requested the token.
-
-          - `FederatedActorAzureProvider object`
-
-            Asserting party: the Azure subscription the organization is bound to.
-
-            - `type: optional "azure"`
-
-              default: azure
-
-            - `subscription_id: string`
-
-          - `FederatedActorGcpProvider object`
-
-            Asserting party: the GCP project the organization is bound to.
-
-            - `type: optional "gcp"`
-
-              default: gcp
-
-            - `project_number: string`
-
-          - `FederatedActorOidcProvider object`
-
-            Asserting party: a customer-registered OIDC federation issuer.
-
-            - `type: optional "oidc"`
-
-              default: oidc
-
-            - `issuer: optional string or null`
-
-              The federation issuer's URL. Null when the presented credential failed verification.
-
-        - `ip_address: optional string or null`
-
-        - `subject: optional string or null`
-
-          The provider's verified identifier for the caller; its form depends on the provider.
-
-        - `user_agent: optional string or null`
-
-      - `AttestedDeviceActor object`
-
-        An attested mobile device authenticated via Apple App Attest.
-
-        - `type: optional "attested_device_actor"`
-
-          default: attested_device_actor
-
-        - `external_client_id: string`
-
-        - `kid_hash: string`
-
-        - `ip_address: optional string or null`
-
-        - `user_agent: optional string or null`
-
-    - `agent_id: string`
-
-      The agent the binding was created for, e.g. "cagt_01HX...".
-
-    - `slack_channel_id: string`
-
-      The Slack channel the agent was assigned to, e.g. "C01ABC...". Empty when the agent was assigned to the entire workspace.
-
-    - `slack_team_id: string`
+    - `user_id: string`
 
-      The Slack workspace the agent was assigned to, e.g. "T01ABC...".
+      Tagged ID of the member whose assignment was removed.
 
     - `id: optional string`
 
@@ -141864,13 +143372,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `CcrAgentSlackBindingDeleted object`
+  - `CcrRoleChannelAssignmentDeleted object`
 
-    A Claude Code agent's assignment to a Slack channel or workspace was removed.
+    CcrRoleChannelAssignmentDeleted is emitted when an org owner/admin removes an RBAC role's channel assignment row (the role reverts to granting zero channels).
 
-    - `type: optional "ccr_agent_slack_binding_deleted"`
+    - `type: optional "ccr_role_channel_assignment_deleted"`
 
-      default: ccr_agent_slack_binding_deleted
+      default: ccr_role_channel_assignment_deleted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -142078,17 +143586,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `agent_id: string`
-
-      The agent the binding was removed from, e.g. "cagt_01HX...".
-
-    - `slack_channel_id: string`
+    - `previous_channel_count: number`
 
-      The Slack channel the agent was unassigned from, e.g. "C01ABC...". Empty when the assignment covered the entire workspace.
+      Number of (team, channel) pairs the role was assigned before deletion.
 
-    - `slack_team_id: string`
+    - `role_id: string`
 
-      The Slack workspace the agent was unassigned from, e.g. "T01ABC...".
+      Tagged ID of the role whose channel assignment was removed.
 
     - `id: optional string`
 
@@ -142108,13 +143612,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `CcrAgentUpdated object`
+  - `CcrRoleChannelAssignmentUpdated object`
 
-    A Claude Code agent's configuration was updated. Also emitted with updated_fields ["is_virtual"] alone when an auto-provisioned agent is promoted to a configured one, whether by an update request targeting it or by binding an agent proxy profile to it.
+    CcrRoleChannelAssignmentUpdated is emitted when an org owner/admin sets or replaces the list of Slack channels an RBAC role's holders may configure via the delegated Claude-in-Slack channel-manage surface.
 
-    - `type: optional "ccr_agent_updated"`
+    - `type: optional "ccr_role_channel_assignment_updated"`
 
-      default: ccr_agent_updated
+      default: ccr_role_channel_assignment_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -142322,36 +143826,32 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `agent_id: string`
+    - `channel_count: number`
 
-      The agent that was updated, e.g. "cagt_01HX...".
+      Number of channels assigned after the write.
 
-    - `default_source_urls_truncated: boolean`
+    - `previous_channel_count: number`
 
-      Whether default_source_urls was capped and omits some of the granted repositories.
+      Number of channels assigned before the write.
 
-    - `omitted_source_url_count: number`
+    - `role_id: string`
 
-      Number of default repository entries that could not be safely rendered as a credential-free URL and were omitted from default_source_urls. A non-zero value with an empty list means repositories were granted but could not be displayed — not that all repositories were removed.
+      Tagged ID of the role whose channel assignment was written.
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
+    - `agent_ids: optional array of string`
+
+      The channel-silo agents (cagt_...) assigned after the write. Capped at 100 entries; channel_count carries the uncapped total.
+
     - `created_at: optional string`
 
       When this activity occurred.
 
       format: date-time
 
-    - `default_source_urls: optional array of string`
-
-      The agent's default repository URLs after the update, reduced to scheme, host, and path — credentials and query parameters are never included. Populated only when the update changed them — "default_source_urls" appears in updated_fields. Empty while listed in updated_fields AND omitted_source_url_count is 0 means all default repositories were removed. At most 100 entries are included; default_source_urls_truncated indicates when more were granted.
-
-    - `guest_policy: optional string or null`
-
-      The agent's response policy for Slack channels that include guest users and Slack Connect channels shared with other organizations, after the update: "allow", "restrict", "channel" (the agent responds, using only that channel's own content and configuration), or "default" when the update removed the agent-specific policy so the agent inherits the surrounding default. In Slack Connect channels "allow" gives at most "channel" access. Present only when the update changed it.
-
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -142360,21 +143860,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `slack_alias: optional string or null`
-
-      The agent's Slack trigger word after the update. Present only when the update changed it. An empty value means the agent responds to bare "@Claude" mentions.
-
-    - `updated_fields: optional array of string`
-
-      Names of the configuration fields included in the update, e.g. "display_name", "system_prompt_addendum", "guest_policy". Includes "is_virtual" when this update was the first administrator action on an auto-provisioned agent — a durable state change even when no other field was supplied.
-
-  - `CcrChannelManagerAdded object`
+  - `CcrSessionCreated object`
 
-    An org owner/admin assigned an organization member to manage the Claude-in-Slack configuration of one Slack channel.
+    A Claude Code session was created. A session is one coding interaction with Claude.
 
-    - `type: optional "ccr_channel_manager_added"`
+    - `type: optional "ccr_session_created"`
 
-      default: ccr_channel_manager_added
+      default: ccr_session_created
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -142582,26 +144074,18 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `agent_id: string`
-
-      The channel's Claude agent (cagt_...) the assignment is recorded against.
-
-    - `slack_channel_id: string`
-
-      The Slack channel the member may now manage, e.g. "C01ABC...".
-
-    - `slack_team_id: string`
-
-      The Slack workspace containing the channel, e.g. "T01ABC...".
-
-    - `user_id: string`
+    - `session_id: string`
 
-      Tagged ID of the member who was assigned.
+      The session that was created, e.g. "cse_01HX...".
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
+    - `agent_id: optional string or null`
+
+      The Claude Code agent attached to the session, e.g. "cagt_01HX...". Omitted when the session was created without an agent.
+
     - `created_at: optional string`
 
       When this activity occurred.
@@ -142616,13 +144100,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `CcrChannelManagerRemoved object`
+  - `CcrSessionDeleted object`
 
-    An org owner/admin removed an organization member's assignment to manage the Claude-in-Slack configuration of one Slack channel.
+    A Claude Code session was deleted.
 
-    - `type: optional "ccr_channel_manager_removed"`
+    - `type: optional "ccr_session_deleted"`
 
-      default: ccr_channel_manager_removed
+      default: ccr_session_deleted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -142830,21 +144314,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `agent_id: string`
-
-      The channel's Claude agent (cagt_...) the assignment was recorded against.
-
-    - `slack_channel_id: string`
-
-      The Slack channel the member managed, e.g. "C01ABC...".
-
-    - `slack_team_id: string`
-
-      The Slack workspace containing the channel, e.g. "T01ABC...".
-
-    - `user_id: string`
+    - `session_id: string`
 
-      Tagged ID of the member whose assignment was removed.
+      The session that was deleted, e.g. "cse_01HX...".
 
     - `id: optional string`
 
@@ -142864,13 +144336,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `CcrRoleChannelAssignmentDeleted object`
+  - `CcrSessionUpdated object`
 
-    CcrRoleChannelAssignmentDeleted is emitted when an org owner/admin removes an RBAC role's channel assignment row (the role reverts to granting zero channels).
+    A Claude Code session's settings were updated.
 
-    - `type: optional "ccr_role_channel_assignment_deleted"`
+    - `type: optional "ccr_session_updated"`
 
-      default: ccr_role_channel_assignment_deleted
+      default: ccr_session_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -143078,13 +144550,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `previous_channel_count: number`
-
-      Number of (team, channel) pairs the role was assigned before deletion.
-
-    - `role_id: string`
+    - `session_id: string`
 
-      Tagged ID of the role whose channel assignment was removed.
+      The session that was updated, e.g. "cse_01HX...".
 
     - `id: optional string`
 
@@ -143104,13 +144572,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `CcrRoleChannelAssignmentUpdated object`
+    - `updated_fields: optional array of string`
 
-    CcrRoleChannelAssignmentUpdated is emitted when an org owner/admin sets or replaces the list of Slack channels an RBAC role's holders may configure via the delegated Claude-in-Slack channel-manage surface.
+      Names of the fields included in the update, e.g. "add_tags", "remove_tags".
 
-    - `type: optional "ccr_role_channel_assignment_updated"`
+  - `CcrSlackChannelJoined object`
 
-      default: ccr_role_channel_assignment_updated
+    Claude's Slack app joined a public Slack channel at an organization administrator's request.
+
+    - `type: optional "ccr_slack_channel_joined"`
+
+      default: ccr_slack_channel_joined
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -143318,26 +144790,18 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `channel_count: number`
-
-      Number of channels assigned after the write.
-
-    - `previous_channel_count: number`
+    - `slack_channel_id: string`
 
-      Number of channels assigned before the write.
+      The Slack channel the app joined, e.g. "C01ABC...".
 
-    - `role_id: string`
+    - `slack_team_id: string`
 
-      Tagged ID of the role whose channel assignment was written.
+      The Slack workspace containing the channel, e.g. "T01ABC...".
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `agent_ids: optional array of string`
-
-      The channel-silo agents (cagt_...) assigned after the write. Capped at 100 entries; channel_count carries the uncapped total.
-
     - `created_at: optional string`
 
       When this activity occurred.
@@ -143352,13 +144816,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `CcrSessionCreated object`
+  - `ClaudeChatSettingsUpdated object`
 
-    A Claude Code session was created. A session is one coding interaction with Claude.
+    User updated the settings for a conversation.
 
-    - `type: optional "ccr_session_created"`
+    - `type: optional "claude_chat_settings_updated"`
 
-      default: ccr_session_created
+      default: claude_chat_settings_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -143566,17 +145030,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `session_id: string`
+    - `claude_chat_id: string`
 
-      The session that was created, e.g. "cse_01HX...".
+      Tagged ID of the conversation whose settings were updated, e.g. "claude_chat_01HX...".
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `agent_id: optional string or null`
+    - `claude_project_id: optional string or null`
 
-      The Claude Code agent attached to the session, e.g. "cagt_01HX...". Omitted when the session was created without an agent.
+      Project ID this chat belongs to, if any
 
     - `created_at: optional string`
 
@@ -143592,13 +145056,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `CcrSessionDeleted object`
+  - `ClaudeChatSnapshotCreated object`
 
-    A Claude Code session was deleted.
+    User created/shared a chat snapshot.
 
-    - `type: optional "ccr_session_deleted"`
+    - `type: optional "claude_chat_snapshot_created"`
 
-      default: ccr_session_deleted
+      default: claude_chat_snapshot_created
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -143806,9 +145270,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `session_id: string`
+    - `claude_chat_id: string`
 
-      The session that was deleted, e.g. "cse_01HX...".
+    - `claude_chat_snapshot_id: string`
 
     - `id: optional string`
 
@@ -143828,13 +145292,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `CcrSessionUpdated object`
+  - `ClaudeChatSnapshotDeleted object`
 
-    A Claude Code session's settings were updated.
+    User deleted/unshared a chat snapshot.
 
-    - `type: optional "ccr_session_updated"`
+    - `type: optional "claude_chat_snapshot_deleted"`
 
-      default: ccr_session_updated
+      default: claude_chat_snapshot_deleted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -144042,14 +145506,14 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `session_id: string`
-
-      The session that was updated, e.g. "cse_01HX...".
+    - `claude_chat_snapshot_id: string`
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
+    - `claude_chat_id: optional string or null`
+
     - `created_at: optional string`
 
       When this activity occurred.
@@ -144064,17 +145528,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `updated_fields: optional array of string`
-
-      Names of the fields included in the update, e.g. "add_tags", "remove_tags".
-
-  - `CcrSlackChannelJoined object`
+  - `ClaudeChatSnapshotViewed object`
 
-    Claude's Slack app joined a public Slack channel at an organization administrator's request.
+    User viewed a chat snapshot (authenticated or public/unauthenticated).
 
-    - `type: optional "ccr_slack_channel_joined"`
+    - `type: optional "claude_chat_snapshot_viewed"`
 
-      default: ccr_slack_channel_joined
+      default: claude_chat_snapshot_viewed
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -144282,18 +145742,14 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `slack_channel_id: string`
-
-      The Slack channel the app joined, e.g. "C01ABC...".
-
-    - `slack_team_id: string`
-
-      The Slack workspace containing the channel, e.g. "T01ABC...".
+    - `claude_chat_snapshot_id: string`
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
+    - `claude_chat_id: optional string or null`
+
     - `created_at: optional string`
 
       When this activity occurred.
@@ -144308,13 +145764,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeChatSettingsUpdated object`
+  - `ClaudeArtifactDuplicated object`
 
-    User updated the settings for a conversation.
+    A user duplicated an artifact they could view into a new artifact that they own. The actor is the user who created the copy; the source artifact is not modified.
 
-    - `type: optional "claude_chat_settings_updated"`
+    - `type: optional "claude_artifact_duplicated"`
 
-      default: claude_chat_settings_updated
+      default: claude_artifact_duplicated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -144522,17 +145978,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `claude_chat_id: string`
+    - `claude_artifact_id: string`
 
-      Tagged ID of the conversation whose settings were updated, e.g. "claude_chat_01HX...".
+      Tagged ID of the new artifact created by the duplication. It is owned by the actor and is independent of the source artifact.
 
-    - `id: optional string`
+    - `source_claude_artifact_id: string`
 
-      Unique identifier for the activity e.g. 'activity_abcd1234'
+      Tagged ID of the artifact that was copied.
 
-    - `claude_project_id: optional string or null`
+    - `id: optional string`
 
-      Project ID this chat belongs to, if any
+      Unique identifier for the activity e.g. 'activity_abcd1234'
 
     - `created_at: optional string`
 
@@ -144548,13 +146004,27 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeChatSnapshotCreated object`
+    - `source_claude_artifact_version_id: optional string or null`
 
-    User created/shared a chat snapshot.
+      The version of the source artifact that was copied into the new artifact.
 
-    - `type: optional "claude_chat_snapshot_created"`
+  - `ClaudeArtifactExternalSharingPermissionUpdated object`
 
-      default: claude_chat_snapshot_created
+    An organization admin allowed one artifact to be shared outside the organization by link while the organization-wide external sharing setting was off, or revoked that permission.
+
+    - `type: optional "claude_artifact_external_sharing_permission_updated"`
+
+      default: claude_artifact_external_sharing_permission_updated
+
+    - `action: "allowed" or "revoked" or "unspecified"`
+
+      Whether the permission was allowed or revoked.
+
+      - `"allowed"`
+
+      - `"revoked"`
+
+      - `"unspecified"`
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -144762,9 +146232,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `claude_chat_id: string`
+    - `claude_artifact_id: string`
 
-    - `claude_chat_snapshot_id: string`
+      Tagged ID of the artifact.
 
     - `id: optional string`
 
@@ -144784,13 +146254,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeChatSnapshotDeleted object`
+  - `ClaudeChatAccessFailed object`
 
-    User deleted/unshared a chat snapshot.
+    A user was denied access to a Claude.ai chat conversation.
 
-    - `type: optional "claude_chat_snapshot_deleted"`
+    - `type: optional "claude_chat_access_failed"`
 
-      default: claude_chat_snapshot_deleted
+      default: claude_chat_access_failed
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -144998,14 +146468,14 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `claude_chat_snapshot_id: string`
+    - `claude_chat_id: string`
+
+      The chat conversation the user was denied access to, e.g. "claude_chat_01Ab...".
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `claude_chat_id: optional string or null`
-
     - `created_at: optional string`
 
       When this activity occurred.
@@ -145020,13 +146490,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeChatSnapshotViewed object`
+  - `ClaudeChatCreated object`
 
-    User viewed a chat snapshot (authenticated or public/unauthenticated).
+    User created a chat.
 
-    - `type: optional "claude_chat_snapshot_viewed"`
+    - `type: optional "claude_chat_created"`
 
-      default: claude_chat_snapshot_viewed
+      default: claude_chat_created
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -145234,13 +146704,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `claude_chat_snapshot_id: string`
+    - `claude_chat_id: string`
+
+      Tagged ID of the created conversation, e.g. "claude_chat_01HX...".
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `claude_chat_id: optional string or null`
+    - `claude_project_id: optional string or null`
+
+      Tagged ID of the project the chat was created in, if any, e.g. "claude_proj_01HX...".
 
     - `created_at: optional string`
 
@@ -145256,13 +146730,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeArtifactDuplicated object`
+  - `ClaudeChatDeleted object`
 
-    A user duplicated an artifact they could view into a new artifact that they own. The actor is the user who created the copy; the source artifact is not modified.
+    A user deleted a Claude.ai chat conversation.
 
-    - `type: optional "claude_artifact_duplicated"`
+    - `type: optional "claude_chat_deleted"`
 
-      default: claude_artifact_duplicated
+      default: claude_chat_deleted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -145470,18 +146944,18 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `claude_artifact_id: string`
-
-      Tagged ID of the new artifact created by the duplication. It is owned by the actor and is independent of the source artifact.
-
-    - `source_claude_artifact_id: string`
+    - `claude_chat_id: string`
 
-      Tagged ID of the artifact that was copied.
+      The chat conversation that was deleted, e.g. "claude_chat_01HX...".
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
+    - `claude_project_id: optional string or null`
+
+      The project the chat belonged to, if any, e.g. "claude_proj_01HX...".
+
     - `created_at: optional string`
 
       When this activity occurred.
@@ -145496,27 +146970,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `source_claude_artifact_version_id: optional string or null`
-
-      The version of the source artifact that was copied into the new artifact.
-
-  - `ClaudeArtifactExternalSharingPermissionUpdated object`
-
-    An organization admin allowed one artifact to be shared outside the organization by link while the organization-wide external sharing setting was off, or revoked that permission.
-
-    - `type: optional "claude_artifact_external_sharing_permission_updated"`
-
-      default: claude_artifact_external_sharing_permission_updated
-
-    - `action: "allowed" or "revoked" or "unspecified"`
-
-      Whether the permission was allowed or revoked.
+  - `ClaudeChatDeletionFailed object`
 
-      - `"allowed"`
+    A request to delete a Claude.ai chat conversation failed.
 
-      - `"revoked"`
+    - `type: optional "claude_chat_deletion_failed"`
 
-      - `"unspecified"`
+      default: claude_chat_deletion_failed
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -145724,9 +147184,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `claude_artifact_id: string`
+    - `claude_chat_id: string`
 
-      Tagged ID of the artifact.
+      The chat conversation the user attempted to delete, e.g. "claude_chat_01HX...".
 
     - `id: optional string`
 
@@ -145746,13 +147206,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeChatAccessFailed object`
+  - `ClaudeChatSyncSourceCreated object`
 
-    A user was denied access to a Claude.ai chat conversation.
+    A sync source was connected for syncing external content into Claude chats.
 
-    - `type: optional "claude_chat_access_failed"`
+    - `type: optional "claude_chat_sync_source_created"`
 
-      default: claude_chat_access_failed
+      default: claude_chat_sync_source_created
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -145960,9 +147420,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `claude_chat_id: string`
+    - `claude_chat_sync_source_id: string`
 
-      The chat conversation the user was denied access to, e.g. "claude_chat_01Ab...".
+      Tagged ID of the chat-scoped sync source that was created.
+
+    - `provider: string`
+
+      The external provider backing the sync source, e.g. `github`, `google_drive`, `outline`, `slack`, `salesforce`, `google_calendar`, `gmail`, `asana`, or `mcp_resources`.
 
     - `id: optional string`
 
@@ -145982,13 +147446,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeChatCreated object`
+    - `resource_descriptor: optional string or null`
 
-    User created a chat.
+      A short provider-specific identifier for the external resource that was connected, e.g. `owner/repo` for GitHub or a file ID for Google Drive.
 
-    - `type: optional "claude_chat_created"`
+  - `ClaudeChatSyncSourceDeleted object`
 
-      default: claude_chat_created
+    A sync source was disconnected from Claude chats.
+
+    - `type: optional "claude_chat_sync_source_deleted"`
+
+      default: claude_chat_sync_source_deleted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -146196,17 +147664,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `claude_chat_id: string`
+    - `claude_chat_sync_source_id: string`
 
-      Tagged ID of the created conversation, e.g. "claude_chat_01HX...".
+      Tagged ID of the chat-scoped sync source that was deleted.
 
-    - `id: optional string`
+    - `provider: string`
 
-      Unique identifier for the activity e.g. 'activity_abcd1234'
+      The external provider backing the sync source. Always `unspecified` for deletion events.
 
-    - `claude_project_id: optional string or null`
+    - `id: optional string`
 
-      Tagged ID of the project the chat was created in, if any, e.g. "claude_proj_01HX...".
+      Unique identifier for the activity e.g. 'activity_abcd1234'
 
     - `created_at: optional string`
 
@@ -146222,13 +147690,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeChatDeleted object`
+  - `ClaudeChatSyncSourceUpdated object`
 
-    A user deleted a Claude.ai chat conversation.
+    A Claude chat sync source's configuration was updated.
 
-    - `type: optional "claude_chat_deleted"`
+    - `type: optional "claude_chat_sync_source_updated"`
 
-      default: claude_chat_deleted
+      default: claude_chat_sync_source_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -146436,17 +147904,21 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `claude_chat_id: string`
+    - `claude_chat_sync_source_id: string`
 
-      The chat conversation that was deleted, e.g. "claude_chat_01HX...".
+      Tagged ID of the chat-scoped sync source that was updated.
+
+    - `provider: string`
+
+      The external provider backing the sync source, e.g. `github`, `google_drive`, `outline`, `slack`, `salesforce`, `google_calendar`, `gmail`, `asana`, or `mcp_resources`.
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `claude_project_id: optional string or null`
+    - `config_changed: optional boolean or null`
 
-      The project the chat belonged to, if any, e.g. "claude_proj_01HX...".
+      Whether the update changed the stored sync-source configuration, including sync settings such as path filters. False for a re-sync or a metadata-only refresh of the same resource.
 
     - `created_at: optional string`
 
@@ -146462,13 +147934,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeChatDeletionFailed object`
+    - `resource_descriptor: optional string or null`
 
-    A request to delete a Claude.ai chat conversation failed.
+      A short provider-specific identifier for the external resource after the update, e.g. `owner/repo` for GitHub or a file ID for Google Drive.
 
-    - `type: optional "claude_chat_deletion_failed"`
+  - `ClaudeChatUpdated object`
 
-      default: claude_chat_deletion_failed
+    User updated the chat metadata (e.g name, model).
+
+    - `type: optional "claude_chat_updated"`
+
+      default: claude_chat_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -146678,12 +148154,16 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
     - `claude_chat_id: string`
 
-      The chat conversation the user attempted to delete, e.g. "claude_chat_01HX...".
+      Tagged ID of the updated conversation, e.g. "claude_chat_01HX...".
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
+    - `claude_project_id: optional string or null`
+
+      Tagged ID of the project the chat belongs to, if any, e.g. "claude_proj_01HX...".
+
     - `created_at: optional string`
 
       When this activity occurred.
@@ -146698,13 +148178,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeChatSyncSourceCreated object`
+  - `ClaudeChatViewed object`
 
-    A sync source was connected for syncing external content into Claude chats.
+    A user viewed a Claude.ai chat conversation.
 
-    - `type: optional "claude_chat_sync_source_created"`
+    - `type: optional "claude_chat_viewed"`
 
-      default: claude_chat_sync_source_created
+      default: claude_chat_viewed
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -146912,18 +148392,18 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `claude_chat_sync_source_id: string`
-
-      Tagged ID of the chat-scoped sync source that was created.
-
-    - `provider: string`
+    - `claude_chat_id: string`
 
-      The external provider backing the sync source, e.g. `github`, `google_drive`, `outline`, `slack`, `salesforce`, `google_calendar`, `gmail`, `asana`, or `mcp_resources`.
+      The chat conversation that was viewed, e.g. "claude_chat_01Ab...".
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
+    - `claude_project_id: optional string or null`
+
+      The project the chat belongs to, if any, e.g. "claude_proj_01Ab...".
+
     - `created_at: optional string`
 
       When this activity occurred.
@@ -146938,17 +148418,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `resource_descriptor: optional string or null`
-
-      A short provider-specific identifier for the external resource that was connected, e.g. `owner/repo` for GitHub or a file ID for Google Drive.
-
-  - `ClaudeChatSyncSourceDeleted object`
+  - `ClaudeCodeCredentialRevoked object`
 
-    A sync source was disconnected from Claude chats.
+    A Claude Code credential (runner pool key, runner token, or session token) was revoked. The credential itself is never recorded.
 
-    - `type: optional "claude_chat_sync_source_deleted"`
+    - `type: optional "claude_code_credential_revoked"`
 
-      default: claude_chat_sync_source_deleted
+      default: claude_code_credential_revoked
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -147156,24 +148632,40 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `claude_chat_sync_source_id: string`
+    - `credential_type: "runner_pool_key" or "runner_token" or "session_token" or "unspecified"`
 
-      Tagged ID of the chat-scoped sync source that was deleted.
+      The kind of credential the revoked target identifies, when known. Subject-targeted revocations cascade to every credential delegated from the target regardless of kind; this field describes the target itself, not the full set of credentials the cascade reached. For a revocation submitted as a pasted credential the kind is best-effort and may be inaccurate; the recorded jti and the revocation itself are unaffected.
 
-    - `provider: string`
+      - `"runner_pool_key"`
 
-      The external provider backing the sync source. Always `unspecified` for deletion events.
+      - `"runner_token"`
+
+      - `"session_token"`
+
+      - `"unspecified"`
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
+    - `agent_id: optional string or null`
+
+      The agent identity whose Claude Code credentials were revoked, when revocation targeted every session created by an agent identity, e.g. "cagt_01HX...".
+
     - `created_at: optional string`
 
       When this activity occurred.
 
       format: date-time
 
+    - `delegating_jti: optional string or null`
+
+      The credential identifier whose delegated credentials were revoked (a chain revoke): every credential delegated from this one was revoked, but the credential itself was not. Distinct from `jti`, which records a revocation of the credential itself and its delegates.
+
+    - `jti: optional string or null`
+
+      The unique identifier of the revoked credential, recorded in its canonical form. Revoking a runner pool key also revokes every runner and session token delegated from it. A revocation submitted as a pasted credential is recorded by that credential's identifier.
+
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -147182,13 +148674,29 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeChatSyncSourceUpdated object`
+    - `runner_id: optional string or null`
 
-    A Claude chat sync source's configuration was updated.
+      The runner whose credentials were revoked, when revocation targeted every credential delegated from the runner, e.g. "ccrunner_01HX...".
 
-    - `type: optional "claude_chat_sync_source_updated"`
+    - `runner_pool_id: optional string or null`
 
-      default: claude_chat_sync_source_updated
+      The runner pool whose credentials were revoked, when revocation targeted every credential delegated from the pool, e.g. "ccpool_01HX...".
+
+    - `session_id: optional string or null`
+
+      The session whose credentials were revoked, when revocation targeted every credential delegated from the session, e.g. "cse_01HX...".
+
+    - `user_id: optional string or null`
+
+      The user whose Claude Code credentials were revoked, when revocation targeted every credential minted for a user. Carries the user's tagged account ID, e.g. "user_01HX..." — the only form the revocation API accepts, so the field joins against other activities' account identifiers and never carries an email.
+
+  - `ClaudeCodeReviewConfigUpdated object`
+
+    Claude Code Review configuration was enabled/disabled for an org.
+
+    - `type: optional "claude_code_review_config_updated"`
+
+      default: claude_code_review_config_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -147396,28 +148904,28 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `claude_chat_sync_source_id: string`
-
-      Tagged ID of the chat-scoped sync source that was updated.
-
-    - `provider: string`
+    - `enabled: boolean`
 
-      The external provider backing the sync source, e.g. `github`, `google_drive`, `outline`, `slack`, `salesforce`, `google_calendar`, `gmail`, `asana`, or `mcp_resources`.
+      Whether code review is now enabled
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `config_changed: optional boolean or null`
-
-      Whether the update changed the stored sync-source configuration, including sync settings such as path filters. False for a re-sync or a metadata-only refresh of the same resource.
-
     - `created_at: optional string`
 
       When this activity occurred.
 
       format: date-time
 
+    - `environment_id: optional string or null`
+
+      Environment used for code review
+
+    - `model: optional string or null`
+
+      Model configured for code review
+
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -147426,17 +148934,49 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `resource_descriptor: optional string or null`
+    - `per_review_limit_usd: optional string or null`
 
-      A short provider-specific identifier for the external resource after the update, e.g. `owner/repo` for GitHub or a file ID for Google Drive.
+      Per-review spend limit in USD
 
-  - `ClaudeChatUpdated object`
+    - `previous_enabled: optional boolean or null`
 
-    User updated the chat metadata (e.g name, model).
+      Whether code review was enabled before the change. Absent when no configuration existed before this update.
 
-    - `type: optional "claude_chat_updated"`
+    - `previous_environment_id: optional string or null`
 
-      default: claude_chat_updated
+      Environment used for code review before the change. Absent when no configuration existed before this update or no environment was set.
+
+    - `previous_model: optional string or null`
+
+      Model configured for code review before the change. Absent when no configuration existed before this update or no model was set.
+
+    - `previous_per_review_limit_usd: optional string or null`
+
+      Per-review spend limit in USD before the change. Absent when no configuration existed before this update or no limit was set.
+
+    - `previous_show_tips: optional boolean or null`
+
+      Whether tip-style pull-request comments were enabled before the change. Absent when no configuration existed before this update.
+
+    - `previous_verification_enabled: optional boolean or null`
+
+      Whether the verification stage of code review was enabled for the organization before the change. Absent when no configuration existed before this update or no preference was set.
+
+    - `show_tips: optional boolean or null`
+
+      Whether tip-style pull-request comments are now enabled
+
+    - `verification_enabled: optional boolean or null`
+
+      Whether the verification stage of code review is now enabled for the organization. Absent when the organization has not set a preference and the default applies.
+
+  - `ClaudeCodeReviewRepositoryAdded object`
+
+    A repository was added to org-level Claude Code Review configuration.
+
+    - `type: optional "claude_code_review_repository_added"`
+
+      default: claude_code_review_repository_added
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -147644,17 +149184,25 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `claude_chat_id: string`
+    - `config_id: string`
 
-      Tagged ID of the updated conversation, e.g. "claude_chat_01HX...".
+      ID of the repository configuration
 
-    - `id: optional string`
+    - `repo_name: string`
 
-      Unique identifier for the activity e.g. 'activity_abcd1234'
+      Repository name
 
-    - `claude_project_id: optional string or null`
+    - `repo_owner: string`
 
-      Tagged ID of the project the chat belongs to, if any, e.g. "claude_proj_01HX...".
+      Repository owner (GitHub org/user)
+
+    - `trigger_mode: string`
+
+      When code review is triggered
+
+    - `id: optional string`
+
+      Unique identifier for the activity e.g. 'activity_abcd1234'
 
     - `created_at: optional string`
 
@@ -147670,13 +149218,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeChatViewed object`
+  - `ClaudeCodeReviewRepositoryRemoved object`
 
-    A user viewed a Claude.ai chat conversation.
+    A repository was removed from org-level Claude Code Review configuration.
 
-    - `type: optional "claude_chat_viewed"`
+    - `type: optional "claude_code_review_repository_removed"`
 
-      default: claude_chat_viewed
+      default: claude_code_review_repository_removed
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -147884,17 +149432,21 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `claude_chat_id: string`
+    - `config_id: string`
 
-      The chat conversation that was viewed, e.g. "claude_chat_01Ab...".
+      ID of the deleted repository configuration
 
-    - `id: optional string`
+    - `repo_name: string`
 
-      Unique identifier for the activity e.g. 'activity_abcd1234'
+      Repository name at deletion time
 
-    - `claude_project_id: optional string or null`
+    - `repo_owner: string`
 
-      The project the chat belongs to, if any, e.g. "claude_proj_01Ab...".
+      Repository owner at deletion time
+
+    - `id: optional string`
+
+      Unique identifier for the activity e.g. 'activity_abcd1234'
 
     - `created_at: optional string`
 
@@ -147910,13 +149462,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeCodeCredentialRevoked object`
+  - `ClaudeCodeReviewRepositoryUpdated object`
 
-    A Claude Code credential (runner pool key, runner token, or session token) was revoked. The credential itself is never recorded.
+    A Claude Code Review repository configuration was updated.
 
-    - `type: optional "claude_code_credential_revoked"`
+    - `type: optional "claude_code_review_repository_updated"`
 
-      default: claude_code_credential_revoked
+      default: claude_code_review_repository_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -148124,40 +149676,28 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `credential_type: "runner_pool_key" or "runner_token" or "session_token" or "unspecified"`
+    - `config_id: string`
 
-      The kind of credential the revoked target identifies, when known. Subject-targeted revocations cascade to every credential delegated from the target regardless of kind; this field describes the target itself, not the full set of credentials the cascade reached. For a revocation submitted as a pasted credential the kind is best-effort and may be inaccurate; the recorded jti and the revocation itself are unaffected.
+      ID of the repository configuration
 
-      - `"runner_pool_key"`
+    - `repo_name: string`
 
-      - `"runner_token"`
+      Repository name
 
-      - `"session_token"`
+    - `repo_owner: string`
 
-      - `"unspecified"`
+      Repository owner
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `agent_id: optional string or null`
-
-      The agent identity whose Claude Code credentials were revoked, when revocation targeted every session created by an agent identity, e.g. "cagt_01HX...".
-
     - `created_at: optional string`
 
       When this activity occurred.
 
       format: date-time
 
-    - `delegating_jti: optional string or null`
-
-      The credential identifier whose delegated credentials were revoked (a chain revoke): every credential delegated from this one was revoked, but the credential itself was not. Distinct from `jti`, which records a revocation of the credential itself and its delegates.
-
-    - `jti: optional string or null`
-
-      The unique identifier of the revoked credential, recorded in its canonical form. Revoking a runner pool key also revokes every runner and session token delegated from it. A revocation submitted as a pasted credential is recorded by that credential's identifier.
-
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -148166,29 +149706,21 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `runner_id: optional string or null`
-
-      The runner whose credentials were revoked, when revocation targeted every credential delegated from the runner, e.g. "ccrunner_01HX...".
-
-    - `runner_pool_id: optional string or null`
-
-      The runner pool whose credentials were revoked, when revocation targeted every credential delegated from the pool, e.g. "ccpool_01HX...".
-
-    - `session_id: optional string or null`
+    - `status: optional string or null`
 
-      The session whose credentials were revoked, when revocation targeted every credential delegated from the session, e.g. "cse_01HX...".
+      Updated status (ACTIVE/INACTIVE)
 
-    - `user_id: optional string or null`
+    - `trigger_mode: optional string or null`
 
-      The user whose Claude Code credentials were revoked, when revocation targeted every credential minted for a user. Carries the user's tagged account ID, e.g. "user_01HX..." — the only form the revocation API accepts, so the field joins against other activities' account identifiers and never carries an email.
+      Updated trigger mode
 
-  - `ClaudeCodeReviewConfigUpdated object`
+  - `ClaudeCodeRunnerDeleted object`
 
-    Claude Code Review configuration was enabled/disabled for an org.
+    A self-hosted runner was forcibly removed from its pool. Sessions assigned to the runner were returned to the pool queue, unless a session had already been requeued repeatedly, in which case it was marked stuck instead of being requeued again.
 
-    - `type: optional "claude_code_review_config_updated"`
+    - `type: optional "claude_code_runner_deleted"`
 
-      default: claude_code_review_config_updated
+      default: claude_code_runner_deleted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -148396,9 +149928,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `enabled: boolean`
+    - `runner_id: string`
 
-      Whether code review is now enabled
+      The runner that was removed, e.g. "ccrunner_01HX...".
 
     - `id: optional string`
 
@@ -148410,14 +149942,6 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
-    - `environment_id: optional string or null`
-
-      Environment used for code review
-
-    - `model: optional string or null`
-
-      Model configured for code review
-
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -148426,49 +149950,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `per_review_limit_usd: optional string or null`
-
-      Per-review spend limit in USD
-
-    - `previous_enabled: optional boolean or null`
-
-      Whether code review was enabled before the change. Absent when no configuration existed before this update.
-
-    - `previous_environment_id: optional string or null`
-
-      Environment used for code review before the change. Absent when no configuration existed before this update or no environment was set.
-
-    - `previous_model: optional string or null`
-
-      Model configured for code review before the change. Absent when no configuration existed before this update or no model was set.
-
-    - `previous_per_review_limit_usd: optional string or null`
-
-      Per-review spend limit in USD before the change. Absent when no configuration existed before this update or no limit was set.
-
-    - `previous_show_tips: optional boolean or null`
-
-      Whether tip-style pull-request comments were enabled before the change. Absent when no configuration existed before this update.
-
-    - `previous_verification_enabled: optional boolean or null`
-
-      Whether the verification stage of code review was enabled for the organization before the change. Absent when no configuration existed before this update or no preference was set.
-
-    - `show_tips: optional boolean or null`
-
-      Whether tip-style pull-request comments are now enabled
-
-    - `verification_enabled: optional boolean or null`
+    - `runner_pool_id: optional string or null`
 
-      Whether the verification stage of code review is now enabled for the organization. Absent when the organization has not set a preference and the default applies.
+      The pool the runner was removed from, e.g. "ccpool_01HX...".
 
-  - `ClaudeCodeReviewRepositoryAdded object`
+  - `ClaudeCodeRunnerPoolCreated object`
 
-    A repository was added to org-level Claude Code Review configuration.
+    A self-hosted runner pool for Claude Code was created.
 
-    - `type: optional "claude_code_review_repository_added"`
+    - `type: optional "claude_code_runner_pool_created"`
 
-      default: claude_code_review_repository_added
+      default: claude_code_runner_pool_created
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -148676,21 +150168,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `config_id: string`
-
-      ID of the repository configuration
-
-    - `repo_name: string`
-
-      Repository name
-
-    - `repo_owner: string`
+    - `display_name: string`
 
-      Repository owner (GitHub org/user)
+      The display name the pool was created with.
 
-    - `trigger_mode: string`
+    - `runner_pool_id: string`
 
-      When code review is triggered
+      The runner pool that was created, e.g. "ccpool_01HX...".
 
     - `id: optional string`
 
@@ -148710,13 +150194,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeCodeReviewRepositoryRemoved object`
+  - `ClaudeCodeRunnerPoolDeleted object`
 
-    A repository was removed from org-level Claude Code Review configuration.
+    A self-hosted runner pool was deleted.
 
-    - `type: optional "claude_code_review_repository_removed"`
+    - `type: optional "claude_code_runner_pool_deleted"`
 
-      default: claude_code_review_repository_removed
+      default: claude_code_runner_pool_deleted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -148924,17 +150408,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `config_id: string`
-
-      ID of the deleted repository configuration
-
-    - `repo_name: string`
-
-      Repository name at deletion time
-
-    - `repo_owner: string`
+    - `runner_pool_id: string`
 
-      Repository owner at deletion time
+      The runner pool that was deleted, e.g. "ccpool_01HX...".
 
     - `id: optional string`
 
@@ -148946,6 +150422,10 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
+    - `display_name: optional string or null`
+
+      The pool's display name at deletion time.
+
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -148954,13 +150434,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeCodeReviewRepositoryUpdated object`
+  - `ClaudeCodeRunnerPoolSecretMinted object`
 
-    A Claude Code Review repository configuration was updated.
+    A registration key for a self-hosted runner pool was minted. Runners present this key to join the pool. The key itself is never recorded.
 
-    - `type: optional "claude_code_review_repository_updated"`
+    - `type: optional "claude_code_runner_pool_secret_minted"`
 
-      default: claude_code_review_repository_updated
+      default: claude_code_runner_pool_secret_minted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -149168,17 +150648,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `config_id: string`
-
-      ID of the repository configuration
-
-    - `repo_name: string`
+    - `jti: string`
 
-      Repository name
+      The minted key's unique identifier (its JWT `jti` claim), usable to revoke that key later.
 
-    - `repo_owner: string`
+    - `runner_pool_id: string`
 
-      Repository owner
+      The runner pool the key was minted for, e.g. "ccpool_01HX...".
 
     - `id: optional string`
 
@@ -149190,6 +150666,16 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
+    - `expires_at: optional string or null`
+
+      When the minted key expires.
+
+      format: date-time
+
+    - `label: optional string or null`
+
+      The label the key was minted with. The key minted automatically when a pool is created carries the label "Initial key".
+
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -149198,21 +150684,25 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `status: optional string or null`
+  - `ClaudeCodeRunnerPoolSessionQueueUpdated object`
 
-      Updated status (ACTIVE/INACTIVE)
+    An admin changed a session's position in its self-hosted runner pool's queue: requeued it onto a different runner, dismissed it from the queue, or re-admitted it for another runner provisioning attempt.
 
-    - `trigger_mode: optional string or null`
+    - `type: optional "claude_code_runner_pool_session_queue_updated"`
 
-      Updated trigger mode
+      default: claude_code_runner_pool_session_queue_updated
 
-  - `ClaudeCodeRunnerDeleted object`
+    - `action: "dismissed" or "provisioning_retried" or "requeued" or "unspecified"`
 
-    A self-hosted runner was forcibly removed from its pool. Sessions assigned to the runner were returned to the pool queue, unless a session had already been requeued repeatedly, in which case it was marked stuck instead of being requeued again.
+      What changed about the session's queue state.
 
-    - `type: optional "claude_code_runner_deleted"`
+      - `"dismissed"`
 
-      default: claude_code_runner_deleted
+      - `"provisioning_retried"`
+
+      - `"requeued"`
+
+      - `"unspecified"`
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -149420,9 +150910,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `runner_id: string`
+    - `session_id: string`
 
-      The runner that was removed, e.g. "ccrunner_01HX...".
+      The session whose queue state changed, e.g. "cse_01HX...".
 
     - `id: optional string`
 
@@ -149434,6 +150924,10 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
+    - `excluded_runner_id: optional string or null`
+
+      The runner the session was moved off, when action is "requeued", e.g. "ccrunner_01HX...".
+
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -149444,15 +150938,15 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
     - `runner_pool_id: optional string or null`
 
-      The pool the runner was removed from, e.g. "ccpool_01HX...".
+      The runner pool whose queue the session is in, when known, e.g. "ccpool_01HX...".
 
-  - `ClaudeCodeRunnerPoolCreated object`
+  - `ClaudeCodeRunnerPoolUpdated object`
 
-    A self-hosted runner pool for Claude Code was created.
+    A self-hosted runner pool's settings were updated.
 
-    - `type: optional "claude_code_runner_pool_created"`
+    - `type: optional "claude_code_runner_pool_updated"`
 
-      default: claude_code_runner_pool_created
+      default: claude_code_runner_pool_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -149662,11 +151156,11 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
     - `display_name: string`
 
-      The display name the pool was created with.
+      The pool's display name after the update.
 
     - `runner_pool_id: string`
 
-      The runner pool that was created, e.g. "ccpool_01HX...".
+      The runner pool that was updated, e.g. "ccpool_01HX...".
 
     - `id: optional string`
 
@@ -149686,13 +151180,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeCodeRunnerPoolDeleted object`
+    - `previous_display_name: optional string or null`
 
-    A self-hosted runner pool was deleted.
+      The pool's display name before the update. Absent when the name was unchanged or the previous value was unavailable.
 
-    - `type: optional "claude_code_runner_pool_deleted"`
+  - `ClaudeCodeSecurityCenterConfigUpdated object`
 
-      default: claude_code_runner_pool_deleted
+    Claude Code Security Center scanning was enabled/disabled for an org.
+
+    - `type: optional "claude_code_security_center_config_updated"`
+
+      default: claude_code_security_center_config_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -149900,9 +151398,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `runner_pool_id: string`
+    - `enabled: boolean`
 
-      The runner pool that was deleted, e.g. "ccpool_01HX...".
+      Whether Security Center is now enabled
 
     - `id: optional string`
 
@@ -149914,9 +151412,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
-    - `display_name: optional string or null`
+    - `environment_id: optional string or null`
 
-      The pool's display name at deletion time.
+      Environment used for security scanning
 
     - `organization_id: optional string or null`
 
@@ -149926,13 +151424,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeCodeRunnerPoolSecretMinted object`
+  - `ClaudeCodeSecurityScanCancelled object`
 
-    A registration key for a self-hosted runner pool was minted. Runners present this key to join the pool. The key itself is never recorded.
+    In-flight Claude Code Security scans were cancelled for a project.
 
-    - `type: optional "claude_code_runner_pool_secret_minted"`
+    - `type: optional "claude_code_security_scan_cancelled"`
 
-      default: claude_code_runner_pool_secret_minted
+      default: claude_code_security_scan_cancelled
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -150140,13 +151638,11 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `jti: string`
-
-      The minted key's unique identifier (its JWT `jti` claim), usable to revoke that key later.
+    - `scan_project_id: string`
 
-    - `runner_pool_id: string`
+      Tagged ID of the scan project
 
-      The runner pool the key was minted for, e.g. "ccpool_01HX...".
+    - `scans_cancelled: number`
 
     - `id: optional string`
 
@@ -150158,16 +151654,6 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
-    - `expires_at: optional string or null`
-
-      When the minted key expires.
-
-      format: date-time
-
-    - `label: optional string or null`
-
-      The label the key was minted with. The key minted automatically when a pool is created carries the label "Initial key".
-
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -150176,25 +151662,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeCodeRunnerPoolSessionQueueUpdated object`
-
-    An admin changed a session's position in its self-hosted runner pool's queue: requeued it onto a different runner, dismissed it from the queue, or re-admitted it for another runner provisioning attempt.
-
-    - `type: optional "claude_code_runner_pool_session_queue_updated"`
-
-      default: claude_code_runner_pool_session_queue_updated
-
-    - `action: "dismissed" or "provisioning_retried" or "requeued" or "unspecified"`
-
-      What changed about the session's queue state.
-
-      - `"dismissed"`
+  - `ClaudeCodeSecurityScanCreated object`
 
-      - `"provisioning_retried"`
+    A Claude Code Security scan was started.
 
-      - `"requeued"`
+    - `type: optional "claude_code_security_scan_created"`
 
-      - `"unspecified"`
+      default: claude_code_security_scan_created
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -150402,9 +151876,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `session_id: string`
+    - `scan_id: string`
 
-      The session whose queue state changed, e.g. "cse_01HX...".
+      Tagged ID of the created scan
+
+    - `scan_project_id: string`
+
+      Tagged ID of the scan project the scan belongs to
 
     - `id: optional string`
 
@@ -150416,10 +151894,6 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
-    - `excluded_runner_id: optional string or null`
-
-      The runner the session was moved off, when action is "requeued", e.g. "ccrunner_01HX...".
-
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -150428,17 +151902,25 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `runner_pool_id: optional string or null`
+  - `ClaudeCodeSecurityScanProjectMemberUpdated object`
 
-      The runner pool whose queue the session is in, when known, e.g. "ccpool_01HX...".
+    A person's access to a Claude Code Security scan project was granted, changed, or revoked.
 
-  - `ClaudeCodeRunnerPoolUpdated object`
+    - `type: optional "claude_code_security_scan_project_member_updated"`
 
-    A self-hosted runner pool's settings were updated.
+      default: claude_code_security_scan_project_member_updated
 
-    - `type: optional "claude_code_runner_pool_updated"`
+    - `action: "member_added" or "member_removed" or "member_role_changed" or "unspecified"`
 
-      default: claude_code_runner_pool_updated
+      Whether the member was granted access, had their role changed, or was revoked
+
+      - `"member_added"`
+
+      - `"member_removed"`
+
+      - `"member_role_changed"`
+
+      - `"unspecified"`
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -150646,18 +152128,32 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `display_name: string`
+    - `member_id: string`
 
-      The pool's display name after the update.
+      Tagged ID of the member whose access changed
 
-    - `runner_pool_id: string`
+    - `scan_project_id: string`
 
-      The runner pool that was updated, e.g. "ccpool_01HX...".
+      Tagged ID of the scan project
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
+    - `access_via: optional "member" or "organization_admin" or "organization_share" or 2 more or null`
+
+      How the actor was authorized to make this change: "owner" (the scan project's owner), "member" (an individually added member), "organization_share" (the project is shared with the actor's organization), or "organization_admin" (an administrator of the organization's security scanning). Absent when no project relationship was involved (for example, an automated change); events recorded before this field was introduced omit it.
+
+      - `"member"`
+
+      - `"organization_admin"`
+
+      - `"organization_share"`
+
+      - `"owner"`
+
+      - `"unspecified"`
+
     - `created_at: optional string`
 
       When this activity occurred.
@@ -150672,17 +152168,33 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `previous_display_name: optional string or null`
+    - `role: optional string or null`
 
-      The pool's display name before the update. Absent when the name was unchanged or the previous value was unavailable.
+      Role granted to the member (full, view_triage, or view); omitted for revocations
 
-  - `ClaudeCodeSecurityCenterConfigUpdated object`
+  - `ClaudeCodeSecurityScanProjectUpdated object`
 
-    Claude Code Security Center scanning was enabled/disabled for an org.
+    A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience.
 
-    - `type: optional "claude_code_security_center_config_updated"`
+    - `type: optional "claude_code_security_scan_project_updated"`
 
-      default: claude_code_security_center_config_updated
+      default: claude_code_security_scan_project_updated
+
+    - `action: "archived" or "created" or "migrated" or 3 more`
+
+      The state change applied to the scan project.
+
+      - `"archived"`
+
+      - `"created"`
+
+      - `"migrated"`
+
+      - `"resumed"`
+
+      - `"unarchived"`
+
+      - `"unspecified"`
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -150890,24 +152402,34 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `enabled: boolean`
+    - `scan_project_id: string`
 
-      Whether Security Center is now enabled
+      Tagged ID of the scan project
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
+    - `access_via: optional "member" or "organization_admin" or "organization_share" or 2 more or null`
+
+      How the actor was authorized to make this change: "owner" (the scan project's owner), "member" (an individually added member), "organization_share" (the project is shared with the actor's organization), or "organization_admin" (an administrator of the organization's security scanning). Absent when no project relationship was involved (the project's creation, or an automated change); events recorded before this field was introduced omit it.
+
+      - `"member"`
+
+      - `"organization_admin"`
+
+      - `"organization_share"`
+
+      - `"owner"`
+
+      - `"unspecified"`
+
     - `created_at: optional string`
 
       When this activity occurred.
 
       format: date-time
 
-    - `environment_id: optional string or null`
-
-      Environment used for security scanning
-
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -150916,13 +152438,23 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeCodeSecurityScanCancelled object`
+  - `ClaudeCodeSecurityScanProjectVisibilityUpdated object`
 
-    In-flight Claude Code Security scans were cancelled for a project.
+    A Claude Code Security scan project was shared with the organization or made private.
 
-    - `type: optional "claude_code_security_scan_cancelled"`
+    - `type: optional "claude_code_security_scan_project_visibility_updated"`
 
-      default: claude_code_security_scan_cancelled
+      default: claude_code_security_scan_project_visibility_updated
+
+    - `action: "shared" or "unshared" or "unspecified"`
+
+      Whether the project was shared with the organization or made private
+
+      - `"shared"`
+
+      - `"unshared"`
+
+      - `"unspecified"`
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -151134,12 +152666,28 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Tagged ID of the scan project
 
-    - `scans_cancelled: number`
-
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
+    - `access_level: optional string or null`
+
+      Access level granted to organization members (read_only or full); only set when shared
+
+    - `access_via: optional "member" or "organization_admin" or "organization_share" or 2 more or null`
+
+      How the actor was authorized to make this change: "owner" (the scan project's owner), "member" (an individually added member), "organization_share" (the project is shared with the actor's organization), or "organization_admin" (an administrator of the organization's security scanning). Absent when no project relationship was involved (for example, an automated change); events recorded before this field was introduced omit it.
+
+      - `"member"`
+
+      - `"organization_admin"`
+
+      - `"organization_share"`
+
+      - `"owner"`
+
+      - `"unspecified"`
+
     - `created_at: optional string`
 
       When this activity occurred.
@@ -151154,13 +152702,29 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeCodeSecurityScanCreated object`
+  - `ClaudeCodeSecurityScanRunUpdated object`
 
-    A Claude Code Security scan was started.
+    A single Claude Code Security scan run was archived, unarchived, or resumed after a billing pause.
 
-    - `type: optional "claude_code_security_scan_created"`
+    - `type: optional "claude_code_security_scan_run_updated"`
 
-      default: claude_code_security_scan_created
+      default: claude_code_security_scan_run_updated
+
+    - `action: "archived" or "created" or "migrated" or 3 more`
+
+      The state change applied to the scan run
+
+      - `"archived"`
+
+      - `"created"`
+
+      - `"migrated"`
+
+      - `"resumed"`
+
+      - `"unarchived"`
+
+      - `"unspecified"`
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -151370,11 +152934,7 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
     - `scan_id: string`
 
-      Tagged ID of the created scan
-
-    - `scan_project_id: string`
-
-      Tagged ID of the scan project the scan belongs to
+      Tagged ID of the scan the request named — for archive/unarchive any scan in the run, not necessarily its canonical (run_index=0) scan; for resume, the paused scan
 
     - `id: optional string`
 
@@ -151394,25 +152954,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeCodeSecurityScanProjectMemberUpdated object`
-
-    A person's access to a Claude Code Security scan project was granted, changed, or revoked.
-
-    - `type: optional "claude_code_security_scan_project_member_updated"`
-
-      default: claude_code_security_scan_project_member_updated
-
-    - `action: "member_added" or "member_removed" or "member_role_changed" or "unspecified"`
-
-      Whether the member was granted access, had their role changed, or was revoked
-
-      - `"member_added"`
+  - `ClaudeCodeSecurityScanScheduleDeleted object`
 
-      - `"member_removed"`
+    A recurring scan schedule was deleted for a Claude Code Security project.
 
-      - `"member_role_changed"`
+    - `type: optional "claude_code_security_scan_schedule_deleted"`
 
-      - `"unspecified"`
+      default: claude_code_security_scan_schedule_deleted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -151620,10 +153168,6 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `member_id: string`
-
-      Tagged ID of the member whose access changed
-
     - `scan_project_id: string`
 
       Tagged ID of the scan project
@@ -151632,20 +153176,6 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `access_via: optional "member" or "organization_admin" or "organization_share" or 2 more or null`
-
-      How the actor was authorized to make this change: "owner" (the scan project's owner), "member" (an individually added member), "organization_share" (the project is shared with the actor's organization), or "organization_admin" (an administrator of the organization's security scanning). Absent when no project relationship was involved (for example, an automated change); events recorded before this field was introduced omit it.
-
-      - `"member"`
-
-      - `"organization_admin"`
-
-      - `"organization_share"`
-
-      - `"owner"`
-
-      - `"unspecified"`
-
     - `created_at: optional string`
 
       When this activity occurred.
@@ -151660,33 +153190,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `role: optional string or null`
-
-      Role granted to the member (full, view_triage, or view); omitted for revocations
-
-  - `ClaudeCodeSecurityScanProjectUpdated object`
-
-    A Claude Code Security scan project was archived, unarchived, created, or migrated to a new product experience.
-
-    - `type: optional "claude_code_security_scan_project_updated"`
-
-      default: claude_code_security_scan_project_updated
-
-    - `action: "archived" or "created" or "migrated" or 3 more`
-
-      The state change applied to the scan project.
-
-      - `"archived"`
-
-      - `"created"`
-
-      - `"migrated"`
+  - `ClaudeCodeSecurityScanScheduleUpdated object`
 
-      - `"resumed"`
+    A recurring scan schedule was set or replaced for a Claude Code Security project.
 
-      - `"unarchived"`
+    - `type: optional "claude_code_security_scan_schedule_updated"`
 
-      - `"unspecified"`
+      default: claude_code_security_scan_schedule_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -151894,6 +153404,8 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
+    - `cadence: string`
+
     - `scan_project_id: string`
 
       Tagged ID of the scan project
@@ -151902,20 +153414,6 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `access_via: optional "member" or "organization_admin" or "organization_share" or 2 more or null`
-
-      How the actor was authorized to make this change: "owner" (the scan project's owner), "member" (an individually added member), "organization_share" (the project is shared with the actor's organization), or "organization_admin" (an administrator of the organization's security scanning). Absent when no project relationship was involved (the project's creation, or an automated change); events recorded before this field was introduced omit it.
-
-      - `"member"`
-
-      - `"organization_admin"`
-
-      - `"organization_share"`
-
-      - `"owner"`
-
-      - `"unspecified"`
-
     - `created_at: optional string`
 
       When this activity occurred.
@@ -151930,23 +153428,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeCodeSecurityScanProjectVisibilityUpdated object`
-
-    A Claude Code Security scan project was shared with the organization or made private.
-
-    - `type: optional "claude_code_security_scan_project_visibility_updated"`
-
-      default: claude_code_security_scan_project_visibility_updated
-
-    - `action: "shared" or "unshared" or "unspecified"`
-
-      Whether the project was shared with the organization or made private
+  - `ClaudeCodeSecurityVulnerabilityDeleted object`
 
-      - `"shared"`
+    A Claude Code Security vulnerability finding was permanently deleted.
 
-      - `"unshared"`
+    - `type: optional "claude_code_security_vulnerability_deleted"`
 
-      - `"unspecified"`
+      default: claude_code_security_vulnerability_deleted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -152154,31 +153642,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `scan_project_id: string`
-
-      Tagged ID of the scan project
-
-    - `id: optional string`
-
-      Unique identifier for the activity e.g. 'activity_abcd1234'
-
-    - `access_level: optional string or null`
-
-      Access level granted to organization members (read_only or full); only set when shared
-
-    - `access_via: optional "member" or "organization_admin" or "organization_share" or 2 more or null`
-
-      How the actor was authorized to make this change: "owner" (the scan project's owner), "member" (an individually added member), "organization_share" (the project is shared with the actor's organization), or "organization_admin" (an administrator of the organization's security scanning). Absent when no project relationship was involved (for example, an automated change); events recorded before this field was introduced omit it.
+    - `scan_id: string`
 
-      - `"member"`
+      Tagged ID of the scan the finding belonged to
 
-      - `"organization_admin"`
+    - `vulnerability_id: number`
 
-      - `"organization_share"`
+      Numeric ID of the deleted finding, as shown in the product
 
-      - `"owner"`
+    - `id: optional string`
 
-      - `"unspecified"`
+      Unique identifier for the activity e.g. 'activity_abcd1234'
 
     - `created_at: optional string`
 
@@ -152194,29 +153668,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeCodeSecurityScanRunUpdated object`
-
-    A single Claude Code Security scan run was archived, unarchived, or resumed after a billing pause.
-
-    - `type: optional "claude_code_security_scan_run_updated"`
-
-      default: claude_code_security_scan_run_updated
-
-    - `action: "archived" or "created" or "migrated" or 3 more`
-
-      The state change applied to the scan run
-
-      - `"archived"`
-
-      - `"created"`
-
-      - `"migrated"`
+  - `ClaudeCodeSecurityVulnerabilityFixSessionCreated object`
 
-      - `"resumed"`
+    A Claude Code remediation session was created for a Claude Code Security vulnerability finding.
 
-      - `"unarchived"`
+    - `type: optional "claude_code_security_vulnerability_fix_session_created"`
 
-      - `"unspecified"`
+      default: claude_code_security_vulnerability_fix_session_created
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -152426,12 +153884,30 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
     - `scan_id: string`
 
-      Tagged ID of the scan the request named — for archive/unarchive any scan in the run, not necessarily its canonical (run_index=0) scan; for resume, the paused scan
+      Tagged ID of the scan the finding belongs to
+
+    - `session_id: string`
+
+      ID of the created remediation session
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
+    - `access_via: optional "member" or "organization_admin" or "organization_share" or 2 more or null`
+
+      How the actor was authorized to make this change: "owner" (the scan project's owner), "member" (an individually added member), "organization_share" (the project is shared with the actor's organization), or "organization_admin" (an administrator of the organization's security scanning). Absent when no project relationship was involved; events recorded before this field was introduced omit it.
+
+      - `"member"`
+
+      - `"organization_admin"`
+
+      - `"organization_share"`
+
+      - `"owner"`
+
+      - `"unspecified"`
+
     - `created_at: optional string`
 
       When this activity occurred.
@@ -152446,13 +153922,27 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeCodeSecurityScanScheduleDeleted object`
+  - `ClaudeCodeSecurityVulnerabilityUpdated object`
 
-    A recurring scan schedule was deleted for a Claude Code Security project.
+    A Claude Code Security vulnerability finding was dismissed, restored, marked fixed, or reopened.
 
-    - `type: optional "claude_code_security_scan_schedule_deleted"`
+    - `type: optional "claude_code_security_vulnerability_updated"`
 
-      default: claude_code_security_scan_schedule_deleted
+      default: claude_code_security_vulnerability_updated
+
+    - `action: "dismissed" or "fixed" or "restored" or 2 more`
+
+      The state change applied to the finding
+
+      - `"dismissed"`
+
+      - `"fixed"`
+
+      - `"restored"`
+
+      - `"unfixed"`
+
+      - `"unspecified"`
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -152660,9 +154150,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `scan_project_id: string`
+    - `scan_id: string`
 
-      Tagged ID of the scan project
+      Tagged ID of the scan the finding belongs to
 
     - `id: optional string`
 
@@ -152674,6 +154164,10 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
+    - `dismissal_reason: optional string or null`
+
+      The categorized dismissal reason (only set when the finding was dismissed)
+
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -152682,13 +154176,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeCodeSecurityScanScheduleUpdated object`
+  - `ClaudeCodeSecurityWebhookCreated object`
 
-    A recurring scan schedule was set or replaced for a Claude Code Security project.
+    A Claude Code Security outbound webhook was created.
 
-    - `type: optional "claude_code_security_scan_schedule_updated"`
+    - `type: optional "claude_code_security_webhook_created"`
 
-      default: claude_code_security_scan_schedule_updated
+      default: claude_code_security_webhook_created
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -152896,11 +154390,11 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `cadence: string`
+    - `url: string`
 
-    - `scan_project_id: string`
+    - `webhook_id: string`
 
-      Tagged ID of the scan project
+      Tagged ID of the webhook
 
     - `id: optional string`
 
@@ -152920,13 +154414,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeCodeSecurityVulnerabilityDeleted object`
+    - `scan_project_id: optional string or null`
 
-    A Claude Code Security vulnerability finding was permanently deleted.
+      Tagged ID of the scan project (null for organization-wide webhooks)
 
-    - `type: optional "claude_code_security_vulnerability_deleted"`
+  - `ClaudeCodeSecurityWebhookDeleted object`
 
-      default: claude_code_security_vulnerability_deleted
+    A Claude Code Security outbound webhook was deleted.
+
+    - `type: optional "claude_code_security_webhook_deleted"`
+
+      default: claude_code_security_webhook_deleted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -153134,13 +154632,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `scan_id: string`
-
-      Tagged ID of the scan the finding belonged to
-
-    - `vulnerability_id: number`
+    - `webhook_id: string`
 
-      Numeric ID of the deleted finding, as shown in the product
+      Tagged ID of the webhook
 
     - `id: optional string`
 
@@ -153160,13 +154654,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeCodeSecurityVulnerabilityFixSessionCreated object`
+    - `scan_project_id: optional string or null`
 
-    A Claude Code remediation session was created for a Claude Code Security vulnerability finding.
+      Tagged ID of the scan project (null for organization-wide webhooks)
 
-    - `type: optional "claude_code_security_vulnerability_fix_session_created"`
+  - `ClaudeCodeSecurityWebhookSecretUpdated object`
 
-      default: claude_code_security_vulnerability_fix_session_created
+    The HMAC signing secret for a Claude Code Security webhook was rotated.
+
+    - `type: optional "claude_code_security_webhook_secret_updated"`
+
+      default: claude_code_security_webhook_secret_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -153374,32 +154872,14 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `scan_id: string`
-
-      Tagged ID of the scan the finding belongs to
-
-    - `session_id: string`
+    - `webhook_id: string`
 
-      ID of the created remediation session
+      Tagged ID of the webhook
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `access_via: optional "member" or "organization_admin" or "organization_share" or 2 more or null`
-
-      How the actor was authorized to make this change: "owner" (the scan project's owner), "member" (an individually added member), "organization_share" (the project is shared with the actor's organization), or "organization_admin" (an administrator of the organization's security scanning). Absent when no project relationship was involved; events recorded before this field was introduced omit it.
-
-      - `"member"`
-
-      - `"organization_admin"`
-
-      - `"organization_share"`
-
-      - `"owner"`
-
-      - `"unspecified"`
-
     - `created_at: optional string`
 
       When this activity occurred.
@@ -153414,27 +154894,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeCodeSecurityVulnerabilityUpdated object`
-
-    A Claude Code Security vulnerability finding was dismissed, restored, marked fixed, or reopened.
-
-    - `type: optional "claude_code_security_vulnerability_updated"`
-
-      default: claude_code_security_vulnerability_updated
-
-    - `action: "dismissed" or "fixed" or "restored" or 2 more`
-
-      The state change applied to the finding
+    - `scan_project_id: optional string or null`
 
-      - `"dismissed"`
+      Tagged ID of the scan project (null for organization-wide webhooks)
 
-      - `"fixed"`
+  - `ClaudeCodeSecurityWebhookUpdated object`
 
-      - `"restored"`
+    A Claude Code Security outbound webhook was updated.
 
-      - `"unfixed"`
+    - `type: optional "claude_code_security_webhook_updated"`
 
-      - `"unspecified"`
+      default: claude_code_security_webhook_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -153642,9 +155112,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `scan_id: string`
+    - `webhook_id: string`
 
-      Tagged ID of the scan the finding belongs to
+      Tagged ID of the webhook
 
     - `id: optional string`
 
@@ -153656,10 +155126,6 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
-    - `dismissal_reason: optional string or null`
-
-      The categorized dismissal reason (only set when the finding was dismissed)
-
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -153668,13 +155134,27 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeCodeSecurityWebhookCreated object`
+    - `scan_project_id: optional string or null`
 
-    A Claude Code Security outbound webhook was created.
+      Tagged ID of the scan project (null for organization-wide webhooks)
 
-    - `type: optional "claude_code_security_webhook_created"`
+  - `ClaudeCodeTeamMemoryACLUpdated object`
 
-      default: claude_code_security_webhook_created
+    An RBAC group was added to or removed from the Claude Code team-memory ACL.
+
+    - `type: optional "claude_code_team_memory_acl_updated"`
+
+      default: claude_code_team_memory_acl_updated
+
+    - `action: "removed" or "set" or "unspecified"`
+
+      Whether the group was set (added/updated) or removed
+
+      - `"removed"`
+
+      - `"set"`
+
+      - `"unspecified"`
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -153882,16 +155362,18 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `url: string`
-
-    - `webhook_id: string`
+    - `group_id: string`
 
-      Tagged ID of the webhook
+      Tagged ID of the RBAC group
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
+    - `access_level: optional string or null`
+
+      Access level granted (when action=set)
+
     - `created_at: optional string`
 
       When this activity occurred.
@@ -153906,17 +155388,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `scan_project_id: optional string or null`
+    - `previous_access_level: optional string or null`
 
-      Tagged ID of the scan project (null for organization-wide webhooks)
+      Access level the group had before this change; absent when the group was not previously in the access list. For removals this is the access level that was removed.
 
-  - `ClaudeCodeSecurityWebhookDeleted object`
+  - `ClaudeCodeTeamMemoryUpdated object`
 
-    A Claude Code Security outbound webhook was deleted.
+    Claude Code team memory shared with the organization was updated.
 
-    - `type: optional "claude_code_security_webhook_deleted"`
+    - `type: optional "claude_code_team_memory_updated"`
 
-      default: claude_code_security_webhook_deleted
+      default: claude_code_team_memory_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -154124,9 +155606,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `webhook_id: string`
+    - `deleted_all: boolean`
 
-      Tagged ID of the webhook
+      True when the entire team memory store for this scope was deleted in one request.
 
     - `id: optional string`
 
@@ -154138,6 +155620,26 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
+    - `keys_deleted: optional array of string`
+
+      Withdrawn — never populated. See `keys_deleted_count`.
+
+    - `keys_deleted_count: optional number or null`
+
+      Number of team memory entries removed.
+
+    - `keys_written: optional array of string`
+
+      Withdrawn — never populated. See `keys_written_count`.
+
+    - `keys_written_count: optional number or null`
+
+      Number of team memory entries created or updated.
+
+    - `new_checksum: optional string or null`
+
+      Checksum of the team memory after this change.
+
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -154146,17 +155648,37 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `scan_project_id: optional string or null`
+    - `previous_checksum: optional string or null`
 
-      Tagged ID of the scan project (null for organization-wide webhooks)
+      Checksum of the team memory before this change; null when it did not exist.
 
-  - `ClaudeCodeSecurityWebhookSecretUpdated object`
+    - `repo: optional string or null`
 
-    The HMAC signing secret for a Claude Code Security webhook was rotated.
+      Withdrawn — never populated.
 
-    - `type: optional "claude_code_security_webhook_secret_updated"`
+    - `version: optional number or null`
 
-      default: claude_code_security_webhook_secret_updated
+      Version number of the team memory store after this change.
+
+  - `ClaudeCodeTeamOnboardingGuideUpdated object`
+
+    A Claude Code team onboarding guide was created, updated, or deleted.
+
+    - `type: optional "claude_code_team_onboarding_guide_updated"`
+
+      default: claude_code_team_onboarding_guide_updated
+
+    - `action: "created" or "deleted" or "unspecified" or "updated"`
+
+      The state change applied to the onboarding guide.
+
+      - `"created"`
+
+      - `"deleted"`
+
+      - `"unspecified"`
+
+      - `"updated"`
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -154364,9 +155886,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `webhook_id: string`
+    - `guide_short_code: string`
 
-      Tagged ID of the webhook
+      Short code identifying the onboarding guide — the public URL handle shown in the share link.
 
     - `id: optional string`
 
@@ -154378,6 +155900,18 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
+    - `guide_id: optional string or null`
+
+      Tagged ID of the onboarding guide.
+
+    - `guide_name: optional string or null`
+
+      Withdrawn — never populated.
+
+    - `new_checksum: optional string or null`
+
+      Checksum of the guide content after this change; null when the guide was deleted.
+
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -154386,17 +155920,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `scan_project_id: optional string or null`
+    - `previous_checksum: optional string or null`
 
-      Tagged ID of the scan project (null for organization-wide webhooks)
+      Checksum of the guide content before this change; null when the guide did not exist.
 
-  - `ClaudeCodeSecurityWebhookUpdated object`
+  - `ClaudeCodeUserMarketplacesUpdated object`
 
-    A Claude Code Security outbound webhook was updated.
+    A user's Claude Code plugin marketplace selections were updated on Anthropic servers.
 
-    - `type: optional "claude_code_security_webhook_updated"`
+    - `type: optional "claude_code_user_marketplaces_updated"`
 
-      default: claude_code_security_webhook_updated
+      default: claude_code_user_marketplaces_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -154604,9 +156138,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `webhook_id: string`
+    - `deleted_all: boolean`
 
-      Tagged ID of the webhook
+      True when all of the user's marketplace selections were removed in one request.
 
     - `id: optional string`
 
@@ -154618,35 +156152,45 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
-    - `organization_id: optional string or null`
+    - `keys_deleted: optional array of string`
 
-      Organization ID this activity is associated with
+      Withdrawn — never populated. See `keys_deleted_count`.
 
-    - `organization_uuid: optional string or null`
+    - `keys_deleted_count: optional number or null`
 
-      Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
+      Number of marketplace selections removed.
 
-    - `scan_project_id: optional string or null`
+    - `keys_written: optional array of string`
 
-      Tagged ID of the scan project (null for organization-wide webhooks)
+      Withdrawn — never populated. See `keys_written_count`.
 
-  - `ClaudeCodeTeamMemoryACLUpdated object`
+    - `keys_written_count: optional number or null`
 
-    An RBAC group was added to or removed from the Claude Code team-memory ACL.
+      Number of marketplace selections added or whose source changed.
 
-    - `type: optional "claude_code_team_memory_acl_updated"`
+    - `new_value: optional string or null`
 
-      default: claude_code_team_memory_acl_updated
+      Withdrawn — never populated.
 
-    - `action: "removed" or "set" or "unspecified"`
+    - `organization_id: optional string or null`
 
-      Whether the group was set (added/updated) or removed
+      Organization ID this activity is associated with
 
-      - `"removed"`
+    - `organization_uuid: optional string or null`
 
-      - `"set"`
+      Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-      - `"unspecified"`
+    - `previous_value: optional string or null`
+
+      Withdrawn — never populated.
+
+  - `ClaudeCodeUserMemoryUpdated object`
+
+    A user's synced private Claude Code memory was updated or deleted on Anthropic servers.
+
+    - `type: optional "claude_code_user_memory_updated"`
+
+      default: claude_code_user_memory_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -154854,24 +156398,40 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `group_id: string`
+    - `deleted_all: boolean`
 
-      Tagged ID of the RBAC group
+      True when the user's entire synced memory for this scope was deleted in one request.
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `access_level: optional string or null`
-
-      Access level granted (when action=set)
-
     - `created_at: optional string`
 
       When this activity occurred.
 
       format: date-time
 
+    - `keys_deleted: optional array of string`
+
+      Withdrawn — never populated. See `keys_deleted_count`.
+
+    - `keys_deleted_count: optional number or null`
+
+      Number of memory file paths removed.
+
+    - `keys_written: optional array of string`
+
+      Withdrawn — never populated. See `keys_written_count`.
+
+    - `keys_written_count: optional number or null`
+
+      Number of memory file paths created or updated.
+
+    - `new_checksum: optional string or null`
+
+      Checksum of the user's synced memory after this change.
+
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -154880,17 +156440,21 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `previous_access_level: optional string or null`
+    - `previous_checksum: optional string or null`
 
-      Access level the group had before this change; absent when the group was not previously in the access list. For removals this is the access level that was removed.
+      Checksum of the user's synced memory before this change; null when the store did not exist.
 
-  - `ClaudeCodeTeamMemoryUpdated object`
+    - `repo: optional string or null`
 
-    Claude Code team memory shared with the organization was updated.
+      Withdrawn — never populated.
 
-    - `type: optional "claude_code_team_memory_updated"`
+  - `ClaudeCodeUserPluginsUpdated object`
 
-      default: claude_code_team_memory_updated
+    A user's Claude Code plugin selections — which plugins are installed and enabled — were updated on Anthropic servers.
+
+    - `type: optional "claude_code_user_plugins_updated"`
+
+      default: claude_code_user_plugins_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -155100,7 +156664,7 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
     - `deleted_all: boolean`
 
-      True when the entire team memory store for this scope was deleted in one request.
+      True when all of the user's plugin selections were removed in one request.
 
     - `id: optional string`
 
@@ -155118,7 +156682,7 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
     - `keys_deleted_count: optional number or null`
 
-      Number of team memory entries removed.
+      Number of plugin selections removed.
 
     - `keys_written: optional array of string`
 
@@ -155126,11 +156690,11 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
     - `keys_written_count: optional number or null`
 
-      Number of team memory entries created or updated.
+      Number of plugin selections added or whose enabled state changed.
 
-    - `new_checksum: optional string or null`
+    - `new_value: optional string or null`
 
-      Checksum of the team memory after this change.
+      The targeted plugin's new enabled state, when a single plugin's state changed.
 
     - `organization_id: optional string or null`
 
@@ -155140,37 +156704,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `previous_checksum: optional string or null`
-
-      Checksum of the team memory before this change; null when it did not exist.
-
-    - `repo: optional string or null`
-
-      Withdrawn — never populated.
-
-    - `version: optional number or null`
-
-      Version number of the team memory store after this change.
-
-  - `ClaudeCodeTeamOnboardingGuideUpdated object`
-
-    A Claude Code team onboarding guide was created, updated, or deleted.
-
-    - `type: optional "claude_code_team_onboarding_guide_updated"`
-
-      default: claude_code_team_onboarding_guide_updated
-
-    - `action: "created" or "deleted" or "unspecified" or "updated"`
+    - `previous_value: optional string or null`
 
-      The state change applied to the onboarding guide.
+      The targeted plugin's previous enabled state, when a single plugin's state changed; null when the plugin did not previously exist or multiple plugins changed.
 
-      - `"created"`
+  - `ClaudeCodeUserSettingsUpdated object`
 
-      - `"deleted"`
+    A user's synced Claude Code settings were updated or deleted on Anthropic servers.
 
-      - `"unspecified"`
+    - `type: optional "claude_code_user_settings_updated"`
 
-      - `"updated"`
+      default: claude_code_user_settings_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -155378,9 +156922,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `guide_short_code: string`
+    - `deleted_all: boolean`
 
-      Short code identifying the onboarding guide — the public URL handle shown in the share link.
+      True when the user's entire synced settings store was deleted in one request.
 
     - `id: optional string`
 
@@ -155392,17 +156936,25 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
-    - `guide_id: optional string or null`
+    - `keys_deleted: optional array of string`
 
-      Tagged ID of the onboarding guide.
+      Withdrawn — never populated. See `keys_deleted_count`.
 
-    - `guide_name: optional string or null`
+    - `keys_deleted_count: optional number or null`
 
-      Withdrawn — never populated.
+      Number of settings entries removed.
+
+    - `keys_written: optional array of string`
+
+      Withdrawn — never populated. See `keys_written_count`.
+
+    - `keys_written_count: optional number or null`
+
+      Number of settings entries created or updated.
 
     - `new_checksum: optional string or null`
 
-      Checksum of the guide content after this change; null when the guide was deleted.
+      Checksum of the user's synced settings after this change.
 
     - `organization_id: optional string or null`
 
@@ -155414,15 +156966,25 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
     - `previous_checksum: optional string or null`
 
-      Checksum of the guide content before this change; null when the guide did not exist.
+      Checksum of the user's synced settings before this change; null when the store did not exist.
 
-  - `ClaudeCodeUserMarketplacesUpdated object`
+  - `ClaudeEnterpriseUpgradeCreditUpdated object`
 
-    A user's Claude Code plugin marketplace selections were updated on Anthropic servers.
+    An organization admin cancelled, or turned back on, the monthly usage credit the organization receives for upgrading from the Team plan to the Enterprise plan, together with the recurring monthly charge that accompanies it.
 
-    - `type: optional "claude_code_user_marketplaces_updated"`
+    - `type: optional "claude_enterprise_upgrade_credit_updated"`
 
-      default: claude_code_user_marketplaces_updated
+      default: claude_enterprise_upgrade_credit_updated
+
+    - `action: "cancelled" or "resumed" or "unspecified"`
+
+      Whether the credit was cancelled or turned back on
+
+      - `"cancelled"`
+
+      - `"resumed"`
+
+      - `"unspecified"`
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -155630,10 +157192,6 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `deleted_all: boolean`
-
-      True when all of the user's marketplace selections were removed in one request.
-
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
@@ -155644,26 +157202,6 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
-    - `keys_deleted: optional array of string`
-
-      Withdrawn — never populated. See `keys_deleted_count`.
-
-    - `keys_deleted_count: optional number or null`
-
-      Number of marketplace selections removed.
-
-    - `keys_written: optional array of string`
-
-      Withdrawn — never populated. See `keys_written_count`.
-
-    - `keys_written_count: optional number or null`
-
-      Number of marketplace selections added or whose source changed.
-
-    - `new_value: optional string or null`
-
-      Withdrawn — never populated.
-
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -155672,17 +157210,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `previous_value: optional string or null`
-
-      Withdrawn — never populated.
-
-  - `ClaudeCodeUserMemoryUpdated object`
+  - `ClaudeFileAccessFailed object`
 
-    A user's synced private Claude Code memory was updated or deleted on Anthropic servers.
+    A user was denied access to a file in Claude.ai.
 
-    - `type: optional "claude_code_user_memory_updated"`
+    - `type: optional "claude_file_access_failed"`
 
-      default: claude_code_user_memory_updated
+      default: claude_file_access_failed
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -155890,39 +157424,27 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `deleted_all: boolean`
+    - `claude_file_id: string`
 
-      True when the user's entire synced memory for this scope was deleted in one request.
+      The file the user was denied access to, e.g. "claude_file_01HX...".
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `created_at: optional string`
-
-      When this activity occurred.
-
-      format: date-time
-
-    - `keys_deleted: optional array of string`
-
-      Withdrawn — never populated. See `keys_deleted_count`.
-
-    - `keys_deleted_count: optional number or null`
-
-      Number of memory file paths removed.
+    - `claude_artifact_id: optional string or null`
 
-    - `keys_written: optional array of string`
+      The artifact the file was accessed through, if any, e.g. "claude_artifact_01HX...".
 
-      Withdrawn — never populated. See `keys_written_count`.
+    - `claude_project_id: optional string or null`
 
-    - `keys_written_count: optional number or null`
+      The project the file was accessed through, if any, e.g. "claude_proj_01HX...".
 
-      Number of memory file paths created or updated.
+    - `created_at: optional string`
 
-    - `new_checksum: optional string or null`
+      When this activity occurred.
 
-      Checksum of the user's synced memory after this change.
+      format: date-time
 
     - `organization_id: optional string or null`
 
@@ -155932,21 +157454,19 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `previous_checksum: optional string or null`
-
-      Checksum of the user's synced memory before this change; null when the store did not exist.
+    - `filename: optional string or null`
 
-    - `repo: optional string or null`
+      **Deprecated**
 
-      Withdrawn — never populated.
+      Deprecated — DO NOT USE. Always empty; the file's display name is intentionally omitted.
 
-  - `ClaudeCodeUserPluginsUpdated object`
+  - `ClaudeFileExported object`
 
-    A user's Claude Code plugin selections — which plugins are installed and enabled — were updated on Anthropic servers.
+    A file was exported from Claude to an external storage destination.
 
-    - `type: optional "claude_code_user_plugins_updated"`
+    - `type: optional "claude_file_exported"`
 
-      default: claude_code_user_plugins_updated
+      default: claude_file_exported
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -156154,39 +157674,35 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `deleted_all: boolean`
-
-      True when all of the user's plugin selections were removed in one request.
-
-    - `id: optional string`
+    - `export_destination: "google_drive" or "unspecified"`
 
-      Unique identifier for the activity e.g. 'activity_abcd1234'
+      The external destination the file was exported to.
 
-    - `created_at: optional string`
+      - `"google_drive"`
 
-      When this activity occurred.
+      - `"unspecified"`
 
-      format: date-time
+    - `filename: string`
 
-    - `keys_deleted: optional array of string`
+      Name of the exported file.
 
-      Withdrawn — never populated. See `keys_deleted_count`.
+    - `id: optional string`
 
-    - `keys_deleted_count: optional number or null`
+      Unique identifier for the activity e.g. 'activity_abcd1234'
 
-      Number of plugin selections removed.
+    - `claude_chat_id: optional string or null`
 
-    - `keys_written: optional array of string`
+      The chat conversation the file was exported from, if the export originated in a chat, e.g. "claude_chat_01HX...".
 
-      Withdrawn — never populated. See `keys_written_count`.
+    - `claude_file_id: optional string or null`
 
-    - `keys_written_count: optional number or null`
+      The exported file, e.g. "claude_file_01HX...", if the file has a stored file record; files that exist only inside a session have no file ID.
 
-      Number of plugin selections added or whose enabled state changed.
+    - `created_at: optional string`
 
-    - `new_value: optional string or null`
+      When this activity occurred.
 
-      The targeted plugin's new enabled state, when a single plugin's state changed.
+      format: date-time
 
     - `organization_id: optional string or null`
 
@@ -156196,17 +157712,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `previous_value: optional string or null`
-
-      The targeted plugin's previous enabled state, when a single plugin's state changed; null when the plugin did not previously exist or multiple plugins changed.
-
-  - `ClaudeCodeUserSettingsUpdated object`
+  - `ClaudeFileViewed object`
 
-    A user's synced Claude Code settings were updated or deleted on Anthropic servers.
+    A user viewed a file in Claude.ai.
 
-    - `type: optional "claude_code_user_settings_updated"`
+    - `type: optional "claude_file_viewed"`
 
-      default: claude_code_user_settings_updated
+      default: claude_file_viewed
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -156414,39 +157926,27 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `deleted_all: boolean`
+    - `claude_file_id: string`
 
-      True when the user's entire synced settings store was deleted in one request.
+      The file that was viewed, e.g. "claude_file_01HX...".
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `created_at: optional string`
-
-      When this activity occurred.
-
-      format: date-time
-
-    - `keys_deleted: optional array of string`
-
-      Withdrawn — never populated. See `keys_deleted_count`.
-
-    - `keys_deleted_count: optional number or null`
-
-      Number of settings entries removed.
+    - `claude_artifact_id: optional string or null`
 
-    - `keys_written: optional array of string`
+      The artifact the file was accessed through, if any, e.g. "claude_artifact_01HX...".
 
-      Withdrawn — never populated. See `keys_written_count`.
+    - `claude_project_id: optional string or null`
 
-    - `keys_written_count: optional number or null`
+      The project the file was accessed through, if any, e.g. "claude_proj_01HX...".
 
-      Number of settings entries created or updated.
+    - `created_at: optional string`
 
-    - `new_checksum: optional string or null`
+      When this activity occurred.
 
-      Checksum of the user's synced settings after this change.
+      format: date-time
 
     - `organization_id: optional string or null`
 
@@ -156456,27 +157956,19 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `previous_checksum: optional string or null`
-
-      Checksum of the user's synced settings before this change; null when the store did not exist.
-
-  - `ClaudeEnterpriseUpgradeCreditUpdated object`
-
-    An organization admin cancelled, or turned back on, the monthly usage credit the organization receives for upgrading from the Team plan to the Enterprise plan, together with the recurring monthly charge that accompanies it.
-
-    - `type: optional "claude_enterprise_upgrade_credit_updated"`
+    - `filename: optional string or null`
 
-      default: claude_enterprise_upgrade_credit_updated
+      **Deprecated**
 
-    - `action: "cancelled" or "resumed" or "unspecified"`
+      Deprecated — DO NOT USE. Always empty; the file's display name is intentionally omitted.
 
-      Whether the credit was cancelled or turned back on
+  - `ClaudeProjectSyncSourceCreated object`
 
-      - `"cancelled"`
+    A sync source was connected to a Claude project's knowledge base.
 
-      - `"resumed"`
+    - `type: optional "claude_project_sync_source_created"`
 
-      - `"unspecified"`
+      default: claude_project_sync_source_created
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -156684,6 +158176,18 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
+    - `claude_project_id: string`
+
+      Tagged ID of the project the sync source was connected to.
+
+    - `claude_project_sync_source_id: string`
+
+      Tagged ID of the per-project sync source that was created.
+
+    - `provider: string`
+
+      The external provider backing the sync source, e.g. `github`, `google_drive`, `outline`, `slack`, `salesforce`, `google_calendar`, `gmail`, `asana`, or `mcp_resources`.
+
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
@@ -156702,13 +158206,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeFileAccessFailed object`
+    - `resource_descriptor: optional string or null`
 
-    A user was denied access to a file in Claude.ai.
+      A short provider-specific identifier for the external resource that was connected, e.g. `owner/repo` for GitHub or a file ID for Google Drive.
 
-    - `type: optional "claude_file_access_failed"`
+  - `ClaudeProjectSyncSourceDeleted object`
 
-      default: claude_file_access_failed
+    A sync source was disconnected from a Claude project's knowledge base.
+
+    - `type: optional "claude_project_sync_source_deleted"`
+
+      default: claude_project_sync_source_deleted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -156916,21 +158424,21 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `claude_file_id: string`
+    - `claude_project_id: string`
 
-      The file the user was denied access to, e.g. "claude_file_01HX...".
+      Tagged ID of the project the sync source was disconnected from.
 
-    - `id: optional string`
+    - `claude_project_sync_source_id: string`
 
-      Unique identifier for the activity e.g. 'activity_abcd1234'
+      Tagged ID of the per-project sync source that was deleted.
 
-    - `claude_artifact_id: optional string or null`
+    - `provider: string`
 
-      The artifact the file was accessed through, if any, e.g. "claude_artifact_01HX...".
+      The external provider backing the sync source. Always `unspecified` for deletion events.
 
-    - `claude_project_id: optional string or null`
+    - `id: optional string`
 
-      The project the file was accessed through, if any, e.g. "claude_proj_01HX...".
+      Unique identifier for the activity e.g. 'activity_abcd1234'
 
     - `created_at: optional string`
 
@@ -156946,19 +158454,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `filename: optional string or null`
-
-      **Deprecated**
-
-      Deprecated — DO NOT USE. Always empty; the file's display name is intentionally omitted.
-
-  - `ClaudeFileExported object`
+  - `ClaudeProjectSyncSourceUpdated object`
 
-    A file was exported from Claude to an external storage destination.
+    A Claude project sync source's configuration was updated.
 
-    - `type: optional "claude_file_exported"`
+    - `type: optional "claude_project_sync_source_updated"`
 
-      default: claude_file_exported
+      default: claude_project_sync_source_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -157166,29 +158668,25 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `export_destination: "google_drive" or "unspecified"`
+    - `claude_project_id: string`
 
-      The external destination the file was exported to.
+      Tagged ID of the project the sync source belongs to.
 
-      - `"google_drive"`
+    - `claude_project_sync_source_id: string`
 
-      - `"unspecified"`
+      Tagged ID of the per-project sync source that was updated.
 
-    - `filename: string`
+    - `provider: string`
 
-      Name of the exported file.
+      The external provider backing the sync source, e.g. `github`, `google_drive`, `outline`, `slack`, `salesforce`, `google_calendar`, `gmail`, `asana`, or `mcp_resources`.
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `claude_chat_id: optional string or null`
-
-      The chat conversation the file was exported from, if the export originated in a chat, e.g. "claude_chat_01HX...".
-
-    - `claude_file_id: optional string or null`
+    - `config_changed: optional boolean or null`
 
-      The exported file, e.g. "claude_file_01HX...", if the file has a stored file record; files that exist only inside a session have no file ID.
+      Whether the update changed the stored sync-source configuration, including sync settings such as path filters. False for a re-sync or a metadata-only refresh of the same resource.
 
     - `created_at: optional string`
 
@@ -157204,13 +158702,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeFileViewed object`
+    - `resource_descriptor: optional string or null`
 
-    A user viewed a file in Claude.ai.
+      A short provider-specific identifier for the external resource after the update, e.g. `owner/repo` for GitHub or a file ID for Google Drive.
 
-    - `type: optional "claude_file_viewed"`
+  - `ClaudeUserSeatTierUpdated object`
 
-      default: claude_file_viewed
+    An organization member's seat tier was changed. A null `previous_seat_tier` means the member previously had no seat assigned; a null `current_seat_tier` means the seat was removed.
+
+    - `type: optional "claude_user_seat_tier_updated"`
+
+      default: claude_user_seat_tier_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -157418,21 +158920,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `claude_file_id: string`
-
-      The file that was viewed, e.g. "claude_file_01HX...".
-
-    - `id: optional string`
+    - `user_email: string`
 
-      Unique identifier for the activity e.g. 'activity_abcd1234'
+      Email address of the member at the time of the change.
 
-    - `claude_artifact_id: optional string or null`
+    - `user_id: string`
 
-      The artifact the file was accessed through, if any, e.g. "claude_artifact_01HX...".
+      Tagged ID of the member whose seat tier changed.
 
-    - `claude_project_id: optional string or null`
+    - `id: optional string`
 
-      The project the file was accessed through, if any, e.g. "claude_proj_01HX...".
+      Unique identifier for the activity e.g. 'activity_abcd1234'
 
     - `created_at: optional string`
 
@@ -157440,6 +158938,10 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
+    - `current_seat_tier: optional string or null`
+
+      The member's seat tier after this change, or null if the seat was removed.
+
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -157448,19 +158950,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `filename: optional string or null`
-
-      **Deprecated**
+    - `previous_seat_tier: optional string or null`
 
-      Deprecated — DO NOT USE. Always empty; the file's display name is intentionally omitted.
+      The member's seat tier before this change, or null if no seat was assigned.
 
-  - `ClaudeProjectSyncSourceCreated object`
+  - `CliPluginExecPolicyUpdated object`
 
-    A sync source was connected to a Claude project's knowledge base.
+    Admin set or cleared the per-op permission ceiling for a plugin CLI.
 
-    - `type: optional "claude_project_sync_source_created"`
+    - `type: optional "cli_plugin_exec_policy_updated"`
 
-      default: claude_project_sync_source_created
+      default: cli_plugin_exec_policy_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -157668,17 +159168,25 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `claude_project_id: string`
+    - `cli_name: string`
 
-      Tagged ID of the project the sync source was connected to.
+      CLI name as declared by the plugin manifest
 
-    - `claude_project_sync_source_id: string`
+    - `marketplace_id: string`
 
-      Tagged ID of the per-project sync source that was created.
+      Marketplace ID owning the plugin
 
-    - `provider: string`
+    - `op_name: string`
 
-      The external provider backing the sync source, e.g. `github`, `google_drive`, `outline`, `slack`, `salesforce`, `google_calendar`, `gmail`, `asana`, or `mcp_resources`.
+      Op name (or '*' for the per-CLI default)
+
+    - `plugin_id: string`
+
+      Plugin ID resolved from the URL
+
+    - `plugin_name: string`
+
+      Plugin name within its marketplace
 
     - `id: optional string`
 
@@ -157690,6 +159198,10 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
+    - `max_permission: optional string or null`
+
+      New max_permission value ('allow' | 'ask' | 'blocked'), or null when cleared
+
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -157698,17 +159210,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `resource_descriptor: optional string or null`
+    - `previous_max_permission: optional string or null`
 
-      A short provider-specific identifier for the external resource that was connected, e.g. `owner/repo` for GitHub or a file ID for Google Drive.
+      Max permission the op had before this change ('allow' | 'ask' | 'blocked'), or null when no policy existed for the op
 
-  - `ClaudeProjectSyncSourceDeleted object`
+  - `ClaudeCommandCreated object`
 
-    A sync source was disconnected from a Claude project's knowledge base.
+    Command was created.
 
-    - `type: optional "claude_project_sync_source_deleted"`
+    - `type: optional "claude_command_created"`
 
-      default: claude_project_sync_source_deleted
+      default: claude_command_created
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -157916,22 +159428,14 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `claude_project_id: string`
-
-      Tagged ID of the project the sync source was disconnected from.
-
-    - `claude_project_sync_source_id: string`
-
-      Tagged ID of the per-project sync source that was deleted.
-
-    - `provider: string`
-
-      The external provider backing the sync source. Always `unspecified` for deletion events.
-
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
+    - `command_id: optional string or null`
+
+    - `command_name: optional string or null`
+
     - `created_at: optional string`
 
       When this activity occurred.
@@ -157946,13 +159450,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeProjectSyncSourceUpdated object`
+  - `ClaudeCommandDeleted object`
 
-    A Claude project sync source's configuration was updated.
+    Command was deleted.
 
-    - `type: optional "claude_project_sync_source_updated"`
+    - `type: optional "claude_command_deleted"`
 
-      default: claude_project_sync_source_updated
+      default: claude_command_deleted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -158160,25 +159664,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `claude_project_id: string`
-
-      Tagged ID of the project the sync source belongs to.
-
-    - `claude_project_sync_source_id: string`
-
-      Tagged ID of the per-project sync source that was updated.
-
-    - `provider: string`
-
-      The external provider backing the sync source, e.g. `github`, `google_drive`, `outline`, `slack`, `salesforce`, `google_calendar`, `gmail`, `asana`, or `mcp_resources`.
-
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `config_changed: optional boolean or null`
+    - `command_id: optional string or null`
 
-      Whether the update changed the stored sync-source configuration, including sync settings such as path filters. False for a re-sync or a metadata-only refresh of the same resource.
+    - `command_name: optional string or null`
 
     - `created_at: optional string`
 
@@ -158194,17 +159686,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `resource_descriptor: optional string or null`
-
-      A short provider-specific identifier for the external resource after the update, e.g. `owner/repo` for GitHub or a file ID for Google Drive.
-
-  - `ClaudeUserSeatTierUpdated object`
+  - `ClaudeCommandReplaced object`
 
-    An organization member's seat tier was changed. A null `previous_seat_tier` means the member previously had no seat assigned; a null `current_seat_tier` means the seat was removed.
+    Command was replaced.
 
-    - `type: optional "claude_user_seat_tier_updated"`
+    - `type: optional "claude_command_replaced"`
 
-      default: claude_user_seat_tier_updated
+      default: claude_command_replaced
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -158412,28 +159900,20 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `user_email: string`
-
-      Email address of the member at the time of the change.
-
-    - `user_id: string`
-
-      Tagged ID of the member whose seat tier changed.
-
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
+    - `command_id: optional string or null`
+
+    - `command_name: optional string or null`
+
     - `created_at: optional string`
 
       When this activity occurred.
 
       format: date-time
 
-    - `current_seat_tier: optional string or null`
-
-      The member's seat tier after this change, or null if the seat was removed.
-
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -158442,17 +159922,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `previous_seat_tier: optional string or null`
-
-      The member's seat tier before this change, or null if no seat was assigned.
-
-  - `CliPluginExecPolicyUpdated object`
+  - `ComplianceAPIAccessed object`
 
-    Admin set or cleared the per-op permission ceiling for a plugin CLI.
+    Logging event auto-generated for each compliance API request.
 
-    - `type: optional "cli_plugin_exec_policy_updated"`
+    - `type: optional "compliance_api_accessed"`
 
-      default: cli_plugin_exec_policy_updated
+      default: compliance_api_accessed
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -158660,25 +160136,31 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `cli_name: string`
+    - `request_id: string`
 
-      CLI name as declared by the plugin manifest
+      Identifier of the request, as returned in the response's request-id header
 
-    - `marketplace_id: string`
+    - `request_method: "DELETE" or "GET" or "POST" or 2 more`
 
-      Marketplace ID owning the plugin
+      HTTP method of the request
 
-    - `op_name: string`
+      - `"DELETE"`
 
-      Op name (or '*' for the per-CLI default)
+      - `"GET"`
 
-    - `plugin_id: string`
+      - `"POST"`
 
-      Plugin ID resolved from the URL
+      - `"PUT"`
 
-    - `plugin_name: string`
+      - `"unspecified"`
 
-      Plugin name within its marketplace
+    - `status_code: number`
+
+      HTTP status code
+
+    - `url: string`
+
+      Full URL that was requested, including any query string
 
     - `id: optional string`
 
@@ -158690,10 +160172,6 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
-    - `max_permission: optional string or null`
-
-      New max_permission value ('allow' | 'ask' | 'blocked'), or null when cleared
-
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -158702,17 +160180,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `previous_max_permission: optional string or null`
+    - `request_body: optional string or null`
 
-      Max permission the op had before this change ('allow' | 'ask' | 'blocked'), or null when no policy existed for the op
+      Serialized JSON request body
 
-  - `ClaudeCommandCreated object`
+  - `CoworkSessionUpdated object`
 
-    Command was created.
+    A Cowork session was updated.
 
-    - `type: optional "claude_command_created"`
+    - `type: optional "cowork_session_updated"`
 
-      default: claude_command_created
+      default: cowork_session_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -158920,13 +160398,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
+    - `cowork_session_id: string`
+
+      Tagged ID of the updated session, e.g. "sess_01HX...".
+
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `command_id: optional string or null`
+    - `claude_project_id: optional string or null`
 
-    - `command_name: optional string or null`
+      Tagged ID of the project the session was moved to, if any, e.g. "claude_proj_01HX...". Absent when the session was removed from its project.
 
     - `created_at: optional string`
 
@@ -158942,13 +160424,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeCommandDeleted object`
+  - `DesignProjectArtifactPublished object`
 
-    Command was deleted.
+    A Claude Design project's content was published as a claude.ai artifact, making a snapshot of one of its files viewable outside the project's sharing settings.
 
-    - `type: optional "claude_command_deleted"`
+    - `type: optional "design_project_artifact_published"`
 
-      default: claude_command_deleted
+      default: design_project_artifact_published
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -159156,13 +160638,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `id: optional string`
+    - `design_project_id: string`
 
-      Unique identifier for the activity e.g. 'activity_abcd1234'
+      The Design project whose content was published, e.g. "design_proj_01HX...".
 
-    - `command_id: optional string or null`
+    - `id: optional string`
 
-    - `command_name: optional string or null`
+      Unique identifier for the activity e.g. 'activity_abcd1234'
 
     - `created_at: optional string`
 
@@ -159170,6 +160652,10 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
+    - `is_public: optional boolean or null`
+
+      True when the published artifact is publicly viewable after this call (anyone with the link). False when it is not — by default, a newly published artifact is visible only to the person who published it.
+
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -159178,13 +160664,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeCommandReplaced object`
+    - `project_type: optional string or null`
 
-    Command was replaced.
+      The project's type: "project", "template", or "design_system".
 
-    - `type: optional "claude_command_replaced"`
+  - `DesignProjectCreated object`
 
-      default: claude_command_replaced
+    A Claude Design project was created.
+
+    - `type: optional "design_project_created"`
+
+      default: design_project_created
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -159392,13 +160882,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `id: optional string`
+    - `creation_method: string`
 
-      Unique identifier for the activity e.g. 'activity_abcd1234'
+      How the project was created: "direct", "duplicate", "remix", or "template_from_project".
 
-    - `command_id: optional string or null`
+    - `design_project_id: string`
 
-    - `command_name: optional string or null`
+      The Design project that was created, e.g. "design_proj_01HX...".
+
+    - `id: optional string`
+
+      Unique identifier for the activity e.g. 'activity_abcd1234'
 
     - `created_at: optional string`
 
@@ -159414,13 +160908,21 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ComplianceAPIAccessed object`
+    - `project_type: optional string or null`
 
-    Logging event auto-generated for each compliance API request.
+      The project type: "project", "template", or "design_system".
 
-    - `type: optional "compliance_api_accessed"`
+    - `source_project_id: optional string or null`
 
-      default: compliance_api_accessed
+      The source project this was created from, when created via duplicate, remix, or template-from-project. Unset for direct creation.
+
+  - `DesignProjectDeleted object`
+
+    A Claude Design project was deleted.
+
+    - `type: optional "design_project_deleted"`
+
+      default: design_project_deleted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -159628,31 +161130,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `request_id: string`
-
-      Identifier of the request, as returned in the response's request-id header
-
-    - `request_method: "DELETE" or "GET" or "POST" or 2 more`
-
-      HTTP method of the request
-
-      - `"DELETE"`
-
-      - `"GET"`
-
-      - `"POST"`
-
-      - `"PUT"`
-
-      - `"unspecified"`
-
-    - `status_code: number`
-
-      HTTP status code
-
-    - `url: string`
+    - `design_project_id: string`
 
-      Full URL that was requested, including any query string
+      The Design project that was deleted, e.g. "design_proj_01HX...".
 
     - `id: optional string`
 
@@ -159672,17 +161152,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `request_body: optional string or null`
-
-      Serialized JSON request body
-
-  - `CoworkSessionUpdated object`
+  - `DesignProjectMemberAdded object`
 
-    A Cowork session was updated.
+    A member was granted access to a Claude Design project.
 
-    - `type: optional "cowork_session_updated"`
+    - `type: optional "design_project_member_added"`
 
-      default: cowork_session_updated
+      default: design_project_member_added
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -159890,17 +161366,25 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `cowork_session_id: string`
+    - `design_project_id: string`
 
-      Tagged ID of the updated session, e.g. "sess_01HX...".
+      The Design project the member was added to, e.g. "design_proj_01HX...".
 
-    - `id: optional string`
+    - `principal_id: string`
 
-      Unique identifier for the activity e.g. 'activity_abcd1234'
+      The member's identifier: a tagged user ID (e.g. "user_01HX...") for "account", the group's identifier for "compartment", or the service's identifier for "trusted_service".
 
-    - `claude_project_id: optional string or null`
+    - `principal_type: string`
 
-      Tagged ID of the project the session was moved to, if any, e.g. "claude_proj_01HX...". Absent when the session was removed from its project.
+      The kind of member that was added: "account" (a user), "compartment" (a named access group), or "trusted_service" (an authorized agent).
+
+    - `role: string`
+
+      The role the member was granted: "viewer", "commenter", or "editor". Access-group ("compartment") members are always view-only.
+
+    - `id: optional string`
+
+      Unique identifier for the activity e.g. 'activity_abcd1234'
 
     - `created_at: optional string`
 
@@ -159916,13 +161400,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `DesignProjectArtifactPublished object`
+    - `project_type: optional string or null`
 
-    A Claude Design project's content was published as a claude.ai artifact, making a snapshot of one of its files viewable outside the project's sharing settings.
+      The project's type: "project", "template", or "design_system".
 
-    - `type: optional "design_project_artifact_published"`
+  - `DesignProjectMemberRemoved object`
 
-      default: design_project_artifact_published
+    A member's access to a Claude Design project was revoked.
+
+    - `type: optional "design_project_member_removed"`
+
+      default: design_project_member_removed
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -160132,7 +161620,15 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
     - `design_project_id: string`
 
-      The Design project whose content was published, e.g. "design_proj_01HX...".
+      The Design project the member was removed from, e.g. "design_proj_01HX...".
+
+    - `principal_id: string`
+
+      The member's identifier: a tagged user ID (e.g. "user_01HX...") for "account", the group's identifier for "compartment", or the service's identifier for "trusted_service".
+
+    - `principal_type: string`
+
+      The kind of member that was removed: "account" (a user), "compartment" (a named access group), or "trusted_service" (an authorized agent).
 
     - `id: optional string`
 
@@ -160144,10 +161640,6 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
-    - `is_public: optional boolean or null`
-
-      True when the published artifact is publicly viewable after this call (anyone with the link). False when it is not — by default, a newly published artifact is visible only to the person who published it.
-
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -160160,13 +161652,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       The project's type: "project", "template", or "design_system".
 
-  - `DesignProjectCreated object`
+  - `DesignProjectMemberRoleUpdated object`
 
-    A Claude Design project was created.
+    A Claude Design project member's role was changed.
 
-    - `type: optional "design_project_created"`
+    - `type: optional "design_project_member_role_updated"`
 
-      default: design_project_created
+      default: design_project_member_role_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -160374,13 +161866,21 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `creation_method: string`
+    - `design_project_id: string`
 
-      How the project was created: "direct", "duplicate", "remix", or "template_from_project".
+      The Design project the member belongs to, e.g. "design_proj_01HX...".
 
-    - `design_project_id: string`
+    - `principal_id: string`
 
-      The Design project that was created, e.g. "design_proj_01HX...".
+      The member's identifier: a tagged user ID (e.g. "user_01HX...") for "account", the group's identifier for "compartment", or the service's identifier for "trusted_service".
+
+    - `principal_type: string`
+
+      The kind of member whose role was changed: "account" (a user), "compartment" (a named access group), or "trusted_service" (an authorized agent).
+
+    - `role: string`
+
+      The member's role after the change: "viewer", "commenter", or "editor".
 
     - `id: optional string`
 
@@ -160400,21 +161900,21 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `project_type: optional string or null`
+    - `previous_role: optional string or null`
 
-      The project type: "project", "template", or "design_system".
+      The member's role before the change.
 
-    - `source_project_id: optional string or null`
+    - `project_type: optional string or null`
 
-      The source project this was created from, when created via duplicate, remix, or template-from-project. Unset for direct creation.
+      The project's type: "project", "template", or "design_system".
 
-  - `DesignProjectDeleted object`
+  - `DesignProjectPublished object`
 
-    A Claude Design project was deleted.
+    A Claude Design template or design system was published, making it discoverable by everyone in its organization.
 
-    - `type: optional "design_project_deleted"`
+    - `type: optional "design_project_published"`
 
-      default: design_project_deleted
+      default: design_project_published
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -160624,7 +162124,7 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
     - `design_project_id: string`
 
-      The Design project that was deleted, e.g. "design_proj_01HX...".
+      The Design project that was published, e.g. "design_proj_01HX...".
 
     - `id: optional string`
 
@@ -160644,13 +162144,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `DesignProjectMemberAdded object`
+    - `project_type: optional string or null`
 
-    A member was granted access to a Claude Design project.
+      The project's type: "template" or "design_system".
 
-    - `type: optional "design_project_member_added"`
+  - `DesignProjectSharingUpdated object`
 
-      default: design_project_member_added
+    A Claude Design project's link-sharing settings were changed — who the project's link works for, and what people opening it through the link may do. Access granted to individual members is reported separately (see design_project_member_added).
+
+    - `type: optional "design_project_sharing_updated"`
+
+      default: design_project_sharing_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -160860,19 +162364,15 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
     - `design_project_id: string`
 
-      The Design project the member was added to, e.g. "design_proj_01HX...".
-
-    - `principal_id: string`
-
-      The member's identifier: a tagged user ID (e.g. "user_01HX...") for "account", the group's identifier for "compartment", or the service's identifier for "trusted_service".
+      The Design project whose sharing settings changed, e.g. "design_proj_01HX...".
 
-    - `principal_type: string`
+    - `new_link_permission: string`
 
-      The kind of member that was added: "account" (a user), "compartment" (a named access group), or "trusted_service" (an authorized agent).
+      What people opening the project through its link may do after the change: "view", "comment", or "edit".
 
-    - `role: string`
+    - `new_scope: string`
 
-      The role the member was granted: "viewer", "commenter", or "editor". Access-group ("compartment") members are always view-only.
+      Who the project link is set to work for after the change: "invited" (only the owner and individually invited members) or "org" (anyone in the project's organization, where the organization's own sharing settings allow org-wide visibility). This records the project's stored setting as changed by the actor; organization-level settings can further restrict who the link actually admits, and changes to those settings are not project events. Projects created before link sharing was restricted may also report a legacy "public" value.
 
     - `id: optional string`
 
@@ -160892,17 +162392,25 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
+    - `previous_link_permission: optional string or null`
+
+      What people opening the project through its link could do before the change.
+
+    - `previous_scope: optional string or null`
+
+      Who the project link was set to work for before the change — the stored setting, with the same organization-level caveat as new_scope. May include the legacy "public" value.
+
     - `project_type: optional string or null`
 
       The project's type: "project", "template", or "design_system".
 
-  - `DesignProjectMemberRemoved object`
+  - `DesignProjectUnpublished object`
 
-    A member's access to a Claude Design project was revoked.
+    A Claude Design template or design system was unpublished, removing it from its organization's shared gallery.
 
-    - `type: optional "design_project_member_removed"`
+    - `type: optional "design_project_unpublished"`
 
-      default: design_project_member_removed
+      default: design_project_unpublished
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -161112,15 +162620,7 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
     - `design_project_id: string`
 
-      The Design project the member was removed from, e.g. "design_proj_01HX...".
-
-    - `principal_id: string`
-
-      The member's identifier: a tagged user ID (e.g. "user_01HX...") for "account", the group's identifier for "compartment", or the service's identifier for "trusted_service".
-
-    - `principal_type: string`
-
-      The kind of member that was removed: "account" (a user), "compartment" (a named access group), or "trusted_service" (an authorized agent).
+      The Design project that was unpublished, e.g. "design_proj_01HX...".
 
     - `id: optional string`
 
@@ -161142,15 +162642,15 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
     - `project_type: optional string or null`
 
-      The project's type: "project", "template", or "design_system".
+      The project's type: "template" or "design_system".
 
-  - `DesignProjectMemberRoleUpdated object`
+  - `DesignProjectUpdated object`
 
-    A Claude Design project member's role was changed.
+    A Claude Design project's metadata was updated.
 
-    - `type: optional "design_project_member_role_updated"`
+    - `type: optional "design_project_updated"`
 
-      default: design_project_member_role_updated
+      default: design_project_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -161360,19 +162860,7 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
     - `design_project_id: string`
 
-      The Design project the member belongs to, e.g. "design_proj_01HX...".
-
-    - `principal_id: string`
-
-      The member's identifier: a tagged user ID (e.g. "user_01HX...") for "account", the group's identifier for "compartment", or the service's identifier for "trusted_service".
-
-    - `principal_type: string`
-
-      The kind of member whose role was changed: "account" (a user), "compartment" (a named access group), or "trusted_service" (an authorized agent).
-
-    - `role: string`
-
-      The member's role after the change: "viewer", "commenter", or "editor".
+      The Design project that was updated, e.g. "design_proj_01HX...".
 
     - `id: optional string`
 
@@ -161392,21 +162880,21 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `previous_role: optional string or null`
+    - `project_type: optional string or null`
 
-      The member's role before the change.
+      The project's type after the update: "project", "template", or "design_system". Present only when the update changed it.
 
-    - `project_type: optional string or null`
+    - `updated_fields: optional array of string`
 
-      The project's type: "project", "template", or "design_system".
+      Names of the fields changed by this update, e.g. "name", "description", "project_type", "design_systems".
 
-  - `DesignProjectPublished object`
+  - `DesignProjectVersionRestored object`
 
-    A Claude Design template or design system was published, making it discoverable by everyone in its organization.
+    A Claude Design project's working tree was rolled back to a previously saved version, replacing its current files with that version's files.
 
-    - `type: optional "design_project_published"`
+    - `type: optional "design_project_version_restored"`
 
-      default: design_project_published
+      default: design_project_version_restored
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -161616,7 +163104,7 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
     - `design_project_id: string`
 
-      The Design project that was published, e.g. "design_proj_01HX...".
+      The Design project that was restored, e.g. "design_proj_01HX...".
 
     - `id: optional string`
 
@@ -161638,15 +163126,19 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
     - `project_type: optional string or null`
 
-      The project's type: "template" or "design_system".
+      The project's type: "project", "template", or "design_system".
 
-  - `DesignProjectSharingUpdated object`
+  - `DesignProjectViewed object`
 
-    A Claude Design project's link-sharing settings were changed — who the project's link works for, and what people opening it through the link may do. Access granted to individual members is reported separately (see design_project_member_added).
+    A Claude Design project's content was read. The surface field records which kind of read — a project open, a full-content read, a single-file read, a saved-version read, or an export request. The actor is the reader.
 
-    - `type: optional "design_project_sharing_updated"`
+    This activity type is retired: project content reads are no longer
+    recorded. Events of this type may still appear in feeds for reads that
+    occurred while it was active.
 
-      default: design_project_sharing_updated
+    - `type: optional "design_project_viewed"`
+
+      default: design_project_viewed
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -161856,20 +163348,20 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
     - `design_project_id: string`
 
-      The Design project whose sharing settings changed, e.g. "design_proj_01HX...".
-
-    - `new_link_permission: string`
-
-      What people opening the project through its link may do after the change: "view", "comment", or "edit".
+      The Design project whose content was read, e.g. "design_proj_01HX...".
 
-    - `new_scope: string`
+    - `surface: string`
 
-      Who the project link is set to work for after the change: "invited" (only the owner and individually invited members) or "org" (anyone in the project's organization, where the organization's own sharing settings allow org-wide visibility). This records the project's stored setting as changed by the actor; organization-level settings can further restrict who the link actually admits, and changes to those settings are not project events. Projects created before link sharing was restricted may also report a legacy "public" value.
+      Which read surface recorded this open: "project" (the project was opened), "project_data" (the project's full contents were read or made readable — either a direct data read, which also includes the project's conversations when the reader's access extends to them, or a render-token request, which exposes the project's files for the token's lifetime; the two share this value and are not distinguished), "file" (one of the project's files was read), "version" (a saved version of the project's files, including their contents, was read — version-history browsing that lists names without contents is not recorded), or "export" (an authenticated export of the project's contents was requested).
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
+    - `access_via: optional string or null`
+
+      How the viewer was authorized to open the project: "owner" (the project's owner), "member_grant" (an individually invited member), "org_link" (org-wide link sharing), "trusted_service" (an authorized agent), or "design_system_reference" (an indirect read of a design system through a project that uses it).
+
     - `created_at: optional string`
 
       When this activity occurred.
@@ -161884,25 +163376,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `previous_link_permission: optional string or null`
-
-      What people opening the project through its link could do before the change.
-
-    - `previous_scope: optional string or null`
-
-      Who the project link was set to work for before the change — the stored setting, with the same organization-level caveat as new_scope. May include the legacy "public" value.
-
     - `project_type: optional string or null`
 
       The project's type: "project", "template", or "design_system".
 
-  - `DesignProjectUnpublished object`
+  - `DesktopExtensionAllowlisted object`
 
-    A Claude Design template or design system was unpublished, removing it from its organization's shared gallery.
+    A desktop extension was added to an org's allowlist.
 
-    - `type: optional "design_project_unpublished"`
+    - `type: optional "desktop_extension_allowlisted"`
 
-      default: design_project_unpublished
+      default: desktop_extension_allowlisted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -162110,9 +163594,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `design_project_id: string`
+    - `extension_id: string`
 
-      The Design project that was unpublished, e.g. "design_proj_01HX...".
+      Allowlisted DXT extension ID
 
     - `id: optional string`
 
@@ -162132,17 +163616,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `project_type: optional string or null`
-
-      The project's type: "template" or "design_system".
-
-  - `DesignProjectUpdated object`
+  - `DesktopExtensionBlocklisted object`
 
-    A Claude Design project's metadata was updated.
+    A desktop extension was added to the global blocklist.
 
-    - `type: optional "design_project_updated"`
+    - `type: optional "desktop_extension_blocklisted"`
 
-      default: design_project_updated
+      default: desktop_extension_blocklisted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -162350,9 +163830,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `design_project_id: string`
+    - `extension_id: string`
 
-      The Design project that was updated, e.g. "design_proj_01HX...".
+      Blocklisted DXT extension ID
 
     - `id: optional string`
 
@@ -162372,21 +163852,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `project_type: optional string or null`
-
-      The project's type after the update: "project", "template", or "design_system". Present only when the update changed it.
-
-    - `updated_fields: optional array of string`
-
-      Names of the fields changed by this update, e.g. "name", "description", "project_type", "design_systems".
-
-  - `DesignProjectVersionRestored object`
+  - `DesktopExtensionDeleted object`
 
-    A Claude Design project's working tree was rolled back to a previously saved version, replacing its current files with that version's files.
+    A desktop extension was deleted, either globally by an admin or org-scoped by an org owner.
 
-    - `type: optional "design_project_version_restored"`
+    - `type: optional "desktop_extension_deleted"`
 
-      default: design_project_version_restored
+      default: desktop_extension_deleted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -162594,9 +164066,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `design_project_id: string`
+    - `extension_id: string`
 
-      The Design project that was restored, e.g. "design_proj_01HX...".
+      DXT extension ID
 
     - `id: optional string`
 
@@ -162616,21 +164088,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `project_type: optional string or null`
-
-      The project's type: "project", "template", or "design_system".
+    - `version: optional string or null`
 
-  - `DesignProjectViewed object`
+      Specific version deleted (null if all versions)
 
-    A Claude Design project's content was read. The surface field records which kind of read — a project open, a full-content read, a single-file read, a saved-version read, or an export request. The actor is the reader.
+  - `DesktopExtensionRemovedFromAllowlist object`
 
-    This activity type is retired: project content reads are no longer
-    recorded. Events of this type may still appear in feeds for reads that
-    occurred while it was active.
+    A desktop extension was removed from an org's allowlist.
 
-    - `type: optional "design_project_viewed"`
+    - `type: optional "desktop_extension_removed_from_allowlist"`
 
-      default: design_project_viewed
+      default: desktop_extension_removed_from_allowlist
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -162838,22 +164306,14 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `design_project_id: string`
-
-      The Design project whose content was read, e.g. "design_proj_01HX...".
-
-    - `surface: string`
+    - `extension_id: string`
 
-      Which read surface recorded this open: "project" (the project was opened), "project_data" (the project's full contents were read or made readable — either a direct data read, which also includes the project's conversations when the reader's access extends to them, or a render-token request, which exposes the project's files for the token's lifetime; the two share this value and are not distinguished), "file" (one of the project's files was read), "version" (a saved version of the project's files, including their contents, was read — version-history browsing that lists names without contents is not recorded), or "export" (an authenticated export of the project's contents was requested).
+      DXT extension ID removed from allowlist
 
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `access_via: optional string or null`
-
-      How the viewer was authorized to open the project: "owner" (the project's owner), "member_grant" (an individually invited member), "org_link" (org-wide link sharing), "trusted_service" (an authorized agent), or "design_system_reference" (an indirect read of a design system through a project that uses it).
-
     - `created_at: optional string`
 
       When this activity occurred.
@@ -162868,17 +164328,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `project_type: optional string or null`
-
-      The project's type: "project", "template", or "design_system".
-
-  - `DesktopExtensionAllowlisted object`
+  - `DesktopExtensionUnblocked object`
 
-    A desktop extension was added to an org's allowlist.
+    A desktop extension was removed from the global blocklist.
 
-    - `type: optional "desktop_extension_allowlisted"`
+    - `type: optional "desktop_extension_unblocked"`
 
-      default: desktop_extension_allowlisted
+      default: desktop_extension_unblocked
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -163088,7 +164544,7 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
     - `extension_id: string`
 
-      Allowlisted DXT extension ID
+      Unblocked DXT extension ID
 
     - `id: optional string`
 
@@ -163108,13 +164564,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `DesktopExtensionBlocklisted object`
+  - `DesktopExtensionUploaded object`
 
-    A desktop extension was added to the global blocklist.
+    A desktop extension was uploaded, either globally by an admin or org-scoped by an org owner.
 
-    - `type: optional "desktop_extension_blocklisted"`
+    - `type: optional "desktop_extension_uploaded"`
 
-      default: desktop_extension_blocklisted
+      default: desktop_extension_uploaded
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -163324,7 +164780,11 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
     - `extension_id: string`
 
-      Blocklisted DXT extension ID
+      DXT extension ID
+
+    - `version: string`
+
+      Version string from the manifest
 
     - `id: optional string`
 
@@ -163344,13 +164804,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `DesktopExtensionDeleted object`
+  - `DesktopExtensionVersionUploaded object`
 
-    A desktop extension was deleted, either globally by an admin or org-scoped by an org owner.
+    A new version of an existing org-owned desktop extension was uploaded.
 
-    - `type: optional "desktop_extension_deleted"`
+    - `type: optional "desktop_extension_version_uploaded"`
 
-      default: desktop_extension_deleted
+      default: desktop_extension_version_uploaded
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -163562,6 +165022,10 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       DXT extension ID
 
+    - `version: string`
+
+      Version string from the manifest
+
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
@@ -163580,17 +165044,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `version: optional string or null`
-
-      Specific version deleted (null if all versions)
-
-  - `DesktopExtensionRemovedFromAllowlist object`
+  - `InferenceHooksConfigDeleted object`
 
-    A desktop extension was removed from an org's allowlist.
+    Inference hooks configuration was removed for the organization.
 
-    - `type: optional "desktop_extension_removed_from_allowlist"`
+    - `type: optional "inference_hooks_config_deleted"`
 
-      default: desktop_extension_removed_from_allowlist
+      default: inference_hooks_config_deleted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -163798,10 +165258,6 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `extension_id: string`
-
-      DXT extension ID removed from allowlist
-
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
@@ -163820,13 +165276,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `DesktopExtensionUnblocked object`
+  - `InferenceHooksConfigUpdated object`
 
-    A desktop extension was removed from the global blocklist.
+    Inference hooks configuration was created or updated for the organization.
 
-    - `type: optional "desktop_extension_unblocked"`
+    - `type: optional "inference_hooks_config_updated"`
 
-      default: desktop_extension_unblocked
+      default: inference_hooks_config_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -164034,9 +165490,29 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `extension_id: string`
+    - `enabled: boolean`
 
-      Unblocked DXT extension ID
+      Whether Inference hooks enforcement is enabled after this change.
+
+    - `enforcement_mode: string`
+
+      Whether Inference hooks inspects both prompts and responses (prompt_and_response) or prompts only (prompt_only).
+
+    - `fail_mode: string`
+
+      Whether requests are allowed (fail_open) or blocked (fail_closed) when the Inference hooks endpoint cannot be reached.
+
+    - `final_verdict_timeout_ms: number`
+
+      Milliseconds inference waits for the Inference hooks verdict on the response.
+
+    - `prompt_verdict_timeout_ms: number`
+
+      Milliseconds inference waits for the Inference hooks verdict on the prompt.
+
+    - `webhook_url: string`
+
+      The endpoint that inspected prompts and responses are sent to.
 
     - `id: optional string`
 
@@ -164048,6 +165524,18 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
+    - `deny_message: optional string or null`
+
+      Administrator-written text shown to users at the end of the error message when a request is blocked by the organization's Inference hooks policy, as configured after this change. Null when the built-in default message is in effect; an empty string when the administrator configured an empty message, in which case no text is appended.
+
+    - `deny_message_enabled: optional boolean or null`
+
+      Whether the organization has the appended deny message turned on, as configured after this change. When on, the administrator-written message (or the built-in default, when none is configured) is appended to the error users see when a request is blocked by the organization's Inference hooks policy; no text is appended when the administrator-written message is empty, or when this is off.
+
+    - `extra_header_names: optional array of string or null`
+
+      Names of the custom HTTP headers attached to every Inference hooks request after this change, or null when this update did not change headers. Header values are write-only and are not recorded.
+
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -164056,13 +165544,25 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `DesktopExtensionUploaded object`
+    - `reset_circuit_breaker: optional boolean or null`
 
-    A desktop extension was uploaded, either globally by an admin or org-scoped by an org owner.
+      Whether this update carried an explicit request to clear the circuit breaker. A tripped breaker otherwise survives configuration updates; it also clears whenever an update enables enforcement.
 
-    - `type: optional "desktop_extension_uploaded"`
+    - `rollout_percentage: optional number or null`
 
-      default: desktop_extension_uploaded
+      Percentage of requests (0-100) inspected by Inference hooks after this change, or null when this update did not change it. 0 disables inspection; 100 inspects every request.
+
+    - `shadow_mode: optional boolean or null`
+
+      Whether the organization's Inference hooks run in shadow mode after this change, or null when this update did not change it. In shadow mode, prompts are still sent to the organization's endpoint and verdicts are recorded, but requests are never blocked.
+
+  - `InferenceHooksSigningSecretGenerated object`
+
+    A request signing secret was generated for the organization's Inference hooks configuration.
+
+    - `type: optional "inference_hooks_signing_secret_generated"`
+
+      default: inference_hooks_signing_secret_generated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -164270,13 +165770,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `extension_id: string`
-
-      DXT extension ID
-
-    - `version: string`
+    - `rotated: boolean`
 
-      Version string from the manifest
+      Whether this generation replaced an existing signing secret (true) or created the organization's first one (false). Replacing a secret invalidates the previous one immediately.
 
     - `id: optional string`
 
@@ -164296,13 +165792,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `DesktopExtensionVersionUploaded object`
+  - `DomainClaimInitiated object`
 
-    A new version of an existing org-owned desktop extension was uploaded.
+    Domain capture claim initiated over personal accounts on verified domains.
 
-    - `type: optional "desktop_extension_version_uploaded"`
+    - `type: optional "domain_claim_initiated"`
 
-      default: desktop_extension_version_uploaded
+      default: domain_claim_initiated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -164510,14 +166006,6 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `extension_id: string`
-
-      DXT extension ID
-
-    - `version: string`
-
-      Version string from the manifest
-
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
@@ -164536,13 +166024,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `InferenceHooksConfigDeleted object`
+  - `EndUserInviteRequested object`
 
-    Inference hooks configuration was removed for the organization.
+    Non-admin member submitted an invite request for a new org member.
 
-    - `type: optional "inference_hooks_config_deleted"`
+    - `type: optional "end_user_invite_requested"`
 
-      default: inference_hooks_config_deleted
+      default: end_user_invite_requested
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -164750,6 +166238,8 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
+    - `invitee_email: string`
+
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
@@ -164768,13 +166258,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `InferenceHooksConfigUpdated object`
+  - `ExtraUsageBillingEnabled object`
 
-    Inference hooks configuration was created or updated for the organization.
+    Usage credit billing was enabled for an organization.
 
-    - `type: optional "inference_hooks_config_updated"`
+    - `type: optional "extra_usage_billing_enabled"`
 
-      default: inference_hooks_config_updated
+      default: extra_usage_billing_enabled
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -164982,30 +166472,6 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `enabled: boolean`
-
-      Whether Inference hooks enforcement is enabled after this change.
-
-    - `enforcement_mode: string`
-
-      Whether Inference hooks inspects both prompts and responses (prompt_and_response) or prompts only (prompt_only).
-
-    - `fail_mode: string`
-
-      Whether requests are allowed (fail_open) or blocked (fail_closed) when the Inference hooks endpoint cannot be reached.
-
-    - `final_verdict_timeout_ms: number`
-
-      Milliseconds inference waits for the Inference hooks verdict on the response.
-
-    - `prompt_verdict_timeout_ms: number`
-
-      Milliseconds inference waits for the Inference hooks verdict on the prompt.
-
-    - `webhook_url: string`
-
-      The endpoint that inspected prompts and responses are sent to.
-
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
@@ -165016,18 +166482,6 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
-    - `deny_message: optional string or null`
-
-      Administrator-written text shown to users at the end of the error message when a request is blocked by the organization's Inference hooks policy, as configured after this change. Null when the built-in default message is in effect; an empty string when the administrator configured an empty message, in which case no text is appended.
-
-    - `deny_message_enabled: optional boolean or null`
-
-      Whether the organization has the appended deny message turned on, as configured after this change. When on, the administrator-written message (or the built-in default, when none is configured) is appended to the error users see when a request is blocked by the organization's Inference hooks policy; no text is appended when the administrator-written message is empty, or when this is off.
-
-    - `extra_header_names: optional array of string or null`
-
-      Names of the custom HTTP headers attached to every Inference hooks request after this change, or null when this update did not change headers. Header values are write-only and are not recorded.
-
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -165036,25 +166490,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `reset_circuit_breaker: optional boolean or null`
-
-      Whether this update carried an explicit request to clear the circuit breaker. A tripped breaker otherwise survives configuration updates; it also clears whenever an update enables enforcement.
-
-    - `rollout_percentage: optional number or null`
-
-      Percentage of requests (0-100) inspected by Inference hooks after this change, or null when this update did not change it. 0 disables inspection; 100 inspects every request.
-
-    - `shadow_mode: optional boolean or null`
-
-      Whether the organization's Inference hooks run in shadow mode after this change, or null when this update did not change it. In shadow mode, prompts are still sent to the organization's endpoint and verdicts are recorded, but requests are never blocked.
-
-  - `InferenceHooksSigningSecretGenerated object`
+  - `ExtraUsageCreditGranted object`
 
-    A request signing secret was generated for the organization's Inference hooks configuration.
+    A promotional usage credit grant was claimed.
 
-    - `type: optional "inference_hooks_signing_secret_generated"`
+    - `type: optional "extra_usage_credit_granted"`
 
-      default: inference_hooks_signing_secret_generated
+      default: extra_usage_credit_granted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -165262,10 +166704,6 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `rotated: boolean`
-
-      Whether this generation replaced an existing signing secret (true) or created the organization's first one (false). Replacing a secret invalidates the previous one immediately.
-
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
@@ -165284,13 +166722,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `DomainClaimInitiated object`
+  - `ExtraUsageSpendLimitCreated object`
 
-    Domain capture claim initiated over personal accounts on verified domains.
+    Usage credit spend limit was created.
 
-    - `type: optional "domain_claim_initiated"`
+    - `type: optional "extra_usage_spend_limit_created"`
 
-      default: domain_claim_initiated
+      default: extra_usage_spend_limit_created
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -165502,12 +166940,24 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
+    - `amount: optional number or null`
+
+      The monthly credit limit amount in minor units (e.g. cents).
+
     - `created_at: optional string`
 
       When this activity occurred.
 
       format: date-time
 
+    - `is_enabled: optional boolean or null`
+
+      Whether the spend limit is enabled.
+
+    - `limit_type: optional string or null`
+
+      The type of spend limit created (e.g. organization, seat_tier, member, service, group).
+
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -165516,13 +166966,23 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `EndUserInviteRequested object`
+    - `spend_limit_id: optional string or null`
 
-    Non-admin member submitted an invite request for a new org member.
+      Tagged ID of the spend limit.
 
-    - `type: optional "end_user_invite_requested"`
+    - `user_id: optional string or null`
 
-      default: end_user_invite_requested
+      **Deprecated**
+
+      Deprecated. Tagged ID of the admin who performed the action — not the target member. Use `spend_limit_id` to look up the target member.
+
+  - `ExtraUsageSpendLimitDeleted object`
+
+    Usage credit spend limit was deleted.
+
+    - `type: optional "extra_usage_spend_limit_deleted"`
+
+      default: extra_usage_spend_limit_deleted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -165730,8 +167190,6 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `invitee_email: string`
-
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
@@ -165750,13 +167208,23 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ExtraUsageBillingEnabled object`
+    - `spend_limit_id: optional string or null`
 
-    Usage credit billing was enabled for an organization.
+      Tagged ID of the spend limit.
 
-    - `type: optional "extra_usage_billing_enabled"`
+    - `user_id: optional string or null`
 
-      default: extra_usage_billing_enabled
+      **Deprecated**
+
+      Deprecated. Tagged ID of the admin who performed the action — not the target member. Use `spend_limit_id` to look up the target member.
+
+  - `ExtraUsageSpendLimitIncreaseRequestApproved object`
+
+    A usage credit spend limit increase request was approved.
+
+    - `type: optional "extra_usage_spend_limit_increase_request_approved"`
+
+      default: extra_usage_spend_limit_increase_request_approved
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -165968,6 +167436,10 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
+    - `amount: optional number or null`
+
+      The approved spend limit amount in minor units (e.g. cents).
+
     - `created_at: optional string`
 
       When this activity occurred.
@@ -165982,13 +167454,25 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ExtraUsageCreditGranted object`
+    - `requester_user_id: optional string or null`
 
-    A promotional usage credit grant was claimed.
+      Tagged ID of the member who requested the increase, e.g. "user_01HX...".
 
-    - `type: optional "extra_usage_credit_granted"`
+    - `spend_limit_id: optional string or null`
 
-      default: extra_usage_credit_granted
+      Tagged ID of the member's spend limit that the approval created or updated.
+
+    - `spend_limit_increase_request_id: optional string or null`
+
+      Tagged ID of the spend limit increase request that was approved.
+
+  - `ExtraUsageSpendLimitIncreaseRequestDenied object`
+
+    A usage credit spend limit increase request was denied.
+
+    - `type: optional "extra_usage_spend_limit_increase_request_denied"`
+
+      default: extra_usage_spend_limit_increase_request_denied
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -166214,13 +167698,21 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ExtraUsageSpendLimitCreated object`
+    - `requester_user_id: optional string or null`
 
-    Usage credit spend limit was created.
+      Tagged ID of the member who requested the increase, e.g. "user_01HX...".
 
-    - `type: optional "extra_usage_spend_limit_created"`
+    - `spend_limit_increase_request_id: optional string or null`
 
-      default: extra_usage_spend_limit_created
+      Tagged ID of the spend limit increase request that was denied.
+
+  - `ExtraUsageSpendLimitUpdated object`
+
+    Usage credit spend limit was updated.
+
+    - `type: optional "extra_usage_spend_limit_updated"`
+
+      default: extra_usage_spend_limit_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -166434,7 +167926,7 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
     - `amount: optional number or null`
 
-      The monthly credit limit amount in minor units (e.g. cents).
+      The new monthly credit limit amount in minor units (e.g. cents).
 
     - `created_at: optional string`
 
@@ -166448,7 +167940,7 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
     - `limit_type: optional string or null`
 
-      The type of spend limit created (e.g. organization, seat_tier, member, service, group).
+      The type of spend limit updated (e.g. organization, seat_tier, member, service, group).
 
     - `organization_id: optional string or null`
 
@@ -166468,13 +167960,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Deprecated. Tagged ID of the admin who performed the action — not the target member. Use `spend_limit_id` to look up the target member.
 
-  - `ExtraUsageSpendLimitDeleted object`
+  - `ClaudeFileDeleted object`
 
-    Usage credit spend limit was deleted.
+    A file was deleted.
 
-    - `type: optional "extra_usage_spend_limit_deleted"`
+    - `type: optional "claude_file_deleted"`
 
-      default: extra_usage_spend_limit_deleted
+      default: claude_file_deleted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -166682,6 +168174,10 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
+    - `claude_file_id: string`
+
+      Tagged ID of the file that was deleted, e.g. "claude_file_01HX...".
+
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
@@ -166692,6 +168188,10 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
+    - `filename: optional string or null`
+
+      Name of the deleted file, when known.
+
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -166700,23 +168200,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `spend_limit_id: optional string or null`
-
-      Tagged ID of the spend limit.
-
-    - `user_id: optional string or null`
-
-      **Deprecated**
-
-      Deprecated. Tagged ID of the admin who performed the action — not the target member. Use `spend_limit_id` to look up the target member.
-
-  - `ExtraUsageSpendLimitIncreaseRequestApproved object`
+  - `ClaudeFileUploaded object`
 
-    A usage credit spend limit increase request was approved.
+    A file was uploaded.
 
-    - `type: optional "extra_usage_spend_limit_increase_request_approved"`
+    - `type: optional "claude_file_uploaded"`
 
-      default: extra_usage_spend_limit_increase_request_approved
+      default: claude_file_uploaded
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -166924,13 +168414,21 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
+    - `claude_file_id: string`
+
+      Tagged ID of the file that was uploaded, e.g. "claude_file_01HX...".
+
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `amount: optional number or null`
+    - `claude_chat_id: optional string or null`
 
-      The approved spend limit amount in minor units (e.g. cents).
+      Chat ID if known at upload time (null for the upload-then-attach flow). To find which chats a file was later attached to, use `GET /v1/compliance/apps/chats/files/{claude_file_id}`.
+
+    - `claude_project_id: optional string or null`
+
+      Project ID if file was uploaded to a project
 
     - `created_at: optional string`
 
@@ -166938,6 +168436,10 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
+    - `filename: optional string or null`
+
+      Name of the uploaded file, when known.
+
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -166946,25 +168448,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `requester_user_id: optional string or null`
-
-      Tagged ID of the member who requested the increase, e.g. "user_01HX...".
-
-    - `spend_limit_id: optional string or null`
-
-      Tagged ID of the member's spend limit that the approval created or updated.
-
-    - `spend_limit_increase_request_id: optional string or null`
-
-      Tagged ID of the spend limit increase request that was approved.
-
-  - `ExtraUsageSpendLimitIncreaseRequestDenied object`
+  - `GheConfigurationCreated object`
 
-    A usage credit spend limit increase request was denied.
+    Admin created a GHE configuration.
 
-    - `type: optional "extra_usage_spend_limit_increase_request_denied"`
+    - `type: optional "ghe_configuration_created"`
 
-      default: extra_usage_spend_limit_increase_request_denied
+      default: ghe_configuration_created
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -167172,6 +168662,10 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
+    - `ghe_configuration_id: string`
+
+      ID of the GHE configuration
+
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
@@ -167182,6 +168676,14 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
+    - `display_name: optional string or null`
+
+      Display name given to the configuration
+
+    - `hostname: optional string or null`
+
+      Hostname of the GitHub Enterprise instance
+
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -167190,21 +168692,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `requester_user_id: optional string or null`
-
-      Tagged ID of the member who requested the increase, e.g. "user_01HX...".
-
-    - `spend_limit_increase_request_id: optional string or null`
+    - `port: optional number or null`
 
-      Tagged ID of the spend limit increase request that was denied.
+      Custom port, if not the HTTPS default
 
-  - `ExtraUsageSpendLimitUpdated object`
+  - `GheConfigurationDeleted object`
 
-    Usage credit spend limit was updated.
+    Admin deleted a GHE configuration.
 
-    - `type: optional "extra_usage_spend_limit_updated"`
+    - `type: optional "ghe_configuration_deleted"`
 
-      default: extra_usage_spend_limit_updated
+      default: ghe_configuration_deleted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -167412,13 +168910,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `id: optional string`
+    - `ghe_configuration_id: string`
 
-      Unique identifier for the activity e.g. 'activity_abcd1234'
+      ID of the GHE configuration
 
-    - `amount: optional number or null`
+    - `id: optional string`
 
-      The new monthly credit limit amount in minor units (e.g. cents).
+      Unique identifier for the activity e.g. 'activity_abcd1234'
 
     - `created_at: optional string`
 
@@ -167426,13 +168924,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
-    - `is_enabled: optional boolean or null`
+    - `display_name: optional string or null`
 
-      Whether the spend limit is enabled.
+      Display name the configuration had when deleted
 
-    - `limit_type: optional string or null`
+    - `hostname: optional string or null`
 
-      The type of spend limit updated (e.g. organization, seat_tier, member, service, group).
+      Hostname of the GitHub Enterprise instance
 
     - `organization_id: optional string or null`
 
@@ -167442,23 +168940,17 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `spend_limit_id: optional string or null`
-
-      Tagged ID of the spend limit.
-
-    - `user_id: optional string or null`
-
-      **Deprecated**
+    - `port: optional number or null`
 
-      Deprecated. Tagged ID of the admin who performed the action — not the target member. Use `spend_limit_id` to look up the target member.
+      Custom port, if not the HTTPS default
 
-  - `ClaudeFileDeleted object`
+  - `GheConfigurationUpdated object`
 
-    A file was deleted.
+    Admin updated a GHE configuration. Previous/new field pairs are recorded only for settings that changed in the update; secret credentials are never recorded, only whether they were replaced.
 
-    - `type: optional "claude_file_deleted"`
+    - `type: optional "ghe_configuration_updated"`
 
-      default: claude_file_deleted
+      default: ghe_configuration_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -167666,9 +169158,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `claude_file_id: string`
+    - `ghe_configuration_id: string`
 
-      Tagged ID of the file that was deleted, e.g. "claude_file_01HX...".
+      ID of the GHE configuration
 
     - `id: optional string`
 
@@ -167680,9 +169172,37 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
-    - `filename: optional string or null`
+    - `custom_ca_certificate_updated: optional boolean or null`
 
-      Name of the deleted file, when known.
+      Whether the custom CA certificate was replaced in this update
+
+    - `display_name: optional string or null`
+
+      New display name, when it changed
+
+    - `github_app_client_id: optional string or null`
+
+      New GitHub App client ID, when it changed
+
+    - `github_app_client_secret_updated: optional boolean or null`
+
+      Whether the GitHub App client secret was replaced in this update
+
+    - `github_app_id: optional number or null`
+
+      New GitHub App ID, when it changed
+
+    - `github_app_private_key_updated: optional boolean or null`
+
+      Whether the GitHub App private key was replaced in this update
+
+    - `hostname: optional string or null`
+
+      Hostname of the GitHub Enterprise instance (immutable; included for context)
+
+    - `is_active: optional boolean or null`
+
+      New active state, when it changed
 
     - `organization_id: optional string or null`
 
@@ -167692,13 +169212,45 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeFileUploaded object`
+    - `port: optional number or null`
 
-    A file was uploaded.
+      New port, when it changed
 
-    - `type: optional "claude_file_uploaded"`
+    - `previous_display_name: optional string or null`
 
-      default: claude_file_uploaded
+      Display name before the change, when it changed
+
+    - `previous_github_app_client_id: optional string or null`
+
+      GitHub App client ID before the change, when it changed
+
+    - `previous_github_app_id: optional number or null`
+
+      GitHub App ID before the change, when it changed
+
+    - `previous_is_active: optional boolean or null`
+
+      Active state before the change, when it changed
+
+    - `previous_port: optional number or null`
+
+      Port before the change, when it changed
+
+    - `read_replica_hostnames_updated: optional boolean or null`
+
+      Whether the read replica hostnames were replaced in this update
+
+    - `webhook_secret_updated: optional boolean or null`
+
+      Whether the webhook secret was replaced in this update
+
+  - `GheUserConnected object`
+
+    User connected to a GHE instance.
+
+    - `type: optional "ghe_user_connected"`
+
+      default: ghe_user_connected
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -167906,31 +169458,19 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `claude_file_id: string`
-
-      Tagged ID of the file that was uploaded, e.g. "claude_file_01HX...".
-
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
 
-    - `claude_chat_id: optional string or null`
-
-      Chat ID if known at upload time (null for the upload-then-attach flow). To find which chats a file was later attached to, use `GET /v1/compliance/apps/chats/files/{claude_file_id}`.
-
-    - `claude_project_id: optional string or null`
-
-      Project ID if file was uploaded to a project
-
     - `created_at: optional string`
 
       When this activity occurred.
 
       format: date-time
 
-    - `filename: optional string or null`
+    - `ghe_configuration_id: optional string or null`
 
-      Name of the uploaded file, when known.
+      ID of the GHE configuration
 
     - `organization_id: optional string or null`
 
@@ -167940,13 +169480,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `GheConfigurationCreated object`
+  - `GheUserDisconnected object`
 
-    Admin created a GHE configuration.
+    User disconnected from a GHE instance.
 
-    - `type: optional "ghe_configuration_created"`
+    - `type: optional "ghe_user_disconnected"`
 
-      default: ghe_configuration_created
+      default: ghe_user_disconnected
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -168154,10 +169694,6 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `ghe_configuration_id: string`
-
-      ID of the GHE configuration
-
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
@@ -168168,13 +169704,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
-    - `display_name: optional string or null`
-
-      Display name given to the configuration
-
-    - `hostname: optional string or null`
+    - `ghe_configuration_id: optional string or null`
 
-      Hostname of the GitHub Enterprise instance
+      ID of the GHE configuration
 
     - `organization_id: optional string or null`
 
@@ -168184,17 +169716,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `port: optional number or null`
-
-      Custom port, if not the HTTPS default
-
-  - `GheConfigurationDeleted object`
+  - `GheWebhookSignatureInvalid object`
 
-    Admin deleted a GHE configuration.
+    Webhook signature validation failed.
 
-    - `type: optional "ghe_configuration_deleted"`
+    - `type: optional "ghe_webhook_signature_invalid"`
 
-      default: ghe_configuration_deleted
+      default: ghe_webhook_signature_invalid
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -168416,14 +169944,6 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
-    - `display_name: optional string or null`
-
-      Display name the configuration had when deleted
-
-    - `hostname: optional string or null`
-
-      Hostname of the GitHub Enterprise instance
-
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
@@ -168432,17 +169952,13 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `port: optional number or null`
-
-      Custom port, if not the HTTPS default
-
-  - `GheConfigurationUpdated object`
+  - `ClaudeGitHubIntegrationCreated object`
 
-    Admin updated a GHE configuration. Previous/new field pairs are recorded only for settings that changed in the update; secret credentials are never recorded, only whether they were replaced.
+    A GitHub integration was enabled for the organization.
 
-    - `type: optional "ghe_configuration_updated"`
+    - `type: optional "claude_github_integration_created"`
 
-      default: ghe_configuration_updated
+      default: claude_github_integration_created
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -168650,9 +170166,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `ghe_configuration_id: string`
+    - `integration_id: string`
 
-      ID of the GHE configuration
+      Tagged ID of the GitHub integration, e.g. "claude_sync_source_01HX...".
 
     - `id: optional string`
 
@@ -168664,85 +170180,37 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
-    - `custom_ca_certificate_updated: optional boolean or null`
-
-      Whether the custom CA certificate was replaced in this update
-
-    - `display_name: optional string or null`
-
-      New display name, when it changed
-
-    - `github_app_client_id: optional string or null`
-
-      New GitHub App client ID, when it changed
-
-    - `github_app_client_secret_updated: optional boolean or null`
-
-      Whether the GitHub App client secret was replaced in this update
-
-    - `github_app_id: optional number or null`
-
-      New GitHub App ID, when it changed
-
-    - `github_app_private_key_updated: optional boolean or null`
-
-      Whether the GitHub App private key was replaced in this update
-
-    - `hostname: optional string or null`
-
-      Hostname of the GitHub Enterprise instance (immutable; included for context)
-
-    - `is_active: optional boolean or null`
+    - `enabled: optional boolean or null`
 
-      New active state, when it changed
+      Whether the integration is enabled after this change.
 
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
 
-    - `organization_uuid: optional string or null`
-
-      Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
-
-    - `port: optional number or null`
-
-      New port, when it changed
-
-    - `previous_display_name: optional string or null`
-
-      Display name before the change, when it changed
-
-    - `previous_github_app_client_id: optional string or null`
-
-      GitHub App client ID before the change, when it changed
-
-    - `previous_github_app_id: optional number or null`
-
-      GitHub App ID before the change, when it changed
-
-    - `previous_is_active: optional boolean or null`
+    - `organization_name: optional string or null`
 
-      Active state before the change, when it changed
+      Name of the GitHub organization the integration is connected to, when known.
 
-    - `previous_port: optional number or null`
+    - `organization_uuid: optional string or null`
 
-      Port before the change, when it changed
+      Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `read_replica_hostnames_updated: optional boolean or null`
+    - `previous_enabled: optional boolean or null`
 
-      Whether the read replica hostnames were replaced in this update
+      Whether the integration was enabled before this change; null when the integration had never been configured.
 
-    - `webhook_secret_updated: optional boolean or null`
+    - `repository_name: optional string or null`
 
-      Whether the webhook secret was replaced in this update
+      Name of the GitHub repository the integration is connected to, when known.
 
-  - `GheUserConnected object`
+  - `ClaudeGitHubIntegrationDeleted object`
 
-    User connected to a GHE instance.
+    A GitHub integration was disabled for the organization.
 
-    - `type: optional "ghe_user_connected"`
+    - `type: optional "claude_github_integration_deleted"`
 
-      default: ghe_user_connected
+      default: claude_github_integration_deleted
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -168950,6 +170418,10 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
+    - `integration_id: string`
+
+      Tagged ID of the GitHub integration, e.g. "claude_sync_source_01HX...".
+
     - `id: optional string`
 
       Unique identifier for the activity e.g. 'activity_abcd1234'
@@ -168960,261 +170432,37 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
-    - `ghe_configuration_id: optional string or null`
+    - `enabled: optional boolean or null`
 
-      ID of the GHE configuration
+      Whether the integration is enabled after this change.
 
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
 
-    - `organization_uuid: optional string or null`
-
-      Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
-
-  - `GheUserDisconnected object`
-
-    User disconnected from a GHE instance.
-
-    - `type: optional "ghe_user_disconnected"`
-
-      default: ghe_user_disconnected
-
-    - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
-
-      - `APIActor object`
-
-        - `type: optional "api_actor"`
-
-          default: api_actor
-
-        - `api_key_id: string`
-
-        - `ip_address: string`
-
-        - `user_agent: string`
-
-      - `UserActor object`
-
-        - `type: optional "user_actor"`
-
-          default: user_actor
-
-        - `email_address: string`
-
-          format: email
-
-        - `ip_address: string`
-
-        - `user_agent: string`
-
-        - `user_id: string`
-
-      - `UnauthenticatedUserActor object`
-
-        - `type: optional "unauthenticated_user_actor"`
-
-          default: unauthenticated_user_actor
-
-        - `ip_address: string`
-
-        - `user_agent: string`
-
-        - `unauthenticated_email_address: optional string or null`
-
-          format: email
-
-      - `AnthropicActor object`
-
-        - `type: optional "anthropic_actor"`
-
-          default: anthropic_actor
-
-        - `email_address: optional string or null`
-
-          format: email
-
-      - `SystemActor object`
-
-        Automated background processing performed by Anthropic systems, acting
-        without a user or customer credential.
-
-        - `type: optional "system_actor"`
-
-          default: system_actor
-
-        - `service: optional string or null`
-
-          Name of the automated process that performed the action, when known.
-
-      - `AdminAPIKeyActor object`
-
-        - `type: optional "admin_api_key_actor"`
-
-          default: admin_api_key_actor
-
-        - `admin_api_key_id: string`
-
-        - `ip_address: string`
-
-        - `user_agent: string`
-
-      - `ServiceAccountActor object`
-
-        - `type: optional "service_account_actor"`
-
-          default: service_account_actor
-
-        - `ip_address: string`
-
-        - `service_account_id: string`
-
-        - `user_agent: string`
-
-      - `ScimDirectorySyncActor object`
-
-        - `type: optional "scim_directory_sync_actor"`
-
-          default: scim_directory_sync_actor
-
-        - `directory_id: string`
-
-        - `workos_event_id: string`
-
-        - `idp_connection_type: optional string or null`
-
-      - `FederatedIdentityActor object`
-
-        A federated external workload authenticated via a verified OIDC token.
-
-        Carries the verified issuer, subject, and audience claims from the
-        presented JWT.
-
-        - `type: optional "federated_identity_actor"`
-
-          default: federated_identity_actor
-
-        - `issuer: string`
-
-        - `subject: string`
-
-        - `audience: optional array of string`
-
-        - `ip_address: optional string or null`
-
-        - `user_agent: optional string or null`
-
-      - `FederatedActor object`
-
-        An external identity asserted by a trusted provider — a cloud-provider
-        gateway or a customer-registered federation issuer — acting without an
-        Anthropic-provisioned account or service account.
-
-        - `type: optional "federated_actor"`
-
-          default: federated_actor
-
-        - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
-
-          - `FederatedActorAwsProvider object`
-
-            Asserting party: the AWS account the organization is bound to.
-
-            - `type: optional "aws"`
-
-              default: aws
-
-            - `account_id: string`
-
-            - `signed_principal: string`
-
-              The AWS-signed ARN of the IAM principal that requested the token.
-
-          - `FederatedActorAzureProvider object`
-
-            Asserting party: the Azure subscription the organization is bound to.
-
-            - `type: optional "azure"`
-
-              default: azure
-
-            - `subscription_id: string`
-
-          - `FederatedActorGcpProvider object`
-
-            Asserting party: the GCP project the organization is bound to.
-
-            - `type: optional "gcp"`
-
-              default: gcp
-
-            - `project_number: string`
-
-          - `FederatedActorOidcProvider object`
-
-            Asserting party: a customer-registered OIDC federation issuer.
-
-            - `type: optional "oidc"`
-
-              default: oidc
-
-            - `issuer: optional string or null`
-
-              The federation issuer's URL. Null when the presented credential failed verification.
-
-        - `ip_address: optional string or null`
-
-        - `subject: optional string or null`
-
-          The provider's verified identifier for the caller; its form depends on the provider.
-
-        - `user_agent: optional string or null`
-
-      - `AttestedDeviceActor object`
-
-        An attested mobile device authenticated via Apple App Attest.
-
-        - `type: optional "attested_device_actor"`
-
-          default: attested_device_actor
-
-        - `external_client_id: string`
-
-        - `kid_hash: string`
-
-        - `ip_address: optional string or null`
-
-        - `user_agent: optional string or null`
-
-    - `id: optional string`
-
-      Unique identifier for the activity e.g. 'activity_abcd1234'
-
-    - `created_at: optional string`
-
-      When this activity occurred.
+    - `organization_name: optional string or null`
 
-      format: date-time
+      Name of the GitHub organization the integration was connected to, when known.
 
-    - `ghe_configuration_id: optional string or null`
+    - `organization_uuid: optional string or null`
 
-      ID of the GHE configuration
+      Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `organization_id: optional string or null`
+    - `previous_enabled: optional boolean or null`
 
-      Organization ID this activity is associated with
+      Whether the integration was enabled before this change; null when the integration had never been configured.
 
-    - `organization_uuid: optional string or null`
+    - `repository_name: optional string or null`
 
-      Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
+      Name of the GitHub repository the integration was connected to, when known.
 
-  - `GheWebhookSignatureInvalid object`
+  - `ClaudeGitHubIntegrationUpdated object`
 
-    Webhook signature validation failed.
+    A GitHub integration's configuration was updated.
 
-    - `type: optional "ghe_webhook_signature_invalid"`
+    - `type: optional "claude_github_integration_updated"`
 
-      default: ghe_webhook_signature_invalid
+      default: claude_github_integration_updated
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -169422,9 +170670,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `ghe_configuration_id: string`
+    - `integration_id: string`
 
-      ID of the GHE configuration
+      Tagged ID of the GitHub integration, e.g. "claude_sync_source_01HX...".
 
     - `id: optional string`
 
@@ -169440,17 +170688,25 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization ID this activity is associated with
 
+    - `organization_name: optional string or null`
+
+      Name of the GitHub organization the integration is connected to, when known.
+
     - `organization_uuid: optional string or null`
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-  - `ClaudeGitHubIntegrationCreated object`
+    - `repository_name: optional string or null`
 
-    A GitHub integration was enabled for the organization.
+      Name of the GitHub repository the integration is connected to, when known.
 
-    - `type: optional "claude_github_integration_created"`
+  - `GitHubAppInstallationLinked object`
 
-      default: claude_github_integration_created
+    An installation of the Claude GitHub App (a GitHub organization or user account where the App is installed) was linked to the organization, letting the organization's Claude Code features act on that GitHub account's repositories.
+
+    - `type: optional "github_app_installation_linked"`
+
+      default: github_app_installation_linked
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -169658,9 +170914,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `integration_id: string`
+    - `github_installation_id: number`
 
-      Tagged ID of the GitHub integration, e.g. "claude_sync_source_01HX...".
+      Numeric GitHub ID of the installation that was linked
 
     - `id: optional string`
 
@@ -169672,37 +170928,29 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
-    - `enabled: optional boolean or null`
+    - `github_account_login: optional string or null`
 
-      Whether the integration is enabled after this change.
+      Login of the GitHub organization or user account the App is installed on
 
-    - `organization_id: optional string or null`
+    - `github_account_type: optional string or null`
 
-      Organization ID this activity is associated with
+      Whether that GitHub account is an organization or a user account, as reported by GitHub ("Organization" or "User")
 
-    - `organization_name: optional string or null`
+    - `organization_id: optional string or null`
 
-      Name of the GitHub organization the integration is connected to, when known.
+      Organization ID this activity is associated with
 
     - `organization_uuid: optional string or null`
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `previous_enabled: optional boolean or null`
-
-      Whether the integration was enabled before this change; null when the integration had never been configured.
-
-    - `repository_name: optional string or null`
+  - `GitHubAppInstallationUnlinked object`
 
-      Name of the GitHub repository the integration is connected to, when known.
+    An installation of the Claude GitHub App was unlinked from the organization, so the organization's Claude Code features can no longer act on that GitHub account's repositories through it.
 
-  - `ClaudeGitHubIntegrationDeleted object`
+    - `type: optional "github_app_installation_unlinked"`
 
-    A GitHub integration was disabled for the organization.
-
-    - `type: optional "claude_github_integration_deleted"`
-
-      default: claude_github_integration_deleted
+      default: github_app_installation_unlinked
 
     - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
 
@@ -169910,9 +171158,9 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
         - `user_agent: optional string or null`
 
-    - `integration_id: string`
+    - `github_installation_id: number`
 
-      Tagged ID of the GitHub integration, e.g. "claude_sync_source_01HX...".
+      Numeric GitHub ID of the installation that was unlinked
 
     - `id: optional string`
 
@@ -169924,274 +171172,22 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       format: date-time
 
-    - `enabled: optional boolean or null`
-
-      Whether the integration is enabled after this change.
-
-    - `organization_id: optional string or null`
-
-      Organization ID this activity is associated with
-
-    - `organization_name: optional string or null`
-
-      Name of the GitHub organization the integration was connected to, when known.
-
-    - `organization_uuid: optional string or null`
-
-      Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
-
-    - `previous_enabled: optional boolean or null`
-
-      Whether the integration was enabled before this change; null when the integration had never been configured.
-
-    - `repository_name: optional string or null`
-
-      Name of the GitHub repository the integration was connected to, when known.
-
-  - `ClaudeGitHubIntegrationUpdated object`
-
-    A GitHub integration's configuration was updated.
-
-    - `type: optional "claude_github_integration_updated"`
-
-      default: claude_github_integration_updated
-
-    - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
-
-      - `APIActor object`
-
-        - `type: optional "api_actor"`
-
-          default: api_actor
-
-        - `api_key_id: string`
-
-        - `ip_address: string`
-
-        - `user_agent: string`
-
-      - `UserActor object`
-
-        - `type: optional "user_actor"`
-
-          default: user_actor
-
-        - `email_address: string`
-
-          format: email
-
-        - `ip_address: string`
-
-        - `user_agent: string`
-
-        - `user_id: string`
-
-      - `UnauthenticatedUserActor object`
-
-        - `type: optional "unauthenticated_user_actor"`
-
-          default: unauthenticated_user_actor
-
-        - `ip_address: string`
-
-        - `user_agent: string`
-
-        - `unauthenticated_email_address: optional string or null`
-
-          format: email
-
-      - `AnthropicActor object`
-
-        - `type: optional "anthropic_actor"`
-
-          default: anthropic_actor
-
-        - `email_address: optional string or null`
-
-          format: email
-
-      - `SystemActor object`
-
-        Automated background processing performed by Anthropic systems, acting
-        without a user or customer credential.
-
-        - `type: optional "system_actor"`
-
-          default: system_actor
-
-        - `service: optional string or null`
-
-          Name of the automated process that performed the action, when known.
-
-      - `AdminAPIKeyActor object`
-
-        - `type: optional "admin_api_key_actor"`
-
-          default: admin_api_key_actor
-
-        - `admin_api_key_id: string`
-
-        - `ip_address: string`
-
-        - `user_agent: string`
-
-      - `ServiceAccountActor object`
-
-        - `type: optional "service_account_actor"`
-
-          default: service_account_actor
-
-        - `ip_address: string`
-
-        - `service_account_id: string`
-
-        - `user_agent: string`
-
-      - `ScimDirectorySyncActor object`
-
-        - `type: optional "scim_directory_sync_actor"`
-
-          default: scim_directory_sync_actor
-
-        - `directory_id: string`
-
-        - `workos_event_id: string`
-
-        - `idp_connection_type: optional string or null`
-
-      - `FederatedIdentityActor object`
-
-        A federated external workload authenticated via a verified OIDC token.
-
-        Carries the verified issuer, subject, and audience claims from the
-        presented JWT.
-
-        - `type: optional "federated_identity_actor"`
-
-          default: federated_identity_actor
-
-        - `issuer: string`
-
-        - `subject: string`
-
-        - `audience: optional array of string`
-
-        - `ip_address: optional string or null`
-
-        - `user_agent: optional string or null`
-
-      - `FederatedActor object`
-
-        An external identity asserted by a trusted provider — a cloud-provider
-        gateway or a customer-registered federation issuer — acting without an
-        Anthropic-provisioned account or service account.
-
-        - `type: optional "federated_actor"`
-
-          default: federated_actor
-
-        - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
-
-          - `FederatedActorAwsProvider object`
-
-            Asserting party: the AWS account the organization is bound to.
-
-            - `type: optional "aws"`
-
-              default: aws
-
-            - `account_id: string`
-
-            - `signed_principal: string`
-
-              The AWS-signed ARN of the IAM principal that requested the token.
-
-          - `FederatedActorAzureProvider object`
-
-            Asserting party: the Azure subscription the organization is bound to.
-
-            - `type: optional "azure"`
-
-              default: azure
-
-            - `subscription_id: string`
-
-          - `FederatedActorGcpProvider object`
-
-            Asserting party: the GCP project the organization is bound to.
+    - `github_account_login: optional string or null`
 
-            - `type: optional "gcp"`
+      Login of the GitHub organization or user account the App is installed on
 
-              default: gcp
+    - `github_account_type: optional string or null`
 
-            - `project_number: string`
-
-          - `FederatedActorOidcProvider object`
-
-            Asserting party: a customer-registered OIDC federation issuer.
-
-            - `type: optional "oidc"`
-
-              default: oidc
-
-            - `issuer: optional string or null`
-
-              The federation issuer's URL. Null when the presented credential failed verification.
-
-        - `ip_address: optional string or null`
-
-        - `subject: optional string or null`
-
-          The provider's verified identifier for the caller; its form depends on the provider.
-
-        - `user_agent: optional string or null`
-
-      - `AttestedDeviceActor object`
-
-        An attested mobile device authenticated via Apple App Attest.
-
-        - `type: optional "attested_device_actor"`
-
-          default: attested_device_actor
-
-        - `external_client_id: string`
-
-        - `kid_hash: string`
-
-        - `ip_address: optional string or null`
-
-        - `user_agent: optional string or null`
-
-    - `integration_id: string`
-
-      Tagged ID of the GitHub integration, e.g. "claude_sync_source_01HX...".
-
-    - `id: optional string`
-
-      Unique identifier for the activity e.g. 'activity_abcd1234'
-
-    - `created_at: optional string`
-
-      When this activity occurred.
-
-      format: date-time
+      Whether that GitHub account is an organization or a user account, as reported by GitHub ("Organization" or "User")
 
     - `organization_id: optional string or null`
 
       Organization ID this activity is associated with
 
-    - `organization_name: optional string or null`
-
-      Name of the GitHub organization the integration is connected to, when known.
-
     - `organization_uuid: optional string or null`
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
-    - `repository_name: optional string or null`
-
-      Name of the GitHub repository the integration is connected to, when known.
-
   - `GitHubTokenImport object`
 
     A user attempted to import a personal GitHub access token for use with Claude Code. The `result` field indicates the outcome of the import (imported, rejected, or failed).
@@ -205456,7 +206452,7 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       - `ClaudeCodeWebEnabled object`
 
-        The Claude Code on the web setting was changed for the organization.
+        The Claude Code cloud sessions setting was changed for the organization.
 
         - `type: optional "claude_code_web_enabled"`
 
@@ -250185,6 +251181,10 @@ curl https://api.anthropic.com/v1/compliance/activities \
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
+    - `tunnel_token_id: optional string or null`
+
+      Id of the tunnel token issued with the tunnel and returned once in the create response; set only when creating the tunnel also issued its token, and absent for a tunnel whose token is revealed separately
+
   - `TunnelTokenMinted object`
 
     An OAuth bearer token for the tunnel management API was minted.
diff --git a/content/en/api/compliance/activities/list.md b/content/en/api/compliance/activities/list.md
index 22d9f332b3..e9390002fd 100644
--- a/content/en/api/compliance/activities/list.md
+++ b/content/en/api/compliance/activities/list.md
@@ -15,7 +15,7 @@ compliance activities that can be filtered by various criteria.
 
 ## Query parameters
 
-- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 501 more`
+- `activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 503 more`
 
   Filter activities by type. See the response `data` schema for the additional fields each type returns. Cannot be combined with `exclude_activity_types[]`.
 
@@ -819,6 +819,14 @@ compliance activities that can be filtered by various criteria.
 
     Webhook signature validation failed.
 
+  - `"github_app_installation_linked"`
+
+    An installation of the Claude GitHub App (a GitHub organization or user account where the App is installed) was linked to the organization, letting the organization's Claude Code features act on that GitHub account's repositories.
+
+  - `"github_app_installation_unlinked"`
+
+    An installation of the Claude GitHub App was unlinked from the organization, so the organization's Claude Code features can no longer act on that GitHub account's repositories through it.
+
   - `"github_token_import"`
 
     A user attempted to import a personal GitHub access token for use with Claude Code. The `result` field indicates the outcome of the import (imported, rejected, or failed).
@@ -2090,7 +2098,7 @@ compliance activities that can be filtered by various criteria.
 
     format: date-time
 
-- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 501 more`
+- `exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 503 more`
 
   Exclude activities of these types. Cannot be combined with `activity_types[]`.
 
@@ -2894,6 +2902,14 @@ compliance activities that can be filtered by various criteria.
 
     Webhook signature validation failed.
 
+  - `"github_app_installation_linked"`
+
+    An installation of the Claude GitHub App (a GitHub organization or user account where the App is installed) was linked to the organization, letting the organization's Claude Code features act on that GitHub account's repositories.
+
+  - `"github_app_installation_unlinked"`
+
+    An installation of the Claude GitHub App was unlinked from the organization, so the organization's Claude Code features can no longer act on that GitHub account's repositories through it.
+
   - `"github_token_import"`
 
     A user attempted to import a personal GitHub access token for use with Claude Code. The `result` field indicates the outcome of the import (imported, rejected, or failed).
@@ -4157,7 +4173,7 @@ compliance activities that can be filtered by various criteria.
 
 ## Returns
 
-- `data: optional array of AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 501 more`
+- `data: optional array of AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 503 more`
 
   List of activity records. Each element's `type` field identifies which activity it is and which additional fields are present.
 
@@ -45053,6 +45069,494 @@ compliance activities that can be filtered by various criteria.
 
       Name of the GitHub repository the integration is connected to, when known.
 
+  - `GitHubAppInstallationLinked object`
+
+    An installation of the Claude GitHub App (a GitHub organization or user account where the App is installed) was linked to the organization, letting the organization's Claude Code features act on that GitHub account's repositories.
+
+    - `type: optional "github_app_installation_linked"`
+
+      default: github_app_installation_linked
+
+    - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
+
+      - `APIActor object`
+
+        - `type: optional "api_actor"`
+
+          default: api_actor
+
+        - `api_key_id: string`
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+      - `UserActor object`
+
+        - `type: optional "user_actor"`
+
+          default: user_actor
+
+        - `email_address: string`
+
+          format: email
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+        - `user_id: string`
+
+      - `UnauthenticatedUserActor object`
+
+        - `type: optional "unauthenticated_user_actor"`
+
+          default: unauthenticated_user_actor
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+        - `unauthenticated_email_address: optional string or null`
+
+          format: email
+
+      - `AnthropicActor object`
+
+        - `type: optional "anthropic_actor"`
+
+          default: anthropic_actor
+
+        - `email_address: optional string or null`
+
+          format: email
+
+      - `SystemActor object`
+
+        Automated background processing performed by Anthropic systems, acting
+        without a user or customer credential.
+
+        - `type: optional "system_actor"`
+
+          default: system_actor
+
+        - `service: optional string or null`
+
+          Name of the automated process that performed the action, when known.
+
+      - `AdminAPIKeyActor object`
+
+        - `type: optional "admin_api_key_actor"`
+
+          default: admin_api_key_actor
+
+        - `admin_api_key_id: string`
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+      - `ServiceAccountActor object`
+
+        - `type: optional "service_account_actor"`
+
+          default: service_account_actor
+
+        - `ip_address: string`
+
+        - `service_account_id: string`
+
+        - `user_agent: string`
+
+      - `ScimDirectorySyncActor object`
+
+        - `type: optional "scim_directory_sync_actor"`
+
+          default: scim_directory_sync_actor
+
+        - `directory_id: string`
+
+        - `workos_event_id: string`
+
+        - `idp_connection_type: optional string or null`
+
+      - `FederatedIdentityActor object`
+
+        A federated external workload authenticated via a verified OIDC token.
+
+        Carries the verified issuer, subject, and audience claims from the
+        presented JWT.
+
+        - `type: optional "federated_identity_actor"`
+
+          default: federated_identity_actor
+
+        - `issuer: string`
+
+        - `subject: string`
+
+        - `audience: optional array of string`
+
+        - `ip_address: optional string or null`
+
+        - `user_agent: optional string or null`
+
+      - `FederatedActor object`
+
+        An external identity asserted by a trusted provider — a cloud-provider
+        gateway or a customer-registered federation issuer — acting without an
+        Anthropic-provisioned account or service account.
+
+        - `type: optional "federated_actor"`
+
+          default: federated_actor
+
+        - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
+
+          - `FederatedActorAwsProvider object`
+
+            Asserting party: the AWS account the organization is bound to.
+
+            - `type: optional "aws"`
+
+              default: aws
+
+            - `account_id: string`
+
+            - `signed_principal: string`
+
+              The AWS-signed ARN of the IAM principal that requested the token.
+
+          - `FederatedActorAzureProvider object`
+
+            Asserting party: the Azure subscription the organization is bound to.
+
+            - `type: optional "azure"`
+
+              default: azure
+
+            - `subscription_id: string`
+
+          - `FederatedActorGcpProvider object`
+
+            Asserting party: the GCP project the organization is bound to.
+
+            - `type: optional "gcp"`
+
+              default: gcp
+
+            - `project_number: string`
+
+          - `FederatedActorOidcProvider object`
+
+            Asserting party: a customer-registered OIDC federation issuer.
+
+            - `type: optional "oidc"`
+
+              default: oidc
+
+            - `issuer: optional string or null`
+
+              The federation issuer's URL. Null when the presented credential failed verification.
+
+        - `ip_address: optional string or null`
+
+        - `subject: optional string or null`
+
+          The provider's verified identifier for the caller; its form depends on the provider.
+
+        - `user_agent: optional string or null`
+
+      - `AttestedDeviceActor object`
+
+        An attested mobile device authenticated via Apple App Attest.
+
+        - `type: optional "attested_device_actor"`
+
+          default: attested_device_actor
+
+        - `external_client_id: string`
+
+        - `kid_hash: string`
+
+        - `ip_address: optional string or null`
+
+        - `user_agent: optional string or null`
+
+    - `github_installation_id: number`
+
+      Numeric GitHub ID of the installation that was linked
+
+    - `id: optional string`
+
+      Unique identifier for the activity e.g. 'activity_abcd1234'
+
+    - `created_at: optional string`
+
+      When this activity occurred.
+
+      format: date-time
+
+    - `github_account_login: optional string or null`
+
+      Login of the GitHub organization or user account the App is installed on
+
+    - `github_account_type: optional string or null`
+
+      Whether that GitHub account is an organization or a user account, as reported by GitHub ("Organization" or "User")
+
+    - `organization_id: optional string or null`
+
+      Organization ID this activity is associated with
+
+    - `organization_uuid: optional string or null`
+
+      Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
+
+  - `GitHubAppInstallationUnlinked object`
+
+    An installation of the Claude GitHub App was unlinked from the organization, so the organization's Claude Code features can no longer act on that GitHub account's repositories through it.
+
+    - `type: optional "github_app_installation_unlinked"`
+
+      default: github_app_installation_unlinked
+
+    - `actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more`
+
+      - `APIActor object`
+
+        - `type: optional "api_actor"`
+
+          default: api_actor
+
+        - `api_key_id: string`
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+      - `UserActor object`
+
+        - `type: optional "user_actor"`
+
+          default: user_actor
+
+        - `email_address: string`
+
+          format: email
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+        - `user_id: string`
+
+      - `UnauthenticatedUserActor object`
+
+        - `type: optional "unauthenticated_user_actor"`
+
+          default: unauthenticated_user_actor
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+        - `unauthenticated_email_address: optional string or null`
+
+          format: email
+
+      - `AnthropicActor object`
+
+        - `type: optional "anthropic_actor"`
+
+          default: anthropic_actor
+
+        - `email_address: optional string or null`
+
+          format: email
+
+      - `SystemActor object`
+
+        Automated background processing performed by Anthropic systems, acting
+        without a user or customer credential.
+
+        - `type: optional "system_actor"`
+
+          default: system_actor
+
+        - `service: optional string or null`
+
+          Name of the automated process that performed the action, when known.
+
+      - `AdminAPIKeyActor object`
+
+        - `type: optional "admin_api_key_actor"`
+
+          default: admin_api_key_actor
+
+        - `admin_api_key_id: string`
+
+        - `ip_address: string`
+
+        - `user_agent: string`
+
+      - `ServiceAccountActor object`
+
+        - `type: optional "service_account_actor"`
+
+          default: service_account_actor
+
+        - `ip_address: string`
+
+        - `service_account_id: string`
+
+        - `user_agent: string`
+
+      - `ScimDirectorySyncActor object`
+
+        - `type: optional "scim_directory_sync_actor"`
+
+          default: scim_directory_sync_actor
+
+        - `directory_id: string`
+
+        - `workos_event_id: string`
+
+        - `idp_connection_type: optional string or null`
+
+      - `FederatedIdentityActor object`
+
+        A federated external workload authenticated via a verified OIDC token.
+
+        Carries the verified issuer, subject, and audience claims from the
+        presented JWT.
+
+        - `type: optional "federated_identity_actor"`
+
+          default: federated_identity_actor
+
+        - `issuer: string`
+
+        - `subject: string`
+
+        - `audience: optional array of string`
+
+        - `ip_address: optional string or null`
+
+        - `user_agent: optional string or null`
+
+      - `FederatedActor object`
+
+        An external identity asserted by a trusted provider — a cloud-provider
+        gateway or a customer-registered federation issuer — acting without an
+        Anthropic-provisioned account or service account.
+
+        - `type: optional "federated_actor"`
+
+          default: federated_actor
+
+        - `provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider`
+
+          - `FederatedActorAwsProvider object`
+
+            Asserting party: the AWS account the organization is bound to.
+
+            - `type: optional "aws"`
+
+              default: aws
+
+            - `account_id: string`
+
+            - `signed_principal: string`
+
+              The AWS-signed ARN of the IAM principal that requested the token.
+
+          - `FederatedActorAzureProvider object`
+
+            Asserting party: the Azure subscription the organization is bound to.
+
+            - `type: optional "azure"`
+
+              default: azure
+
+            - `subscription_id: string`
+
+          - `FederatedActorGcpProvider object`
+
+            Asserting party: the GCP project the organization is bound to.
+
+            - `type: optional "gcp"`
+
+              default: gcp
+
+            - `project_number: string`
+
+          - `FederatedActorOidcProvider object`
+
+            Asserting party: a customer-registered OIDC federation issuer.
+
+            - `type: optional "oidc"`
+
+              default: oidc
+
+            - `issuer: optional string or null`
+
+              The federation issuer's URL. Null when the presented credential failed verification.
+
+        - `ip_address: optional string or null`
+
+        - `subject: optional string or null`
+
+          The provider's verified identifier for the caller; its form depends on the provider.
+
+        - `user_agent: optional string or null`
+
+      - `AttestedDeviceActor object`
+
+        An attested mobile device authenticated via Apple App Attest.
+
+        - `type: optional "attested_device_actor"`
+
+          default: attested_device_actor
+
+        - `external_client_id: string`
+
+        - `kid_hash: string`
+
+        - `ip_address: optional string or null`
+
+        - `user_agent: optional string or null`
+
+    - `github_installation_id: number`
+
+      Numeric GitHub ID of the installation that was unlinked
+
+    - `id: optional string`
+
+      Unique identifier for the activity e.g. 'activity_abcd1234'
+
+    - `created_at: optional string`
+
+      When this activity occurred.
+
+      format: date-time
+
+    - `github_account_login: optional string or null`
+
+      Login of the GitHub organization or user account the App is installed on
+
+    - `github_account_type: optional string or null`
+
+      Whether that GitHub account is an organization or a user account, as reported by GitHub ("Organization" or "User")
+
+    - `organization_id: optional string or null`
+
+      Organization ID this activity is associated with
+
+    - `organization_uuid: optional string or null`
+
+      Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
+
   - `GitHubTokenImport object`
 
     A user attempted to import a personal GitHub access token for use with Claude Code. The `result` field indicates the outcome of the import (imported, rejected, or failed).
@@ -80317,7 +80821,7 @@ compliance activities that can be filtered by various criteria.
 
       - `ClaudeCodeWebEnabled object`
 
-        The Claude Code on the web setting was changed for the organization.
+        The Claude Code cloud sessions setting was changed for the organization.
 
         - `type: optional "claude_code_web_enabled"`
 
@@ -125046,6 +125550,10 @@ compliance activities that can be filtered by various criteria.
 
       Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).
 
+    - `tunnel_token_id: optional string or null`
+
+      Id of the tunnel token issued with the tunnel and returned once in the create response; set only when creating the tunnel also issued its token, and absent for a tunnel whose token is revealed separately
+
   - `TunnelTokenMinted object`
 
     An OAuth bearer token for the tunnel management API was minted.
diff --git a/content/en/api/csharp/beta.md b/content/en/api/csharp/beta.md
index 4c01add4e1..1d47a42e33 100644
--- a/content/en/api/csharp/beta.md
+++ b/content/en/api/csharp/beta.md
@@ -2181,7 +2181,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
             - `class BetaToolChangeMcpToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `JsonElement Type = "mcp_tool_reference"`
@@ -2223,7 +2223,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
             - `class BetaToolChangeMcpToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `class BetaToolChangeMcpToolsetReference`
@@ -7963,7 +7963,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
             - `class BetaToolChangeMcpToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `JsonElement Type = "mcp_tool_reference"`
@@ -8005,7 +8005,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
             - `class BetaToolChangeMcpToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `class BetaToolChangeMcpToolsetReference`
@@ -11633,7 +11633,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
                 - `class BetaToolChangeMcpToolReference`
 
-                  Reference to a single MCP tool by its server and remote name — the
+                  Reference to a single MCP tool by its server and remote name; the
                   same `server_name`/`name` pair `mcp_tool_use` carries.
 
                   - `JsonElement Type = "mcp_tool_reference"`
@@ -11675,7 +11675,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
                 - `class BetaToolChangeMcpToolReference`
 
-                  Reference to a single MCP tool by its server and remote name — the
+                  Reference to a single MCP tool by its server and remote name; the
                   same `server_name`/`name` pair `mcp_tool_use` carries.
 
                 - `class BetaToolChangeMcpToolsetReference`
diff --git a/content/en/api/csharp/beta/messages.md b/content/en/api/csharp/beta/messages.md
index 570faf35a5..5f4d904593 100644
--- a/content/en/api/csharp/beta/messages.md
+++ b/content/en/api/csharp/beta/messages.md
@@ -1214,7 +1214,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
             - `class BetaToolChangeMcpToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `JsonElement Type = "mcp_tool_reference"`
@@ -1256,7 +1256,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
             - `class BetaToolChangeMcpToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `class BetaToolChangeMcpToolsetReference`
@@ -6996,7 +6996,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
             - `class BetaToolChangeMcpToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `JsonElement Type = "mcp_tool_reference"`
@@ -7038,7 +7038,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
             - `class BetaToolChangeMcpToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `class BetaToolChangeMcpToolsetReference`
@@ -15947,7 +15947,7 @@ Console.WriteLine(betaMessageTokensCount);
 
       - `class BetaToolChangeMcpToolReference`
 
-        Reference to a single MCP tool by its server and remote name — the
+        Reference to a single MCP tool by its server and remote name; the
         same `server_name`/`name` pair `mcp_tool_use` carries.
 
         - `JsonElement Type = "mcp_tool_reference"`
@@ -15989,7 +15989,7 @@ Console.WriteLine(betaMessageTokensCount);
 
       - `class BetaToolChangeMcpToolReference`
 
-        Reference to a single MCP tool by its server and remote name — the
+        Reference to a single MCP tool by its server and remote name; the
         same `server_name`/`name` pair `mcp_tool_use` carries.
 
       - `class BetaToolChangeMcpToolsetReference`
@@ -21984,7 +21984,7 @@ Console.WriteLine(betaMessageTokensCount);
 
           - `class BetaToolChangeMcpToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `JsonElement Type = "mcp_tool_reference"`
@@ -22026,7 +22026,7 @@ Console.WriteLine(betaMessageTokensCount);
 
           - `class BetaToolChangeMcpToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
           - `class BetaToolChangeMcpToolsetReference`
@@ -28322,7 +28322,7 @@ Console.WriteLine(betaMessageTokensCount);
 
     - `class BetaToolChangeMcpToolReference`
 
-      Reference to a single MCP tool by its server and remote name — the
+      Reference to a single MCP tool by its server and remote name; the
       same `server_name`/`name` pair `mcp_tool_use` carries.
 
       - `JsonElement Type = "mcp_tool_reference"`
@@ -28389,7 +28389,7 @@ Console.WriteLine(betaMessageTokensCount);
 
     - `class BetaToolChangeMcpToolReference`
 
-      Reference to a single MCP tool by its server and remote name — the
+      Reference to a single MCP tool by its server and remote name; the
       same `server_name`/`name` pair `mcp_tool_use` carries.
 
       - `JsonElement Type = "mcp_tool_reference"`
@@ -30235,7 +30235,7 @@ Console.WriteLine(betaMessageTokensCount);
 
 - `class BetaToolChangeMcpToolReference`
 
-  Reference to a single MCP tool by its server and remote name — the
+  Reference to a single MCP tool by its server and remote name; the
   same `server_name`/`name` pair `mcp_tool_use` carries.
 
   - `JsonElement Type = "mcp_tool_reference"`
@@ -37790,7 +37790,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
                 - `class BetaToolChangeMcpToolReference`
 
-                  Reference to a single MCP tool by its server and remote name — the
+                  Reference to a single MCP tool by its server and remote name; the
                   same `server_name`/`name` pair `mcp_tool_use` carries.
 
                   - `JsonElement Type = "mcp_tool_reference"`
@@ -37832,7 +37832,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
                 - `class BetaToolChangeMcpToolReference`
 
-                  Reference to a single MCP tool by its server and remote name — the
+                  Reference to a single MCP tool by its server and remote name; the
                   same `server_name`/`name` pair `mcp_tool_use` carries.
 
                 - `class BetaToolChangeMcpToolsetReference`
diff --git a/content/en/api/csharp/beta/messages/batches.md b/content/en/api/csharp/beta/messages/batches.md
index 3f16961699..e93f952660 100644
--- a/content/en/api/csharp/beta/messages/batches.md
+++ b/content/en/api/csharp/beta/messages/batches.md
@@ -1234,7 +1234,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
                 - `class BetaToolChangeMcpToolReference`
 
-                  Reference to a single MCP tool by its server and remote name — the
+                  Reference to a single MCP tool by its server and remote name; the
                   same `server_name`/`name` pair `mcp_tool_use` carries.
 
                   - `JsonElement Type = "mcp_tool_reference"`
@@ -1276,7 +1276,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
                 - `class BetaToolChangeMcpToolReference`
 
-                  Reference to a single MCP tool by its server and remote name — the
+                  Reference to a single MCP tool by its server and remote name; the
                   same `server_name`/`name` pair `mcp_tool_use` carries.
 
                 - `class BetaToolChangeMcpToolsetReference`
diff --git a/content/en/api/csharp/beta/messages/batches/create.md b/content/en/api/csharp/beta/messages/batches/create.md
index 57d17baf1a..0aca5b01d4 100644
--- a/content/en/api/csharp/beta/messages/batches/create.md
+++ b/content/en/api/csharp/beta/messages/batches/create.md
@@ -1232,7 +1232,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
                 - `class BetaToolChangeMcpToolReference`
 
-                  Reference to a single MCP tool by its server and remote name — the
+                  Reference to a single MCP tool by its server and remote name; the
                   same `server_name`/`name` pair `mcp_tool_use` carries.
 
                   - `JsonElement Type = "mcp_tool_reference"`
@@ -1274,7 +1274,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
                 - `class BetaToolChangeMcpToolReference`
 
-                  Reference to a single MCP tool by its server and remote name — the
+                  Reference to a single MCP tool by its server and remote name; the
                   same `server_name`/`name` pair `mcp_tool_use` carries.
 
                 - `class BetaToolChangeMcpToolsetReference`
diff --git a/content/en/api/csharp/beta/messages/count_tokens.md b/content/en/api/csharp/beta/messages/count_tokens.md
index 1b9eb463f8..aa5ee86f18 100644
--- a/content/en/api/csharp/beta/messages/count_tokens.md
+++ b/content/en/api/csharp/beta/messages/count_tokens.md
@@ -1200,7 +1200,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
             - `class BetaToolChangeMcpToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `JsonElement Type = "mcp_tool_reference"`
@@ -1242,7 +1242,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
             - `class BetaToolChangeMcpToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `class BetaToolChangeMcpToolsetReference`
diff --git a/content/en/api/csharp/beta/messages/create.md b/content/en/api/csharp/beta/messages/create.md
index 38706801bb..283218ed63 100644
--- a/content/en/api/csharp/beta/messages/create.md
+++ b/content/en/api/csharp/beta/messages/create.md
@@ -1212,7 +1212,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
             - `class BetaToolChangeMcpToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `JsonElement Type = "mcp_tool_reference"`
@@ -1254,7 +1254,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
             - `class BetaToolChangeMcpToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `class BetaToolChangeMcpToolsetReference`
diff --git a/content/en/api/go/beta.md b/content/en/api/go/beta.md
index a25ca5cb77..14902927ee 100644
--- a/content/en/api/go/beta.md
+++ b/content/en/api/go/beta.md
@@ -2429,7 +2429,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
             - `type BetaToolChangeMCPToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `Type MCPToolReference`
@@ -2471,7 +2471,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
             - `type BetaToolChangeMCPToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `type BetaToolChangeMCPToolsetReference`
@@ -8374,7 +8374,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
             - `type BetaToolChangeMCPToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `Type MCPToolReference`
@@ -8416,7 +8416,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
             - `type BetaToolChangeMCPToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `type BetaToolChangeMCPToolsetReference`
@@ -12064,7 +12064,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
                 - `type BetaToolChangeMCPToolReference`
 
-                  Reference to a single MCP tool by its server and remote name — the
+                  Reference to a single MCP tool by its server and remote name; the
                   same `server_name`/`name` pair `mcp_tool_use` carries.
 
                   - `Type MCPToolReference`
@@ -12106,7 +12106,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
                 - `type BetaToolChangeMCPToolReference`
 
-                  Reference to a single MCP tool by its server and remote name — the
+                  Reference to a single MCP tool by its server and remote name; the
                   same `server_name`/`name` pair `mcp_tool_use` carries.
 
                 - `type BetaToolChangeMCPToolsetReference`
diff --git a/content/en/api/go/beta/messages.md b/content/en/api/go/beta/messages.md
index e6eb536c26..c76495d893 100644
--- a/content/en/api/go/beta/messages.md
+++ b/content/en/api/go/beta/messages.md
@@ -1210,7 +1210,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
             - `type BetaToolChangeMCPToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `Type MCPToolReference`
@@ -1252,7 +1252,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
             - `type BetaToolChangeMCPToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `type BetaToolChangeMCPToolsetReference`
@@ -7155,7 +7155,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
             - `type BetaToolChangeMCPToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `Type MCPToolReference`
@@ -7197,7 +7197,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
             - `type BetaToolChangeMCPToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `type BetaToolChangeMCPToolsetReference`
@@ -16360,7 +16360,7 @@ func main() {
 
       - `type BetaToolChangeMCPToolReference`
 
-        Reference to a single MCP tool by its server and remote name — the
+        Reference to a single MCP tool by its server and remote name; the
         same `server_name`/`name` pair `mcp_tool_use` carries.
 
         - `Type MCPToolReference`
@@ -16402,7 +16402,7 @@ func main() {
 
       - `type BetaToolChangeMCPToolReference`
 
-        Reference to a single MCP tool by its server and remote name — the
+        Reference to a single MCP tool by its server and remote name; the
         same `server_name`/`name` pair `mcp_tool_use` carries.
 
       - `type BetaToolChangeMCPToolsetReference`
@@ -22998,7 +22998,7 @@ func main() {
 
           - `type BetaToolChangeMCPToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `Type MCPToolReference`
@@ -23040,7 +23040,7 @@ func main() {
 
           - `type BetaToolChangeMCPToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
           - `type BetaToolChangeMCPToolsetReference`
@@ -29829,7 +29829,7 @@ func main() {
 
     - `type BetaToolChangeMCPToolReference`
 
-      Reference to a single MCP tool by its server and remote name — the
+      Reference to a single MCP tool by its server and remote name; the
       same `server_name`/`name` pair `mcp_tool_use` carries.
 
       - `Type MCPToolReference`
@@ -29896,7 +29896,7 @@ func main() {
 
     - `type BetaToolChangeMCPToolReference`
 
-      Reference to a single MCP tool by its server and remote name — the
+      Reference to a single MCP tool by its server and remote name; the
       same `server_name`/`name` pair `mcp_tool_use` carries.
 
       - `Type MCPToolReference`
@@ -31796,7 +31796,7 @@ func main() {
 
 - `type BetaToolChangeMCPToolReference`
 
-  Reference to a single MCP tool by its server and remote name — the
+  Reference to a single MCP tool by its server and remote name; the
   same `server_name`/`name` pair `mcp_tool_use` carries.
 
   - `Type MCPToolReference`
@@ -39423,7 +39423,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
                 - `type BetaToolChangeMCPToolReference`
 
-                  Reference to a single MCP tool by its server and remote name — the
+                  Reference to a single MCP tool by its server and remote name; the
                   same `server_name`/`name` pair `mcp_tool_use` carries.
 
                   - `Type MCPToolReference`
@@ -39465,7 +39465,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
                 - `type BetaToolChangeMCPToolReference`
 
-                  Reference to a single MCP tool by its server and remote name — the
+                  Reference to a single MCP tool by its server and remote name; the
                   same `server_name`/`name` pair `mcp_tool_use` carries.
 
                 - `type BetaToolChangeMCPToolsetReference`
diff --git a/content/en/api/go/beta/messages/batches.md b/content/en/api/go/beta/messages/batches.md
index f2ecb49f19..46d6eec349 100644
--- a/content/en/api/go/beta/messages/batches.md
+++ b/content/en/api/go/beta/messages/batches.md
@@ -1230,7 +1230,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
                 - `type BetaToolChangeMCPToolReference`
 
-                  Reference to a single MCP tool by its server and remote name — the
+                  Reference to a single MCP tool by its server and remote name; the
                   same `server_name`/`name` pair `mcp_tool_use` carries.
 
                   - `Type MCPToolReference`
@@ -1272,7 +1272,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
                 - `type BetaToolChangeMCPToolReference`
 
-                  Reference to a single MCP tool by its server and remote name — the
+                  Reference to a single MCP tool by its server and remote name; the
                   same `server_name`/`name` pair `mcp_tool_use` carries.
 
                 - `type BetaToolChangeMCPToolsetReference`
diff --git a/content/en/api/go/beta/messages/batches/create.md b/content/en/api/go/beta/messages/batches/create.md
index e452894890..12572d8f83 100644
--- a/content/en/api/go/beta/messages/batches/create.md
+++ b/content/en/api/go/beta/messages/batches/create.md
@@ -1228,7 +1228,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
                 - `type BetaToolChangeMCPToolReference`
 
-                  Reference to a single MCP tool by its server and remote name — the
+                  Reference to a single MCP tool by its server and remote name; the
                   same `server_name`/`name` pair `mcp_tool_use` carries.
 
                   - `Type MCPToolReference`
@@ -1270,7 +1270,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
                 - `type BetaToolChangeMCPToolReference`
 
-                  Reference to a single MCP tool by its server and remote name — the
+                  Reference to a single MCP tool by its server and remote name; the
                   same `server_name`/`name` pair `mcp_tool_use` carries.
 
                 - `type BetaToolChangeMCPToolsetReference`
diff --git a/content/en/api/go/beta/messages/count_tokens.md b/content/en/api/go/beta/messages/count_tokens.md
index 0eae3cb5fc..2219e93b6e 100644
--- a/content/en/api/go/beta/messages/count_tokens.md
+++ b/content/en/api/go/beta/messages/count_tokens.md
@@ -1196,7 +1196,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
             - `type BetaToolChangeMCPToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `Type MCPToolReference`
@@ -1238,7 +1238,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
             - `type BetaToolChangeMCPToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `type BetaToolChangeMCPToolsetReference`
diff --git a/content/en/api/go/beta/messages/create.md b/content/en/api/go/beta/messages/create.md
index 49cbe44109..3090fa708a 100644
--- a/content/en/api/go/beta/messages/create.md
+++ b/content/en/api/go/beta/messages/create.md
@@ -1208,7 +1208,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
             - `type BetaToolChangeMCPToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `Type MCPToolReference`
@@ -1250,7 +1250,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
             - `type BetaToolChangeMCPToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `type BetaToolChangeMCPToolsetReference`
diff --git a/content/en/api/java/beta.md b/content/en/api/java/beta.md
index a90f46e021..4e74dd934d 100644
--- a/content/en/api/java/beta.md
+++ b/content/en/api/java/beta.md
@@ -2391,7 +2391,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
             - `class BetaToolChangeMcpToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `JsonValue type = "mcp_tool_reference"`
@@ -2433,7 +2433,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
             - `class BetaToolChangeMcpToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `class BetaToolChangeMcpToolsetReference`
@@ -8172,7 +8172,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
             - `class BetaToolChangeMcpToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `JsonValue type = "mcp_tool_reference"`
@@ -8214,7 +8214,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
             - `class BetaToolChangeMcpToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `class BetaToolChangeMcpToolsetReference`
@@ -11841,7 +11841,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
                 - `class BetaToolChangeMcpToolReference`
 
-                  Reference to a single MCP tool by its server and remote name — the
+                  Reference to a single MCP tool by its server and remote name; the
                   same `server_name`/`name` pair `mcp_tool_use` carries.
 
                   - `JsonValue type = "mcp_tool_reference"`
@@ -11883,7 +11883,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
                 - `class BetaToolChangeMcpToolReference`
 
-                  Reference to a single MCP tool by its server and remote name — the
+                  Reference to a single MCP tool by its server and remote name; the
                   same `server_name`/`name` pair `mcp_tool_use` carries.
 
                 - `class BetaToolChangeMcpToolsetReference`
diff --git a/content/en/api/java/beta/messages.md b/content/en/api/java/beta/messages.md
index f47e5a9c1c..bdc9907daf 100644
--- a/content/en/api/java/beta/messages.md
+++ b/content/en/api/java/beta/messages.md
@@ -1316,7 +1316,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
             - `class BetaToolChangeMcpToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `JsonValue type = "mcp_tool_reference"`
@@ -1358,7 +1358,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
             - `class BetaToolChangeMcpToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `class BetaToolChangeMcpToolsetReference`
@@ -7097,7 +7097,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
             - `class BetaToolChangeMcpToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `JsonValue type = "mcp_tool_reference"`
@@ -7139,7 +7139,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
             - `class BetaToolChangeMcpToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `class BetaToolChangeMcpToolsetReference`
@@ -15945,7 +15945,7 @@ public final class Main {
 
       - `class BetaToolChangeMcpToolReference`
 
-        Reference to a single MCP tool by its server and remote name — the
+        Reference to a single MCP tool by its server and remote name; the
         same `server_name`/`name` pair `mcp_tool_use` carries.
 
         - `JsonValue type = "mcp_tool_reference"`
@@ -15987,7 +15987,7 @@ public final class Main {
 
       - `class BetaToolChangeMcpToolReference`
 
-        Reference to a single MCP tool by its server and remote name — the
+        Reference to a single MCP tool by its server and remote name; the
         same `server_name`/`name` pair `mcp_tool_use` carries.
 
       - `class BetaToolChangeMcpToolsetReference`
@@ -21982,7 +21982,7 @@ public final class Main {
 
           - `class BetaToolChangeMcpToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `JsonValue type = "mcp_tool_reference"`
@@ -22024,7 +22024,7 @@ public final class Main {
 
           - `class BetaToolChangeMcpToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
           - `class BetaToolChangeMcpToolsetReference`
@@ -28320,7 +28320,7 @@ public final class Main {
 
     - `class BetaToolChangeMcpToolReference`
 
-      Reference to a single MCP tool by its server and remote name — the
+      Reference to a single MCP tool by its server and remote name; the
       same `server_name`/`name` pair `mcp_tool_use` carries.
 
       - `JsonValue type = "mcp_tool_reference"`
@@ -28387,7 +28387,7 @@ public final class Main {
 
     - `class BetaToolChangeMcpToolReference`
 
-      Reference to a single MCP tool by its server and remote name — the
+      Reference to a single MCP tool by its server and remote name; the
       same `server_name`/`name` pair `mcp_tool_use` carries.
 
       - `JsonValue type = "mcp_tool_reference"`
@@ -30233,7 +30233,7 @@ public final class Main {
 
 - `class BetaToolChangeMcpToolReference`
 
-  Reference to a single MCP tool by its server and remote name — the
+  Reference to a single MCP tool by its server and remote name; the
   same `server_name`/`name` pair `mcp_tool_use` carries.
 
   - `JsonValue type = "mcp_tool_reference"`
@@ -37890,7 +37890,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
                 - `class BetaToolChangeMcpToolReference`
 
-                  Reference to a single MCP tool by its server and remote name — the
+                  Reference to a single MCP tool by its server and remote name; the
                   same `server_name`/`name` pair `mcp_tool_use` carries.
 
                   - `JsonValue type = "mcp_tool_reference"`
@@ -37932,7 +37932,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
                 - `class BetaToolChangeMcpToolReference`
 
-                  Reference to a single MCP tool by its server and remote name — the
+                  Reference to a single MCP tool by its server and remote name; the
                   same `server_name`/`name` pair `mcp_tool_use` carries.
 
                 - `class BetaToolChangeMcpToolsetReference`
diff --git a/content/en/api/java/beta/messages/batches.md b/content/en/api/java/beta/messages/batches.md
index 2b9e3345f0..cce8162c62 100644
--- a/content/en/api/java/beta/messages/batches.md
+++ b/content/en/api/java/beta/messages/batches.md
@@ -1336,7 +1336,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
                 - `class BetaToolChangeMcpToolReference`
 
-                  Reference to a single MCP tool by its server and remote name — the
+                  Reference to a single MCP tool by its server and remote name; the
                   same `server_name`/`name` pair `mcp_tool_use` carries.
 
                   - `JsonValue type = "mcp_tool_reference"`
@@ -1378,7 +1378,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
                 - `class BetaToolChangeMcpToolReference`
 
-                  Reference to a single MCP tool by its server and remote name — the
+                  Reference to a single MCP tool by its server and remote name; the
                   same `server_name`/`name` pair `mcp_tool_use` carries.
 
                 - `class BetaToolChangeMcpToolsetReference`
diff --git a/content/en/api/java/beta/messages/batches/create.md b/content/en/api/java/beta/messages/batches/create.md
index 82ed70aaf6..02dd1d79a8 100644
--- a/content/en/api/java/beta/messages/batches/create.md
+++ b/content/en/api/java/beta/messages/batches/create.md
@@ -1334,7 +1334,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
                 - `class BetaToolChangeMcpToolReference`
 
-                  Reference to a single MCP tool by its server and remote name — the
+                  Reference to a single MCP tool by its server and remote name; the
                   same `server_name`/`name` pair `mcp_tool_use` carries.
 
                   - `JsonValue type = "mcp_tool_reference"`
@@ -1376,7 +1376,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
                 - `class BetaToolChangeMcpToolReference`
 
-                  Reference to a single MCP tool by its server and remote name — the
+                  Reference to a single MCP tool by its server and remote name; the
                   same `server_name`/`name` pair `mcp_tool_use` carries.
 
                 - `class BetaToolChangeMcpToolsetReference`
diff --git a/content/en/api/java/beta/messages/count_tokens.md b/content/en/api/java/beta/messages/count_tokens.md
index 201a5588b0..0828b88980 100644
--- a/content/en/api/java/beta/messages/count_tokens.md
+++ b/content/en/api/java/beta/messages/count_tokens.md
@@ -1302,7 +1302,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
             - `class BetaToolChangeMcpToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `JsonValue type = "mcp_tool_reference"`
@@ -1344,7 +1344,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
             - `class BetaToolChangeMcpToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `class BetaToolChangeMcpToolsetReference`
diff --git a/content/en/api/java/beta/messages/create.md b/content/en/api/java/beta/messages/create.md
index efd4ba9925..23a3f0520e 100644
--- a/content/en/api/java/beta/messages/create.md
+++ b/content/en/api/java/beta/messages/create.md
@@ -1314,7 +1314,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
             - `class BetaToolChangeMcpToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `JsonValue type = "mcp_tool_reference"`
@@ -1356,7 +1356,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
             - `class BetaToolChangeMcpToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `class BetaToolChangeMcpToolsetReference`
diff --git a/content/en/api/python/beta.md b/content/en/api/python/beta.md
index b368921e80..37406b960f 100644
--- a/content/en/api/python/beta.md
+++ b/content/en/api/python/beta.md
@@ -2398,7 +2398,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
           - `class BetaToolChangeMCPToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `type: Literal["mcp_tool_reference"]`
@@ -2440,7 +2440,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
           - `class BetaToolChangeMCPToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
           - `class BetaToolChangeMCPToolsetReference`
@@ -8651,7 +8651,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
           - `class BetaToolChangeMCPToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `type: Literal["mcp_tool_reference"]`
@@ -8693,7 +8693,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
           - `class BetaToolChangeMCPToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
           - `class BetaToolChangeMCPToolsetReference`
@@ -12603,7 +12603,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
               - `class BetaToolChangeMCPToolReference`
 
-                Reference to a single MCP tool by its server and remote name — the
+                Reference to a single MCP tool by its server and remote name; the
                 same `server_name`/`name` pair `mcp_tool_use` carries.
 
                 - `type: Literal["mcp_tool_reference"]`
@@ -12645,7 +12645,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
               - `class BetaToolChangeMCPToolReference`
 
-                Reference to a single MCP tool by its server and remote name — the
+                Reference to a single MCP tool by its server and remote name; the
                 same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `class BetaToolChangeMCPToolsetReference`
diff --git a/content/en/api/python/beta/messages.md b/content/en/api/python/beta/messages.md
index 5f9e2fd881..c3c6fcda66 100644
--- a/content/en/api/python/beta/messages.md
+++ b/content/en/api/python/beta/messages.md
@@ -1212,7 +1212,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
           - `class BetaToolChangeMCPToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `type: Literal["mcp_tool_reference"]`
@@ -1254,7 +1254,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
           - `class BetaToolChangeMCPToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
           - `class BetaToolChangeMCPToolsetReference`
@@ -7465,7 +7465,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
           - `class BetaToolChangeMCPToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `type: Literal["mcp_tool_reference"]`
@@ -7507,7 +7507,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
           - `class BetaToolChangeMCPToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
           - `class BetaToolChangeMCPToolsetReference`
@@ -16992,7 +16992,7 @@ print(beta_message_tokens_count.context_management)
 
       - `class BetaToolChangeMCPToolReference`
 
-        Reference to a single MCP tool by its server and remote name — the
+        Reference to a single MCP tool by its server and remote name; the
         same `server_name`/`name` pair `mcp_tool_use` carries.
 
         - `type: Literal["mcp_tool_reference"]`
@@ -17034,7 +17034,7 @@ print(beta_message_tokens_count.context_management)
 
       - `class BetaToolChangeMCPToolReference`
 
-        Reference to a single MCP tool by its server and remote name — the
+        Reference to a single MCP tool by its server and remote name; the
         same `server_name`/`name` pair `mcp_tool_use` carries.
 
       - `class BetaToolChangeMCPToolsetReference`
@@ -23874,7 +23874,7 @@ print(beta_message_tokens_count.context_management)
 
           - `class BetaToolChangeMCPToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `type: Literal["mcp_tool_reference"]`
@@ -23916,7 +23916,7 @@ print(beta_message_tokens_count.context_management)
 
           - `class BetaToolChangeMCPToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
           - `class BetaToolChangeMCPToolsetReference`
@@ -30837,7 +30837,7 @@ print(beta_message_tokens_count.context_management)
 
     - `class BetaToolChangeMCPToolReference`
 
-      Reference to a single MCP tool by its server and remote name — the
+      Reference to a single MCP tool by its server and remote name; the
       same `server_name`/`name` pair `mcp_tool_use` carries.
 
       - `type: Literal["mcp_tool_reference"]`
@@ -30904,7 +30904,7 @@ print(beta_message_tokens_count.context_management)
 
     - `class BetaToolChangeMCPToolReference`
 
-      Reference to a single MCP tool by its server and remote name — the
+      Reference to a single MCP tool by its server and remote name; the
       same `server_name`/`name` pair `mcp_tool_use` carries.
 
       - `type: Literal["mcp_tool_reference"]`
@@ -32804,7 +32804,7 @@ print(beta_message_tokens_count.context_management)
 
 - `class BetaToolChangeMCPToolReference`
 
-  Reference to a single MCP tool by its server and remote name — the
+  Reference to a single MCP tool by its server and remote name; the
   same `server_name`/`name` pair `mcp_tool_use` carries.
 
   - `type: Literal["mcp_tool_reference"]`
@@ -40471,7 +40471,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
               - `class BetaToolChangeMCPToolReference`
 
-                Reference to a single MCP tool by its server and remote name — the
+                Reference to a single MCP tool by its server and remote name; the
                 same `server_name`/`name` pair `mcp_tool_use` carries.
 
                 - `type: Literal["mcp_tool_reference"]`
@@ -40513,7 +40513,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
               - `class BetaToolChangeMCPToolReference`
 
-                Reference to a single MCP tool by its server and remote name — the
+                Reference to a single MCP tool by its server and remote name; the
                 same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `class BetaToolChangeMCPToolsetReference`
diff --git a/content/en/api/python/beta/messages/batches.md b/content/en/api/python/beta/messages/batches.md
index 83244eb932..0d4d8a3cfc 100644
--- a/content/en/api/python/beta/messages/batches.md
+++ b/content/en/api/python/beta/messages/batches.md
@@ -1232,7 +1232,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
               - `class BetaToolChangeMCPToolReference`
 
-                Reference to a single MCP tool by its server and remote name — the
+                Reference to a single MCP tool by its server and remote name; the
                 same `server_name`/`name` pair `mcp_tool_use` carries.
 
                 - `type: Literal["mcp_tool_reference"]`
@@ -1274,7 +1274,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
               - `class BetaToolChangeMCPToolReference`
 
-                Reference to a single MCP tool by its server and remote name — the
+                Reference to a single MCP tool by its server and remote name; the
                 same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `class BetaToolChangeMCPToolsetReference`
diff --git a/content/en/api/python/beta/messages/batches/create.md b/content/en/api/python/beta/messages/batches/create.md
index e59b995195..1c5ef4425d 100644
--- a/content/en/api/python/beta/messages/batches/create.md
+++ b/content/en/api/python/beta/messages/batches/create.md
@@ -1230,7 +1230,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
               - `class BetaToolChangeMCPToolReference`
 
-                Reference to a single MCP tool by its server and remote name — the
+                Reference to a single MCP tool by its server and remote name; the
                 same `server_name`/`name` pair `mcp_tool_use` carries.
 
                 - `type: Literal["mcp_tool_reference"]`
@@ -1272,7 +1272,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
               - `class BetaToolChangeMCPToolReference`
 
-                Reference to a single MCP tool by its server and remote name — the
+                Reference to a single MCP tool by its server and remote name; the
                 same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `class BetaToolChangeMCPToolsetReference`
diff --git a/content/en/api/python/beta/messages/count_tokens.md b/content/en/api/python/beta/messages/count_tokens.md
index d844d159da..d3a0a7d11b 100644
--- a/content/en/api/python/beta/messages/count_tokens.md
+++ b/content/en/api/python/beta/messages/count_tokens.md
@@ -1198,7 +1198,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
           - `class BetaToolChangeMCPToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `type: Literal["mcp_tool_reference"]`
@@ -1240,7 +1240,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
           - `class BetaToolChangeMCPToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
           - `class BetaToolChangeMCPToolsetReference`
diff --git a/content/en/api/python/beta/messages/create.md b/content/en/api/python/beta/messages/create.md
index 79866d8b67..81edf1b652 100644
--- a/content/en/api/python/beta/messages/create.md
+++ b/content/en/api/python/beta/messages/create.md
@@ -1210,7 +1210,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
           - `class BetaToolChangeMCPToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `type: Literal["mcp_tool_reference"]`
@@ -1252,7 +1252,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
           - `class BetaToolChangeMCPToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
           - `class BetaToolChangeMCPToolsetReference`
diff --git a/content/en/api/ruby/beta.md b/content/en/api/ruby/beta.md
index dcfc0ca710..a26e675906 100644
--- a/content/en/api/ruby/beta.md
+++ b/content/en/api/ruby/beta.md
@@ -2275,7 +2275,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
           - `class BetaToolChangeMCPToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `type: :mcp_tool_reference`
@@ -2317,7 +2317,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
           - `class BetaToolChangeMCPToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
           - `class BetaToolChangeMCPToolsetReference`
@@ -8356,7 +8356,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
           - `class BetaToolChangeMCPToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `type: :mcp_tool_reference`
@@ -8398,7 +8398,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
           - `class BetaToolChangeMCPToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
           - `class BetaToolChangeMCPToolsetReference`
@@ -12290,7 +12290,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
               - `class BetaToolChangeMCPToolReference`
 
-                Reference to a single MCP tool by its server and remote name — the
+                Reference to a single MCP tool by its server and remote name; the
                 same `server_name`/`name` pair `mcp_tool_use` carries.
 
                 - `type: :mcp_tool_reference`
@@ -12332,7 +12332,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
               - `class BetaToolChangeMCPToolReference`
 
-                Reference to a single MCP tool by its server and remote name — the
+                Reference to a single MCP tool by its server and remote name; the
                 same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `class BetaToolChangeMCPToolsetReference`
diff --git a/content/en/api/ruby/beta/messages.md b/content/en/api/ruby/beta/messages.md
index 5607c5cefc..a5e684455d 100644
--- a/content/en/api/ruby/beta/messages.md
+++ b/content/en/api/ruby/beta/messages.md
@@ -1212,7 +1212,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
           - `class BetaToolChangeMCPToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `type: :mcp_tool_reference`
@@ -1254,7 +1254,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
           - `class BetaToolChangeMCPToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
           - `class BetaToolChangeMCPToolsetReference`
@@ -7293,7 +7293,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
           - `class BetaToolChangeMCPToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `type: :mcp_tool_reference`
@@ -7335,7 +7335,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
           - `class BetaToolChangeMCPToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
           - `class BetaToolChangeMCPToolsetReference`
@@ -16534,7 +16534,7 @@ puts(beta_message_tokens_count)
 
       - `class BetaToolChangeMCPToolReference`
 
-        Reference to a single MCP tool by its server and remote name — the
+        Reference to a single MCP tool by its server and remote name; the
         same `server_name`/`name` pair `mcp_tool_use` carries.
 
         - `type: :mcp_tool_reference`
@@ -16576,7 +16576,7 @@ puts(beta_message_tokens_count)
 
       - `class BetaToolChangeMCPToolReference`
 
-        Reference to a single MCP tool by its server and remote name — the
+        Reference to a single MCP tool by its server and remote name; the
         same `server_name`/`name` pair `mcp_tool_use` carries.
 
       - `class BetaToolChangeMCPToolsetReference`
@@ -22930,7 +22930,7 @@ puts(beta_message_tokens_count)
 
           - `class BetaToolChangeMCPToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `type: :mcp_tool_reference`
@@ -22972,7 +22972,7 @@ puts(beta_message_tokens_count)
 
           - `class BetaToolChangeMCPToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
           - `class BetaToolChangeMCPToolsetReference`
@@ -29285,7 +29285,7 @@ puts(beta_message_tokens_count)
 
     - `class BetaToolChangeMCPToolReference`
 
-      Reference to a single MCP tool by its server and remote name — the
+      Reference to a single MCP tool by its server and remote name; the
       same `server_name`/`name` pair `mcp_tool_use` carries.
 
       - `type: :mcp_tool_reference`
@@ -29352,7 +29352,7 @@ puts(beta_message_tokens_count)
 
     - `class BetaToolChangeMCPToolReference`
 
-      Reference to a single MCP tool by its server and remote name — the
+      Reference to a single MCP tool by its server and remote name; the
       same `server_name`/`name` pair `mcp_tool_use` carries.
 
       - `type: :mcp_tool_reference`
@@ -31198,7 +31198,7 @@ puts(beta_message_tokens_count)
 
 - `class BetaToolChangeMCPToolReference`
 
-  Reference to a single MCP tool by its server and remote name — the
+  Reference to a single MCP tool by its server and remote name; the
   same `server_name`/`name` pair `mcp_tool_use` carries.
 
   - `type: :mcp_tool_reference`
@@ -38767,7 +38767,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
               - `class BetaToolChangeMCPToolReference`
 
-                Reference to a single MCP tool by its server and remote name — the
+                Reference to a single MCP tool by its server and remote name; the
                 same `server_name`/`name` pair `mcp_tool_use` carries.
 
                 - `type: :mcp_tool_reference`
@@ -38809,7 +38809,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
               - `class BetaToolChangeMCPToolReference`
 
-                Reference to a single MCP tool by its server and remote name — the
+                Reference to a single MCP tool by its server and remote name; the
                 same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `class BetaToolChangeMCPToolsetReference`
diff --git a/content/en/api/ruby/beta/messages/batches.md b/content/en/api/ruby/beta/messages/batches.md
index 41a4a8b2ab..1220914ca5 100644
--- a/content/en/api/ruby/beta/messages/batches.md
+++ b/content/en/api/ruby/beta/messages/batches.md
@@ -1232,7 +1232,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
               - `class BetaToolChangeMCPToolReference`
 
-                Reference to a single MCP tool by its server and remote name — the
+                Reference to a single MCP tool by its server and remote name; the
                 same `server_name`/`name` pair `mcp_tool_use` carries.
 
                 - `type: :mcp_tool_reference`
@@ -1274,7 +1274,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
               - `class BetaToolChangeMCPToolReference`
 
-                Reference to a single MCP tool by its server and remote name — the
+                Reference to a single MCP tool by its server and remote name; the
                 same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `class BetaToolChangeMCPToolsetReference`
diff --git a/content/en/api/ruby/beta/messages/batches/create.md b/content/en/api/ruby/beta/messages/batches/create.md
index 6f2e4c82c0..0c3dd79436 100644
--- a/content/en/api/ruby/beta/messages/batches/create.md
+++ b/content/en/api/ruby/beta/messages/batches/create.md
@@ -1230,7 +1230,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
               - `class BetaToolChangeMCPToolReference`
 
-                Reference to a single MCP tool by its server and remote name — the
+                Reference to a single MCP tool by its server and remote name; the
                 same `server_name`/`name` pair `mcp_tool_use` carries.
 
                 - `type: :mcp_tool_reference`
@@ -1272,7 +1272,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
               - `class BetaToolChangeMCPToolReference`
 
-                Reference to a single MCP tool by its server and remote name — the
+                Reference to a single MCP tool by its server and remote name; the
                 same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `class BetaToolChangeMCPToolsetReference`
diff --git a/content/en/api/ruby/beta/messages/count_tokens.md b/content/en/api/ruby/beta/messages/count_tokens.md
index 0e468ad232..bcc00eadc5 100644
--- a/content/en/api/ruby/beta/messages/count_tokens.md
+++ b/content/en/api/ruby/beta/messages/count_tokens.md
@@ -1198,7 +1198,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
           - `class BetaToolChangeMCPToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `type: :mcp_tool_reference`
@@ -1240,7 +1240,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
           - `class BetaToolChangeMCPToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
           - `class BetaToolChangeMCPToolsetReference`
diff --git a/content/en/api/ruby/beta/messages/create.md b/content/en/api/ruby/beta/messages/create.md
index f0a3981393..3edfa0f8c1 100644
--- a/content/en/api/ruby/beta/messages/create.md
+++ b/content/en/api/ruby/beta/messages/create.md
@@ -1210,7 +1210,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
           - `class BetaToolChangeMCPToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `type: :mcp_tool_reference`
@@ -1252,7 +1252,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
           - `class BetaToolChangeMCPToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
           - `class BetaToolChangeMCPToolsetReference`
diff --git a/content/en/api/skills.md b/content/en/api/skills.md
index 34f97e488a..f924186c6e 100644
--- a/content/en/api/skills.md
+++ b/content/en/api/skills.md
@@ -106,7 +106,7 @@ curl https://api.anthropic.com/v1/skills \
     -H 'Content-Type: multipart/form-data' \
     -H 'anthropic-version: 2023-06-01' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY" \
-    -F files='["Example data"]'
+    -F 'files[]=@/path/to/file'
 ```
 
 #### Response (200)
@@ -623,7 +623,7 @@ curl https://api.anthropic.com/v1/skills/$SKILL_ID/versions \
     -H 'Content-Type: multipart/form-data' \
     -H 'anthropic-version: 2023-06-01' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY" \
-    -F files='["Example data"]'
+    -F 'files[]=@/path/to/file'
 ```
 
 ##### Response (200)
diff --git a/content/en/api/skills/create.md b/content/en/api/skills/create.md
index e67e7843b7..2d8f8eaaa4 100644
--- a/content/en/api/skills/create.md
+++ b/content/en/api/skills/create.md
@@ -104,7 +104,7 @@ curl https://api.anthropic.com/v1/skills \
     -H 'Content-Type: multipart/form-data' \
     -H 'anthropic-version: 2023-06-01' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY" \
-    -F files='["Example data"]'
+    -F 'files[]=@/path/to/file'
 ```
 
 ### Response (200)
diff --git a/content/en/api/skills/versions.md b/content/en/api/skills/versions.md
index 65203139ca..3881895494 100644
--- a/content/en/api/skills/versions.md
+++ b/content/en/api/skills/versions.md
@@ -80,7 +80,7 @@ curl https://api.anthropic.com/v1/skills/$SKILL_ID/versions \
     -H 'Content-Type: multipart/form-data' \
     -H 'anthropic-version: 2023-06-01' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY" \
-    -F files='["Example data"]'
+    -F 'files[]=@/path/to/file'
 ```
 
 #### Response (200)
diff --git a/content/en/api/skills/versions/create.md b/content/en/api/skills/versions/create.md
index fd9c598b70..0bbcd24843 100644
--- a/content/en/api/skills/versions/create.md
+++ b/content/en/api/skills/versions/create.md
@@ -78,7 +78,7 @@ curl https://api.anthropic.com/v1/skills/$SKILL_ID/versions \
     -H 'Content-Type: multipart/form-data' \
     -H 'anthropic-version: 2023-06-01' \
     -H "X-Api-Key: $ANTHROPIC_API_KEY" \
-    -F files='["Example data"]'
+    -F 'files[]=@/path/to/file'
 ```
 
 ### Response (200)
diff --git a/content/en/api/typescript/beta.md b/content/en/api/typescript/beta.md
index 7a20cee472..ba940ad7e4 100644
--- a/content/en/api/typescript/beta.md
+++ b/content/en/api/typescript/beta.md
@@ -2410,7 +2410,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
               - `interface BetaToolChangeMCPToolReference`
 
-                Reference to a single MCP tool by its server and remote name — the
+                Reference to a single MCP tool by its server and remote name; the
                 same `server_name`/`name` pair `mcp_tool_use` carries.
 
                 - `type: "mcp_tool_reference"`
@@ -2452,7 +2452,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
               - `interface BetaToolChangeMCPToolReference`
 
-                Reference to a single MCP tool by its server and remote name — the
+                Reference to a single MCP tool by its server and remote name; the
                 same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `interface BetaToolChangeMCPToolsetReference`
@@ -8683,7 +8683,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
             - `interface BetaToolChangeMCPToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `type: "mcp_tool_reference"`
@@ -8725,7 +8725,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
             - `interface BetaToolChangeMCPToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `interface BetaToolChangeMCPToolsetReference`
@@ -12623,7 +12623,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
                 - `interface BetaToolChangeMCPToolReference`
 
-                  Reference to a single MCP tool by its server and remote name — the
+                  Reference to a single MCP tool by its server and remote name; the
                   same `server_name`/`name` pair `mcp_tool_use` carries.
 
                   - `type: "mcp_tool_reference"`
@@ -12665,7 +12665,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
                 - `interface BetaToolChangeMCPToolReference`
 
-                  Reference to a single MCP tool by its server and remote name — the
+                  Reference to a single MCP tool by its server and remote name; the
                   same `server_name`/`name` pair `mcp_tool_use` carries.
 
                 - `interface BetaToolChangeMCPToolsetReference`
diff --git a/content/en/api/typescript/beta/messages.md b/content/en/api/typescript/beta/messages.md
index ec6d65e7e0..666998940a 100644
--- a/content/en/api/typescript/beta/messages.md
+++ b/content/en/api/typescript/beta/messages.md
@@ -1216,7 +1216,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
               - `interface BetaToolChangeMCPToolReference`
 
-                Reference to a single MCP tool by its server and remote name — the
+                Reference to a single MCP tool by its server and remote name; the
                 same `server_name`/`name` pair `mcp_tool_use` carries.
 
                 - `type: "mcp_tool_reference"`
@@ -1258,7 +1258,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
               - `interface BetaToolChangeMCPToolReference`
 
-                Reference to a single MCP tool by its server and remote name — the
+                Reference to a single MCP tool by its server and remote name; the
                 same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `interface BetaToolChangeMCPToolsetReference`
@@ -7489,7 +7489,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
             - `interface BetaToolChangeMCPToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `type: "mcp_tool_reference"`
@@ -7531,7 +7531,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
             - `interface BetaToolChangeMCPToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `interface BetaToolChangeMCPToolsetReference`
@@ -16938,7 +16938,7 @@ console.log(betaMessageTokensCount.context_management);
 
       - `interface BetaToolChangeMCPToolReference`
 
-        Reference to a single MCP tool by its server and remote name — the
+        Reference to a single MCP tool by its server and remote name; the
         same `server_name`/`name` pair `mcp_tool_use` carries.
 
         - `type: "mcp_tool_reference"`
@@ -16980,7 +16980,7 @@ console.log(betaMessageTokensCount.context_management);
 
       - `interface BetaToolChangeMCPToolReference`
 
-        Reference to a single MCP tool by its server and remote name — the
+        Reference to a single MCP tool by its server and remote name; the
         same `server_name`/`name` pair `mcp_tool_use` carries.
 
       - `interface BetaToolChangeMCPToolsetReference`
@@ -23560,7 +23560,7 @@ console.log(betaMessageTokensCount.context_management);
 
           - `interface BetaToolChangeMCPToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `type: "mcp_tool_reference"`
@@ -23602,7 +23602,7 @@ console.log(betaMessageTokensCount.context_management);
 
           - `interface BetaToolChangeMCPToolReference`
 
-            Reference to a single MCP tool by its server and remote name — the
+            Reference to a single MCP tool by its server and remote name; the
             same `server_name`/`name` pair `mcp_tool_use` carries.
 
           - `interface BetaToolChangeMCPToolsetReference`
@@ -30413,7 +30413,7 @@ console.log(betaMessageTokensCount.context_management);
 
     - `interface BetaToolChangeMCPToolReference`
 
-      Reference to a single MCP tool by its server and remote name — the
+      Reference to a single MCP tool by its server and remote name; the
       same `server_name`/`name` pair `mcp_tool_use` carries.
 
       - `type: "mcp_tool_reference"`
@@ -30480,7 +30480,7 @@ console.log(betaMessageTokensCount.context_management);
 
     - `interface BetaToolChangeMCPToolReference`
 
-      Reference to a single MCP tool by its server and remote name — the
+      Reference to a single MCP tool by its server and remote name; the
       same `server_name`/`name` pair `mcp_tool_use` carries.
 
       - `type: "mcp_tool_reference"`
@@ -32380,7 +32380,7 @@ console.log(betaMessageTokensCount.context_management);
 
 - `interface BetaToolChangeMCPToolReference`
 
-  Reference to a single MCP tool by its server and remote name — the
+  Reference to a single MCP tool by its server and remote name; the
   same `server_name`/`name` pair `mcp_tool_use` carries.
 
   - `type: "mcp_tool_reference"`
@@ -40005,7 +40005,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
                 - `interface BetaToolChangeMCPToolReference`
 
-                  Reference to a single MCP tool by its server and remote name — the
+                  Reference to a single MCP tool by its server and remote name; the
                   same `server_name`/`name` pair `mcp_tool_use` carries.
 
                   - `type: "mcp_tool_reference"`
@@ -40047,7 +40047,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
                 - `interface BetaToolChangeMCPToolReference`
 
-                  Reference to a single MCP tool by its server and remote name — the
+                  Reference to a single MCP tool by its server and remote name; the
                   same `server_name`/`name` pair `mcp_tool_use` carries.
 
                 - `interface BetaToolChangeMCPToolsetReference`
diff --git a/content/en/api/typescript/beta/messages/batches.md b/content/en/api/typescript/beta/messages/batches.md
index 0d694a7e86..8de480c90c 100644
--- a/content/en/api/typescript/beta/messages/batches.md
+++ b/content/en/api/typescript/beta/messages/batches.md
@@ -1234,7 +1234,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
                 - `interface BetaToolChangeMCPToolReference`
 
-                  Reference to a single MCP tool by its server and remote name — the
+                  Reference to a single MCP tool by its server and remote name; the
                   same `server_name`/`name` pair `mcp_tool_use` carries.
 
                   - `type: "mcp_tool_reference"`
@@ -1276,7 +1276,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
                 - `interface BetaToolChangeMCPToolReference`
 
-                  Reference to a single MCP tool by its server and remote name — the
+                  Reference to a single MCP tool by its server and remote name; the
                   same `server_name`/`name` pair `mcp_tool_use` carries.
 
                 - `interface BetaToolChangeMCPToolsetReference`
diff --git a/content/en/api/typescript/beta/messages/batches/create.md b/content/en/api/typescript/beta/messages/batches/create.md
index 4e3b22dd38..43e0cb4dbb 100644
--- a/content/en/api/typescript/beta/messages/batches/create.md
+++ b/content/en/api/typescript/beta/messages/batches/create.md
@@ -1232,7 +1232,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
                 - `interface BetaToolChangeMCPToolReference`
 
-                  Reference to a single MCP tool by its server and remote name — the
+                  Reference to a single MCP tool by its server and remote name; the
                   same `server_name`/`name` pair `mcp_tool_use` carries.
 
                   - `type: "mcp_tool_reference"`
@@ -1274,7 +1274,7 @@ Learn more about the Message Batches API in our [user guide](https://platform.cl
 
                 - `interface BetaToolChangeMCPToolReference`
 
-                  Reference to a single MCP tool by its server and remote name — the
+                  Reference to a single MCP tool by its server and remote name; the
                   same `server_name`/`name` pair `mcp_tool_use` carries.
 
                 - `interface BetaToolChangeMCPToolsetReference`
diff --git a/content/en/api/typescript/beta/messages/count_tokens.md b/content/en/api/typescript/beta/messages/count_tokens.md
index bbd2aebb3a..eafc4ee995 100644
--- a/content/en/api/typescript/beta/messages/count_tokens.md
+++ b/content/en/api/typescript/beta/messages/count_tokens.md
@@ -1200,7 +1200,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
             - `interface BetaToolChangeMCPToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `type: "mcp_tool_reference"`
@@ -1242,7 +1242,7 @@ Learn more about token counting in our [user guide](https://platform.claude.com/
 
             - `interface BetaToolChangeMCPToolReference`
 
-              Reference to a single MCP tool by its server and remote name — the
+              Reference to a single MCP tool by its server and remote name; the
               same `server_name`/`name` pair `mcp_tool_use` carries.
 
             - `interface BetaToolChangeMCPToolsetReference`
diff --git a/content/en/api/typescript/beta/messages/create.md b/content/en/api/typescript/beta/messages/create.md
index 2d675f5f96..a7c4844595 100644
--- a/content/en/api/typescript/beta/messages/create.md
+++ b/content/en/api/typescript/beta/messages/create.md
@@ -1214,7 +1214,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
               - `interface BetaToolChangeMCPToolReference`
 
-                Reference to a single MCP tool by its server and remote name — the
+                Reference to a single MCP tool by its server and remote name; the
                 same `server_name`/`name` pair `mcp_tool_use` carries.
 
                 - `type: "mcp_tool_reference"`
@@ -1256,7 +1256,7 @@ Learn more about the Messages API in our [user guide](https://platform.claude.co
 
               - `interface BetaToolChangeMCPToolReference`
 
-                Reference to a single MCP tool by its server and remote name — the
+                Reference to a single MCP tool by its server and remote name; the
                 same `server_name`/`name` pair `mcp_tool_use` carries.
 
               - `interface BetaToolChangeMCPToolsetReference`
diff --git a/content/en/build-with-claude/claude-in-microsoft-foundry.md b/content/en/build-with-claude/claude-in-microsoft-foundry.md
index db289cb8e6..c0652b3ffb 100644
--- a/content/en/build-with-claude/claude-in-microsoft-foundry.md
+++ b/content/en/build-with-claude/claude-in-microsoft-foundry.md
@@ -676,18 +676,18 @@ Lifecycle terms (Deprecated, Retired) are defined in [Model deprecations](https:
 The following Claude models are available through Foundry:
 
 | Model             | Default deployment name | Hosted on Azure | Hosted on Anthropic |
-| ----------------- | ----------------------- | --------------- | ------------------- |
-| Claude Fable 5.1  | claude-fable-5-1        |                 | ✓                   |
-| Claude Fable 5    | claude-fable-5          |                 | ✓                   |
-| Claude Opus 5     | claude-opus-5           | ✓               | ✓                   |
-| Claude Opus 4.8   | claude-opus-4-8         | ✓               | ✓                   |
-| Claude Opus 4.7   | claude-opus-4-7         |                 | ✓                   |
-| Claude Opus 4.6   | claude-opus-4-6         |                 | ✓                   |
-| Claude Opus 4.5   | claude-opus-4-5         |                 | ✓                   |
-| Claude Sonnet 5   | claude-sonnet-5         | ✓               | ✓                   |
-| Claude Sonnet 4.6 | claude-sonnet-4-6       |                 | ✓                   |
-| Claude Sonnet 4.5 | claude-sonnet-4-5       |                 | ✓                   |
-| Claude Haiku 4.5  | claude-haiku-4-5        | ✓               | ✓                   |
+| :---------------- | :---------------------- | :-------------: | :-----------------: |
+| Claude Fable 5.1  | `claude-fable-5-1`      |                 |          ✓          |
+| Claude Fable 5    | `claude-fable-5`        |                 |          ✓          |
+| Claude Opus 5     | `claude-opus-5`         |        ✓        |          ✓          |
+| Claude Opus 4.8   | `claude-opus-4-8`       |        ✓        |          ✓          |
+| Claude Opus 4.7   | `claude-opus-4-7`       |                 |          ✓          |
+| Claude Opus 4.6   | `claude-opus-4-6`       |                 |          ✓          |
+| Claude Opus 4.5   | `claude-opus-4-5`       |                 |          ✓          |
+| Claude Sonnet 5   | `claude-sonnet-5`       |        ✓        |          ✓          |
+| Claude Sonnet 4.6 | `claude-sonnet-4-6`     |                 |          ✓          |
+| Claude Sonnet 4.5 | `claude-sonnet-4-5`     |                 |          ✓          |
+| Claude Haiku 4.5  | `claude-haiku-4-5`      |        ✓        |          ✓          |
 
 By default, deployment names match the model IDs shown in the preceding table. However, you can create custom deployments with different names in the Foundry portal to manage different configurations, versions, or rate limits. Use the deployment name (not necessarily the model ID) in your API requests.
 
diff --git a/content/en/build-with-claude/claude-on-vertex-ai.md b/content/en/build-with-claude/claude-on-vertex-ai.md
index 3315823b7b..9b9c3abd79 100644
--- a/content/en/build-with-claude/claude-on-vertex-ai.md
+++ b/content/en/build-with-claude/claude-on-vertex-ai.md
@@ -115,24 +115,23 @@ Note that Anthropic model availability varies by region. Search for "Claude" in
 
 Lifecycle terms (Deprecated, Retired) are defined in [Model deprecations](https://platform.claude.com/docs/en/about-claude/model-deprecations). Lifecycle dates on partner-operated platforms are set by the partner and can differ from the Claude API schedule. For the current retirement date of any model on Agent Platform, see [Google Cloud's documentation for Claude models on Agent Platform](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/partner-models/claude).
 
-| Model                        | Agent Platform API model ID |
-| ---------------------------- | --------------------------- |
-| Claude Fable 5.1             | claude-fable-5-1            |
-| Claude Fable 5               | claude-fable-5              |
-| Claude Opus 5                | claude-opus-5               |
-| Claude Opus 4.8              | claude-opus-4-8             |
-| Claude Opus 4.7              | claude-opus-4-7             |
-| Claude Opus 4.6              | claude-opus-4-6             |
-| Claude Sonnet 5              | `claude-sonnet-5`           |
-| Claude Sonnet 4.6            | claude-sonnet-4-6           |
-| Claude Sonnet 4.5            | claude-sonnet-4-5\@20250929 |
-| Claude Sonnet 4 Deprecated.  | claude-sonnet-4\@20250514   |
-| Claude Sonnet 3.7 Retired.   | claude-3-7-sonnet\@20250219 |
-| Claude Opus 4.5              | claude-opus-4-5\@20251101   |
-| Claude Opus 4.1 Deprecated.  | claude-opus-4-1\@20250805   |
-| Claude Opus 4 Deprecated.    | claude-opus-4\@20250514     |
-| Claude Haiku 4.5             | claude-haiku-4-5\@20251001  |
-| Claude Haiku 3.5 Deprecated. | claude-3-5-haiku\@20241022  |
+| Model                                                                                                | Agent Platform API model ID  |
+| :--------------------------------------------------------------------------------------------------- | :--------------------------- |
+| Claude Fable 5.1                                                                                     | `claude-fable-5-1`           |
+| Claude Fable 5                                                                                       | `claude-fable-5`             |
+| Claude Opus 5                                                                                        | `claude-opus-5`              |
+| Claude Opus 4.8                                                                                      | `claude-opus-4-8`            |
+| Claude Opus 4.7                                                                                      | `claude-opus-4-7`            |
+| Claude Opus 4.6                                                                                      | `claude-opus-4-6`            |
+| Claude Opus 4.5                                                                                      | `claude-opus-4-5@20251101`   |
+| Claude Opus 4.1 ([deprecated](https://platform.claude.com/docs/en/about-claude/model-deprecations))  | `claude-opus-4-1@20250805`   |
+| Claude Opus 4 ([deprecated](https://platform.claude.com/docs/en/about-claude/model-deprecations))    | `claude-opus-4@20250514`     |
+| Claude Sonnet 5                                                                                      | `claude-sonnet-5`            |
+| Claude Sonnet 4.6                                                                                    | `claude-sonnet-4-6`          |
+| Claude Sonnet 4.5                                                                                    | `claude-sonnet-4-5@20250929` |
+| Claude Sonnet 4 ([deprecated](https://platform.claude.com/docs/en/about-claude/model-deprecations))  | `claude-sonnet-4@20250514`   |
+| Claude Haiku 4.5                                                                                     | `claude-haiku-4-5@20251001`  |
+| Claude Haiku 3.5 ([deprecated](https://platform.claude.com/docs/en/about-claude/model-deprecations)) | `claude-3-5-haiku@20241022`  |
 
 <Tip>
   Upgrading to a newer Claude model? In Claude Code, run `/claude-api migrate` to apply model ID swaps and breaking parameter changes across your codebase. The skill detects which cloud platform your code targets and adjusts model ID formats and feature changes for that platform. See [Migrating to a newer Claude model](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/claude-api-skill#migrating-to-a-newer-claude-model).
diff --git a/content/en/build-with-claude/claude-platform-on-aws.md b/content/en/build-with-claude/claude-platform-on-aws.md
index a926d63690..ce989f41f8 100644
--- a/content/en/build-with-claude/claude-platform-on-aws.md
+++ b/content/en/build-with-claude/claude-platform-on-aws.md
@@ -344,19 +344,19 @@ Anthropic's [client SDKs](https://platform.claude.com/docs/en/cli-sdks-libraries
 
 The following models are available on Claude Platform on AWS:
 
-| Model             | Model ID          |
-| :---------------- | :---------------- |
-| Claude Fable 5.1  | claude-fable-5-1  |
-| Claude Fable 5    | claude-fable-5    |
-| Claude Opus 5     | claude-opus-5     |
-| Claude Opus 4.8   | claude-opus-4-8   |
-| Claude Opus 4.7   | claude-opus-4-7   |
-| Claude Opus 4.6   | claude-opus-4-6   |
-| Claude Opus 4.5   | claude-opus-4-5   |
-| Claude Sonnet 5   | claude-sonnet-5   |
-| Claude Sonnet 4.6 | claude-sonnet-4-6 |
-| Claude Sonnet 4.5 | claude-sonnet-4-5 |
-| Claude Haiku 4.5  | claude-haiku-4-5  |
+| Model             | Model ID            |
+| :---------------- | :------------------ |
+| Claude Fable 5.1  | `claude-fable-5-1`  |
+| Claude Fable 5    | `claude-fable-5`    |
+| Claude Opus 5     | `claude-opus-5`     |
+| Claude Opus 4.8   | `claude-opus-4-8`   |
+| Claude Opus 4.7   | `claude-opus-4-7`   |
+| Claude Opus 4.6   | `claude-opus-4-6`   |
+| Claude Opus 4.5   | `claude-opus-4-5`   |
+| Claude Sonnet 5   | `claude-sonnet-5`   |
+| Claude Sonnet 4.6 | `claude-sonnet-4-6` |
+| Claude Sonnet 4.5 | `claude-sonnet-4-5` |
+| Claude Haiku 4.5  | `claude-haiku-4-5`  |
 
 Model IDs are identical to the first-party Claude API. There are no Bedrock-style ARNs or `anthropic.` prefixes.
 
diff --git a/content/en/build-with-claude/extended-thinking.md b/content/en/build-with-claude/extended-thinking.md
index 141b7da919..81108dcc94 100644
--- a/content/en/build-with-claude/extended-thinking.md
+++ b/content/en/build-with-claude/extended-thinking.md
@@ -54,7 +54,7 @@ Here is an example of using extended thinking in the Messages API:
 
   ```bash CLI
   ant messages create \
-    --transform content --format yaml <<'YAML'
+    --format yaml <<'YAML'
   model: claude-sonnet-4-6
   max_tokens: 16000
   thinking:
diff --git a/content/en/build-with-claude/preserved-thinking.md b/content/en/build-with-claude/preserved-thinking.md
index 6621d758cd..99fe250716 100644
--- a/content/en/build-with-claude/preserved-thinking.md
+++ b/content/en/build-with-claude/preserved-thinking.md
@@ -140,7 +140,6 @@ The following request opts into dropping rather than rejecting. On a first turn
 
   ```bash CLI
   ant beta:messages create --beta thinking-binding-controls-2026-08-01 \
-    --transform '{content.#(type=="text")#.text,input_transformations}' \
     --format yaml <<'YAML'
   model: claude-fable-5-1
   max_tokens: 16000
diff --git a/content/en/build-with-claude/refusals-and-fallback.md b/content/en/build-with-claude/refusals-and-fallback.md
index 0df5844893..0042f68470 100644
--- a/content/en/build-with-claude/refusals-and-fallback.md
+++ b/content/en/build-with-claude/refusals-and-fallback.md
@@ -29,7 +29,7 @@ The simplest setup, in beta on the Claude API: set `fallbacks` to `"default"`, a
       "max_tokens": 1024,
       "fallbacks": "default",
       "messages": [{"role": "user", "content": "Hello, Claude"}]
-    }' | jq -r '.model'
+    }'
   ```
 
   ```bash CLI
@@ -38,8 +38,7 @@ The simplest setup, in beta on the Claude API: set `fallbacks` to `"default"`, a
     --max-tokens 1024 \
     --message '{"role":"user","content":"Hello, Claude"}' \
     --fallbacks default \
-    --beta server-side-fallback-2026-07-01 \
-    --transform model --raw-output
+    --beta server-side-fallback-2026-07-01
   ```
 
   ```python Python
@@ -504,7 +503,7 @@ The highlighted lines are the only difference from the default-routing request.
       "max_tokens": 1024,
       "fallbacks": [{"model": "claude-opus-4-8"}],
       "messages": [{"role": "user", "content": "Hello, Claude"}]
-    }' | jq -r '.model'
+    }'
   ```
 
   ```bash CLI
@@ -513,8 +512,7 @@ The highlighted lines are the only difference from the default-routing request.
     --max-tokens 1024 \
     --message '{"role":"user","content":"Hello, Claude"}' \
     --fallbacks '[{"model":"claude-opus-4-8"}]' \
-    --beta server-side-fallback-2026-07-01 \
-    --transform model --raw-output
+    --beta server-side-fallback-2026-07-01
   ```
 
   ```python Python
diff --git a/content/en/build-with-claude/skills-guide.md b/content/en/build-with-claude/skills-guide.md
index a528d54923..f208e955c4 100644
--- a/content/en/build-with-claude/skills-guide.md
+++ b/content/en/build-with-claude/skills-guide.md
@@ -2166,7 +2166,7 @@ Upload your custom Skill to make it available in your workspace. You can upload
 
 Files are identified by the filename you attach (the `;filename=` suffix in the cURL example and the filename arguments in the SDK examples). For the walkthrough's skill, create a zip with `zip -r financial_skill.zip financial_skill/` and substitute it for the `example_skill.zip` placeholder in the zip-upload options.
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   curl -X POST "https://api.anthropic.com/v1/skills" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
@@ -2471,7 +2471,7 @@ For complete request/response schemas, see the [Create Skill API reference](http
 
 Retrieve all Skills available to your workspace, including both Anthropic pre-built Skills and your custom Skills. Use the `source` parameter to filter by skill type:
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   # List all Skills
   curl "https://api.anthropic.com/v1/skills" \
@@ -2617,7 +2617,7 @@ See the [List Skills API reference](https://platform.claude.com/docs/en/api/skil
 
 Get details about a specific Skill:
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   curl "https://api.anthropic.com/v1/skills/skill_01AbCdEfGhIjKlMnOpQrStUv" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
@@ -2714,7 +2714,7 @@ Get details about a specific Skill:
 
 Deleting a Skill also removes all of its versions.
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   curl -X DELETE "https://api.anthropic.com/v1/skills/skill_01AbCdEfGhIjKlMnOpQrStUv" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
@@ -2795,7 +2795,7 @@ Skills support versioning to manage updates safely:
 
 A new version is a complete snapshot, not a delta: upload the Skill's full file set each time. Files you omit are not carried over, and the `name` in the new version's `SKILL.md` must match the Skill's existing name. The following examples re-upload the complete `financial_skill/` bundle from [Creating a Skill](https://platform.claude.com/docs/en/build-with-claude/skills-guide#creating-a-skill).
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   # Create a new version
   NEW_VERSION=$(curl -X POST "https://api.anthropic.com/v1/skills/skill_01AbCdEfGhIjKlMnOpQrStUv/versions" \
diff --git a/content/en/build-with-claude/thinking.md b/content/en/build-with-claude/thinking.md
index 05b5c12253..f02d9dfdf2 100644
--- a/content/en/build-with-claude/thinking.md
+++ b/content/en/build-with-claude/thinking.md
@@ -1163,23 +1163,22 @@ You can't prefill the assistant response while thinking is on. Forced tool use (
 
 Each model accepts `max_tokens` up to the ceiling listed here. On the [Message Batches API](https://platform.claude.com/docs/en/build-with-claude/batch-processing#extended-output-beta), the `output-300k-2026-03-24` [beta header](https://platform.claude.com/docs/en/api/beta-headers) raises that ceiling for the models with a batches ceiling listed.
 
-| Model             | Max output tokens | Batches beta ceiling |
-| :---------------- | :---------------- | :------------------- |
-| Claude Fable 5.1  | 128K              | —                    |
-| Claude Mythos 5.1 | 128K              | —                    |
-| Claude Fable 5    | 128K              | —                    |
-| Claude Mythos 5   | 128K              | —                    |
-| Claude Opus 5     | 128K              | 300K                 |
-| Claude Opus 4.8   | 128K              | 300K                 |
-| Claude Opus 4.7   | 128K              | 300K                 |
-| Claude Opus 4.6   | 128K              | 300K                 |
-| Claude Opus 4.5   | 64K               | Not available        |
-| Claude Sonnet 5   | 128K              | 300K                 |
-| Claude Sonnet 4.6 | 128K              | 300K                 |
-| Claude Sonnet 4.5 | 64K               | Not available        |
-| Claude Haiku 4.5  | 64K               | Not available        |
-
-[Claude Mythos Preview](https://anthropic.com/glasswing) accepts `max_tokens` up to 128K; the Batches beta ceiling is not available for it.
+| Model                 | Max output tokens | Batches beta ceiling |
+| :-------------------- | :---------------- | :------------------- |
+| Claude Fable 5.1      | 128K              | —                    |
+| Claude Mythos 5.1     | 128K              | —                    |
+| Claude Fable 5        | 128K              | —                    |
+| Claude Mythos 5       | 128K              | —                    |
+| Claude Mythos Preview | 128K              | Not available        |
+| Claude Opus 5         | 128K              | 300K                 |
+| Claude Opus 4.8       | 128K              | 300K                 |
+| Claude Opus 4.7       | 128K              | 300K                 |
+| Claude Opus 4.6       | 128K              | 300K                 |
+| Claude Opus 4.5       | 64K               | Not available        |
+| Claude Sonnet 5       | 128K              | 300K                 |
+| Claude Sonnet 4.6     | 128K              | 300K                 |
+| Claude Sonnet 4.5     | 64K               | Not available        |
+| Claude Haiku 4.5      | 64K               | Not available        |
 
 See the [models overview](https://platform.claude.com/docs/en/models/overview) for limits on legacy models.
 
diff --git a/content/en/docs/claude-code/artifacts.md b/content/en/docs/claude-code/artifacts.md
index 6ea8a7b160..e5ed747a8d 100644
--- a/content/en/docs/claude-code/artifacts.md
+++ b/content/en/docs/claude-code/artifacts.md
@@ -249,7 +249,7 @@ Turn this migration plan into a checklist artifact. Check items off as you compl
 
 ## Improve the visual design
 
-Claude applies a built-in design skill when it builds an artifact, so pages get a deliberate palette, typography, and layout without extra prompting. Requires Claude Code v2.1.182 or later. That skill also looks for an existing design system in your project before choosing its own. Design tokens are the named color, typography, and spacing values your design system reuses. To keep artifacts consistent with your product's branding, record them where Claude can find them, such as the project's [CLAUDE.md](/docs/en/memory) or a theme file in your repository:
+Claude applies a built-in design skill when it builds an artifact, so pages get a deliberate palette, typography, and layout without extra prompting. That skill also looks for an existing design system in your project before choosing its own. Design tokens are the named color, typography, and spacing values your design system reuses. To keep artifacts consistent with your product's branding, record them where Claude can find them, such as the project's [CLAUDE.md](/docs/en/memory) or a theme file in your repository:
 
 ```markdown theme={null}
 ## Design system
diff --git a/content/en/docs/claude-code/changelog.md b/content/en/docs/claude-code/changelog.md
index bcd481d262..e43e672e9f 100644
--- a/content/en/docs/claude-code/changelog.md
+++ b/content/en/docs/claude-code/changelog.md
@@ -10,6 +10,101 @@ This page is generated from the [CHANGELOG.md on GitHub](https://github.com/anth
 
 Run `claude --version` to check your installed version.
 
+<Update label="2.1.278" description="September 19, 2026">
+  * Changed auto mode for Claude API and Enterprise users, and on Bedrock, Vertex, Foundry and gateways, to default to the server-side classifier, which does not charge for classifier overhead (`CLAUDE_CODE_AUTO_MODE_SERVER=0` opts out on Bedrock, Vertex, Foundry and gateways); warns on billed fallback. See [https://code.claude.com/docs/en/auto-mode-classifier-billing](https://code.claude.com/docs/en/auto-mode-classifier-billing)
+  * Added an `Auto mode server` row to `/status` showing whether this session's auto mode classifier runs on the server
+</Update>
+
+<Update label="2.1.277" description="September 18, 2026">
+  * Added AGENTS.md support: in a project with no CLAUDE.md, Claude Code reads AGENTS.md instead; change it under "Project instructions" in `/config` (not yet on Bedrock, Vertex or Foundry)
+  * Added `CLAUDE_GATEWAY_PROXY_IS_EGRESS_BOUNDARY=1` for Claude apps gateways whose only egress is a forward proxy: every outbound request hands the proxy the hostname instead of resolving it locally
+  * Added an optional `headers:` map on Claude apps gateway upstreams, to send static headers to a proxy you run in front of a provider
+  * Added a line saying a background task's update is waiting when it finishes while a panel such as `/tasks` is open
+  * Fixed `claude -p` and Agent SDK sessions that could hang with no result after an internal error; they now report the error and exit with code 1
+  * Fixed conversations failing every request with "text content blocks must be non-empty" when an earlier assistant turn held an empty text block beside other content, including after `--resume`
+  * Fixed being unexpectedly logged out when an older Claude Code build (for example an IDE extension's bundled CLI) runs on the same machine as the current one
+  * Fixed interactive start-up hanging or showing an error for `ANTHROPIC_API_KEY` users when `~/.claude.json` holds a malformed `customApiKeyResponses` value
+  * Fixed update checks erroring every 30 minutes, and `claude update` hanging when a minimum or maximum version is set, if a proxy returns an invalid version; a malformed `minimumVersion` is now ignored
+  * Fixed `claude update` on winget- or apk-managed installs reporting "up to date" when the version lookup failed
+  * Fixed `claude plugin install` sometimes failing and breaking the installed copy when reinstalling a plugin version that a session or another program was using; an unchanged copy is now left alone
+  * Fixed Grep and Glob reporting no matches when the search could not start because the system was out of processes, memory or file handles; they now return an error saying so
+  * Fixed the Write tool silently ending the turn as a declined permission when the target path is an existing directory; it now reports a clear error
+  * Fixed the Edit tool treating an escaped backslash followed by `uXXXX` text as a `\uXXXX` escape, which could make an edit of a non-ASCII character rewrite an escaped backslash sequence instead
+  * Fixed the Edit tool reporting "Invalid regular expression: regular expression too large" instead of "String not found in file" when a very large edit containing non-ASCII text did not match the file
+  * Fixed a turn ending early with "Path contains null bytes" when a tool call's file path contained `\u0000` written as an escape sequence; escaped control characters now stay as literal text
+  * Fixed background sessions (`claude --bg`) exiting when a plugin's LSP server exited or closed its stdin
+  * Fixed a crash ("Type error") when opening `/mcp` or `/plugin manage` with a malformed `claudeAiMcpEverConnected` value in `~/.claude.json`
+  * Fixed a crash at launch when `~/.claude.json` holds a malformed `theme` value
+  * Fixed a crash ("unrecoverable interface error") when the prompt held text containing terminal color codes, for example a prompt recalled from history or text loaded from the external editor
+  * Fixed a crash when resuming a session whose saved history holds an assistant message stored as a plain string
+  * Fixed sessions on slow or heavily loaded machines sometimes exiting with "Claude Code exited after an unrecoverable interface error" when the first spinner appeared
+  * Fixed a rare case where the screen could stop updating for the rest of the session after an internal rendering error
+  * Fixed a rare case on Windows where a turn could stop with an error such as "Out of memory" right after Claude replied, so that reply's tool calls never ran
+  * Fixed sessions continued after `/clear` (restart, `--continue`, `--resume`) missing part of their first message when a SessionStart hook printed output, causing a full prompt-cache miss
+  * Fixed messages from other agents (such as a subagent's SendMessage) that arrived mid-turn showing up below the "Ran N shell commands" row instead of where they arrived
+  * Fixed the "copied" notice not appearing after drag-selecting text in the fullscreen `/resume` picker and other panels that cover the prompt area
+  * Fixed `$TMPDIR` expanding empty in Bash commands that run outside the sandbox while sandboxing is enabled
+  * Fixed WebFetch and WebSearch in Cowork cloud sessions not telling Claude why a request was refused, such as a used-up fetch budget or an admin policy
+  * Fixed the Claude apps gateway's telemetry relay ignoring a collector hostname or domain listed in `NO_PROXY` when a proxy is set
+  * Fixed one malformed `strictKnownMarketplaces` or `blockedMarketplaces` entry silently disabling the whole enterprise marketplace policy
+  * Fixed failed auto-updates leaving large staged downloads behind in `~/.cache/claude/staging`
+  * Fixed `/plugin` not stripping terminal control characters from messages on the Installed tab, such as the error of a failed plugin update
+  * Fixed `/plugin` → Installed and `/skills` crashing when a skill or legacy command is named like a built-in Object property such as `constructor` or `toString`
+  * Fixed `/plugin` closing with no message when every install in a multi-select failed
+  * Fixed uninstalled plugins reappearing as "failed to load" rows in `/plugin` Installed, and Remove not clearing such a row
+  * Fixed plugins from the official marketplace being recorded without their commit in `installed_plugins.json`, and `installed_plugins.json` keeping the old commit after updating a pinned-commit plugin
+  * Fixed plugin reload previews keeping every previewed copy of a plugin archive unpacked until exit, and overwriting the cached `--plugin-url` archive a reload falls back to when its download fails
+  * Fixed Remote Control session bookkeeping failing when `~/.claude.json` holds a malformed placeholder record
+  * Fixed the error after a revoked claude.ai login blaming an expired Anthropic profile; it now leads with `/login`
+  * Fixed typed or pasted text occasionally coming out scrambled in the `claude agents` dispatch input during key repeat or very fast input
+  * Fixed a crash ("unrecoverable interface error") when resuming a session whose saved transcript contains a stop hook summary without a well-formed hook list
+  * Fixed Enter on a selected agent panel row doing nothing when `keybindings.json` rebinds Enter in the Chat context, for example to `chat:queueSubmit`
+  * Fixed PDF page reads on Windows failing when the working folder's path is long (about 120 characters or more)
+  * Fixed a headless resume (`claude -p --resume`, the SDK, a VS Code extension window reload) starting the session's cost and usage totals at zero; headless sessions now save their totals at exit
+  * Fixed project skills from the main repository not loading in `--worktree` sessions when `.claude/skills` is untracked
+  * Fixed a `sandbox.excludedCommands` glob exempting an entire compound Bash command from the sandbox when only one part matched; every part must now match
+  * Fixed resumed subagents and teammates re-rendering the MCP tool definitions they had loaded, which broke prompt caching for that agent
+  * Fixed rate-limited artifact publishes telling Claude to stop retrying; Claude is now told nothing was published and when to send the same publish again
+  * Fixed attachments recorded earlier in a conversation being re-rendered after a resume or relaunch, which dropped extended thinking and missed the prompt cache
+  * Fixed Console sign-in showing only "Request failed with status code 400" when the server refuses to create an API key; it now shows the server's message
+  * Fixed messages typed while Claude is still working sometimes being ignored by the model
+  * Improved session start-up for SDK and headless (`-p`) use: the first turn no longer waits on the per-directory CLAUDE.md lookup
+  * Improved the Claude apps gateway's loopback error messages to name `CLAUDE_GATEWAY_ALLOW_LOOPBACK`
+  * Improved `/plugin` Installed: an MCP server listed apart from its plugin now shows which plugin it belongs to
+  * Improved `claude plugin install` on an already-installed plugin: it now says when the marketplace offers a newer version and names the `claude plugin update` command
+  * Improved the startup notice overflow line under the logo: it now reads "N more notices hidden" instead of "+N more · /status"
+  * Improved prompt handling: invisible Unicode formatting and tag characters in a prompt are removed and the cleaned prompt is shown for review before it is sent
+  * Improved `/ultrareview` when there's nothing to review: messages say which case you're in, offer a command that reviews your latest commit, and a new repository's first commit is reviewed in full
+  * Improved artifact link handling so Claude reads claude.ai artifact links with the Artifact tool instead of WebFetch when that tool is available
+  * Improved the dangerous-rm permission prompt to name the flagged rm command and suggest a `${VAR:?}` guard, so headless runs can recover
+  * Improved the Artifact tool's permission prompts: shorter sentences, pages and artifacts named by title or file name, and links listed after the text
+  * Changed Fable to always appear in `/model` on the Anthropic API; it is greyed out only when your organization's settings disable it
+  * Changed the Bash sandbox instructions on Bedrock, Vertex and Foundry to the first-party wording, which frames the sandbox as the boundary of what the task was given
+  * Changed `/ultrareview` in non-interactive sessions to refuse when the repository has no base branch or shared history
+  * Changed subagent results to reach the main agent under a header marking them as subagent output, with the result indented, so text in a subagent's result cannot pass as the session's own instructions
+  * Changed workflow scripts' computed `agent()` prompts on Bedrock, Vertex and Foundry to reach the subagent framed as script-authored text, so the safety classifier does not read them as the user
+  * Removed the background Haiku auto-title request from `claude -p` runs launched outside an SDK or IDE
+  * Removed the deprecated TaskOutput tool; Claude reads a background task's output file with Read instead, and the `taskOutputMaxChars` setting and `TASK_MAX_OUTPUT_LENGTH` no longer have any effect
+  * \[VSCode] Added a Sign out row to the panel menu, with `/logout` in the typed command menu
+  * \[VSCode] Added background shells and other running tasks to the agent map, each with a Stop, and a typed `/tasks` that opens it
+  * \[VSCode] Added a Copy response button on responses and a typed `/copy`
+  * \[VSCode] Added a one-time notice when inactive sessions are archived automatically, and an "Unarchive all" action on the Archived sessions group
+  * \[VSCode] Added the session's cost and token usage to the Account & usage dialog and the session manager where plan limits do not apply (Vertex, Bedrock, Foundry, API key)
+  * \[VSCode] Fixed the "General config" menu row showing `/config` usage text instead of opening settings, and made typed `/mcp`, `/hooks`, `/memory`, `/rewind` and similar commands open their dialogs
+  * \[VSCode] Fixed the effort slider's level not persisting into later sessions on a model that already had a level saved with `/effort`
+  * \[VSCode] Fixed Auto missing from the mode picker for conversations opened in an already-used panel when the saved model setting is a differently-cased alias such as "Sonnet"
+  * \[VSCode] Fixed `/fast` not saving fast mode as the default, so it was lost when the extension relaunched Claude Code
+  * \[Claude Code on the web] Added Personal and Organization sections to the environment picker on Team and Enterprise plans, and admins can now share a personal environment with the organization
+  * \[Claude Code on the web] Changed organization environments to open as a read-only summary from the Code tab on Team and Enterprise plans, with editing under Admin settings → Cloud environments
+  * \[Claude Code on the web] Fixed a cloud environment saved with Custom network access and no domains silently reverting to Trusted; the dialog now asks for at least one domain
+  * \[Claude Code on the web] Changed the admin Claude Code setting labeled "Web" to "Cloud sessions" and removed the redundant read-only Mobile row beneath it
+  * \[Claude Tag] Fixed routines created in a Slack channel on an Enterprise Grid org-wide install failing to read other public channels in their workspace when they ran
+  * \[Claude Tag] Fixed the "Learn more" links on credential presets in Claude Tag access bundles to open each vendor's credential-setup page instead of a generic API reference
+  * \[Claude Tag] Changed the Pylon credential preset in Claude Tag access bundles so admins can point it at Pylon's EU host
+  * \[Claude Tag] Fixed Google Cloud credential forms in Claude Tag access bundles: a refused key file now says why, the website and scopes stay locked, and a rejected rotation keeps the pasted key
+  * \[Claude Tag] Fixed the network events log in Claude Tag admin settings showing no response status for requests through connections that use AWS signing, client certificates or a custom CA
+</Update>
+
 <Update label="2.1.276" description="September 18, 2026">
   * Fixed every request failing with `400 … Input tag 'advisor_20260301'` when `ANTHROPIC_BASE_URL` points at a proxy or gateway (2.1.275 regression)
 </Update>
@@ -4430,7 +4525,7 @@ Run `claude --version` to check your installed version.
   * Improved `@`-mention typeahead to rank source files above MCP resources with similar names
   * Improved PowerShell tool prompt with version-appropriate syntax guidance (5.1 vs 7+)
   * Changed `Edit` to work on files viewed via `Bash` with `sed -n` or `cat`, without requiring a separate `Read` call first
-  * Changed hook output over 50K characters to be saved to disk with a file path + preview instead of being injected directly into context
+  * Changed hook output over 10,000 characters to be saved to disk with a file path + a 2,000-character preview instead of being injected directly into context
   * Changed `cleanupPeriodDays: 0` in settings.json to be rejected with a validation error — it previously silently disabled transcript persistence
   * Changed thinking summaries to no longer be generated by default in interactive sessions — set `showThinkingSummaries: true` in settings.json to restore
   * Documented `TaskCreated` hook event and its blocking behavior
diff --git a/content/en/docs/claude-code/claude-apps-gateway-config.md b/content/en/docs/claude-code/claude-apps-gateway-config.md
index 998be40a00..6ce0619993 100644
--- a/content/en/docs/claude-code/claude-apps-gateway-config.md
+++ b/content/en/docs/claude-code/claude-apps-gateway-config.md
@@ -84,7 +84,7 @@ OpenID Connect (OIDC) is the SSO protocol the gateway uses with your identity pr
 | `id_token_signed_response_alg`  | No       | Expected id\_token signing algorithm. Default `RS256`. Set for IdPs that sign with ES256, PS256, or EdDSA.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | `additional_authorized_parties` | No       | Extra `azp` values to accept beyond `client_id`, for Keycloak broker and token-exchange flows                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
 | `discovery_url`                 | No       | Fetch the discovery document from this URL instead of deriving it from `issuer`, for IdPs behind a proxy that rewrites the issuer host. The path must contain `/.well-known/`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| `use_proxy`                     | No       | Send the gateway's own IdP requests through the forward proxy in `HTTPS_PROXY` or `HTTP_PROXY`, honoring `NO_PROXY`. Unset or `false`, those requests go direct. Requires v2.1.227 or later; see [IdP requests through a forward proxy](#idp-requests-through-a-forward-proxy) below.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| `use_proxy`                     | No       | Send the gateway's own IdP requests through the forward proxy in `HTTPS_PROXY` or `HTTP_PROXY`, honoring `NO_PROXY`. `false` keeps those requests direct. Requires v2.1.227 or later; see [IdP requests through a forward proxy](#idp-requests-through-a-forward-proxy) below.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
 | `form_action_origins`           | No       | Additional origins for the `/device` page's `Content-Security-Policy: form-action` directive. The gateway already allows `'self'` and the discovered `authorization_endpoint` origin, but Chrome enforces `form-action` against the entire redirect chain. If your IdP redirects through a second host, such as Azure AD federated to ADFS, hub-spoke Okta, or a corporate SSO interceptor, list every origin the authorization request may redirect through.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
 | `ca_cert_pem`                   | No       | The PEM-encoded CA certificate itself, not a path to a file. It replaces the system trust store for IdP requests only. To load a mounted file, write `${file:/etc/gateway/idp-ca.pem}`. Use for Keycloak or Dex behind corporate PKI.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
 
@@ -94,6 +94,43 @@ The inference upstreams honor `HTTPS_PROXY` and `HTTP_PROXY` on every version. T
 
 With `use_proxy: true`, the pod resolves each IdP endpoint's hostname itself and asks the proxy to `CONNECT` to the resolved IP address, so the proxy must accept `CONNECT` to the IP address of every host the discovery document names, not only the issuer. Use an `http://` proxy URL. `ca_cert_pem` and the [SSRF guard](/docs/en/claude-apps-gateway-deploy#threat-model-summary) apply on the proxied path as well.
 
+[Proxy-only egress](#proxy-only-egress) changes both of these: while it's active, IdP requests follow the proxy unless you set `use_proxy: false`, and the gateway hands the proxy each IdP hostname without resolving it first.
+
+#### Proxy-only egress
+
+Set `CLAUDE_GATEWAY_PROXY_IS_EGRESS_BOUNDARY=1` in the gateway's environment, next to `HTTPS_PROXY`, when the pod reaches other hosts only through that forward proxy and can't resolve public DNS names itself, or when the proxy refuses `CONNECT` to an IP address. Requires v2.1.277 or later. It's an environment variable rather than a `gateway.yaml` key so that nothing in the config file can relax the gateway's address check.
+
+```bash theme={null}
+export HTTPS_PROXY=http://proxy.corp.example.com:3128
+export NO_PROXY=
+export no_proxy=
+export CLAUDE_GATEWAY_PROXY_IS_EGRESS_BOUNDARY=1
+```
+
+The gateway logs one `network:` line at boot while proxy-only egress is active.
+
+Each row below is one class of outbound request on a gateway with `HTTPS_PROXY` set, by default and while proxy-only egress is active.
+
+| Outbound request                                                                                                             | Default                                                                                                                                                          | Proxy-only egress active                                                                  |
+| ---------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- |
+| `provider: anthropic` upstreams, Workload Identity Federation token exchange, `telemetry.forward_to` exports                 | Resolved and checked locally, then `CONNECT` to the checked IP address through the proxy. A telemetry collector listed in `NO_PROXY` is reached directly instead | Hostname handed to the proxy                                                              |
+| IdP discovery, JWKS, token, and userinfo                                                                                     | Direct unless [`oidc.use_proxy: true`](#idp-requests-through-a-forward-proxy), then `CONNECT` to the checked IP address                                          | Hostname handed to the proxy, unless `oidc.use_proxy: false` keeps an internal IdP direct |
+| Amazon Bedrock, Claude Platform on AWS, Google Cloud's Agent Platform, and Microsoft Foundry upstreams; Google group lookups | Hostname handed to the proxy                                                                                                                                     | Unchanged                                                                                 |
+
+Proxy-only egress stays off unless the gateway's environment meets all three of these conditions:
+
+* `HTTPS_PROXY` or `HTTP_PROXY` is set.
+* `NO_PROXY` and `no_proxy` are empty. If your platform injects either into pods, set both to an empty value on the gateway container. Listing a telemetry collector in `NO_PROXY` keeps proxy-only egress off.
+* `CLAUDE_GATEWAY_ALLOW_LOOPBACK` isn't turned on. A collector or IdP on the pod's own loopback can't be combined with proxy-only egress, because a loopback address handed to the proxy would be the proxy host's own, so give those services an address the proxy can reach instead. For the same reason the gateway refuses `localhost`-style names outright while proxy-only egress is active.
+
+When one of those conditions isn't met, the gateway logs a warning at boot naming the variable that stopped it and keeps the default behavior.
+
+Once proxy-only egress is active, allow every destination in the proxy, including an internal collector and any host configured by IP address. You can still keep an internal IdP direct with [`oidc.use_proxy: false`](#idp-requests-through-a-forward-proxy).
+
+<Warning>
+  Turn this on only when the proxy's allowlist is at least as strict as the gateway's own check. The proxy must refuse cloud metadata endpoints such as `169.254.169.254` and `metadata.google.internal`, link-local addresses, and the proxy host's own loopback, and it must refuse them by the address a name resolves to, not only by name, because the gateway no longer catches a hostname that resolves to one of them. A proxy that connects anywhere it's asked removes the gateway's [SSRF guard](/docs/en/claude-apps-gateway-deploy#threat-model-summary) for these requests.
+</Warning>
+
 ### `session`
 
 The `session` block shapes the bearer tokens the gateway mints after sign-in: the secret that signs them and how long they live.
@@ -107,12 +144,13 @@ The `session` block shapes the bearer tokens the gateway mints after sign-in: th
 
 The `store` block points the gateway at its PostgreSQL database, which holds device grants and rate-limit counters.
 
-| Field             | Required | Description                                                                                                                                                                                                                                                                                                                                                                                                                        |
-| ----------------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `postgres_url`    | Yes      | `postgres://` or `postgresql://` URL. Required: the device-grant rendezvous, where the browser callback writes and the polling CLI reads, needs cross-replica state. The gateway runs its own schema migrations at boot and on upgrade, so the role needs rights to create and alter tables on the target schema. See [Upgrades](/docs/en/claude-apps-gateway-deploy#upgrades) and [Postgres](/docs/en/claude-apps-gateway-deploy#postgres). |
-| `username`        | No       | Overrides the user in `postgres_url`                                                                                                                                                                                                                                                                                                                                                                                               |
-| `password`        | No       | Database credential. Set it here rather than in `postgres_url` so the credential stays out of the URL. Accepts any characters and takes precedence over URL credentials.                                                                                                                                                                                                                                                           |
-| `max_connections` | No       | Postgres connection-pool size per replica. Default `5`, which is conservative and friendly to shared databases. With [spend limits](#admin) enabled, the hot path does a few operations per inference request, so raise it for a dedicated database under load, and keep replicas × this below the database's `max_connections`.                                                                                                   |
+| Field                     | Required | Description                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| ------------------------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `postgres_url`            | Yes      | `postgres://` or `postgresql://` URL. Required: the device-grant rendezvous, where the browser callback writes and the polling CLI reads, needs cross-replica state. The gateway runs its own schema migrations at boot and on upgrade, so the role needs rights to create and alter tables on the target schema. See [Upgrades](/docs/en/claude-apps-gateway-deploy#upgrades) and [Postgres](/docs/en/claude-apps-gateway-deploy#postgres). |
+| `username`                | No       | Overrides the user in `postgres_url`                                                                                                                                                                                                                                                                                                                                                                                               |
+| `password`                | No       | Database credential. Set it here rather than in `postgres_url` so the credential stays out of the URL. Accepts any characters and takes precedence over URL credentials.                                                                                                                                                                                                                                                           |
+| `max_connections`         | No       | Postgres connection-pool size per replica. Default `5`, which is conservative and friendly to shared databases. With [spend limits](#admin) enabled, the hot path does a few operations per inference request, so raise it for a dedicated database under load, and keep replicas × this below the database's `max_connections`.                                                                                                   |
+| `connect_timeout_seconds` | No       | Seconds the gateway waits when it opens a Postgres connection. A whole number from `1` to `60`, default `5`. Raise it if connection attempts time out when a new gateway instance starts. Requires Claude Code v2.1.274 or later on the gateway server. Earlier versions refuse to start when the key is set.                                                                                                                      |
 
 For local development, point `postgres_url` at a throwaway Postgres container, for example `docker run --rm -p 5432:5432 -e POSTGRES_HOST_AUTH_METHOD=trust postgres`.
 
@@ -333,6 +371,51 @@ upstreams:
 | ACI / App Service       | Enable system-assigned or user-assigned managed identity on the resource. `use_azure_ad: true` picks it up.                                                                               |
 | Anywhere else           | `auth: { api_key: "${FOUNDRY_API_KEY}" }`. Quote `${…}` inside `{ }`.                                                                                                                     |
 
+#### Static headers on upstream requests
+
+To add fixed headers to the requests the gateway sends to one upstream, set `headers:` on that upstream. Use it when a proxy you run in front of the provider routes or attributes traffic by a header.
+
+`headers:` requires Claude Code v2.1.277 or later on the gateway server. An earlier gateway refuses to start when it finds the key. Upgrade every replica before you add the key, and remove the key before you roll back to an earlier version.
+
+The headers go to the server that `base_url` names, or to the provider's own endpoint when `base_url` is unset. The provider receives them too unless your proxy removes them.
+
+This example reaches a `provider: vertex` upstream through a proxy at `upstream-proxy.internal.example.com`. It sets the `x-source` header the proxy reads, and sends a token from the `PROXY_TOKEN` environment variable as `x-proxy-token`:
+
+```yaml theme={null}
+upstreams:
+  - provider: vertex
+    region: us-east5
+    project_id: example-prod
+    base_url: https://upstream-proxy.internal.example.com
+    auth: {}
+    headers:
+      x-source: claude-apps-gateway
+      x-proxy-token: ${PROXY_TOKEN}
+```
+
+Values are printable ASCII text with no space at either end. Quote a number, `true`, or `false` so YAML reads it as text.
+
+To keep a secret out of the config file, use [secret expansion](#secret-expansion) to load the value from an environment variable with `${VAR}` or from a file with `${file:/path}`. A `${VAR}` that resolves to an empty value stops the gateway from starting.
+
+`headers:` works on every provider, and each upstream sends only its own.
+
+Not every request that the gateway sends to an upstream carries them:
+
+| Request the gateway sends to this upstream                             | Carries `headers:`                   |
+| ---------------------------------------------------------------------- | ------------------------------------ |
+| `/v1/messages`, streaming or not, and `/v1/messages/count_tokens`      | Yes                                  |
+| A request that failed over from another upstream                       | Yes, this upstream's `headers:` only |
+| Amazon Bedrock's `CountTokens` call for a request the client abandoned | No                                   |
+| The Workload Identity Federation token exchange                        | No                                   |
+
+On an Amazon Bedrock or Claude Platform on AWS upstream that signs requests with AWS SigV4, these headers are part of the signature, so your proxy must pass them through unchanged.
+
+If you use a name the gateway reserves, it refuses to start, and the startup error names the header. Reserved names include:
+
+* `authorization` and `x-api-key`
+* `host`, `content-type`, and `user-agent`
+* Any name starting with `anthropic-`, `x-goog-`, `x-amz-`, or `x-amzn-`
+
 #### Multiple upstreams
 
 The same provider can appear more than once with a distinct `name:`. This covers different regions, different accounts via different credential chains, provisioned throughput versus on-demand, and cross-provider fallback.
@@ -341,6 +424,12 @@ The gateway tries upstreams in order. `5xx`, `429`, `401`, `403`, `404`, timeout
 
 `429` is per-upstream capacity, so provisioned-throughput (PT) exhaustion fails over to on-demand. If you set [`forward_user_identity: true`](#per-user-identity-headers-for-a-proxy-you-run) on an upstream, a `429` to a request that carried the developer's email is a per-user denial instead and doesn't fail over.
 
+Every request starts at the first upstream. A request reaches a later upstream only when every upstream ahead of it has failed or doesn't serve the requested model.
+
+The gateway keeps no record of failed upstreams, so while an upstream is down, every request that reaches it still tries it and waits for it to fail before moving on.
+
+For an Anthropic API upstream, [`timeouts.upstream_ttfb_ms`](#http-tuning) bounds the wait on a down upstream. That setting doesn't apply to the other providers, where the gateway waits up to one hour for an upstream to start responding.
+
 `404` is per-upstream model availability, so an upstream that hasn't enabled a model doesn't block a later upstream that serves it. An upstream that can't resolve the requested model is skipped without a network round-trip.
 
 This example routes a provisioned-throughput Amazon Bedrock allotment first, overflows to on-demand and a second account, and falls back to the Anthropic API last:
@@ -735,12 +824,18 @@ The CLI stamps each export with the authenticated user's identity, read from the
 
 [Claude Desktop](#claude-desktop-overlay) and Cowork sessions signed in through the gateway stamp their telemetry with `user.email` and `user.groups` alongside `enduser.id`, so you can cover terminal, Desktop, and Cowork usage with one query on `user.email` or `user.groups`. `user.groups` is the comma-separated IdP group list.
 
+Desktop and Cowork telemetry also carries `enduser.sub`, the `sub` claim your identity provider issues for the user, which stays the same when a user's email changes. Terminal sessions stamp the same value under `user.id`, so a query that matches `enduser.sub` against terminal `user.id` covers one user's terminal, Desktop, and Cowork usage together. On Desktop and Cowork exports, `user.id` is an anonymous identifier, not the subject.
+
 Like all OpenTelemetry data from Claude Code, these attributes go only to destinations your organization configures, never to Anthropic.
 
 If a user's group list is longer than 255 characters once percent-encoded, or a group name contains a comma or equals sign, the gateway leaves `user.groups` off that user's Desktop and Cowork telemetry rather than truncating it. That user's terminal sessions still carry the full list.
 
+The gateway leaves `enduser.sub` off when the subject is longer than 255 characters once percent-encoded, or contains a space, a character outside printable ASCII, or one of `,` `;` `=` `\` `"` `%`. That user's Desktop and Cowork telemetry keeps its other attributes.
+
 You need Claude Code v2.1.265 or later on the gateway server for `user.email` and `user.groups` on Desktop and Cowork telemetry, and Claude Desktop 1.24012 or later on each developer's machine for `user.groups`.
 
+You need Claude Code v2.1.274 or later on the gateway server for `enduser.sub`.
+
 ```yaml theme={null}
 telemetry:
   forward_to:
@@ -772,6 +867,12 @@ Each `forward_to` URL must use `https://`, with one exception for a collector on
 
 For an in-cluster collector, expose it over HTTPS at its own internal address, or run it as a sidecar with the variable set.
 
+When `HTTPS_PROXY` is set, the gateway sends exports through that proxy.
+
+To reach an internal collector directly, add it to `NO_PROXY` by hostname or by a domain with a leading dot such as `.internal.example.com`, which requires Claude Code v2.1.277 or later on the gateway server. Make sure the gateway can reach the collector without the proxy. An entry without a leading dot matches only that exact name, not names under it. CIDR ranges don't match.
+
+With [proxy-only egress](#proxy-only-egress) turned on, allow the collector in the proxy instead, since any `NO_PROXY` entry keeps proxy-only egress off.
+
 Telemetry is off in the CLI by default. When you set both `telemetry.forward_to` and `listen.public_url`, the gateway turns it on for connected clients by pushing six environment variables through `/managed/settings`:
 
 * `CLAUDE_CODE_ENABLE_TELEMETRY=1`
@@ -839,9 +940,9 @@ Four optional top-level blocks, `access_control`, `limits`, `timeouts`, and `rat
 | `limits`         | `max_request_bytes`                            | 32 MiB   | Max inbound request body; oversize requests get `413` before the body is buffered. Raise for large file or image requests.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
 | `limits`         | `max_request_header_bytes`                     | unset    | When set, oversize headers return `431`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | `limits`         | `max_url_length`                               | unset    | When set, an over-long URL returns `414`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| `timeouts`       | `upstream_ttfb_ms`                             | 120000   | Max wait for the upstream's response headers (time to first byte). The response body then streams with no wall-clock cap. Applies to the direct Anthropic upstream path; every other provider is bounded by its provider SDK's own timeout.                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| `rate_limits`    | `device_authorization.max` / `.window_seconds` | 30 / 600 | Per-IP rate limit on the unauthenticated device-authorization endpoint. Raise for a large org behind a shared egress IP or NAT. These limits apply only to the device-grant sign-in flow, not to `/v1/messages` inference. See [User-code brute-force resistance](/docs/en/claude-apps-gateway-deploy#user-code-brute-force-resistance).                                                                                                                                                                                                                                                                                                                                                                          |
-| `rate_limits`    | `device_verify.max` / `.window_seconds`        | 10 / 600 | Per-IP rate limit on `user_code` submissions at `/device`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| `timeouts`       | `upstream_ttfb_ms`                             | 120000   | Max wait for the upstream's response headers (time to first byte). The response body then streams with no wall-clock cap. Applies to the direct Anthropic upstream path; on every other provider the gateway waits up to one hour for the response to start.                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| `rate_limits`    | `device_authorization.max` / `.window_seconds` | 30 / 600 | Per-IP rate limit on the unauthenticated device-authorization endpoint. Raise for a large org behind a shared egress IP or NAT. [Large rollouts](/docs/en/claude-apps-gateway-deploy#large-rollouts) shows how to size it. These limits apply only to the device-grant sign-in flow, not to `/v1/messages` inference. See [User-code brute-force resistance](/docs/en/claude-apps-gateway-deploy#user-code-brute-force-resistance).                                                                                                                                                                                                                                                                                    |
+| `rate_limits`    | `device_verify.max` / `.window_seconds`        | 10 / 600 | Per-IP rate limit on `user_code` submissions at `/device`. It is what stops someone from guessing another developer's code. [Large rollouts](/docs/en/claude-apps-gateway-deploy#large-rollouts) shows how far to raise it.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
 
 If you leave both `access_control` lists empty, which is the default, the gateway serves any client address, so only your network restricts who can reach it. That matters because a gateway can push [managed settings](#managed) that run commands on developer machines.
 
@@ -903,6 +1004,7 @@ session:
 store:
   postgres_url: ${GATEWAY_POSTGRES_URL}
   # max_connections: 5
+  # connect_timeout_seconds: 5
 
 # Enables /v1/organizations/spend_limits (mirrors the Anthropic Admin API)
 # and per-developer spend enforcement on /v1/messages. Omit to disable.
diff --git a/content/en/docs/claude-code/claude-apps-gateway-deploy.md b/content/en/docs/claude-code/claude-apps-gateway-deploy.md
index 0989063cb7..9fd99304f1 100644
--- a/content/en/docs/claude-code/claude-apps-gateway-deploy.md
+++ b/content/en/docs/claude-code/claude-apps-gateway-deploy.md
@@ -114,6 +114,29 @@ Once you deploy the keys, Claude Code stops using a leftover API key or claude.a
 
 See [where each mechanism stores the policy](/docs/en/managed-settings#where-each-mechanism-stores-the-policy) for the file paths, and [Client-side managed settings](/docs/en/claude-apps-gateway-config#client-side-managed-settings) for the Claude Desktop `bootstrapUrl` equivalent.
 
+### Large rollouts
+
+Sign-in is rate limited per client IP address, and the defaults suit a small team. Each address gets 30 sign-in starts and 10 code submissions every 10 minutes. A rollout to thousands of developers can reach those limits on the first morning, for one of two reasons:
+
+* **The gateway can't see past your load balancer.** Without [`listen.trusted_proxies`](/docs/en/claude-apps-gateway-config#listen), every developer appears to come from the load balancer's address and shares one limit. Set it before anything else. The gateway logs a warning the first time it ignores an `X-Forwarded-For` header.
+* **Many developers share a few NAT or VPN egress addresses.** They share those addresses' limits even when `trusted_proxies` is right. Raise [`rate_limits`](/docs/en/claude-apps-gateway-config#http-tuning) to fit.
+
+To size `max`, divide the developers by the egress addresses they share. Estimate how many of those sign in within one `window_seconds` period, which is 10 minutes by default. Then double it to cover retries and developers who sign in to both Claude Code and Claude Desktop.
+
+For example, 10,000 developers behind 4 egress addresses sign in evenly over an hour. That is 2,500 developers per address and about 420 of them in each 10 minutes, which you double and round up to 1,000. The example below sets both limits to 1,000:
+
+```yaml theme={null}
+rate_limits:
+  device_authorization: { max: 1000, window_seconds: 600 }
+  device_verify: { max: 1000, window_seconds: 600 }
+```
+
+`device_verify` is what stops someone from guessing another developer's sign-in code, so raise it only as far as your estimate needs. Even at these limits, a code is 8 characters from a 20-character alphabet and expires after 10 minutes, so guessing stays impractical; see [User-code brute-force resistance](#user-code-brute-force-resistance).
+
+When your IdP issues refresh tokens, Claude Code renews sessions silently, so you can put the limit back after the rollout. Without refresh tokens, developers sign in again every [`session.ttl_hours`](/docs/en/claude-apps-gateway-config#session). Size both limits for that steady rate too and leave them raised.
+
+When a limit is reached, Claude Code v2.1.274 or later shows `The gateway is limiting sign-in attempts right now`. A gateway on v2.1.274 or later shows `Too many attempts came from your network address` on the verification page, with the settings to check. It also writes a `sign-in refused` log line that names the setting to change.
+
 ## Operations
 
 Once the gateway is serving traffic, day-to-day operation is reading its logs, probing its health, and rotating its secrets on your schedule. The subsections cover each, plus what Postgres holds and how upgrades and rollbacks behave.
@@ -142,6 +165,27 @@ The gateway serves `GET /healthz` as a liveness probe and `GET /readyz` as a rea
 
 The OAuth discovery document at `/.well-known/oauth-authorization-server` also returns `200` only after config load, OIDC discovery, upstream client construction, and Postgres migration all succeed, so it doubles as an end-to-end boot check.
 
+### Concurrent upstream requests
+
+By default, each gateway replica sends at most 256 requests upstream at the same time. A streaming response counts against the limit until the stream ends.
+
+A request that arrives while a replica is at the limit waits inside the gateway for a free slot. The developer sees a response that is slow to start or appears to hang. On a `provider: anthropic` upstream, a request that waits longer than [`timeouts.upstream_ttfb_ms`](/docs/en/claude-apps-gateway-config#http-tuning) gives up on that upstream, and fails with a 502 when no later upstream serves it.
+
+The startup log line that contains `upstream requests:` shows the limit in effect. While a replica has more requests open than the limit, it also logs a warning that contains `client requests are open`, at most once a minute.
+
+To serve more requests at once, you have two options:
+
+* Add replicas.
+* Raise the limit on each replica. Set the `BUN_CONFIG_MAX_HTTP_REQUESTS` environment variable on the gateway container to a whole number from 1 to 65535, then restart the container.
+
+A replica fills its limit at a request rate of about the limit divided by the average number of seconds a request stays open. For example, if requests stay open for 10 seconds on average, a replica at the default limit of 256 fills it at about 26 requests a second.
+
+If you autoscale on CPU, a replica at the limit queues requests without triggering a scale-out, so set the target below the CPU level your replicas show when they log the `client requests are open` warning.
+
+<Warning>
+  Every open request holds memory in the gateway process while it streams and while it waits for a slot. If you keep the limit at 256, memory on an overloaded replica still grows, because waiting requests keep their request bodies. Size the container's memory for the number of requests open at peak, and watch memory when you change the limit. A replica that runs out of memory is killed and drops every stream it holds.
+</Warning>
+
 ### Outage behavior
 
 If Postgres goes down, the gateway itself keeps serving signed-in developers and new sign-ins fail. Whether developers actually keep working depends on how your orchestrator handles readiness:
@@ -181,7 +225,23 @@ With spend limits in use, a lost database means lost spend tracking and caps, no
 
 ### Upgrades
 
-Replicas are stateless, so a rolling restart is safe at any time. The gateway runs schema migrations at boot, which means deploying the new binary self-migrates the database. Concurrent replicas serialize on a Postgres advisory lock, so only one applies each migration.
+Replicas are stateless, so a rolling restart loses no gateway state. The gateway runs schema migrations at boot, which means deploying the new binary self-migrates the database. Concurrent replicas serialize on a Postgres advisory lock, so only one applies each migration.
+
+When your orchestrator stops a replica with `SIGTERM`, as in a rolling restart or a scale-in, the gateway stops accepting new connections and lets requests and streams already in flight finish before it exits. It waits up to 25 seconds, called the drain window, then closes whatever is still open. A `SIGINT`, such as Ctrl+C in a terminal, starts the same drain, and a second signal during the drain closes the open requests and exits right away. Draining requires gateway v2.1.274 or later.
+
+Long generations can stream for minutes. On Kubernetes and Amazon ECS, raise both of these together to give those streams more time:
+
+* **The drain window**: set the `CLAUDE_GATEWAY_DRAIN_TIMEOUT_MS` environment variable on the gateway container to a positive whole number of milliseconds, such as `120000`. The gateway ignores a value in any other form, such as `120s`, and keeps the 25-second default
+* **Your orchestrator's grace period**: `terminationGracePeriodSeconds` on Kubernetes, or `stopTimeout` on Amazon ECS
+
+The grace period defaults to 30 seconds on both platforms. Keep it at least 5 seconds longer than the drain window, or the orchestrator kills the gateway before the drain finishes. On Kubernetes, add the duration of any `preStop` hook as well, because the grace period starts counting before the hook runs rather than when the gateway receives `SIGTERM`.
+
+Your platform may also cap how long the drain can run:
+
+* **Amazon ECS on Fargate**: `stopTimeout` allows at most 120 seconds
+* **Cloud Run**: stops an instance 10 seconds after `SIGTERM`, so open streams get at most 10 seconds there, whatever the drain window is
+
+When the drain window ends with requests still open, the gateway logs a warning that contains `drain window over after`, counts the requests it cut, and names both settings to raise.
 
 Migrations are append-only, so rolling back to a prior binary that knows fewer migrations is safe; it ignores the extra rows. Rollback also re-validates the YAML against the older binary's schema, so a config that adopted a key introduced by the newer release fails boot on the older one. Remove the new key before rolling back.
 
@@ -207,7 +267,11 @@ The gateway sits inside your network perimeter, but individual developer laptops
 
 * Developers hold short-lived JWTs instead of raw upstream keys. The CLI-to-gateway leg uses the RFC 8628 device grant, and the gateway's authorization-code exchange with the IdP runs PKCE in the default configuration, so an intercepted IdP authorization code is useless.
 * The device-verification page enforces same-origin POST and a per-IP rate limit per RFC 8628 §5.1. See [User-code brute-force resistance](#user-code-brute-force-resistance).
-* Outbound requests go through a server-side request forgery (SSRF) guard that resolves DNS, blocks link-local and cloud-metadata addresses plus loopback by default, and pins the connection to the resolved IP, so operator-influenced URLs such as the IdP and OTLP destinations can't be redirected to cloud metadata endpoints. RFC 1918 private ranges are deliberately allowed, because IdPs and OTLP collectors commonly live on private IPs. Set `CLAUDE_GATEWAY_ALLOW_LOOPBACK=1` in the gateway's environment only when something the gateway must reach legitimately lives on loopback, such as a local-development IdP or a sidecar OTLP collector on `localhost`. The variable relaxes the loopback block for every operator-configured URL and also skips the boot-time warning that checks whether the pod can reach the cloud metadata endpoint, so prefer giving the collector its own internal address.
+* The gateway's requests to your IdP, your OTLP collectors, and `provider: anthropic` upstreams go through a server-side request forgery (SSRF) guard that resolves DNS, blocks link-local and cloud-metadata addresses plus loopback by default, and pins the connection to the resolved IP, so those operator-influenced URLs can't be redirected to cloud metadata endpoints. RFC 1918 private ranges are deliberately allowed, because IdPs and OTLP collectors commonly live on private IPs. For the other providers, the gateway refuses a `base_url` that names one of those addresses or a metadata hostname when it loads the config, and the provider's SDK then connects without the DNS check.
+
+  If you turn on [proxy-only egress](/docs/en/claude-apps-gateway-config#proxy-only-egress), that address check moves to your forward proxy: the gateway hands it hostnames and the proxy's allowlist must refuse those destinations.
+
+  Set `CLAUDE_GATEWAY_ALLOW_LOOPBACK=1` in the gateway's environment only when something the gateway must reach legitimately lives on loopback, such as a local-development IdP or a sidecar OTLP collector on `localhost`. The variable relaxes the loopback block for every operator-configured URL and also skips the boot-time warning that checks whether the pod can reach the cloud metadata endpoint, so prefer giving the collector its own internal address.
 
 If you add your own egress controls, the gateway must reach the metadata server whenever it uses instance-metadata credentials such as workload identity.
 
@@ -220,7 +284,7 @@ Two threats are out of scope because they are your infrastructure to secure:
 
 The `user_code` a developer types into the `/device` verification page is 8 characters drawn from a 20-character alphabet, which yields 20⁸ or about 2.56×10¹⁰ combinations, and it expires after 10 minutes.
 
-The gateway applies per-IP rate limits on the device-grant endpoints, configurable via [`rate_limits`](/docs/en/claude-apps-gateway-config#http-tuning). Raise the limits if many developers sign in from a single shared corporate NAT address. The limits apply only to the sign-in flow, not to inference.
+The gateway applies per-IP rate limits on the device-grant endpoints, configurable via [`rate_limits`](/docs/en/claude-apps-gateway-config#http-tuning). Raise the limits if many developers sign in from a single shared corporate NAT address. [Large rollouts](#large-rollouts) shows how to size them. The limits apply only to the sign-in flow, not to inference.
 
 ### Compliance posture
 
@@ -245,40 +309,43 @@ For questions and feedback, use [Claude Code support](https://support.claude.com
 
 The gateway's stderr includes the audit event stream, the audit log records developer identities, and the debug file records hook and MCP server output from the developer's machine. Review and redact these before posting to a public issue.
 
-| Symptom                                                                                                                                                                     | Cause                                                                                                                                                                                                                                                                                                                                                                                                           | Fix                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| A developer's `/login` shows the standard account picker instead of the **Cloud gateway** screen                                                                            | `forceLoginMethod` or `forceLoginGatewayUrl` isn't set in managed settings on that machine                                                                                                                                                                                                                                                                                                                      | Deploy the [managed settings file](/docs/en/claude-apps-gateway#set-the-gateway-url) to the device; `/login` reads the gateway URL from there                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| A developer's requests fail with `Not signed in to the Cloud gateway — run /login.`                                                                                         | The machine's managed settings set `forceLoginMethod: "gateway"` or `forceLoginGatewayUrl`, and the session has no gateway sign-in. A leftover claude.ai login doesn't satisfy the requirement.                                                                                                                                                                                                                 | Have the developer run `/login` and complete the gateway sign-in. See also [Administrator policy requires a Cloud gateway sign-in](/docs/en/errors#administrator-policy-requires-a-cloud-gateway-sign-in).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| Claude Desktop reports that its bootstrap configuration couldn't be fetched                                                                                                 | `/user/bootstrap` returned 404: the policy matching the user doesn't carry a `desktop` key, or no policy matched. The gateway's audit log records each rejection as `desktop_bootstrap.denied` with the reason.                                                                                                                                                                                                 | Add a `desktop` block to the policy that matches the user, or to the `match: {}` base layer; an empty `desktop: {}` suffices. See [Claude Desktop overlay](/docs/en/claude-apps-gateway-config#claude-desktop-overlay).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| Startup shows `Gateway login is configured in managed settings, but this Claude Code build does not include Cloud gateway support.`                                         | The installed Claude Code build predates gateway support                                                                                                                                                                                                                                                                                                                                                        | Have the developer update Claude Code to a release that includes Cloud gateway support                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| Startup exits with `Administrator policy requires a Cloud gateway sign-in on this machine`                                                                                  | The developer's environment sets `ANTHROPIC_API_KEY` or `ANTHROPIC_AUTH_TOKEN`, their settings configure an [`apiKeyHelper`](/docs/en/settings-reference#apikeyhelper), or an API key from an earlier Claude Console login is still saved                                                                                                                                                                            | Have the developer clear each that applies: unset the variable, remove the `apiKeyHelper` entry, or run `claude auth logout` to remove the saved key. Then have them start `claude` and sign in with `/login`. See also [Administrator policy requires a Cloud gateway sign-in](/docs/en/errors#administrator-policy-requires-a-cloud-gateway-sign-in).                                                                                                                                                                                                                                                                                                                                                                               |
-| Startup or `/login` reports `Claude Code may not be enabled for your organization` after a 403 on the managed settings load                                                 | The gateway, or something in front of it, answered the `/managed/settings` request with 403. The gateway's own settings route never answers 403. The status comes from the [`access_control`](/docs/en/claude-apps-gateway-config#http-tuning) IP checks or from a proxy or WAF in front of the gateway. The audit log records an IP-check denial as `access.denied` with the reason. The developer stays signed in. | Check the audit log for `access.denied` at the time of the failure and fix the `access_control` lists or the front end, then have the developer start `claude` again                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-| CLI `/login`: `Gateway hosts must be on your organization's private network; <host> resolves to the public (or unrecognized) address <ip>`                                  | The gateway hostname resolves to at least one public IP address. Claude Code checks each resolved address and requires every one to be private. A common cause is a dual-stack name where one family resolves to a public address, including AWS internal dual-stack load balancers, which return public-range AAAA addresses.                                                                                  | Have the gateway name resolve only to private addresses on developer machines. For a dual-stack name, drop the public-range record or serve a separate internal-only DNS name. See the [private-network prerequisite](/docs/en/claude-apps-gateway#prerequisites). If the address is public space your organization owns and uses internally, [declare that block](/docs/en/claude-apps-gateway#allow-a-gateway-on-public-address-space-you-own) instead.                                                                                                                                                                                                                                                                                  |
-| CLI `/login`: `Gateway login would go through proxy <proxy>, which is not on a private network`                                                                             | An `HTTPS_PROXY` or `HTTP_PROXY` applies to the gateway host and the proxy's hostname resolves to a public address. A proxy whose host resolves only to private addresses is allowed and doesn't trigger this error                                                                                                                                                                                             | Add the gateway host to `NO_PROXY` on the developer's machine so the connection is direct, or use a proxy whose hostname resolves to private addresses. The message names the exact `NO_PROXY` entry to add                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| CLI `/login`: `Claude Code only signs in to <host> from inside its declared network <block> (managed settings), and this machine is connecting from <ip>, outside it`       | The gateway is on a block declared in [`gatewayInternalNetworks`](/docs/en/claude-apps-gateway#allow-a-gateway-on-public-address-space-you-own), and the developer's machine reached it from an address outside that block: a VPN address pool, a container or WSL2 NAT segment, or a network that isn't yours                                                                                                       | Have the developer run `/login` from the host OS on your network. If the address shown is also your organization's own public space, replace the gateway's entry with a block that covers both, up to `/8`; a second, overlapping entry is refused                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| CLI `/login`: `Every address for gateway host <host> must be inside its declared network <block>, and it also resolves to <ip>`                                             | The gateway's name resolves to an address outside the block declared in [`gatewayInternalNetworks`](/docs/en/claude-apps-gateway#allow-a-gateway-on-public-address-space-you-own): a second site, or an IPv6 record on a dual-stack name. Under a declared block every record must be inside that one IPv4 block, private and IPv6 addresses included                                                                | Publish only records inside the block for the gateway name on developer machines, or serve a separate internal-only name                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| CLI `/login`: `<host> is on the declared network <block>, which Claude Code checks over a direct connection, not through an HTTP proxy`                                     | An `HTTPS_PROXY` or `HTTP_PROXY` applies to a gateway on a declared block                                                                                                                                                                                                                                                                                                                                       | On the developer's machine, add the `NO_PROXY` entry the message names                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| CLI `/login`: a message starting `gatewayInternalNetworks in managed settings`                                                                                              | The value breaks one of the [validation rules](/docs/en/claude-apps-gateway#allow-a-gateway-on-public-address-space-you-own), and the message names which. Until you fix it, Claude Code refuses every new gateway `/login` on the machine, gateways on private addresses included; existing sign-ins keep working                                                                                                   | In the managed settings source you deploy, correct the entry the message names, then rerun `/login`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| CLI `/login`: `Could not resolve the configured HTTP proxy`                                                                                                                 | The hostname in `HTTPS_PROXY` or `HTTP_PROXY` doesn't resolve from the developer's machine, typically because it isn't connected to the corporate network                                                                                                                                                                                                                                                       | Have the developer connect to your network or VPN and retry, or fix the proxy URL                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
-| CLI `/login`: `Could not resolve gateway host <host>`                                                                                                                       | The machine can't resolve the gateway's internal DNS name, typically because it isn't on the corporate network                                                                                                                                                                                                                                                                                                  | Have the developer connect to your network or VPN, then retry `/login`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| Boot exits with a config validation error naming `store.postgres_url`                                                                                                       | No Postgres configured; the gateway requires Postgres                                                                                                                                                                                                                                                                                                                                                           | Set `store.postgres_url`. For local development, use a throwaway container: `docker run --rm -p 5432:5432 -e POSTGRES_HOST_AUTH_METHOD=trust postgres`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| Boot exits: `requires the native binary`                                                                                                                                    | Running under Node instead of the native binary                                                                                                                                                                                                                                                                                                                                                                 | Install Claude Code with one of the [standalone install methods](/docs/en/setup)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| Boot exits with an OIDC discovery error after `config.load`                                                                                                                 | `oidc.issuer` unreachable, or TLS chain not trusted                                                                                                                                                                                                                                                                                                                                                             | Check the issuer is reachable from the pod and serves `/.well-known/openid-configuration`. Set `ca_cert_pem` for private PKI. If the pod reaches the IdP only through a forward proxy, set [`oidc.use_proxy: true`](/docs/en/claude-apps-gateway-config#idp-requests-through-a-forward-proxy); on versions before v2.1.227, give the pod a direct route to each of the IdP's endpoints instead.                                                                                                                                                                                                                                                                                                                                       |
-| Boot exits with a Postgres permission error                                                                                                                                 | The database role lacks DDL rights on its schema                                                                                                                                                                                                                                                                                                                                                                | Grant the role `CREATE` on the gateway's schema so it can create and alter its tables at boot                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| `/oauth/callback` shows "Sign-in could not be completed"                                                                                                                    | Email domain rejected, id\_token validation failed, or `email_verified` is explicitly `false`, which the gateway always rejects with no override                                                                                                                                                                                                                                                                | Check `allowed_email_domains` and that the IdP returns a verified `email` claim. For `email_verified: false`, fix the IdP-side verification. If your IdP emits email under a different claim name, set `oidc.email_claim`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
-| Log: `token exchange failed request_id=<id>: id_token missing email claim`                                                                                                  | The IdP isn't including `email` in the id\_token by default. This rejection fires only when `allowed_email_domains` is set; without it, a missing email mints a session with no email                                                                                                                                                                                                                           | Configure the IdP to emit `email` in the id\_token. Okta: add `email` to a custom authorization server's ID-token claims. Entra: add `email` as an optional claim on the app registration. PingFederate: enable an OpenID Connect Policy that emits `email`. If the IdP serves `email` from the userinfo endpoint but won't include it in the id\_token, such as the Okta org authorization server, set `oidc.userinfo_fallback: true`.                                                                                                                                                                                                                                                                                          |
-| Log: `refresh failed request_id=<id>: invalid_token (…) (at userinfo_no_id_token, …)`, and developers see `Cloud gateway session expired` every `session.ttl_hours`         | The IdP accepted the refresh token but returned no id\_token with it, so the gateway asked the IdP's userinfo endpoint for the user's claims. The IdP rejected the refreshed access token there. The gateway answers `temporarily_unavailable`, so Claude Code keeps the refresh token but can't renew the session. Gateway versions before v2.1.260 log the same line without the `(at …)` detail.             | Set [`oidc.scope_on_refresh: true`](/docs/en/claude-apps-gateway-config#oidc), available in gateway v2.1.260 or later, so the refresh request asks for `openid` again. Some IdPs, such as Okta, return an id\_token on refresh only when asked. On PingFederate, enable **Return ID Token On Refresh Grant** under **Applications > OAuth > OpenID Connect Policy Management** instead. The key doesn't change PingFederate's behavior. For other IdPs that still omit it, check whether the userinfo endpoint accepts access tokens issued by a refresh. As a stopgap, raise [`session.ttl_hours`](/docs/en/claude-apps-gateway-config#session). See [Identity provider setup](#identity-provider-setup) for the deprovisioning tradeoff. |
-| Every Amazon Bedrock request returns 502; log shows `Could not load credentials from any providers`                                                                         | On EC2, IMDSv2's default hop limit of 1 blocks the instance-metadata request from inside the container. Boot and `/readyz` pass anyway because the AWS SDK resolves instance credentials on the first request, not at client construction                                                                                                                                                                       | Raise the hop limit with `aws ec2 modify-instance-metadata-options --instance-id <id> --http-put-response-hop-limit 2`, or set it in the launch template. The change applies to every container on the instance. Prefer ECS task roles where available, which read credentials from the ECS container-credentials endpoint and avoid the change entirely, or apply the change on a dedicated gateway instance to limit the exposure.                                                                                                                                                                                                                                                                                             |
-| IdP error: unknown or unsupported scope                                                                                                                                     | The IdP rejects scopes it doesn't recognize                                                                                                                                                                                                                                                                                                                                                                     | Set `oidc.scopes` to exactly the list your IdP accepts; it must include `openid`. The default is `openid profile email offline_access`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| Sessions don't silently renew after setting `oidc.scopes`                                                                                                                   | `offline_access` was dropped from the override                                                                                                                                                                                                                                                                                                                                                                  | Add `offline_access` back if your IdP supports it. Without a refresh token, developers re-run the browser login every `session.ttl_hours`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
-| Browser shows "This request came from another site and was blocked"                                                                                                         | Cross-site form POST, blocked as CSRF protection. Expected for embedded or proxied pages                                                                                                                                                                                                                                                                                                                        | Open the verification link directly                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| Chrome blocks the Approve button with "Refused to send form data … violates … Content Security Policy directive: form-action", but the same page works in Safari or Firefox | Chrome enforces `form-action` against the entire redirect chain. Your IdP redirects onward to a second host that isn't allowlisted.                                                                                                                                                                                                                                                                             | Add each additional origin in the redirect chain to `oidc.form_action_origins`. Open Chrome DevTools → Console on the Approve page to see which origin was blocked.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| Sign-in completes at the IdP but the callback fails, with a CSP error in Chrome or "this sign-in link has expired" in Safari                                                | The IdP returned the code via `response_mode=form_post`, which auto-submits it cross-origin via POST to `/oauth/callback`. Chrome blocks that under a strict CSP; Safari allows the submit but the callback reads only the query string.                                                                                                                                                                        | Make sure your IdP honors `response_mode=query`, which the gateway requests explicitly so the callback is a plain redirect                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
-| Login works locally but fails behind an ALB                                                                                                                                 | `public_url` still names the local or inner `http://` origin, so the IdP gets the wrong `redirect_uri`                                                                                                                                                                                                                                                                                                          | Set `listen.public_url` to the external `https://` origin and register `<public_url>/oauth/callback` with the IdP                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
-| Developer sees the trust prompt repeatedly                                                                                                                                  | TLS cert is rotating per replica or per request                                                                                                                                                                                                                                                                                                                                                                 | Use a stable cert at the ingress, or terminate TLS once and run replicas over plain HTTP internally                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| CLI `/login`: "Could not verify the gateway's TLS certificate" or `SELF_SIGNED_CERT_IN_CHAIN`                                                                               | Gateway's TLS chain is signed by a private CA not in the CLI host's trust store                                                                                                                                                                                                                                                                                                                                 | Claude Code reads the OS trust store by default on the native binary and on Node 22.15 or later; [`CLAUDE_CODE_CERT_STORE`](/docs/en/network-config#ca-certificate-store) controls this behavior. If the CA is installed in the OS trust store, ensure developers are on a current runtime. Otherwise set `NODE_EXTRA_CA_CERTS` to the CA certificate PEM before launching. The first-connect fingerprint prompt still applies.                                                                                                                                                                                                                                                                                                       |
-| CLI `/login` completes the browser sign-in, then the session ends with `Cloud gateway sign-in was not completed` and a TLS certificate mismatch                             | On the first request after sign-in, the gateway presented a certificate that doesn't match the fingerprint Claude Code pinned, so Claude Code kept no gateway credential. The usual causes are replicas behind one address that serve different certificates, or something on the network path that intercepts TLS.                                                                                             | Serve one certificate for the hostname, for example by terminating TLS once at the ingress, then have the developer run `/login` again. If that certificate differs from the pinned one, Claude Code shows the [trust prompt](/docs/en/claude-apps-gateway#connect-developers) again with a warning that the certificate changed.                                                                                                                                                                                                                                                                                                                                                                                                     |
-| CLI `/login` stops with `The gateway's TLS certificate changed during sign-in: it no longer matches the one you trusted`                                                    | A sign-in request reached a server whose certificate doesn't match the one the developer accepted when `/login` started: replicas behind one address serving different certificates, TLS interception on the path, or a certificate rotation while the sign-in was in progress.                                                                                                                                 | Serve one certificate for the hostname, then have the developer start the sign-in again and review the new certificate at the [trust prompt](/docs/en/claude-apps-gateway#connect-developers).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| Symptom                                                                                                                                                                                                                | Cause                                                                                                                                                                                                                                                                                                                                                                                                           | Fix                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| A developer's `/login` shows the standard account picker instead of the **Cloud gateway** screen                                                                                                                       | `forceLoginMethod` or `forceLoginGatewayUrl` isn't set in managed settings on that machine                                                                                                                                                                                                                                                                                                                      | Deploy the [managed settings file](/docs/en/claude-apps-gateway#set-the-gateway-url) to the device; `/login` reads the gateway URL from there                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| A developer's requests fail with `Not signed in to the Cloud gateway — run /login.`                                                                                                                                    | The machine's managed settings set `forceLoginMethod: "gateway"` or `forceLoginGatewayUrl`, and the session has no gateway sign-in. A leftover claude.ai login doesn't satisfy the requirement.                                                                                                                                                                                                                 | Have the developer run `/login` and complete the gateway sign-in. See also [Administrator policy requires a Cloud gateway sign-in](/docs/en/errors#administrator-policy-requires-a-cloud-gateway-sign-in).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| Claude Desktop reports that its bootstrap configuration couldn't be fetched                                                                                                                                            | `/user/bootstrap` returned 404: the policy matching the user doesn't carry a `desktop` key, or no policy matched. The gateway's audit log records each rejection as `desktop_bootstrap.denied` with the reason.                                                                                                                                                                                                 | Add a `desktop` block to the policy that matches the user, or to the `match: {}` base layer; an empty `desktop: {}` suffices. See [Claude Desktop overlay](/docs/en/claude-apps-gateway-config#claude-desktop-overlay).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| Startup shows `Gateway login is configured in managed settings, but this Claude Code build does not include Cloud gateway support.`                                                                                    | The installed Claude Code build predates gateway support                                                                                                                                                                                                                                                                                                                                                        | Have the developer update Claude Code to a release that includes Cloud gateway support                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| Startup exits with `Administrator policy requires a Cloud gateway sign-in on this machine`                                                                                                                             | The developer's environment sets `ANTHROPIC_API_KEY` or `ANTHROPIC_AUTH_TOKEN`, their settings configure an [`apiKeyHelper`](/docs/en/settings-reference#apikeyhelper), or an API key from an earlier Claude Console login is still saved                                                                                                                                                                            | Have the developer clear each that applies: unset the variable, remove the `apiKeyHelper` entry, or run `claude auth logout` to remove the saved key. Then have them start `claude` and sign in with `/login`. See also [Administrator policy requires a Cloud gateway sign-in](/docs/en/errors#administrator-policy-requires-a-cloud-gateway-sign-in).                                                                                                                                                                                                                                                                                                                                                                               |
+| Startup or `/login` reports `Claude Code may not be enabled for your organization` after a 403 on the managed settings load                                                                                            | The gateway, or something in front of it, answered the `/managed/settings` request with 403. The gateway's own settings route never answers 403. The status comes from the [`access_control`](/docs/en/claude-apps-gateway-config#http-tuning) IP checks or from a proxy or WAF in front of the gateway. The audit log records an IP-check denial as `access.denied` with the reason. The developer stays signed in. | Check the audit log for `access.denied` at the time of the failure and fix the `access_control` lists or the front end, then have the developer start `claude` again                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| CLI `/login`: `The gateway is limiting sign-in attempts right now`, or `Request failed with status code 429` on older versions. The `/device` page may show `Too many attempts` to developers who haven't tried before | The per-IP sign-in rate limit was reached. Either `listen.trusted_proxies` doesn't cover the load balancer, so every developer shares its address, or many developers share a NAT or VPN egress address. Audit events with `result: rate_limited` show the same one or few `client_ip` values.                                                                                                                  | Set `listen.trusted_proxies` to the load balancer's source ranges first, then raise `rate_limits` if developers still share addresses. See [Large rollouts](#large-rollouts).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| CLI `/login`: `Gateway hosts must be on your organization's private network; <host> resolves to the public (or unrecognized) address <ip>`                                                                             | The gateway hostname resolves to at least one public IP address. Claude Code checks each resolved address and requires every one to be private. A common cause is a dual-stack name where one family resolves to a public address, including AWS internal dual-stack load balancers, which return public-range AAAA addresses.                                                                                  | Have the gateway name resolve only to private addresses on developer machines. For a dual-stack name, drop the public-range record or serve a separate internal-only DNS name. See the [private-network prerequisite](/docs/en/claude-apps-gateway#prerequisites). If the address is public space your organization owns and uses internally, [declare that block](/docs/en/claude-apps-gateway#allow-a-gateway-on-public-address-space-you-own) instead.                                                                                                                                                                                                                                                                                  |
+| CLI `/login`: `Gateway login would go through proxy <proxy>, which is not on a private network`                                                                                                                        | An `HTTPS_PROXY` or `HTTP_PROXY` applies to the gateway host and the proxy's hostname resolves to a public address. A proxy whose host resolves only to private addresses is allowed and doesn't trigger this error                                                                                                                                                                                             | Add the gateway host to `NO_PROXY` on the developer's machine so the connection is direct, or use a proxy whose hostname resolves to private addresses. The message names the exact `NO_PROXY` entry to add                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| CLI `/login`: `Claude Code only signs in to <host> from inside its declared network <block> (managed settings), and this machine is connecting from <ip>, outside it`                                                  | The gateway is on a block declared in [`gatewayInternalNetworks`](/docs/en/claude-apps-gateway#allow-a-gateway-on-public-address-space-you-own), and the developer's machine reached it from an address outside that block: a VPN address pool, a container or WSL2 NAT segment, or a network that isn't yours                                                                                                       | Have the developer run `/login` from the host OS on your network. If the address shown is also your organization's own public space, replace the gateway's entry with a block that covers both, up to `/8`; a second, overlapping entry is refused                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| CLI `/login`: `Every address for gateway host <host> must be inside its declared network <block>, and it also resolves to <ip>`                                                                                        | The gateway's name resolves to an address outside the block declared in [`gatewayInternalNetworks`](/docs/en/claude-apps-gateway#allow-a-gateway-on-public-address-space-you-own): a second site, or an IPv6 record on a dual-stack name. Under a declared block every record must be inside that one IPv4 block, private and IPv6 addresses included                                                                | Publish only records inside the block for the gateway name on developer machines, or serve a separate internal-only name                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| CLI `/login`: `<host> is on the declared network <block>, which Claude Code checks over a direct connection, not through an HTTP proxy`                                                                                | An `HTTPS_PROXY` or `HTTP_PROXY` applies to a gateway on a declared block                                                                                                                                                                                                                                                                                                                                       | On the developer's machine, add the `NO_PROXY` entry the message names                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| CLI `/login`: a message starting `gatewayInternalNetworks in managed settings`                                                                                                                                         | The value breaks one of the [validation rules](/docs/en/claude-apps-gateway#allow-a-gateway-on-public-address-space-you-own), and the message names which. Until you fix it, Claude Code refuses every new gateway `/login` on the machine, gateways on private addresses included; existing sign-ins keep working                                                                                                   | In the managed settings source you deploy, correct the entry the message names, then rerun `/login`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| CLI `/login`: `Could not resolve the configured HTTP proxy`                                                                                                                                                            | The hostname in `HTTPS_PROXY` or `HTTP_PROXY` doesn't resolve from the developer's machine, typically because it isn't connected to the corporate network                                                                                                                                                                                                                                                       | Have the developer connect to your network or VPN and retry, or fix the proxy URL                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| CLI `/login`: `Could not resolve gateway host <host>`                                                                                                                                                                  | The machine can't resolve the gateway's internal DNS name, typically because it isn't on the corporate network                                                                                                                                                                                                                                                                                                  | Have the developer connect to your network or VPN, then retry `/login`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| Boot exits with a config validation error naming `store.postgres_url`                                                                                                                                                  | No Postgres configured; the gateway requires Postgres                                                                                                                                                                                                                                                                                                                                                           | Set `store.postgres_url`. For local development, use a throwaway container: `docker run --rm -p 5432:5432 -e POSTGRES_HOST_AUTH_METHOD=trust postgres`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| Boot exits: `requires the native binary`                                                                                                                                                                               | Running under Node instead of the native binary                                                                                                                                                                                                                                                                                                                                                                 | Install Claude Code with one of the [standalone install methods](/docs/en/setup)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| Boot exits with an OIDC discovery error after `config.load`                                                                                                                                                            | `oidc.issuer` unreachable, or TLS chain not trusted                                                                                                                                                                                                                                                                                                                                                             | Check the issuer is reachable from the pod and serves `/.well-known/openid-configuration`. Set `ca_cert_pem` for private PKI. If the pod reaches the IdP only through a forward proxy, set [`oidc.use_proxy: true`](/docs/en/claude-apps-gateway-config#idp-requests-through-a-forward-proxy); on versions before v2.1.227, give the pod a direct route to each of the IdP's endpoints instead. If the pod also can't resolve the IdP's hostname, or the proxy refuses `CONNECT` to an IP address, see [Proxy-only egress](/docs/en/claude-apps-gateway-config#proxy-only-egress), which requires v2.1.277 or later.                                                                                                                       |
+| Boot exits with a Postgres permission error                                                                                                                                                                            | The database role lacks DDL rights on its schema                                                                                                                                                                                                                                                                                                                                                                | Grant the role `CREATE` on the gateway's schema so it can create and alter its tables at boot                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| Log: `could not connect to Postgres at boot, attempt 1 of 3`                                                                                                                                                           | The database wasn't reachable yet when the gateway started, for example on a cold instance whose network is still coming up                                                                                                                                                                                                                                                                                     | If the gateway then finishes booting, no action is needed. When the database isn't reachable, the gateway tries the connection three times, two seconds apart, before it exits. If it exits with `could not connect to Postgres`, check `store.postgres_url` and the network path to the database. If the attempts time out rather than being refused, raise [`store.connect_timeout_seconds`](/docs/en/claude-apps-gateway-config#store) to give each one longer.                                                                                                                                                                                                                                                                    |
+| `/oauth/callback` shows "Sign-in could not be completed"                                                                                                                                                               | Email domain rejected, id\_token validation failed, or `email_verified` is explicitly `false`, which the gateway always rejects with no override                                                                                                                                                                                                                                                                | Check `allowed_email_domains` and that the IdP returns a verified `email` claim. For `email_verified: false`, fix the IdP-side verification. If your IdP emits email under a different claim name, set `oidc.email_claim`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| Log: `token exchange failed request_id=<id>: id_token missing email claim`                                                                                                                                             | The IdP isn't including `email` in the id\_token by default. This rejection fires only when `allowed_email_domains` is set; without it, a missing email mints a session with no email                                                                                                                                                                                                                           | Configure the IdP to emit `email` in the id\_token. Okta: add `email` to a custom authorization server's ID-token claims. Entra: add `email` as an optional claim on the app registration. PingFederate: enable an OpenID Connect Policy that emits `email`. If the IdP serves `email` from the userinfo endpoint but won't include it in the id\_token, such as the Okta org authorization server, set `oidc.userinfo_fallback: true`.                                                                                                                                                                                                                                                                                          |
+| Log: `refresh failed request_id=<id>: invalid_token (…) (at userinfo_no_id_token, …)`, and developers see `Cloud gateway session expired` every `session.ttl_hours`                                                    | The IdP accepted the refresh token but returned no id\_token with it, so the gateway asked the IdP's userinfo endpoint for the user's claims. The IdP rejected the refreshed access token there. The gateway answers `temporarily_unavailable`, so Claude Code keeps the refresh token but can't renew the session. Gateway versions before v2.1.260 log the same line without the `(at …)` detail.             | Set [`oidc.scope_on_refresh: true`](/docs/en/claude-apps-gateway-config#oidc), available in gateway v2.1.260 or later, so the refresh request asks for `openid` again. Some IdPs, such as Okta, return an id\_token on refresh only when asked. On PingFederate, enable **Return ID Token On Refresh Grant** under **Applications > OAuth > OpenID Connect Policy Management** instead. The key doesn't change PingFederate's behavior. For other IdPs that still omit it, check whether the userinfo endpoint accepts access tokens issued by a refresh. As a stopgap, raise [`session.ttl_hours`](/docs/en/claude-apps-gateway-config#session). See [Identity provider setup](#identity-provider-setup) for the deprovisioning tradeoff. |
+| Every Amazon Bedrock request returns 502; log shows `Could not load credentials from any providers`                                                                                                                    | On EC2, IMDSv2's default hop limit of 1 blocks the instance-metadata request from inside the container. Boot and `/readyz` pass anyway because the AWS SDK resolves instance credentials on the first request, not at client construction                                                                                                                                                                       | Raise the hop limit with `aws ec2 modify-instance-metadata-options --instance-id <id> --http-put-response-hop-limit 2`, or set it in the launch template. The change applies to every container on the instance. Prefer ECS task roles where available, which read credentials from the ECS container-credentials endpoint and avoid the change entirely, or apply the change on a dedicated gateway instance to limit the exposure.                                                                                                                                                                                                                                                                                             |
+| At peak load, responses are slow to start or appear to hang, or fail with a 502 `all upstreams failed` while the upstream is healthy                                                                                   | A replica has more requests open than it sends upstream at once, so the extra requests wait inside the gateway. On a `provider: anthropic` upstream, a request that waits longer than `timeouts.upstream_ttfb_ms` gives up on that upstream, which produces the 502 when no later upstream serves it. The log shows a warning that contains `client requests are open`.                                         | Add replicas, or raise the limit on each replica. See [Concurrent upstream requests](#concurrent-upstream-requests).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| IdP error: unknown or unsupported scope                                                                                                                                                                                | The IdP rejects scopes it doesn't recognize                                                                                                                                                                                                                                                                                                                                                                     | Set `oidc.scopes` to exactly the list your IdP accepts; it must include `openid`. The default is `openid profile email offline_access`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| Sessions don't silently renew after setting `oidc.scopes`                                                                                                                                                              | `offline_access` was dropped from the override                                                                                                                                                                                                                                                                                                                                                                  | Add `offline_access` back if your IdP supports it. Without a refresh token, developers re-run the browser login every `session.ttl_hours`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| Browser shows "This request came from another site and was blocked"                                                                                                                                                    | Cross-site form POST, blocked as CSRF protection. Expected for embedded or proxied pages                                                                                                                                                                                                                                                                                                                        | Open the verification link directly                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| Chrome blocks the Approve button with "Refused to send form data … violates … Content Security Policy directive: form-action", but the same page works in Safari or Firefox                                            | Chrome enforces `form-action` against the entire redirect chain. Your IdP redirects onward to a second host that isn't allowlisted.                                                                                                                                                                                                                                                                             | Add each additional origin in the redirect chain to `oidc.form_action_origins`. Open Chrome DevTools → Console on the Approve page to see which origin was blocked.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| Sign-in completes at the IdP but the callback fails, with a CSP error in Chrome or "this sign-in link has expired" in Safari                                                                                           | The IdP returned the code via `response_mode=form_post`, which auto-submits it cross-origin via POST to `/oauth/callback`. Chrome blocks that under a strict CSP; Safari allows the submit but the callback reads only the query string.                                                                                                                                                                        | Make sure your IdP honors `response_mode=query`, which the gateway requests explicitly so the callback is a plain redirect                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| Login works locally but fails behind an ALB                                                                                                                                                                            | `public_url` still names the local or inner `http://` origin, so the IdP gets the wrong `redirect_uri`                                                                                                                                                                                                                                                                                                          | Set `listen.public_url` to the external `https://` origin and register `<public_url>/oauth/callback` with the IdP                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| Developer sees the trust prompt repeatedly                                                                                                                                                                             | TLS cert is rotating per replica or per request                                                                                                                                                                                                                                                                                                                                                                 | Use a stable cert at the ingress, or terminate TLS once and run replicas over plain HTTP internally                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| CLI `/login`: "Could not verify the gateway's TLS certificate" or `SELF_SIGNED_CERT_IN_CHAIN`                                                                                                                          | Gateway's TLS chain is signed by a private CA not in the CLI host's trust store                                                                                                                                                                                                                                                                                                                                 | Claude Code reads the OS trust store by default on the native binary and on Node 22.15 or later; [`CLAUDE_CODE_CERT_STORE`](/docs/en/network-config#ca-certificate-store) controls this behavior. If the CA is installed in the OS trust store, ensure developers are on a current runtime. Otherwise set `NODE_EXTRA_CA_CERTS` to the CA certificate PEM before launching. The first-connect fingerprint prompt still applies.                                                                                                                                                                                                                                                                                                       |
+| CLI `/login` completes the browser sign-in, then the session ends with `Cloud gateway sign-in was not completed` and a TLS certificate mismatch                                                                        | On the first request after sign-in, the gateway presented a certificate that doesn't match the fingerprint Claude Code pinned, so Claude Code kept no gateway credential. The usual causes are replicas behind one address that serve different certificates, or something on the network path that intercepts TLS.                                                                                             | Serve one certificate for the hostname, for example by terminating TLS once at the ingress, then have the developer run `/login` again. If that certificate differs from the pinned one, Claude Code shows the [trust prompt](/docs/en/claude-apps-gateway#connect-developers) again with a warning that the certificate changed.                                                                                                                                                                                                                                                                                                                                                                                                     |
+| CLI `/login` stops with `The gateway's TLS certificate changed during sign-in: it no longer matches the one you trusted`                                                                                               | A sign-in request reached a server whose certificate doesn't match the one the developer accepted when `/login` started: replicas behind one address serving different certificates, TLS interception on the path, or a certificate rotation while the sign-in was in progress.                                                                                                                                 | Serve one certificate for the hostname, then have the developer start the sign-in again and review the new certificate at the [trust prompt](/docs/en/claude-apps-gateway#connect-developers).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
 
 The `Cloud gateway sign-in was not completed` message names the gateway hostname. When Claude Code has both the pinned fingerprint and the presented one, the message also shows the first 16 characters of each.
 
diff --git a/content/en/docs/claude-code/claude-apps-gateway-on-aws.md b/content/en/docs/claude-code/claude-apps-gateway-on-aws.md
index 70000410ed..162fe396e7 100644
--- a/content/en/docs/claude-code/claude-apps-gateway-on-aws.md
+++ b/content/en/docs/claude-code/claude-apps-gateway-on-aws.md
@@ -492,7 +492,7 @@ For gateway boot and login errors, see the platform-agnostic [troubleshooting ta
 | Bedrock requests return `403 AccessDeniedException`                                                                                        | The account hasn't submitted Anthropic's one-time use case form, the automatic AWS Marketplace subscription that starts on the account's first invoke hasn't finished yet, or the task role's policy is missing the inference-profile or foundation-model ARNs                                                                                                                                                                                                                                                                              | Submit the use case form from the Bedrock console's Model catalog; if it was just submitted or this is the account's first invoke, retry after a few minutes. Grant `bedrock:InvokeModel` and `bedrock:InvokeModelWithResponseStream` on both ARN families.                                                    |
 | Bedrock returns a `ValidationException` saying on-demand throughput isn't supported                                                        | A custom `models:` entry maps to a bare foundation-model ID that the region serves only through inference profiles                                                                                                                                                                                                                                                                                                                                                                                                                          | Map the model to its cross-region inference profile ID (`us.anthropic.*`) instead; the built-in catalog already does this                                                                                                                                                                                      |
 | ECS task stops with `ResourceInitializationError` before the gateway logs anything                                                         | The execution role can't read the Secrets Manager secrets, or the private subnets have no path to Secrets Manager or ECR                                                                                                                                                                                                                                                                                                                                                                                                                    | Grant `secretsmanager:GetSecretValue` on the three `gateway-` secrets' ARNs to the execution role, and provide egress via the NAT gateway, or, without one, interface endpoints for Secrets Manager, ECR, and CloudWatch Logs, which the `awslogs` driver needs at the same stage, plus an S3 gateway endpoint |
-| Gateway boot exits with a Postgres connection-timeout error                                                                                | The database security group doesn't admit the gateway's security group on 5432, or the service runs outside the database's VPC; the store stops waiting after 5 seconds                                                                                                                                                                                                                                                                                                                                                                     | Allow 5432 from the gateway's security group on the database's, and run the service in the same VPC as the DB subnet group                                                                                                                                                                                     |
+| Gateway boot exits with a Postgres connection-timeout error                                                                                | The database security group doesn't admit the gateway's security group on 5432, or the service runs outside the database's VPC                                                                                                                                                                                                                                                                                                                                                                                                              | Allow 5432 from the gateway's security group on the database's, and run the service in the same VPC as the DB subnet group                                                                                                                                                                                     |
 | Gateway boot exits with a Postgres TLS certificate verification error                                                                      | The connection string sets `sslmode=verify-full` but the image doesn't trust the RDS CA bundle: the bundle wasn't copied into the image, or `NODE_EXTRA_CA_CERTS` doesn't point at it                                                                                                                                                                                                                                                                                                                                                       | Add the build step's two Dockerfile lines that copy the bundle and set `NODE_EXTRA_CA_CERTS`, then rebuild, push under a new tag, and redeploy                                                                                                                                                                 |
 | Streaming responses drop mid-stream after a quiet period                                                                                   | A gateway older than v2.1.229 on a Bedrock or Claude Platform on AWS upstream sends nothing while the upstream is quiet, for example during extended thinking with no streamed output. The ALB closes a connection after 60 seconds with no data by default, so it cuts the stream at that gap. Gateways v2.1.229 and later keep a quiet stream under that timeout: on those upstreams the gateway emits an SSE `ping` event once about 15 seconds pass with no stream data, and on an Anthropic API upstream it relays the API's own pings | Update the gateway to v2.1.229 or later, or set the `idle_timeout.timeout_seconds` attribute to `3600`, via `modify-load-balancer-attributes` or the `load-balancer-attributes` Ingress annotation on EKS                                                                                                      |
 
diff --git a/content/en/docs/claude-code/claude-apps-gateway-on-gcp.md b/content/en/docs/claude-code/claude-apps-gateway-on-gcp.md
index 135d127ca7..3779c21de1 100644
--- a/content/en/docs/claude-code/claude-apps-gateway-on-gcp.md
+++ b/content/en/docs/claude-code/claude-apps-gateway-on-gcp.md
@@ -308,7 +308,7 @@ For gateway boot and login errors, see the platform-agnostic [troubleshooting ta
 | Cloud Run returns `403 Forbidden` before reaching the container                          | The invoker IAM check is still enabled                                                                                              | Deploy with `--no-invoker-iam-check`, or grant `allUsers` the `run.invoker` role with `--allow-unauthenticated`                                                                                                             |
 | `--no-invoker-iam-check` rejected with `invoker_iam_disabled is not currently available` | Blocked by `constraints/run.managed.requireInvokerIam`                                                                              | Use `--allow-unauthenticated`. If Domain Restricted Sharing via `constraints/iam.allowedPolicyMemberDomains` blocks that too, use the GKE track, which exposes the gateway at the network layer with no `allUsers` binding. |
 | `Container manifest type … must support amd64/linux` at deploy                           | Image was built on a non-amd64 host, or buildx emitted an OCI image index                                                           | Build with `--platform=linux/amd64 --provenance=false`                                                                                                                                                                      |
-| Gateway boot exits with a Postgres connection-timeout error on Cloud Run                 | Service isn't attached to the VPC, or Cloud SQL has no private IP on that VPC; the store stops waiting after 5 seconds              | Deploy with `--network` and `--subnet` for Direct VPC egress, and create the Cloud SQL instance with `--no-assign-ip` and `--network` pointing at the same VPC                                                              |
+| Gateway boot exits with a Postgres connection-timeout error on Cloud Run                 | Service isn't attached to the VPC, or Cloud SQL has no private IP on that VPC                                                       | Deploy with `--network` and `--subnet` for Direct VPC egress, and create the Cloud SQL instance with `--no-assign-ip` and `--network` pointing at the same VPC                                                              |
 | Google Cloud's Agent Platform requests return `403 PERMISSION_DENIED`                    | Runtime isn't using the `claude-gateway` service account, or the model isn't enabled in Model Garden for the project                | Set `--service-account` on Cloud Run or bind Workload Identity on GKE, and enable each Claude model in Model Garden for the target region                                                                                   |
 | Streaming responses cut off after a fixed duration                                       | Front-end request timeout: the load balancer backend service behind GKE Ingress defaults to 30 seconds and Cloud Run to 300 seconds | Attach a BackendConfig with a raised `timeoutSec` on GKE, or deploy with `--timeout=3600` on Cloud Run                                                                                                                      |
 
diff --git a/content/en/docs/claude-code/claude-code-on-the-web.md b/content/en/docs/claude-code/claude-code-on-the-web.md
index f48205c63c..200e43c631 100644
--- a/content/en/docs/claude-code/claude-code-on-the-web.md
+++ b/content/en/docs/claude-code/claude-code-on-the-web.md
@@ -250,6 +250,8 @@ You pick a cloud session's [permission mode](/docs/en/permission-modes) from the
 
 Each session shows a diff indicator with lines added and removed, like `+42 -18`. Select it to open the diff view, leave inline comments on specific lines, and send them to Claude with your next message.
 
+The diff view compares the session's changes against its base branch by default. To compare against any other branch in the repository, select **Compare against** and pick one.
+
 Claude Code computes these diffs, including the per-file diffs shown as Claude edits, from raw git blob content, so diff drivers and `textconv` filters configured in the repository don't apply. For a file in a repository that isn't one of the session's own checkouts, such as one cloned inside the workspace during the session, the per-file diff shows Claude's edit itself rather than a git comparison.
 
 See [Review and iterate](/docs/en/web-quickstart#review-and-iterate) for the full walkthrough including PR creation. To have Claude monitor the PR for CI failures and review comments automatically, see [Auto-fix pull requests](#auto-fix-pull-requests).
diff --git a/content/en/docs/claude-code/claude-directory.md b/content/en/docs/claude-code/claude-directory.md
index 3d79b273a3..9296faa566 100644
--- a/content/en/docs/claude-code/claude-directory.md
+++ b/content/en/docs/claude-code/claude-directory.md
@@ -34,7 +34,7 @@ export const ClaudeExplorer = () => {
         oneLiner: 'Project instructions Claude reads every session',
         when: 'Loaded into context at the start of every session',
         description: 'Project-specific instructions that shape how Claude works in this repository. Put your conventions, common commands, and architectural context here so Claude operates with the same assumptions your team does.',
-        tips: ['Target under 200 lines. Longer files still load in full but may reduce adherence', <>CLAUDE.md loads into every session. If something only matters for specific tasks, move it to a <A href="/docs/en/skills">skill</A> or a path-scoped <A href="/docs/en/memory#organize-rules-with-claude/rules/">rule</A> so it loads only when needed</>, 'List the commands you run most, like build, test, and format, so Claude knows them without you spelling them out each time', <>Run <C>/memory</C> to open and edit CLAUDE.md from within a session</>, <>Also works at <C>.claude/CLAUDE.md</C> if you prefer to keep the project root clean</>],
+        tips: ['Target under 200 lines. Longer files still load in full but may reduce adherence', <>CLAUDE.md loads into every session. If something only matters for specific tasks, move it to a <A href="/docs/en/skills">skill</A> or a path-scoped <A href="/docs/en/memory#organize-rules-with-claude/rules/">rule</A> so it loads only when needed</>, 'List the commands you run most, like build, test, and format, so Claude knows them without you spelling them out each time', <>Run <C>/memory</C> to open and edit CLAUDE.md from within a session</>, <>Also works at <C>.claude/CLAUDE.md</C> if you prefer to keep the project root clean</>, <>If your repo already has an <C>AGENTS.md</C> for other coding agents, Claude Code <A href="/docs/en/memory#agents-md">can read that</A> on its own or alongside CLAUDE.md</>],
         exampleIntro: 'This example is for a TypeScript and React project. It lists the build and test commands, the framework conventions Claude should follow, and project-specific rules like export style and file layout.',
         example: `# Project conventions
 
@@ -1434,7 +1434,7 @@ Claude Code reads instructions, settings, skills, subagents, and memory from you
 
 On Windows, `~/.claude` resolves to `%USERPROFILE%\.claude`. If you set [`CLAUDE_CONFIG_DIR`](/docs/en/env-vars), every `~/.claude` path on this page lives under that directory instead.
 
-Most users only edit `CLAUDE.md` and `settings.json`. The rest of the directory is optional: add skills, rules, or subagents as you need them.
+Most users only edit `CLAUDE.md` and `settings.json`. If your repository already has an `AGENTS.md` for other coding agents, Claude Code [can read that](/docs/en/memory#agents-md) on its own or alongside `CLAUDE.md`. The rest of the directory is optional: add skills, rules, or subagents as you need them.
 
 ## Explore the directory
 
@@ -1446,11 +1446,12 @@ Click files in the tree to see what each one does, when it loads, and an example
 
 The explorer covers files you author and edit. A few related files live elsewhere:
 
-| File                    | Location                   | Purpose                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
-| ----------------------- | -------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `managed-settings.json` | System-level, varies by OS | Enterprise-enforced settings that you can't override, apart from [narrow exceptions](/docs/en/settings#security-keys-where-the-stricter-value-applies). See [where to save the file](/docs/en/managed-settings#deploy-a-managed-settings-file) and [which managed source Claude Code uses](/docs/en/managed-settings#precedence-within-the-managed-tier).                                                                                                                                                                                                                                                                                                                                                                                                     |
-| `CLAUDE.local.md`       | Project root               | Your private preferences for this project, loaded alongside CLAUDE.md. Create it manually and add it to `.gitignore`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| Installed plugins       | `~/.claude/plugins`        | Cloned marketplaces, installed plugin versions, and per-plugin data, managed by `claude plugin` commands. For a plugin installed from a marketplace [`command` source](/docs/en/plugin-marketplaces#command-sources) in link mode, Claude Code stores links here instead of a copy, and the plugin's files stay in the directory the command prints. A `command` source requires Claude Code v2.1.229 or later. A plugin listed by relative path in a local-directory marketplace also [loads in place](/docs/en/plugins-reference#plugin-caching-and-file-resolution) from its source directory rather than from a cache copy. See [plugin caching](/docs/en/plugins-reference#plugin-caching-and-file-resolution) for how orphaned versions are cleaned up. |
+| File                    | Location                                   | Purpose                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| ----------------------- | ------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `managed-settings.json` | System-level, varies by OS                 | Enterprise-enforced settings that you can't override, apart from [narrow exceptions](/docs/en/settings#security-keys-where-the-stricter-value-applies). See [where to save the file](/docs/en/managed-settings#deploy-a-managed-settings-file) and [which managed source Claude Code uses](/docs/en/managed-settings#precedence-within-the-managed-tier).                                                                                                                                                                                                                                                                                                                                                                                                     |
+| `CLAUDE.local.md`       | Project root                               | Your private preferences for this project, loaded alongside CLAUDE.md. Create it manually and add it to `.gitignore`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `AGENTS.md`             | Project root, `.claude/`, or any directory | Project instructions you write for AI coding agents. Claude Code can [load it](/docs/en/memory#agents-md) on its own or alongside `CLAUDE.md`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| Installed plugins       | `~/.claude/plugins`                        | Cloned marketplaces, installed plugin versions, and per-plugin data, managed by `claude plugin` commands. For a plugin installed from a marketplace [`command` source](/docs/en/plugin-marketplaces#command-sources) in link mode, Claude Code stores links here instead of a copy, and the plugin's files stay in the directory the command prints. A `command` source requires Claude Code v2.1.229 or later. A plugin listed by relative path in a local-directory marketplace also [loads in place](/docs/en/plugins-reference#plugin-caching-and-file-resolution) from its source directory rather than from a cache copy. See [plugin caching](/docs/en/plugins-reference#plugin-caching-and-file-resolution) for how orphaned versions are cleaned up. |
 
 `~/.claude` also holds data Claude Code writes as you work: transcripts, prompt history, file snapshots, caches, and logs. See [application data](#application-data) below.
 
diff --git a/content/en/docs/claude-code/cloud-environments.md b/content/en/docs/claude-code/cloud-environments.md
index a82f9f5da5..6bbeeffa14 100644
--- a/content/en/docs/claude-code/cloud-environments.md
+++ b/content/en/docs/claude-code/cloud-environments.md
@@ -144,7 +144,7 @@ A [self-hosted environment](/docs/en/self-hosted-environments) ID, which has the
 
 ### Archive an environment
 
-To archive an environment, open it for editing and select **Archive**. You can't delete an environment, only archive it.
+To archive one of your own environments, open it for editing and select **Archive**. An Owner archives a [shared environment](#organization-shared-environments) from the **Cloud environments** page in admin settings. You can't delete an environment, only archive it.
 
 Archiving affects new sessions, not running ones:
 
@@ -155,9 +155,16 @@ Archiving affects new sessions, not running ones:
 
 ### Organization-shared environments
 
-On Team and Enterprise plans, an Owner can create cloud environments that are shared with every member of the organization. The same role manages everything else on the **Cloud environments** admin page, including [self-hosted environments](/docs/en/self-hosted-environments); the Admin role can't open the page. The full list of roles that can open it is the one for [managing server-managed settings](/docs/en/server-managed-settings#access-control). Shared environments appear in each member's environment selector alongside their personal ones, so a team can standardize on one configuration instead of each member recreating it.
+On Team and Enterprise plans, an Owner can create cloud environments that are shared with every member of the organization. The same role manages everything else on the **Cloud environments** admin page, including [self-hosted environments](/docs/en/self-hosted-environments); the Admin role can't open the page. The full list of roles that can open it is the one for [managing server-managed settings](/docs/en/server-managed-settings#access-control).
 
-Create, edit, and archive shared environments from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings). A shared environment also opens from the [environment selector](#configure-your-environment) at [claude.ai/code](https://claude.ai/code): an Owner can edit it there. Other members see it read-only. Each shared environment has a name, a [network access level](#access-levels), [environment variables](#set-environment-variables) in `.env` format, and a [setup script](#setup-scripts). Owners choose the organization's [default environment](#the-default-environment) separately, at [claude.ai/admin-settings/claude-code](https://claude.ai/admin-settings/claude-code).
+Shared environments appear in each member's [environment selector](#configure-your-environment) under an **Organization** heading, after the member's own environments under **Personal**, so a team can standardize on one configuration instead of each member recreating it. Selecting a shared environment's settings icon there opens a read-only summary of its configuration for every member, Owners included.
+
+An Owner makes an environment available to the organization in one of two ways:
+
+* **Create a shared environment**: use the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings), which is also where Owners edit and archive shared environments. Each one has a name, a [network access level](#access-levels), [environment variables](#set-environment-variables) in `.env` format, and a [setup script](#setup-scripts).
+* **Share a personal environment**: open one of your own environments for editing in the environment selector, then share it from the **Who can use it** row. The environment keeps its ID, so sessions and routines that already use it aren't affected, and every member can then see it and start sessions in it.
+
+Owners choose the organization's [default environment](#the-default-environment) separately, at [claude.ai/admin-settings/claude-code](https://claude.ai/admin-settings/claude-code).
 
 Every member's sessions in a shared environment read its variables, so don't include secrets in them. [API credentials](#add-api-credentials), which give sessions a key they can't read, aren't available on Team or Enterprise plans yet.
 
@@ -172,7 +179,7 @@ In [Claude Tag](https://claude.com/docs/claude-tag/overview) channels, Claude wo
 
 Each environment sets one network access level, which controls the outbound connections its sessions can make. The default level, **Trusted**, allows package registries and other [allowlisted domains](#default-allowed-domains); **Custom** takes your own domain list.
 
-To change an environment's network access, [open it for editing](#configure-your-environment) and use the **Network access** selector in the dialog. The cloud icon that opens the selector appears on the app surfaces listed under [The Default environment](#the-default-environment) and in the [routine editor](/docs/en/routines#environments-and-network-access); personal environments don't have a separate page in your claude.ai account settings.
+To change an environment's network access, [open it for editing](#configure-your-environment) and use the **Network access** selector in the dialog. A [shared environment](#organization-shared-environments) opens read-only there, so an Owner changes its network access from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings) instead. The cloud icon that opens the selector appears on the app surfaces listed under [The Default environment](#the-default-environment) and in the [routine editor](/docs/en/routines#environments-and-network-access); personal environments don't have a separate page in your claude.ai account settings.
 
 <Note>
   MCP connectors you enable on a session or routine work without adding their hosts to **Allowed domains**, because connector traffic travels through Anthropic's servers rather than the session's network. This relies on the same Anthropic-bound channel noted under [Security and isolation](/docs/en/claude-code-on-the-web#security-and-isolation). Turn off any connector you don't need to limit which tools Claude can reach.
@@ -314,7 +321,7 @@ GitHub's [`gh` CLI](https://cli.github.com) is pre-installed. If you need a `gh`
 
 Each cloud session has a transcript URL on claude.ai, and the session can read its own ID from the `CLAUDE_CODE_REMOTE_SESSION_ID` environment variable. Use this to put a traceable link in PR bodies, commit messages, Slack posts, or generated reports so a reviewer can open the run that produced them.
 
-Commits that Claude creates in a cloud session include a `Claude-Session: <url>` git trailer, and PR bodies include the session URL on its own line. To omit the trailer and the PR-body link, set [`attribution.sessionUrl`](/docs/en/settings-reference#attribution-sessionurl) to `false`. The setting requires v2.1.182 or later.
+Commits that Claude creates in a cloud session include a `Claude-Session: <url>` git trailer, and PR bodies include the session URL on its own line. To omit the trailer and the PR-body link, set [`attribution.sessionUrl`](/docs/en/settings-reference#attribution-sessionurl) to `false`.
 
 To include the session link in something other than a commit or PR, such as a Slack message Claude posts or a report file it writes, have Claude run the following command and use its output. The command converts the `cse_` prefix in the environment variable's value to the `session_` prefix that the transcript URL expects:
 
diff --git a/content/en/docs/claude-code/commands.md b/content/en/docs/claude-code/commands.md
index 9a45eb29fc..977ef25853 100644
--- a/content/en/docs/claude-code/commands.md
+++ b/content/en/docs/claude-code/commands.md
@@ -68,7 +68,7 @@ In the table below, `<arg>` indicates a required argument and `[arg]` indicates
 | `/code-review [low\|medium\|high\|xhigh\|max\|ultra] [--fix] [--comment] [pr#\|branch\|path]`                | **[Skill](/docs/en/skills#bundled-skills).** Review the current diff, or a PR number, branch, or path you pass, for correctness bugs and cleanup opportunities. Pass `--fix` to apply findings, `--comment` to post them on the GitHub PR or GitLab merge request, or `ultra` to run a deep [cloud review](/docs/en/ultrareview). Posting to a GitLab merge request requires Claude Code v2.1.257 or later. With `ultra` on a `github.com` PR target, pass `--post` to preselect [posting the finished findings to the PR](/docs/en/ultrareview#post-findings-to-the-pull-request) in the launch dialog; `--post` requires Claude Code v2.1.227 or later. See [Review a diff locally](/docs/en/code-review#review-a-diff-locally) for the effort levels, targeting, and how it relates to `/simplify`. Alias: `/review`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
 | `/color [color\|default]`                                                                                    | Set the prompt bar color for the current session. Available colors: `red`, `blue`, `green`, `yellow`, `purple`, `orange`, `pink`, `cyan`. Use `default` to reset, or run with no argument to pick a random color. When [Remote Control](/docs/en/remote-control) is connected, the color syncs to claude.ai/code. Also available in non-interactive mode (`-p`); requires Claude Code v2.1.205 or later                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
 | `/compact [instructions]`                                                                                    | Free up context by summarizing the conversation so far. Optionally pass focus instructions for the summary. See [how compaction handles rules, skills, and memory files](/docs/en/context-window#what-survives-compaction)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| `/config [key=value ...]`                                                                                    | Open the [Settings](/docs/en/settings) interface to adjust theme, model, [output style](/docs/en/output-styles), and other preferences. Pass one or more `key=value` pairs to set a setting directly without opening the interface, for example `/config thinking=false`. From v2.1.182, named shorthand keys are also accepted, such as `/config theme=dark` or `/config model=sonnet`. The `key=value` form also works in non-interactive mode (`-p`) and from the Claude mobile app via [Remote Control](/docs/en/remote-control). The `key=value` form can't turn on a setting that needs your confirmation in the panel, such as [`autoContinueAtUsageLimit`](/docs/en/interactive-mode#turn-automatic-continue-off), though it can turn one off. Run `/config --help` to list the keys it accepts. Alias: `/settings`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| `/config [key=value ...]`                                                                                    | Open the [Settings](/docs/en/settings) interface to adjust theme, model, [output style](/docs/en/output-styles), and other preferences. Pass one or more `key=value` pairs to set a setting directly without opening the interface, for example `/config thinking=false`, `/config theme=dark`, or `/config model=sonnet`. The `key=value` form also works in non-interactive mode (`-p`) and from the Claude mobile app via [Remote Control](/docs/en/remote-control). The `key=value` form can't turn on a setting that needs your confirmation in the panel, such as [`autoContinueAtUsageLimit`](/docs/en/interactive-mode#turn-automatic-continue-off), though it can turn one off. Run `/config --help` to list the keys it accepts. Alias: `/settings`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
 | `/context [all]`                                                                                             | Visualize current context usage as a colored grid. Shows optimization suggestions for context-heavy tools, memory bloat, and capacity warnings. When the conversation exceeds the context window, the output includes a [warning](/docs/en/errors#context-exceeds-the-token-limit) showing how far over the limit you are and which command frees space. In [fullscreen mode](/docs/en/fullscreen), `/context` collapses the per-item breakdown to keep the grid visible. Pass `all` to expand it                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
 | `/copy [N]`                                                                                                  | Copy the last assistant response to clipboard. Pass a number `N` to copy the Nth-latest response: `/copy 2` copies the second-to-last. When code blocks are present, shows an interactive picker to select individual blocks or the full response. Press `w` in the picker to write the selection to a file instead of the clipboard, which is useful over SSH                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
 | `/cost`                                                                                                      | Alias for `/usage`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
diff --git a/content/en/docs/claude-code/context-window.md b/content/en/docs/claude-code/context-window.md
index fad79616c0..d0fd6fdcb5 100644
--- a/content/en/docs/claude-code/context-window.md
+++ b/content/en/docs/claude-code/context-window.md
@@ -1584,7 +1584,7 @@ Claude Code's context window holds everything Claude knows about your session: y
 
 The session walks through a realistic flow with representative token counts:
 
-* **Before you type anything**: CLAUDE.md, auto memory, MCP tool names, and skill descriptions all load into context. Your own setup may add more here, like an [output style](/docs/en/output-styles) or text from [`--append-system-prompt`](/docs/en/cli-reference).
+* **Before you type anything**: CLAUDE.md, auto memory, MCP tool names, and skill descriptions all load into context. [AGENTS.md files](/docs/en/memory#agents-md) can load too, on their own or alongside CLAUDE.md. Your own setup may add more here, like an [output style](/docs/en/output-styles) or text from [`--append-system-prompt`](/docs/en/cli-reference).
 * **As Claude works**: each file read adds to context, [path-scoped rules](/docs/en/memory#path-specific-rules) load automatically alongside matching files, and a [PostToolUse hook](/docs/en/hooks-guide) fires after each edit.
 * **The follow-up prompt**: a [subagent](/docs/en/sub-agents) handles the research in its own separate context window, so the large file reads stay out of yours. Only the summary and a small metadata trailer come back.
 * **At the end**: `/compact` replaces the conversation with a structured summary. Most startup content reloads automatically; the table below shows what happens to each mechanism.
diff --git a/content/en/docs/claude-code/corporate-launcher.md b/content/en/docs/claude-code/corporate-launcher.md
index 90ba5d9a11..372228bff9 100644
--- a/content/en/docs/claude-code/corporate-launcher.md
+++ b/content/en/docs/claude-code/corporate-launcher.md
@@ -10,7 +10,7 @@ Some organizations require every process on a workstation to start through a man
 
 `CLAUDE_CODE_PROCESS_WRAPPER` starts every process Claude Code launches from its own binary through your launcher: the background service, every session it hosts in [agent view](/docs/en/agent-view), and Claude Code's relaunches after an update. Set it to your launcher's absolute path, and Claude Code runs the launcher with the Claude Code command as its arguments.
 
-A launcher that wraps the `claude` command on your `PATH` can't reach these processes, because they start from the binary's direct path without looking up `claude`.
+A launcher that wraps the `claude` command on your `PATH` can't reach the background service or the sessions it hosts, because they start from the binary's direct path without looking up `claude`.
 
 <Note>
   `CLAUDE_CODE_PROCESS_WRAPPER` requires Claude Code v2.1.208 or later. Earlier versions ignore the variable and start every process unwrapped. The equivalent [`processWrapper` setting](/docs/en/settings-reference#processwrapper) requires v2.1.210 or later. Earlier versions ignore it as an unknown key, apply no launcher, and report no error.
@@ -36,7 +36,7 @@ On Windows, the variable is ignored: the launcher contract depends on `exec`, wh
 The following processes don't start through the launcher:
 
 * An [installed background service](/docs/en/agent-view#the-supervisor-process) whose unit was written before the launcher was configured: `launchd` or `systemd` starts that process from its unit file. `/status` and `claude daemon status` warn while the running service and the configured launcher don't match, and the sessions the service spawns still start through the launcher once the service restarts with the variable in its settings.
-* A session you start yourself in a terminal, which runs however you invoked it. To cover these sessions, put a script named `claude` in a directory earlier on `PATH` that runs your launcher with the real binary; don't replace the managed symlink. Self-spawns don't consult `PATH`, so the two launchers never stack.
+* A session you start yourself in a terminal, which runs however you invoked it. To cover these sessions, put a script named `claude` in a directory earlier on `PATH` that runs your launcher with the real binary; don't replace the managed symlink. The background service and its sessions start without a `PATH` lookup, so the two launchers don't stack there.
 * The first process of a `claude-cli://` deep link, which the operating system's protocol handler starts directly. Everything that session starts in the background afterward runs through the launcher. To close this path entirely, [prevent handler registration](/docs/en/deep-links#registration-and-supported-platforms) with the `disableDeepLinkRegistration` setting.
 * The relaunch that `--worktree` combined with `--tmux` performs: the terminal multiplexer starts that pane, not Claude Code's binary.
 * The native-messaging host that [Claude in Chrome](/docs/en/chrome) registers: the browser starts it, not Claude Code's binary.
diff --git a/content/en/docs/claude-code/desktop-changelog.md b/content/en/docs/claude-code/desktop-changelog.md
index ca2a3c3e99..dabc47413d 100644
--- a/content/en/docs/claude-code/desktop-changelog.md
+++ b/content/en/docs/claude-code/desktop-changelog.md
@@ -206,15 +206,15 @@ Right-click any file path in the chat, diff viewer, or file pane to open a conte
 
 ### Switch view modes
 
-View modes control how much detail appears in the chat transcript. Switch modes from the **Transcript view** dropdown next to the send button, or press **Ctrl+O** on macOS or Windows to cycle through them.
+View modes control how much detail appears in the chat transcript. Switch modes from the **Transcript view** dropdown next to the send button, or press **Ctrl+O** on macOS or Windows to cycle through them. The Thinking mode appears in the dropdown only after Claude has produced thinking in the session you're viewing.
 
-| Mode        | What it shows                                                  |
-| ----------- | -------------------------------------------------------------- |
-| **Normal**  | Tool calls collapsed into summaries, with full text responses  |
-| **Verbose** | Every tool call, file read, and intermediate step Claude takes |
-| **Summary** | Only Claude's final responses and the changes it made          |
+| Mode         | What it shows                                                                          |
+| ------------ | -------------------------------------------------------------------------------------- |
+| **Normal**   | Tool calls collapsed into summaries, with full text responses                          |
+| **Thinking** | Tool calls collapsed into summaries, plus Claude's thinking                            |
+| **Verbose**  | Every tool call, file read, and intermediate step Claude takes, plus Claude's thinking |
 
-Use Verbose when debugging why Claude took a particular action. Use Summary when you're running multiple sessions and want to scan results quickly.
+Use Thinking to follow Claude's reasoning with tool calls still collapsed. Use Verbose when debugging why Claude took a particular action. Claude Desktop versions before 1.46388.1 also list a Summary mode, and a session still set to Summary opens in Normal once you update.
 
 ### Keyboard shortcuts
 
diff --git a/content/en/docs/claude-code/desktop.md b/content/en/docs/claude-code/desktop.md
index ca2a3c3e99..dabc47413d 100644
--- a/content/en/docs/claude-code/desktop.md
+++ b/content/en/docs/claude-code/desktop.md
@@ -206,15 +206,15 @@ Right-click any file path in the chat, diff viewer, or file pane to open a conte
 
 ### Switch view modes
 
-View modes control how much detail appears in the chat transcript. Switch modes from the **Transcript view** dropdown next to the send button, or press **Ctrl+O** on macOS or Windows to cycle through them.
+View modes control how much detail appears in the chat transcript. Switch modes from the **Transcript view** dropdown next to the send button, or press **Ctrl+O** on macOS or Windows to cycle through them. The Thinking mode appears in the dropdown only after Claude has produced thinking in the session you're viewing.
 
-| Mode        | What it shows                                                  |
-| ----------- | -------------------------------------------------------------- |
-| **Normal**  | Tool calls collapsed into summaries, with full text responses  |
-| **Verbose** | Every tool call, file read, and intermediate step Claude takes |
-| **Summary** | Only Claude's final responses and the changes it made          |
+| Mode         | What it shows                                                                          |
+| ------------ | -------------------------------------------------------------------------------------- |
+| **Normal**   | Tool calls collapsed into summaries, with full text responses                          |
+| **Thinking** | Tool calls collapsed into summaries, plus Claude's thinking                            |
+| **Verbose**  | Every tool call, file read, and intermediate step Claude takes, plus Claude's thinking |
 
-Use Verbose when debugging why Claude took a particular action. Use Summary when you're running multiple sessions and want to scan results quickly.
+Use Thinking to follow Claude's reasoning with tool calls still collapsed. Use Verbose when debugging why Claude took a particular action. Claude Desktop versions before 1.46388.1 also list a Summary mode, and a session still set to Summary opens in Normal once you update.
 
 ### Keyboard shortcuts
 
diff --git a/content/en/docs/claude-code/env-vars.md b/content/en/docs/claude-code/env-vars.md
index adb1dad4d5..a919fcaf96 100644
--- a/content/en/docs/claude-code/env-vars.md
+++ b/content/en/docs/claude-code/env-vars.md
@@ -213,7 +213,7 @@ Numeric variables such as timeouts, token budgets, and retry counts accept scien
 | `CLAUDE_CODE_AUTO_BACKGROUND_WORKER_CHECKIN_SECONDS`    | When `CLAUDE_AUTO_BACKGROUND_TASKS` is enabled, seconds between reminders to Claude to check on [background subagents](/docs/en/sub-agents#run-subagents-in-foreground-or-background) that are still running. Accepts a plain integer from `1` to `86400` only; any other value or spelling reads as unset. When unset, there are no check-in reminders. Requires Claude Code v2.1.248 or later                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
 | `CLAUDE_CODE_AUTO_COMPACT_WINDOW`                       | Set the [auto-compact window](/docs/en/model-config#set-the-auto-compact-window) in tokens, from `100000` to `1000000`. Accepts a plain integer such as `500000` only: a value like `500k` reads as `500` and clamps to the 100K minimum. The effective window is also capped at the model's context window. Takes precedence over the `/autocompact` command, the `--autocompact` flag, and the `autoCompactWindow` setting. The status line's `used_percentage` always measures against the model's full context window, so once this variable is set, that percentage no longer indicates when compaction will run                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
 | `CLAUDE_CODE_AUTO_CONNECT_IDE`                          | Override automatic [IDE connection](/docs/en/vs-code). By default, Claude Code connects automatically when launched inside a supported IDE's integrated terminal. Set to `false` to prevent this. Set to `true` to force a connection attempt when auto-detection fails, such as when tmux obscures the parent terminal. Takes precedence over the [`autoConnectIde`](/docs/en/settings-reference#autoconnectide) global config setting                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| `CLAUDE_CODE_AUTO_MODE_SERVER`                          | On Amazon Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry, set to `1` to have the platform's server-side classifier review [auto mode](/docs/en/permission-modes#eliminate-prompts-with-auto-mode) actions; where the platform doesn't run the classifier, Claude Code falls back to its own classifier requests. When unset or `0`, the classifier runs through requests that Claude Code itself sends. Has no effect on other providers, including the Anthropic API. Requires Claude Code v2.1.271 or later                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| `CLAUDE_CODE_AUTO_MODE_SERVER`                          | Controls whether Claude Code asks the server to [review auto mode actions](/docs/en/permission-modes#server-side-classifier-review). When unset, Claude Code asks the server on Amazon Bedrock, Google Cloud's Agent Platform, Microsoft Foundry, and Claude Platform on AWS, and when you point `ANTHROPIC_BASE_URL` at an LLM gateway or proxy. Set to `0` to use Claude Code's own classifier requests instead. Not read on a direct connection to the Anthropic API. Requires Claude Code v2.1.271 or later; asking the server by default requires v2.1.278 or later                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
 | `CLAUDE_CODE_AWS_CHAIN_RESOLVE_TIMEOUT_MS`              | Time in milliseconds Claude Code waits for the AWS default credential provider chain to produce credentials before the request fails with [`AWS default-chain credential resolve timed out`](/docs/en/errors#aws-default-chain-credential-resolve-timed-out) (default: `60000`). Raise it when a step in your chain legitimately needs longer, such as a browser-based SSO sign-in with MFA through a wrapper like `aws-vault`. Applies wherever Claude Code signs with the default chain: [Amazon Bedrock](/docs/en/amazon-bedrock#credential-caching-and-resolution-timeout), [Claude Platform on AWS](/docs/en/claude-platform-on-aws), and the [Mantle endpoint](/docs/en/amazon-bedrock#use-the-mantle-endpoint). Requires Claude Code v2.1.207 or later                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
 | `CLAUDE_CODE_BASH_EDIT_DIFF`                            | Set to `0` to turn off the [diff of the files a Bash command changed](/docs/en/hooks#bash), or `1` to record it in every permission mode. Takes precedence over the [`bashEditDiffEnabled`](/docs/en/settings-reference#basheditdiffenabled) setting. Requires Claude Code v2.1.269 or later                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
 | `CLAUDE_CODE_BG_TASKS_REPORT_RUNNING`                   | Set to `0` to make a non-interactive session report an idle status to its host at every turn end, even while background work is still running. By default, the session keeps reporting a running status past turn end while background work such as a background agent or a [workflow](/docs/en/workflows) run is still live. This keeps a host that watches the status, such as a remote session list, from announcing that Claude is waiting for your input mid-work. Background shell commands, such as a dev server, don't hold the running status. The running-status default and the `0` opt-out require Claude Code v2.1.269 or later; on earlier versions, set `1` to hold the running status                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
@@ -509,6 +509,7 @@ Claude Code turns some features on through feature flags it fetches from Anthrop
 
 With fetching off, you can't:
 
+* Have Claude Code [read `AGENTS.md` files](/docs/en/memory#agents-md) as project instructions; it loads `CLAUDE.md` files only
 * [Start sessions in auto mode by default](/docs/en/permission-modes#which-mode-a-session-starts-in) on Pro, Max, and Team plans
 * Have the VS Code extension [read settings files for the starting permission mode](/docs/en/permission-modes#switch-permission-modes)
 * Run [`/auto-mode-setup`](/docs/en/auto-mode-config#generate-environment-entries) to draft `autoMode.environment` entries
diff --git a/content/en/docs/claude-code/errors.md b/content/en/docs/claude-code/errors.md
index 510a2082aa..bca747be45 100644
--- a/content/en/docs/claude-code/errors.md
+++ b/content/en/docs/claude-code/errors.md
@@ -230,6 +230,7 @@ Match the message you see to a section below.
 | `Refusing to send: connected endpoint is a different process with the expected pid`                                                                                                                                                                                  | [Tool errors](#refusing-to-send-a-cross-session-message)                                                                      |
 | `Refusing to read <path>: its symlink resolution changed after permission was checked (<reason>)` / `Refusing to search <path>: its symlink resolution changed after permission was checked`                                                                         | [Tool errors](#refusing-after-a-symlink-changed)                                                                              |
 | `Refusing to write <path>: its parent-directory symlink resolution changed after permission was checked` / `Refusing to write <path>: it is a symbolic link. Write to the link's target path instead`                                                                | [Tool errors](#refusing-after-a-symlink-changed)                                                                              |
+| `Refusing to write through symlink: <path>` / `Refusing to write into symlinked directory: <path>`                                                                                                                                                                   | [Tool errors](#refusing-after-a-symlink-changed)                                                                              |
 | `Refusing to search <path>: a path one of its Read deny rules is written through changed while the search was being prepared` / `Refusing to search <path>: it could not be opened`                                                                                  | [Tool errors](#refusing-after-a-symlink-changed)                                                                              |
 | `its permission check expired before it ran (too many concurrent file operations)` / `ripgrep was found only by name on PATH`                                                                                                                                        | [Tool errors](#refusing-after-a-symlink-changed)                                                                              |
 | `task output swap refused (tasks dir moved or linked)`                                                                                                                                                                                                               | [Tool errors](#task-output-swap-refused)                                                                                      |
@@ -1623,6 +1624,8 @@ This is not a client-side network problem. Cloud sessions and [routines](/docs/e
 
 **What to do:**
 
+These steps change one of your own environments. An [organization-shared environment](/docs/en/cloud-environments#organization-shared-environments) opens read-only in the selector, so ask an Owner to change its network access from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings).
+
 * Open the routine for editing, or start a cloud session. Select the cloud icon showing your environment's name, such as **Default**, to open the selector. Hover over your environment and click the settings icon.
 * In the **Update cloud environment** dialog, change **Network access** from **Trusted** to **Custom**, then add the blocked domain to **Allowed domains**. Enter one domain per line. Check **Also include default list of common package managers** to keep the [default allowlist](/docs/en/cloud-environments#default-allowed-domains) alongside your custom domains. Select **Full** instead if you want unrestricted access.
 * Click **Save changes**. The next run uses the updated allowlist.
@@ -3408,11 +3411,13 @@ Claude Code checks a file path's [permission rules](/docs/en/permissions#read-an
 Refusing to read /path/to/file: its symlink resolution changed after permission was checked (a link on the way now leads somewhere the check did not see). If a link in the working directory is being rewritten concurrently, stop that and retry.
 ```
 
-The text after the path names the reason:
+Each refusal names its reason:
 
 * `its symlink resolution changed after permission was checked`: a symlink along the path, or at a Grep or Glob search root, was replaced between the permission check and the operation. In a read refusal, the parenthesized phrase names which comparison failed.
 * `its parent-directory symlink resolution changed after permission was checked`: a directory the write path passes through no longer resolves to the approved location
-* `it is a symbolic link. Write to the link's target path instead`: a symbolic link sits at the approved write location itself
+* `it is a symbolic link. Write to the link's target path instead`: a symbolic link sits at the approved write location itself, for example a `CLAUDE.md` that is a symlink to `AGENTS.md`; the message directs Claude to the link's target
+* `Refusing to write through symlink: <path>. Resolve the symlink and pass the real target path explicitly.`: the same condition caught when another writer opens the file, such as a write to a symlinked `.mcp.json`
+* `Refusing to write into symlinked directory: <path>`: the directory that holds the file is itself a symbolic link, for example a project's `.claude/` directory linked to another location
 * `a path one of its Read deny rules is written through changed while the search was being prepared. Retry.`: a `Read` deny rule for the search names a path that passes through a symlink, and that link changed while Claude Code was preparing the search
 * `it could not be opened (EACCES) — it is unreadable, or is being replaced concurrently.`: the search root exists but couldn't be opened; the parenthesized code is the operating system error
 * `its permission check expired before it ran (too many concurrent file operations). Retry.`: Claude Code evicted the approval record under many simultaneous file operations before the tool used it; retrying runs a fresh permission check
@@ -3426,7 +3431,7 @@ The text after the path names the reason:
 * If a read refusal appears on macOS for a file that nothing is rewriting, such as a screenshot dragged into the prompt, upgrade to v2.1.273 or later
 * For the ripgrep refusal, install ripgrep with your package manager so `rg` resolves to an absolute path on `PATH`, or keep searches under the working directory
 
-Before v2.1.251, Claude Code re-checked a path's resolution only for file writes, so a link replaced after the permission check could redirect a read or search to a different location without a message. Of these refusals, only the parent-directory write refusal appears on earlier versions.
+Before v2.1.251, Claude Code re-checked a path's resolution only for file writes, so a link replaced after the permission check could redirect a read or search to a different location without a message. Of these, only the parent-directory, through-symlink, and symlinked-directory write refusals appear on earlier versions.
 
 <h3 id="task-output-swap-refused">
   Task output swap refused
diff --git a/content/en/docs/claude-code/feature-availability.md b/content/en/docs/claude-code/feature-availability.md
index 4dc3adc621..84421188a8 100644
--- a/content/en/docs/claude-code/feature-availability.md
+++ b/content/en/docs/claude-code/feature-availability.md
@@ -32,8 +32,9 @@ These work on every provider:
 * [Checkpoints](/docs/en/checkpointing), [sandboxing](/docs/en/sandboxing), and [Workflows](/docs/en/workflows)
 * [OpenTelemetry metrics](/docs/en/monitoring-usage) and the [managed settings file](/docs/en/managed-settings#delivery-mechanisms)
 
-Three of these have provider-specific differences:
+These have provider-specific differences:
 
+* **CLAUDE.md memory**: `CLAUDE.md` files load on every provider. Reading [`AGENTS.md` files](/docs/en/memory#agents-md) as project instructions also requires a session that [fetches feature flags](/docs/en/env-vars#features-that-need-feature-flag-fetching)
 * **MCP servers**: [connectors from claude.ai](/docs/en/mcp#use-mcp-servers-from-claude-ai) load only when your claude.ai subscription is the active authentication method. [Tool search](/docs/en/mcp#configure-tool-search) is off by default when `ANTHROPIC_BASE_URL` points to a non-first-party host, and isn't supported on Google Cloud's Agent Platform models earlier than the Claude 4.5 generation or on Microsoft Foundry [deployments hosted on Azure](https://platform.claude.com/docs/en/build-with-claude/claude-in-microsoft-foundry#hosting-options)
 * **Subagents**: the built-in [Explore subagent](/docs/en/sub-agents#built-in-subagents) caps its inherited model at Opus on the Claude API, and inherits the main conversation's model directly on any other provider, including Claude Platform on AWS
 * **[Commands](/docs/en/commands#all-commands)**:
@@ -216,6 +217,8 @@ Organization-level controls and usage visibility.
 
 <Note>
   If you authenticate through an [LLM gateway](/docs/en/llm-gateway), feature availability matches the underlying provider the gateway forwards to, except for the features Claude Code itself turns off. Whenever `ANTHROPIC_BASE_URL` points at a host other than `api.anthropic.com`, Claude Code turns off features such as [Remote Control](/docs/en/remote-control#requirements) and [server-managed settings](/docs/en/server-managed-settings#platform-availability), whatever the gateway forwards. Some Anthropic-only features such as the [Advisor](/docs/en/advisor) work only if the gateway forwards requests intact to the Anthropic API.
+
+  For how the requests Claude Code sends differ between an Amazon Bedrock- or Agent Platform-format gateway, an `ANTHROPIC_BASE_URL` gateway, and a Claude apps gateway sign-in, see [client behavior by connection method](/docs/en/llm-gateway-protocol#how-the-connection-method-changes-client-behavior).
 </Note>
 
 ### Summary by provider
diff --git a/content/en/docs/claude-code/glossary.md b/content/en/docs/claude-code/glossary.md
index e1bba56734..3315078360 100644
--- a/content/en/docs/claude-code/glossary.md
+++ b/content/en/docs/claude-code/glossary.md
@@ -10,6 +10,12 @@ This glossary defines Claude Code terminology. Each entry links to the page wher
 
 ## A
 
+### AGENTS.md
+
+A markdown file of project instructions you write for AI coding agents. If your repository has one and no [CLAUDE.md](#claude-md), Claude reads it as your project instructions without you adding a second file. You can change the **Project instructions** setting in `/config` to have Claude read both files or only `CLAUDE.md`. Reading `AGENTS.md` directly requires Claude Code v2.1.277 or later in a session that fetches feature flags; on other versions, import it from a CLAUDE.md.
+
+Learn more: [AGENTS.md](/docs/en/memory#agents-md)
+
 ### Agent teams
 
 Multiple independent Claude Code sessions coordinated by a team lead, with a shared task list and peer-to-peer messaging. Unlike [subagents](#subagent), which run within a single session and report only to the parent, teammates each have their own context window and you can interact with any of them directly. Agent teams are experimental and disabled by default; see [Enable agent teams](/docs/en/agent-teams#enable-agent-teams).
@@ -90,7 +96,7 @@ Learn more: [The `.claude` directory](/docs/en/claude-directory)
 
 A markdown file of persistent instructions you write for Claude, loaded at the start of every session as a user message after the system prompt. Put project conventions, architecture notes, and "always do X" rules here. Project-root CLAUDE.md survives [compaction](#compaction) and is re-read fresh from disk afterward.
 
-You can place CLAUDE.md at project scope in `./CLAUDE.md` or `./.claude/CLAUDE.md`, at user scope in `~/.claude/CLAUDE.md`, or as [managed policy](#managed-settings) for your organization. All discovered files are concatenated into context rather than overriding each other, ordered from broadest scope to most specific.
+You can place CLAUDE.md at project scope in `./CLAUDE.md` or `./.claude/CLAUDE.md`, at user scope in `~/.claude/CLAUDE.md`, or as [managed policy](#managed-settings) for your organization. All discovered files are concatenated into context rather than overriding each other, ordered from broadest scope to most specific. Claude Code can also load a project's [AGENTS.md](#agents-md) files, on their own or alongside CLAUDE.md.
 
 Learn more: [CLAUDE.md files](/docs/en/memory#claude-md-files)
 
diff --git a/content/en/docs/claude-code/headless.md b/content/en/docs/claude-code/headless.md
index 3212ef1106..b5df24c5c6 100644
--- a/content/en/docs/claude-code/headless.md
+++ b/content/en/docs/claude-code/headless.md
@@ -314,7 +314,7 @@ The `--allowedTools` flag uses [permission rule syntax](/docs/en/settings-refere
   * User-invoked [skills](/docs/en/skills) and custom commands work. Include `/skill-name` in the prompt string and Claude Code expands it before running.
   * Built-in commands that only run in the terminal interface, such as `/login`, aren't available.
   * `/model`, `/effort`, `/fast`, `/color`, and `/rename` accept the value as an argument, for example `/model sonnet`, and `/mcp` with no argument prints a text summary of server status. These forms require Claude Code v2.1.205 or later and follow each command's [availability notes](/docs/en/commands#all-commands).
-  * To change a setting, pass `key=value` to `/config`, for example `/config thinking=false`. Requires Claude Code v2.1.181 or later.
+  * To change a setting, pass `key=value` to `/config`, for example `/config thinking=false`.
   * `/output-style <style>` switches [output styles](/docs/en/output-styles) and `/output-style` alone lists them. Requires Claude Code v2.1.269 or later.
 </Note>
 
diff --git a/content/en/docs/claude-code/hooks.md b/content/en/docs/claude-code/hooks.md
index 9e05fdb60a..218bd957d9 100644
--- a/content/en/docs/claude-code/hooks.md
+++ b/content/en/docs/claude-code/hooks.md
@@ -938,7 +938,11 @@ Exit codes only let you block or stay silent, but JSON output gives you finer-gr
 
 Your hook's stdout must contain only the JSON object. If your shell profile prints text on startup, it can interfere with JSON parsing. See [Hook JSON has no effect](/docs/en/hooks-guide#hook-json-has-no-effect) in the troubleshooting guide.
 
-Hook output strings, including `additionalContext`, `systemMessage`, and plain stdout, are capped at 10,000 characters. Output that exceeds this limit is saved to a file and replaced with a preview and file path, the same way a large valid Bash result is handled under [Output limits](/docs/en/tools-reference#output-limits).
+A hook's `additionalContext`, `systemMessage`, and `initialUserMessage` strings, and its plain stdout, are capped at 10,000 characters:
+
+* **Scope**: Claude Code measures each string on its own, even when several hooks run for the same event. For JSON output, each field is measured separately; plain stdout is measured whole.
+* **Over the limit**: Claude Code saves the output to a file in the session directory and replaces it with the file path and a preview of up to the first 2,000 characters. A large valid Bash result is handled the same way, described under [Output limits](/docs/en/tools-reference#output-limits). Unlike that Bash ceiling, this cap has no setting or environment variable to raise it.
+* **Reading the file**: Claude Code doesn't ask Claude to read the file, so keep anything Claude must always see within the cap.
 
 The JSON object supports three kinds of fields:
 
@@ -1020,7 +1024,7 @@ Where the reminder appears depends on the event:
 
 When several hooks return `additionalContext` for the same event, Claude receives all of the values.
 
-If a value exceeds 10,000 characters, Claude Code writes the text to a file in the session directory and passes Claude the file path with a short preview instead.
+If a value exceeds 10,000 characters, Claude Code writes the text to a file in the session directory and passes Claude the file path with a preview of up to the first 2,000 characters instead. Claude can read the file, but Claude Code doesn't ask it to.
 
 Use `additionalContext` for information Claude should know about the current state of your environment or the operation that just ran:
 
@@ -1301,6 +1305,8 @@ Setup hooks have access to `CLAUDE_ENV_FILE`. Variables written to that file per
 
 Fires when a `CLAUDE.md` or `.claude/rules/*.md` file is loaded into context. This event fires at session start for eagerly-loaded files and again later when files are lazily loaded, for example when Claude accesses a subdirectory that contains a nested `CLAUDE.md` or when conditional rules with `paths:` frontmatter match. The hook doesn't support blocking or decision control. It runs asynchronously for observability purposes.
 
+This event doesn't fire when Claude [reads `AGENTS.md` directly](/docs/en/memory#agents-md) through the **Project instructions** setting. It does fire when a `CLAUDE.md` imports your `AGENTS.md`, with `load_reason` set to `include` as for any other imported file, and when `CLAUDE.md` is a symlink to it, as a normal `CLAUDE.md` load.
+
 The matcher runs against `load_reason`. For example, use `"matcher": "session_start"` to fire only for files loaded at session start, or `"matcher": "path_glob_match|nested_traversal"` to fire only for lazy loads.
 
 #### InstructionsLoaded input
diff --git a/content/en/docs/claude-code/how-claude-code-works.md b/content/en/docs/claude-code/how-claude-code-works.md
index b5594dcb31..b1b6deb2a7 100644
--- a/content/en/docs/claude-code/how-claude-code-works.md
+++ b/content/en/docs/claude-code/how-claude-code-works.md
@@ -68,7 +68,7 @@ When you run `claude` in a directory, Claude Code gains access to:
 * **Your project.** Files in your directory and subdirectories, plus files elsewhere with your permission.
 * **Your terminal.** Any command you could run: build tools, git, package managers, system utilities, scripts. If you can do it from the command line, Claude can too.
 * **Your git state.** Current branch, uncommitted changes, and recent commit history.
-* **Your [CLAUDE.md](/docs/en/memory).** A markdown file where you store project-specific instructions, conventions, and context that Claude should know every session.
+* **Your [CLAUDE.md](/docs/en/memory).** A markdown file where you store project-specific instructions, conventions, and context that Claude should know every session. If your repository has an AGENTS.md for other coding agents, Claude [can read that](/docs/en/memory#agents-md) on its own or alongside CLAUDE.md.
 * **[Auto memory](/docs/en/memory#auto-memory).** Learnings Claude saves automatically as you work, like your preferences. The first 200 lines or 25KB of MEMORY.md, whichever comes first, load at the start of each session.
 * **Extensions you configure.** [MCP servers](/docs/en/mcp) for external services, [skills](/docs/en/skills) for workflows, [subagents](/docs/en/sub-agents) for delegated work, and [Claude in Chrome](/docs/en/chrome) for browser interaction.
 
diff --git a/content/en/docs/claude-code/llm-gateway-protocol.md b/content/en/docs/claude-code/llm-gateway-protocol.md
index 6e04ea120e..f8ad9812d3 100644
--- a/content/en/docs/claude-code/llm-gateway-protocol.md
+++ b/content/en/docs/claude-code/llm-gateway-protocol.md
@@ -18,7 +18,9 @@ The [Claude apps gateway](/docs/en/claude-apps-gateway), Anthropic's self-hosted
 This page covers:
 
 * [API formats](#api-formats) and the endpoints to serve for each
+* [Client behavior by connection method](#how-the-connection-method-changes-client-behavior): how model IDs, `anthropic-beta` values, request fields, and defaults differ between the formats and a Claude apps gateway sign-in
 * [Request headers](#request-headers): which must reach the upstream and which your gateway can consume
+* [Response headers](#response-headers): what to return so stall detection, retries, and usage limit display work
 * The [system prompt attribution block](#system-prompt-attribution-block) and how it interacts with prompt caching
 * [Feature pass-through](#feature-pass-through): what breaks when headers or body fields are stripped
 * [Model discovery](#model-discovery)
@@ -76,6 +78,37 @@ Which format the client speaks determines what your gateway receives. The common
 
 Bridging that difference is your gateway's job. [Feature pass-through](#feature-pass-through) describes what breaks when it doesn't.
 
+If your upstream is Amazon Bedrock or Google Cloud's Agent Platform, you can avoid the bridging by exposing that provider's format instead. [Route to a cloud provider through a gateway](/docs/en/llm-gateway-connect#route-to-a-cloud-provider-through-a-gateway) shows the client configuration for that format.
+
+## How the connection method changes client behavior
+
+The way a developer connects to your gateway determines which model IDs, `anthropic-beta` values, and request fields Claude Code sends, and which defaults it applies. Your gateway sees one of three client behaviors:
+
+* **Amazon Bedrock or Agent Platform format**: the developer sets `CLAUDE_CODE_USE_BEDROCK=1` with `ANTHROPIC_BEDROCK_BASE_URL`, or `CLAUDE_CODE_USE_VERTEX=1` with `ANTHROPIC_VERTEX_BASE_URL`, pointing at your gateway. Claude Code uses that provider's model IDs, request fields, and defaults.
+* **Anthropic Messages format**: the developer sets `ANTHROPIC_BASE_URL` to your gateway. Claude Code treats the gateway as the Claude API and can't tell which upstream you forward to.
+* **Claude apps gateway sign-in**: the developer signs in to a [Claude apps gateway](/docs/en/claude-apps-gateway). That gateway speaks the Anthropic Messages format but can route to any upstream, so Claude Code sends only the `anthropic-beta` values and model-capability assumptions that Amazon Bedrock and Agent Platform also accept.
+
+### Requests and defaults by connection method
+
+The table below compares the three connection methods, one behavior per row. It leaves out Microsoft Foundry and Claude Platform on AWS, which also use the Anthropic Messages format but which Claude Code reaches through their own variables. For those, see the [Microsoft Foundry](/docs/en/microsoft-foundry) and [Claude Platform on AWS](/docs/en/claude-platform-on-aws) pages.
+
+| Behavior                                                                                                       | Amazon Bedrock or Agent Platform format                                                                                                                                                                           | Anthropic Messages format                                                                                                                                                              | Claude apps gateway sign-in                                                                                            |
+| :------------------------------------------------------------------------------------------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :--------------------------------------------------------------------------------------------------------------------- |
+| Model IDs in requests by default                                                                               | The provider's form, such as `us.anthropic.claude-opus-4-8` on Amazon Bedrock                                                                                                                                     | Anthropic IDs, such as `claude-opus-4-8`                                                                                                                                               | Anthropic IDs                                                                                                          |
+| `anthropic-beta` values sent                                                                                   | The subset Amazon Bedrock and Agent Platform accept                                                                                                                                                               | The full set described under [feature pass-through](#feature-pass-through), unless the developer sets [`CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS`](#disable-pre-release-capabilities)    | The subset Amazon Bedrock and Agent Platform accept                                                                    |
+| Request fields for a model ID Claude Code doesn't recognize, such as a gateway alias                           | Thinking with a fixed budget rather than adaptive reasoning, and no effort or context management fields                                                                                                           | Everything current Claude models accept on the Claude API, including adaptive reasoning, effort, and context management, which an Amazon Bedrock or Agent Platform upstream can reject | Same as the Amazon Bedrock or Agent Platform format                                                                    |
+| One-hour [prompt cache TTL](/docs/en/prompt-caching#choose-the-ttl-yourself) when a developer opts in               | Requested through the `ttl` field in `cache_control`, with no beta value                                                                                                                                          | Requested through the `ttl` field plus an `extended-cache-ttl` value in `anthropic-beta`, which you must forward                                                                       | See the Claude apps gateway [availability and limitations](/docs/en/claude-apps-gateway#availability-and-limitations) table |
+| Model for [background tasks](/docs/en/costs#background-token-usage) unless `ANTHROPIC_DEFAULT_HAIKU_MODEL` pins one | The default Sonnet model, or the main model once one is selected, as the [Amazon Bedrock](/docs/en/amazon-bedrock#4-pin-model-versions) and [Agent Platform](/docs/en/google-vertex-ai#5-pin-model-versions) pages describe | The main model, or the default Haiku model when `ANTHROPIC_API_KEY` or `apiKeyHelper` supplies an Anthropic Console key and `ANTHROPIC_AUTH_TOKEN` is unset                            | The main model                                                                                                         |
+
+For the features each connection supports and the telemetry it sends to Anthropic by default, see [Feature availability](/docs/en/feature-availability#availability-by-model-provider) and [Default behaviors by API provider](/docs/en/data-usage#default-behaviors-by-api-provider).
+
+### Settings for unrecognized model IDs
+
+Two client-side settings change what Claude Code assumes for a model ID it doesn't recognize, whichever connection method the developer uses:
+
+* **Context window**: Claude Code assumes 200K, or 1M when the ID carries `[1m]`. To declare the real window, see [Correct the window for a gateway or custom model ID](/docs/en/model-config#correct-the-window-for-a-gateway-or-custom-model-id)
+* **Capabilities**: to give a gateway alias the capabilities of the model behind it, map that model's Anthropic ID to your alias with a [`modelOverrides`](/docs/en/errors#unrecognized-model-id-on-a-request) entry in the settings you distribute. For where the `ANTHROPIC_DEFAULT_*_MODEL_SUPPORTED_CAPABILITIES` variables apply, see [feature pass-through](#feature-pass-through)
+
 ## Request headers
 
 Claude Code includes these headers on API requests. Header names are case-insensitive on the wire. Forward `anthropic-version` and `anthropic-beta` unchanged, plus `anthropic-workspace-id` when the upstream is the [Claude Platform on AWS](/docs/en/claude-platform-on-aws); the rest the gateway may consume for routing, attribution, and tracing, and need not forward.
@@ -101,6 +134,17 @@ When forwarding to an Anthropic-format upstream, pass `anthropic-*` request head
 
 The exception is a non-Anthropic upstream such as Amazon Bedrock or Google Cloud's Agent Platform, where bridging the schema difference is the gateway's job; see [feature pass-through](#feature-pass-through).
 
+## Response headers
+
+Claude Code reads these response headers to detect stalled streams, to decide whether and when to retry, and to show usage limits. The table lists what to return for each. Also forward error response bodies unmodified, so Claude Code's [capability-rejection recovery](#automatic-retry-and-error-forwarding) can match the upstream's error wording.
+
+| Header                          | What to return and why                                                                                                                                                                                                                                                                                                                                                |
+| :------------------------------ | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `content-type`                  | Return `text/event-stream` on streamed Anthropic Messages-format responses, and `application/vnd.amazon.eventstream`, unmodified, on Amazon Bedrock-format responses, where [a different type fails the request](/docs/en/amazon-bedrock#streaming-errors-behind-a-gateway-or-proxy). [Streaming](#streaming) lists which connections run stall detection on these streams |
+| `retry-after`                   | Return integer seconds rather than an HTTP date. Claude Code waits at least that long before the next [automatic retry](/docs/en/errors#automatic-retries), and outside [`CLAUDE_CODE_RETRY_WATCHDOG`](/docs/en/env-vars) sessions a value above 60 stops the retries and shows the error at once                                                                               |
+| `x-should-retry`                | Pass the upstream's value through unchanged. Claude Code reads this header as one input when deciding whether to retry a failed request: `true` marks the response retryable and `false` marks it not retryable. For retry counts, backoff, and which failures Claude Code retries, see [automatic retries](/docs/en/errors#automatic-retries)                             |
+| `anthropic-ratelimit-unified-*` | Forward the upstream's values unchanged on every response. Claude Code reads them on successful responses to show usage against plan limits to developers signed in with claude.ai, and on a `429` to tell a plan limit or spend cap from a temporary throttle; see [usage limits](/docs/en/errors#usage-limits)                                                           |
+
 ## System prompt attribution block
 
 Claude Code prepends a short attribution block to the system prompt containing the client version and a fingerprint derived from the conversation. The `api.anthropic.com` endpoint strips the block before processing when it arrives unchanged as the first system block, so it doesn't affect first-party prompt caching. Any other upstream receives it as part of the prompt.
diff --git a/content/en/docs/claude-code/llm-gateway-rollout.md b/content/en/docs/claude-code/llm-gateway-rollout.md
index b0e23c134e..2b63a90f2d 100644
--- a/content/en/docs/claude-code/llm-gateway-rollout.md
+++ b/content/en/docs/claude-code/llm-gateway-rollout.md
@@ -257,14 +257,26 @@ Finally, check the gateway's logs for the message you sent: the credential ident
 
 After rollout, three kinds of change reach the gateway over time. Each has a symptom to watch for and an action to take.
 
-| Change                                                                       | Symptom when the gateway hasn't kept up                                                                                                                    | Action                                                                                                                                                                                                                                                   |
-| :--------------------------------------------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| New Claude Code releases add `anthropic-beta` values and request body fields | Developers report `400` errors naming a new field after they update Claude Code; see [feature pass-through](/docs/en/llm-gateway-protocol#feature-pass-through) | Forward `anthropic-*` headers and request bodies verbatim rather than allowlisting; test new Claude Code releases against the gateway before they reach developers                                                                                       |
-| New Claude models become available                                           | Developers selecting a new model name get `404`; the `/model` picker doesn't list it                                                                       | Add the model name to the gateway's routing configuration, then re-run the [routing check](#confirm-the-gateway-routes-your-models). If you distribute `ANTHROPIC_MODEL` or the default-model variables, update the managed settings                     |
-| Credentials expire or need rotation                                          | All developer requests start failing with `401` from the upstream                                                                                          | Rotate the gateway's provider credential on its own schedule; developer keys rotate at the gateway, and an [`apiKeyHelper`](/docs/en/llm-gateway-connect#rotate-credentials-with-apikeyhelper) handles per-developer rotation without redistributing settings |
+| Change                                                                       | Symptom when the gateway hasn't kept up                                                                                                                    | Action                                                                                                                                                                                                                                                            |
+| :--------------------------------------------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| New Claude Code releases add `anthropic-beta` values and request body fields | Developers report `400` errors naming a new field after they update Claude Code; see [feature pass-through](/docs/en/llm-gateway-protocol#feature-pass-through) | Forward `anthropic-*` headers and request bodies verbatim rather than allowlisting; test new Claude Code releases against the gateway before they reach developers, checking the areas in [Plan Claude Code version upgrades](#plan-claude-code-version-upgrades) |
+| New Claude models become available                                           | Developers selecting a new model name get `404`; the `/model` picker doesn't list it                                                                       | Add the model name to the gateway's routing configuration, then re-run the [routing check](#confirm-the-gateway-routes-your-models). If you distribute `ANTHROPIC_MODEL` or the default-model variables, update the managed settings                              |
+| Credentials expire or need rotation                                          | All developer requests start failing with `401` from the upstream                                                                                          | Rotate the gateway's provider credential on its own schedule; developer keys rotate at the gateway, and an [`apiKeyHelper`](/docs/en/llm-gateway-connect#rotate-credentials-with-apikeyhelper) handles per-developer rotation without redistributing settings          |
 
 When sizing per-key rate limits, account for the client [retrying transient failures](/docs/en/errors#automatic-retries), including `429` responses, up to 10 times with backoff, honoring `Retry-After`. Keep the [compatibility guide](/docs/en/llm-gateway-protocol) as the reference for what each Claude Code release sends.
 
+### Plan Claude Code version upgrades
+
+Some Claude Code behavior is built into the installed version rather than set at your gateway, so moving developers to a new release can change behavior across your deployment even when the gateway configuration hasn't changed. To control when that happens, pin developers to a tested version with [`requiredMaximumVersion`](/docs/en/settings-reference#requiredmaximumversion), or with [`DISABLE_UPDATES`](/docs/en/setup#disable-auto-updates) if you distribute Claude Code through your own channel. Before you raise the pin, read the new release's [changelog](/docs/en/changelog) entry and [test it against the gateway](#test-claude-code-against-the-gateway).
+
+When you test a release, new headers or request fields that the gateway rejects appear as the `400` errors described in [Maintain the gateway](#maintain-the-gateway). The table below covers version-dependent changes that don't produce an error, with the setting that keeps each one constant across upgrades.
+
+| Area                         | What can change when developers upgrade                                                                                                                                                                                                                                                                                                                                                          | Setting that keeps it constant                                                                                                                                                                                                                                                                                                                             |
+| :--------------------------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Feature-flag defaults        | Sessions that [don't fetch feature flags from Anthropic](/docs/en/env-vars#features-that-need-feature-flag-fetching), such as sessions on a cloud provider or with telemetry turned off, use the flag defaults built into the installed version. When a release changes one of those defaults, the behavior changes for those developers as soon as they upgrade                                      | The version pin itself, `requiredMaximumVersion` or `DISABLE_UPDATES`                                                                                                                                                                                                                                                                                      |
+| Model capability assumptions | A model ID that the installed version doesn't recognize, such as the gateway alias `prod-opus`, runs on default assumptions for [adaptive reasoning](/docs/en/model-config#adaptive-reasoning-and-fixed-thinking-budgets), the effort parameter, and the [context window](/docs/en/model-config#correct-the-window-for-a-gateway-or-custom-model-id) until a later version recognizes the ID or you map it | Route Anthropic model IDs at the gateway, or add a [`modelOverrides`](/docs/en/model-config#override-model-ids-per-version) entry that maps the Anthropic model ID to your alias. On a cloud provider connection, you can instead [declare a pinned model's capabilities](/docs/en/model-config#customize-pinned-model-display-and-capabilities)                     |
+| Default model and aliases    | The model that new sessions start on by default, and the models that aliases such as `opus` and `sonnet` resolve to, are [built into each version](/docs/en/model-config#pin-models-for-third-party-deployments) and can change when developers upgrade                                                                                                                                               | [`ANTHROPIC_DEFAULT_MODEL`](/docs/en/model-config#set-a-default-model-for-new-sessions) for the model new sessions start on, and the [`ANTHROPIC_DEFAULT_*_MODEL` variables](/docs/en/model-config#environment-variables), such as `ANTHROPIC_DEFAULT_OPUS_MODEL`, for what each alias resolves to. `ANTHROPIC_DEFAULT_MODEL` requires Claude Code v2.1.236 or later |
+
 ## Related resources
 
 * [Connect Claude Code to an LLM gateway](/docs/en/llm-gateway-connect): the developer-facing setup steps, with per-surface configuration and a troubleshooting table you can hand to developers
diff --git a/content/en/docs/claude-code/llm-gateway.md b/content/en/docs/claude-code/llm-gateway.md
index d5d985408d..c607a9e10e 100644
--- a/content/en/docs/claude-code/llm-gateway.md
+++ b/content/en/docs/claude-code/llm-gateway.md
@@ -26,7 +26,7 @@ A gateway gives your organization one place to manage:
 * **Audit logging**: log every model request for compliance
 * **Provider switching**: change the provider in gateway configuration, without touching developer machines
 
-All of these except provider switching apply whether the upstream is Anthropic's API or a [cloud provider](/docs/en/third-party-integrations). Provider switching without reconfiguring developer machines also depends on the gateway exposing a single [Anthropic-format endpoint](/docs/en/llm-gateway-protocol#api-formats) regardless of upstream; a gateway that exposes a provider's own format ties the client configuration to that provider.
+All of these except provider switching apply whether the upstream is Anthropic's API or a [cloud provider](/docs/en/third-party-integrations). Provider switching without reconfiguring developer machines also depends on the gateway exposing a single [Anthropic-format endpoint](/docs/en/llm-gateway-protocol#api-formats) regardless of upstream. A gateway that exposes a provider's own format ties the client configuration to that provider and changes [what Claude Code sends and which defaults it applies](/docs/en/llm-gateway-protocol#how-the-connection-method-changes-client-behavior).
 
 The tradeoff is that the gateway becomes infrastructure your organization operates. Claude Code adds capabilities with each release, and a gateway that doesn't forward them breaks the corresponding features, so the gateway product needs to be kept updated as Claude Code evolves. The [gateway compatibility guide](/docs/en/llm-gateway-protocol) covers what to forward.
 
diff --git a/content/en/docs/claude-code/memory.md b/content/en/docs/claude-code/memory.md
index f08a210adb..1cc2122be7 100644
--- a/content/en/docs/claude-code/memory.md
+++ b/content/en/docs/claude-code/memory.md
@@ -4,16 +4,17 @@
 
 # How Claude remembers your project
 
-> Give Claude persistent instructions with CLAUDE.md files, and let Claude accumulate learnings automatically with auto memory.
+> Give Claude persistent instructions with CLAUDE.md or AGENTS.md files, and let Claude accumulate learnings automatically with auto memory.
 
 Each Claude Code session begins with a fresh context window. Two mechanisms carry knowledge across sessions:
 
-* **CLAUDE.md files**: instructions you write to give Claude persistent context
+* **CLAUDE.md files**: instructions you write to give Claude persistent context. Claude can also read a repository's [`AGENTS.md` files](#agents-md), on their own or alongside CLAUDE.md
 * **Auto memory**: notes Claude writes itself based on your corrections and preferences
 
 This page covers how to:
 
 * [Write and organize CLAUDE.md files](#claude-md-files)
+* [Use an existing AGENTS.md](#agents-md) as your project instructions, on its own or alongside CLAUDE.md
 * [Scope rules to specific file types](#organize-rules-with-claude/rules/) with `.claude/rules/`
 * [Configure auto memory](#auto-memory) so Claude takes notes automatically
 * [Troubleshoot](#troubleshoot-memory-issues) when instructions aren't being followed
@@ -36,7 +37,7 @@ Subagents can also maintain their own auto memory. See [subagent configuration](
 
 ## CLAUDE.md files
 
-CLAUDE.md files are markdown files that give Claude persistent instructions for a project, your personal workflow, or your entire organization. You write these files in plain text; Claude reads them at the start of every session.
+CLAUDE.md files are markdown files that give Claude persistent instructions for a project, your personal workflow, or your entire organization. You write these files in plain text; Claude reads them at the start of every session. If your repository uses `AGENTS.md` instead, see [AGENTS.md](#agents-md).
 
 ### When to add to CLAUDE.md
 
@@ -57,7 +58,7 @@ CLAUDE.md files can live in several locations, each with a different scope. The
 | ------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- | -------------------------------------------------------------------- | ------------------------------- |
 | **Managed policy**       | • macOS: `/Library/Application Support/ClaudeCode/CLAUDE.md`<br />• Linux and WSL: `/etc/claude-code/CLAUDE.md`<br />• Windows: `C:\Program Files\ClaudeCode\CLAUDE.md` | Organization-wide instructions managed by IT/DevOps        | Company coding standards, security policies, compliance requirements | All users in organization       |
 | **User instructions**    | `~/.claude/CLAUDE.md`                                                                                                                                                   | Personal preferences for all projects                      | Code styling preferences, personal tooling shortcuts                 | Just you (all projects)         |
-| **Project instructions** | `./CLAUDE.md` or `./.claude/CLAUDE.md`                                                                                                                                  | Team-shared instructions for the project                   | Project architecture, coding standards, common workflows             | Team members via source control |
+| **Project instructions** | `./CLAUDE.md` or `./.claude/CLAUDE.md`. See [AGENTS.md](#agents-md) for when `./AGENTS.md` loads instead of or alongside them                                           | Team-shared instructions for the project                   | Project architecture, coding standards, common workflows             | Team members via source control |
 | **Local instructions**   | `./CLAUDE.local.md`                                                                                                                                                     | Personal project-specific preferences; add to `.gitignore` | Your sandbox URLs, preferred test data                               | Just you (current project)      |
 
 CLAUDE.md and CLAUDE.local.md files in the directory hierarchy above the working directory are loaded at launch. Files in subdirectories load on demand when Claude reads files in those directories. See [How CLAUDE.md files load](#how-claude-md-files-load) for the full resolution order.
@@ -124,32 +125,6 @@ If you work across multiple git worktrees of the same repository, a gitignored `
   In Cowork sessions on your desktop, Claude Code skips any import in a user-scope file that resolves to a path outside the session's working directory and loads the rest of the file. In those sessions it also skips a `~/.claude/CLAUDE.md` that is itself a symlink or hard link, and a symlinked `~/.claude/rules/` directory or rule file that points outside the working directory.
 </Warning>
 
-### AGENTS.md
-
-Claude Code reads `CLAUDE.md`, not `AGENTS.md`. If your repository already uses `AGENTS.md` for other coding agents, create a `CLAUDE.md` that imports it so both tools read the same instructions without duplicating them. You can also add Claude-specific instructions below the import. Claude loads the imported file at session start, then appends the rest:
-
-```markdown CLAUDE.md theme={null}
-@AGENTS.md
-
-## Claude Code
-
-Use plan mode for changes under `src/billing/`.
-```
-
-A symlink also works if you don't need to add Claude-specific content:
-
-```bash theme={null}
-ln -s AGENTS.md CLAUDE.md
-```
-
-The command prints no output on success. In your next session, run `/context` and confirm `CLAUDE.md` appears under **Memory files**.
-
-On Windows, creating a symlink requires Administrator privileges or Developer Mode, so use the `@AGENTS.md` import instead.
-
-Running [`/init`](/docs/en/commands) reads Cursor rules, in `.cursor/rules/` or `.cursorrules`, and Copilot rules, in `.github/copilot-instructions.md`, and incorporates the relevant parts into the generated `CLAUDE.md`. With `CLAUDE_CODE_NEW_INIT=1` set, `/init` also reads `AGENTS.md`, `.devin/rules/`, `.windsurf/rules/` or `.windsurfrules`, and `.clinerules`.
-
-You can also run [`/import`](/docs/en/commands) to bring a supported coding agent's configuration into Claude Code, which appends a one-time copy of instruction files such as `AGENTS.md` to the matching `CLAUDE.md` and carries over MCP servers, commands, subagents, and skills. Requires Claude Code v2.1.213 or later.
-
 ### How CLAUDE.md files load
 
 Claude Code loads `CLAUDE.md` and `CLAUDE.local.md` from your current working directory and every directory above it. Run Claude Code in `foo/bar/` and it loads instructions from `foo/bar/CLAUDE.md`, `foo/CLAUDE.md`, and any `CLAUDE.local.md` files alongside them.
@@ -341,6 +316,131 @@ To exclude a rules file you reach through a [symlink](#share-rules-across-projec
 
 Managed policy CLAUDE.md files cannot be excluded. This ensures organization-wide instructions always apply regardless of individual settings.
 
+## AGENTS.md
+
+Claude Code can read [`AGENTS.md`](/docs/en/glossary#agents-md) as your project instructions, so a repository already set up for other coding agents works without adding a `CLAUDE.md`, an import, or a setting. This table shows what Claude reads by default for each combination of instruction files in your repository:
+
+| Your repository has                                                                           | Claude reads                                                   |
+| :-------------------------------------------------------------------------------------------- | :------------------------------------------------------------- |
+| An `AGENTS.md`, and no `CLAUDE.md` or `CLAUDE.local.md` in your working directory or above it | Your `AGENTS.md`                                               |
+| An `AGENTS.md` and a `CLAUDE.md` or `CLAUDE.local.md` in your working directory or above it   | Your `CLAUDE.md` files only                                    |
+| A `CLAUDE.md` that already [imports `AGENTS.md`](#share-one-file-with-other-coding-tools)     | Your `CLAUDE.md`, with `AGENTS.md` included through the import |
+
+To change the default, for example to have Claude always read both files, read only `CLAUDE.md`, or read only your organization's managed instructions, [change the **Project instructions** setting](#choose-which-instruction-files-load).
+
+<Note>
+  Reading `AGENTS.md` directly requires Claude Code v2.1.277 or later. In some sessions, such as those on Amazon Bedrock or with telemetry disabled, Claude [can't read `AGENTS.md`](#when-agents-md-support-is-unavailable), so [import it from a `CLAUDE.md`](#share-one-file-with-other-coding-tools) there instead.
+</Note>
+
+### When Claude Code reads AGENTS.md
+
+By default, Claude reads `AGENTS.md` only when you have no `CLAUDE.md` in your working directory or above it. Here's which of your files count for that check:
+
+* **Count, so Claude reads them instead of `AGENTS.md`**: a `CLAUDE.md`, `.claude/CLAUDE.md`, or `CLAUDE.local.md` in your working directory or any directory above it
+* **Don't count, and keep loading alongside `AGENTS.md`**: your `~/.claude/CLAUDE.md`, your organization's managed `CLAUDE.md`, and `.claude/rules/` files
+
+When none count, here's what Claude reads and how you can tell:
+
+* **At session start**: every `AGENTS.md` and `.claude/AGENTS.md` in your working directory and the directories above it. In an interactive session you see a line such as `no CLAUDE.md found; AGENTS.md loaded: /home/you/repo/AGENTS.md` in the conversation
+* **As Claude works in subdirectories**: a subdirectory's `AGENTS.md`, when Claude opens a file there with the Read tool and that subdirectory has none of the three `CLAUDE.md` files of its own
+* **Inside each `AGENTS.md`**: [`@path` imports](#import-additional-files) are expanded, [`claudeMdExcludes`](#exclude-specific-claude-md-files) patterns apply, and subagents that [skip project instructions](/docs/en/sub-agents#what-loads-at-startup) skip these files too
+* **Not read**: `AGENTS.local.md`, `AGENTS.override.md`, or anything under a `.agents/` directory
+
+<Note>
+  Because `CLAUDE.local.md` counts, adding one to keep your own uncommitted instructions in a project that relies on `AGENTS.md` stops Claude from reading `AGENTS.md` for you. To keep your `CLAUDE.local.md` and still have Claude read `AGENTS.md`, set **Project instructions** to [`claude-md-and-agents-md`](#choose-which-instruction-files-load).
+</Note>
+
+### Choose which instruction files load
+
+To change which files Claude reads, type `/config` in a Claude Code session to open the settings panel, then set **Project instructions** to one of these values:
+
+| Value                     | What Claude reads                                                                                                                                                                                                                                                                                                                                           |
+| :------------------------ | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `claude-md-or-agents-md`  | Your `CLAUDE.md` files, or your `AGENTS.md` files when you have no `CLAUDE.md` or `CLAUDE.local.md` in your working directory or above it. This is the default                                                                                                                                                                                              |
+| `claude-md-and-agents-md` | Your `CLAUDE.md` and `AGENTS.md` files together, each directory's `CLAUDE.md` files first and its `AGENTS.md` after them. Claude Code skips an `AGENTS.md` it has already loaded, so one that your `CLAUDE.md` imports or symlinks to isn't read twice                                                                                                      |
+| `claude-md`               | Your `CLAUDE.md` files only                                                                                                                                                                                                                                                                                                                                 |
+| `managed-only`            | Only your organization's managed `CLAUDE.md` and [auto memory](#auto-memory) at launch. Your project, local, and user `CLAUDE.md` files, your `.claude/rules/` files, and every `AGENTS.md` are left out. A subdirectory's `CLAUDE.md` and `.claude/rules/` files, and [path-scoped rules](#path-specific-rules), still load when Claude reads a file there |
+
+You can also set the value in a settings file instead of `/config`. Add it under the built-in `agents-md` plugin's ID in [`pluginConfigs`](/docs/en/settings-reference#pluginconfigs), in `~/.claude/settings.json`, a `--settings` file, or [managed settings](/docs/en/managed-settings). Claude Code ignores it in project and local settings files. This example has Claude read both files:
+
+```json settings.json theme={null}
+{
+  "pluginConfigs": {
+    "agents-md@builtin": {
+      "options": { "instructionFiles": "claude-md-and-agents-md" }
+    }
+  }
+}
+```
+
+Your change applies from the next message you send and in every new session.
+
+### When AGENTS.md support is unavailable
+
+In these sessions Claude reads `CLAUDE.md` files only, and **Project instructions** doesn't appear in the `/config` settings panel:
+
+* You're on a Claude Code version before v2.1.277
+* Your session doesn't [fetch feature flags from Anthropic](/docs/en/env-vars#features-that-need-feature-flag-fetching), for example because you use Amazon Bedrock or another third-party provider, or you disabled telemetry. The linked section has the full list
+* It's your [first session after you install or upgrade](/docs/en/env-vars#first-session-after-an-install-or-upgrade) to a version with `AGENTS.md` support. Claude reads `AGENTS.md` from your next session on
+* You or your organization set [`disableAllHooks`](/docs/en/settings-reference#disableallhooks) or [`allowManagedHooksOnly`](/docs/en/settings-reference#allowmanagedhooksonly), or you disabled the built-in `agents-md` plugin in `/plugin`
+
+To give Claude your `AGENTS.md` in these sessions, [import it from a `CLAUDE.md`](#share-one-file-with-other-coding-tools).
+
+### Where AGENTS.md differs from CLAUDE.md
+
+An `AGENTS.md` that Claude reads through the **Project instructions** setting differs from a `CLAUDE.md` in these places:
+
+|                                                                                                                                       | `CLAUDE.md`                                                                  | `AGENTS.md` read through the setting                                                                                                                                                      |
+| :------------------------------------------------------------------------------------------------------------------------------------ | :--------------------------------------------------------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `/memory` and the **Memory files** list in `/context`                                                                                 | Listed                                                                       | Not listed. To confirm Claude read it, look for the [`AGENTS.md loaded` line](#when-claude-code-reads-agents-md) under the default value, or ask Claude what its project instructions say |
+| [`InstructionsLoaded` hooks](/docs/en/hooks#instructionsloaded)                                                                            | Fire                                                                         | Don't fire. They fire as usual for an `AGENTS.md` that a `CLAUDE.md` imports or symlinks to                                                                                               |
+| Directories you add with `--add-dir` while [`CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD`](#load-from-additional-directories) is set | Their `CLAUDE.md` loads                                                      | Their `AGENTS.md` doesn't load                                                                                                                                                            |
+| An `@path` import of a file outside your working directory                                                                            | Claude Code asks you to approve [external imports](#import-additional-files) | Loads only if you already approved external imports for this project, with no prompt                                                                                                      |
+
+### Remove an earlier AGENTS.md workaround
+
+If you set Claude Code up to read `AGENTS.md` before it did so on its own, here's what to do with each common setup:
+
+* **A `CLAUDE.md` containing `@AGENTS.md`**: you can leave it. Keeping the import never makes Claude read `AGENTS.md` twice, whichever **Project instructions** value you use. Remove the `CLAUDE.md` if it holds nothing else, or keep it if some of your sessions [can't load `AGENTS.md` directly](#when-agents-md-support-is-unavailable).
+* **A `CLAUDE.md` that tells Claude in words to read `AGENTS.md`**: Claude sees `AGENTS.md` only if it decides to open the file. Delete the `CLAUDE.md` so Claude reads `AGENTS.md` directly, or replace the sentence with an `@AGENTS.md` import.
+* **A `CLAUDE.md` symlinked to `AGENTS.md`**: nothing, or delete the symlink. Either way Claude reads the content once.
+* **A `SessionStart` hook that prints `AGENTS.md`**: remove it. Once Claude reads `AGENTS.md` directly, the hook adds a second copy to the context.
+
+### Share one file with other coding tools
+
+When Claude isn't reading your `AGENTS.md` directly, you can still keep it as the one file every tool shares by putting an `@AGENTS.md` import in a `CLAUDE.md` next to it. Do this when your project also has a `CLAUDE.md`, when you've set **Project instructions** to `claude-md`, or in sessions that [can't load `AGENTS.md`](#when-agents-md-support-is-unavailable). Add any Claude-specific instructions below the import, and Claude reads the imported file first, then the rest:
+
+```markdown CLAUDE.md theme={null}
+@AGENTS.md
+
+## Claude Code
+
+Use plan mode for changes under `src/billing/`.
+```
+
+If you don't need Claude-specific content, a symlink also works:
+
+```bash theme={null}
+ln -s AGENTS.md CLAUDE.md
+```
+
+The command prints no output on success. Before you choose the symlink over the import, check these constraints:
+
+* **Editing**: Claude reads `CLAUDE.md` through the link, but the Edit and Write tools [refuse to write through a symlink](/docs/en/errors#refusing-after-a-symlink-changed), and the refusal directs Claude to edit the link's target, `AGENTS.md`, instead
+* **Windows**: if you or anyone who clones the repository works on Windows, use the `@AGENTS.md` import instead. Creating a symlink there needs Administrator privileges or Developer Mode, and Git checks a committed symlink out as a plain text file unless `core.symlinks` is enabled, which leaves that clone with a one-line `CLAUDE.md` in place of your instructions
+
+With either approach, run `/context` in your next session and confirm `CLAUDE.md` appears under **Memory files**.
+
+### Migrate instructions from other tools
+
+Running [`/init`](/docs/en/commands) reads other tools' instruction files and incorporates the relevant parts into the generated `CLAUDE.md`:
+
+* Cursor rules in `.cursor/rules/` or `.cursorrules`
+* Copilot rules in `.github/copilot-instructions.md`
+* With `CLAUDE_CODE_NEW_INIT=1` set: `AGENTS.md`, `.devin/rules/`, `.windsurf/rules/` or `.windsurfrules`, and `.clinerules`
+
+You can also run [`/import`](/docs/en/commands) to bring a supported coding agent's configuration into Claude Code, which appends a one-time copy of instruction files such as `AGENTS.md` to the matching `CLAUDE.md` and carries over MCP servers, commands, subagents, and skills. Requires Claude Code v2.1.213 or later.
+
 ## Auto memory
 
 Auto memory lets Claude accumulate knowledge across sessions without you writing anything. As it works, Claude saves four kinds of notes for itself. Claude records the kind as a `type` field in the memory file's frontmatter:
@@ -422,7 +522,7 @@ Auto memory files are plain markdown you can edit or delete at any time. Run [`/
 
 ## View and edit with `/memory`
 
-The `/memory` command lists your CLAUDE.md, CLAUDE.local.md, and other memory file locations across user and project scopes, including user and project CLAUDE.md entries for files that don't exist yet. It also lets you toggle auto memory on or off and provides an option to open the auto memory folder. Select any file to open it in your editor; selecting one that doesn't exist yet creates it first. To check which files actually loaded into the current session, run `/context`.
+The `/memory` command lists your CLAUDE.md, CLAUDE.local.md, and other memory file locations across user and project scopes, including user and project CLAUDE.md entries for files that don't exist yet. It also lets you toggle auto memory on or off and provides an option to open the auto memory folder. Select any file to open it in your editor; selecting one that doesn't exist yet creates it first. To check which `CLAUDE.md` and rules files loaded into the current session, run `/context`.
 
 GUI editors such as VS Code open the file in a separate window, and you can keep using the session while it's open. Before v2.1.216, `/memory` waited for you to close the file before responding. Terminal editors such as Vim take over the terminal until you exit.
 
@@ -438,7 +538,7 @@ CLAUDE.md content is delivered as a user message after the system prompt, not as
 
 To debug:
 
-* Run `/context` and check the list under **Memory files** to verify your CLAUDE.md and CLAUDE.local.md files loaded. If a file is missing there, Claude can't see it. Use `/memory` to open and edit the files.
+* Run `/context` and check the list under **Memory files** to verify your CLAUDE.md and CLAUDE.local.md files loaded. If a `CLAUDE.md` file is missing there, Claude can't see it. An `AGENTS.md` appears there only when a `CLAUDE.md` imports it, not when Claude [reads it directly](#where-agents-md-differs-from-claude-md). Use `/memory` to open and edit the files.
 * Check that the relevant CLAUDE.md is in a location that gets loaded for your session (see [Choose where to put CLAUDE.md files](#choose-where-to-put-claude-md-files)).
 * Make instructions more specific. "Use 2-space indentation" works better than "format code nicely."
 * Look for conflicting instructions across CLAUDE.md files. If two files give different guidance for the same behavior, Claude may pick one arbitrarily.
@@ -448,9 +548,22 @@ If the instruction is something that must run at a specific point, such as befor
 For instructions you want at the system prompt level, use [`--append-system-prompt`](/docs/en/cli-reference#system-prompt-flags). You pass it at launch, so it's better suited to scripts and automation than interactive use. For how it behaves when you resume a conversation, see [System prompt flags in resumed conversations](/docs/en/cli-reference#system-prompt-flags-in-resumed-conversations).
 
 <Tip>
-  Use the [`InstructionsLoaded` hook](/docs/en/hooks#instructionsloaded) to log exactly which instruction files are loaded, when they load, and why. This is useful for debugging path-specific rules or lazy-loaded files in subdirectories.
+  Use the [`InstructionsLoaded` hook](/docs/en/hooks#instructionsloaded) to log which `CLAUDE.md` and rules files are loaded, when they load, and why. This is useful for debugging path-specific rules or lazy-loaded files in subdirectories.
 </Tip>
 
+### My AGENTS.md isn't loading
+
+If your repository has an `AGENTS.md` and Claude doesn't seem to know what it says, the usual cause is a `CLAUDE.md` somewhere on the project path. By default Claude reads `AGENTS.md` only when you have no `CLAUDE.md` or `CLAUDE.local.md` in your working directory or above it. Check these in order:
+
+1. Look for a `CLAUDE.md`, `.claude/CLAUDE.md`, or `CLAUDE.local.md` in your working directory or any directory above it, other than your `~/.claude/CLAUDE.md`. If you find one, Claude reads it instead of `AGENTS.md` unless you set **Project instructions** to `claude-md-and-agents-md`.
+2. Run `claude --version` and confirm v2.1.277 or later.
+3. Check whether your session is one that [can't load `AGENTS.md`](#when-agents-md-support-is-unavailable), such as a session on a third-party provider or with telemetry disabled.
+4. Type `/config` in your session to open the settings panel and confirm **Project instructions** isn't set to `claude-md` or `managed-only`. If you don't see the setting there at all, your session is one that [can't load `AGENTS.md`](#when-agents-md-support-is-unavailable).
+
+`AGENTS.md` doesn't appear in `/memory` or `/context` when Claude reads it directly, so check for the `AGENTS.md loaded` line or ask Claude what its project instructions say instead.
+
+If you want to keep the `CLAUDE.md` you found, or your session can't load `AGENTS.md`, [add a `CLAUDE.md` next to your `AGENTS.md` that imports it](#share-one-file-with-other-coding-tools).
+
 ### I don't know what auto memory saved
 
 Run `/memory` and select the auto memory folder to browse what Claude has saved. Everything is plain markdown you can read, edit, or delete.
diff --git a/content/en/docs/claude-code/overview.md b/content/en/docs/claude-code/overview.md
index 493a47fcfb..565a00fcd4 100644
--- a/content/en/docs/claude-code/overview.md
+++ b/content/en/docs/claude-code/overview.md
@@ -165,7 +165,7 @@ Here are some of the ways you can use Claude Code:
   </Accordion>
 
   <Accordion title="Customize with instructions, skills, and hooks" icon="sliders">
-    [`CLAUDE.md`](/docs/en/memory) is a markdown file you add to your project root that Claude Code reads at the start of every session. Use it to set coding standards, architecture decisions, preferred libraries, and review checklists. Claude also builds [auto memory](/docs/en/memory#auto-memory) as it works, saving learnings across sessions without you writing anything.
+    [`CLAUDE.md`](/docs/en/memory) is a markdown file you add to your project root that Claude Code reads at the start of every session. Use it to set coding standards, architecture decisions, preferred libraries, and review checklists. If your repository already has an `AGENTS.md` for other coding agents, Claude Code [can read that](/docs/en/memory#agents-md) on its own or alongside `CLAUDE.md`. Claude also builds [auto memory](/docs/en/memory#auto-memory) as it works, saving learnings across sessions without you writing anything.
 
     Create [skills](/docs/en/skills) to package repeatable workflows your team can share, like `/review-pr` or `/deploy-staging`.
 
diff --git a/content/en/docs/claude-code/permission-modes.md b/content/en/docs/claude-code/permission-modes.md
index ea6b06618c..7573145d47 100644
--- a/content/en/docs/claude-code/permission-modes.md
+++ b/content/en/docs/claude-code/permission-modes.md
@@ -314,9 +314,11 @@ To prevent developers from using auto mode, set `disableAutoMode` to `"disable"`
 
 In v2.1.158 through v2.1.206, auto mode was off on these providers until you set `CLAUDE_CODE_ENABLE_AUTO_MODE=1`, and Claude Code ignored `defaultMode: "auto"` on these providers unless the variable was also set. The variable is still accepted for compatibility and has no effect from v2.1.207 onward.
 
-#### Server-side classifier review
+### Server-side classifier review
 
-On Amazon Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry, Claude Code reviews auto mode actions with its own classifier requests by default. To have the platform's server-side classifier review [the actions that go to the classifier](#how-the-classifier-evaluates-actions) as part of the session's model requests instead, set [`CLAUDE_CODE_AUTO_MODE_SERVER=1`](/docs/en/env-vars). Where the platform runs the classifier, its verdicts decide those actions; where it doesn't, Claude Code falls back to its own classifier requests. In v2.1.271 and v2.1.272, asking the platform was the default on these providers.
+On Enterprise plans and accounts that use the Claude API, on [Claude Platform on AWS](/docs/en/claude-platform-on-aws), Amazon Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry, and whenever you point `ANTHROPIC_BASE_URL` at an [LLM gateway or proxy](/docs/en/llm-gateway), Claude Code in auto mode asks the server to review [the actions that go to the classifier](#how-the-classifier-evaluates-actions) as part of the session's model requests. Where the server reviews them, its verdicts decide those actions. Where it doesn't, most often because an LLM gateway or proxy interferes with the traffic, or because the platform, region, or credential doesn't have server-side checks yet, Claude Code falls back to its own classifier requests, and once that fallback holds for the rest of the session it shows a [notice about classifier request charges](/docs/en/auto-mode-classifier-billing) on accounts where those requests are billed. To skip asking the server and always use Claude Code's own classifier requests, set [`CLAUDE_CODE_AUTO_MODE_SERVER=0`](/docs/en/env-vars). The variable isn't read on a direct connection to the Anthropic API. If you set `CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS=1` and leave `CLAUDE_CODE_AUTO_MODE_SERVER` unset, Claude Code also stops asking the server.
+
+Asking the server by default requires Claude Code v2.1.278 or later.
 
 ### What the classifier blocks by default
 
@@ -495,7 +497,7 @@ Repeated blocks usually mean the classifier is missing context about your infras
 
     The session's first auto-mode request validates the Sonnet 5 default: if the request succeeds, Sonnet 5 stays the session's classifier model, and if it fails because the model isn't available, the session uses the fallback instead. After that validation settles, the classifier's model doesn't change for the session.
 
-    On Enterprise plans and on accounts that use the Claude API, [Claude Platform on AWS](/docs/en/claude-platform-on-aws), Amazon Bedrock, Google Cloud's Agent Platform, or Microsoft Foundry, classifier calls count toward your token usage. Each check sends a portion of the transcript plus the pending action, adding a round-trip before execution. Reads and working-directory edits outside protected paths skip the classifier, so the overhead comes mainly from shell commands and network operations. On Amazon Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry, you can move the review into the session's model requests instead; see [Server-side classifier review](#server-side-classifier-review).
+    On Enterprise plans and on accounts that use the Claude API, [Claude Platform on AWS](/docs/en/claude-platform-on-aws), Amazon Bedrock, Google Cloud's Agent Platform, or Microsoft Foundry, classifier calls count toward your token usage. Each check sends a portion of the transcript plus the pending action, adding a round-trip before execution. Reads and working-directory edits outside protected paths skip the classifier, so the overhead comes mainly from shell commands and network operations. Where the server reviews the actions as part of the session's model requests, there are no separate classifier calls to count; see [Server-side classifier review](#server-side-classifier-review).
 
     Sandboxed network access adds no per-connection classifier requests. The classifier judges [the hosts a command names](/docs/en/sandboxing#per-command-allowed-domains-in-auto-mode) together with the command in one review, and Claude Code checks each connection against the approved list without calling the classifier again.
   </Accordion>
diff --git a/content/en/docs/claude-code/plugins-reference.md b/content/en/docs/claude-code/plugins-reference.md
index 68fa4545c3..4a2a9d8c57 100644
--- a/content/en/docs/claude-code/plugins-reference.md
+++ b/content/en/docs/claude-code/plugins-reference.md
@@ -837,7 +837,10 @@ Claude Code runs the install inside the copied version directory each time it cr
 
 If a plugin contains more than one of these lockfiles, Claude Code uses the first match, checking in order: `bun.lock`, `bun.lockb`, `npm-shrinkwrap.json`, `package-lock.json`.
 
-Claude Code skips `yarn.lock` and `pnpm-lock.yaml` because Yarn and pnpm support resolution-time configuration hooks that bypass `--ignore-scripts`. When a `bunfig.toml` sits beside the matched bun lockfile, Claude Code skips the install entirely, because the file can configure a security scanner that Bun loads and runs during the install. The filename match ignores letter case. Remove the `bunfig.toml`, or ship an npm lockfile in place of the bun lockfile.
+Claude Code skips the install in two cases, each with its own fix:
+
+* If your plugin ships only a `yarn.lock` or `pnpm-lock.yaml`, replace it with an npm lockfile.
+* If a `bunfig.toml` sits beside the bun lockfile, remove the `bunfig.toml`, or replace the bun lockfile with an npm lockfile.
 
 Ship an npm lockfile for the widest reach. Claude Code runs the matched lockfile's package manager from the user's PATH and doesn't fall back to the other lockfile if it's missing. For a plugin distributed through an npm source, use `npm-shrinkwrap.json`; npm excludes `package-lock.json` from published packages.
 
@@ -849,7 +852,7 @@ Claude Code constrains this dependency install so that no code from the plugin o
 
 Claude Code fetches an npm-source plugin before this dependency install, and none of the package's own install scripts run during the fetch. See [npm packages](/docs/en/plugin-marketplaces#npm-packages).
 
-A failed or skipped install never blocks the plugin. When the install fails, or Claude Code skips a yarn or pnpm lockfile or a bun lockfile with a `bunfig.toml` beside it, it records the reason as a warning in [debug output](#debugging-commands). A plugin with a `package.json` and no lockfile is skipped without a log entry. A timed-out install can leave a partial `node_modules` tree in the cached copy.
+A failed or skipped install never blocks the plugin. When the install fails, or Claude Code skips it because of a yarn or pnpm lockfile or a `bunfig.toml`, it records the reason as a warning in [debug output](#debugging-commands). A plugin with a `package.json` and no lockfile is skipped without a log entry. A timed-out install can leave a partial `node_modules` tree in the cached copy.
 
 You can't turn the automatic install off; no setting or environment variable disables it. In restricted networks, see the [network access requirements](/docs/en/network-config#network-access-requirements) for the hosts to allow.
 
diff --git a/content/en/docs/claude-code/routines.md b/content/en/docs/claude-code/routines.md
index 0d1b7fa9e2..0d6c3c0adb 100644
--- a/content/en/docs/claude-code/routines.md
+++ b/content/en/docs/claude-code/routines.md
@@ -48,7 +48,18 @@ Create a routine from the web at [claude.ai/code/routines](https://claude.ai/cod
 
 The creation form sets up the routine's prompt, repositories, environment, connectors, and triggers.
 
-Routines run autonomously as full Claude Code cloud sessions: there is no permission-mode picker and no approval prompts during a run. The session can run shell commands, use [skills](/docs/en/skills) committed to the cloned repository, and call any connectors you include. What a routine can reach is determined by the repositories you select, the [environment's](/docs/en/cloud-environments) network access and variables, and the connectors you include. Scope each of those to what the routine actually needs.
+Routines run autonomously as full Claude Code cloud sessions: there is no permission-mode picker, and the session runs shell commands, uses [skills](/docs/en/skills) committed to the cloned repository, and calls any connectors you include, all without stopping for approval apart from some [artifact](/docs/en/artifacts) actions.
+
+What a routine can reach is determined by the repositories you select, the [environment's](/docs/en/cloud-environments) network access and variables, and the connectors you include. Scope each of those to what the routine actually needs.
+
+When the routine's schedule or **Run now** starts a run, Claude republishes an existing artifact without asking only when all of these hold:
+
+* You can edit the artifact and it belongs to your own organization
+* The artifact isn't shared publicly, and isn't shared with specific people or your organization with the latest version chosen as the version viewers see
+* The publish carries only the page, with no supporting files or anything else added, and doesn't force over a newer version
+* The page holds no grant that reaches beyond the page, such as [connector calls](/docs/en/artifacts#pull-live-data-with-mcp-connectors)
+
+In every other case, including publishing a new artifact, Claude asks first. When a routine's job is to keep a page current, give it an artifact you already published.
 
 Routines belong to your individual claude.ai account. They are not shared with teammates, and they count against your account's daily run allowance. Anything a routine does through your connected GitHub identity or connectors appears as you: commits and pull requests carry your GitHub user, and Slack messages, Linear tickets, or other connector actions use your linked accounts for those services.
 
@@ -313,6 +324,8 @@ You can also ask about a routine's run history, for example `/schedule why did m
 
 Routines need GitHub access to clone repositories. When you create a routine from the CLI with `/schedule`, Claude checks whether your account has GitHub access for the repository you ran it from and, if it doesn't, adds a setup note naming how to grant it. See [GitHub authentication options](/docs/en/claude-code-on-the-web#github-authentication-options) for the two ways to grant access.
 
+If your GitHub connection is missing or expired when a run is due, the routine skips runs until you reconnect, for up to 72 hours. Reconnect GitHub within that window and the routine resumes on its own. After 72 hours without a connection, the routine turns off, and you turn it back on after reconnecting GitHub.
+
 Each repository you add is cloned on every run. Claude starts from the repository's default branch unless your prompt specifies otherwise.
 
 Claude pushes its work to branches prefixed with `claude/`, which are always accepted. When your prompt directs Claude to push to another branch, Claude Code checks the push first and rejects it if any of the following is true:
@@ -337,7 +350,7 @@ Each routine uses a [cloud environment](/docs/en/cloud-environments) that contro
 
 The **Default** environment uses **Trusted** network access, which allows only the [default allowlist](/docs/en/cloud-environments#default-allowed-domains) through the session's network. Requests on that path to hosts outside the allowlist fail with `403` and `x-deny-reason: host_not_allowed`. MCP connector traffic is routed through Anthropic's servers rather than that path, so the connectors you add to the routine work without adding their hosts to **Allowed domains**. Remove any connectors you don't need under [Connectors](#connectors).
 
-To allow additional domains:
+To allow additional domains on one of your own environments, follow these steps. An [organization-shared environment](/docs/en/cloud-environments#organization-shared-environments) opens read-only here, so an Owner changes its network access from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings) instead.
 
 <Steps>
   <Step title="Open the routine for editing">
@@ -371,6 +384,8 @@ When a routine hits the daily cap or your subscription usage limit, organization
 
 One-off runs do not count against the daily routine cap. They draw down your regular subscription usage like any other session.
 
+While your subscription is paused, your routines are put on hold and don't run. Once your subscription is active again, turn them back on.
+
 ## Troubleshooting
 
 <h3 id="schedule-returns-unknown-command">
@@ -383,7 +398,7 @@ The cause is usually one of the following:
 
 * You are authenticated with a Console API key, an [Anthropic profile or federation credential](/docs/en/authentication#anthropic-profiles-and-federation-credentials), or a cloud provider such as Amazon Bedrock, Google Cloud's Agent Platform, or Microsoft Foundry. `/schedule` requires a claude.ai subscription login. With a Console API key or a profile, and feature-flag fetching enabled, submitting `/schedule` instead shows `/schedule is available with Claude for Enterprise — ask your admin about migrating from API-key access`. With a cloud-provider login, you still see `Unknown command: /schedule`. If `ANTHROPIC_API_KEY` or `ANTHROPIC_AUTH_TOKEN` is set in your shell, or `apiKeyHelper` is set in `settings.json`, remove it first, since these take precedence over a claude.ai login. A profile or federation credential takes precedence too, so switch that off as well
 * You are fully signed out, with no API key or other credential. With feature-flag fetching enabled, submitting `/schedule` shows `/schedule requires a claude.ai subscription. Run /login to sign in with your claude.ai account.` Before v2.1.268, a signed-out session showed the same Claude for Enterprise message as a Console API key
-* You are inside a cloud session. Manage routines from the [web UI](https://claude.ai/code/routines) instead
+* You are inside a cloud session, where submitting `/schedule` answers that the command isn't available in that environment. Manage routines from the [web UI](https://claude.ai/code/routines) instead
 * Your organization's policy disables [cloud sessions](/docs/en/claude-code-on-the-web), which routines require. In this case, submitting `/schedule` answers [`Cloud sessions are disabled by your organization's policy`](/docs/en/errors#cloud-sessions-are-disabled-by-your-organizations-policy) instead. Before v2.1.268, it returned `Unknown command: /schedule`
 * An Owner [turned off routines](#routines-are-disabled-by-your-organizations-policy) for your Team or Enterprise organization. Before v2.1.227, the command still appeared in this case, and claude.ai rejected the routine when Claude tried to create or run it
 
diff --git a/content/en/docs/claude-code/self-hosted-environments-deploy.md b/content/en/docs/claude-code/self-hosted-environments-deploy.md
index 3fc06caef6..e73308acd6 100644
--- a/content/en/docs/claude-code/self-hosted-environments-deploy.md
+++ b/content/en/docs/claude-code/self-hosted-environments-deploy.md
@@ -148,7 +148,7 @@ Whichever mechanism you configure must work without a prompt, because the runner
 * The runner sets `GCM_INTERACTIVE=never`, so Git Credential Manager doesn't open a sign-in dialog.
 * The runner clears `core.askPass`, so if you use an askpass helper, set it through the `GIT_ASKPASS` environment variable instead.
 
-If your git host rejects the credential, or you didn't configure one, the runner retries a few times and then fails repository preparation. The runner doesn't pass these settings into the session's environment.
+If your git host rejects the credential, or you didn't configure one, the runner retries a few times and then fails repository preparation when the repository is the one the session pushes results to. For a repository the session only reads from, [Troubleshooting](#troubleshooting) covers when the runner skips it instead. The runner doesn't pass these settings into the session's environment.
 
 If checkout directories are owned by a different uid than the runner process, git refuses to operate on them; add `safe.directory`:
 
@@ -469,7 +469,19 @@ Common issues:
 * **Sessions can't reach the network through an authenticating egress proxy**: when the source you set with [`--proxy-authorization-command` or `--proxy-authorization-file`](#authenticate-to-an-egress-proxy) fails, times out after 30 seconds, or yields an empty value, the runner answers that connection `502 Bad Gateway` and logs why. The runner redacts the command's stderr in that log and never logs the header value. With `--proxy-authorization-command`, run the command yourself on the host to confirm it prints the whole header value on stdout. If the runner instead exits at startup with `could not start the proxy-authorization listener`, it couldn't open its loopback listener.
 * **Runner logs `Poll failed` lines containing `rejecting the malformed poll response`**: the runner received a work-poll response whose body isn't the queue's expected JSON, most often because something between the runner and `api.anthropic.com`, such as an intercepting proxy or a captive portal, answered with its own page. The runner rejects the response, counts it under the `transport` kind of the `claude_code_self_hosted_runner_poll_errors_total` [metric](/docs/en/self-hosted-environments-reference#prometheus-metrics), and retries on the failed-poll schedule described in [Session lifecycle](/docs/en/self-hosted-environments#session-lifecycle). The runner keeps serving its live sessions. Configure the proxy to pass responses from `api.anthropic.com` through unaltered. Before v2.1.246, the runner read such a response as an empty work queue, which could end its live sessions or make it exit.
 * **A session's branch no longer exists on the remote**: for a git source the session only reads from, the runner skips that source and continues on the remaining ones. For the source the session pushes results to, a deleted branch, typically because it was merged and auto-deleted, fails the session with an error naming the repository and branch and asking you to restore the branch and retry. The runner fails the session with the same error when skipping would leave it with no repository at all. Before v2.1.228, such a session started in an empty directory.
+* **A session starts without one of its repositories**: on a runner with no [`checkout` hook](/docs/en/self-hosted-environments-configuration#checkout), the git host can refuse the runner's access check for a repository the session only reads from. The runner then skips that repository, logs a `[runner:warn] could not access context source` line naming the refusal, and starts the session on the remaining ones.
+
+  The runner skips only a clear refusal: the host answers that the repository wasn't found, git finds no credentials for the host, or authentication fails. A network failure, a timeout, or an HTTP `403` still fails the session start, as does a refusal for a repository the session pushes results to. The runner still fails a session that skipping would leave with no repository at all. With [`--use-anthropic-git-proxy`](#use-the-anthropic-git-proxy), the runner skips only a repository the git proxy itself denies.
+
+  The access check runs again each time the session starts on a runner, so once the runner's git identity has read access, the next start clones the repository. Before v2.1.274, each of these refusals failed the session start.
 * **Sessions take minutes to start**: the initial clone usually dominates. Watch the `claude_code_self_hosted_runner_session_init_duration_seconds` [metric](/docs/en/self-hosted-environments-reference#prometheus-metrics) to confirm, and cut the clone with a [pre-warmed checkout](#reuse-a-pre-warmed-checkout) or a smaller `CLAUDE_RUNNER_FETCH_DEPTH`.
+* **Turns fail with a 401**: each session authenticates model calls with the short-lived [`CLAUDE_CODE_OAUTH_TOKEN`](/docs/en/self-hosted-environments-configuration#wrapper-scripts) that the runner fetches from Anthropic and rotates over the session's stdin. When a turn ends with a 401 or 403 from the model API, the runner fetches a fresh token and passes it to the session. The failed turn isn't retried.
+
+  When a fetch fails, the runner logs an `inference_token refresh failed` line that says when it will retry, and it keeps retrying for as long as the session runs.
+
+  If every call starts failing about 30 minutes into a session, a wrapper script has likely severed the session's stdin, so token rotations can't reach it; see [Keep stdin and file descriptor 3 attached](/docs/en/self-hosted-environments-configuration#keep-stdin-and-file-descriptor-3-attached).
+
+  Before v2.1.274, the runner stopped retrying a failed fetch after a few attempts and waited for the next scheduled one. A failed turn didn't trigger a fetch, so every turn failed with a 401 until the next scheduled fetch.
 * **Pod is killed mid-drain**: raise `terminationGracePeriodSeconds` to at least the value the runner logs at startup. See [Shutdown timing](#shutdown-timing).
 
 Once logging is initialized, the runner writes its lifecycle log, including `[runner:fatal]` lines, to stdout, and debug output to stderr, all as plain-text lines rather than JSON. The startup failures described in the troubleshooting entries above print to stderr before that point. Capture both streams with `--log-file`, which also lets `self-hosted-runner doctor` tail them, or with your platform's log collection.
diff --git a/content/en/docs/claude-code/self-hosted-environments-reference.md b/content/en/docs/claude-code/self-hosted-environments-reference.md
index 376d94980f..7553e904d0 100644
--- a/content/en/docs/claude-code/self-hosted-environments-reference.md
+++ b/content/en/docs/claude-code/self-hosted-environments-reference.md
@@ -95,6 +95,7 @@ These runner settings are read from the environment only and cover behavior most
 | `SELF_HOSTED_RUNNER_BG_RESULT_GRACE_MS`    | `30000`     | How long the runner considers a session busy after a background task finishes while the follow-up turn that reads the result hasn't started. The [`--drain-wait-sec` and `--release-idle-session-min` rows](#runner-cli-flags) describe where the hold applies on drain and idle release, and [Runner lifecycle](/docs/en/self-hosted-environments#runner-lifecycle) describes where it applies on `--retire-at` retirement. `0` or an unusable value falls back to the default, so the hold can't be turned off. Requires Claude Code v2.1.228 or later. |
 | `SELF_HOSTED_RUNNER_HOST_CONFIG_DIR`       | `~/.claude` | Directory captured into the runner's startup snapshot and seeded into each session's `CLAUDE_CONFIG_DIR`; changes on disk apply after a runner restart. Setting the variable also moves where the runner reads `.claude.json` for [MCP seeding](/docs/en/self-hosted-environments-configuration#mcp-servers), so setting it, including to its own default, relocates that lookup; point at an empty directory to disable seeding entirely.                                                                                                                |
 | `SELF_HOSTED_RUNNER_MAX_LIFETIME_GRACE_MS` | `900000`    | How long the runner waits after a session reaches its `--kill-session-after-min` limit, for a running turn to finish or the release to complete, before it terminates the session                                                                                                                                                                                                                                                                                                                                                                    |
+| `SELF_HOSTED_RUNNER_POST_TURN_SETTLE_MS`   | `7000`      | Cap on how long the runner counts a session as busy for the `--drain-wait-sec` drain after a turn finishes, while the session's process reports the turn's end to Anthropic. `0` or an unusable value falls back to the default, so the hold can't be turned off. Requires Claude Code v2.1.275 or later.                                                                                                                                                                                                                                            |
 | `SELF_HOSTED_RUNNER_SIGKILL_GRACE_MS`      | `30000`     | How long the runner waits for the OS to deliver `SIGKILL` to a child stuck in uninterruptible I/O before exiting itself. Floored at `--post-session-hook-timeout-sec` plus 15 seconds, and 30 more when `--push-outcome-on-release` is set, so the effective minimum is 75 seconds at defaults.                                                                                                                                                                                                                                                      |
 | `CLAUDE_RUNNER_FETCH_DEPTH`                | `50`        | Git fetch depth for fresh clones. Set a positive integer, or `full` or `0` for a complete fetch. Repositories already present in the workspace keep their existing depth.                                                                                                                                                                                                                                                                                                                                                                            |
 | `CLAUDE_RUNNER_SKIP_GIT_VERIFY`            | unset       | When `1`, skip the `.git` presence check after a `checkout` hook runs. Set this when your hook materializes a non-git source.                                                                                                                                                                                                                                                                                                                                                                                                                        |
diff --git a/content/en/docs/claude-code/settings-reference.md b/content/en/docs/claude-code/settings-reference.md
index c5c3699413..2a5956e25a 100644
--- a/content/en/docs/claude-code/settings-reference.md
+++ b/content/en/docs/claude-code/settings-reference.md
@@ -4604,6 +4604,8 @@ This example stores the `api_endpoint` option for the `deployer` plugin from `ac
 }
 ```
 
+Built-in plugins store their options under the same key with an `@builtin` suffix. For example, the [**Project instructions**](/docs/en/memory#choose-which-instruction-files-load) setting that controls whether Claude Code reads `AGENTS.md` files is `pluginConfigs["agents-md@builtin"].options.instructionFiles`.
+
 Claude Code ignores project and local entries because it substitutes these values into plugin hook, MCP, and LSP configurations, and a cloned repository must not be able to supply them. Before v2.1.207, project and local settings were also read.
 
 ## MCP
@@ -4695,7 +4697,7 @@ The denylist takes precedence over [`allowedMcpServers`](#allowedmcpservers), so
 
 ### `disableClaudeAiConnectors`
 
-Turn off the [claude.ai MCP connectors](/docs/en/mcp#use-mcp-servers-from-claude-ai) [Claude Code fetches itself](/docs/en/mcp#how-connectors-reach-claude-code), so it neither fetches nor connects them. A `true` in any settings file applies: a checked-in project `.claude/settings.json` can opt a repository out of those connectors, but a project-level `false` can't override a user- or managed-level `true`. Requires Claude Code v2.1.182 or later.
+Turn off the [claude.ai MCP connectors](/docs/en/mcp#use-mcp-servers-from-claude-ai) [Claude Code fetches itself](/docs/en/mcp#how-connectors-reach-claude-code), so it neither fetches nor connects them. A `true` in any settings file applies: a checked-in project `.claude/settings.json` can opt a repository out of those connectors, but a project-level `false` can't override a user- or managed-level `true`.
 
 * **Scope**: [`Any file`](#scopes)
 * **Type**: Boolean
@@ -4710,7 +4712,7 @@ Turn off the [claude.ai MCP connectors](/docs/en/mcp#use-mcp-servers-from-claude
 }
 ```
 
-Servers you pass explicitly with `--mcp-config` are unaffected. To block individual connectors instead of all of them, use [`deniedMcpServers`](#deniedmcpservers). See [Disable claude.ai connectors](/docs/en/mcp#disable-claude-ai-connectors). Requires Claude Code v2.1.182 or later.
+Servers you pass explicitly with `--mcp-config` are unaffected. To block individual connectors instead of all of them, use [`deniedMcpServers`](#deniedmcpservers). See [Disable claude.ai connectors](/docs/en/mcp#disable-claude-ai-connectors).
 
 ### `disabledMcpjsonServers`
 
diff --git a/content/en/docs/claude-code/slack.md b/content/en/docs/claude-code/slack.md
index 00da894c16..4288b4f2ce 100644
--- a/content/en/docs/claude-code/slack.md
+++ b/content/en/docs/claude-code/slack.md
@@ -189,7 +189,9 @@ This error means your Claude account has no cloud environment yet. Sign in at [c
 
 This entry applies to workspaces using [Claude Tag](https://claude.com/docs/claude-tag/overview), where Claude works in channels as your organization's shared identity, not as any member's account. If you created the channel's cloud environment at [claude.ai/code](https://claude.ai/code), it belongs to your personal account, and Claude can't start channel sessions in a personal environment. Claude Code fails the session immediately, and retrying doesn't help.
 
-If you're an Owner, recreate the environment as an [organization-shared environment](/docs/en/cloud-environments#organization-shared-environments) from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings). You can apply it in two ways:
+If you're an Owner and the environment is your own, [share it with the organization](/docs/en/cloud-environments#organization-shared-environments) from the environment selector. Otherwise, an Owner recreates it as an organization-shared environment from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings).
+
+You can apply it in two ways:
 
 * Set it as the organization default at [claude.ai/admin-settings/claude-code](https://claude.ai/admin-settings/claude-code).
 * [Set it on the channel](https://claude.com/docs/claude-tag/admins/troubleshooting#channel-sessions-use-the-wrong-environment-or-can%E2%80%99t-find-one) in the Claude Tag admin settings.
diff --git a/content/en/docs/claude-code/sub-agents.md b/content/en/docs/claude-code/sub-agents.md
index 95d649e72d..98fd21065c 100644
--- a/content/en/docs/claude-code/sub-agents.md
+++ b/content/en/docs/claude-code/sub-agents.md
@@ -1038,7 +1038,7 @@ A non-fork subagent's initial context contains:
 
 * **System prompt**: the agent's own prompt plus environment details that Claude Code appends, not the Claude Code system prompt. Custom subagents define theirs in the [markdown body](#write-subagent-files) or `prompt` field. Built-in agents have predefined prompts.
 * **Task message**: the delegation prompt Claude writes when it hands off the work.
-* **CLAUDE.md files**: every level of the [CLAUDE.md hierarchy](/docs/en/memory#how-claude-md-files-load) the main conversation loads, including `~/.claude/CLAUDE.md`, project rules, `CLAUDE.local.md`, and managed policy files. The built-in Explore and Plan agents skip this. A subagent whose definition sets [`omitClaudeMd`](#supported-frontmatter-fields) loads only the managed policy files, or none at all when the definition comes from [managed settings](#choose-the-subagent-scope).
+* **CLAUDE.md files**: every level of the [CLAUDE.md hierarchy](/docs/en/memory#how-claude-md-files-load) the main conversation loads, including `~/.claude/CLAUDE.md`, project rules, `CLAUDE.local.md`, managed policy files, and any [`AGENTS.md` files](/docs/en/memory#agents-md) loaded as project instructions. The built-in Explore and Plan agents skip this. A subagent whose definition sets [`omitClaudeMd`](#supported-frontmatter-fields) loads only the managed policy files, or none at all when the definition comes from [managed settings](#choose-the-subagent-scope).
 * **Git status**: a snapshot taken at the start of the parent session. Absent when the working directory isn't a Git repository or when [`includeGitInstructions`](/docs/en/settings-reference#includegitinstructions) is `false`. Explore and Plan skip it regardless.
 * **Preloaded skills**: full content of any skill named in the agent's [`skills` field](#preload-skills-into-subagents). Built-in agents don't preload skills.
 * **Sibling roster**: a system reminder listing `main` and every other named agent in the session, each a valid `to` value for [`SendMessage`](#resume-subagents). Requires Claude Code v2.1.206 or later. The roster appears only when the subagent's tools include `SendMessage` and at least one other agent has a name, whether Claude named it when spawning it or it runs as an [agent team](/docs/en/agent-teams) teammate. It is a snapshot taken when the subagent starts, so agents named later don't appear.
diff --git a/content/en/docs/claude-code/tools-reference.md b/content/en/docs/claude-code/tools-reference.md
index fd8df5370e..fbbf2bfdcc 100644
--- a/content/en/docs/claude-code/tools-reference.md
+++ b/content/en/docs/claude-code/tools-reference.md
@@ -162,10 +162,10 @@ Each command runs under a timeout, and Claude manages it: when it wants longer t
 
 Claude Code streams a command's output to a working file as the command runs; a command whose output passes 5 GB is killed. When the command finishes, Claude Code reads the output back from that file, up to the read-back window described below. How much of the output reaches Claude inline depends on whether Claude Code treats the result as a failure:
 
-| Result  | What Claude gets                                                                                                                                                                                                                             |
-| :------ | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Valid   | Inline up to roughly 30,000 characters by default; past that, the path of a file saved to the session directory and truncated past 64 MiB, plus a short preview from the start, and Claude reads or searches the file when it needs the rest |
-| Failure | Inline up to roughly 10,000 characters; past that, a head-and-tail excerpt of that size cut from the read-back window, with no file path                                                                                                     |
+| Result  | What Claude gets                                                                                                                                                                                                                                            |
+| :------ | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Valid   | Inline up to roughly 30,000 characters by default; past that, the path of a file saved to the session directory and truncated past 64 MiB, plus a preview of up to the first 2,000 characters, and Claude reads or searches the file when it needs the rest |
+| Failure | Inline up to roughly 10,000 characters; past that, a head-and-tail excerpt of that size cut from the read-back window, with no file path                                                                                                                    |
 
 A command that exits 1 counts as a valid result for the Bash tool only when Claude Code recognizes exit code 1 as a benign outcome for that command: `grep`, `rg`, `egrep`, `fgrep`, `find`, `diff`, `test`, and `[`, plus `git diff` and `git grep`. Every other command that exits 1 counts as a failure, even when exit 1 is a benign informational outcome: no matches for `pgrep` and `jq -e`, files that differ for `cmp`.
 
diff --git a/content/en/docs/claude-code/web-quickstart.md b/content/en/docs/claude-code/web-quickstart.md
index 22f88d5391..36c694ce6f 100644
--- a/content/en/docs/claude-code/web-quickstart.md
+++ b/content/en/docs/claude-code/web-quickstart.md
@@ -182,6 +182,8 @@ When Claude finishes, review the changes, leave feedback on specific lines, and
 <Steps>
   <Step title="Open the diff view">
     A diff indicator shows lines added and removed across the session, for example `+42 -18`. Select it to open the diff view, with a file list on the left and changes on the right.
+
+    The diff compares the session's changes against its base branch by default. To compare against a different branch, select **Compare against** and pick one.
   </Step>
 
   <Step title="Leave inline comments">
diff --git a/content/en/docs/claude-code/web-scheduled-tasks.md b/content/en/docs/claude-code/web-scheduled-tasks.md
index 0d1b7fa9e2..0d6c3c0adb 100644
--- a/content/en/docs/claude-code/web-scheduled-tasks.md
+++ b/content/en/docs/claude-code/web-scheduled-tasks.md
@@ -48,7 +48,18 @@ Create a routine from the web at [claude.ai/code/routines](https://claude.ai/cod
 
 The creation form sets up the routine's prompt, repositories, environment, connectors, and triggers.
 
-Routines run autonomously as full Claude Code cloud sessions: there is no permission-mode picker and no approval prompts during a run. The session can run shell commands, use [skills](/docs/en/skills) committed to the cloned repository, and call any connectors you include. What a routine can reach is determined by the repositories you select, the [environment's](/docs/en/cloud-environments) network access and variables, and the connectors you include. Scope each of those to what the routine actually needs.
+Routines run autonomously as full Claude Code cloud sessions: there is no permission-mode picker, and the session runs shell commands, uses [skills](/docs/en/skills) committed to the cloned repository, and calls any connectors you include, all without stopping for approval apart from some [artifact](/docs/en/artifacts) actions.
+
+What a routine can reach is determined by the repositories you select, the [environment's](/docs/en/cloud-environments) network access and variables, and the connectors you include. Scope each of those to what the routine actually needs.
+
+When the routine's schedule or **Run now** starts a run, Claude republishes an existing artifact without asking only when all of these hold:
+
+* You can edit the artifact and it belongs to your own organization
+* The artifact isn't shared publicly, and isn't shared with specific people or your organization with the latest version chosen as the version viewers see
+* The publish carries only the page, with no supporting files or anything else added, and doesn't force over a newer version
+* The page holds no grant that reaches beyond the page, such as [connector calls](/docs/en/artifacts#pull-live-data-with-mcp-connectors)
+
+In every other case, including publishing a new artifact, Claude asks first. When a routine's job is to keep a page current, give it an artifact you already published.
 
 Routines belong to your individual claude.ai account. They are not shared with teammates, and they count against your account's daily run allowance. Anything a routine does through your connected GitHub identity or connectors appears as you: commits and pull requests carry your GitHub user, and Slack messages, Linear tickets, or other connector actions use your linked accounts for those services.
 
@@ -313,6 +324,8 @@ You can also ask about a routine's run history, for example `/schedule why did m
 
 Routines need GitHub access to clone repositories. When you create a routine from the CLI with `/schedule`, Claude checks whether your account has GitHub access for the repository you ran it from and, if it doesn't, adds a setup note naming how to grant it. See [GitHub authentication options](/docs/en/claude-code-on-the-web#github-authentication-options) for the two ways to grant access.
 
+If your GitHub connection is missing or expired when a run is due, the routine skips runs until you reconnect, for up to 72 hours. Reconnect GitHub within that window and the routine resumes on its own. After 72 hours without a connection, the routine turns off, and you turn it back on after reconnecting GitHub.
+
 Each repository you add is cloned on every run. Claude starts from the repository's default branch unless your prompt specifies otherwise.
 
 Claude pushes its work to branches prefixed with `claude/`, which are always accepted. When your prompt directs Claude to push to another branch, Claude Code checks the push first and rejects it if any of the following is true:
@@ -337,7 +350,7 @@ Each routine uses a [cloud environment](/docs/en/cloud-environments) that contro
 
 The **Default** environment uses **Trusted** network access, which allows only the [default allowlist](/docs/en/cloud-environments#default-allowed-domains) through the session's network. Requests on that path to hosts outside the allowlist fail with `403` and `x-deny-reason: host_not_allowed`. MCP connector traffic is routed through Anthropic's servers rather than that path, so the connectors you add to the routine work without adding their hosts to **Allowed domains**. Remove any connectors you don't need under [Connectors](#connectors).
 
-To allow additional domains:
+To allow additional domains on one of your own environments, follow these steps. An [organization-shared environment](/docs/en/cloud-environments#organization-shared-environments) opens read-only here, so an Owner changes its network access from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings) instead.
 
 <Steps>
   <Step title="Open the routine for editing">
@@ -371,6 +384,8 @@ When a routine hits the daily cap or your subscription usage limit, organization
 
 One-off runs do not count against the daily routine cap. They draw down your regular subscription usage like any other session.
 
+While your subscription is paused, your routines are put on hold and don't run. Once your subscription is active again, turn them back on.
+
 ## Troubleshooting
 
 <h3 id="schedule-returns-unknown-command">
@@ -383,7 +398,7 @@ The cause is usually one of the following:
 
 * You are authenticated with a Console API key, an [Anthropic profile or federation credential](/docs/en/authentication#anthropic-profiles-and-federation-credentials), or a cloud provider such as Amazon Bedrock, Google Cloud's Agent Platform, or Microsoft Foundry. `/schedule` requires a claude.ai subscription login. With a Console API key or a profile, and feature-flag fetching enabled, submitting `/schedule` instead shows `/schedule is available with Claude for Enterprise — ask your admin about migrating from API-key access`. With a cloud-provider login, you still see `Unknown command: /schedule`. If `ANTHROPIC_API_KEY` or `ANTHROPIC_AUTH_TOKEN` is set in your shell, or `apiKeyHelper` is set in `settings.json`, remove it first, since these take precedence over a claude.ai login. A profile or federation credential takes precedence too, so switch that off as well
 * You are fully signed out, with no API key or other credential. With feature-flag fetching enabled, submitting `/schedule` shows `/schedule requires a claude.ai subscription. Run /login to sign in with your claude.ai account.` Before v2.1.268, a signed-out session showed the same Claude for Enterprise message as a Console API key
-* You are inside a cloud session. Manage routines from the [web UI](https://claude.ai/code/routines) instead
+* You are inside a cloud session, where submitting `/schedule` answers that the command isn't available in that environment. Manage routines from the [web UI](https://claude.ai/code/routines) instead
 * Your organization's policy disables [cloud sessions](/docs/en/claude-code-on-the-web), which routines require. In this case, submitting `/schedule` answers [`Cloud sessions are disabled by your organization's policy`](/docs/en/errors#cloud-sessions-are-disabled-by-your-organizations-policy) instead. Before v2.1.268, it returned `Unknown command: /schedule`
 * An Owner [turned off routines](#routines-are-disabled-by-your-organizations-policy) for your Team or Enterprise organization. Before v2.1.227, the command still appeared in this case, and claude.ai rejected the routine when Claude tried to create or run it
 
diff --git a/content/en/manage-claude/cmek-aws-kms.md b/content/en/manage-claude/cmek-aws-kms.md
index 9c537b8287..6fba7549e9 100644
--- a/content/en/manage-claude/cmek-aws-kms.md
+++ b/content/en/manage-claude/cmek-aws-kms.md
@@ -137,385 +137,407 @@ How you register the key depends on which product you use.
       To attach the key to an additional workspace, add that workspace's compartment ID to the condition with `kms:PutKeyPolicy` before attaching.
     </Note>
 
-    <Steps>
-      <Step title="Register the key with Anthropic">
-        Create an external key configuration through the Admin API.
-
-        <CodeGroup>
-          ```bash cURL
-          curl -sS "https://api.anthropic.com/v1/organizations/external_keys" \
-            -H "x-api-key: $ANTHROPIC_API_KEY" \
-            -H "anthropic-version: 2023-06-01" \
-            -H "content-type: application/json" \
-            -d '{
-              "display_name": "<friendly-name>",
-              "geo": "us",
-              "provider_config": {
-                "type": "aws",
-                "kms_arn": "<key-arn-from-create-key-step>"
-              }
-            }'
-          ```
-
-          ```bash CLI
-          ant beta:organization:external-keys create <<'YAML'
-          display_name: "<friendly-name>"
-          geo: us
-          provider_config:
-            type: aws
-            kms_arn: "<key-arn-from-create-key-step>"
-          YAML
-          ```
-
-          ```python Python
-          client = anthropic.Anthropic()
-
-          external_key = client.beta.organization.external_keys.create(
-              display_name="<friendly-name>",
-              geo="us",
-              provider_config={"type": "aws", "kms_arn": "<key-arn-from-create-key-step>"},
-          )
-
-          print(f"id: {external_key.id}")
-          print(f"display_name: {external_key.display_name}")
-          ```
-
-          ```typescript TypeScript
-          const client = new Anthropic();
-
-          const externalKey = await client.beta.organization.externalKeys.create({
-            display_name: "<friendly-name>",
-            geo: "us",
-            provider_config: {
-              type: "aws",
-              kms_arn: "<key-arn-from-create-key-step>"
-            }
-          });
-
-          console.log(`id: ${externalKey.id}`);
-          console.log(`display_name: ${externalKey.display_name}`);
-          ```
-
-          ```csharp C#
-          using Anthropic.Models.Beta.Organization.ExternalKeys;
-
-          AnthropicClient client = new();
-
-          var externalKey = await client.Beta.Organization.ExternalKeys.Create(new()
-          {
-              DisplayName = "<friendly-name>",
-              Geo = Geo.Us,
-              ProviderConfig = new BetaAwsExternalKeyConfig
+    You can set up the key in the Claude Console or through the Admin API, with the same result.
+
+    <Tabs>
+      <Tab title="Claude Console">
+        <Steps>
+          <Step title="Register the key with Anthropic">
+            In the Claude Console, open **Settings > Encryption keys** and click **Add key**. Enter a display name, choose **AWS KMS**, and click **Continue**. Paste the key ARN into **KMS key ARN**, and click **Add**.
+          </Step>
+
+          <Step title="Validate the key">
+            On the **Encryption keys** page, click **Verify** next to the key. **Connected** appears when the check passes. If it fails, a message gives the reason.
+          </Step>
+
+          <Step title="Attach the key to a workspace">
+            Open **Settings > Workspaces**, choose the workspace, and open its **Security** tab. Under **Encryption key**, select the key, click **Save**, and confirm. Attaching a key can't be undone. For a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).
+          </Step>
+        </Steps>
+      </Tab>
+
+      <Tab title="API">
+        <Steps>
+          <Step title="Register the key with Anthropic">
+            Create an external key configuration through the Admin API.
+
+            <CodeGroup>
+              ```bash cURL
+              curl -sS "https://api.anthropic.com/v1/organizations/external_keys" \
+                -H "x-api-key: $ANTHROPIC_API_KEY" \
+                -H "anthropic-version: 2023-06-01" \
+                -H "content-type: application/json" \
+                -d '{
+                  "display_name": "<friendly-name>",
+                  "geo": "us",
+                  "provider_config": {
+                    "type": "aws",
+                    "kms_arn": "<key-arn-from-create-key-step>"
+                  }
+                }'
+              ```
+
+              ```bash CLI
+              ant beta:organization:external-keys create <<'YAML'
+              display_name: "<friendly-name>"
+              geo: us
+              provider_config:
+                type: aws
+                kms_arn: "<key-arn-from-create-key-step>"
+              YAML
+              ```
+
+              ```python Python
+              client = anthropic.Anthropic()
+
+              external_key = client.beta.organization.external_keys.create(
+                  display_name="<friendly-name>",
+                  geo="us",
+                  provider_config={"type": "aws", "kms_arn": "<key-arn-from-create-key-step>"},
+              )
+
+              print(f"id: {external_key.id}")
+              print(f"display_name: {external_key.display_name}")
+              ```
+
+              ```typescript TypeScript
+              const client = new Anthropic();
+
+              const externalKey = await client.beta.organization.externalKeys.create({
+                display_name: "<friendly-name>",
+                geo: "us",
+                provider_config: {
+                  type: "aws",
+                  kms_arn: "<key-arn-from-create-key-step>"
+                }
+              });
+
+              console.log(`id: ${externalKey.id}`);
+              console.log(`display_name: ${externalKey.display_name}`);
+              ```
+
+              ```csharp C#
+              using Anthropic.Models.Beta.Organization.ExternalKeys;
+
+              AnthropicClient client = new();
+
+              var externalKey = await client.Beta.Organization.ExternalKeys.Create(new()
               {
-                  KmsArn = "<key-arn-from-create-key-step>"
+                  DisplayName = "<friendly-name>",
+                  Geo = Geo.Us,
+                  ProviderConfig = new BetaAwsExternalKeyConfig
+                  {
+                      KmsArn = "<key-arn-from-create-key-step>"
+                  }
+              });
+
+              Console.WriteLine($"id: {externalKey.ID}");
+              Console.WriteLine($"display_name: {externalKey.DisplayName}");
+              ```
+
+              ```go Go
+              client := anthropic.NewClient()
+
+              externalKey, err := client.Beta.Organization.ExternalKeys.New(context.Background(), anthropic.BetaOrganizationExternalKeyNewParams{
+              	DisplayName: anthropic.String("<friendly-name>"),
+              	Geo:         anthropic.BetaOrganizationExternalKeyNewParamsGeoUs,
+              	ProviderConfig: anthropic.BetaOrganizationExternalKeyNewParamsProviderConfigUnion{
+              		OfAWS: &anthropic.BetaAWSExternalKeyConfigParam{
+              			KMSARN: "<key-arn-from-create-key-step>",
+              		},
+              	},
+              })
+              if err != nil {
+              	log.Fatal(err)
               }
-          });
-
-          Console.WriteLine($"id: {externalKey.ID}");
-          Console.WriteLine($"display_name: {externalKey.DisplayName}");
-          ```
-
-          ```go Go
-          client := anthropic.NewClient()
-
-          externalKey, err := client.Beta.Organization.ExternalKeys.New(context.Background(), anthropic.BetaOrganizationExternalKeyNewParams{
-          	DisplayName: anthropic.String("<friendly-name>"),
-          	Geo:         anthropic.BetaOrganizationExternalKeyNewParamsGeoUs,
-          	ProviderConfig: anthropic.BetaOrganizationExternalKeyNewParamsProviderConfigUnion{
-          		OfAWS: &anthropic.BetaAWSExternalKeyConfigParam{
-          			KMSARN: "<key-arn-from-create-key-step>",
-          		},
-          	},
-          })
-          if err != nil {
-          	log.Fatal(err)
-          }
-
-          fmt.Printf("id: %s\n", externalKey.ID)
-          fmt.Printf("display_name: %s\n", externalKey.DisplayName)
-          ```
-
-          ```java Java
-          import com.anthropic.models.beta.organization.externalkeys.BetaAwsExternalKeyConfig;
-          import com.anthropic.models.beta.organization.externalkeys.ExternalKeyCreateParams;
 
-          void main() {
-              AnthropicClient client = AnthropicOkHttpClient.fromEnv();
+              fmt.Printf("id: %s\n", externalKey.ID)
+              fmt.Printf("display_name: %s\n", externalKey.DisplayName)
+              ```
 
-              var params = ExternalKeyCreateParams.builder()
-                  .displayName("<friendly-name>")
-                  .geo(ExternalKeyCreateParams.Geo.US)
-                  .providerConfig(BetaAwsExternalKeyConfig.builder()
-                      .kmsArn("<key-arn-from-create-key-step>")
-                      .build())
-                  .build();
-              var externalKey = client.beta().organization().externalKeys().create(params);
-
-              IO.println("id: " + externalKey.id());
-              IO.println("display_name: " + externalKey.displayName().orElseThrow());
-          }
-          ```
-
-          ```php PHP
-          use Anthropic\Beta\Organization\ExternalKeys\ExternalKeyCreateParams\Geo;
-          // ...
-
-          $client = new Client();
-
-          $externalKey = $client->beta->organization->externalKeys->create(
-              displayName: '<friendly-name>',
-              geo: Geo::US,
-              providerConfig: [
-                  'type' => 'aws',
-                  'kmsARN' => '<key-arn-from-create-key-step>',
-              ],
-          );
-
-          echo "id: {$externalKey->id}\n";
-          echo "display_name: {$externalKey->displayName}\n";
-          ```
-
-          ```ruby Ruby
-          client = Anthropic::Client.new
-
-          external_key = client.beta.organization.external_keys.create(
-            display_name: "<friendly-name>",
-            geo: :us,
-            provider_config: {
-              type: :aws,
-              kms_arn: "<key-arn-from-create-key-step>"
-            }
-          )
+              ```java Java
+              import com.anthropic.models.beta.organization.externalkeys.BetaAwsExternalKeyConfig;
+              import com.anthropic.models.beta.organization.externalkeys.ExternalKeyCreateParams;
 
-          puts "id: #{external_key.id}"
-          puts "display_name: #{external_key.display_name}"
-          ```
-        </CodeGroup>
+              void main() {
+                  AnthropicClient client = AnthropicOkHttpClient.fromEnv();
 
-        The response contains the external key ID:
+                  var params = ExternalKeyCreateParams.builder()
+                      .displayName("<friendly-name>")
+                      .geo(ExternalKeyCreateParams.Geo.US)
+                      .providerConfig(BetaAwsExternalKeyConfig.builder()
+                          .kmsArn("<key-arn-from-create-key-step>")
+                          .build())
+                      .build();
+                  var externalKey = client.beta().organization().externalKeys().create(params);
 
-        ```json
-        {
-          "type": "external_key",
-          "id": "ekey_<id>",
-          "display_name": "<friendly-name>"
-        }
-        ```
-      </Step>
+                  IO.println("id: " + externalKey.id());
+                  IO.println("display_name: " + externalKey.displayName().orElseThrow());
+              }
+              ```
+
+              ```php PHP
+              use Anthropic\Beta\Organization\ExternalKeys\ExternalKeyCreateParams\Geo;
+              // ...
+
+              $client = new Client();
+
+              $externalKey = $client->beta->organization->externalKeys->create(
+                  displayName: '<friendly-name>',
+                  geo: Geo::US,
+                  providerConfig: [
+                      'type' => 'aws',
+                      'kmsARN' => '<key-arn-from-create-key-step>',
+                  ],
+              );
+
+              echo "id: {$externalKey->id}\n";
+              echo "display_name: {$externalKey->displayName}\n";
+              ```
+
+              ```ruby Ruby
+              client = Anthropic::Client.new
+
+              external_key = client.beta.organization.external_keys.create(
+                display_name: "<friendly-name>",
+                geo: :us,
+                provider_config: {
+                  type: :aws,
+                  kms_arn: "<key-arn-from-create-key-step>"
+                }
+              )
+
+              puts "id: #{external_key.id}"
+              puts "display_name: #{external_key.display_name}"
+              ```
+            </CodeGroup>
+
+            The response contains the external key ID:
+
+            ```json
+            {
+              "type": "external_key",
+              "id": "ekey_<id>",
+              "display_name": "<friendly-name>"
+            }
+            ```
+          </Step>
 
-      <Step title="Validate the key">
-        Trigger an encrypt and decrypt round-trip against your key.
+          <Step title="Validate the key">
+            Trigger an encrypt and decrypt round-trip against your key.
 
-        <CodeGroup>
-          ```bash cURL
-          curl -sS -X POST "https://api.anthropic.com/v1/organizations/external_keys/ekey_<id>/validate" \
-            -H "x-api-key: $ANTHROPIC_API_KEY" \
-            -H "anthropic-version: 2023-06-01"
-          ```
+            <CodeGroup>
+              ```bash cURL
+              curl -sS -X POST "https://api.anthropic.com/v1/organizations/external_keys/ekey_<id>/validate" \
+                -H "x-api-key: $ANTHROPIC_API_KEY" \
+                -H "anthropic-version: 2023-06-01"
+              ```
 
-          ```bash CLI
-          ant beta:organization:external-keys validate --external-key-id "ekey_<id>"
-          ```
+              ```bash CLI
+              ant beta:organization:external-keys validate --external-key-id "ekey_<id>"
+              ```
 
-          ```python Python
-          client = anthropic.Anthropic()
+              ```python Python
+              client = anthropic.Anthropic()
 
-          validation = client.beta.organization.external_keys.validate("ekey_<id>")
+              validation = client.beta.organization.external_keys.validate("ekey_<id>")
 
-          print(f"status: {validation.status}")
-          print(f"error: {validation.error}")
-          ```
+              print(f"status: {validation.status}")
+              print(f"error: {validation.error}")
+              ```
 
-          ```typescript TypeScript
-          const client = new Anthropic();
+              ```typescript TypeScript
+              const client = new Anthropic();
 
-          const validation = await client.beta.organization.externalKeys.validate("ekey_<id>");
+              const validation = await client.beta.organization.externalKeys.validate("ekey_<id>");
 
-          console.log(`status: ${validation.status}`);
-          console.log(`error: ${validation.error}`);
-          ```
+              console.log(`status: ${validation.status}`);
+              console.log(`error: ${validation.error}`);
+              ```
 
-          ```csharp C#
-          AnthropicClient client = new();
+              ```csharp C#
+              AnthropicClient client = new();
 
-          var validation = await client.Beta.Organization.ExternalKeys.Validate("ekey_<id>");
+              var validation = await client.Beta.Organization.ExternalKeys.Validate("ekey_<id>");
 
-          Console.WriteLine($"status: {validation.Status.Raw()}");
-          Console.WriteLine($"error: {validation.Error}");
-          ```
+              Console.WriteLine($"status: {validation.Status.Raw()}");
+              Console.WriteLine($"error: {validation.Error}");
+              ```
 
-          ```go Go
-          client := anthropic.NewClient()
+              ```go Go
+              client := anthropic.NewClient()
 
-          validation, err := client.Beta.Organization.ExternalKeys.Validate(context.Background(), "ekey_<id>")
-          if err != nil {
-          	log.Fatal(err)
-          }
+              validation, err := client.Beta.Organization.ExternalKeys.Validate(context.Background(), "ekey_<id>")
+              if err != nil {
+              	log.Fatal(err)
+              }
 
-          fmt.Printf("status: %s\n", validation.Status)
-          fmt.Printf("error: %s\n", validation.Error)
-          ```
+              fmt.Printf("status: %s\n", validation.Status)
+              fmt.Printf("error: %s\n", validation.Error)
+              ```
 
-          ```java Java
-          AnthropicClient client = AnthropicOkHttpClient.fromEnv();
+              ```java Java
+              AnthropicClient client = AnthropicOkHttpClient.fromEnv();
 
-          var validation = client.beta().organization().externalKeys().validate("ekey_<id>");
+              var validation = client.beta().organization().externalKeys().validate("ekey_<id>");
 
-          IO.println("status: " + validation.status().asString());
-          IO.println("error: " + validation.error().orElse(""));
-          ```
+              IO.println("status: " + validation.status().asString());
+              IO.println("error: " + validation.error().orElse(""));
+              ```
 
-          ```php PHP
-          $client = new Client();
+              ```php PHP
+              $client = new Client();
 
-          $validation = $client->beta->organization->externalKeys->validate(
-              externalKeyID: 'ekey_<id>',
-          );
+              $validation = $client->beta->organization->externalKeys->validate(
+                  externalKeyID: 'ekey_<id>',
+              );
 
-          echo "status: {$validation->status}\n";
-          echo "error: {$validation->error}\n";
-          ```
+              echo "status: {$validation->status}\n";
+              echo "error: {$validation->error}\n";
+              ```
 
-          ```ruby Ruby
-          client = Anthropic::Client.new
+              ```ruby Ruby
+              client = Anthropic::Client.new
 
-          external_key_id = "ekey_<id>"
-          validation = client.beta.organization.external_keys.validate(external_key_id)
+              external_key_id = "ekey_<id>"
+              validation = client.beta.organization.external_keys.validate(external_key_id)
 
-          puts "status: #{validation.status}"
-          puts "error: #{validation.error}"
-          ```
-        </CodeGroup>
+              puts "status: #{validation.status}"
+              puts "error: #{validation.error}"
+              ```
+            </CodeGroup>
 
-        A successful response looks like this:
+            A successful response looks like this:
 
-        ```json
-        { "type": "external_key_validation", "status": "success", "error": null }
-        ```
+            ```json
+            { "type": "external_key_validation", "status": "success", "error": null }
+            ```
 
-        If validation fails, common causes are:
+            If validation fails, common causes are:
 
-        * **Encryption context mismatch:** Validation fails while data traffic works (or the reverse) with an opaque `AccessDeniedException` when a `kms:EncryptionContext:anthropic:compartment_uuid` condition allows only one of the two values Anthropic sends. Validation sends the all-zeros UUID (`00000000-0000-0000-0000-000000000000`); live traffic sends the attached workspace's compartment ID. Confirm the condition lists both. To rule the condition out entirely, temporarily remove the `Condition` block from the `AllowAnthropicCMEKCrypto` statement and re-validate.
-        * **Resource control policies (RCPs):** If your AWS organization has an RCP that denies KMS operations when `aws:PrincipalOrgID` does not match your org, it blocks Anthropic's cross-account role. The RCP needs a carve-out for this key or for Anthropic's role ARN. Service control policies do not apply here, because they do not evaluate for external principals calling through resource-based policies.
-        * **Access granted through IAM instead of the key policy:** Cross-account KMS access must be granted in the key policy itself, not through an IAM policy in your account. Check with `aws kms get-key-policy --key-id <id> --policy-name default`.
-        * **Region mismatch:** Confirm the key's region is one Anthropic operates in for the geo tier you configured.
-      </Step>
+            * **Encryption context mismatch:** Validation fails while data traffic works (or the reverse) with an opaque `AccessDeniedException` when a `kms:EncryptionContext:anthropic:compartment_uuid` condition allows only one of the two values Anthropic sends. Validation sends the all-zeros UUID (`00000000-0000-0000-0000-000000000000`); live traffic sends the attached workspace's compartment ID. Confirm the condition lists both. To rule the condition out entirely, temporarily remove the `Condition` block from the `AllowAnthropicCMEKCrypto` statement and re-validate.
+            * **Resource control policies (RCPs):** If your AWS organization has an RCP that denies KMS operations when `aws:PrincipalOrgID` does not match your org, it blocks Anthropic's cross-account role. The RCP needs a carve-out for this key or for Anthropic's role ARN. Service control policies do not apply here, because they do not evaluate for external principals calling through resource-based policies.
+            * **Access granted through IAM instead of the key policy:** Cross-account KMS access must be granted in the key policy itself, not through an IAM policy in your account. Check with `aws kms get-key-policy --key-id <id> --policy-name default`.
+            * **Region mismatch:** Confirm the key's region is one Anthropic operates in for the geo tier you configured.
+          </Step>
 
-      <Step title="Attach the key to a workspace">
-        Once the key is validated, attach it to a new workspace before you send any requests to that workspace. For a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).
+          <Step title="Attach the key to a workspace">
+            Once the key is validated, attach it to a new workspace before you send any requests to that workspace. For a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).
 
-        <CodeGroup>
-          ```bash cURL
-          curl -sS -X POST "https://api.anthropic.com/v1/organizations/workspaces/<workspace-id>" \
-            -H "x-api-key: $ANTHROPIC_API_KEY" \
-            -H "anthropic-version: 2023-06-01" \
-            -H "content-type: application/json" \
-            -d '{
-              "external_key_id": "ekey_<id>"
-            }'
-          ```
+            <CodeGroup>
+              ```bash cURL
+              curl -sS -X POST "https://api.anthropic.com/v1/organizations/workspaces/<workspace-id>" \
+                -H "x-api-key: $ANTHROPIC_API_KEY" \
+                -H "anthropic-version: 2023-06-01" \
+                -H "content-type: application/json" \
+                -d '{
+                  "external_key_id": "ekey_<id>"
+                }'
+              ```
 
-          ```bash CLI
-          ant beta:organization:workspaces update \
-            --workspace-id "<workspace-id>" \
-            --external-key-id "ekey_<id>"
-          ```
+              ```bash CLI
+              ant beta:organization:workspaces update \
+                --workspace-id "<workspace-id>" \
+                --external-key-id "ekey_<id>"
+              ```
 
-          ```python Python
-          client = anthropic.Anthropic()
+              ```python Python
+              client = anthropic.Anthropic()
 
-          workspace = client.beta.organization.workspaces.update(
-              "<workspace-id>", external_key_id="ekey_<id>"
-          )
+              workspace = client.beta.organization.workspaces.update(
+                  "<workspace-id>", external_key_id="ekey_<id>"
+              )
 
-          print(f"id: {workspace.id}")
-          print(f"external_key_id: {workspace.external_key_id}")
-          ```
+              print(f"id: {workspace.id}")
+              print(f"external_key_id: {workspace.external_key_id}")
+              ```
 
-          ```typescript TypeScript
-          const client = new Anthropic();
+              ```typescript TypeScript
+              const client = new Anthropic();
 
-          const workspace = await client.beta.organization.workspaces.update("<workspace-id>", {
-            external_key_id: "ekey_<id>"
-          });
+              const workspace = await client.beta.organization.workspaces.update("<workspace-id>", {
+                external_key_id: "ekey_<id>"
+              });
 
-          console.log(`id: ${workspace.id}`);
-          console.log(`external_key_id: ${workspace.external_key_id}`);
-          ```
+              console.log(`id: ${workspace.id}`);
+              console.log(`external_key_id: ${workspace.external_key_id}`);
+              ```
 
-          ```csharp C#
-          AnthropicClient client = new();
+              ```csharp C#
+              AnthropicClient client = new();
 
-          var workspace = await client.Beta.Organization.Workspaces.Update("<workspace-id>", new()
-          {
-              ExternalKeyID = "ekey_<id>"
-          });
-
-          Console.WriteLine($"id: {workspace.ID}");
-          Console.WriteLine($"external_key_id: {workspace.ExternalKeyID}");
-          ```
-
-          ```go Go
-          client := anthropic.NewClient()
-
-          workspace, err := client.Beta.Organization.Workspaces.Update(
-          	context.Background(),
-          	"<workspace-id>",
-          	anthropic.BetaOrganizationWorkspaceUpdateParams{
-          		ExternalKeyID: anthropic.String("ekey_<id>"),
-          	},
-          )
-          if err != nil {
-          	log.Fatal(err)
-          }
+              var workspace = await client.Beta.Organization.Workspaces.Update("<workspace-id>", new()
+              {
+                  ExternalKeyID = "ekey_<id>"
+              });
+
+              Console.WriteLine($"id: {workspace.ID}");
+              Console.WriteLine($"external_key_id: {workspace.ExternalKeyID}");
+              ```
+
+              ```go Go
+              client := anthropic.NewClient()
+
+              workspace, err := client.Beta.Organization.Workspaces.Update(
+              	context.Background(),
+              	"<workspace-id>",
+              	anthropic.BetaOrganizationWorkspaceUpdateParams{
+              		ExternalKeyID: anthropic.String("ekey_<id>"),
+              	},
+              )
+              if err != nil {
+              	log.Fatal(err)
+              }
 
-          fmt.Printf("id: %s\n", workspace.ID)
-          fmt.Printf("external_key_id: %s\n", workspace.ExternalKeyID)
-          ```
+              fmt.Printf("id: %s\n", workspace.ID)
+              fmt.Printf("external_key_id: %s\n", workspace.ExternalKeyID)
+              ```
 
-          ```java Java
-          import com.anthropic.models.beta.organization.workspaces.WorkspaceUpdateParams;
+              ```java Java
+              import com.anthropic.models.beta.organization.workspaces.WorkspaceUpdateParams;
 
-          void main() {
-              AnthropicClient client = AnthropicOkHttpClient.fromEnv();
+              void main() {
+                  AnthropicClient client = AnthropicOkHttpClient.fromEnv();
 
-              var params = WorkspaceUpdateParams.builder()
-                  .externalKeyId("ekey_<id>")
-                  .build();
-              var workspace = client.beta().organization().workspaces().update("<workspace-id>", params);
+                  var params = WorkspaceUpdateParams.builder()
+                      .externalKeyId("ekey_<id>")
+                      .build();
+                  var workspace = client.beta().organization().workspaces().update("<workspace-id>", params);
 
-              IO.println("id: " + workspace.id());
-              IO.println("external_key_id: " + workspace.externalKeyId().orElseThrow());
-          }
-          ```
-
-          ```php PHP
-          $client = new Client();
-
-          $workspace = $client->beta->organization->workspaces->update(
-              workspaceID: '<workspace-id>',
-              externalKeyID: 'ekey_<id>',
-          );
-
-          echo "id: {$workspace->id}\n";
-          echo "external_key_id: {$workspace->externalKeyID}\n";
-          ```
-
-          ```ruby Ruby
-          client = Anthropic::Client.new
-
-          workspace_id = "<workspace-id>"
-          workspace = client.beta.organization.workspaces.update(
-            workspace_id,
-            external_key_id: "ekey_<id>"
-          )
-
-          puts "id: #{workspace.id}"
-          puts "external_key_id: #{workspace.external_key_id}"
-          ```
-        </CodeGroup>
-      </Step>
-    </Steps>
+                  IO.println("id: " + workspace.id());
+                  IO.println("external_key_id: " + workspace.externalKeyId().orElseThrow());
+              }
+              ```
+
+              ```php PHP
+              $client = new Client();
+
+              $workspace = $client->beta->organization->workspaces->update(
+                  workspaceID: '<workspace-id>',
+                  externalKeyID: 'ekey_<id>',
+              );
+
+              echo "id: {$workspace->id}\n";
+              echo "external_key_id: {$workspace->externalKeyID}\n";
+              ```
+
+              ```ruby Ruby
+              client = Anthropic::Client.new
+
+              workspace_id = "<workspace-id>"
+              workspace = client.beta.organization.workspaces.update(
+                workspace_id,
+                external_key_id: "ekey_<id>"
+              )
+
+              puts "id: #{workspace.id}"
+              puts "external_key_id: #{workspace.external_key_id}"
+              ```
+            </CodeGroup>
+          </Step>
+        </Steps>
+      </Tab>
+    </Tabs>
   </Tab>
 
   <Tab title="Claude Enterprise">
diff --git a/content/en/manage-claude/cmek-azure-key-vault.md b/content/en/manage-claude/cmek-azure-key-vault.md
index 5073086c30..2be2407973 100644
--- a/content/en/manage-claude/cmek-azure-key-vault.md
+++ b/content/en/manage-claude/cmek-azure-key-vault.md
@@ -143,403 +143,425 @@ How you register the key depends on which product you use.
 
 <Tabs>
   <Tab title="Claude Platform">
-    <Steps>
-      <Step title="Register the key with Anthropic">
-        Create an external key configuration through the Admin API.
-
-        <CodeGroup>
-          ```bash cURL
-          curl -sS "https://api.anthropic.com/v1/organizations/external_keys" \
-            -H "x-api-key: $ANTHROPIC_API_KEY" \
-            -H "anthropic-version: 2023-06-01" \
-            -H "content-type: application/json" \
-            -d '{
-              "display_name": "<friendly-name>",
-              "geo": "us",
-              "provider_config": {
-                "type": "azure",
-                "vault_uri": "https://<your-vault-name>.vault.azure.net/",
-                "key_name": "<your-key-name>",
-                "tenant_id": "<your-tenant-id>"
-              }
-            }'
-          ```
-
-          ```bash CLI
-          ant beta:organization:external-keys create <<'YAML'
-          display_name: "<friendly-name>"
-          geo: us
-          provider_config:
-            type: azure
-            vault_uri: "https://<your-vault-name>.vault.azure.net/"
-            key_name: "<your-key-name>"
-            tenant_id: "<your-tenant-id>"
-          YAML
-          ```
-
-          ```python Python
-          client = anthropic.Anthropic()
-
-          external_key = client.beta.organization.external_keys.create(
-              display_name="<friendly-name>",
-              geo="us",
-              provider_config={
-                  "type": "azure",
-                  "vault_uri": "https://<your-vault-name>.vault.azure.net/",
-                  "key_name": "<your-key-name>",
-                  "tenant_id": "<your-tenant-id>",
-              },
-          )
-
-          print(f"id: {external_key.id}")
-          print(f"display_name: {external_key.display_name}")
-          ```
-
-          ```typescript TypeScript
-          const client = new Anthropic();
-
-          const externalKey = await client.beta.organization.externalKeys.create({
-            display_name: "<friendly-name>",
-            geo: "us",
-            provider_config: {
-              type: "azure",
-              vault_uri: "https://<your-vault-name>.vault.azure.net/",
-              key_name: "<your-key-name>",
-              tenant_id: "<your-tenant-id>"
-            }
-          });
-
-          console.log(`id: ${externalKey.id}`);
-          console.log(`display_name: ${externalKey.display_name}`);
-          ```
-
-          ```csharp C#
-          using Anthropic.Models.Beta.Organization.ExternalKeys;
-
-          AnthropicClient client = new();
-
-          var externalKey = await client.Beta.Organization.ExternalKeys.Create(new()
-          {
-              DisplayName = "<friendly-name>",
-              Geo = Geo.Us,
-              ProviderConfig = new BetaAzureExternalKeyConfigParam
+    You can set up the key in the Claude Console or through the Admin API, with the same result.
+
+    <Tabs>
+      <Tab title="Claude Console">
+        <Steps>
+          <Step title="Register the key with Anthropic">
+            In the Claude Console, open **Settings > Encryption keys** and click **Add key**. Enter a display name, choose **Azure Key Vault**, and click **Continue**. Fill in **Vault URI**, **Key name**, and **Tenant ID**, and click **Add**.
+          </Step>
+
+          <Step title="Validate the key">
+            On the **Encryption keys** page, click **Verify** next to the key. **Connected** appears when the check passes. If it fails, a message gives the reason.
+          </Step>
+
+          <Step title="Attach the key to a workspace">
+            Open **Settings > Workspaces**, choose the workspace, and open its **Security** tab. Under **Encryption key**, select the key, click **Save**, and confirm. Attaching a key can't be undone. For a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).
+          </Step>
+        </Steps>
+      </Tab>
+
+      <Tab title="API">
+        <Steps>
+          <Step title="Register the key with Anthropic">
+            Create an external key configuration through the Admin API.
+
+            <CodeGroup>
+              ```bash cURL
+              curl -sS "https://api.anthropic.com/v1/organizations/external_keys" \
+                -H "x-api-key: $ANTHROPIC_API_KEY" \
+                -H "anthropic-version: 2023-06-01" \
+                -H "content-type: application/json" \
+                -d '{
+                  "display_name": "<friendly-name>",
+                  "geo": "us",
+                  "provider_config": {
+                    "type": "azure",
+                    "vault_uri": "https://<your-vault-name>.vault.azure.net/",
+                    "key_name": "<your-key-name>",
+                    "tenant_id": "<your-tenant-id>"
+                  }
+                }'
+              ```
+
+              ```bash CLI
+              ant beta:organization:external-keys create <<'YAML'
+              display_name: "<friendly-name>"
+              geo: us
+              provider_config:
+                type: azure
+                vault_uri: "https://<your-vault-name>.vault.azure.net/"
+                key_name: "<your-key-name>"
+                tenant_id: "<your-tenant-id>"
+              YAML
+              ```
+
+              ```python Python
+              client = anthropic.Anthropic()
+
+              external_key = client.beta.organization.external_keys.create(
+                  display_name="<friendly-name>",
+                  geo="us",
+                  provider_config={
+                      "type": "azure",
+                      "vault_uri": "https://<your-vault-name>.vault.azure.net/",
+                      "key_name": "<your-key-name>",
+                      "tenant_id": "<your-tenant-id>",
+                  },
+              )
+
+              print(f"id: {external_key.id}")
+              print(f"display_name: {external_key.display_name}")
+              ```
+
+              ```typescript TypeScript
+              const client = new Anthropic();
+
+              const externalKey = await client.beta.organization.externalKeys.create({
+                display_name: "<friendly-name>",
+                geo: "us",
+                provider_config: {
+                  type: "azure",
+                  vault_uri: "https://<your-vault-name>.vault.azure.net/",
+                  key_name: "<your-key-name>",
+                  tenant_id: "<your-tenant-id>"
+                }
+              });
+
+              console.log(`id: ${externalKey.id}`);
+              console.log(`display_name: ${externalKey.display_name}`);
+              ```
+
+              ```csharp C#
+              using Anthropic.Models.Beta.Organization.ExternalKeys;
+
+              AnthropicClient client = new();
+
+              var externalKey = await client.Beta.Organization.ExternalKeys.Create(new()
               {
-                  VaultUri = "https://<your-vault-name>.vault.azure.net/",
-                  KeyName = "<your-key-name>",
-                  TenantID = "<your-tenant-id>"
+                  DisplayName = "<friendly-name>",
+                  Geo = Geo.Us,
+                  ProviderConfig = new BetaAzureExternalKeyConfigParam
+                  {
+                      VaultUri = "https://<your-vault-name>.vault.azure.net/",
+                      KeyName = "<your-key-name>",
+                      TenantID = "<your-tenant-id>"
+                  }
+              });
+
+              Console.WriteLine($"id: {externalKey.ID}");
+              Console.WriteLine($"display_name: {externalKey.DisplayName}");
+              ```
+
+              ```go Go
+              client := anthropic.NewClient()
+
+              externalKey, err := client.Beta.Organization.ExternalKeys.New(context.Background(), anthropic.BetaOrganizationExternalKeyNewParams{
+              	DisplayName: anthropic.String("<friendly-name>"),
+              	Geo:         anthropic.BetaOrganizationExternalKeyNewParamsGeoUs,
+              	ProviderConfig: anthropic.BetaOrganizationExternalKeyNewParamsProviderConfigUnion{
+              		OfAzure: &anthropic.BetaAzureExternalKeyConfigParam{
+              			VaultURI: "https://<your-vault-name>.vault.azure.net/",
+              			KeyName:  "<your-key-name>",
+              			TenantID: "<your-tenant-id>",
+              		},
+              	},
+              })
+              if err != nil {
+              	log.Fatal(err)
               }
-          });
-
-          Console.WriteLine($"id: {externalKey.ID}");
-          Console.WriteLine($"display_name: {externalKey.DisplayName}");
-          ```
-
-          ```go Go
-          client := anthropic.NewClient()
-
-          externalKey, err := client.Beta.Organization.ExternalKeys.New(context.Background(), anthropic.BetaOrganizationExternalKeyNewParams{
-          	DisplayName: anthropic.String("<friendly-name>"),
-          	Geo:         anthropic.BetaOrganizationExternalKeyNewParamsGeoUs,
-          	ProviderConfig: anthropic.BetaOrganizationExternalKeyNewParamsProviderConfigUnion{
-          		OfAzure: &anthropic.BetaAzureExternalKeyConfigParam{
-          			VaultURI: "https://<your-vault-name>.vault.azure.net/",
-          			KeyName:  "<your-key-name>",
-          			TenantID: "<your-tenant-id>",
-          		},
-          	},
-          })
-          if err != nil {
-          	log.Fatal(err)
-          }
-
-          fmt.Printf("id: %s\n", externalKey.ID)
-          fmt.Printf("display_name: %s\n", externalKey.DisplayName)
-          ```
-
-          ```java Java
-          import com.anthropic.models.beta.organization.externalkeys.BetaAzureExternalKeyConfigParam;
-          import com.anthropic.models.beta.organization.externalkeys.ExternalKeyCreateParams;
-
-          void main() {
-              AnthropicClient client = AnthropicOkHttpClient.fromEnv();
 
-              var params = ExternalKeyCreateParams.builder()
-                  .displayName("<friendly-name>")
-                  .geo(ExternalKeyCreateParams.Geo.US)
-                  .providerConfig(BetaAzureExternalKeyConfigParam.builder()
-                      .vaultUri("https://<your-vault-name>.vault.azure.net/")
-                      .keyName("<your-key-name>")
-                      .tenantId("<your-tenant-id>")
-                      .build())
-                  .build();
-              var externalKey = client.beta().organization().externalKeys().create(params);
-
-              IO.println("id: " + externalKey.id());
-              IO.println("display_name: " + externalKey.displayName().orElseThrow());
-          }
-          ```
-
-          ```php PHP
-          use Anthropic\Beta\Organization\ExternalKeys\ExternalKeyCreateParams\Geo;
-          // ...
-
-          $client = new Client();
-
-          $externalKey = $client->beta->organization->externalKeys->create(
-              displayName: '<friendly-name>',
-              geo: Geo::US,
-              providerConfig: [
-                  'type' => 'azure',
-                  'vaultURI' => 'https://<your-vault-name>.vault.azure.net/',
-                  'keyName' => '<your-key-name>',
-                  'tenantID' => '<your-tenant-id>',
-              ],
-          );
-
-          echo "id: {$externalKey->id}\n";
-          echo "display_name: {$externalKey->displayName}\n";
-          ```
-
-          ```ruby Ruby
-          client = Anthropic::Client.new
-
-          external_key = client.beta.organization.external_keys.create(
-            display_name: "<friendly-name>",
-            geo: :us,
-            provider_config: {
-              type: :azure,
-              vault_uri: "https://<your-vault-name>.vault.azure.net/",
-              key_name: "<your-key-name>",
-              tenant_id: "<your-tenant-id>"
+              fmt.Printf("id: %s\n", externalKey.ID)
+              fmt.Printf("display_name: %s\n", externalKey.DisplayName)
+              ```
+
+              ```java Java
+              import com.anthropic.models.beta.organization.externalkeys.BetaAzureExternalKeyConfigParam;
+              import com.anthropic.models.beta.organization.externalkeys.ExternalKeyCreateParams;
+
+              void main() {
+                  AnthropicClient client = AnthropicOkHttpClient.fromEnv();
+
+                  var params = ExternalKeyCreateParams.builder()
+                      .displayName("<friendly-name>")
+                      .geo(ExternalKeyCreateParams.Geo.US)
+                      .providerConfig(BetaAzureExternalKeyConfigParam.builder()
+                          .vaultUri("https://<your-vault-name>.vault.azure.net/")
+                          .keyName("<your-key-name>")
+                          .tenantId("<your-tenant-id>")
+                          .build())
+                      .build();
+                  var externalKey = client.beta().organization().externalKeys().create(params);
+
+                  IO.println("id: " + externalKey.id());
+                  IO.println("display_name: " + externalKey.displayName().orElseThrow());
+              }
+              ```
+
+              ```php PHP
+              use Anthropic\Beta\Organization\ExternalKeys\ExternalKeyCreateParams\Geo;
+              // ...
+
+              $client = new Client();
+
+              $externalKey = $client->beta->organization->externalKeys->create(
+                  displayName: '<friendly-name>',
+                  geo: Geo::US,
+                  providerConfig: [
+                      'type' => 'azure',
+                      'vaultURI' => 'https://<your-vault-name>.vault.azure.net/',
+                      'keyName' => '<your-key-name>',
+                      'tenantID' => '<your-tenant-id>',
+                  ],
+              );
+
+              echo "id: {$externalKey->id}\n";
+              echo "display_name: {$externalKey->displayName}\n";
+              ```
+
+              ```ruby Ruby
+              client = Anthropic::Client.new
+
+              external_key = client.beta.organization.external_keys.create(
+                display_name: "<friendly-name>",
+                geo: :us,
+                provider_config: {
+                  type: :azure,
+                  vault_uri: "https://<your-vault-name>.vault.azure.net/",
+                  key_name: "<your-key-name>",
+                  tenant_id: "<your-tenant-id>"
+                }
+              )
+
+              puts "id: #{external_key.id}"
+              puts "display_name: #{external_key.display_name}"
+              ```
+            </CodeGroup>
+
+            The response contains the external key ID:
+
+            ```json
+            {
+              "type": "external_key",
+              "id": "ekey_<id>",
+              "display_name": "<friendly-name>"
             }
-          )
+            ```
+          </Step>
 
-          puts "id: #{external_key.id}"
-          puts "display_name: #{external_key.display_name}"
-          ```
-        </CodeGroup>
+          <Step title="Validate the key">
+            Trigger an encrypt and decrypt round-trip against your key. This confirms that Anthropic can authenticate to your tenant and perform wrap and unwrap operations.
 
-        The response contains the external key ID:
+            <CodeGroup>
+              ```bash cURL
+              curl -sS -X POST "https://api.anthropic.com/v1/organizations/external_keys/ekey_<id>/validate" \
+                -H "x-api-key: $ANTHROPIC_API_KEY" \
+                -H "anthropic-version: 2023-06-01"
+              ```
 
-        ```json
-        {
-          "type": "external_key",
-          "id": "ekey_<id>",
-          "display_name": "<friendly-name>"
-        }
-        ```
-      </Step>
+              ```bash CLI
+              ant beta:organization:external-keys validate --external-key-id "ekey_<id>"
+              ```
 
-      <Step title="Validate the key">
-        Trigger an encrypt and decrypt round-trip against your key. This confirms that Anthropic can authenticate to your tenant and perform wrap and unwrap operations.
+              ```python Python
+              client = anthropic.Anthropic()
 
-        <CodeGroup>
-          ```bash cURL
-          curl -sS -X POST "https://api.anthropic.com/v1/organizations/external_keys/ekey_<id>/validate" \
-            -H "x-api-key: $ANTHROPIC_API_KEY" \
-            -H "anthropic-version: 2023-06-01"
-          ```
+              validation = client.beta.organization.external_keys.validate("ekey_<id>")
 
-          ```bash CLI
-          ant beta:organization:external-keys validate --external-key-id "ekey_<id>"
-          ```
+              print(f"status: {validation.status}")
+              print(f"error: {validation.error}")
+              ```
 
-          ```python Python
-          client = anthropic.Anthropic()
+              ```typescript TypeScript
+              const client = new Anthropic();
 
-          validation = client.beta.organization.external_keys.validate("ekey_<id>")
+              const validation = await client.beta.organization.externalKeys.validate("ekey_<id>");
 
-          print(f"status: {validation.status}")
-          print(f"error: {validation.error}")
-          ```
+              console.log(`status: ${validation.status}`);
+              console.log(`error: ${validation.error}`);
+              ```
 
-          ```typescript TypeScript
-          const client = new Anthropic();
+              ```csharp C#
+              AnthropicClient client = new();
 
-          const validation = await client.beta.organization.externalKeys.validate("ekey_<id>");
+              var validation = await client.Beta.Organization.ExternalKeys.Validate("ekey_<id>");
 
-          console.log(`status: ${validation.status}`);
-          console.log(`error: ${validation.error}`);
-          ```
+              Console.WriteLine($"status: {validation.Status.Raw()}");
+              Console.WriteLine($"error: {validation.Error}");
+              ```
 
-          ```csharp C#
-          AnthropicClient client = new();
+              ```go Go
+              client := anthropic.NewClient()
 
-          var validation = await client.Beta.Organization.ExternalKeys.Validate("ekey_<id>");
-
-          Console.WriteLine($"status: {validation.Status.Raw()}");
-          Console.WriteLine($"error: {validation.Error}");
-          ```
-
-          ```go Go
-          client := anthropic.NewClient()
+              validation, err := client.Beta.Organization.ExternalKeys.Validate(context.Background(), "ekey_<id>")
+              if err != nil {
+              	log.Fatal(err)
+              }
 
-          validation, err := client.Beta.Organization.ExternalKeys.Validate(context.Background(), "ekey_<id>")
-          if err != nil {
-          	log.Fatal(err)
-          }
+              fmt.Printf("status: %s\n", validation.Status)
+              fmt.Printf("error: %s\n", validation.Error)
+              ```
 
-          fmt.Printf("status: %s\n", validation.Status)
-          fmt.Printf("error: %s\n", validation.Error)
-          ```
+              ```java Java
+              AnthropicClient client = AnthropicOkHttpClient.fromEnv();
 
-          ```java Java
-          AnthropicClient client = AnthropicOkHttpClient.fromEnv();
+              var validation = client.beta().organization().externalKeys().validate("ekey_<id>");
 
-          var validation = client.beta().organization().externalKeys().validate("ekey_<id>");
+              IO.println("status: " + validation.status().asString());
+              IO.println("error: " + validation.error().orElse(""));
+              ```
 
-          IO.println("status: " + validation.status().asString());
-          IO.println("error: " + validation.error().orElse(""));
-          ```
+              ```php PHP
+              $client = new Client();
 
-          ```php PHP
-          $client = new Client();
+              $validation = $client->beta->organization->externalKeys->validate(
+                  externalKeyID: 'ekey_<id>',
+              );
 
-          $validation = $client->beta->organization->externalKeys->validate(
-              externalKeyID: 'ekey_<id>',
-          );
+              echo "status: {$validation->status}\n";
+              echo "error: {$validation->error}\n";
+              ```
 
-          echo "status: {$validation->status}\n";
-          echo "error: {$validation->error}\n";
-          ```
+              ```ruby Ruby
+              client = Anthropic::Client.new
 
-          ```ruby Ruby
-          client = Anthropic::Client.new
+              validation = client.beta.organization.external_keys.validate("ekey_<id>")
 
-          validation = client.beta.organization.external_keys.validate("ekey_<id>")
+              puts "status: #{validation.status}"
+              puts "error: #{validation.error}"
+              ```
+            </CodeGroup>
 
-          puts "status: #{validation.status}"
-          puts "error: #{validation.error}"
-          ```
-        </CodeGroup>
+            A successful response looks like this:
 
-        A successful response looks like this:
+            ```json
+            { "type": "external_key_validation", "status": "success", "error": null }
+            ```
 
-        ```json
-        { "type": "external_key_validation", "status": "success", "error": null }
-        ```
+            If validation fails, the `error` field describes the problem. Common causes are:
 
-        If validation fails, the `error` field describes the problem. Common causes are:
+            * **RBAC propagation delay:** role assignments can take a few minutes to take effect. Wait and retry.
+            * **Network ACLs blocking Anthropic:** confirm public network access and `ipRules` as described in the verification step.
+            * **Conditional access policies on workload identities:** if your tenant has conditional access policies that target service principals, exclude the Anthropic service principal or add Anthropic's egress ranges to the policy's named locations.
+          </Step>
 
-        * **RBAC propagation delay:** role assignments can take a few minutes to take effect. Wait and retry.
-        * **Network ACLs blocking Anthropic:** confirm public network access and `ipRules` as described in the verification step.
-        * **Conditional access policies on workload identities:** if your tenant has conditional access policies that target service principals, exclude the Anthropic service principal or add Anthropic's egress ranges to the policy's named locations.
-      </Step>
+          <Step title="Attach the key to a workspace">
+            Once the key is validated, attach it to a new workspace before you send any requests to that workspace. For a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).
 
-      <Step title="Attach the key to a workspace">
-        Once the key is validated, attach it to a new workspace before you send any requests to that workspace. For a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).
+            <CodeGroup>
+              ```bash cURL
+              curl -sS -X POST "https://api.anthropic.com/v1/organizations/workspaces/<workspace-id>" \
+                -H "x-api-key: $ANTHROPIC_API_KEY" \
+                -H "anthropic-version: 2023-06-01" \
+                -H "content-type: application/json" \
+                -d '{
+                  "external_key_id": "ekey_<id>"
+                }'
+              ```
 
-        <CodeGroup>
-          ```bash cURL
-          curl -sS -X POST "https://api.anthropic.com/v1/organizations/workspaces/<workspace-id>" \
-            -H "x-api-key: $ANTHROPIC_API_KEY" \
-            -H "anthropic-version: 2023-06-01" \
-            -H "content-type: application/json" \
-            -d '{
-              "external_key_id": "ekey_<id>"
-            }'
-          ```
+              ```bash CLI
+              ant beta:organization:workspaces update \
+                --workspace-id "<workspace-id>" \
+                --external-key-id "ekey_<id>"
+              ```
 
-          ```bash CLI
-          ant beta:organization:workspaces update \
-            --workspace-id "<workspace-id>" \
-            --external-key-id "ekey_<id>"
-          ```
+              ```python Python
+              client = anthropic.Anthropic()
 
-          ```python Python
-          client = anthropic.Anthropic()
+              workspace = client.beta.organization.workspaces.update(
+                  "<workspace-id>", external_key_id="ekey_<id>"
+              )
 
-          workspace = client.beta.organization.workspaces.update(
-              "<workspace-id>", external_key_id="ekey_<id>"
-          )
+              print(f"id: {workspace.id}")
+              print(f"external_key_id: {workspace.external_key_id}")
+              ```
 
-          print(f"id: {workspace.id}")
-          print(f"external_key_id: {workspace.external_key_id}")
-          ```
+              ```typescript TypeScript
+              const client = new Anthropic();
 
-          ```typescript TypeScript
-          const client = new Anthropic();
+              const workspace = await client.beta.organization.workspaces.update("<workspace-id>", {
+                external_key_id: "ekey_<id>"
+              });
 
-          const workspace = await client.beta.organization.workspaces.update("<workspace-id>", {
-            external_key_id: "ekey_<id>"
-          });
+              console.log(`id: ${workspace.id}`);
+              console.log(`external_key_id: ${workspace.external_key_id}`);
+              ```
 
-          console.log(`id: ${workspace.id}`);
-          console.log(`external_key_id: ${workspace.external_key_id}`);
-          ```
+              ```csharp C#
+              AnthropicClient client = new();
 
-          ```csharp C#
-          AnthropicClient client = new();
+              var workspace = await client.Beta.Organization.Workspaces.Update("<workspace-id>", new()
+              {
+                  ExternalKeyID = "ekey_<id>"
+              });
+
+              Console.WriteLine($"id: {workspace.ID}");
+              Console.WriteLine($"external_key_id: {workspace.ExternalKeyID}");
+              ```
+
+              ```go Go
+              client := anthropic.NewClient()
+
+              workspace, err := client.Beta.Organization.Workspaces.Update(
+              	context.Background(),
+              	"<workspace-id>",
+              	anthropic.BetaOrganizationWorkspaceUpdateParams{
+              		ExternalKeyID: anthropic.String("ekey_<id>"),
+              	},
+              )
+              if err != nil {
+              	log.Fatal(err)
+              }
 
-          var workspace = await client.Beta.Organization.Workspaces.Update("<workspace-id>", new()
-          {
-              ExternalKeyID = "ekey_<id>"
-          });
+              fmt.Printf("id: %s\n", workspace.ID)
+              fmt.Printf("external_key_id: %s\n", workspace.ExternalKeyID)
+              ```
 
-          Console.WriteLine($"id: {workspace.ID}");
-          Console.WriteLine($"external_key_id: {workspace.ExternalKeyID}");
-          ```
+              ```java Java
+              import com.anthropic.models.beta.organization.workspaces.WorkspaceUpdateParams;
 
-          ```go Go
-          client := anthropic.NewClient()
+              void main() {
+                  AnthropicClient client = AnthropicOkHttpClient.fromEnv();
 
-          workspace, err := client.Beta.Organization.Workspaces.Update(
-          	context.Background(),
-          	"<workspace-id>",
-          	anthropic.BetaOrganizationWorkspaceUpdateParams{
-          		ExternalKeyID: anthropic.String("ekey_<id>"),
-          	},
-          )
-          if err != nil {
-          	log.Fatal(err)
-          }
-
-          fmt.Printf("id: %s\n", workspace.ID)
-          fmt.Printf("external_key_id: %s\n", workspace.ExternalKeyID)
-          ```
-
-          ```java Java
-          import com.anthropic.models.beta.organization.workspaces.WorkspaceUpdateParams;
-
-          void main() {
-              AnthropicClient client = AnthropicOkHttpClient.fromEnv();
+                  var params = WorkspaceUpdateParams.builder()
+                      .externalKeyId("ekey_<id>")
+                      .build();
+                  var workspace = client.beta().organization().workspaces().update("<workspace-id>", params);
 
-              var params = WorkspaceUpdateParams.builder()
-                  .externalKeyId("ekey_<id>")
-                  .build();
-              var workspace = client.beta().organization().workspaces().update("<workspace-id>", params);
-
-              IO.println("id: " + workspace.id());
-              IO.println("external_key_id: " + workspace.externalKeyId().orElseThrow());
-          }
-          ```
-
-          ```php PHP
-          $client = new Client();
-
-          $workspace = $client->beta->organization->workspaces->update(
-              workspaceID: '<workspace-id>',
-              externalKeyID: 'ekey_<id>',
-          );
-
-          echo "id: {$workspace->id}\n";
-          echo "external_key_id: {$workspace->externalKeyID}\n";
-          ```
-
-          ```ruby Ruby
-          client = Anthropic::Client.new
-
-          workspace = client.beta.organization.workspaces.update(
-            "<workspace-id>",
-            external_key_id: "ekey_<id>"
-          )
-
-          puts "id: #{workspace.id}"
-          puts "external_key_id: #{workspace.external_key_id}"
-          ```
-        </CodeGroup>
-      </Step>
-    </Steps>
+                  IO.println("id: " + workspace.id());
+                  IO.println("external_key_id: " + workspace.externalKeyId().orElseThrow());
+              }
+              ```
+
+              ```php PHP
+              $client = new Client();
+
+              $workspace = $client->beta->organization->workspaces->update(
+                  workspaceID: '<workspace-id>',
+                  externalKeyID: 'ekey_<id>',
+              );
+
+              echo "id: {$workspace->id}\n";
+              echo "external_key_id: {$workspace->externalKeyID}\n";
+              ```
+
+              ```ruby Ruby
+              client = Anthropic::Client.new
+
+              workspace = client.beta.organization.workspaces.update(
+                "<workspace-id>",
+                external_key_id: "ekey_<id>"
+              )
+
+              puts "id: #{workspace.id}"
+              puts "external_key_id: #{workspace.external_key_id}"
+              ```
+            </CodeGroup>
+          </Step>
+        </Steps>
+      </Tab>
+    </Tabs>
   </Tab>
 
   <Tab title="Claude Enterprise">
diff --git a/content/en/manage-claude/cmek-google-cloud-kms.md b/content/en/manage-claude/cmek-google-cloud-kms.md
index d933f9d828..6a782da122 100644
--- a/content/en/manage-claude/cmek-google-cloud-kms.md
+++ b/content/en/manage-claude/cmek-google-cloud-kms.md
@@ -136,385 +136,407 @@ How you register the key depends on which product you use.
 
 <Tabs>
   <Tab title="Claude Platform">
-    <Steps>
-      <Step title="Register the key with Anthropic">
-        Create an external key configuration through the Admin API, using the resource name from the Note the full key resource name step under Encryption key setup.
-
-        <CodeGroup>
-          ```bash cURL
-          curl -sS "https://api.anthropic.com/v1/organizations/external_keys" \
-            -H "x-api-key: $ANTHROPIC_API_KEY" \
-            -H "anthropic-version: 2023-06-01" \
-            -H "content-type: application/json" \
-            -d '{
-              "display_name": "<friendly-name>",
-              "geo": "us",
-              "provider_config": {
-                "type": "gcp",
-                "key_name": "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
+    You can set up the key in the Claude Console or through the Admin API, with the same result.
+
+    <Tabs>
+      <Tab title="Claude Console">
+        <Steps>
+          <Step title="Register the key with Anthropic">
+            In the Claude Console, open **Settings > Encryption keys** and click **Add key**. Enter a display name, choose **Google Cloud KMS**, and click **Continue**. Paste the full key resource name into **Key resource name**, and click **Add**.
+          </Step>
+
+          <Step title="Validate the key">
+            On the **Encryption keys** page, click **Verify** next to the key. **Connected** appears when the check passes. If it fails, a message gives the reason.
+          </Step>
+
+          <Step title="Attach the key to a workspace">
+            Open **Settings > Workspaces**, choose the workspace, and open its **Security** tab. Under **Encryption key**, select the key, click **Save**, and confirm. Attaching a key can't be undone. For a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).
+          </Step>
+        </Steps>
+      </Tab>
+
+      <Tab title="API">
+        <Steps>
+          <Step title="Register the key with Anthropic">
+            Create an external key configuration through the Admin API, using the resource name from the Note the full key resource name step under Encryption key setup.
+
+            <CodeGroup>
+              ```bash cURL
+              curl -sS "https://api.anthropic.com/v1/organizations/external_keys" \
+                -H "x-api-key: $ANTHROPIC_API_KEY" \
+                -H "anthropic-version: 2023-06-01" \
+                -H "content-type: application/json" \
+                -d '{
+                  "display_name": "<friendly-name>",
+                  "geo": "us",
+                  "provider_config": {
+                    "type": "gcp",
+                    "key_name": "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
+                  }
+                }'
+              ```
+
+              ```bash CLI
+              ant beta:organization:external-keys create <<'YAML'
+              display_name: "<friendly-name>"
+              geo: us
+              provider_config:
+                type: gcp
+                key_name: "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
+              YAML
+              ```
+
+              ```python Python
+              client = anthropic.Anthropic()
+
+              external_key = client.beta.organization.external_keys.create(
+                  display_name="<friendly-name>",
+                  geo="us",
+                  provider_config={
+                      "type": "gcp",
+                      "key_name": "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>",
+                  },
+              )
+
+              print(f"id: {external_key.id}")
+              print(f"display_name: {external_key.display_name}")
+              ```
+
+              ```typescript TypeScript
+              const client = new Anthropic();
+
+              const externalKey = await client.beta.organization.externalKeys.create({
+                display_name: "<friendly-name>",
+                geo: "us",
+                provider_config: {
+                  type: "gcp",
+                  key_name:
+                    "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
+                }
+              });
+
+              console.log(`id: ${externalKey.id}`);
+              console.log(`display_name: ${externalKey.display_name}`);
+              ```
+
+              ```csharp C#
+              using Anthropic.Models.Beta.Organization.ExternalKeys;
+
+              AnthropicClient client = new();
+
+              var externalKey = await client.Beta.Organization.ExternalKeys.Create(new()
+              {
+                  DisplayName = "<friendly-name>",
+                  Geo = Geo.Us,
+                  ProviderConfig = new BetaGcpExternalKeyConfig
+                  {
+                      KeyName = "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
+                  }
+              });
+
+              Console.WriteLine($"id: {externalKey.ID}");
+              Console.WriteLine($"display_name: {externalKey.DisplayName}");
+              ```
+
+              ```go Go
+              client := anthropic.NewClient()
+
+              externalKey, err := client.Beta.Organization.ExternalKeys.New(context.Background(), anthropic.BetaOrganizationExternalKeyNewParams{
+              	DisplayName: anthropic.String("<friendly-name>"),
+              	Geo:         anthropic.BetaOrganizationExternalKeyNewParamsGeoUs,
+              	ProviderConfig: anthropic.BetaOrganizationExternalKeyNewParamsProviderConfigUnion{
+              		OfGCP: &anthropic.BetaGCPExternalKeyConfigParam{
+              			KeyName: "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>",
+              		},
+              	},
+              })
+              if err != nil {
+              	log.Fatal(err)
               }
-            }'
-          ```
-
-          ```bash CLI
-          ant beta:organization:external-keys create <<'YAML'
-          display_name: "<friendly-name>"
-          geo: us
-          provider_config:
-            type: gcp
-            key_name: "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
-          YAML
-          ```
-
-          ```python Python
-          client = anthropic.Anthropic()
-
-          external_key = client.beta.organization.external_keys.create(
-              display_name="<friendly-name>",
-              geo="us",
-              provider_config={
-                  "type": "gcp",
-                  "key_name": "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>",
-              },
-          )
-
-          print(f"id: {external_key.id}")
-          print(f"display_name: {external_key.display_name}")
-          ```
-
-          ```typescript TypeScript
-          const client = new Anthropic();
-
-          const externalKey = await client.beta.organization.externalKeys.create({
-            display_name: "<friendly-name>",
-            geo: "us",
-            provider_config: {
-              type: "gcp",
-              key_name:
-                "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
-            }
-          });
 
-          console.log(`id: ${externalKey.id}`);
-          console.log(`display_name: ${externalKey.display_name}`);
-          ```
+              fmt.Printf("id: %s\n", externalKey.ID)
+              fmt.Printf("display_name: %s\n", externalKey.DisplayName)
+              ```
 
-          ```csharp C#
-          using Anthropic.Models.Beta.Organization.ExternalKeys;
+              ```java Java
+              import com.anthropic.models.beta.organization.externalkeys.ExternalKeyCreateParams;
 
-          AnthropicClient client = new();
+              void main() {
+                  AnthropicClient client = AnthropicOkHttpClient.fromEnv();
 
-          var externalKey = await client.Beta.Organization.ExternalKeys.Create(new()
-          {
-              DisplayName = "<friendly-name>",
-              Geo = Geo.Us,
-              ProviderConfig = new BetaGcpExternalKeyConfig
-              {
-                  KeyName = "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
-              }
-          });
-
-          Console.WriteLine($"id: {externalKey.ID}");
-          Console.WriteLine($"display_name: {externalKey.DisplayName}");
-          ```
-
-          ```go Go
-          client := anthropic.NewClient()
-
-          externalKey, err := client.Beta.Organization.ExternalKeys.New(context.Background(), anthropic.BetaOrganizationExternalKeyNewParams{
-          	DisplayName: anthropic.String("<friendly-name>"),
-          	Geo:         anthropic.BetaOrganizationExternalKeyNewParamsGeoUs,
-          	ProviderConfig: anthropic.BetaOrganizationExternalKeyNewParamsProviderConfigUnion{
-          		OfGCP: &anthropic.BetaGCPExternalKeyConfigParam{
-          			KeyName: "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>",
-          		},
-          	},
-          })
-          if err != nil {
-          	log.Fatal(err)
-          }
-
-          fmt.Printf("id: %s\n", externalKey.ID)
-          fmt.Printf("display_name: %s\n", externalKey.DisplayName)
-          ```
-
-          ```java Java
-          import com.anthropic.models.beta.organization.externalkeys.ExternalKeyCreateParams;
-
-          void main() {
-              AnthropicClient client = AnthropicOkHttpClient.fromEnv();
+                  var params = ExternalKeyCreateParams.builder()
+                      .displayName("<friendly-name>")
+                      .geo(ExternalKeyCreateParams.Geo.US)
+                      .gcpProviderConfig("projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>")
+                      .build();
+                  var externalKey = client.beta().organization().externalKeys().create(params);
 
-              var params = ExternalKeyCreateParams.builder()
-                  .displayName("<friendly-name>")
-                  .geo(ExternalKeyCreateParams.Geo.US)
-                  .gcpProviderConfig("projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>")
-                  .build();
-              var externalKey = client.beta().organization().externalKeys().create(params);
-
-              IO.println("id: " + externalKey.id());
-              IO.println("display_name: " + externalKey.displayName().orElseThrow());
-          }
-          ```
-
-          ```php PHP
-          use Anthropic\Beta\Organization\ExternalKeys\ExternalKeyCreateParams\Geo;
-          // ...
-
-          $client = new Client();
-
-          $externalKey = $client->beta->organization->externalKeys->create(
-              displayName: '<friendly-name>',
-              geo: Geo::US,
-              providerConfig: [
-                  'type' => 'gcp',
-                  'keyName' => 'projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>',
-              ],
-          );
-
-          echo "id: {$externalKey->id}\n";
-          echo "display_name: {$externalKey->displayName}\n";
-          ```
-
-          ```ruby Ruby
-          client = Anthropic::Client.new
-
-          external_key = client.beta.organization.external_keys.create(
-            display_name: "<friendly-name>",
-            geo: :us,
-            provider_config: {
-              type: :gcp,
-              key_name: "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
+                  IO.println("id: " + externalKey.id());
+                  IO.println("display_name: " + externalKey.displayName().orElseThrow());
+              }
+              ```
+
+              ```php PHP
+              use Anthropic\Beta\Organization\ExternalKeys\ExternalKeyCreateParams\Geo;
+              // ...
+
+              $client = new Client();
+
+              $externalKey = $client->beta->organization->externalKeys->create(
+                  displayName: '<friendly-name>',
+                  geo: Geo::US,
+                  providerConfig: [
+                      'type' => 'gcp',
+                      'keyName' => 'projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>',
+                  ],
+              );
+
+              echo "id: {$externalKey->id}\n";
+              echo "display_name: {$externalKey->displayName}\n";
+              ```
+
+              ```ruby Ruby
+              client = Anthropic::Client.new
+
+              external_key = client.beta.organization.external_keys.create(
+                display_name: "<friendly-name>",
+                geo: :us,
+                provider_config: {
+                  type: :gcp,
+                  key_name: "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
+                }
+              )
+
+              puts "id: #{external_key.id}"
+              puts "display_name: #{external_key.display_name}"
+              ```
+            </CodeGroup>
+
+            The response contains the external key ID:
+
+            ```json
+            {
+              "type": "external_key",
+              "id": "ekey_<id>",
+              "display_name": "<friendly-name>"
             }
-          )
+            ```
+          </Step>
 
-          puts "id: #{external_key.id}"
-          puts "display_name: #{external_key.display_name}"
-          ```
-        </CodeGroup>
+          <Step title="Validate the key">
+            Trigger an encrypt and decrypt round-trip against your key.
 
-        The response contains the external key ID:
+            <CodeGroup>
+              ```bash cURL
+              curl -sS -X POST "https://api.anthropic.com/v1/organizations/external_keys/ekey_<id>/validate" \
+                -H "x-api-key: $ANTHROPIC_API_KEY" \
+                -H "anthropic-version: 2023-06-01"
+              ```
 
-        ```json
-        {
-          "type": "external_key",
-          "id": "ekey_<id>",
-          "display_name": "<friendly-name>"
-        }
-        ```
-      </Step>
+              ```bash CLI
+              ant beta:organization:external-keys validate --external-key-id "ekey_<id>"
+              ```
 
-      <Step title="Validate the key">
-        Trigger an encrypt and decrypt round-trip against your key.
+              ```python Python
+              client = anthropic.Anthropic()
 
-        <CodeGroup>
-          ```bash cURL
-          curl -sS -X POST "https://api.anthropic.com/v1/organizations/external_keys/ekey_<id>/validate" \
-            -H "x-api-key: $ANTHROPIC_API_KEY" \
-            -H "anthropic-version: 2023-06-01"
-          ```
+              validation = client.beta.organization.external_keys.validate("ekey_<id>")
 
-          ```bash CLI
-          ant beta:organization:external-keys validate --external-key-id "ekey_<id>"
-          ```
+              print(f"status: {validation.status}")
+              print(f"error: {validation.error}")
+              ```
 
-          ```python Python
-          client = anthropic.Anthropic()
+              ```typescript TypeScript
+              const client = new Anthropic();
 
-          validation = client.beta.organization.external_keys.validate("ekey_<id>")
+              const validation = await client.beta.organization.externalKeys.validate("ekey_<id>");
 
-          print(f"status: {validation.status}")
-          print(f"error: {validation.error}")
-          ```
+              console.log(`status: ${validation.status}`);
+              console.log(`error: ${validation.error}`);
+              ```
 
-          ```typescript TypeScript
-          const client = new Anthropic();
+              ```csharp C#
+              AnthropicClient client = new();
 
-          const validation = await client.beta.organization.externalKeys.validate("ekey_<id>");
+              var validation = await client.Beta.Organization.ExternalKeys.Validate("ekey_<id>");
 
-          console.log(`status: ${validation.status}`);
-          console.log(`error: ${validation.error}`);
-          ```
+              Console.WriteLine($"status: {validation.Status.Raw()}");
+              Console.WriteLine($"error: {validation.Error}");
+              ```
 
-          ```csharp C#
-          AnthropicClient client = new();
+              ```go Go
+              client := anthropic.NewClient()
 
-          var validation = await client.Beta.Organization.ExternalKeys.Validate("ekey_<id>");
+              validation, err := client.Beta.Organization.ExternalKeys.Validate(context.Background(), "ekey_<id>")
+              if err != nil {
+              	log.Fatal(err)
+              }
 
-          Console.WriteLine($"status: {validation.Status.Raw()}");
-          Console.WriteLine($"error: {validation.Error}");
-          ```
+              fmt.Printf("status: %s\n", validation.Status)
+              fmt.Printf("error: %s\n", validation.Error)
+              ```
 
-          ```go Go
-          client := anthropic.NewClient()
+              ```java Java
+              AnthropicClient client = AnthropicOkHttpClient.fromEnv();
 
-          validation, err := client.Beta.Organization.ExternalKeys.Validate(context.Background(), "ekey_<id>")
-          if err != nil {
-          	log.Fatal(err)
-          }
+              var validation = client.beta().organization().externalKeys().validate("ekey_<id>");
 
-          fmt.Printf("status: %s\n", validation.Status)
-          fmt.Printf("error: %s\n", validation.Error)
-          ```
+              IO.println("status: " + validation.status().asString());
+              IO.println("error: " + validation.error().orElse(""));
+              ```
 
-          ```java Java
-          AnthropicClient client = AnthropicOkHttpClient.fromEnv();
+              ```php PHP
+              $client = new Client();
 
-          var validation = client.beta().organization().externalKeys().validate("ekey_<id>");
+              $validation = $client->beta->organization->externalKeys->validate(
+                  externalKeyID: 'ekey_<id>',
+              );
 
-          IO.println("status: " + validation.status().asString());
-          IO.println("error: " + validation.error().orElse(""));
-          ```
+              echo "status: {$validation->status}\n";
+              echo "error: {$validation->error}\n";
+              ```
 
-          ```php PHP
-          $client = new Client();
+              ```ruby Ruby
+              client = Anthropic::Client.new
 
-          $validation = $client->beta->organization->externalKeys->validate(
-              externalKeyID: 'ekey_<id>',
-          );
+              external_key_id = "ekey_<id>"
+              validation = client.beta.organization.external_keys.validate(external_key_id)
 
-          echo "status: {$validation->status}\n";
-          echo "error: {$validation->error}\n";
-          ```
+              puts "status: #{validation.status}"
+              puts "error: #{validation.error}"
+              ```
+            </CodeGroup>
 
-          ```ruby Ruby
-          client = Anthropic::Client.new
+            A successful response looks like this:
 
-          external_key_id = "ekey_<id>"
-          validation = client.beta.organization.external_keys.validate(external_key_id)
+            ```json
+            { "type": "external_key_validation", "status": "success", "error": null }
+            ```
 
-          puts "status: #{validation.status}"
-          puts "error: #{validation.error}"
-          ```
-        </CodeGroup>
+            If validation fails, common causes are:
 
-        A successful response looks like this:
+            * **VPC Service Controls:** if a service perimeter protects Cloud KMS in your project, add Anthropic to an access level on the perimeter (or exclude the key's project) so Anthropic can reach the key.
+            * **Domain restricted sharing:** the `constraints/iam.allowedPolicyMemberDomains` org policy can strip the Anthropic service account binding (see the earlier note). Confirm the binding is present with `gcloud kms keys get-iam-policy <your-key-name> --project=<your-project-id> --location=<region> --keyring=<your-keyring-name>`.
+            * **Disabled or destroyed key version:** confirm the key's primary version is enabled, and not disabled, scheduled for destruction, or destroyed.
+          </Step>
 
-        ```json
-        { "type": "external_key_validation", "status": "success", "error": null }
-        ```
+          <Step title="Attach the key to a workspace">
+            Once the key is validated, attach it to a new workspace before you send any requests to that workspace. For a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).
 
-        If validation fails, common causes are:
+            <CodeGroup>
+              ```bash cURL
+              curl -sS -X POST "https://api.anthropic.com/v1/organizations/workspaces/<workspace-id>" \
+                -H "x-api-key: $ANTHROPIC_API_KEY" \
+                -H "anthropic-version: 2023-06-01" \
+                -H "content-type: application/json" \
+                -d '{
+                  "external_key_id": "ekey_<id>"
+                }'
+              ```
 
-        * **VPC Service Controls:** if a service perimeter protects Cloud KMS in your project, add Anthropic to an access level on the perimeter (or exclude the key's project) so Anthropic can reach the key.
-        * **Domain restricted sharing:** the `constraints/iam.allowedPolicyMemberDomains` org policy can strip the Anthropic service account binding (see the earlier note). Confirm the binding is present with `gcloud kms keys get-iam-policy <your-key-name> --project=<your-project-id> --location=<region> --keyring=<your-keyring-name>`.
-        * **Disabled or destroyed key version:** confirm the key's primary version is enabled, and not disabled, scheduled for destruction, or destroyed.
-      </Step>
+              ```bash CLI
+              ant beta:organization:workspaces update \
+                --workspace-id "<workspace-id>" \
+                --external-key-id "ekey_<id>"
+              ```
 
-      <Step title="Attach the key to a workspace">
-        Once the key is validated, attach it to a new workspace before you send any requests to that workspace. For a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).
+              ```python Python
+              client = anthropic.Anthropic()
 
-        <CodeGroup>
-          ```bash cURL
-          curl -sS -X POST "https://api.anthropic.com/v1/organizations/workspaces/<workspace-id>" \
-            -H "x-api-key: $ANTHROPIC_API_KEY" \
-            -H "anthropic-version: 2023-06-01" \
-            -H "content-type: application/json" \
-            -d '{
-              "external_key_id": "ekey_<id>"
-            }'
-          ```
+              workspace = client.beta.organization.workspaces.update(
+                  "<workspace-id>", external_key_id="ekey_<id>"
+              )
 
-          ```bash CLI
-          ant beta:organization:workspaces update \
-            --workspace-id "<workspace-id>" \
-            --external-key-id "ekey_<id>"
-          ```
+              print(f"id: {workspace.id}")
+              print(f"external_key_id: {workspace.external_key_id}")
+              ```
 
-          ```python Python
-          client = anthropic.Anthropic()
+              ```typescript TypeScript
+              const client = new Anthropic();
 
-          workspace = client.beta.organization.workspaces.update(
-              "<workspace-id>", external_key_id="ekey_<id>"
-          )
+              const workspace = await client.beta.organization.workspaces.update("<workspace-id>", {
+                external_key_id: "ekey_<id>"
+              });
 
-          print(f"id: {workspace.id}")
-          print(f"external_key_id: {workspace.external_key_id}")
-          ```
+              console.log(`id: ${workspace.id}`);
+              console.log(`external_key_id: ${workspace.external_key_id}`);
+              ```
 
-          ```typescript TypeScript
-          const client = new Anthropic();
+              ```csharp C#
+              AnthropicClient client = new();
 
-          const workspace = await client.beta.organization.workspaces.update("<workspace-id>", {
-            external_key_id: "ekey_<id>"
-          });
+              var workspace = await client.Beta.Organization.Workspaces.Update("<workspace-id>", new()
+              {
+                  ExternalKeyID = "ekey_<id>"
+              });
+
+              Console.WriteLine($"id: {workspace.ID}");
+              Console.WriteLine($"external_key_id: {workspace.ExternalKeyID}");
+              ```
+
+              ```go Go
+              client := anthropic.NewClient()
+
+              workspace, err := client.Beta.Organization.Workspaces.Update(
+              	context.Background(),
+              	"<workspace-id>",
+              	anthropic.BetaOrganizationWorkspaceUpdateParams{
+              		ExternalKeyID: anthropic.String("ekey_<id>"),
+              	},
+              )
+              if err != nil {
+              	log.Fatal(err)
+              }
 
-          console.log(`id: ${workspace.id}`);
-          console.log(`external_key_id: ${workspace.external_key_id}`);
-          ```
+              fmt.Printf("id: %s\n", workspace.ID)
+              fmt.Printf("external_key_id: %s\n", workspace.ExternalKeyID)
+              ```
 
-          ```csharp C#
-          AnthropicClient client = new();
-
-          var workspace = await client.Beta.Organization.Workspaces.Update("<workspace-id>", new()
-          {
-              ExternalKeyID = "ekey_<id>"
-          });
+              ```java Java
+              import com.anthropic.models.beta.organization.workspaces.WorkspaceUpdateParams;
 
-          Console.WriteLine($"id: {workspace.ID}");
-          Console.WriteLine($"external_key_id: {workspace.ExternalKeyID}");
-          ```
+              void main() {
+                  AnthropicClient client = AnthropicOkHttpClient.fromEnv();
 
-          ```go Go
-          client := anthropic.NewClient()
-
-          workspace, err := client.Beta.Organization.Workspaces.Update(
-          	context.Background(),
-          	"<workspace-id>",
-          	anthropic.BetaOrganizationWorkspaceUpdateParams{
-          		ExternalKeyID: anthropic.String("ekey_<id>"),
-          	},
-          )
-          if err != nil {
-          	log.Fatal(err)
-          }
-
-          fmt.Printf("id: %s\n", workspace.ID)
-          fmt.Printf("external_key_id: %s\n", workspace.ExternalKeyID)
-          ```
-
-          ```java Java
-          import com.anthropic.models.beta.organization.workspaces.WorkspaceUpdateParams;
-
-          void main() {
-              AnthropicClient client = AnthropicOkHttpClient.fromEnv();
+                  var params = WorkspaceUpdateParams.builder()
+                      .externalKeyId("ekey_<id>")
+                      .build();
+                  var workspace = client.beta().organization().workspaces().update("<workspace-id>", params);
 
-              var params = WorkspaceUpdateParams.builder()
-                  .externalKeyId("ekey_<id>")
-                  .build();
-              var workspace = client.beta().organization().workspaces().update("<workspace-id>", params);
-
-              IO.println("id: " + workspace.id());
-              IO.println("external_key_id: " + workspace.externalKeyId().orElseThrow());
-          }
-          ```
-
-          ```php PHP
-          $client = new Client();
-
-          $workspace = $client->beta->organization->workspaces->update(
-              workspaceID: '<workspace-id>',
-              externalKeyID: 'ekey_<id>',
-          );
-
-          echo "id: {$workspace->id}\n";
-          echo "external_key_id: {$workspace->externalKeyID}\n";
-          ```
-
-          ```ruby Ruby
-          client = Anthropic::Client.new
-
-          workspace_id = "<workspace-id>"
-          workspace = client.beta.organization.workspaces.update(
-            workspace_id,
-            external_key_id: "ekey_<id>"
-          )
-
-          puts "id: #{workspace.id}"
-          puts "external_key_id: #{workspace.external_key_id}"
-          ```
-        </CodeGroup>
-      </Step>
-    </Steps>
+                  IO.println("id: " + workspace.id());
+                  IO.println("external_key_id: " + workspace.externalKeyId().orElseThrow());
+              }
+              ```
+
+              ```php PHP
+              $client = new Client();
+
+              $workspace = $client->beta->organization->workspaces->update(
+                  workspaceID: '<workspace-id>',
+                  externalKeyID: 'ekey_<id>',
+              );
+
+              echo "id: {$workspace->id}\n";
+              echo "external_key_id: {$workspace->externalKeyID}\n";
+              ```
+
+              ```ruby Ruby
+              client = Anthropic::Client.new
+
+              workspace_id = "<workspace-id>"
+              workspace = client.beta.organization.workspaces.update(
+                workspace_id,
+                external_key_id: "ekey_<id>"
+              )
+
+              puts "id: #{workspace.id}"
+              puts "external_key_id: #{workspace.external_key_id}"
+              ```
+            </CodeGroup>
+          </Step>
+        </Steps>
+      </Tab>
+    </Tabs>
   </Tab>
 
   <Tab title="Claude Enterprise">
diff --git a/content/en/manage-claude/cmek.md b/content/en/manage-claude/cmek.md
index f50f5a34d8..14462403c7 100644
--- a/content/en/manage-claude/cmek.md
+++ b/content/en/manage-claude/cmek.md
@@ -23,7 +23,7 @@ The use of CMEK is optional. Eligible organizations can **opt in** to use custom
 
 ## How it works
 
-Only Organization Admins (on Claude Platform; the Admin role on Claude Platform on AWS) or Owners and the Primary Owner (on Claude Enterprise) can configure CMEK. On Claude Platform, CMEK is scoped per workspace and configured with the Admin API (on Claude Platform on AWS, in the Claude Console or through the IAM-authorized external key and workspace endpoints). On Claude Enterprise, CMEK is scoped per organization and configured in [claude.ai > Organization settings > Data and privacy](https://claude.ai/admin-settings/data-privacy-controls). On either product, CMEK protects data written after your key takes effect. Existing data (prior chats, files, and sessions) remains encrypted with Anthropic-managed keys and is not re-encrypted under your key.
+Only Organization Admins (on Claude Platform; the Admin role on Claude Platform on AWS) or Owners and the Primary Owner (on Claude Enterprise) can configure CMEK. On Claude Platform, CMEK is scoped per workspace and configured in the Claude Console or with the Admin API (on Claude Platform on AWS, in the Claude Console or through the IAM-authorized external key and workspace endpoints). On Claude Enterprise, CMEK is scoped per organization and configured in [claude.ai > Organization settings > Data and privacy](https://claude.ai/admin-settings/data-privacy-controls). On either product, CMEK protects data written after your key takes effect. Existing data (prior chats, files, and sessions) remains encrypted with Anthropic-managed keys and is not re-encrypted under your key.
 
 On Claude Platform, Anthropic recommends attaching your key to a new workspace before you send any requests to that workspace. If you attach a key to a workspace that already receives requests, your key can take up to a day to take effect. Data written before then, like existing data, is encrypted with Anthropic-managed keys and is not re-encrypted.
 
diff --git a/content/en/managed-agents/agent-setup.md b/content/en/managed-agents/agent-setup.md
index 25a3cc429a..52953b6cb3 100644
--- a/content/en/managed-agents/agent-setup.md
+++ b/content/en/managed-agents/agent-setup.md
@@ -465,7 +465,7 @@ With the CLI, edit the agent's file and run `ant apply` again; apply supplies `v
 
 The preceding example supplies `version` from the create response, so the update only applies if nothing else has changed the agent since you read it. To apply an update unconditionally, omit `version` from the request:
 
-<CodeGroup defaultLanguage="cURL">
+<CodeGroup>
   ```bash cURL
   updated_agent=$(curl -fsSL "https://api.anthropic.com/v1/agents/$AGENT_ID" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
@@ -510,7 +510,7 @@ The preceding example supplies `version` from the create response, so the update
 
 Fetch the full version history to track how an agent has changed over time. Results are paginated, and the SDK examples fetch every page automatically.
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   curl -fsSL "https://api.anthropic.com/v1/agents/$AGENT_ID/versions" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
@@ -576,7 +576,7 @@ Fetch the full version history to track how an agent has changed over time. Resu
 
 Archiving makes the agent read-only and cannot be undone. Existing sessions continue to run, but new sessions cannot reference the agent. The response sets `archived_at` to the archive timestamp.
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   archived=$(curl -fsSL -X POST "https://api.anthropic.com/v1/agents/$AGENT_ID/archive" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
diff --git a/content/en/managed-agents/budgets.md b/content/en/managed-agents/budgets.md
index 92e3a37f4b..179a6e6906 100644
--- a/content/en/managed-agents/budgets.md
+++ b/content/en/managed-agents/budgets.md
@@ -14,9 +14,9 @@ A session budget is an optional hard spend ceiling you set when you [create a se
 
 Pass the optional `budget` field when you create the session:
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
-  session=$(curl -sS --fail-with-body https://api.anthropic.com/v1/sessions \
+  curl -sS --fail-with-body https://api.anthropic.com/v1/sessions \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01" \
     -H "anthropic-beta: managed-agents-2026-04-01" \
@@ -31,17 +31,14 @@ Pass the optional `budget` field when you create the session:
     }
   }
   EOF
-  )
-  SESSION_ID=$(jq -r '.id' <<< "$session")
   ```
 
   ```bash CLI
   # Keep the amount quoted so it is sent as a string, not a number.
-  SESSION_ID=$(ant beta:sessions create \
+  ant beta:sessions create \
     --agent "$AGENT_ID" \
     --environment-id "$ENVIRONMENT_ID" \
-    --budget '{type: limit, max_list_cost: {amount: "125", currency: USD}}' \
-    --transform id --raw-output)
+    --budget '{type: limit, max_list_cost: {amount: "125", currency: USD}}'
   ```
 
   ```python Python
@@ -194,7 +191,7 @@ Change or remove the budget with a session update. An accepted update resumes th
 
 Update the session with a new `max_list_cost`. The new value can be higher or lower than the current cap, but it must be strictly greater than the session's consumed list cost; otherwise the update is rejected with a 400 error: `budget.max_list_cost must be greater than the session's consumed list cost`. Because the consumed cost usually sits [a fraction past the old cap](https://platform.claude.com/docs/en/managed-agents/budgets#when-a-session-reaches-its-budget) when the session pauses, base the new value on the session's reported `usage.list_cost`, not on the old `max_list_cost`. Set it a cent or more above that figure: the reported value is rounded and can sit a fraction below the exact consumed cost the check uses.
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   curl -sS --fail-with-body "https://api.anthropic.com/v1/sessions/$SESSION_ID" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
@@ -304,7 +301,7 @@ Update the session with a new `max_list_cost`. The new value can be higher or lo
 
 Set `budget` to `null` to remove the cap entirely. The session's paused work resumes, and the resulting `session.updated` event carries `budget` set to `null`.
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   curl -sS --fail-with-body "https://api.anthropic.com/v1/sessions/$SESSION_ID" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
diff --git a/content/en/managed-agents/define-outcomes.md b/content/en/managed-agents/define-outcomes.md
index 92730b8b48..887c8583aa 100644
--- a/content/en/managed-agents/define-outcomes.md
+++ b/content/en/managed-agents/define-outcomes.md
@@ -56,19 +56,15 @@ Pass the rubric as inline text on `user.define_outcome` (see [Create a session w
 
 <CodeGroup>
   ```bash cURL
-  rubric=$(curl -fsSL https://api.anthropic.com/v1/files \
+  curl -fsSL https://api.anthropic.com/v1/files \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01" \
     -H "anthropic-beta: managed-agents-2026-04-01" \
-    -F file=@/tmp/rubric.md)
-  rubric_id=$(jq -r '.id' <<<"$rubric")
-  printf 'Uploaded rubric: %s\n' "$rubric_id"
+    -F file=@/tmp/rubric.md
   ```
 
   ```bash CLI
-  RUBRIC_ID=$(ant files upload \
-    --file /tmp/rubric.md \
-    --transform id --raw-output)
+  ant files upload --file /tmp/rubric.md
   ```
 
   ```python Python
@@ -297,16 +293,16 @@ The following examples create a [session](https://platform.claude.com/docs/en/ma
     -H "anthropic-beta: managed-agents-2026-04-01" \
     --json @- <<EOF
   {
-    "agent": "$agent_id",
-    "environment_id": "$environment_id",
+    "agent": "$AGENT_ID",
+    "environment_id": "$ENVIRONMENT_ID",
     "title": "Financial analysis on Costco"
   }
   EOF
   )
-  session_id=$(jq -r '.id' <<<"$session")
+  SESSION_ID=$(jq -r '.id' <<<"$session")
 
   # Define the outcome — agent starts working on receipt
-  curl -fsSL "https://api.anthropic.com/v1/sessions/$session_id/events" \
+  curl -fsSL "https://api.anthropic.com/v1/sessions/$SESSION_ID/events" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01" \
     -H "anthropic-beta: managed-agents-2026-04-01" \
@@ -322,7 +318,7 @@ The following examples create a [session](https://platform.claude.com/docs/en/ma
     ]
   }
   EOF
-  # or: "rubric": {"type": "file", "file_id": "$rubric_id"}
+  # or: "rubric": {"type": "file", "file_id": "$RUBRIC_ID"}
   # "max_iterations" is optional; default 3, max 20
   ```
 
@@ -627,18 +623,14 @@ You can either listen on the [event stream](https://platform.claude.com/docs/en/
 
 <CodeGroup>
   ```bash cURL
-  session=$(curl -fsSL "https://api.anthropic.com/v1/sessions/$session_id" \
+  curl -fsSL "https://api.anthropic.com/v1/sessions/$SESSION_ID" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01" \
-    -H "anthropic-beta: managed-agents-2026-04-01")
-
-  jq -r '.outcome_evaluations[] | "\(.outcome_id): \(.result)"' <<<"$session"
-  # outc_01a...: satisfied
+    -H "anthropic-beta: managed-agents-2026-04-01"
   ```
 
   ```bash CLI
-  ant beta:sessions retrieve --session-id "$SESSION_ID" \
-    --transform 'outcome_evaluations' --format yaml
+  ant beta:sessions retrieve --session-id "$SESSION_ID"
   ```
 
   ```python Python
@@ -716,16 +708,18 @@ The agent writes output files to `/mnt/session/outputs/` inside the sandbox. To
   ```bash cURL
   # List files produced by this session
   # scope_id filtering requires the managed-agents beta
-  files=$(curl -fsSL "https://api.anthropic.com/v1/files?scope_id=$session_id" \
+  curl -fsSL "https://api.anthropic.com/v1/files?scope_id=$SESSION_ID" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01" \
-    -H "anthropic-beta: managed-agents-2026-04-01")
-  jq -r '.data[] | "\(.id) \(.filename)"' <<<"$files"
+    -H "anthropic-beta: managed-agents-2026-04-01"
 
   # Download a file
-  file_id=$(jq -r '.data[0].id // empty' <<<"$files")
-  if [[ -n $file_id ]]; then
-    curl -fsSL "https://api.anthropic.com/v1/files/$file_id/content" \
+  FILE_ID=$(curl -fsSL "https://api.anthropic.com/v1/files?scope_id=$SESSION_ID" \
+    -H "x-api-key: $ANTHROPIC_API_KEY" \
+    -H "anthropic-version: 2023-06-01" \
+    -H "anthropic-beta: managed-agents-2026-04-01" | jq -r '.data[0].id // empty')
+  if [[ -n $FILE_ID ]]; then
+    curl -fsSL "https://api.anthropic.com/v1/files/$FILE_ID/content" \
       -H "x-api-key: $ANTHROPIC_API_KEY" \
       -H "anthropic-version: 2023-06-01" \
       -H "anthropic-beta: managed-agents-2026-04-01" \
diff --git a/content/en/managed-agents/dreams.md b/content/en/managed-agents/dreams.md
index ca8b3fea3b..60254cee72 100644
--- a/content/en/managed-agents/dreams.md
+++ b/content/en/managed-agents/dreams.md
@@ -31,7 +31,7 @@ The dream produces another **output memory store**, separate from the input. The
 
 <CodeGroup>
   ```bash cURL
-  dream=$(curl -s https://api.anthropic.com/v1/dreams \
+  curl -s https://api.anthropic.com/v1/dreams \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01" \
     -H "anthropic-beta: managed-agents-2026-04-01,dreaming-2026-04-21" \
@@ -46,13 +46,10 @@ The dream produces another **output memory store**, separate from the input. The
     "instructions": "Focus on coding-style preferences; ignore one-off debugging notes."
   }
   EOF
-  )
-  dream_id=$(jq -r '.id' <<< "$dream")
-  echo "$dream_id"  # drm_01...
   ```
 
   ```bash CLI
-  dream_id=$(ant beta:dreams create --transform id --raw-output <<YAML
+  ant beta:dreams create <<YAML
   inputs:
     - type: memory_store
       memory_store_id: $store_id
@@ -61,7 +58,6 @@ The dream produces another **output memory store**, separate from the input. The
   model: claude-opus-4-8
   instructions: Focus on coding-style preferences; ignore one-off debugging notes.
   YAML
-  )
   ```
 
   ```python Python
diff --git a/content/en/managed-agents/environments.md b/content/en/managed-agents/environments.md
index b9c1791217..dbd9cad7c7 100644
--- a/content/en/managed-agents/environments.md
+++ b/content/en/managed-agents/environments.md
@@ -16,7 +16,7 @@ This page covers `type: cloud` environments. To run sandboxes on your own infras
 
 <CodeGroup defaultLanguage="CLI">
   ```bash cURL
-  environment=$(curl -fsS https://api.anthropic.com/v1/environments \
+  curl -fsS https://api.anthropic.com/v1/environments \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01" \
     -H "anthropic-beta: managed-agents-2026-04-01" \
@@ -30,10 +30,6 @@ This page covers `type: cloud` environments. To run sandboxes on your own infras
     }
   }
   EOF
-  )
-  environment_id=$(jq -r '.id' <<< "$environment")
-
-  echo "Environment ID: $environment_id"
   ```
 
   <MultiFileExample language="cli" label="CLI">
@@ -144,20 +140,19 @@ Use a unique, descriptive `name` so you can tell environments apart.
 
 Pass the environment ID as a string when [creating a session](https://platform.claude.com/docs/en/managed-agents/sessions).
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
-  session=$(curl -fsS https://api.anthropic.com/v1/sessions \
+  curl -fsS https://api.anthropic.com/v1/sessions \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01" \
     -H "anthropic-beta: managed-agents-2026-04-01" \
     -H "content-type: application/json" \
     --data @- <<EOF
   {
-    "agent": "$agent_id",
-    "environment_id": "$environment_id"
+    "agent": "$AGENT_ID",
+    "environment_id": "$ENVIRONMENT_ID"
   }
   EOF
-  )
   ```
 
   ```bash CLI
@@ -228,7 +223,7 @@ The `packages` field pre-installs packages into the sandbox before the agent sta
 
 <CodeGroup defaultLanguage="CLI">
   ```bash cURL
-  environment=$(curl -fsS https://api.anthropic.com/v1/environments \
+  curl -fsS https://api.anthropic.com/v1/environments \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01" \
     -H "anthropic-beta: managed-agents-2026-04-01" \
@@ -246,7 +241,6 @@ The `packages` field pre-installs packages into the sandbox before the agent sta
     }
   }
   EOF
-  )
   ```
 
   <MultiFileExample language="cli" label="CLI">
@@ -581,28 +575,28 @@ When using `limited` networking:
 
 ## Manage environments
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   # List environments
-  environments=$(curl -fsS https://api.anthropic.com/v1/environments \
+  curl -fsS https://api.anthropic.com/v1/environments \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01" \
-    -H "anthropic-beta: managed-agents-2026-04-01")
+    -H "anthropic-beta: managed-agents-2026-04-01"
 
   # Retrieve a specific environment
-  env=$(curl -fsS "https://api.anthropic.com/v1/environments/$environment_id" \
+  curl -fsS "https://api.anthropic.com/v1/environments/$ENVIRONMENT_ID" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01" \
-    -H "anthropic-beta: managed-agents-2026-04-01")
+    -H "anthropic-beta: managed-agents-2026-04-01"
 
   # Archive an environment (read-only, existing sessions continue)
-  curl -fsS -X POST "https://api.anthropic.com/v1/environments/$environment_id/archive" \
+  curl -fsS -X POST "https://api.anthropic.com/v1/environments/$ENVIRONMENT_ID/archive" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01" \
     -H "anthropic-beta: managed-agents-2026-04-01"
 
   # Delete an environment (only if no sessions reference it)
-  curl -fsS -X DELETE "https://api.anthropic.com/v1/environments/$environment_id" \
+  curl -fsS -X DELETE "https://api.anthropic.com/v1/environments/$ENVIRONMENT_ID" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01" \
     -H "anthropic-beta: managed-agents-2026-04-01"
diff --git a/content/en/managed-agents/events-and-streaming.md b/content/en/managed-agents/events-and-streaming.md
index 02398f2a78..82107e69bd 100644
--- a/content/en/managed-agents/events-and-streaming.md
+++ b/content/en/managed-agents/events-and-streaming.md
@@ -920,13 +920,11 @@ Every persisted event includes a `processed_at` timestamp set when the event fin
         -H "x-api-key: $ANTHROPIC_API_KEY" \
         -H "anthropic-version: 2023-06-01" \
         -H "anthropic-beta: managed-agents-2026-04-01" \
-        -H "content-type: application/json" \
-        | jq -r '.data[] | "[\(.type)] \(.processed_at)"'
+        -H "content-type: application/json"
       ```
 
       ```bash CLI
-      ant beta:sessions:events list --session-id "$SESSION_ID" \
-        --format jsonl --transform '{type,processed_at}'
+      ant beta:sessions:events list --session-id "$SESSION_ID" --format jsonl
       ```
 
       ```python Python
@@ -991,14 +989,13 @@ Every persisted event includes a `processed_at` timestamp set when the event fin
       curl --fail-with-body -sS "https://api.anthropic.com/v1/sessions/$SESSION_ID/events?beta=true&types[]=agent.tool_use&types[]=agent.tool_result" \
         -H "x-api-key: $ANTHROPIC_API_KEY" \
         -H "anthropic-version: 2023-06-01" \
-        -H "anthropic-beta: managed-agents-2026-04-01" \
-        | jq -r '.data[] | "[\(.type)] \(.processed_at)"'
+        -H "anthropic-beta: managed-agents-2026-04-01"
       ```
 
       ```bash CLI
       ant beta:sessions:events list --session-id "$SESSION_ID" \
         --type agent.tool_use --type agent.tool_result \
-        --format jsonl --transform '{type,processed_at}'
+        --format jsonl
       ```
 
       ```python Python
@@ -1585,7 +1582,7 @@ The thread stream's path is easy to get wrong: it is `/threads/{thread_id}/strea
 
 The preview events themselves don't change. `event_start` and `event_delta` have the same shape on a thread stream as on the session-level stream, and the [accumulate and reconcile](https://platform.claude.com/docs/en/managed-agents/events-and-streaming#accumulate-and-reconcile) pattern applies as written. The one adjustment is bookkeeping: run one accumulator instance per stream connection.
 
-<CodeGroup defaultLanguage="cURL">
+<CodeGroup>
   ```bash cURL
   # List the session's threads and pick a child: child threads carry a non-null
   # parent_thread_id, and the primary thread's parent_thread_id is null.
@@ -2459,7 +2456,7 @@ Sessions persist between interactions. Conversation history is preserved unless
 
 To resume a session, send a `user.message` event to it as usual:
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   # In production, pass the stored ID of the session you want to resume.
   curl --fail-with-body -sS "https://api.anthropic.com/v1/sessions/$SESSION_ID/events?beta=true" \
@@ -2643,7 +2640,7 @@ No event resumes a session paused at its cap. Instead, update the session's budg
 
 Send a `system.message` event to give the agent privileged system-level context that applies to the accompanying turn and all subsequent turns. Unlike the `system` field on the agent definition (which sets the top-level system prompt), `system.message` content is appended to the session's system context as a `role: "system"` turn rather than replacing that prompt. Use it when the agent needs updated system-level guidance mid-session: a different persona, revised constraints, or context fetched at runtime that should shape the model's behavior going forward.
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   curl --fail-with-body -sS "https://api.anthropic.com/v1/sessions/$SESSION_ID/events?beta=true" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
diff --git a/content/en/managed-agents/files.md b/content/en/managed-agents/files.md
index a4120d1477..6210084cda 100644
--- a/content/en/managed-agents/files.md
+++ b/content/en/managed-agents/files.md
@@ -19,8 +19,7 @@ First, upload a file using the [Files API](https://platform.claude.com/docs/en/b
   file=$(curl --fail-with-body -sS "${auth[@]}" \
     "${base_url}/files" \
     -F file=@data.csv)
-  file_id=$(jq -er '.id' <<<"${file}")
-  printf 'File ID: %s\n' "${file_id}"
+  FILE_ID=$(jq -er '.id' <<<"${file}")
   ```
 
   ```bash CLI
@@ -91,37 +90,32 @@ Mount uploaded files into the sandbox by adding them to the `resources` array wh
 
 <CodeGroup>
   ```bash cURL
-  session=$(
-    jq -n \
-      --arg agent_id "${agent_id}" \
-      --arg environment_id "${environment_id}" \
-      --arg file_id "${file_id}" \
-      '{
-        agent: $agent_id,
-        environment_id: $environment_id,
-        resources: [
-          {
-            type: "file",
-            file_id: $file_id,
-            mount_path: "/data.csv"
-          }
-        ]
-      }' | curl --fail-with-body -sS "${auth[@]}" "${base_url}/sessions" --json @-
-  )
-  session_id=$(jq -er '.id' <<<"${session}")
+  jq -n \
+    --arg agent_id "${AGENT_ID}" \
+    --arg environment_id "${ENVIRONMENT_ID}" \
+    --arg file_id "${FILE_ID}" \
+    '{
+      agent: $agent_id,
+      environment_id: $environment_id,
+      resources: [
+        {
+          type: "file",
+          file_id: $file_id,
+          mount_path: "/data.csv"
+        }
+      ]
+    }' | curl --fail-with-body -sS "${auth[@]}" "${base_url}/sessions" --json @-
   ```
 
   ```bash CLI
-  SESSION_ID=$(ant beta:sessions create \
+  ant beta:sessions create \
     --agent "$AGENT_ID" \
-    --environment-id "$ENVIRONMENT_ID" \
-    --transform id --raw-output <<EOF
+    --environment-id "$ENVIRONMENT_ID" <<EOF
   resources:
     - type: file
       file_id: $FILE_ID
       mount_path: /data.csv
   EOF
-  )
   ```
 
   ```python Python
@@ -368,21 +362,16 @@ You can add or remove files from a session after creation using the session reso
 
 <CodeGroup>
   ```bash cURL
-  resource=$(
-    jq -n --arg file_id "${file_id}" '{type: "file", file_id: $file_id}' \
-      | curl --fail-with-body -sS "${auth[@]}" \
-          "${base_url}/sessions/${session_id}/resources" --json @-
-  )
-  resource_id=$(jq -er '.id' <<<"${resource}")
-  printf '%s\n' "${resource_id}"  # "sesrsc_01ABC..."
+  jq -n --arg file_id "${FILE_ID}" '{type: "file", file_id: $file_id}' \
+    | curl --fail-with-body -sS "${auth[@]}" \
+        "${base_url}/sessions/${SESSION_ID}/resources" --json @-
   ```
 
   ```bash CLI
-  RESOURCE_ID=$(ant beta:sessions:resources add \
+  ant beta:sessions:resources add \
     --session-id "$SESSION_ID" \
     --type file \
-    --file-id "$FILE_ID" \
-    --transform id --raw-output)
+    --file-id "$FILE_ID"
   ```
 
   ```python Python
@@ -466,11 +455,10 @@ List all resources on a session with `resources.list`. To remove a file, call `r
 <CodeGroup>
   ```bash cURL
   curl --fail-with-body -sS "${auth[@]}" \
-    "${base_url}/sessions/${session_id}/resources" \
-    | jq -r '.data[] | "\(.id) \(.type)"'
+    "${base_url}/sessions/${SESSION_ID}/resources"
 
   curl --fail-with-body -sS "${auth[@]}" -X DELETE \
-    "${base_url}/sessions/${session_id}/resources/${resource_id}" >/dev/null
+    "${base_url}/sessions/${SESSION_ID}/resources/${RESOURCE_ID}" >/dev/null
   ```
 
   ```bash CLI
diff --git a/content/en/managed-agents/memory.md b/content/en/managed-agents/memory.md
index e01bf71777..180b01a90b 100644
--- a/content/en/managed-agents/memory.md
+++ b/content/en/managed-agents/memory.md
@@ -28,23 +28,20 @@ Every change to a memory creates an immutable **memory version**, giving you an
 
 Give the store a `name` and a `description`. The description is passed to the agent, telling it what the store contains.
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
-  store=$(curl -s https://api.anthropic.com/v1/memory_stores \
+  curl -s https://api.anthropic.com/v1/memory_stores \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01" \
     -H "anthropic-beta: agent-memory-2026-07-22" \
     -H "content-type: application/json" \
-    -d '{"name": "User Preferences", "description": "Per-user preferences and project context."}')
-  store_id=$(jq -r '.id' <<< "$store")
-  echo "$store_id"  # memstore_01Hx...
+    -d '{"name": "User Preferences", "description": "Per-user preferences and project context."}'
   ```
 
   ```bash CLI
-  store_id=$(ant beta:memory-stores create \
+  ant beta:memory-stores create \
     --name "User Preferences" \
-    --description "Per-user preferences and project context." \
-    --transform id --raw-output)
+    --description "Per-user preferences and project context."
   ```
 
   ```python Python
@@ -124,7 +121,7 @@ The memory store `id` (`memstore_...`) is what you pass when attaching the store
 
 Pre-load a store with reference material before any agent runs:
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   curl -s "https://api.anthropic.com/v1/memory_stores/$store_id/memories" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
@@ -214,7 +211,7 @@ Optionally include `instructions` to provide session-specific guidance for how t
 
 You can configure `access` as well. It defaults to `read_write` (shown explicitly in the following example), but `read_only` is also supported.
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   curl -s https://api.anthropic.com/v1/sessions \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
@@ -400,12 +397,12 @@ List the memories in a store. Results are returned in a stable, server-defined o
 * `path_prefix` scopes the list to one directory. It must end with `/` and matches whole path segments, so `path_prefix=/notes/` returns `/notes/todo.md` but not `/notes-archive/todo.md`.
 * `depth` controls how deep the listing goes below `path_prefix`: omit it (or pass `0`) to list the whole subtree, or pass `1` to list only the immediate children. Other values return a `400` error.
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   curl -s "https://api.anthropic.com/v1/memory_stores/$store_id/memories?path_prefix=/" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01" \
-    -H "anthropic-beta: agent-memory-2026-07-22" | jq -r '.data[] | "\(.type)  \(.path)"'
+    -H "anthropic-beta: agent-memory-2026-07-22"
   ```
 
   ```bash CLI
@@ -496,12 +493,12 @@ See the [List memories reference](https://platform.claude.com/docs/en/api/beta/m
 
 Fetching an individual memory returns the full content.
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   curl -s "https://api.anthropic.com/v1/memory_stores/$store_id/memories/$mem_id" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01" \
-    -H "anthropic-beta: agent-memory-2026-07-22" | jq -r '.content'
+    -H "anthropic-beta: agent-memory-2026-07-22"
   ```
 
   ```bash CLI
@@ -571,26 +568,21 @@ See the [Retrieve a memory reference](https://platform.claude.com/docs/en/api/be
 
 `memories.create` creates a memory at a given `path`. Create does not overwrite; to change an existing memory, use [`memories.update`](https://platform.claude.com/docs/en/managed-agents/memory#update-a-memory).
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
-  mem=$(curl -s "https://api.anthropic.com/v1/memory_stores/$store_id/memories" \
+  curl -s "https://api.anthropic.com/v1/memory_stores/$store_id/memories" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01" \
     -H "anthropic-beta: agent-memory-2026-07-22" \
     -H "content-type: application/json" \
-    -d '{"path": "/preferences/formatting.md", "content": "Always use tabs, not spaces."}')
-  mem_id=$(jq -r '.id' <<< "$mem")
-  mem_sha=$(jq -r '.content_sha256' <<< "$mem")
+    -d '{"path": "/preferences/formatting.md", "content": "Always use tabs, not spaces."}'
   ```
 
   ```bash CLI
-  mem=$(ant beta:memory-stores:memories create \
+  ant beta:memory-stores:memories create \
     --memory-store-id "$store_id" \
     --path "/preferences/formatting.md" \
-    --content "Always use tabs, not spaces." \
-    --format json)
-  mem_id=$(jq -r '.id' <<< "$mem")
-  mem_sha=$(jq -r '.content_sha256' <<< "$mem")
+    --content "Always use tabs, not spaces."
   ```
 
   ```python Python
@@ -659,7 +651,7 @@ See the [Create a memory reference](https://platform.claude.com/docs/en/api/beta
 
 `memories.update` modifies an existing memory by ID. You can change `content`, `path` (a rename), or both. The example renames a memory to an archive path:
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   curl -s -X POST "https://api.anthropic.com/v1/memory_stores/$store_id/memories/$mem_id" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
@@ -743,7 +735,7 @@ See the [Update a memory reference](https://platform.claude.com/docs/en/api/beta
 
 To avoid clobbering a concurrent write, pass a `content_sha256` precondition. The update only applies if the stored content hash still matches the one you read; on mismatch, re-read the memory and retry against the fresh state.
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   curl -s -X POST "https://api.anthropic.com/v1/memory_stores/$store_id/memories/$mem_id" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
@@ -848,7 +840,7 @@ To avoid clobbering a concurrent write, pass a `content_sha256` precondition. Th
 
 ### Delete a memory
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   curl -s -X DELETE "https://api.anthropic.com/v1/memory_stores/$store_id/memories/$mem_id" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
@@ -927,24 +919,19 @@ Past memory versions might be deleted after 30 days. To preserve memory history
 
 List version history for a store, newest first. The example filters to a single memory's history:
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
-  versions=$(curl -s "https://api.anthropic.com/v1/memory_stores/$store_id/memory_versions?memory_id=$mem_id" \
+  curl -s "https://api.anthropic.com/v1/memory_stores/$store_id/memory_versions?memory_id=$mem_id" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01" \
-    -H "anthropic-beta: agent-memory-2026-07-22")
-  jq -r '.data[] | "\(.id): \(.operation)"' <<< "$versions"
-  version_id=$(jq -r '.data[1].id' <<< "$versions")
+    -H "anthropic-beta: agent-memory-2026-07-22"
   ```
 
   ```bash CLI
-  versions=$(ant beta:memory-stores:memory-versions list \
+  ant beta:memory-stores:memory-versions list \
     --memory-store-id "$store_id" \
     --memory-id "$mem_id" \
-    --format json)
-  # `list --format json` emits one JSON object per item.
-  jq -r '"\(.id): \(.operation)"' <<< "$versions"
-  version_id=$(jq -rs '.[1].id' <<< "$versions")
+    --format json
   ```
 
   ```python Python
@@ -1048,7 +1035,7 @@ See the [List memory versions reference](https://platform.claude.com/docs/en/api
 
 Fetching an individual version returns the same fields as the list response plus the full `content` body.
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   curl -s "https://api.anthropic.com/v1/memory_stores/$store_id/memory_versions/$version_id" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
@@ -1128,7 +1115,7 @@ Redact scrubs content out of a historical version while preserving the audit tra
 
 A version that is the current head of a live memory cannot be redacted. Write a new version first (or delete the memory), then redact the old one.
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   curl -s -X POST "https://api.anthropic.com/v1/memory_stores/$store_id/memory_versions/$version_id/redact" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
@@ -1205,12 +1192,12 @@ In addition to [`create`](https://platform.claude.com/docs/en/api/beta/memory_st
 
 List stores in the workspace. Archived stores are excluded by default; pass `include_archived: true` to include them.
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   curl -s "https://api.anthropic.com/v1/memory_stores?include_archived=true" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01" \
-    -H "anthropic-beta: agent-memory-2026-07-22" | jq '.data[] | {id, name, archived_at}'
+    -H "anthropic-beta: agent-memory-2026-07-22"
   ```
 
   ```bash CLI
@@ -1278,7 +1265,7 @@ See the [List memory stores reference](https://platform.claude.com/docs/en/api/b
 
 Archiving makes a store read-only and prevents it from being attached to new sessions. Archiving is one-way; there is no unarchive.
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   curl -s -X POST "https://api.anthropic.com/v1/memory_stores/$store_id/archive" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
diff --git a/content/en/managed-agents/multiagent-orchestration.md b/content/en/managed-agents/multiagent-orchestration.md
index d740929b11..9faff16115 100644
--- a/content/en/managed-agents/multiagent-orchestration.md
+++ b/content/en/managed-agents/multiagent-orchestration.md
@@ -415,7 +415,9 @@ MCP servers are agent-scoped (each agent definition declares its own servers and
 
 [Agent configuration overrides](https://platform.claude.com/docs/en/managed-agents/sessions#override-agent-configuration-for-a-session) at session creation can replace the coordinator's MCP servers and those of its `self` copies.
 
-<CodeGroup>
+Create the researcher, which declares the GitHub MCP server, and the coordinator that delegates to the researcher:
+
+<CodeGroup defaultLanguage="CLI">
   ```bash cURL
   research_agent_id=$(curl --fail-with-body -sS "$BASE/v1/agents" "${H[@]}" --data @- <<'EOF' | jq -er '.id'
   {
@@ -439,16 +441,6 @@ MCP servers are agent-scoped (each agent definition declares its own servers and
   }
   EOF
   )
-
-  session_id=$(curl --fail-with-body -sS "$BASE/v1/sessions" "${H[@]}" --data @- <<EOF | jq -er '.id'
-  {
-    "agent": "$coordinator_id",
-    "environment_id": "$environment_id",
-    "vault_ids": ["$vault_id"]
-  }
-  EOF
-  )
-  echo "$session_id"
   ```
 
   <MultiFileExample language="cli" label="CLI">
@@ -486,15 +478,6 @@ MCP servers are agent-scoped (each agent definition declares its own servers and
       ---
       ```
     </File>
-
-    ```bash CLI
-    session_id=$(ant beta:sessions create \
-      --agent "$coordinator_id" \
-      --environment-id "$environment_id" \
-      --vault-id "$vault_id" \
-      --transform id --raw-output)
-    echo "$session_id"
-    ```
   </MultiFileExample>
 
   ```python Python
@@ -516,13 +499,6 @@ MCP servers are agent-scoped (each agent definition declares its own servers and
           "agents": [{"type": "agent", "id": research_agent.id}],
       },
   )
-
-  session = client.beta.sessions.create(
-      agent=coordinator.id,
-      environment_id=environment.id,
-      vault_ids=[vault.id],
-  )
-  print(session.id)
   ```
 
   ```typescript TypeScript
@@ -544,13 +520,6 @@ MCP servers are agent-scoped (each agent definition declares its own servers and
       agents: [{ type: "agent", id: researchAgent.id }],
     },
   });
-
-  const session = await client.beta.sessions.create({
-    agent: coordinator.id,
-    environment_id: environment.id,
-    vault_ids: [vault.id],
-  });
-  console.log(session.id);
   ```
 
   ```csharp C#
@@ -601,14 +570,6 @@ MCP servers are agent-scoped (each agent definition declares its own servers and
           ],
       },
   });
-
-  var session = await client.Beta.Sessions.Create(new()
-  {
-      Agent = coordinator.ID,
-      EnvironmentID = environment.ID,
-      VaultIds = [vault.ID],
-  });
-  Console.WriteLine(session.ID);
   ```
 
   ```go Go
@@ -652,18 +613,6 @@ MCP servers are agent-scoped (each agent definition declares its own servers and
   if err != nil {
   	panic(err)
   }
-
-  session, err := client.Beta.Sessions.New(ctx, anthropic.BetaSessionNewParams{
-  	Agent: anthropic.BetaSessionNewParamsAgentUnion{
-  		OfString: anthropic.String(coordinator.ID),
-  	},
-  	EnvironmentID: environment.ID,
-  	VaultIDs:      []string{vault.ID},
-  })
-  if err != nil {
-  	panic(err)
-  }
-  fmt.Println(session.ID)
   ```
 
   ```java Java
@@ -699,13 +648,6 @@ MCP servers are agent-scoped (each agent definition declares its own servers and
               .build())
           .build()
   );
-
-  var session = client.beta().sessions().create(SessionCreateParams.builder()
-      .agent(coordinator.id())
-      .environmentId(environment.id())
-      .vaultIds(List.of(vault.id()))
-      .build());
-  IO.println(session.id());
   ```
 
   ```php PHP
@@ -733,13 +675,6 @@ MCP servers are agent-scoped (each agent definition declares its own servers and
           ],
       ],
   );
-
-  $session = $client->beta->sessions->create(
-      agent: $coordinator->id,
-      environmentID: $environment->id,
-      vaultIDs: [$vault->id],
-  );
-  echo "{$session->id}\n";
   ```
 
   ```ruby Ruby
@@ -767,7 +702,94 @@ MCP servers are agent-scoped (each agent definition declares its own servers and
       ]
     }
   )
+  ```
+</CodeGroup>
+
+Then create the session with the vault that holds the GitHub credential:
 
+<CodeGroup>
+  ```bash cURL
+  session_id=$(curl --fail-with-body -sS "$BASE/v1/sessions" "${H[@]}" --data @- <<EOF | jq -er '.id'
+  {
+    "agent": "$coordinator_id",
+    "environment_id": "$environment_id",
+    "vault_ids": ["$vault_id"]
+  }
+  EOF
+  )
+  echo "$session_id"
+  ```
+
+  ```bash CLI
+  session_id=$(ant beta:sessions create \
+    --agent "$coordinator_id" \
+    --environment-id "$environment_id" \
+    --vault-id "$vault_id" \
+    --transform id --raw-output)
+  echo "$session_id"
+  ```
+
+  ```python Python
+  session = client.beta.sessions.create(
+      agent=coordinator.id,
+      environment_id=environment.id,
+      vault_ids=[vault.id],
+  )
+  print(session.id)
+  ```
+
+  ```typescript TypeScript
+  const session = await client.beta.sessions.create({
+    agent: coordinator.id,
+    environment_id: environment.id,
+    vault_ids: [vault.id],
+  });
+  console.log(session.id);
+  ```
+
+  ```csharp C#
+  var session = await client.Beta.Sessions.Create(new()
+  {
+      Agent = coordinator.ID,
+      EnvironmentID = environment.ID,
+      VaultIds = [vault.ID],
+  });
+  Console.WriteLine(session.ID);
+  ```
+
+  ```go Go
+  session, err := client.Beta.Sessions.New(ctx, anthropic.BetaSessionNewParams{
+  	Agent: anthropic.BetaSessionNewParamsAgentUnion{
+  		OfString: anthropic.String(coordinator.ID),
+  	},
+  	EnvironmentID: environment.ID,
+  	VaultIDs:      []string{vault.ID},
+  })
+  if err != nil {
+  	panic(err)
+  }
+  fmt.Println(session.ID)
+  ```
+
+  ```java Java
+  var session = client.beta().sessions().create(SessionCreateParams.builder()
+      .agent(coordinator.id())
+      .environmentId(environment.id())
+      .vaultIds(List.of(vault.id()))
+      .build());
+  IO.println(session.id());
+  ```
+
+  ```php PHP
+  $session = $client->beta->sessions->create(
+      agent: $coordinator->id,
+      environmentID: $environment->id,
+      vaultIDs: [$vault->id],
+  );
+  echo "{$session->id}\n";
+  ```
+
+  ```ruby Ruby
   session = client.beta.sessions.create(
     agent: coordinator.id,
     environment_id: environment.id,
diff --git a/content/en/managed-agents/onboarding.md b/content/en/managed-agents/onboarding.md
index 7d811ecd8d..438c7351ae 100644
--- a/content/en/managed-agents/onboarding.md
+++ b/content/en/managed-agents/onboarding.md
@@ -32,9 +32,9 @@ Once your agent works as expected:
 1. Copy the agent ID and [environment ID](https://platform.claude.com/docs/en/managed-agents/environments) from Console.
 2. Reference them in your code when [creating sessions](https://platform.claude.com/docs/en/managed-agents/sessions):
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
-  session=$(curl -fsSL https://api.anthropic.com/v1/sessions \
+  curl -fsSL https://api.anthropic.com/v1/sessions \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01" \
     -H "anthropic-beta: managed-agents-2026-04-01" \
@@ -43,7 +43,7 @@ Once your agent works as expected:
       "agent": "agent_01J8XkN5uT3vHpLqRfWdY2",
       "environment_id": "env_01K2mPsT7hNwR4jXuLvCqD8",
       "title": "My first session"
-    }')
+    }'
   ```
 
   ```bash CLI
diff --git a/content/en/managed-agents/permission-policies.md b/content/en/managed-agents/permission-policies.md
index 0bb1b62ea2..3aa0252acd 100644
--- a/content/en/managed-agents/permission-policies.md
+++ b/content/en/managed-agents/permission-policies.md
@@ -475,7 +475,7 @@ This example connects a GitHub MCP server and allows its tools to run without co
 
 Use the `configs` array to override the default for individual tools. The `name` values for the agent toolset are listed in [Available tools](https://platform.claude.com/docs/en/managed-agents/tools#available-tools). This example allows the full agent toolset by default but requires confirmation before any bash command runs:
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   tools='[
     {
@@ -1075,7 +1075,7 @@ To answer interactively instead, use `ant beta:sessions connect`, which shows th
 
 In the following examples, the tool-use event IDs come from the `stop_reason.event_ids` array of the `session.status_idle` event. Learn more about receiving events in the [Session event stream](https://platform.claude.com/docs/en/managed-agents/events-and-streaming#integrating-events) guide, or [subscribe to webhooks](https://platform.claude.com/docs/en/managed-agents/webhooks) to be notified when a session pauses for input.
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   # Allow the tool to execute
   curl -fsSL "https://api.anthropic.com/v1/sessions/$SESSION_ID/events" \
diff --git a/content/en/managed-agents/scheduled-deployments.md b/content/en/managed-agents/scheduled-deployments.md
index 156dc9f651..bd25f032aa 100644
--- a/content/en/managed-agents/scheduled-deployments.md
+++ b/content/en/managed-agents/scheduled-deployments.md
@@ -20,15 +20,14 @@ When creating a deployment, you pass the [session configurations](https://platfo
 * Deployments also require at least one initial event, a `user.message` or `user.define_outcome`, that starts each session's work.
 * In the `schedule`, you define a cron `expression` and a `timezone`. Maximum granularity supported is at the minute level.
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
-  DEPLOYMENT_ID=$(
-    curl --fail-with-body -sS "https://api.anthropic.com/v1/deployments?beta=true" \
-      -H "x-api-key: $ANTHROPIC_API_KEY" \
-      -H "anthropic-version: 2023-06-01" \
-      -H "anthropic-beta: managed-agents-2026-04-01" \
-      -H "content-type: application/json" \
-      -d @- <<EOF | jq -er '.id'
+  curl --fail-with-body -sS "https://api.anthropic.com/v1/deployments?beta=true" \
+    -H "x-api-key: $ANTHROPIC_API_KEY" \
+    -H "anthropic-version: 2023-06-01" \
+    -H "anthropic-beta: managed-agents-2026-04-01" \
+    -H "content-type: application/json" \
+    -d @- <<EOF
   {
     "name": "Weekly compliance scan",
     "agent": "$AGENT_ID",
@@ -43,11 +42,10 @@ When creating a deployment, you pass the [session configurations](https://platfo
     }
   }
   EOF
-  )
   ```
 
   ```bash CLI
-  DEPLOYMENT_ID=$(ant beta:deployments create <<YAML | jq -er '.id'
+  ant beta:deployments create <<YAML
   name: Weekly compliance scan
   agent: $AGENT_ID
   environment_id: $ENVIRONMENT_ID
@@ -61,7 +59,6 @@ When creating a deployment, you pass the [session configurations](https://platfo
     expression: "0 20 * * 5"
     timezone: America/New_York
   YAML
-  )
   ```
 
   ```python Python
@@ -290,7 +287,7 @@ Successful deployments generate active sessions, and a successful deployment run
 
 List all deployment runs for a deployment as follows:
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   curl --fail-with-body -sS "https://api.anthropic.com/v1/deployment_runs?beta=true&deployment_id=$DEPLOYMENT_ID" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
@@ -379,7 +376,7 @@ List all deployment runs for a deployment as follows:
 
 You can additionally filter on deployment runs with errors:
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   curl --fail-with-body -sS "https://api.anthropic.com/v1/deployment_runs?beta=true&deployment_id=$DEPLOYMENT_ID&has_error=true" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
@@ -489,7 +486,7 @@ Each lifecycle change emits a [webhook event](https://platform.claude.com/docs/e
 
 **Pause** suppresses scheduled triggers on a go-forward basis; running sessions from a prior deployment run continue to execute. Manual runs through the `run` endpoint are still allowed while paused. Pausing sets `paused_reason` to `{"type": "manual"}`; unpausing clears it.
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   curl --fail-with-body -sS -X POST "https://api.anthropic.com/v1/deployments/$DEPLOYMENT_ID/pause?beta=true" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
@@ -534,7 +531,7 @@ Each lifecycle change emits a [webhook event](https://platform.claude.com/docs/e
 
 **Unpause** resumes the schedule from the next scheduled occurrence. Missed triggers are not backfilled.
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   curl --fail-with-body -sS -X POST "https://api.anthropic.com/v1/deployments/$DEPLOYMENT_ID/unpause?beta=true" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
@@ -579,7 +576,7 @@ Each lifecycle change emits a [webhook event](https://platform.claude.com/docs/e
 
 **Archive**, unlike **pause**, is terminal: the schedule terminates and the deployment cannot be modified.
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   curl --fail-with-body -sS -X POST "https://api.anthropic.com/v1/deployments/$DEPLOYMENT_ID/archive?beta=true" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
@@ -632,7 +629,7 @@ If a deployment's agent has been archived, the deployment is automatically archi
 
 To run a deployment outside its schedule, call the [`run` endpoint](https://platform.claude.com/docs/en/api/beta/deployments/run). This creates a session immediately and writes a deployment run with `trigger_context.type: "manual"`. This allows you to test a deployment before committing to the schedule.
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   curl --fail-with-body -sS -X POST "https://api.anthropic.com/v1/deployments/$DEPLOYMENT_ID/run?beta=true" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
diff --git a/content/en/managed-agents/self-hosted-sandboxes.md b/content/en/managed-agents/self-hosted-sandboxes.md
index 677ae66983..ec2c6bbb3f 100644
--- a/content/en/managed-agents/self-hosted-sandboxes.md
+++ b/content/en/managed-agents/self-hosted-sandboxes.md
@@ -74,7 +74,7 @@ You need:
 
     Or through the API:
 
-    <CodeGroup>
+    <CodeGroup defaultLanguage="CLI">
       ```bash cURL
       curl -sS --fail-with-body https://api.anthropic.com/v1/environments \
         -H "x-api-key: $ANTHROPIC_API_KEY" \
diff --git a/content/en/managed-agents/session-operations.md b/content/en/managed-agents/session-operations.md
index cc60ea447a..3ab1c090e8 100644
--- a/content/en/managed-agents/session-operations.md
+++ b/content/en/managed-agents/session-operations.md
@@ -31,7 +31,7 @@ The semantics of a `tools` or `mcp_servers` update are full replacement: the pro
 
 The session must be `idle` to update the agent. To update the agent while the session is running, send a [`user.interrupt` event](https://platform.claude.com/docs/en/managed-agents/events-and-streaming#integrating-events) by itself and wait for the session to become `idle`.
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   curl -sS --fail-with-body "https://api.anthropic.com/v1/sessions/$SESSION_ID" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
@@ -217,13 +217,12 @@ A session [created with a budget](https://platform.claude.com/docs/en/managed-ag
 
 ## Retrieving a session
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
-  retrieved=$(curl -fsSL "https://api.anthropic.com/v1/sessions/$SESSION_ID" \
+  curl -fsSL "https://api.anthropic.com/v1/sessions/$SESSION_ID" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01" \
-    -H "anthropic-beta: managed-agents-2026-04-01")
-  echo "Status: $(jq -r '.status' <<< "$retrieved")"
+    -H "anthropic-beta: managed-agents-2026-04-01"
   ```
 
   ```bash CLI
@@ -277,7 +276,7 @@ To go back a page, pass `prev_page` as the `page` parameter. `prev_page` is `nul
 
 A `page` cursor is opaque and encodes the `order` of the request that produced it. The `order` query parameter sets the sort direction of the results, `asc` or `desc` by creation time; the default is `desc` (newest first). Reusing a cursor with a different `order` returns a 400 error, as does changing a `created_at` filter so that it excludes the cursor's position. Other query parameters, including the remaining filters and `limit`, can change between paginated requests. For the pagination fields shared across list endpoints, see [Pagination](https://platform.claude.com/docs/en/api/overview#pagination).
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   first_page=$(curl -sS --fail-with-body \
     "https://api.anthropic.com/v1/sessions?agent_id=$AGENT_ID&limit=1" \
@@ -534,7 +533,7 @@ A `page` cursor is opaque and encodes the `order` of the request that produced i
 
 Archive a session to prevent new events from being sent while preserving its history. A `running` session cannot be archived; to archive one, send a [`user.interrupt` event](https://platform.claude.com/docs/en/managed-agents/events-and-streaming#integrating-events) by itself and wait for the session to become `idle`.
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   curl -fsSL -X POST "https://api.anthropic.com/v1/sessions/$SESSION_ID/archive" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
@@ -585,7 +584,7 @@ Delete a session to permanently remove its record, events, and associated sandbo
 
 Memory stores, vaults, skills, environments, and agents are independent resources and are not affected by session deletion. Files you uploaded through the Files API are also unaffected, but files the session itself produced are scoped to it and are permanently deleted along with its filesystem. Download anything you need to keep before deleting the session. An output file written at the end of the last turn can take a few seconds after the session goes idle to appear in the [session's file list](https://platform.claude.com/docs/en/managed-agents/files#listing-and-downloading-session-files), so check that the files you expect are listed first.
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   curl -fsSL -X DELETE "https://api.anthropic.com/v1/sessions/$SESSION_ID" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
diff --git a/content/en/managed-agents/sessions.md b/content/en/managed-agents/sessions.md
index 76e74a2370..295c13baff 100644
--- a/content/en/managed-agents/sessions.md
+++ b/content/en/managed-agents/sessions.md
@@ -14,9 +14,9 @@ A session is an agent instance within an environment. Each session references an
 
 A session requires an `agent` ID and an `environment` ID. Agents are versioned resources; passing in the `agent` ID as a string creates the session with the latest agent version.
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
-  session=$(curl -fsSL https://api.anthropic.com/v1/sessions \
+  curl -fsSL https://api.anthropic.com/v1/sessions \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01" \
     -H "anthropic-beta: managed-agents-2026-04-01" \
@@ -27,8 +27,6 @@ A session requires an `agent` ID and an `environment` ID. Agents are versioned r
     "environment_id": "$ENVIRONMENT_ID"
   }
   EOF
-  )
-  SESSION_ID=$(jq -r '.id' <<< "$session")
   ```
 
   ```bash CLI
@@ -95,9 +93,9 @@ A session requires an `agent` ID and an `environment` ID. Agents are versioned r
 
 To pin a session to a specific agent version, pass an object. This lets you control exactly which version runs and stage rollouts of new versions independently.
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
-  pinned_session=$(curl -fsSL https://api.anthropic.com/v1/sessions \
+  curl -fsSL https://api.anthropic.com/v1/sessions \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01" \
     -H "anthropic-beta: managed-agents-2026-04-01" \
@@ -108,8 +106,6 @@ To pin a session to a specific agent version, pass an object. This lets you cont
     "environment_id": "$ENVIRONMENT_ID"
   }
   EOF
-  )
-  PINNED_SESSION_ID=$(jq -r '.id' <<< "$pinned_session")
   ```
 
   ```bash CLI
@@ -197,7 +193,7 @@ You can create a session and start its work in one call. `initial_events` is an
 
 The following example creates a session with a single `user.message` in `initial_events`:
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   seeded_session=$(curl -fsSL https://api.anthropic.com/v1/sessions \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
@@ -481,9 +477,9 @@ In the response, the `agent` object reflects the configuration the session runs
 
 The following example starts a session that overrides the model and clears the system prompt:
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
-  override_session=$(curl -fsSL https://api.anthropic.com/v1/sessions \
+  curl -fsSL https://api.anthropic.com/v1/sessions \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01" \
     -H "anthropic-beta: managed-agents-2026-04-01" \
@@ -499,17 +495,12 @@ The following example starts a session that overrides the model and clears the s
     "environment_id": "$ENVIRONMENT_ID"
   }
   EOF
-  )
-  jq '.agent | {id, version, model, system}' <<< "$override_session"
-  OVERRIDE_SESSION_ID=$(jq -r '.id' <<< "$override_session")
   ```
 
   ```bash CLI
   # The response's `agent` is the resolved snapshot: each override replaces that
   # field for this session only, and the agent resource keeps its id and version.
-  ant beta:sessions create \
-    --transform 'agent.{id,version,model,system}' \
-    --format json <<YAML
+  ant beta:sessions create <<YAML
   agent:
     type: agent_with_overrides
     id: $AGENT_ID
@@ -653,7 +644,7 @@ Because a `model` override replaces the agent's `model` object in full, it also
 
 The following example starts a session from an agent whose model has no geo pin, pins the session's model requests to US inference by including `inference_geo` in the `model` override, and prints the value echoed in the response's `agent.model`:
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   # Replaces the agent's `model` in full: restate `id`, add `inference_geo` to pin.
   session=$(curl -fsSL https://api.anthropic.com/v1/sessions \
@@ -836,9 +827,9 @@ See [Session budgets](https://platform.claude.com/docs/en/managed-agents/budgets
 
 If your agent uses MCP tools that require authentication, pass `vault_ids` at session creation to reference a vault containing stored OAuth credentials. Anthropic manages token refresh on your behalf. See [Authenticate with vaults](https://platform.claude.com/docs/en/managed-agents/vaults) for how to create vaults and register credentials.
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
-  vault_session=$(curl -fsSL https://api.anthropic.com/v1/sessions \
+  curl -fsSL https://api.anthropic.com/v1/sessions \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01" \
     -H "anthropic-beta: managed-agents-2026-04-01" \
@@ -850,8 +841,6 @@ If your agent uses MCP tools that require authentication, pass `vault_ids` at se
     "vault_ids": ["$VAULT_ID"]
   }
   EOF
-  )
-  VAULT_SESSION_ID=$(jq -r '.id' <<< "$vault_session")
   ```
 
   ```bash CLI
@@ -930,7 +919,7 @@ If your agent uses MCP tools that require authentication, pass `vault_ids` at se
 
 Creating a session without `initial_events` registers the session but does not start any work; the environment's sandbox begins provisioning as soon as the session is created, so the first tool call does not wait on it. To delegate a task, send events to the session using a [user event](https://platform.claude.com/docs/en/managed-agents/reference#event-types). To supply the first event in the create request instead, see [Seed the session with initial events](https://platform.claude.com/docs/en/managed-agents/sessions#seed-the-session-with-initial-events). The session acts as a state machine that tracks progress while events drive the actual execution.
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   curl -fsSL "https://api.anthropic.com/v1/sessions/$SESSION_ID/events" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
diff --git a/content/en/managed-agents/skills.md b/content/en/managed-agents/skills.md
index bcb83f8fc6..92039a63b5 100644
--- a/content/en/managed-agents/skills.md
+++ b/content/en/managed-agents/skills.md
@@ -431,7 +431,7 @@ Repository skills use the same `SKILL.md` format as the custom skills you upload
 
 To load skills from a repository, create a session that mounts it. This is the same request shown in [Accessing GitHub](https://platform.claude.com/docs/en/managed-agents/github#token-permissions); `mount_path` is optional and defaults to `/workspace/<repo-name>`:
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   session_id=$(curl -fsS https://api.anthropic.com/v1/sessions \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
diff --git a/content/en/managed-agents/tools.md b/content/en/managed-agents/tools.md
index 7386ea2cd9..ac49f7e69d 100644
--- a/content/en/managed-agents/tools.md
+++ b/content/en/managed-agents/tools.md
@@ -35,7 +35,7 @@ Enable the full toolset with `agent_toolset_20260401` when creating an agent. Us
 
 Config entries for `web_search` and `web_fetch` also accept domain filters and other web settings; see [Restrict web search and web fetch domains](https://platform.claude.com/docs/en/managed-agents/tools#restrict-web-search-and-web-fetch-domains).
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   agent=$(curl -fsSL https://api.anthropic.com/v1/agents \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
@@ -258,7 +258,7 @@ The following toolset limits `web_search` to two sites and localizes its results
 
 The following request creates an agent with this toolset and prints the `configs` array from the response:
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   agent=$(curl -fsSL https://api.anthropic.com/v1/agents \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
diff --git a/content/en/managed-agents/vaults.md b/content/en/managed-agents/vaults.md
index 21ad498e77..3dd0d59312 100644
--- a/content/en/managed-agents/vaults.md
+++ b/content/en/managed-agents/vaults.md
@@ -20,27 +20,24 @@ The vault reference is a per-session parameter, so you can manage your product a
 
 A vault is the collection of `credentials` associated with an end user. Give it a `display_name` and optionally tag it with `metadata` so you can map it back to your own user records.
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
-  vault_id=$(curl --fail-with-body -sS https://api.anthropic.com/v1/vaults \
+  curl --fail-with-body -sS https://api.anthropic.com/v1/vaults \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01" \
     -H "anthropic-beta: managed-agents-2026-04-01" \
     -H "content-type: application/json" \
-    --data @- <<'EOF' | jq -r '.id'
+    --data @- <<'EOF'
   {
     "display_name": "Alice",
     "metadata": {"external_user_id": "usr_abc123"}
   }
   EOF
-  )
-  echo "$vault_id"  # "vlt_01ABC..."
   ```
 
   <MultiFileExample language="cli" label="CLI">
     ```bash CLI
-    VAULT_ID=$(ant beta:vaults create --transform id --raw-output < alice.vault.yaml)
-    echo "$VAULT_ID"  # "vlt_01ABC..."
+    ant beta:vaults create < alice.vault.yaml
     ```
 
     <File filename="alice.vault.yaml">
@@ -152,14 +149,14 @@ The actual credential values you supply (`token`, `access_token`, `refresh_token
     * `client_secret_basic`: HTTP Basic authentication with the client secret
     * `client_secret_post`: client secret in the POST body
 
-    <CodeGroup defaultLanguage="CLI">
+    <CodeGroup>
       ```bash cURL
-      credential_id=$(curl --fail-with-body -sS "https://api.anthropic.com/v1/vaults/$vault_id/credentials" \
+      curl --fail-with-body -sS "https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials" \
         -H "x-api-key: $ANTHROPIC_API_KEY" \
         -H "anthropic-version: 2023-06-01" \
         -H "anthropic-beta: managed-agents-2026-04-01" \
         -H "content-type: application/json" \
-        --data @- <<'EOF' | jq -r '.id'
+        --data @- <<'EOF'
       {
         "display_name": "Alice's Slack",
         "auth": {
@@ -177,14 +174,12 @@ The actual credential values you supply (`token`, `access_token`, `refresh_token
         }
       }
       EOF
-      )
       ```
 
       ```bash CLI
-      CREDENTIAL_ID=$(ant beta:vaults:credentials create \
+      ant beta:vaults:credentials create \
         --vault-id "$VAULT_ID" \
-        --display-name "Alice's Slack" \
-        --transform id --raw-output <<'YAML'
+        --display-name "Alice's Slack" <<'YAML'
       auth:
         type: mcp_oauth
         mcp_server_url: https://mcp.slack.com/mcp
@@ -199,7 +194,6 @@ The actual credential values you supply (`token`, `access_token`, `refresh_token
             type: client_secret_post
             client_secret: abc123...
       YAML
-      )
       ```
 
       ```python Python
@@ -372,9 +366,9 @@ The actual credential values you supply (`token`, `access_token`, `refresh_token
   <Tab title="MCP static bearer">
     Use `static_bearer` when the MCP server accepts a fixed bearer token (API key, personal access token, or similar). No refresh flow is needed.
 
-    <CodeGroup defaultLanguage="CLI">
+    <CodeGroup>
       ```bash cURL
-      curl --fail-with-body -sS "https://api.anthropic.com/v1/vaults/$vault_id/credentials" \
+      curl --fail-with-body -sS "https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials" \
         -H "x-api-key: $ANTHROPIC_API_KEY" \
         -H "anthropic-version: 2023-06-01" \
         -H "anthropic-beta: managed-agents-2026-04-01" \
@@ -505,14 +499,14 @@ The actual credential values you supply (`token`, `access_token`, `refresh_token
 
     The optional `injection_location` field scopes where the secret is substituted; the full semantics follow the example.
 
-    <CodeGroup defaultLanguage="CLI">
+    <CodeGroup>
       ```bash cURL
-      curl --fail-with-body -sS "https://api.anthropic.com/v1/vaults/$vault_id/credentials" \
+      curl --fail-with-body -sS "https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials" \
         -H "x-api-key: $ANTHROPIC_API_KEY" \
         -H "anthropic-version: 2023-06-01" \
         -H "anthropic-beta: managed-agents-2026-04-01" \
         -H "content-type: application/json" \
-        --data @- <<'EOF' | jq '.auth.injection_location'
+        --data @- <<'EOF'
       {
         "auth": {
           "type": "environment_variable",
@@ -530,9 +524,7 @@ The actual credential values you supply (`token`, `access_token`, `refresh_token
       ```
 
       ```bash CLI
-      ant beta:vaults:credentials create \
-        --vault-id "$VAULT_ID" \
-        --transform 'auth.injection_location' --format json <<'YAML'
+      ant beta:vaults:credentials create --vault-id "$VAULT_ID" <<'YAML'
       display_name: Notion API key for sandbox
       auth:
         type: environment_variable
@@ -743,31 +735,29 @@ Constraints:
 
 Pass `vault_ids` when creating a session:
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
-  session_id=$(curl --fail-with-body -sS https://api.anthropic.com/v1/sessions \
+  curl --fail-with-body -sS https://api.anthropic.com/v1/sessions \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01" \
     -H "anthropic-beta: managed-agents-2026-04-01" \
     -H "content-type: application/json" \
-    --data @- <<EOF | jq -r '.id'
+    --data @- <<EOF
   {
-    "agent": "$agent_id",
-    "environment_id": "$environment_id",
-    "vault_ids": ["$vault_id"],
+    "agent": "$AGENT_ID",
+    "environment_id": "$ENVIRONMENT_ID",
+    "vault_ids": ["$VAULT_ID"],
     "title": "Alice's Slack digest"
   }
   EOF
-  )
   ```
 
   ```bash CLI
-  SESSION_ID=$(ant beta:sessions create \
+  ant beta:sessions create \
     --agent "$AGENT_ID" \
     --environment-id "$ENVIRONMENT_ID" \
     --vault-id "$VAULT_ID" \
-    --title "Alice's Slack digest" \
-    --transform id --raw-output)
+    --title "Alice's Slack digest"
   ```
 
   ```python Python
@@ -850,10 +840,10 @@ Runtime behavior:
 
 Secret values, `display_name`, and (on environment variable credentials) `injection_location` can be updated. `injection_location` updates merge per field, as described in the Environment variable tab of [Add a credential](https://platform.claude.com/docs/en/managed-agents/vaults#add-a-credential). For a running session, an `injection_location` update propagates the same way as a secret rotation: the session's credentials are re-resolved without a restart, as described in [Credential lifecycle](https://platform.claude.com/docs/en/managed-agents/vaults#credential-lifecycle), and the updated locations apply to the session's subsequent outbound requests. Structural fields (`mcp_server_url`, `secret_name`, `token_endpoint`, `client_id`) are locked after creation. To change them, archive the credential and create a new one.
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   curl --fail-with-body -sS \
-    "https://api.anthropic.com/v1/vaults/$vault_id/credentials/$credential_id" \
+    "https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01" \
     -H "anthropic-beta: managed-agents-2026-04-01" \
@@ -1015,10 +1005,10 @@ The top-level `status` tells you what to do next:
 * `invalid`: the grant is gone or the OAuth server rejected the refresh with a 4xx. Prompt the end user to re-authorize.
 * `unknown`: a transient error (5xx, 429, or network failure). Wait and retry.
 
-<CodeGroup defaultLanguage="CLI">
+<CodeGroup>
   ```bash cURL
   curl --fail-with-body -sS -X POST \
-    "https://api.anthropic.com/v1/vaults/$vault_id/credentials/$credential_id/mcp_oauth_validate?beta=true" \
+    "https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID/mcp_oauth_validate?beta=true" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01" \
     -H "anthropic-beta: managed-agents-2026-04-01"
@@ -1027,8 +1017,7 @@ The top-level `status` tells you what to do next:
   ```bash CLI
   ant beta:vaults:credentials mcp-oauth-validate \
     --vault-id "$VAULT_ID" \
-    --credential-id "$CREDENTIAL_ID" \
-    --transform status --raw-output  # "valid", "invalid", or "unknown"
+    --credential-id "$CREDENTIAL_ID"
   ```
 
   ```python Python
diff --git a/content/en/models/sonnet-5/migration-guide.md b/content/en/models/sonnet-5/migration-guide.md
index f0b412e7a5..e82bc87fc5 100644
--- a/content/en/models/sonnet-5/migration-guide.md
+++ b/content/en/models/sonnet-5/migration-guide.md
@@ -340,7 +340,7 @@ Items 4 and 5 in the following list are breaking changes. `max_tokens` remains a
 
          ```bash CLI
          ant messages create \
-           --transform content --format yaml <<'YAML'
+           --format yaml <<'YAML'
          model: claude-sonnet-4-6
          max_tokens: 16000
          thinking:
diff --git a/content/github/anthropic-sdk-python/CHANGELOG.md b/content/github/anthropic-sdk-python/CHANGELOG.md
index 471d697c13..5621b83154 100644
--- a/content/github/anthropic-sdk-python/CHANGELOG.md
+++ b/content/github/anthropic-sdk-python/CHANGELOG.md
@@ -1,5 +1,34 @@
 # Changelog
 
+## 1.7.0 (2026-09-18)
+
+Full Changelog: [v1.6.0...v1.7.0](https://github.com/anthropics/anthropic-sdk-python/compare/v1.6.0...v1.7.0)
+
+### Features
+
+* **api:** add group with display_name to rate limits, deprecate group_type ([28f0a83](https://github.com/anthropics/anthropic-sdk-python/commit/28f0a831355fa3d539fd3e1db1c63f92a39bb252))
+* **tools:** add compact_before_next_turn() to the tool runner ([#641](https://github.com/anthropics/anthropic-sdk-python/issues/641)) ([8b23fb3](https://github.com/anthropics/anthropic-sdk-python/commit/8b23fb33f326c7ffa52e8d925902af0fd94501ce))
+
+
+### Bug Fixes
+
+* **bedrock:** raise an API error for eventstream exception and error frames ([#769](https://github.com/anthropics/anthropic-sdk-python/issues/769)) ([8ec9cc9](https://github.com/anthropics/anthropic-sdk-python/commit/8ec9cc9bdf7278ce7a1557dc7d6e455c7808946e))
+* **client:** accept `X | Y` union types when parsing responses ([b366fa5](https://github.com/anthropics/anthropic-sdk-python/commit/b366fa5a1d62e4908a35415a1692f18621cf9e2c))
+* **client:** don't raise TypeError for `X | Y` fields with unknown data ([30ebd69](https://github.com/anthropics/anthropic-sdk-python/commit/30ebd6963c4b21044fc8d7f8cf33a19981c74856))
+* **client:** join multiple anthropic-beta values with a comma and no space ([#781](https://github.com/anthropics/anthropic-sdk-python/issues/781)) ([1680324](https://github.com/anthropics/anthropic-sdk-python/commit/168032429a6880ef7063de7680c7abe18e45be35))
+* **tools:** tidy compact_before_next_turn() state and failure handling ([#804](https://github.com/anthropics/anthropic-sdk-python/issues/804)) ([d3a9fc8](https://github.com/anthropics/anthropic-sdk-python/commit/d3a9fc80f9792eda4944e33efb821306e632b7c6))
+
+
+### Chores
+
+* **deps:** require pydantic 1.10 or later ([91931e1](https://github.com/anthropics/anthropic-sdk-python/commit/91931e1d205839e72b2a4c2c851b18874f935943))
+* **docs:** add descriptions for enum values and path parameters ([99184dc](https://github.com/anthropics/anthropic-sdk-python/commit/99184dc76a7a6c404478556483d2118498994a47))
+* **docs:** clarify the compaction tool_changes and tool change descriptions ([eacc0ff](https://github.com/anthropics/anthropic-sdk-python/commit/eacc0ffde324201faac42fdcb60500b2076c25b6))
+* **internal:** add more unnecessary cast comments ([9e6ce27](https://github.com/anthropics/anthropic-sdk-python/commit/9e6ce27b8d89c737bd427fc91b96f9932431f547))
+* **internal:** pass strict= to zip() in the MCP tool helpers ([13cfe64](https://github.com/anthropics/anthropic-sdk-python/commit/13cfe644920119b718e0a73085b7ecd9726fb9e9))
+* **internal:** remove an unused noqa comment from the model tests ([2c18298](https://github.com/anthropics/anthropic-sdk-python/commit/2c18298ff35a1b28b98d25b424e928b3865ef405))
+* **internal:** set ruff's target version to Python 3.10 ([2bdfd41](https://github.com/anthropics/anthropic-sdk-python/commit/2bdfd415fe4842b44f871b31328cc76135b48fbb))
+
 ## 1.6.0 (2026-09-15)
 
 Full Changelog: [v1.5.0...v1.6.0](https://github.com/anthropics/anthropic-sdk-python/compare/v1.5.0...v1.6.0)
diff --git a/content/github/anthropic-sdk-python/api.md b/content/github/anthropic-sdk-python/api.md
index 70fbfa14a2..5c11d9a7b3 100644
--- a/content/github/anthropic-sdk-python/api.md
+++ b/content/github/anthropic-sdk-python/api.md
@@ -1783,7 +1783,13 @@ Types:
 ```python
 from anthropic.types.beta.organization import (
     BetaOrganizationRateLimit,
+    BetaOrganizationRateLimitBatchGroup,
+    BetaOrganizationRateLimitFilesGroup,
+    BetaOrganizationRateLimitModelGroup,
+    BetaOrganizationRateLimitSkillsGroup,
+    BetaOrganizationRateLimitTokenCountGroup,
     BetaOrganizationRateLimitValue,
+    BetaOrganizationRateLimitWebSearchGroup,
 )
 ```
 
diff --git a/content/github/anthropic-sdk-python/tools.md b/content/github/anthropic-sdk-python/tools.md
index 08fefb6501..69345377cb 100644
--- a/content/github/anthropic-sdk-python/tools.md
+++ b/content/github/anthropic-sdk-python/tools.md
@@ -76,6 +76,43 @@ for message in runner:
     rich.print(message)
 ```
 
+### Compacting the conversation
+
+With the `compact-2026-09-04` beta you decide when a conversation is compacted: a request with the `compaction` param returns a single `compaction` block, which then replaces the messages it summarizes. In a tool runner, call `runner.compact_before_next_turn()` and the runner does this for you.
+
+```py
+runner = client.beta.messages.tool_runner(
+    max_tokens=1024,
+    model="claude-sonnet-4-5-20250929",
+    betas=["compact-2026-09-04"],
+    tools=[search_docs],
+    messages=[{"role": "user", "content": "Find every page that mentions rate limits."}],
+)
+for message in runner:
+    if message.usage.input_tokens > 100_000:
+        runner.compact_before_next_turn()
+```
+
+The call only schedules the compaction. Once the current turn has finished, including any tool calls, the runner requests a summary, replaces its message history with the compaction response the API returns, and carries on. A turn that was paused (`pause_turn`) is resumed and finished first. If the current turn is the last one, the runner compacts and then stops. If you call it before iterating, the compaction is the first request.
+
+The compaction response is yielded like any other message and doesn't count towards `max_iterations`. It has `stop_reason == "compaction"`, the summary is in `message.content[0].content`, and its `usage.input_tokens` is the size of the history that was just summarized. Calling `compact_before_next_turn()` while handling that message does nothing, so a threshold like the one above doesn't compact twice.
+
+`compact_before_next_turn()` takes the same config as the `compaction` param of `messages.create()`, for example to give your own summarization instructions:
+
+```py
+runner.compact_before_next_turn({"type": "summarize", "instructions": "Keep the page URLs found so far."})
+```
+
+A few things to know:
+
+- Calling it again before the compaction runs replaces the pending one.
+- The runner doesn't add the beta for you, so pass `betas=["compact-2026-09-04"]`.
+- `context_management` is left out of the compaction request, because the API doesn't accept the two together, and is sent again afterwards. `compact_before_next_turn()` raises if `context_management` has a `compact_*` edit.
+- While you're handling the compaction response, `append_messages()` and replacing `messages` with `set_messages_params()` raise, because the compaction response is about to replace the messages. Other params can still be changed.
+- If the API returns no summary, the runner logs a warning and keeps the history as it is.
+- If the run ends on a turn that was cut short with tool calls that never ran (`stop_reason == "max_tokens"`, for example), the pending compaction is skipped with a warning. It is also skipped if the run stops at `max_iterations` or you `break` out of the loop.
+- The `compaction` param itself can't be set on a tool runner, because every request in the loop would compact again.
+
 ## ToolError
 
 To report an error from a tool back to the model, raise a `ToolError`. Unlike a plain exception, `ToolError` accepts content blocks, allowing you to include images or other structured content in the error response:
diff --git a/content/github/anthropic-sdk-typescript/CHANGELOG.md b/content/github/anthropic-sdk-typescript/CHANGELOG.md
index ad46c99eea..bbabcb8858 100644
--- a/content/github/anthropic-sdk-typescript/CHANGELOG.md
+++ b/content/github/anthropic-sdk-typescript/CHANGELOG.md
@@ -1,5 +1,43 @@
 # Changelog
 
+## 0.127.0 (2026-09-18)
+
+Full Changelog: [sdk-v0.126.0...sdk-v0.127.0](https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.126.0...sdk-v0.127.0)
+
+### Features
+
+* **api:** add group with display_name to rate limits, deprecate group_type ([2575d97](https://github.com/anthropics/anthropic-sdk-typescript/commit/2575d977be0508d0bd3e3c429b758efeb1e240a2))
+* **tools:** add compactBeforeNextTurn() to the tool runner ([#682](https://github.com/anthropics/anthropic-sdk-typescript/issues/682)) ([9f75ca6](https://github.com/anthropics/anthropic-sdk-typescript/commit/9f75ca69905ba808709c95f31c4159e74fbf6e19))
+
+
+### Bug Fixes
+
+* **BetaMessageStream:** stop coercing a null compaction_delta content into "null" ([#655](https://github.com/anthropics/anthropic-sdk-typescript/issues/655)) ([dbd6845](https://github.com/anthropics/anthropic-sdk-typescript/commit/dbd684543914f57d8d974d28ad97769d123e56a1))
+* **client:** don't retry requests whose body is a stream or iterator ([eebc1b9](https://github.com/anthropics/anthropic-sdk-typescript/commit/eebc1b995b031c7e288a03c1621a3834cc71f3e3))
+* **client:** join multiple anthropic-beta values with a comma and no space ([#638](https://github.com/anthropics/anthropic-sdk-typescript/issues/638)) ([e0cb1ff](https://github.com/anthropics/anthropic-sdk-typescript/commit/e0cb1ff479dcd26e58e47dc1ba8c9d68d191e6b5))
+* **client:** make pagination exports on the client namespace type-only ([5adea1f](https://github.com/anthropics/anthropic-sdk-typescript/commit/5adea1f6fa5063b06fe3384f23d46fb0418da3c4))
+* **internal:** drop jest from tsconfig types ([60588af](https://github.com/anthropics/anthropic-sdk-typescript/commit/60588af343e0c19cc507e5eaef62fb86f28c4c38))
+* **middleware:** echo a streamed compaction summary in the fallback continuation ([#657](https://github.com/anthropics/anthropic-sdk-typescript/issues/657)) ([2e0f004](https://github.com/anthropics/anthropic-sdk-typescript/commit/2e0f0042e8d39d0dccfac8bdcaa42e3d10de626e))
+* **tools:** keep $defs when transformJSONSchema root is a $ref ([#687](https://github.com/anthropics/anthropic-sdk-typescript/issues/687)) ([57a9f30](https://github.com/anthropics/anthropic-sdk-typescript/commit/57a9f30bf3cb166666dc8fa3006384977cca8bf6))
+
+
+### Performance Improvements
+
+* **client:** skip formatting request details when debug logging is off ([2b29ed2](https://github.com/anthropics/anthropic-sdk-typescript/commit/2b29ed2f71ea72beed40fea45f532f5aec64af2d))
+
+
+### Chores
+
+* **ci:** publish releases from Node 24 with its bundled npm ([6b3c6f5](https://github.com/anthropics/anthropic-sdk-typescript/commit/6b3c6f544a17d268ca24e56458b391bb3ad13b26))
+* **docs:** add descriptions for enum values and path parameters ([cb254c4](https://github.com/anthropics/anthropic-sdk-typescript/commit/cb254c48f3d15edb66b77ff36a3835123ef31fc6))
+* **docs:** clarify the compaction tool_changes and tool change descriptions ([5a695eb](https://github.com/anthropics/anthropic-sdk-typescript/commit/5a695eb84e48b7e639465aecd09442ac168f78a5))
+* **internal:** build the sub-packages with TypeScript 6.0.3 ([8a69ff5](https://github.com/anthropics/anthropic-sdk-typescript/commit/8a69ff594ffeec3f6bd964030086b01ae5354aaf))
+* **internal:** build with TypeScript 6.0.3 and typescript-eslint 8.58.0 ([01f3ee6](https://github.com/anthropics/anthropic-sdk-typescript/commit/01f3ee693619bd099ce2a85c76a565a46885be19))
+* **internal:** keep lib/internal out of the published exports map ([763fb43](https://github.com/anthropics/anthropic-sdk-typescript/commit/763fb43ee3a8d55fda55d99fe84a3af4d894366c))
+* **internal:** re-export pagination classes with a plain export list ([c77bdc3](https://github.com/anthropics/anthropic-sdk-typescript/commit/c77bdc3ce95e56cfce425fb1fb1edf21caa74de5))
+* **internal:** share a single Simplify type util ([31d5e75](https://github.com/anthropics/anthropic-sdk-typescript/commit/31d5e7574613a6be77e9be5b88b2e73eef50dca2))
+* **internal:** switch unit tests from jest to vitest ([110542d](https://github.com/anthropics/anthropic-sdk-typescript/commit/110542dde844ce5171807af0b8f6dcd14a89a825), [788c9c6](https://github.com/anthropics/anthropic-sdk-typescript/commit/788c9c62ba2bd8180ffc7dcebd1cee14cd692d03))
+
 ## 0.126.0 (2026-09-15)
 
 Full Changelog: [sdk-v0.125.0...sdk-v0.126.0](https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.125.0...sdk-v0.126.0)
diff --git a/content/github/anthropic-sdk-typescript/api.md b/content/github/anthropic-sdk-typescript/api.md
index defac769f1..bd3decb661 100644
--- a/content/github/anthropic-sdk-typescript/api.md
+++ b/content/github/anthropic-sdk-typescript/api.md
@@ -1659,7 +1659,13 @@ Methods:
 Types:
 
 - <code><a href="./src/resources/beta/organization/rate-limits.ts">BetaOrganizationRateLimit</a></code>
+- <code><a href="./src/resources/beta/organization/rate-limits.ts">BetaOrganizationRateLimitBatchGroup</a></code>
+- <code><a href="./src/resources/beta/organization/rate-limits.ts">BetaOrganizationRateLimitFilesGroup</a></code>
+- <code><a href="./src/resources/beta/organization/rate-limits.ts">BetaOrganizationRateLimitModelGroup</a></code>
+- <code><a href="./src/resources/beta/organization/rate-limits.ts">BetaOrganizationRateLimitSkillsGroup</a></code>
+- <code><a href="./src/resources/beta/organization/rate-limits.ts">BetaOrganizationRateLimitTokenCountGroup</a></code>
 - <code><a href="./src/resources/beta/organization/rate-limits.ts">BetaOrganizationRateLimitValue</a></code>
+- <code><a href="./src/resources/beta/organization/rate-limits.ts">BetaOrganizationRateLimitWebSearchGroup</a></code>
 
 Methods:
 
diff --git a/content/github/anthropic-sdk-typescript/helpers.md b/content/github/anthropic-sdk-typescript/helpers.md
index 2e75b8c43a..d2c89035e4 100644
--- a/content/github/anthropic-sdk-typescript/helpers.md
+++ b/content/github/anthropic-sdk-typescript/helpers.md
@@ -337,6 +337,47 @@ You can also set or update the signal after creating the runner:
 runner.setRequestOptions({ signal: controller.signal });
 ```
 
+#### Compaction
+
+With the `compact-2026-09-04` beta you decide when a conversation is compacted: a request with the `compaction` param returns a single `compaction` block, which then replaces the messages it summarizes. In a tool runner, call `runner.compactBeforeNextTurn()` and the runner does this for you.
+
+```ts
+const runner = anthropic.beta.messages.toolRunner({
+  model: 'claude-sonnet-5',
+  max_tokens: 1000,
+  betas: ['compact-2026-09-04'],
+  messages: [{ role: 'user', content: 'Find every page that mentions rate limits.' }],
+  tools: [searchDocsTool],
+});
+
+for await (const message of runner) {
+  if (message.usage.input_tokens > 100_000) {
+    runner.compactBeforeNextTurn();
+  }
+}
+```
+
+The call only schedules the compaction. Once the current turn has finished, including any tool calls, the runner requests a summary, replaces its message history with the compaction response the API returns, and carries on. A turn that was paused (`pause_turn`) is resumed and finished first. If the current turn is the last one, the runner compacts and then stops. If you call it before iterating, the compaction is the first request.
+
+The compaction response is yielded like any other message and doesn't count towards `max_iterations`. It has `stop_reason: 'compaction'`, the summary is in the `content` of its first content block, and its `usage.input_tokens` is the size of the history that was just summarized. Calling `compactBeforeNextTurn()` while handling that message does nothing, so a threshold like the one above doesn't compact twice.
+
+`compactBeforeNextTurn()` takes the same config as the `compaction` param of `messages.create()`, for example to give your own summarization instructions:
+
+```ts
+runner.compactBeforeNextTurn({ type: 'summarize', instructions: 'Keep the page URLs found so far.' });
+```
+
+A few things to know:
+
+- Calling it again before the compaction runs replaces the pending one.
+- The runner doesn't add the beta for you, so pass `betas: ['compact-2026-09-04']`.
+- `context_management` is left out of the compaction request, because the API doesn't accept the two together, and is sent again afterwards. `compactBeforeNextTurn()` throws if `context_management` has a `compact_*` edit, and so does adding one with `setMessagesParams()` while a compaction is scheduled.
+- While you're handling the compaction response, `pushMessages()` and replacing `messages` with `setMessagesParams()` throw, because the compaction response is about to replace the messages. Other params can still be changed.
+- If the API returns no summary, the runner logs a warning and keeps the history as it is.
+- If the run ends on a turn that was cut short with tool calls that never ran (`stop_reason: 'max_tokens'`, for example), the pending compaction is skipped with a warning. It is also skipped if `max_iterations` ends the run after a turn with tool calls, or you `break` out of the loop.
+- When the runner compacts on the last turn and a summary comes back, the compaction response is the last message it receives, so that is what `await runner` and `runner.done()` resolve to.
+- The `compaction` param itself can't be set on a tool runner, because every request in the loop would compact again.
+
 ### `betaZodTool`
 
 Zod schemas can be used to define the input schema for your tools:
@@ -423,7 +464,7 @@ const calculatorTool = betaTool({
 
 ### `client.messages.toolRunner(params): BetaToolRunner`
 
-**Parameters:** All standard message parameters plus:
+**Parameters:** All standard message parameters except `compaction` (see [Compaction](#compaction)), plus:
 
 - `tools: Array<BetaToolUnion | BetaRunnableTool>` - Array of tools
 - `max_iterations?: number` - Maximum number of tool execution iterations (default: no limit)
@@ -493,6 +534,14 @@ runner.pushMessages(
 );
 ```
 
+#### `BetaToolRunner.compactBeforeNextTurn()`
+
+Schedules a compaction of the conversation for when the current turn has finished. Takes the same config as the `compaction` param of `messages.create()` and defaults to `{ type: 'summarize' }`. See [Compaction](#compaction).
+
+```ts
+runner.compactBeforeNextTurn();
+```
+
 #### `BetaToolRunner.setRequestOptions()`
 
 Updates the request options (e.g., headers, abort signal) for future API calls and tool executions.
diff --git a/content/github/anthropic-sdk-typescript/packages/aws-sdk/CHANGELOG.md b/content/github/anthropic-sdk-typescript/packages/aws-sdk/CHANGELOG.md
index 7a3af696e0..4abc4c94de 100644
--- a/content/github/anthropic-sdk-typescript/packages/aws-sdk/CHANGELOG.md
+++ b/content/github/anthropic-sdk-typescript/packages/aws-sdk/CHANGELOG.md
@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.7.3 (2026-09-18)
+
+Full Changelog: [aws-sdk-v0.7.2...aws-sdk-v0.7.3](https://github.com/anthropics/anthropic-sdk-typescript/compare/aws-sdk-v0.7.2...aws-sdk-v0.7.3)
+
+### Chores
+
+* **internal:** build the sub-packages with TypeScript 6.0.3 ([8a69ff5](https://github.com/anthropics/anthropic-sdk-typescript/commit/8a69ff594ffeec3f6bd964030086b01ae5354aaf))
+* **internal:** switch unit tests from jest to vitest ([788c9c6](https://github.com/anthropics/anthropic-sdk-typescript/commit/788c9c62ba2bd8180ffc7dcebd1cee14cd692d03))
+
 ## 0.7.2 (2026-09-15)
 
 Full Changelog: [aws-sdk-v0.7.1...aws-sdk-v0.7.2](https://github.com/anthropics/anthropic-sdk-typescript/compare/aws-sdk-v0.7.1...aws-sdk-v0.7.2)
diff --git a/content/github/anthropic-sdk-typescript/packages/bedrock-sdk/CHANGELOG.md b/content/github/anthropic-sdk-typescript/packages/bedrock-sdk/CHANGELOG.md
index 32337f06a3..c77d56469a 100644
--- a/content/github/anthropic-sdk-typescript/packages/bedrock-sdk/CHANGELOG.md
+++ b/content/github/anthropic-sdk-typescript/packages/bedrock-sdk/CHANGELOG.md
@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.33.7 (2026-09-18)
+
+Full Changelog: [bedrock-sdk-v0.33.6...bedrock-sdk-v0.33.7](https://github.com/anthropics/anthropic-sdk-typescript/compare/bedrock-sdk-v0.33.6...bedrock-sdk-v0.33.7)
+
+### Bug Fixes
+
+* **bedrock:** raise APIError for mid-stream exception and error frames ([#622](https://github.com/anthropics/anthropic-sdk-typescript/issues/622)) ([8a14b15](https://github.com/anthropics/anthropic-sdk-typescript/commit/8a14b15cc33c64aeb8a77fefd2594c620c7ecc23))
+
+
+### Chores
+
+* **internal:** build the sub-packages with TypeScript 6.0.3 ([8a69ff5](https://github.com/anthropics/anthropic-sdk-typescript/commit/8a69ff594ffeec3f6bd964030086b01ae5354aaf))
+* **internal:** switch unit tests from jest to vitest ([788c9c6](https://github.com/anthropics/anthropic-sdk-typescript/commit/788c9c62ba2bd8180ffc7dcebd1cee14cd692d03))
+
 ## 0.33.6 (2026-09-15)
 
 Full Changelog: [bedrock-sdk-v0.33.5...bedrock-sdk-v0.33.6](https://github.com/anthropics/anthropic-sdk-typescript/compare/bedrock-sdk-v0.33.5...bedrock-sdk-v0.33.6)
diff --git a/content/github/anthropic-sdk-typescript/packages/foundry-sdk/CHANGELOG.md b/content/github/anthropic-sdk-typescript/packages/foundry-sdk/CHANGELOG.md
index 4d48079a8f..baedc0afc3 100644
--- a/content/github/anthropic-sdk-typescript/packages/foundry-sdk/CHANGELOG.md
+++ b/content/github/anthropic-sdk-typescript/packages/foundry-sdk/CHANGELOG.md
@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.4.8 (2026-09-18)
+
+Full Changelog: [foundry-sdk-v0.4.7...foundry-sdk-v0.4.8](https://github.com/anthropics/anthropic-sdk-typescript/compare/foundry-sdk-v0.4.7...foundry-sdk-v0.4.8)
+
+### Chores
+
+* **internal:** build the sub-packages with TypeScript 6.0.3 ([8a69ff5](https://github.com/anthropics/anthropic-sdk-typescript/commit/8a69ff594ffeec3f6bd964030086b01ae5354aaf))
+* **internal:** switch unit tests from jest to vitest ([788c9c6](https://github.com/anthropics/anthropic-sdk-typescript/commit/788c9c62ba2bd8180ffc7dcebd1cee14cd692d03))
+
 ## 0.4.7 (2026-09-15)
 
 Full Changelog: [foundry-sdk-v0.4.6...foundry-sdk-v0.4.7](https://github.com/anthropics/anthropic-sdk-typescript/compare/foundry-sdk-v0.4.6...foundry-sdk-v0.4.7)
diff --git a/content/github/anthropic-sdk-typescript/packages/google-cloud-sdk/CHANGELOG.md b/content/github/anthropic-sdk-typescript/packages/google-cloud-sdk/CHANGELOG.md
index 4711e19394..7a2d9f22c8 100644
--- a/content/github/anthropic-sdk-typescript/packages/google-cloud-sdk/CHANGELOG.md
+++ b/content/github/anthropic-sdk-typescript/packages/google-cloud-sdk/CHANGELOG.md
@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.0.13 (2026-09-18)
+
+Full Changelog: [google-cloud-sdk-v0.0.12...google-cloud-sdk-v0.0.13](https://github.com/anthropics/anthropic-sdk-typescript/compare/google-cloud-sdk-v0.0.12...google-cloud-sdk-v0.0.13)
+
+### Chores
+
+* **internal:** build the sub-packages with TypeScript 6.0.3 ([8a69ff5](https://github.com/anthropics/anthropic-sdk-typescript/commit/8a69ff594ffeec3f6bd964030086b01ae5354aaf))
+* **internal:** switch unit tests from jest to vitest ([788c9c6](https://github.com/anthropics/anthropic-sdk-typescript/commit/788c9c62ba2bd8180ffc7dcebd1cee14cd692d03))
+
 ## 0.0.12 (2026-09-15)
 
 Full Changelog: [google-cloud-sdk-v0.0.11...google-cloud-sdk-v0.0.12](https://github.com/anthropics/anthropic-sdk-typescript/compare/google-cloud-sdk-v0.0.11...google-cloud-sdk-v0.0.12)
diff --git a/content/github/anthropic-sdk-typescript/packages/vertex-sdk/CHANGELOG.md b/content/github/anthropic-sdk-typescript/packages/vertex-sdk/CHANGELOG.md
index bd4f87386f..1315d7dda9 100644
--- a/content/github/anthropic-sdk-typescript/packages/vertex-sdk/CHANGELOG.md
+++ b/content/github/anthropic-sdk-typescript/packages/vertex-sdk/CHANGELOG.md
@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.19.10 (2026-09-18)
+
+Full Changelog: [vertex-sdk-v0.19.9...vertex-sdk-v0.19.10](https://github.com/anthropics/anthropic-sdk-typescript/compare/vertex-sdk-v0.19.9...vertex-sdk-v0.19.10)
+
+### Chores
+
+* **internal:** build the sub-packages with TypeScript 6.0.3 ([8a69ff5](https://github.com/anthropics/anthropic-sdk-typescript/commit/8a69ff594ffeec3f6bd964030086b01ae5354aaf))
+* **internal:** switch unit tests from jest to vitest ([788c9c6](https://github.com/anthropics/anthropic-sdk-typescript/commit/788c9c62ba2bd8180ffc7dcebd1cee14cd692d03))
+
 ## 0.19.9 (2026-09-15)
 
 Full Changelog: [vertex-sdk-v0.19.8...vertex-sdk-v0.19.9](https://github.com/anthropics/anthropic-sdk-typescript/compare/vertex-sdk-v0.19.8...vertex-sdk-v0.19.9)
diff --git a/content/github/claude-cookbooks/misc/admin_api.ipynb b/content/github/claude-cookbooks/misc/admin_api.ipynb
new file mode 100644
index 0000000000..922ca1efee
--- /dev/null
+++ b/content/github/claude-cookbooks/misc/admin_api.ipynb
@@ -0,0 +1,800 @@
+{
+ "cells": [
+  {
+   "cell_type": "markdown",
+   "id": "7eaa7d36",
+   "metadata": {},
+   "source": [
+    "# Manage your organization with the Admin API\n",
+    "\n",
+    "Onboarding a team onto the Claude API means the same Console clicks every time: invite each person, create a workspace, add members, check which API keys exist, and set up an identity for CI. Doing that by hand leaves no record and doesn't scale past a few teams.\n",
+    "\n",
+    "The Admin API exposes those controls as REST endpoints under `/v1/organizations`, and the Python SDK wraps them as `client.beta.organization`. This notebook onboards a team end to end, audits the organization's API keys along the way, and then removes everything it created.\n",
+    "\n",
+    "**By the end of this notebook, you'll be able to:**\n",
+    "\n",
+    "- Authenticate as an organization admin with an OAuth login or a Console Admin API key\n",
+    "- Invite users, set organization roles, and create a workspace with members\n",
+    "- Audit the organization's API keys and read its rate limits\n",
+    "- Create a service account for automation and grant it workspace access\n",
+    "\n",
+    "The same calls work unchanged in a provisioning script or a scheduled audit job."
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "id": "3fb46390",
+   "metadata": {},
+   "source": [
+    "## Prerequisites\n",
+    "\n",
+    "- Python fundamentals, and familiarity with Claude Console organizations, workspaces, and API keys\n",
+    "- Python 3.11+ and `anthropic>=1.1.0`, the first release with `client.beta.organization`\n",
+    "- A Claude Console **organization** where you hold the `admin`, `owner`, or `primary_owner` role. The Admin API isn't available for individual accounts.\n",
+    "- Optional: the [`ant` CLI](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/authentication) for the OAuth login path"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "id": "234f5d5a",
+   "metadata": {},
+   "source": [
+    "## Authenticate as an admin\n",
+    "\n",
+    "API keys scoped to a single workspace can't call the Admin API. It accepts three credentials: an `org:admin` OAuth token, an Admin API key, and a personal or service account key that isn't scoped to one workspace. This notebook uses the first two, and only organization admins can create either:\n",
+    "\n",
+    "| Credential | How to get it | Coverage |\n",
+    "|---|---|---|\n",
+    "| OAuth token with the `org:admin` scope | `ant auth login --profile admin --scope org:admin` | Every endpoint in this notebook |\n",
+    "| Admin API key (`sk-ant-admin01-...`) | Claude Console → Settings → [Admin keys](https://platform.claude.com/settings/admin-keys) | Everything except service accounts and workload identity federation |\n",
+    "\n",
+    "The OAuth login opens a browser, asks you to pick the organization, and stores a refreshable token under `~/.config/anthropic/`. The SDK loads it when you construct the client with `profile=\"admin\"`.\n",
+    "\n",
+    "To use an Admin API key instead, add `ANTHROPIC_ADMIN_API_KEY=sk-ant-admin01-...` to a `.env` file next to this notebook. The setup cell uses the key if it's set and falls back to the OAuth profile otherwise."
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": 1,
+   "id": "2a433652",
+   "metadata": {
+    "execution": {
+     "iopub.execute_input": "2026-08-26T18:06:55.044389Z",
+     "iopub.status.busy": "2026-08-26T18:06:55.044245Z",
+     "iopub.status.idle": "2026-08-26T18:06:57.040181Z",
+     "shell.execute_reply": "2026-08-26T18:06:57.039433Z"
+    }
+   },
+   "outputs": [],
+   "source": [
+    "%%capture\n",
+    "%pip install -U \"anthropic>=1.1.0\" python-dotenv"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": 2,
+   "id": "bd8ac47e",
+   "metadata": {
+    "execution": {
+     "iopub.execute_input": "2026-08-26T18:06:57.042299Z",
+     "iopub.status.busy": "2026-08-26T18:06:57.042157Z",
+     "iopub.status.idle": "2026-08-26T18:06:59.796695Z",
+     "shell.execute_reply": "2026-08-26T18:06:59.796038Z"
+    }
+   },
+   "outputs": [
+    {
+     "name": "stdout",
+     "output_type": "stream",
+     "text": [
+      "Connected to Example Org (1f6e8a52-93c4-4d7b-a1e0-5b2c9d8e4f37) with OAuth profile 'admin'\n"
+     ]
+    }
+   ],
+   "source": [
+    "import os\n",
+    "import time\n",
+    "from datetime import UTC, datetime\n",
+    "from itertools import islice\n",
+    "\n",
+    "import anthropic\n",
+    "from dotenv import load_dotenv\n",
+    "\n",
+    "load_dotenv()\n",
+    "\n",
+    "ADMIN_KEY = os.getenv(\"ANTHROPIC_ADMIN_API_KEY\")\n",
+    "# The profile name you passed to `ant auth login --profile`.\n",
+    "PROFILE = os.getenv(\"ANTHROPIC_PROFILE\", \"admin\")\n",
+    "# Only used to pick which rate limit group to print.\n",
+    "MODEL = \"claude-sonnet-5\"\n",
+    "\n",
+    "if ADMIN_KEY:\n",
+    "    client = anthropic.Anthropic(api_key=ADMIN_KEY)\n",
+    "else:\n",
+    "    client = anthropic.Anthropic(profile=PROFILE)\n",
+    "\n",
+    "org = client.beta.organization.retrieve()\n",
+    "auth = \"an Admin API key\" if ADMIN_KEY else f\"OAuth profile {PROFILE!r}\"\n",
+    "print(f\"Connected to {org.name} ({org.id}) with {auth}\")"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "id": "4b939caf",
+   "metadata": {},
+   "source": [
+    "`organization.retrieve()` calls `GET /v1/organizations/me`. Check the name before going further: an admin credential is bound to one organization, and every call that follows reads or writes it.\n",
+    "\n",
+    "The rest of the notebook names what it creates after one team, so you can spot it in the Console."
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": 3,
+   "id": "81f0f9cc",
+   "metadata": {
+    "execution": {
+     "iopub.execute_input": "2026-08-26T18:06:59.798682Z",
+     "iopub.status.busy": "2026-08-26T18:06:59.798544Z",
+     "iopub.status.idle": "2026-08-26T18:06:59.801379Z",
+     "shell.execute_reply": "2026-08-26T18:06:59.801009Z"
+    }
+   },
+   "outputs": [
+    {
+     "name": "stdout",
+     "output_type": "stream",
+     "text": [
+      "research-20260826-180659\n"
+     ]
+    }
+   ],
+   "source": [
+    "RUN_ID = datetime.now(UTC).strftime(\"%Y%m%d-%H%M%S\")\n",
+    "TEAM = f\"research-{RUN_ID}\"\n",
+    "print(TEAM)"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "id": "641d5512",
+   "metadata": {},
+   "source": [
+    "## Invite teammates and set roles\n",
+    "\n",
+    "An invite emails the recipient a sign-up link and records the role they get when they accept. For Console organizations the API accepts `user`, `developer`, `billing`, and `claude_code_user`. The `admin` role can only be granted in the Console.\n",
+    "\n",
+    "Start new members as `user`, which grants Console and playground access without API keys, and promote them when they need more.\n",
+    "\n",
+    "An invite sends a real email. Some organizations accept invites only to their own email domain, and an invite to any other domain returns a `400`. The next cell defaults to a placeholder address on an existing admin's domain so it runs in any organization. Set `INVITE_EMAIL` to a teammate's address to try the full flow."
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": 4,
+   "id": "ab0722a6",
+   "metadata": {
+    "execution": {
+     "iopub.execute_input": "2026-08-26T18:06:59.803093Z",
+     "iopub.status.busy": "2026-08-26T18:06:59.802968Z",
+     "iopub.status.idle": "2026-08-26T18:07:00.555411Z",
+     "shell.execute_reply": "2026-08-26T18:07:00.554507Z"
+    }
+   },
+   "outputs": [
+    {
+     "name": "stdout",
+     "output_type": "stream",
+     "text": [
+      "invite_015gWxHNr6h6TdRPZTmuCGnn  new.teammate+20260826-180659@example.com  role=user  status=pending\n",
+      "expires 2026-09-16\n"
+     ]
+    }
+   ],
+   "source": [
+    "INVITE_EMAIL = os.getenv(\"INVITE_EMAIL\")\n",
+    "if not INVITE_EMAIL:\n",
+    "    # Invites to other domains return a 400 in organizations that restrict invite domains.\n",
+    "    users = client.beta.organization.users.list(limit=100)\n",
+    "    admin = next((u for u in users if u.role in {\"admin\", \"owner\", \"primary_owner\"}), None)\n",
+    "    if admin is None:\n",
+    "        raise RuntimeError(\"No admin user to borrow an email domain from. Set INVITE_EMAIL.\")\n",
+    "    INVITE_EMAIL = f\"new.teammate+{RUN_ID}@{admin.email.split('@', 1)[1]}\"\n",
+    "\n",
+    "invite = client.beta.organization.invites.create(email=INVITE_EMAIL, role=\"user\")\n",
+    "print(f\"{invite.id}  {invite.email}  role={invite.role}  status={invite.status}\")\n",
+    "print(f\"expires {invite.expires_at:%Y-%m-%d}\")"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "id": "6223a466",
+   "metadata": {},
+   "source": [
+    "Invites expire after 21 days. `invites.list()` returns every invite in the organization with its status, and `invites.delete()` revokes a pending one."
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": 5,
+   "id": "0561d852",
+   "metadata": {
+    "execution": {
+     "iopub.execute_input": "2026-08-26T18:07:00.556874Z",
+     "iopub.status.busy": "2026-08-26T18:07:00.556738Z",
+     "iopub.status.idle": "2026-08-26T18:07:00.710540Z",
+     "shell.execute_reply": "2026-08-26T18:07:00.709889Z"
+    }
+   },
+   "outputs": [
+    {
+     "name": "stdout",
+     "output_type": "stream",
+     "text": [
+      "new.teammate+20260826-180659@example.com                 user             pending   sent 2026-08-26\n"
+     ]
+    }
+   ],
+   "source": [
+    "for inv in client.beta.organization.invites.list(limit=100):\n",
+    "    print(f\"{inv.email:<45} {inv.role:<16} {inv.status:<9} sent {inv.invited_at:%Y-%m-%d}\")"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "id": "7e5ab62f",
+   "metadata": {},
+   "source": [
+    "Once someone accepts, they show up in `users.list()`. The next cell prints the first 10. Filter by `email` to find one person, then change their role with `users.update()` or offboard them with `users.remove()`. Admins can't be removed through the API.\n",
+    "\n",
+    "While the invite is pending, the next cell finds no user and skips the promotion, and the membership cell later skips the add. Both run once the invite is accepted."
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": 6,
+   "id": "44a76402",
+   "metadata": {
+    "execution": {
+     "iopub.execute_input": "2026-08-26T18:07:00.712402Z",
+     "iopub.status.busy": "2026-08-26T18:07:00.712288Z",
+     "iopub.status.idle": "2026-08-26T18:07:01.026602Z",
+     "shell.execute_reply": "2026-08-26T18:07:01.026204Z"
+    }
+   },
+   "outputs": [
+    {
+     "name": "stdout",
+     "output_type": "stream",
+     "text": [
+      "ada@example.com                              admin            joined 2026-06-01\n"
+     ]
+    },
+    {
+     "name": "stdout",
+     "output_type": "stream",
+     "text": [
+      "\n",
+      "new.teammate+20260826-180659@example.com hasn't accepted yet, nothing to promote\n"
+     ]
+    }
+   ],
+   "source": [
+    "# Iterating a list call fetches every page, so cap what gets printed.\n",
+    "for user in islice(client.beta.organization.users.list(limit=100), 10):\n",
+    "    print(f\"{user.email:<45} {user.role:<16} joined {user.added_at:%Y-%m-%d}\")\n",
+    "\n",
+    "teammate = next(iter(client.beta.organization.users.list(email=INVITE_EMAIL)), None)\n",
+    "if teammate is None:\n",
+    "    print(f\"\\n{INVITE_EMAIL} hasn't accepted yet, nothing to promote\")\n",
+    "else:\n",
+    "    teammate = client.beta.organization.users.update(teammate.id, role=\"developer\")\n",
+    "    print(f\"\\n{teammate.email} is now {teammate.role}\")"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "id": "cbab80e5",
+   "metadata": {},
+   "source": [
+    "## Create a workspace for the team\n",
+    "\n",
+    "Workspaces partition API keys, spend limits, rate limits, and usage reporting inside one organization. One workspace per team or per environment is the usual layout. `tags` carry your own metadata, such as a cost center, and come back on every read."
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": 7,
+   "id": "a036e097",
+   "metadata": {
+    "execution": {
+     "iopub.execute_input": "2026-08-26T18:07:01.027915Z",
+     "iopub.status.busy": "2026-08-26T18:07:01.027801Z",
+     "iopub.status.idle": "2026-08-26T18:07:01.254113Z",
+     "shell.execute_reply": "2026-08-26T18:07:01.253070Z"
+    }
+   },
+   "outputs": [
+    {
+     "name": "stdout",
+     "output_type": "stream",
+     "text": [
+      "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ research-20260826-180659 {'team': 'research', 'cost-center': '4711'}\n"
+     ]
+    }
+   ],
+   "source": [
+    "workspace = client.beta.organization.workspaces.create(\n",
+    "    name=TEAM,\n",
+    "    tags={\"team\": \"research\", \"cost-center\": \"4711\"},\n",
+    ")\n",
+    "print(workspace.id, workspace.name, workspace.tags)"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "id": "eb082fae",
+   "metadata": {},
+   "source": [
+    "`workspaces.update()` changes the name, display color, or tags. Tags merge with what's already there, and setting a tag to `None` removes it."
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": 8,
+   "id": "dca7a442",
+   "metadata": {
+    "execution": {
+     "iopub.execute_input": "2026-08-26T18:07:01.255887Z",
+     "iopub.status.busy": "2026-08-26T18:07:01.255759Z",
+     "iopub.status.idle": "2026-08-26T18:07:01.512340Z",
+     "shell.execute_reply": "2026-08-26T18:07:01.511892Z"
+    }
+   },
+   "outputs": [
+    {
+     "name": "stdout",
+     "output_type": "stream",
+     "text": [
+      "{'env': 'sandbox', 'team': 'research'}\n"
+     ]
+    }
+   ],
+   "source": [
+    "workspace = client.beta.organization.workspaces.update(\n",
+    "    workspace.id, tags={\"env\": \"sandbox\", \"cost-center\": None}\n",
+    ")\n",
+    "print(workspace.tags)"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "id": "e32cd6da",
+   "metadata": {},
+   "source": [
+    "Organization admins and billing users are implicit members of every workspace and don't appear in `members.list()`. Everyone else needs an explicit workspace role, such as `workspace_user`, `workspace_developer`, or `workspace_admin`.\n",
+    "\n",
+    "`members.update()` changes a role and `members.remove()` drops someone from the workspace without touching their organization membership."
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": 9,
+   "id": "99608d11",
+   "metadata": {
+    "execution": {
+     "iopub.execute_input": "2026-08-26T18:07:01.514123Z",
+     "iopub.status.busy": "2026-08-26T18:07:01.513989Z",
+     "iopub.status.idle": "2026-08-26T18:07:01.672676Z",
+     "shell.execute_reply": "2026-08-26T18:07:01.671856Z"
+    }
+   },
+   "outputs": [
+    {
+     "name": "stdout",
+     "output_type": "stream",
+     "text": [
+      "research-20260826-180659: 0 explicit member(s)\n"
+     ]
+    }
+   ],
+   "source": [
+    "if teammate:\n",
+    "    client.beta.organization.workspaces.members.add(\n",
+    "        workspace.id, user_id=teammate.id, workspace_role=\"workspace_developer\"\n",
+    "    )\n",
+    "\n",
+    "members = list(client.beta.organization.workspaces.members.list(workspace.id))\n",
+    "print(f\"{workspace.name}: {len(members)} explicit member(s)\")\n",
+    "for m in members:\n",
+    "    print(f\"  {m.user_id} {m.workspace_role}\")"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "id": "d03eedf9",
+   "metadata": {},
+   "source": [
+    "## Audit API keys\n",
+    "\n",
+    "The Admin API lists, renames, deactivates, and archives API keys, but it can't create them: new keys come from the Console only. Use it for a scheduled audit, not for provisioning.\n",
+    "\n",
+    "The next cell walks every active key in the organization and flags keys older than `MAX_KEY_AGE_DAYS` and keys with no expiry."
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": 10,
+   "id": "69004027",
+   "metadata": {
+    "execution": {
+     "iopub.execute_input": "2026-08-26T18:07:01.674237Z",
+     "iopub.status.busy": "2026-08-26T18:07:01.674106Z",
+     "iopub.status.idle": "2026-08-26T18:07:01.999246Z",
+     "shell.execute_reply": "2026-08-26T18:07:01.998831Z"
+    }
+   },
+   "outputs": [
+    {
+     "name": "stdout",
+     "output_type": "stream",
+     "text": [
+      "backend-prod                 production         sk-ant-api03-R2D...igAA    14d  expires 2027-08-12 \n",
+      "ci-deploy                    production         sk-ant-api03-9xQ...0mAA    14d  expires 2026-12-09 \n",
+      "\n",
+      "0 key(s) flagged\n"
+     ]
+    }
+   ],
+   "source": [
+    "MAX_KEY_AGE_DAYS = 90\n",
+    "now = datetime.now(UTC)\n",
+    "\n",
+    "# The default workspace isn't returned by workspaces.list(), so any ID missing here is it.\n",
+    "workspace_names = {w.id: w.name for w in client.beta.organization.workspaces.list(limit=1000)}\n",
+    "\n",
+    "flagged = []\n",
+    "for key in client.beta.organization.api_keys.list(status=\"active\", limit=1000):\n",
+    "    if key.scope.type == \"workspace\":\n",
+    "        where = workspace_names.get(key.scope.workspace_id, \"Default\")\n",
+    "    else:\n",
+    "        where = \"(organization)\"\n",
+    "    age = (now - key.created_at).days\n",
+    "    expires = f\"{key.expires_at:%Y-%m-%d}\" if key.expires_at else \"never\"\n",
+    "    flags = []\n",
+    "    if age > MAX_KEY_AGE_DAYS:\n",
+    "        flags.append(\"old\")\n",
+    "    if key.expires_at is None:\n",
+    "        flags.append(\"no-expiry\")\n",
+    "    if flags:\n",
+    "        flagged.append(key)\n",
+    "    hint = key.partial_key_hint or \"-\"\n",
+    "    print(f\"{key.name:<28} {where:<18} {hint:<24}\", end=\" \")\n",
+    "    print(f\"{age:>4}d  expires {expires:<10} {' '.join(flags)}\")\n",
+    "\n",
+    "print(f\"\\n{len(flagged)} key(s) flagged\")"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "id": "9f20438a",
+   "metadata": {},
+   "source": [
+    "Deactivating a key is reversible (`status=\"active\"` turns it back on). Archiving is not. Leave `APPLY = False` for a dry run, or set it to `True` to deactivate the flagged keys.\n",
+    "\n",
+    "Read the flagged list first. A key with no expiry is flagged even if it serves production traffic, and a deactivated key starts failing requests immediately."
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": 11,
+   "id": "b3ee2df3",
+   "metadata": {
+    "execution": {
+     "iopub.execute_input": "2026-08-26T18:07:02.000786Z",
+     "iopub.status.busy": "2026-08-26T18:07:02.000664Z",
+     "iopub.status.idle": "2026-08-26T18:07:02.003771Z",
+     "shell.execute_reply": "2026-08-26T18:07:02.003386Z"
+    }
+   },
+   "outputs": [
+    {
+     "name": "stdout",
+     "output_type": "stream",
+     "text": [
+      "no flagged keys, nothing to do\n"
+     ]
+    }
+   ],
+   "source": [
+    "APPLY = False\n",
+    "\n",
+    "if not flagged:\n",
+    "    print(\"no flagged keys, nothing to do\")\n",
+    "for key in flagged:\n",
+    "    if APPLY:\n",
+    "        key = client.beta.organization.api_keys.update(key.id, status=\"inactive\")\n",
+    "    print(f\"{key.name:<28} -> {key.status}{'' if APPLY else '  (dry run, unchanged)'}\")"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "id": "25fcd0cc",
+   "metadata": {},
+   "source": [
+    "## Create a service account for automation\n",
+    "\n",
+    "A service account is a non-human member of the organization for CI jobs and backend services. It holds an organization role and workspace roles like a person does, so credentials issued to it don't depend on an employee's account. The service account endpoints accept only the `org:admin` OAuth credential. An Admin API key is rejected here.\n",
+    "\n",
+    "`name` is a slug of lowercase letters, digits, and hyphens, and it must be unique in the organization. The service account endpoints can lag behind creation. An object created a few seconds ago can briefly return `404` from these endpoints, or be missing from a list. Retry on `404` when a call references something you just created, which is what the helper in the next cell does."
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": 12,
+   "id": "62708ef0",
+   "metadata": {
+    "execution": {
+     "iopub.execute_input": "2026-08-26T18:07:02.005475Z",
+     "iopub.status.busy": "2026-08-26T18:07:02.005354Z",
+     "iopub.status.idle": "2026-08-26T18:07:02.258095Z",
+     "shell.execute_reply": "2026-08-26T18:07:02.257702Z"
+    }
+   },
+   "outputs": [
+    {
+     "name": "stdout",
+     "output_type": "stream",
+     "text": [
+      "svac_01ABCDEFabcdef0123456789XY ci-research-20260826-180659 developer\n"
+     ]
+    }
+   ],
+   "source": [
+    "# New objects can briefly 404 on the service account endpoints.\n",
+    "def retry_on_not_found(call, attempts: int = 6, delay: float = 5.0):\n",
+    "    for attempt in range(attempts):\n",
+    "        try:\n",
+    "            return call()\n",
+    "        except anthropic.NotFoundError:\n",
+    "            if attempt == attempts - 1:\n",
+    "                raise\n",
+    "            time.sleep(delay)\n",
+    "\n",
+    "\n",
+    "service_account = None\n",
+    "if ADMIN_KEY:\n",
+    "    print(\"Skipped: service account endpoints need the org:admin OAuth credential\")\n",
+    "else:\n",
+    "    service_account = client.beta.organization.service_accounts.create(\n",
+    "        name=f\"ci-{TEAM}\",\n",
+    "        description=\"Deploy pipeline for the research team\",\n",
+    "    )\n",
+    "    print(service_account.id, service_account.name, service_account.organization_role)"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "id": "9ea2b22d",
+   "metadata": {},
+   "source": [
+    "Grant it a role in the team workspace, then list its memberships. Every service account is also an implicit `workspace_user` in the default workspace, and a grant made seconds ago can take a moment to appear in the list."
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": 13,
+   "id": "771d6bfa",
+   "metadata": {
+    "execution": {
+     "iopub.execute_input": "2026-08-26T18:07:02.259476Z",
+     "iopub.status.busy": "2026-08-26T18:07:02.259363Z",
+     "iopub.status.idle": "2026-08-26T18:07:08.030045Z",
+     "shell.execute_reply": "2026-08-26T18:07:08.029139Z"
+    }
+   },
+   "outputs": [
+    {
+     "name": "stdout",
+     "output_type": "stream",
+     "text": [
+      "granted workspace_developer in research-20260826-180659\n",
+      "\n",
+      "Default                      workspace_user         implicit\n",
+      "research-20260826-180659     workspace_developer    explicit\n"
+     ]
+    }
+   ],
+   "source": [
+    "if service_account:\n",
+    "    grant = retry_on_not_found(\n",
+    "        lambda: client.beta.organization.service_accounts.workspaces.add(\n",
+    "            service_account.id, workspace_id=workspace.id, workspace_role=\"workspace_developer\"\n",
+    "        )\n",
+    "    )\n",
+    "    print(f\"granted {grant.workspace_role} in {workspace.name}\\n\")\n",
+    "    for m in client.beta.organization.service_accounts.workspaces.list(service_account.id):\n",
+    "        name = workspace.name if m.workspace_id == workspace.id else \"Default\"\n",
+    "        print(f\"{name:<28} {m.workspace_role:<22} {'implicit' if m.implicit else 'explicit'}\")"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "id": "0b723cb3",
+   "metadata": {},
+   "source": [
+    "To let a pipeline authenticate as this service account without storing a secret, register your CI provider as a federation issuer and add a rule that maps its OIDC tokens to the account. [Workload identity federation](https://platform.claude.com/docs/en/manage-claude/workload-identity-federation) covers that setup."
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "id": "11b1fcf2",
+   "metadata": {},
+   "source": [
+    "## Check rate limits\n",
+    "\n",
+    "Rate limits are set per organization. Each group covers a model family or another part of the API, such as `batch`, `files`, or `web_search`. `rate_limits.list()` returns every group. The next cell prints the group that covers `MODEL`, which the setup cell defines, plus the groups that aren't tied to a model."
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": 14,
+   "id": "c9e38019",
+   "metadata": {
+    "execution": {
+     "iopub.execute_input": "2026-08-26T18:07:08.031753Z",
+     "iopub.status.busy": "2026-08-26T18:07:08.031637Z",
+     "iopub.status.idle": "2026-08-26T18:07:08.237821Z",
+     "shell.execute_reply": "2026-08-26T18:07:08.237208Z"
+    }
+   },
+   "outputs": [
+    {
+     "name": "stdout",
+     "output_type": "stream",
+     "text": [
+      "batch              enqueued_batch_requests=500,000, requests_per_minute=4,000\n",
+      "claude-sonnet-5    input_tokens_per_minute=10,000,000, output_tokens_per_minute=2,000,000, requests_per_minute=10,000\n"
+     ]
+    }
+   ],
+   "source": [
+    "for rl in client.beta.organization.rate_limits.list():\n",
+    "    if rl.group_type == \"model_group\" and MODEL not in (rl.models or []):\n",
+    "        continue\n",
+    "    label = MODEL if rl.group_type == \"model_group\" else rl.group_type\n",
+    "    limits = \", \".join(f\"{limit.type}={limit.value:,}\" for limit in rl.limits)\n",
+    "    print(f\"{label:<18} {limits}\")"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "id": "59307873",
+   "metadata": {},
+   "source": [
+    "Workspaces inherit those values. An admin can cap a workspace lower in the Console, and `workspaces.rate_limits.list()` returns only the values that were overridden."
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": 15,
+   "id": "565367f2",
+   "metadata": {
+    "execution": {
+     "iopub.execute_input": "2026-08-26T18:07:08.239432Z",
+     "iopub.status.busy": "2026-08-26T18:07:08.239317Z",
+     "iopub.status.idle": "2026-08-26T18:07:08.490157Z",
+     "shell.execute_reply": "2026-08-26T18:07:08.489724Z"
+    }
+   },
+   "outputs": [
+    {
+     "name": "stdout",
+     "output_type": "stream",
+     "text": [
+      "research-20260826-180659 has no overrides and inherits the organization limits\n"
+     ]
+    }
+   ],
+   "source": [
+    "overrides = list(client.beta.organization.workspaces.rate_limits.list(workspace.id))\n",
+    "if not overrides:\n",
+    "    print(f\"{workspace.name} has no overrides and inherits the organization limits\")\n",
+    "for rl in overrides:\n",
+    "    print(rl.group_type, rl.models, [(limit.type, limit.value) for limit in rl.limits])"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "id": "48091b57",
+   "metadata": {},
+   "source": [
+    "## Clean up\n",
+    "\n",
+    "Remove what this notebook created. **Archiving a workspace is permanent and revokes every API key in it**, so double-check `workspace.name` before running this against a real organization. Archived workspaces don't count toward the 100-workspace limit.\n",
+    "\n",
+    "If an earlier cell raised, run this cell by hand. It needs `workspace`, `service_account`, and `invite` from the kernel."
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": 16,
+   "id": "dd31c2a9",
+   "metadata": {
+    "execution": {
+     "iopub.execute_input": "2026-08-26T18:07:08.491482Z",
+     "iopub.status.busy": "2026-08-26T18:07:08.491367Z",
+     "iopub.status.idle": "2026-08-26T18:07:09.429127Z",
+     "shell.execute_reply": "2026-08-26T18:07:09.428448Z"
+    }
+   },
+   "outputs": [
+    {
+     "name": "stdout",
+     "output_type": "stream",
+     "text": [
+      "archived workspace research-20260826-180659 at 2026-08-26 18:07\n",
+      "archived service account ci-research-20260826-180659\n",
+      "deleted invite for new.teammate+20260826-180659@example.com\n"
+     ]
+    }
+   ],
+   "source": [
+    "archived = client.beta.organization.workspaces.archive(workspace.id)\n",
+    "print(f\"archived workspace {archived.name} at {archived.archived_at:%Y-%m-%d %H:%M}\")\n",
+    "\n",
+    "if service_account:\n",
+    "    retry_on_not_found(\n",
+    "        lambda: client.beta.organization.service_accounts.archive(service_account.id)\n",
+    "    )\n",
+    "    print(f\"archived service account {service_account.name}\")\n",
+    "\n",
+    "# Deleting an accepted invite returns a 400, because that person is a member now.\n",
+    "if client.beta.organization.invites.retrieve(invite.id).status == \"pending\":\n",
+    "    client.beta.organization.invites.delete(invite.id)\n",
+    "    print(f\"deleted invite for {invite.email}\")\n",
+    "else:\n",
+    "    print(f\"{invite.email} joined the organization, offboard them with users.remove()\")"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "id": "115dc9be",
+   "metadata": {},
+   "source": [
+    "## Next steps\n",
+    "\n",
+    "You authenticated as an admin, invited a user, created a workspace, gave a service account access to it, audited the organization's API keys, and read its rate limits, all through `client.beta.organization`.\n",
+    "\n",
+    "Related admin surfaces that aren't covered here:\n",
+    "\n",
+    "- [Usage and cost cookbook](../observability/usage_cost_api.ipynb) and the [Usage and Cost API](https://platform.claude.com/docs/en/manage-claude/usage-cost-api): token and dollar reporting by workspace, key, and model\n",
+    "- [Claude Code Analytics API](https://platform.claude.com/docs/en/manage-claude/claude-code-analytics-api): per-user Claude Code activity for the organization\n",
+    "- [Workload identity federation](https://platform.claude.com/docs/en/manage-claude/workload-identity-federation): keyless authentication for the service account you created, via `client.beta.organization.federation`\n",
+    "- [Admin API reference](https://platform.claude.com/docs/en/api/admin): every endpoint, including the ones the SDK exposes under `external_keys` and `federation`"
+   ]
+  }
+ ],
+ "metadata": {
+  "kernelspec": {
+   "display_name": "Python 3",
+   "language": "python",
+   "name": "python3"
+  },
+  "language_info": {
+   "codemirror_mode": {
+    "name": "ipython",
+    "version": 3
+   },
+   "file_extension": ".py",
+   "mimetype": "text/x-python",
+   "name": "python",
+   "nbconvert_exporter": "python",
+   "pygments_lexer": "ipython3",
+   "version": "3.12.3"
+  }
+ },
+ "nbformat": 4,
+ "nbformat_minor": 5
+}
diff --git a/content/github/claude-plugins-official/.claude-plugin/marketplace.json b/content/github/claude-plugins-official/.claude-plugin/marketplace.json
index 6c20581a34..c2a548774b 100644
--- a/content/github/claude-plugins-official/.claude-plugin/marketplace.json
+++ b/content/github/claude-plugins-official/.claude-plugin/marketplace.json
@@ -110,6 +110,7 @@
     },
     {
       "name": "airwallex-agentos",
+      "displayName": "Airwallex",
       "description": "Bring Airwallex's global financial infrastructure to Claude. Orchestrate actions across your account in plain language, e.g., set up invoices from a PO, onboard suppliers from invoices, and check current cash position across currencies. AgentOS bundles pre-built finance Skills with MCP servers. A public CLI connects your agent to Airwallex's capabilities.",
       "author": {
         "name": "Airwallex"
@@ -1909,6 +1910,22 @@
       "category": "productivity",
       "source": "./external_plugins/imessage"
     },
+    {
+      "name": "incident-io",
+      "description": "Work with incident.io from Claude: respond to and investigate incidents, check on-call schedules and escalations, and author the runbooks, skills and architecture docs that incident.io investigations draw on. Bundles the official incident.io MCP server (OAuth on first use).",
+      "author": {
+        "name": "incident.io"
+      },
+      "category": "monitoring",
+      "source": {
+        "source": "git-subdir",
+        "url": "https://github.com/incident-io/skills.git",
+        "path": "plugins/incident-io",
+        "ref": "main",
+        "sha": "6d0bbfc9e52256fc39326b9ba6d08f16831b60ae"
+      },
+      "homepage": "https://incident.io"
+    },
     {
       "name": "informatica-for-claude-platform",
       "description": "Governed catalog discovery for Informatica Intelligent Data Management Cloud (CDGC): find tables, columns, files, glossary terms and policies across the enterprise catalog, check ownership, certification, sensitivity and applicable policy, and get safe-usage guidance grounded in catalog metadata before querying any data. Requires an Informatica IDMC tenant and the Informatica Catalog Discovery connector.",
@@ -3022,7 +3039,7 @@
     {
       "name": "qodo",
       "displayName": "Qodo",
-      "description": "Qodo setup, code intelligence, and review workflows.",
+      "description": "Bring Qodo's codebase intelligence, coding standards, and code review into your coding agent.",
       "author": {
         "name": "Qodo",
         "email": "support@qodo.ai"
@@ -4318,6 +4335,21 @@
         "sha": "9529e72715d96ab47738e8edf83d49798d0f8be5"
       },
       "homepage": "https://www.dynatrace.com/hub/detail/claude-code-cli/"
+    },
+    {
+      "name": "wingspan",
+      "displayName": "Wingspan",
+      "description": "Ask Claude about the contractors you pay through Wingspan, what you owe them, and what is holding up a payment, then onboard contractors and log payments as drafts, with a preview before anything is written. Requires a Wingspan account; bundles the Wingspan MCP server (OAuth on first use).",
+      "author": {
+        "name": "Wingspan"
+      },
+      "category": "productivity",
+      "source": {
+        "source": "url",
+        "url": "https://github.com/wingspanHQ/mcp-claude-plugin.git",
+        "sha": "b989f3b303a1f605955291e34ed29b755bf436e1"
+      },
+      "homepage": "https://github.com/wingspanHQ/mcp-claude-plugin"
     }
   ]
 }
diff --git a/content/github/claude-quickstarts/README.md b/content/github/claude-quickstarts/README.md
index cb9d01a1cc..3dda60a835 100644
--- a/content/github/claude-quickstarts/README.md
+++ b/content/github/claude-quickstarts/README.md
@@ -62,6 +62,24 @@ A deal-room knowledge wiki built with Claude Managed Agents. This project demons
 
 [Go to Managed Agents Knowledge Wiki Quickstart](./managed-agents/knowledge-wiki)
 
+### Managed Agents: Linear
+
+An agent you can @mention or assign in Linear, backed by a Claude Managed Agent. This project demonstrates a stateless webhook bridge on Linear's Agent Platform: an `AgentSessionEvent` creates a Managed Agents session with the Linear session and organization IDs stored in session metadata, and the `session.status_idled` webhook reads that metadata back to post the reply as a comment. It installs through Linear OAuth with `actor=app`.
+
+[Go to Managed Agents Linear Quickstart](./managed-agents/linear)
+
+### Managed Agents: MCP Server (TypeScript)
+
+An MCP server that exposes the Claude Managed Agents Sessions API as nine tools. This project demonstrates how to let Claude Desktop, Claude Code, or claude.ai drive the agents already in your workspace: list them, start a session, send a message, and wait for the reply, over stdio or Streamable HTTP. One tool, `wait_for_idle`, turns the session's event stream into a single request/response call, and an agent allowlist limits what a bearer-token holder can reach.
+
+[Go to Managed Agents MCP Server (TypeScript) Quickstart](./managed-agents/mcp-server-typescript)
+
+### Managed Agents: Road Trip Planner
+
+A national-park road trip planner built directly on a Claude Managed Agents session, in Next.js with no chat framework and no database. This project demonstrates four API features on one screen: token-by-token streaming with `event_deltas` on the session event stream, vault credentials injected at a specific request location (`injection_location`), a per-session model override with `agent_with_overrides`, and a `multiagent` coordinator that hands its draft to a reviewer agent in a session thread.
+
+[Go to Managed Agents Road Trip Planner Quickstart](./managed-agents/roadtrip-planner)
+
 ### Managed Agents: Sentry
 
 A scheduled Sentry triage agent built on Claude Managed Agents. This project demonstrates a deployment that starts a session on a cron schedule with no host process, and a vault environment-variable credential that lets `sentry-cli` authenticate inside the sandbox while the real token stays outside it: the egress proxy substitutes it only on requests to Sentry's hosts.
diff --git a/content/github/claude-quickstarts/managed-agents/README.md b/content/github/claude-quickstarts/managed-agents/README.md
index eae896f157..5315f75559 100644
--- a/content/github/claude-quickstarts/managed-agents/README.md
+++ b/content/github/claude-quickstarts/managed-agents/README.md
@@ -42,6 +42,34 @@ Projects built on [Claude Managed Agents](https://platform.claude.com/docs/en/ma
   example is a real M&A data room: the 2024 Squarespace / Permira
   take-private, fetched from public SEC EDGAR filings.
 
+- **[linear/](linear/)** answers `@mentions` and assignments in
+  Linear issues with a comment, over a stateless Bun webhook bridge
+  on Linear's Agent Platform. The `AgentSessionEvent` creates a
+  session with the Linear session and organization IDs stored in
+  session `metadata`, the handler posts a "thought" inside Linear's
+  10-second window, and the `session.status_idled` webhook reads that
+  metadata back to post the reply. It installs through Linear OAuth
+  with `actor=app`, the first workspace to install owns the bridge,
+  and Stop in Linear interrupts the running session.
+
+- **[mcp-server-typescript/](mcp-server-typescript/)** wraps the
+  Sessions API as nine MCP tools, so Claude Desktop, Claude Code, or
+  claude.ai can list the agents in your workspace, start sessions,
+  and relay messages to them. Eight tools map 1:1 to endpoints, and
+  `wait_for_idle` turns the event stream into one request/response
+  call. It creates no agents of its own. The HTTP entrypoint binds
+  loopback by default, and `ALLOWED_AGENT_IDS` limits which agents a
+  bearer-token holder can reach.
+
+- **[roadtrip-planner/](roadtrip-planner/)** plans national park
+  road trips in a Next.js chat built directly on a session, with no
+  chat framework and no database. It shows four API features on one
+  screen: `event_deltas` token streaming through a thin SSE proxy,
+  vault credentials injected at a header or in a JSON body with
+  `injection_location`, a per-session model override with
+  `agent_with_overrides`, and a `multiagent` coordinator that hands
+  its draft to a reviewer agent on the same event stream.
+
 - **[self-hosted-sandboxes/](self-hosted-sandboxes/)** runs sessions
   on hardware you control. A self-hosted environment is a work queue:
   a host process polls it with the environment key and starts one
diff --git a/content/github/claude-quickstarts/managed-agents/linear/CLAUDE.md b/content/github/claude-quickstarts/managed-agents/linear/CLAUDE.md
new file mode 100644
index 0000000000..d652edd253
--- /dev/null
+++ b/content/github/claude-quickstarts/managed-agents/linear/CLAUDE.md
@@ -0,0 +1,19 @@
+# Linear × Claude Managed Agents bridge
+
+Stateless webhook bridge: Linear `AgentSessionEvent` → Managed Agents session (with routing metadata) → `session.status_idled` webhook → `createAgentActivity` reply.
+
+## When the user asks to set this up, get it working, or debug it
+
+1. **Invoke `/claude-api` first.** That skill loads the full Managed Agents API reference (agents, sessions, environments, events, webhooks, outcomes, multiagent, vaults, memory stores). Use it as the source of truth for any SDK call you write or edit. Don't guess field names.
+2. **Read `./skill.md`** and walk the user through it step by step. It has the ordered checklist, every gotcha (workspace-scoped webhooks, `actor=app` OAuth, the 10-second ack rule, retrieve-then-filter, the open install endpoint), and the debugging table.
+3. **After the base bridge works, offer extensions.** Ask the user which (if any) they want, then edit `agents/linear-assistant/agent.yaml` and re-run `./agents/setup.sh`, which pushes the edit as a new agent version, and/or edit `src/agent.ts` for the session side. A new resource is a new YAML file in `agents/linear-assistant/` plus one more create/update block in `setup.sh`, copied from the two already there.
+   - **GitHub repo**: mount a repo into the session container (`resources: [{type: "github_repository", ...}]` on `sessions.create`)
+   - **MCP tools**: e.g. Linear or GitHub MCP so the agent can act, not only reply (`mcp_servers` + `mcp_toolset` in `agent.yaml`, `agents/linear-assistant/vault.yaml` plus an `ant beta:vaults create` block in `setup.sh` that appends `CLAUDE_VAULT_ID`, then `vault_ids` on the session)
+   - **Outcomes**: rubric-graded iterate loop (`user.define_outcome` event instead of `user.message`)
+   - **Multiagent**: coordinator + subagent roster (`multiagent: {type: coordinator, agents: [...]}` in `agent.yaml`)
+   - **Memory store**: cross-session persistence (add `agents/linear-assistant/memory-store.yaml` and an `ant beta:memory-stores create` block in `setup.sh`, then `resources: [{type: "memory_store", ...}]` on `sessions.create`)
+   - **Custom tools**: host-side execution via `agent.custom_tool_use` / `user.custom_tool_result`
+
+   Pull exact shapes from the `/claude-api` skill's `shared/managed-agents-*.md` docs.
+
+Run the server with `bun run dev`. Agent provisioning is `./agents/setup.sh`: it creates the agent and environment from `agents/linear-assistant/*.yaml` with the `ant` CLI, writes their IDs to `.env`, and on re-runs pushes YAML edits onto the same resources.
diff --git a/content/github/claude-quickstarts/managed-agents/linear/README.md b/content/github/claude-quickstarts/managed-agents/linear/README.md
new file mode 100644
index 0000000000..a04c112abe
--- /dev/null
+++ b/content/github/claude-quickstarts/managed-agents/linear/README.md
@@ -0,0 +1,52 @@
+# Linear × Claude Managed Agents
+
+`@mention` a Claude [Managed Agent](https://platform.claude.com/docs/en/managed-agents/overview) in a Linear issue, or assign the issue to it, and get the reply as a comment. The bridge is stateless: the session's `metadata` (`linear_session_id`, `linear_org_id`) is the only routing state, so there is no database and no mapping table.
+
+```
+Linear @mention ──▶ /linear-webhook ──▶ sessions.create (+ metadata) ──▶ 200
+                                                   │
+                                 Claude runs to idle on Anthropic infra
+                                                   │
+/managed-agents/webhook ◀── session.status_idled ◀─┘
+      │
+      └──▶ sessions.retrieve → read metadata → createAgentActivity
+```
+
+## Quickstart
+
+Needs [Bun](https://bun.sh/), the [`ant` CLI](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/quickstart) 1.19 or later (`brew install anthropics/tap/ant`), a public HTTPS tunnel such as ngrok, admin rights on a Linear workspace, and Anthropic auth: `ant auth login` once, or an API key from [platform.claude.com](https://platform.claude.com/).
+
+```bash
+cd managed-agents/linear
+bun install
+claude "walk me through setting this up"   # reads skill.md and drives the rest
+```
+
+Claude walks through the Linear OAuth app, the agent and webhook, the env vars, and `bun run dev` in the order that works.
+
+Or by hand:
+
+```bash
+ant auth login            # or put ANTHROPIC_API_KEY in .env (cp .env.example .env)
+./agents/setup.sh         # creates the agent + environment from agents/linear-assistant/*.yaml, writes their IDs to .env
+bun run dev               # then follow the local dev checklist in skill.md for the Linear and webhook halves
+```
+
+To change the agent (model, prompt, tools), edit [`agents/linear-assistant/agent.yaml`](agents/linear-assistant/agent.yaml) and re-run `./agents/setup.sh`.
+
+## Before you expose it
+
+`/oauth/authorize` has no login in front of it, and every mention from an installed workspace runs a session on your Anthropic credentials. So the first Linear workspace to install owns the bridge, and installs from any other workspace are refused and revoked. To pin that choice, or to serve more than one workspace, set `LINEAR_ALLOWED_ORG_IDS` in `.env` (the server logs the organization ID on install). See `skill.md`, "Issue text is untrusted input", for what a mention can make the agent do.
+
+## Files
+
+| | |
+|---|---|
+| `agents/linear-assistant/` | The agent and environment definitions `setup.sh` provisions |
+| `src/main.ts` | Bun server, routes |
+| `src/oauth.ts` | Linear OAuth (`actor=app`, single-use `state`) + token store |
+| `src/agent.ts` | `sessions.create` + `user.message` with routing metadata |
+| `src/managed-agents-webhook.ts` | `beta.webhooks.unwrap` → filter by metadata → post reply |
+| `skill.md` | Mental model, gotchas, setup checklist, debugging |
+
+Requires `@anthropic-ai/sdk` ≥ 0.109.0.
diff --git a/content/github/claude-quickstarts/managed-agents/linear/skill.md b/content/github/claude-quickstarts/managed-agents/linear/skill.md
new file mode 100644
index 0000000000..b800f5fa8b
--- /dev/null
+++ b/content/github/claude-quickstarts/managed-agents/linear/skill.md
@@ -0,0 +1,130 @@
+# Setup tips & tricks: Linear × Claude Managed Agents webhook bridge
+
+Things that aren't obvious from the docs and tend to cost debugging time.
+
+---
+
+## Mental model
+
+### A webhook is "call me when something happens"
+
+It's an HTTP POST a service sends to a URL you gave it, with a small JSON body describing an event. You register the URL once, and the service calls it whenever the event fires. No polling, no held-open connections.
+
+### The bridge is mandatory (today)
+
+Linear's Agent Platform and Managed Agents don't share a wire format or credentials. Something has to translate "Linear @mention" → "`user.message`" on the way in, and "session idle" → "Linear comment" on the way out, while holding both sets of keys. That's the bridge.
+
+### Two webhooks, one bridge
+
+- **Linear → bridge** (`/linear-webhook`) fires on @mention or assignment. Payload carries `agentSession.id`, `organizationId`, and issue context.
+- **Anthropic → bridge** (`/managed-agents/webhook`) fires on session idle. Payload carries **only** the session ID.
+
+Neither carries a "callback URL." Neither carries the agent's output. Both are *signals* with IDs.
+
+### The webhook is a doorbell, not a delivery
+
+Anthropic's `session.status_idled` payload is deliberately thin: `{type, id}`. You always follow up with `sessions.retrieve(id)` (to get metadata) and `sessions.events.list(id)` (to get the output). Push the signal, pull the data. Retries stay cheap and data is never stale.
+
+### `metadata` is the entire routing state
+
+When the bridge creates the session it sets `metadata: {linear_session_id, linear_org_id}`. When the idle webhook arrives later with only a session ID, the bridge retrieves the session, reads those keys back, and knows exactly where to reply, with nothing stored in the bridge itself. This is what makes it stateless.
+
+---
+
+## Gotchas
+
+### Anthropic webhooks are workspace-scoped
+
+The endpoint you register in Console only receives events for sessions **in that same workspace**. If your Anthropic credentials belong to workspace A but you registered the endpoint in workspace B, you get **zero deliveries, silently**. Match the workspace picker on the Console's Webhooks page to the Workspace column on your API key, or to the workspace `ant auth login` signed you into.
+
+### A workspace webhook fires for *every* session in the workspace
+
+Not only yours. If the Anthropic workspace is shared with other agents, scripts, or teammates, every `session.status_idled` in that workspace hits your endpoint. Your handler **must** filter: `sessions.retrieve(id)` → check for your `metadata` keys → return 204 for anything that isn't yours. Also catch 404/403 on `sessions.retrieve`, and only those. Sessions created under other API keys in the same workspace aren't readable by yours, but a 429 or 5xx is a real failure that should be retried.
+
+Corollaries: subscribe only to the event types you need (`session.status_idled`, `session.status_terminated`), not "All events". For production, consider a dedicated Anthropic workspace so there are no unrelated sessions to discard.
+
+### Linear OAuth apps are workspace-admin-only
+
+OAuth apps live at `linear.app/<your-workspace>/settings/api`. In the sidebar it's **Administration → API**, then the **OAuth Applications** section. If you're not an admin of your company workspace, spin up a free personal workspace for testing. It takes two minutes and you won't install an experimental agent into production.
+
+When creating the app, the **Developer URL** field is required but cosmetic (it's a link shown on the consent screen). Any real `https://` URL is fine.
+
+### `actor=app` is the load-bearing OAuth parameter
+
+`scope=app:assignable,app:mentionable` + `actor=app` is what creates an **app user** in the Linear workspace that shows up in the @-picker. A personal `LINEAR_API_KEY` won't do this. The bridge must post back *as the app*, via the OAuth token.
+
+### `BASE_URL` has to match the callback URL exactly
+
+`src/oauth.ts` builds the redirect URI as `${BASE_URL}/oauth/callback` and sends it on both the authorize redirect and the token exchange. Linear rejects the exchange unless it matches the callback URL registered on the OAuth app character for character. A new ngrok URL means updating both `.env` and the Linear app.
+
+### The first install owns the bridge
+
+`/oauth/authorize` has no login in front of it. Anyone who can reach the server could install the agent into a Linear workspace they administer, and from then on every mention there would run a session on your Anthropic credentials. So the gate fails closed. With `LINEAR_ALLOWED_ORG_IDS` unset, the first workspace to install is the only one the bridge serves: a later install from a different workspace gets a 403 and its token is revoked, and webhook events from it are ignored. Install your own workspace right after you start the server, and check the log line names it.
+
+Set `LINEAR_ALLOWED_ORG_IDS` to a comma-separated list of organization IDs to pin that choice or to serve more than one workspace. The server logs the organization ID on each install. To hand the bridge to a different workspace, delete `.linear-tokens.json` and install again.
+
+The flow also uses a single-use `state` value that expires after 10 minutes, so a callback only succeeds if this server started it. Restarting the server forgets pending states. If you see "Unknown or expired state", start again at `/oauth/authorize`.
+
+### The idle webhook only trusts routes it signed
+
+`metadata` says where to reply, but it does not prove the session is the bridge's. Anyone with credentials for the same Anthropic workspace can start a session, on this same agent, with `linear_session_id` and `linear_org_id` of their choosing. A handler that trusted those keys would post their text into your Linear issue with your token. Checking `session.agent.id` and `session.environment_id` is a useful first filter and nothing more, because agent IDs are not secrets.
+
+So at kickoff `src/agent.ts` stores `linear_route_sig`, an HMAC over the Claude session ID, the Linear session ID, and the organization ID, keyed by a secret derived from `LINEAR_CLIENT_SECRET`, which never leaves the bridge. `src/managed-agents-webhook.ts` recomputes it and compares in constant time before posting anything. The Claude session ID is part of the signed text on purpose: metadata is readable by the same people who can forge it, so a signature over the route alone could be copied onto another session. The signature is also single-use. A signed session is still a session that anyone with workspace credentials can send another message to, and its next idle would post their text into the issue. So once the bridge has delivered, or decided it never will, it deletes `linear_route_sig` from the metadata, and later idles are refused. A retryable failure leaves it in place so the retry can still verify. The bridge also remembers delivered sessions in memory and takes a per-session lock right after verifying, because the remote delete can fail and two idle events for one session carry different event ids. And the signed text includes an issued-at time: a route older than 24 hours is refused, so one whose delivery keeps failing does not stay live with no end. An agent run longer than that loses its reply. Raise `MAX_AGE_SECONDS` in `src/route-signature.ts` if yours do. If you fork this, keep the verify call between the metadata read and the first Linear call, and keep the delete after the delivery. Rotating `LINEAR_CLIENT_SECRET` invalidates the signatures of sessions still running, and their replies are dropped with a log line.
+
+### Issue text is untrusted input
+
+The prompt is the issue title, description, and comments, which anyone with access to the Linear workspace can write. `src/agent.ts` wraps each piece in a tag such as `<linear_issue_description>` and the system prompt tells the agent to treat tagged text as data. That lowers the odds that an injected instruction is followed. It does not remove them. The agent has the full toolset (`bash`, web fetch) with `always_allow`, in a sandbox with unrestricted egress, and nobody approves a step. Treat it like running a script a stranger wrote: keep secrets out of the sandbox, and if you mount a repo or add MCP tools, scope their credentials to what a hostile issue should be able to touch. `agents/linear-assistant/environment.yaml` is where to switch networking to `limited` with an allowlist.
+
+### Linear's 10-second ack rule
+
+The bridge must post *some* `agentActivity` (a `{type: "thought"}` is enough) within 10 seconds of receiving the `AgentSessionEvent`, or Linear marks the session failed. Do this *before* creating the Managed Agents session.
+
+### `event.id` is your idempotency key
+
+Anthropic retries failed deliveries with the **same** top-level `event.id`. Dedupe on it, but only mark an id handled once handling finished. If it threw, the retry has to be processed or the reply is lost. A duplicate that arrives while the first attempt is still running gets a 503, not a 204: acking it would mark the event delivered while the outcome is still unknown. Return 2xx once you've either handled it or decided to ignore it. Anything else triggers a retry, and ~20 consecutive failures auto-disables your endpoint. That is why a Linear error a retry can't fix (no token for the org, a revoked install or a refused token refresh, an agent session Linear has closed) is logged and acked instead of thrown.
+
+### Stop interrupts the run, best effort
+
+Linear sends Stop as a `prompted` event whose activity carries `signal: "stop"`. Treated as a prompt, it would start a second session. `src/agent.ts` remembers which Claude session is working on each Linear session, sends that session `user.interrupt`, posts "Stopped.", and the idle webhook then skips the interrupted run's half-finished text.
+
+That map is the one piece of state the bridge keeps, and it lives in memory. After a restart the bridge has no record of runs started before it, so Stop says exactly that instead of claiming a stop that did not happen. Reply routing never depends on the map. It still reads `metadata`. For production, keep `linear_session_id → session.id` in Redis or a DB.
+
+### No approval surface, so tools are `always_allow`
+
+`agents/linear-assistant/agent.yaml` sets `permission_policy: {type: always_allow}` on the toolset. An `always_ask` tool idles the session to wait for a confirmation, the idle webhook fires, and the bridge posts whatever partial text exists. If you add an approval flow (Linear's `elicitation` activity plus `user.tool_confirmation`), switch the risky tools back to `always_ask`.
+
+### Signature header names
+
+The docs say `X-Webhook-Signature`. The wire uses `Webhook-Signature` / `Webhook-Id` / `Webhook-Timestamp` (Standard Webhooks spec). The SDK's `webhooks.unwrap()` handles this, so it only matters if you're verifying by hand.
+
+---
+
+## Local dev checklist
+
+1. `ngrok http 3000` (or `cloudflared tunnel`) → note the public URL and set it as `BASE_URL` in `.env` (`cp .env.example .env` first). Everything below uses it.
+2. `ant auth login` (or set `ANTHROPIC_API_KEY` in `.env`), then `./agents/setup.sh`. It appends `CLAUDE_AGENT_ID` and `CLAUDE_ENVIRONMENT_ID` to `.env`. **Don't overwrite them later** when you paste in the Linear secrets.
+3. Linear OAuth app (**Administration → API → OAuth Applications → Create new**): Developer URL = any real `https://` URL (cosmetic). Callback `<url>/oauth/callback`. Webhook `<url>/linear-webhook`, events = Agent session events → copy client ID/secret + webhook secret into `.env`.
+4. Claude Console → **Manage → Webhooks**: `<url>/managed-agents/webhook`, events = `session.status_idled` + `session.status_terminated` → copy `whsec_…` → `ANTHROPIC_WEBHOOK_SIGNING_KEY`. **Same workspace as your Anthropic credentials.**
+5. `bun run dev`.
+6. Visit `<url>/oauth/authorize` → approve → "Agent installed." The server logs `[oauth] installed in "<name>" (<org-id>)`. That workspace now owns the bridge. Put the ID in `LINEAR_ALLOWED_ORG_IDS` to pin it.
+7. @mention it in an issue.
+
+### Debugging a silent failure
+
+- **"Thinking…" never appears** → Linear webhook isn't reaching you. Check the Linear app's webhook URL and that ngrok is up. If the log shows `ignored event from org …`, a different workspace installed first or that workspace isn't in `LINEAR_ALLOWED_ORG_IDS`.
+- **"Thinking…" appears but no reply** → check `curl localhost:4040/api/requests/http` (ngrok's request log). If no POST to `/managed-agents/webhook`: workspace mismatch on the Anthropic side, or endpoint not saved. If POST arrives with 401: signing key mismatch. If the log shows `could not post to linear=…`: the message names the cause, usually a missing `.linear-tokens.json` entry (reinstall at `/oauth/authorize`).
+- **`FATAL: … .linear-tokens.json is not valid`** at startup → the token file is corrupt. The bridge refuses to start on it, because reading it as empty would let any workspace install. Fix the JSON, or delete the file and reinstall at `/oauth/authorize`.
+- **`FATAL: CLAUDE_AGENT_ID is required`** → `./agents/setup.sh` hasn't run yet. It appends the IDs to `.env` in this directory.
+- **`./agents/setup.sh` fails with 409 on the environment** → environment names are unique per workspace and someone already created `quickstart-linear-assistant-env` there. Paste that environment's ID into `.env` as `CLAUDE_ENVIRONMENT_ID`, or change `name` in `agents/linear-assistant/environment.yaml`, then re-run.
+- **`Linear refused to refresh the token for org …`** in the log → Linear answered `invalid_grant`: the workspace uninstalled the app. Reinstall at `/oauth/authorize`. An `invalid_client` in the log instead means `LINEAR_CLIENT_SECRET` is wrong.
+- **"Linear rejected the install"** after approving → the server log has Linear's response. The usual cause is `BASE_URL` not matching the app's callback URL.
+- **The bot answers with an old prompt or model** → Bun loads `.env.local` over `.env`. If you have one left from the cookbook version of this bridge, delete it.
+
+---
+
+## Production notes
+
+- Replace ngrok with a real deploy (Cloudflare Workers, Fly, etc.). Nothing else changes.
+- Replace the in-memory `seenEventIds` Set and the pending OAuth `state` map with Redis or a DB for multi-instance deploys.
+- Replace the `.linear-tokens.json` file with a real secret store. The bridge writes it owner-only (`0600`) and replaces it atomically, which is enough for a laptop and not for a server.
+- Narrow the Anthropic endpoint's event subscription to exactly what you handle.
diff --git a/content/github/claude-quickstarts/managed-agents/mcp-server-typescript/CLAUDE.md b/content/github/claude-quickstarts/managed-agents/mcp-server-typescript/CLAUDE.md
new file mode 100644
index 0000000000..0ac959629e
--- /dev/null
+++ b/content/github/claude-quickstarts/managed-agents/mcp-server-typescript/CLAUDE.md
@@ -0,0 +1,13 @@
+# MCP server (TypeScript) × Claude Managed Agents
+
+MCP server that exposes Managed Agents session primitives as tools. Two entrypoints sharing one tool set: `src/server.ts` (stdio → Claude Desktop and Claude Code) and `src/server-http.ts` (Streamable HTTP → claude.ai custom connector).
+
+## When the user asks to set this up, extend it, or debug it
+
+1. **Invoke `/claude-api` first.** That skill loads the full Managed Agents API reference (agents, sessions, events, environments). Use it as the source of truth for any SDK call. Don't guess field names.
+2. **Read `./skill.md`** and walk the user through it. First ask which client they're targeting (Claude Desktop or Claude Code → stdio path, claude.ai → HTTP + deploy + connector), then follow that path's checklist. Both end with the same `send_message → wait_for_idle` loop and relay-mode Project instructions. For the HTTP path, do not skip "What the token can reach": get `ALLOWED_AGENT_IDS` set before anything is deployed.
+3. **Adding a tool?** Write the SDK call in `src/managed-agents.ts`, then register it in `src/tools.ts` with a zod schema and a scope (`"agent"`, `"session"`, or `"listing"`). The scope is what runs the `ALLOWED_AGENT_IDS` check, and registration throws if it doesn't match the schema. A `"listing"` tool takes no ID, so it has to filter its own results the way `listAgents` does. See the table in `skill.md` for what is deliberately **not** exposed (destructive ops, secrets).
+
+This quickstart creates no agents, so there is no `agents/` directory. It needs one environment, created once from `environment.yaml` (the command is in that file and in `README.md`).
+
+Commands: `bun run stdio` (Desktop, Code), `bun run http` (claude.ai), `bun run typecheck`.
diff --git a/content/github/claude-quickstarts/managed-agents/mcp-server-typescript/README.md b/content/github/claude-quickstarts/managed-agents/mcp-server-typescript/README.md
new file mode 100644
index 0000000000..c68c99cfb3
--- /dev/null
+++ b/content/github/claude-quickstarts/managed-agents/mcp-server-typescript/README.md
@@ -0,0 +1,77 @@
+# MCP server (TypeScript) × Claude Managed Agents
+
+A thin [MCP](https://modelcontextprotocol.io) server that wraps the Claude [Managed Agents](https://platform.claude.com/docs/en/managed-agents/overview) Sessions API, so Claude Desktop, Claude Code, **or** claude.ai can start and chat with the agents already in your workspace as if they were tools.
+
+```
+User ─▶ Claude (Desktop, Code, or claude.ai) ─▶ MCP: send_message + wait_for_idle ─▶ session
+  ▲                                                                                    │
+  └────────────────────────── agent's reply ◀─── stream-to-idle ◀──────────────────────┘
+```
+
+Nine tools. Eight are 1:1 with Managed Agents endpoints, and one (`wait_for_idle`) is the SSE to request/response shim. Same handlers, two transports.
+
+This is the remote-control shape: every agent the server's credentials can reach, driven through the raw session primitives, from TypeScript, over stdio or HTTP. The other common shape publishes one agent as a purpose-built tool, such as `ask_research_specialist`, with per-caller keys and a continuation token for turns that outlast the client's timeout. Build that one to hand a single agent to other agent platforms. Use this one to operate your own workspace from a chat window.
+
+## Quickstart
+
+Needs [Bun](https://bun.sh/), the [`ant` CLI](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/quickstart) 1.19 or later (`brew install anthropics/tap/ant`), and Anthropic auth: `ant auth login` once, or an API key from [platform.claude.com](https://platform.claude.com/).
+
+```bash
+cd managed-agents/mcp-server-typescript
+bun install
+claude "walk me through setting this up"   # reads skill.md and drives the rest
+```
+
+Claude asks which client you're targeting and follows that path:
+
+| Client | Transport | Entrypoint |
+|---|---|---|
+| **Claude Desktop / Claude Code** | stdio (local process) | `src/server.ts` |
+| **claude.ai** (custom connector) | Streamable HTTP (deployed URL + bearer token) | `src/server-http.ts` |
+
+Or by hand, for the stdio path:
+
+```bash
+ant auth login            # or put ANTHROPIC_API_KEY in .env (cp .env.example .env)
+printf 'CLAUDE_ENVIRONMENT_ID=%s\n' \
+  "$(ant beta:environments create --transform id --raw-output < environment.yaml)" >> .env
+claude mcp add managed-agents -- bun --env-file="$PWD/.env" run "$PWD/src/server.ts"
+```
+
+This quickstart creates no agents. There is no `agents/` directory and no `setup.sh`, because the server drives the agents already in your workspace. It needs one environment, which is what the second command creates from [`environment.yaml`](environment.yaml). If the workspace has no agents yet, run `./agents/setup.sh` in a sibling quickstart such as [`../slack`](../slack) or [`../chat-sdk`](../chat-sdk) first.
+
+## Before you put it on a network
+
+The HTTP server's bearer token lets its holder list, read, and run **every agent in the workspace** the server's Anthropic credentials belong to, and the bill goes to those credentials. Two settings narrow that, and both are in `.env.example`:
+
+- **`ALLOWED_AGENT_IDS`**: a comma-separated list of agent IDs. When set, `list_agents` returns only those, `get_agent` and `create_session` refuse anything else, and every tool that takes a `session_id` first checks that the session belongs to one of them. Set it before you deploy.
+- **`ALLOWED_HOSTS`**: the public hostname clients will use. The server binds `127.0.0.1` by default and refuses to start on another `HOST` until this is set.
+
+See `skill.md`, "What the token can reach", for the rest.
+
+## Tools
+
+| Tool | Managed Agents endpoint |
+|---|---|
+| `list_agents` / `get_agent` | `GET /v1/agents[/{id}]` |
+| `create_session` | `POST /v1/sessions` |
+| `send_message` / `interrupt` | `POST /v1/sessions/{id}/events` |
+| `get_session` | `GET /v1/sessions/{id}` |
+| `list_events` | `GET /v1/sessions/{id}/events` |
+| `archive_session` | `POST /v1/sessions/{id}/archive` |
+| **`wait_for_idle`** | streams `…/events/stream` until idle, returns reply text and why the turn stopped |
+
+## Files
+
+| | |
+|---|---|
+| `environment.yaml` | The one resource this quickstart creates: the environment sessions boot from |
+| `src/scope.ts` | ID validation and the `ALLOWED_AGENT_IDS` check every tool goes through |
+| `src/managed-agents.ts` | Anthropic SDK calls, shared |
+| `src/tools.ts` | Nine tool registrations, each declaring what it touches, shared |
+| `src/server.ts` | stdio entrypoint |
+| `src/server-http.ts` | HTTP entrypoint: bearer auth, Host and Origin checks, loopback by default |
+| `Dockerfile` | Fly / Railway / Render / Cloud Run deploy for the HTTP path |
+| `skill.md` | Mental model, setup for both clients, gotchas, debugging |
+
+Requires `@anthropic-ai/sdk` ≥ 0.109.0. `bun.lock` is committed because the Docker build installs from it with `--frozen-lockfile`.
diff --git a/content/github/claude-quickstarts/managed-agents/mcp-server-typescript/skill.md b/content/github/claude-quickstarts/managed-agents/mcp-server-typescript/skill.md
new file mode 100644
index 0000000000..37efe9c5b4
--- /dev/null
+++ b/content/github/claude-quickstarts/managed-agents/mcp-server-typescript/skill.md
@@ -0,0 +1,171 @@
+# Setup tips & tricks: Claude Managed Agents as an MCP server
+
+Things that aren't obvious from the docs and tend to cost debugging time.
+
+---
+
+## Mental model
+
+### Claude Desktop is the frontend, Managed Agents is the backend
+
+The Claude you're typing to in Desktop is a **relay**. It calls `send_message` with your words, calls `wait_for_idle` to block until the managed agent finishes, then shows you the reply. The work itself (tool use, code execution, repo edits) happens in the Managed Agents session, not in Desktop.
+
+### Eight 1:1 tools, one shim
+
+`list_agents`, `get_agent`, `create_session`, `send_message`, `interrupt`, `get_session`, `list_events`, `archive_session` are straight endpoint wrappers. `wait_for_idle` is the only editorial: MCP is request/response and a Managed Agents turn completes over SSE, so something has to stream-to-idle inside a tool call.
+
+### `session_id` is the only state, and Claude holds it
+
+`create_session` returns it, and Claude passes it to every later call. The MCP server itself is stateless.
+
+### Two transports, one tool set
+
+`src/tools.ts` registers the nine tools. `src/server.ts` wraps it in stdio (Claude Desktop or Claude Code spawns it as a subprocess). `src/server-http.ts` wraps it in Streamable HTTP (claude.ai reaches it over the network). Pick one.
+
+### No agents are created here
+
+This server drives the agents already in your workspace. Create and update them with the `ant` CLI, the Console, or another quickstart's `./agents/setup.sh`. The one resource it needs is an environment, because `sessions.create` takes an `environment_id`. `environment.yaml` defines it.
+
+---
+
+## Setup: Claude Desktop or Claude Code (stdio, local)
+
+1. **Auth and environment** (one time):
+   ```bash
+   ant auth login            # or: cp .env.example .env and set ANTHROPIC_API_KEY
+   printf 'CLAUDE_ENVIRONMENT_ID=%s\n' \
+     "$(ant beta:environments create --transform id --raw-output < environment.yaml)" >> .env
+   ```
+2. **Agents**: if the workspace has none, run `./agents/setup.sh` in `../slack` or `../chat-sdk`. Optionally list the IDs you want reachable in `ALLOWED_AGENT_IDS` in `.env`.
+3. **Register with Claude Code**:
+   ```bash
+   claude mcp add managed-agents -- bun --env-file="$PWD/.env" run "$PWD/src/server.ts"
+   ```
+   **Or with Claude Desktop**: add this to `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) and restart Desktop. Desktop does not read your shell's environment or `.env`, so the values go in the `env` block:
+   ```json
+   {
+     "mcpServers": {
+       "managed-agents": {
+         "command": "/absolute/path/to/bun",
+         "args": ["run", "/absolute/path/to/managed-agents/mcp-server-typescript/src/server.ts"],
+         "env": {
+           "ANTHROPIC_API_KEY": "<your key>",
+           "CLAUDE_ENVIRONMENT_ID": "<from step 1>"
+         }
+       }
+     }
+   }
+   ```
+4. **Test**: in a new chat, ask *"list my managed agents, start a session with the first one, and relay this message to it: hello."*
+
+---
+
+## Setup: claude.ai (Streamable HTTP, remote)
+
+Same tools, but the server runs at a public URL and claude.ai connects to it as a custom connector. Read "What the token can reach" below before step 3.
+
+1. **Token**: generate it and keep it. The server refuses to start without one of at least 32 characters.
+   ```bash
+   echo "MANAGED_AGENTS_MCP_TOKEN=$(openssl rand -hex 32)" >> .env
+   ```
+2. **Run locally first**:
+   ```bash
+   bun run http   # http://127.0.0.1:3000/mcp
+   ```
+   To test through a tunnel (ngrok, cloudflared), add the tunnel's hostname to `ALLOWED_HOSTS`. The server answers 421 to any `Host` header it wasn't told about.
+3. **Deploy**: the `Dockerfile` targets Fly, Railway, Render, and Cloud Run. Set `ANTHROPIC_API_KEY`, `CLAUDE_ENVIRONMENT_ID`, `MANAGED_AGENTS_MCP_TOKEN`, `ALLOWED_HOSTS`, and `ALLOWED_AGENT_IDS` as secrets on the platform. The image sets `HOST=0.0.0.0`, and the server will not start on a non-loopback host until `ALLOWED_HOSTS` names the public hostname. Terminate TLS in front of it. Cloudflare Workers also works: `WebStandardStreamableHTTPServerTransport` is fetch-native, so swap `process.env` for `env` and `Bun.serve` for `export default { fetch }`.
+4. **claude.ai → Settings → Connectors → Add custom connector**:
+
+   | Field | Value |
+   |---|---|
+   | Name | `Managed Agents` |
+   | URL | `https://<your-deploy>/mcp` |
+   | Authentication | Bearer token → your `MANAGED_AGENTS_MCP_TOKEN` |
+
+   > **Team and Enterprise orgs:** adding a connector by URL is typically **org-admin only**. Individual users see a curated directory, not a URL field. An admin adds the URL and token once in org settings, and it then appears in every member's connector list to enable. That is the shape you want for rolling out to non-technical users anyway.
+
+5. **Test**: new chat → enable the connector → same prompt as above.
+
+---
+
+## Relay mode (recommended Project instructions)
+
+Without guidance, the frontend Claude will try to answer the user itself instead of relaying. Put this in a Project's custom instructions:
+
+> You are a frontend for a backend Managed Agent reached through the `managed-agents` MCP tools. On the first user turn: `list_agents` (if needed) → `create_session` → `send_message(user text verbatim)` → `wait_for_idle` → return the `reply` verbatim. On later turns: `send_message` → `wait_for_idle`. Do not answer from your own knowledge, and do not paraphrase the backend's reply. If `wait_for_idle` returns `status: "timeout"`, tell the user it's still running and offer to keep waiting. If it returns any status other than `"idle"` or `"timeout"`, tell the user the turn stopped early and give the status.
+
+---
+
+## Gotchas
+
+### What the token can reach
+
+The caller of these tools is a model, and whoever holds the bearer token is whoever can talk to that model. The server's Anthropic credentials can see **every agent and every session in the workspace**. With no allowlist, so can the caller: `list_agents` enumerates them, `get_agent` returns their full system prompts and tool configs, `create_session` runs any of them on your bill, and any `session_id` the caller learns or guesses can be read, messaged, interrupted, or archived.
+
+`ALLOWED_AGENT_IDS` narrows all of that to the agents you name:
+
+- `list_agents` fetches exactly those agents and nothing else.
+- `get_agent` and `create_session` refuse any other `agent_id`.
+- Every tool that takes a `session_id` retrieves the session first and refuses unless its agent is on the list. That check runs before the send, interrupt, archive, or stream.
+- A refusal says "not available through this server" whether or not the ID exists.
+
+The check lives in one place, `src/scope.ts`, and `src/tools.ts` runs it from the scope each tool declares at registration. A tool whose scope doesn't match its schema throws when the server starts.
+
+Two more layers, both independent of the allowlist: every ID is matched against `agent_…` / `sesn_…` / `sevt_…` before it reaches the API, so a model-supplied string never becomes a URL path segment unchecked. And for production, give the server an API key from a **dedicated workspace** that holds only the agents it should serve. Then the workspace boundary does the scoping and the allowlist is the second line.
+
+### stdio = your machine, HTTP = the network
+
+Browser claude.ai can't spawn a local process, so stdio only works with Claude Desktop and Claude Code. The HTTP path gets you claude.ai, but now the URL is public and the **bearer token is the gate** in front of everything above. The server compares it in constant time, never logs it, and answers a wrong one with a bare 401. Don't deploy without TLS, and rotate the token like any API key.
+
+### The Host and Origin checks
+
+`src/server-http.ts` answers 421 unless the `Host` header is one it was told about: the loopback names by default, or `ALLOWED_HOSTS`. It answers 403 to any request that carries an `Origin` header not in `ALLOWED_ORIGINS`. Server-to-server MCP clients send no `Origin`, so this only stops browsers. Together they close DNS rebinding against a server running on your laptop, where a web page you visit resolves its own hostname to `127.0.0.1` and talks to your local port.
+
+### Replies are untrusted text
+
+`wait_for_idle` and `list_events` hand the backend agent's words to the frontend model. That agent may have read web pages or repo files, so treat its output as data. The tools return it inside a JSON text block, the tool descriptions are fixed strings, and `list_events` clips each field at 4,000 characters and returns a page of at most 500 events. The relay instructions above tell the frontend to pass the reply through, not to act on it.
+
+### `idle` means finished, and nothing else does
+
+`wait_for_idle` returns `status: "idle"` only when the agent ended its turn. `requires_action` means it is parked on a tool approval or a custom tool result that this server has no way to supply. `retries_exhausted` and `budget_reached` mean it gave up or hit its cap. `terminated` means the session is gone. In each of those, `reply` may hold a half-finished preamble. `timeout` means it is still running.
+
+### Long turns vs tool timeout
+
+`wait_for_idle` blocks, and the deadline is real: a timer drops the stream at `timeout_sec` even if the session emits nothing. If the agent runs for minutes (big repo clone, many tool calls), the MCP client may time out the tool call first. Mitigations: pass a smaller `timeout_sec` and loop (`status: "timeout"` comes with `last_event_id`, so call again), or have Claude poll `get_session` + `list_events(after_id=...)`.
+
+Over HTTP there is a second clock. Nothing is written to the response while the agent works, and Bun closes a connection that has been silent for `idleTimeout` seconds (10 by default). Proxies and load balancers do the same. `src/server-http.ts` sets the transport's SSE keep-alive comment to every 5 seconds and Bun's `idleTimeout` to 30, so a quiet wait survives. If a proxy in front of your deploy still cuts long calls, its own idle timeout is shorter than 5 seconds or it buffers SSE.
+
+### Billing
+
+Usage bills to the Anthropic credentials in the server config, not to the chat user's account. That's the point (non-technical users, no keys), but size the workspace limits accordingly. An agent-level session budget is the other lever.
+
+### Deliberately not exposed
+
+| Endpoint | Why not |
+|---|---|
+| `agents.archive` | Permanent, no undo. One bad tool call bricks a prod agent |
+| `agents.create` / `update` | Authoring belongs in the `ant` CLI or the Console, not a chat turn |
+| `sessions.list` | Would enumerate every session in the workspace. Add it only with the allowlist filter `listAgents` uses |
+| `sessions.delete`, `environments.*` | Destructive infra ops |
+| `vaults.*`, `credentials.*` | Secrets |
+| `sessions.resources.add` | Needs tokens or file IDs the chat user won't have |
+
+Adding one is a function in `src/managed-agents.ts` plus a registration in `src/tools.ts` with its scope.
+
+---
+
+## Debugging
+
+| Symptom | Check |
+|---|---|
+| Desktop shows no `managed-agents` tools | Config path wrong, or `bun` not on PATH for the Desktop process (use an absolute path to `bun`). Check Desktop's MCP logs. |
+| `CLAUDE_ENVIRONMENT_ID is required` | Env block missing from the Desktop config. stdio servers don't read your shell's env. With Claude Code, check the `--env-file` path. |
+| `ALLOWED_AGENT_IDS has an entry that is not an agent ID` | A typo or a stray space-separated value. The list is comma-separated `agent_…` IDs, and the server stops on a bad one so a typo can't pass for a working allowlist. |
+| A tool answers "not available through this server" | The agent, or the session's agent, is not in `ALLOWED_AGENT_IDS`. The message is the same if the ID doesn't exist. |
+| `wait_for_idle` returns empty `reply` | The agent went idle without emitting text (for example only tool calls), or `status` is not `"idle"`. `list_events` shows the full log. |
+| Every turn starts a new session | Claude isn't threading `session_id`. Tighten the Project instructions. |
+| `FATAL: MANAGED_AGENTS_MCP_TOKEN must be set` | Not in `.env`, or shorter than 32 characters. `bun run http` loads `.env` from this directory. |
+| `FATAL: HOST=… is not loopback, so ALLOWED_HOSTS is required` | You set `HOST=0.0.0.0` (the Docker image does). Name the public hostname in `ALLOWED_HOSTS`. |
+| HTTP 421 | The `Host` header isn't in `ALLOWED_HOSTS`. Add the tunnel or deploy hostname, with the port if the client sends one. |
+| HTTP 403 | The request carried an `Origin` header that isn't in `ALLOWED_ORIGINS`. A browser is calling, not an MCP client. |
+| HTTP 401, or the connector shows "couldn't connect" | URL wrong, server not reachable, or token mismatch. |
diff --git a/content/github/claude-quickstarts/managed-agents/roadtrip-planner/CLAUDE.md b/content/github/claude-quickstarts/managed-agents/roadtrip-planner/CLAUDE.md
new file mode 100644
index 0000000000..4283fd7bf5
--- /dev/null
+++ b/content/github/claude-quickstarts/managed-agents/roadtrip-planner/CLAUDE.md
@@ -0,0 +1,72 @@
+# Road trip planner (Claude Managed Agents + Next.js)
+
+A Next.js chat built directly on a Managed Agent session: no chat framework,
+the event log is the app state. Teaches session event streaming
+(`event_deltas`), vault credential `injection_location`, per-session
+`agent_with_overrides`, and `multiagent` coordinator rosters. The planner
+calls the National Park Service and Windy APIs with keys it never holds,
+then hands its draft to a second agent for a quick critique. That second
+agent is an Opus reviewer running as a session thread.
+
+## When the user asks to set this up, run it, or debug it
+
+1. **Invoke `/claude-api` first.** It loads the Managed Agents API reference
+   (agents, environments, sessions, events, vaults, credentials, webhooks).
+   Use it as the source of truth for any SDK call you write or edit here.
+   Don't guess field names.
+2. **Read [`./skill.md`](./skill.md)** and walk the user through it in order.
+   It has the key signups, the provisioning step, a pointer to the four
+   README steps, and the debugging table.
+3. The files worth reading before changing anything are
+   `src/lib/use-managed-agent-session.ts` (the client runtime: one EventSource, the
+   SDK accumulator, the re-sync-on-connect habit), `agents/setup.sh` (where
+   each credential's `injection_location` is set), and
+   `agents/roadtrip-planner/agent.yaml` (the planner prompt and the
+   `multiagent` roster). `src/lib/transcript.ts` is the one fold both first
+   paint and live streaming render through. `src/lib/client.ts` holds
+   `ownedSession()`, the check every route runs on the session cookie.
+
+Provisioning is `./agents/setup.sh`: it creates the vault, two credentials,
+environment, reviewer, and planner from `agents/*/*.yaml` with the `ant` CLI,
+writes their IDs to `.env`, and on re-runs pushes YAML edits onto the same
+resources. A new resource is a new YAML file plus one more create/update
+block in `setup.sh`, copied from the ones already there, and one more line in
+`agents/teardown.sh`.
+
+## Invariants to preserve when editing
+
+- The stream is a tail, not a replay, and previews are never persisted: every
+  EventSource (re)connect re-fetches the event log (via `/api/session`)
+  before trusting the tail. Do not "optimize" that fetch away. It is the
+  entire resume story.
+- Previews are speculative. The accumulator's snapshot retires when the
+  buffered `agent.message` with the same id lands in the log, an orphan
+  `event_delta` (attached mid-generation) is dropped, and an errored
+  `span.model_request_end` discards the open snapshot.
+- One fold (`transcript.ts`) renders both history and live state. If a new
+  event type should render, it goes in the fold, not in a second mapping.
+- Every route that takes the session cookie goes through `ownedSession()`
+  before any other API call, and refuses when it returns null. The cookie is
+  browser input and the server's credentials can see every session in the
+  workspace. A new route that touches a session uses it too.
+- The `model` override is checked against `src/lib/models.ts` on the server.
+  The picker and the check share that one list.
+- `web_search` and `web_fetch` stay disabled on the agent. With them on, the
+  model answers from the open web and the vault demo proves nothing.
+- The reviewer stays tool-free: its toolset is deny-by-default
+  (`default_config: {enabled: false}`), and the prompt says the same. The
+  review must come from the draft alone. A poisoned draft must have no tool
+  to reach, and the rail must not fill with a second agent's curls.
+- The handoff is prompt-triggered. The planner's "Review step" prompt
+  section decides when to message the reviewer. The user never asks and the
+  app sends nothing. Weaken that section and step 4 silently disappears.
+- The environment's `allowed_hosts` and each credential's `allowed_hosts`
+  both list the vendor host, as exact hosts with no wildcards. Drop either
+  and the calls fail differently.
+- The header's model picker shows `session.agent.model` from the API
+  response, never client state. An override must be visible as the resolved
+  snapshot or the demo proves nothing.
+- Secrets reach the vault through the heredocs in `agents/setup.sh` and
+  nowhere else. Never write a vendor key into a YAML file or pass one as a
+  CLI flag.
+- No database. If a change needs one, it does not belong in this quickstart.
diff --git a/content/github/claude-quickstarts/managed-agents/roadtrip-planner/README.md b/content/github/claude-quickstarts/managed-agents/roadtrip-planner/README.md
new file mode 100644
index 0000000000..f668c6e839
--- /dev/null
+++ b/content/github/claude-quickstarts/managed-agents/roadtrip-planner/README.md
@@ -0,0 +1,200 @@
+# Road trip planner: stream sessions, scope vault credentials, override models, and review plans agent-to-agent
+
+A Next.js chat built directly on a [Claude Managed Agent](https://platform.claude.com/docs/en/managed-agents/overview) [session](https://platform.claude.com/docs/en/managed-agents/sessions). There is no chat framework and no database: the session's event log is the message list, the live tokens are its SSE tail, and the only server code in the streaming path is a thin proxy that keeps the API key out of the browser. The agent plans road trips around any US national park. You'll see four API features on one screen:
+
+1. **Stream the turn live.** `event_deltas[]=...` on [`GET /v1/sessions/{id}/events/stream`](https://platform.claude.com/docs/en/managed-agents/events-and-streaming) interleaves previews with the buffered event log. `agent.message` previews carry the reply token by token, and `agent.thinking` previews fire the moment extended thinking starts. Tool calls, results, retries, and usage ride the same stream, so the UI renders the whole turn as it happens. Without previews the same chat is seconds of blank, then a paragraph.
+2. **Inject [vault credentials](https://platform.claude.com/docs/en/managed-agents/vaults) at a specific request location.** The agent authenticates to two vendor APIs with keys it never holds. The National Park Service wants its key in a request header and Windy wants it inside the JSON body. The `injection_location` field on each credential controls where the placeholder may be swapped for the real value at egress.
+3. **Override agent settings per session.** Every session is created with the `agent_with_overrides` selector. The model picker adds a `model` override to it, rerunning the same stored agent on a different model. One agent, no per-user copies, no new versions.
+4. **Hand the draft to a second agent.** The planner is a `multiagent` coordinator with one roster entry: a reviewer agent running Opus. When it drafts an itinerary it spawns the reviewer as a session thread, messages it the draft, and waits for the critique. The whole exchange is ordinary session events (`session.thread_created`, `agent.thread_message_sent`, `agent.thread_message_received`) on the same stream the chat already renders, so you watch the two agents talk to each other.
+
+```
+browser ──▶ POST /api/chat ──▶ sessions.events.send(user.message)
+   ▲
+   │ one EventSource              GET /v1/sessions/{id}/events/stream
+   └── GET /api/stream ◀──────────   ?event_deltas[]=agent.message
+       (a thin SSE proxy)            &event_deltas[]=agent.thinking
+
+   src/lib/use-managed-agent-session.ts: accumulate previews (SDK helper),
+   append buffered events, fold the log into turns, render
+
+sandbox ── curl -H "X-Api-Key: $NATIONAL_PARK_SERVICE_API_KEY" ──▶ egress ──▶ developer.nps.gov
+           the env var is an opaque placeholder                    └─ swaps in the real key when the
+                                                                      host and the location are allowed
+
+planner ── agent.thread_message_sent (the draft) ──▶ reviewer thread (Opus, same session)
+        ◀── agent.thread_message_received (the critique) ──┘
+```
+
+The session is the backend: the agent remembers the conversation, the transcript is `GET /v1/sessions/{id}/events`, and the browser holds one httpOnly cookie with the session id.
+
+The new API calls, and where to read them:
+
+- `event_deltas` on the session event stream: [`src/app/api/stream/route.ts`](./src/app/api/stream/route.ts), the SSE proxy
+- the SDK's `accumulateManagedAgentsEvent` folding previews in the browser: [`src/lib/use-managed-agent-session.ts`](./src/lib/use-managed-agent-session.ts)
+- the event log folded into renderable turns: [`src/lib/transcript.ts`](./src/lib/transcript.ts)
+- `injection_location` provisioned on each credential: the two credential blocks in [`agents/setup.sh`](./agents/setup.sh)
+- `injection_location` flipped on a live credential: one `ant` CLI call, step 2 below
+- `agent_with_overrides` on session create: [`src/app/api/session/route.ts`](./src/app/api/session/route.ts)
+- the `multiagent` coordinator roster on the planner agent: [`agents/roadtrip-planner/agent.yaml`](./agents/roadtrip-planner/agent.yaml)
+- thread events folded into the rail and the chat: [`src/lib/transcript.ts`](./src/lib/transcript.ts)
+
+## Quickstart
+
+Needs Node 20 or later, the [`ant` CLI](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/quickstart) 1.19 or later (`brew install anthropics/tap/ant`), and Anthropic auth for an organization with Managed Agents access: `ant auth login` once, or an API key from [platform.claude.com](https://platform.claude.com/). It also needs two free vendor keys:
+
+- A National Park Service API key, emailed instantly: <https://www.nps.gov/subjects/developer/get-started.htm>
+- A Windy Point Forecast API key, free tier: <https://api.windy.com/point-forecast/docs>
+
+```bash
+cd managed-agents/roadtrip-planner
+npm install
+claude "walk me through setting this up"   # reads skill.md and drives the rest
+```
+
+Or by hand:
+
+```bash
+ant auth login            # or put ANTHROPIC_API_KEY in .env
+cp .env.example .env      # fill in NATIONAL_PARK_SERVICE_API_KEY and WINDY_API_KEY
+./agents/setup.sh         # vault + 2 credentials + environment + 2 agents, IDs -> .env
+npm run dev               # http://localhost:3000
+```
+
+To change either agent (model, prompt, tools), edit its YAML under [`agents/`](./agents) and re-run `./agents/setup.sh`. It pushes a new agent version that new trips pick up. `./agents/teardown.sh` archives everything and clears the IDs from `.env`.
+
+Setup provisions each credential with the injection location its vendor documents, hardcoded in [`agents/setup.sh`](./agents/setup.sh):
+
+| secret | host | injected in |
+|---|---|---|
+| `NATIONAL_PARK_SERVICE_API_KEY` | `developer.nps.gov` | header (`X-Api-Key`) |
+| `WINDY_API_KEY` | `api.windy.com` | body (`"key": ...`) |
+
+Same credential type, same vault, opposite `injection_location`. The model never sees either value.
+
+## Before you deploy
+
+This demo has no user accounts. The cookie ties one browser to one session and nothing more, so run it on localhost. Two things are in place, and both need to stay if you fork it:
+
+- **Every route checks that the session belongs to this app.** The cookie value comes from the browser and becomes an API path parameter, and the server's Anthropic credentials can see every session in the workspace. `ownedSession()` in [`src/lib/client.ts`](./src/lib/client.ts) only accepts an ID that resolves, was created on this quickstart's planner agent, and is still live. Stream, chat, and interrupt answer 403 to anything else, and `/api/session` starts a new trip instead of returning someone else's events. Keep that function in the path of anything that takes a session ID from a client.
+- **The `model` override is checked against the picker's list** ([`src/lib/models.ts`](./src/lib/models.ts)) before it reaches `sessions.create`, so a caller cannot run your agent on a model you did not offer.
+
+Put real authentication in front of all four routes before exposing the app beyond your machine.
+
+## Four things to do with it
+
+Each one is a runnable step. Together they are the quickstart.
+
+### 1. Ask for a trip
+
+"Plan a 5 day road trip split between Zion and Bryce Canyon for the first week of October." The agent resolves the parks first (`/parks?q=...`), then plans from what the APIs return. The status line flips to "thinking..." the moment the model starts reasoning: that is the `agent.thinking` preview, where the buffered event only lands when thinking ends. The reply renders as the model writes it. The right rail shows each `curl` the agent runs in its sandbox (it budgets itself to five per question), each against an allowed host, each authenticated with a key it cannot read. Any park works: swap in Acadia, Yellowstone, Joshua Tree.
+
+### 2. Flip one field and watch a vendor reject the placeholder
+
+Update the live credential with the `ant` CLI. It uses the same credentials `./agents/setup.sh` did, and the IDs are in `.env`:
+
+```bash
+eval "$(grep '^CLAUDE_' .env)"
+ant beta:vaults:credentials update \
+  --vault-id "$CLAUDE_VAULT_ID" \
+  --credential-id "$CLAUDE_NATIONAL_PARK_SERVICE_CREDENTIAL_ID" \
+  --auth '{type: environment_variable, injection_location: {header: false, body: true}}'
+```
+
+The National Park Service only accepts its key in a header, and header injection is now off for that credential. Nothing substitutes the placeholder, the next NPS call carries it literally, and NPS rejects it. Ask "is anything closed at the park right now" and watch the 4xx land in the tool rail: the agent shows the status and body, retries the documented header location once, then says plainly that NPS is rejecting its key while it keeps planning with the weather API. Heal it by setting the credential back to the location its vendor documents:
+
+```bash
+eval "$(grep '^CLAUDE_' .env)"
+ant beta:vaults:credentials update \
+  --vault-id "$CLAUDE_VAULT_ID" \
+  --credential-id "$CLAUDE_NATIONAL_PARK_SERVICE_CREDENTIAL_ID" \
+  --auth '{type: environment_variable, injection_location: {header: true, body: false}}'
+```
+
+One field, no secret rotation, no redeploy, visible consequence. The same flip works the other way on the Windy credential (`$CLAUDE_WINDY_CREDENTIAL_ID`, with the two booleans inverted), because Windy only documents body auth.
+
+### 3. Run the same agent on a different model
+
+Pick another model in the header. A new trip starts with a `model` override on the selector every session already uses:
+
+```ts
+client.beta.sessions.create({
+  agent: { type: "agent_with_overrides", id: agentId, model: "claude-opus-5" },
+  // ...
+});
+```
+
+The override replaces the stored agent's model for this session only. The header shows the model from the session's resolved `agent` snapshot (`session.agent.model`), so what you read is what the API resolved, not what the client asked for. The stored agent never changes: no copy, no new version, and "New trip" returns to its configured model. `system`, `tools`, `mcp_servers`, and `skills` are overridable the same way.
+
+### 4. Watch the planner get its plan reviewed
+
+Ask for a full multi-day itinerary (step 1's Zion and Bryce prompt works). After the draft is written, the status line flips to "waiting on Plan reviewer...": the planner spawned its roster agent as a session thread and messaged it the draft. The reviewer is a second stored agent, created by `./agents/setup.sh` before the planner so the planner's roster can name it:
+
+```yaml
+# agents/plan-reviewer/agent.yaml
+name: Plan reviewer
+model: claude-opus-5
+system: |
+  You review road trip itineraries drafted by another agent. ...
+tools:
+  - type: agent_toolset_20260401
+    default_config:
+      enabled: false
+
+# agents/roadtrip-planner/agent.yaml
+name: Road trip planner
+model: claude-sonnet-5
+multiagent:
+  type: coordinator
+  agents: ["{{CLAUDE_REVIEWER_AGENT_ID}}"]   # setup.sh fills this in
+```
+
+Nobody asks for the review. The roster grants the capability, and the planner's own system prompt decides when to use it: a new day-by-day itinerary gets reviewed, a quick factual answer does not. The send is not a tool call and not an app request. The only trace is the thread events themselves.
+
+Two models in one session: the planner drafts on Sonnet, the gut-check runs on Opus. The reviewer's toolset is deny-by-default, which is both a security boundary (a poisoned draft has no tool to reach) and what keeps the review fast: it judges the draft text alone. Its reply still routes back, because agent-to-agent messaging is platform machinery, not a tool.
+
+The exchange renders in two places, fed by the same events. In the chat, two chips: "to Plan reviewer" (the draft going out) and "from Plan reviewer" (the critique coming back). In the rail: `session.thread_created`, then both `agent.thread_message_*` events with their full text, then the thread's status events as it goes idle. The planner's final reply ends with a "Reviewer flagged" line when the critique raised something it could not verify from the APIs.
+
+The review costs one extra agent and zero plumbing: no queue, no webhook, no second session. The thread lives inside the session, its lifecycle events cross-post to the stream the page already holds open, and the agent-to-agent messages are persisted events, so the exchange survives a reload like everything else.
+
+## The client
+
+A Managed Agents session already is a resumable chat backend, so the client is three pieces, all in [`src/lib/use-managed-agent-session.ts`](./src/lib/use-managed-agent-session.ts) and [`src/lib/transcript.ts`](./src/lib/transcript.ts):
+
+- **One EventSource** on `/api/stream`, a thin proxy of the session's SSE tail. The browser owns reconnect, and every connect re-fetches the event log first: the stream is a tail, not a replay, and previews are never persisted. That habit is the whole resume story: reload mid-answer and the page renders what streaming rendered.
+- **The SDK's `accumulateManagedAgentsEvent`**, run in the browser, folds `event_start` / `event_delta` previews into one growing `agent.message` snapshot. Previews are speculative: the buffered event with the same id retires the snapshot, and because the ids match, the rendered part does not jump. A delta for a preview the client never saw open (it attached mid-generation) is dropped, and the buffered event delivers the whole thing. An errored model request never produces its buffered event, so its terminal `span.model_request_end` drops the snapshot instead.
+- **One fold** from the event array to renderable turns. The same fold runs over hydrated history and the live array, so a reload renders what streaming rendered, turn stats included.
+
+Everything else on the stream is a status signal: thinking starts drive the activity line, `span.model_request_*` drive the working state and token stats, `agent.thread_message_sent` flips the activity line to "waiting on Plan reviewer..." until the reply lands, and `session.error` distinguishes a retry in progress from a dead turn. Stop is a real API verb: the button POSTs `user.interrupt`, the agent winds down, and the `session.status_idle` that follows flips the UI back to ready.
+
+<details>
+<summary><strong>Caveats</strong></summary>
+
+- `injection_location` has two flags: `header` and `body`. There is no query-string option, so a key in `?api_key=...` is never substituted. APIs that only accept query-param auth can't use environment variable credentials, and if the agent falls back to NPS's `?api_key=` form the request carries the placeholder.
+- Two allowlists must agree. The [environment](https://platform.claude.com/docs/en/managed-agents/environments)'s `networking.allowed_hosts` controls what the sandbox can reach at all, and the credential's `networking.allowed_hosts` controls where its secret may be substituted. A host missing from the first never connects, and a host missing from the second gets the placeholder. Both list exact hosts. A wildcard on the credential would let the real key be substituted on a host you did not mean.
+- Streaming previews cover `agent.message` (text deltas) and `agent.thinking` (start only) on the session's primary thread. Tool calls and subagent threads arrive as buffered events, so the reviewer's critique lands whole, not token by token.
+- The roster is flat: 1 to 20 entries, and a roster agent cannot have a roster of its own (depth limit 1). The model picker overrides the planner only. The reviewer thread always runs the reviewer agent's stored model.
+- Vaults and the model both attach at `sessions.create`. You can update a credential in a vault a running session already holds, but a different vault or a different model means a new session, which is why the picker starts a new trip.
+- `./agents/setup.sh` creates the two credentials once. Re-running it updates the vault, environment, and both agents from their YAML, but leaves live credentials alone so a flip from step 2 survives. To rotate a vendor key, update the credential's `secret_value` with `ant beta:vaults:credentials update`, or run `./agents/teardown.sh` and set up again.
+
+</details>
+
+## Files
+
+| | |
+|---|---|
+| `agents/roadtrip-planner/` | The planner agent, environment, and vault definitions `setup.sh` provisions |
+| `agents/plan-reviewer/` | The reviewer agent definition |
+| `agents/setup.sh` | Vault + two credentials + environment + reviewer + planner. Creates on the first run, updates in place after |
+| `agents/teardown.sh` | Archive sessions and everything setup created, and clear the IDs from `.env` |
+| `src/lib/client.ts` | The shared SDK client, the session cookie name, and `ownedSession()` |
+| `src/lib/models.ts` | The models the picker offers and `/api/session` accepts |
+| `src/lib/use-managed-agent-session.ts` | The client runtime: one EventSource, the SDK accumulator, send/stop |
+| `src/lib/transcript.ts` | The event log folded into renderable turns |
+| `src/app/api/session/route.ts` | Create or resume the session behind the cookie, return the event log |
+| `src/app/api/stream/route.ts` | SSE proxy of the session tail (the API key stays server-side) |
+| `src/app/api/chat/route.ts` | Send one `user.message` |
+| `src/app/api/interrupt/route.ts` | Send `user.interrupt` (the stop button) |
+| `src/app/page.tsx` | The chat, the model picker, the tool rail |
+| `skill.md` | Setup walkthrough and debugging table |
+
+Requires `@anthropic-ai/sdk` ≥ 0.109.0.
diff --git a/content/github/claude-quickstarts/managed-agents/roadtrip-planner/skill.md b/content/github/claude-quickstarts/managed-agents/roadtrip-planner/skill.md
new file mode 100644
index 0000000000..8c64bfdced
--- /dev/null
+++ b/content/github/claude-quickstarts/managed-agents/roadtrip-planner/skill.md
@@ -0,0 +1,93 @@
+# Setup walkthrough
+
+Work top to bottom. Every step has a verification before the next one starts.
+
+## 1. Keys
+
+| key | where | notes |
+|---|---|---|
+| Anthropic auth | `ant auth login`, or an API key from <https://platform.claude.com/> | the CLI and the app share the login. With a key, uncomment `ANTHROPIC_API_KEY` in `.env`. The org needs Managed Agents access |
+| `NATIONAL_PARK_SERVICE_API_KEY` | <https://www.nps.gov/subjects/developer/get-started.htm> | free, emailed instantly |
+| `WINDY_API_KEY` | <https://api.windy.com/point-forecast/docs> | free tier, point-forecast product |
+
+```bash
+cp .env.example .env   # then fill in the two vendor keys
+```
+
+Verify the vendor keys from your own machine before involving the sandbox:
+
+```bash
+set -a; . ./.env; set +a
+curl -sS "https://developer.nps.gov/api/v1/alerts?parkCode=acad&limit=1" -H "X-Api-Key: $NATIONAL_PARK_SERVICE_API_KEY" | head -c 300
+curl -sS -X POST "https://api.windy.com/api/point-forecast/v2" \
+  -H "Content-Type: application/json" \
+  -d '{"lat":44.35,"lon":-68.21,"model":"gfs","parameters":["temp"],"levels":["surface"],"key":"'"$WINDY_API_KEY"'"}' | head -c 300
+```
+
+Both return JSON. A 403 here is a key problem, not a quickstart problem.
+
+## 2. Provision
+
+```bash
+npm install
+./agents/setup.sh
+```
+
+Creates the vault and two `environment_variable` credentials with the `injection_location` each vendor documents hardcoded (NPS: header, Windy: body), the environment (networking limited to `developer.nps.gov` and `api.windy.com`), the reviewer agent (Opus, review-only prompt), and the planner agent (bash on, `web_search`/`web_fetch` off, a `multiagent` coordinator roster naming the reviewer). Appends six `CLAUDE_*` IDs to `.env`.
+
+Each resource is gated on its own ID in `.env`, so a run that fails partway picks up where it stopped. Re-running after a full run updates the vault, environment, and both agents from their YAML. An agent update is a new version that new trips pick up. The two credentials are created once and then left alone, so a flip from README step 2 survives a re-run.
+
+Verify: `.env` ends with six `CLAUDE_*` lines, and `ant beta:agents retrieve --agent-id "$CLAUDE_AGENT_ID" --transform multiagent` shows the reviewer's ID in the roster.
+
+## 3. Run
+
+```bash
+npm run dev
+```
+
+Open <http://localhost:3000>. The page creates one session per browser on load (cookie `roadtrip_planner_session_id`), so the sandbox is warm before the first question. Then do the four steps in [README.md](./README.md#four-things-to-do-with-it), in order. Step 2 is the vault story and it only lands after a real conversation exists. Step 3 is the `agent_with_overrides` model picker. Step 4 is the multi-agent review: it needs a full itinerary ask, not a one-fact question.
+
+## Gotchas
+
+### The cookie is input, so every route checks it
+
+The session ID in the cookie goes straight into an API path, and the server's Anthropic credentials can read every session in the workspace. `ownedSession()` in `src/lib/client.ts` is why a pasted ID from another app gets a 403: the session has to resolve, belong to `CLAUDE_AGENT_ID`, and still be live. The reviewer's agent ID is never accepted. Its threads live inside the planner's sessions and are not addressable from the browser.
+
+### Setup reads `.env`, so placeholders break it
+
+`./agents/setup.sh` sources `.env`. A leftover `CLAUDE_AGENT_ID=agent_...` placeholder would send it down the update path against an agent that does not exist. `.env.example` ships no placeholder IDs for that reason. Setup also refuses a vendor key with quotes or spaces in it, because the key is interpolated into a YAML body.
+
+### Next.js loads `.env.local` over `.env`
+
+If you have a `.env.local` from an older copy of this app, its IDs win and the app talks to archived resources. Delete it. Everything lives in `.env` now. Next.js also never overrides a variable your shell already exports, so a `CLAUDE_AGENT_ID` exported for a sibling quickstart wins over this directory's `.env`. `unset` it, or start `npm run dev` from a clean shell. `./agents/setup.sh` and `./agents/teardown.sh` clear those names themselves before they read `.env`.
+
+## Debugging
+
+| symptom | cause | fix |
+|---|---|---|
+| `./agents/setup.sh` 404s on `/v1/environments` or `/v1/vaults` | org not enrolled in Managed Agents | request access, or switch orgs |
+| `./agents/setup.sh` stops with 409 on the environment | environment names are unique per workspace and `quickstart-roadtrip-planner-env` already exists there | paste that environment's ID into `.env` as `CLAUDE_ENVIRONMENT_ID`, or change `name` in `agents/roadtrip-planner/environment.yaml`, then re-run |
+| `tsc` rejects `event_deltas`, `injection_location`, or the `lib/sessions/accumulate` import | installed SDK predates the 2026-07-01 Managed Agents update | upgrade `@anthropic-ai/sdk` |
+| replies arrive whole, no token-by-token rendering | the org's streaming gate is closed (`event_deltas` is silently ignored when ungated), or an older SDK's stream parser drops the `event_start` / `event_delta` events it does not recognize | confirm the org is enrolled in the update, and upgrade `@anthropic-ai/sdk` |
+| picking a model 400s with "Agent must be a non-empty Agent ID or agent_reference" (or the older "Extra inputs are not permitted") | the org's gate for `agent_with_overrides` is not open yet (a closed gate rejects the selector as an unknown agent shape) | use the default model until the org is enrolled in the update |
+| picking a model 400s with `model must be one of: ...` | the request named a model that is not in `src/lib/models.ts` | add it to that list. The picker and the server check share it |
+| picking a model 400s with `agent_field_not_overridable` | the selector carried a key that is not overridable (the gate is open, and only `model`, `system`, `tools`, `mcp_servers`, `skills` may be overridden) | only happens if you edited the `sessions.create` call in `src/app/api/session/route.ts`: remove the extra key |
+| boot screen says `Missing CLAUDE_AGENT_ID` | `.env` not written or dev server started before setup | run `./agents/setup.sh`, restart `npm run dev` |
+| the stream, chat, or stop button answers 403 | the cookie names a session this app's planner did not create, or one that was archived | reload. `/api/session` issues a fresh one |
+| events arrive only in end-of-turn bursts | a proxy is buffering the SSE response | use `next dev` directly on localhost first |
+| the rail shows `session.error` `model_overloaded_error`, then the turn ends with no reply | the API was overloaded and the session's retries ran out | send the message again, or pick another model for the next trip |
+| answer cites no tool calls | the agent answered from priors | the prompt demands API evidence per claim. If you weakened it, restore `agents/roadtrip-planner/agent.yaml` and re-run `./agents/setup.sh` |
+| itinerary arrives with no review handoff (no thread events in the rail) | the question was small enough that the prompt's "skip the review" branch applied, or the planner's roster is empty | ask for a full multi-day itinerary. Check the roster with the `ant beta:agents retrieve` call in step 2 |
+| `./agents/setup.sh` 400s creating the planner, naming `multiagent` | the org is not enrolled in the Managed Agents update that ships coordinator rosters | delete the `multiagent` block in `agents/roadtrip-planner/agent.yaml` for a single-agent copy until the org is enrolled |
+| every NPS call 403s with header injection on | the National Park Service key itself is bad | re-run the step 1 curl from your machine |
+| `session.error` `credential_host_unreachable_error` | the credential allows a host the environment's networking does not | both `allowed_hosts` lists must name the vendor host |
+| the chat resets to an empty trip after a teardown | the cookie pointed at an archived session, so a fresh one was created | expected: archived sessions cannot take another message |
+
+## Reset
+
+```bash
+./agents/teardown.sh   # archive sessions, both agents, credentials, vault, environment, and clear the IDs from .env
+./agents/setup.sh      # provision a fresh copy
+```
+
+Teardown interrupts a session that is still running, waits up to 20 seconds for it to go idle, and archives it. It is safe to re-run: an ID stays in `.env` only while its archive keeps failing. If a session will not archive, the planner's ID stays too, because listing by that ID is how the next run finds the session.
diff --git a/content/github/claude-quickstarts/managed-agents/slack/skill.md b/content/github/claude-quickstarts/managed-agents/slack/skill.md
index abc0366105..d1667b81e4 100644
--- a/content/github/claude-quickstarts/managed-agents/slack/skill.md
+++ b/content/github/claude-quickstarts/managed-agents/slack/skill.md
@@ -67,9 +67,11 @@ Not only yours. If the Anthropic workspace is shared with other agents, scripts,
 - **Catch 404/403 on `sessions.retrieve`.** Sessions created under other API keys in the same workspace aren't readable by yours.
 - **For production, use a dedicated Anthropic workspace.** Each unrelated session costs one `retrieve()` call to discard it. A workspace that only contains this agent's sessions avoids that.
 
-### The idle webhook checks who started the session
+### The idle webhook only trusts routes it signed
 
-`metadata` says where to reply, but it does not prove the session is the bridge's. Anyone who can create sessions in the same Anthropic workspace can set `slack_channel` and `slack_thread_ts` on one of theirs, and a handler that trusted the keys alone would post their text into your Slack channel with your bot token. So `src/managed-agents-webhook.ts` also requires `session.agent.id` and `session.environment_id` to match this bridge's `CLAUDE_AGENT_ID` and `CLAUDE_ENVIRONMENT_ID`. If you fork this, keep that check next to the metadata read.
+`metadata` says where to reply, but it does not prove the session is the bridge's. Anyone with credentials for the same Anthropic workspace can start a session, on this same agent, with `slack_channel` and `slack_thread_ts` of their choosing. A handler that trusted those keys would post their text into your Slack channel with your bot token. Checking `session.agent.id` and `session.environment_id` is a useful first filter and nothing more, because agent IDs are not secrets.
+
+So at kickoff `src/agent.ts` stores `slack_route_sig`, an HMAC over the session ID, channel, and thread, keyed by a secret derived from `SLACK_SIGNING_SECRET`, which never leaves the bridge. `src/managed-agents-webhook.ts` recomputes it and compares in constant time before posting anything. The session ID is part of the signed text on purpose: metadata is readable by the same people who can forge it, so a signature over the route alone could be copied onto another session. The signature is also single-use. A signed session is still a session that anyone with workspace credentials can send another message to, and its next idle would post their text into the channel. So once the bridge has delivered, or decided it never will, it deletes `slack_route_sig` from the metadata, and later idles are refused. A retryable failure leaves it in place so the retry can still verify. The bridge also remembers delivered sessions in memory and takes a per-session lock right after verifying, because the remote delete can fail and two idle events for one session carry different event ids. And the signed text includes an issued-at time: a route older than 24 hours is refused, so one whose delivery keeps failing does not stay live with no end. An agent run longer than that loses its reply. Raise `MAX_AGE_SECONDS` in `src/route-signature.ts` if yours do. If you fork this, keep the verify call between the metadata read and the first Slack call, and keep the delete after the delivery. Rotating `SLACK_SIGNING_SECRET` invalidates the signatures of sessions still running, and their replies are dropped with a log line.
 
 ### Message text is untrusted input
 
diff --git a/content/mcp/community/interest-groups/primitive-grouping.md b/content/mcp/community/interest-groups/primitive-grouping.md
index ced5309c5a..ba7ecd467b 100644
--- a/content/mcp/community/interest-groups/primitive-grouping.md
+++ b/content/mcp/community/interest-groups/primitive-grouping.md
@@ -30,7 +30,7 @@ The Primitive Grouping Interest Group explores how MCP Primitives (Tools, Resour
 ### Related Groups
 
 * **[Tool Annotations IG](/community/interest-groups/tool-annotations)** - annotation-based filtering and selection of primitives intersects with how primitives are organized and surfaced
-* **[Skills Over MCP WG](/community/working-groups/skills-over-mcp)** - the MCP-and-Skills effort is evaluating how capabilities are discovered and organized, which overlaps with grouping
+* **[Skills Over MCP WG](/community/working-groups/skills-over-mcp)** - maintains the published [Skills extension](/extensions/skills/overview); skill discovery and progressive disclosure overlap with grouping
 * **[Registry WG](/community/working-groups/registry)** - organizing MCP servers (beyond this group's mandate) is evaluated here
 * **[Security IG](/community/interest-groups/security)** - organizing and disclosing primitives by privilege level is a security concern outside this group's scope
 
@@ -47,7 +47,7 @@ Flat lists of MCP primitives can be long and cumbersome to work with for several
 **Beyond Scope**
 
 * **Organization for security** - organizing and disclosing primitives to clients based on their privilege level is an important problem but beyond this group's mandate
-* **Organizing MCP servers** - the MCP Registry and MCP-and-Skills groups are evaluating how different servers should be organized to improve the client experience
+* **Organizing MCP servers** - server discovery and registry schema decisions belong to the [Registry WG](/community/working-groups/registry), with skill-distribution requirements contributed by the Skills Over MCP WG
 
 ## Goals
 
diff --git a/content/mcp/community/working-groups/filesystems.md b/content/mcp/community/working-groups/filesystems.md
index 87bc171a78..fca8697908 100644
--- a/content/mcp/community/working-groups/filesystems.md
+++ b/content/mcp/community/working-groups/filesystems.md
@@ -51,8 +51,9 @@ optimistic concurrency control, and the interaction with change notification and
 
 * **File Uploads WG.** Both groups transfer content to a server. Coordination needed on where an upload-oriented flow
   ends and a resource write operation begins.
-* **Skills Over MCP WG.** Filesystem dependency, including questions about write access, was an agenda item at the
-  office hours of 24 March 2026 and remains open.
+* **[Skills Over MCP WG](/community/working-groups/skills-over-mcp).** The published
+  [Skills extension](/extensions/skills/overview) uses Resources for file reads and defines optional directory reading.
+  It does not depend on filesystem write operations; coordinate on future resource operations that affect skills.
 * **Agents WG.** Multi-agent and job orchestration systems are the motivating consumers of a shared write path.
 
 ## Leadership
diff --git a/content/mcp/community/working-groups/skills-over-mcp.md b/content/mcp/community/working-groups/skills-over-mcp.md
index 1a2f4d37db..5d61de8f00 100644
--- a/content/mcp/community/working-groups/skills-over-mcp.md
+++ b/content/mcp/community/working-groups/skills-over-mcp.md
@@ -19,22 +19,27 @@ emerged from discussion on [SEP-2076 — Agent Skills as a First-Class MCP Primi
 which raised open questions about whether existing MCP primitives suffice or what
 conventions to standardize. The WG produces specification extensions, reference
 implementations, and coordination artifacts because solutions touch the protocol spec,
-registry schema, SDK implementations, and client behavior. The WG's current direction
-is captured in [SEP-2640 — Skills Extension](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2640)
-(Resources-based, Extensions Track).
+registry schema, SDK implementations, and client behavior.
+
+[SEP-2640 — Skills Extension](/seps/2640-skills-extension) is Final. The WG maintains
+the official [Skills extension](/extensions/skills/overview)
+(`io.modelcontextprotocol/skills`) in
+[modelcontextprotocol/ext-skills](https://github.com/modelcontextprotocol/ext-skills).
+Current work focuses on implementation support, interoperability, and evolution
+of the published extension.
 
 ## Scope
 
 ### In Scope
 
-* **Specification Work**: SEPs defining how skills are represented, discovered, and
-  consumed within MCP — including the Skills Extension (Extensions Track) and related
-  protocol changes
+* **Specification Work**: Maintain and evolve the Skills extension, with changes
+  tracked in the [decision log](https://github.com/modelcontextprotocol/ext-skills/blob/main/docs/decisions.md);
+  propose related core protocol changes through the SEP process
 * **Reference Implementations**: SDK components and reference servers demonstrating
   skill discovery and consumption patterns
 * **Cross-Cutting Concerns**: Coordination with Registry WG (skills discovery/distribution,
   registry schema changes), Agents WG (skill activation, server metadata consumption),
-  Primitive Grouping WG (progressive disclosure patterns), and external projects including
+  Primitive Grouping IG (progressive disclosure patterns), and external projects including
   the [Agent Skills](https://agentskills.io/) spec (content format and well-known URI
   discovery), FastMCP, and PydanticAI
 * **Documentation**: Specification sections and guidance covering skill authoring,
@@ -54,7 +59,7 @@ is captured in [SEP-2640 — Skills Extension](https://github.com/modelcontextpr
 
 * **Agents WG** — How agents consume server metadata, skill activation
 * **Registry WG** — Skills discovery/distribution, registry schema changes
-* **Primitive Grouping WG** — Progressive disclosure patterns
+* **Primitive Grouping IG** — Progressive disclosure patterns
 
 ## Leadership
 
@@ -113,27 +118,31 @@ Discord: [#skills-over-mcp-wg](https://discord.com/channels/1358869848138059966/
 
 ## Resources
 
-* Experimental findings and reference implementations: [modelcontextprotocol/experimental-ext-skills](https://github.com/modelcontextprotocol/experimental-ext-skills)
-* Project board: [Skills Over MCP WG](https://github.com/orgs/modelcontextprotocol/projects/38/views/1)
+* [Skills extension overview](/extensions/skills/overview) and [Final SEP-2640](/seps/2640-skills-extension)
+* Specification and WG documents: [modelcontextprotocol/ext-skills](https://github.com/modelcontextprotocol/ext-skills)
+* [Implementations](https://github.com/modelcontextprotocol/ext-skills/blob/main/docs/implementations.md) and [client support](/extensions/client-matrix)
+* [Decision log](https://github.com/modelcontextprotocol/ext-skills/blob/main/docs/decisions.md) and [archived design work](https://github.com/modelcontextprotocol/ext-skills/tree/main/docs/archive)
 
 ## Deliverables & Success Metrics
 
-### Active Work Items
+### Completed Milestones
+
+* [SEP-2640](/seps/2640-skills-extension) is **Final**, merged on September 13, 2026.
+* The official specification is published in [ext-skills](https://github.com/modelcontextprotocol/ext-skills/blob/main/specification/stable/skills.mdx), with a [website overview](/extensions/skills/overview).
+* [Skills conformance scenarios](https://github.com/modelcontextprotocol/conformance/pull/330) were merged on September 11, 2026.
 
-Full live tracking is on the [Skills Over MCP WG project board](https://github.com/orgs/modelcontextprotocol/projects/38/views/1). Headline workstreams:
+### Current Work
 
-| Item                                                                                                              | Status      | Target Date | Champion                                                                                     |
-| ----------------------------------------------------------------------------------------------------------------- | ----------- | ----------- | -------------------------------------------------------------------------------------------- |
-| [Skills Extension SEP](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2640) (Extensions Track) | In Review   |             | [@pja-ant](https://github.com/pja-ant)                                                       |
-| Skills Extension reference implementation                                                                         | In Review   |             | [@olaservo](https://github.com/olaservo)                                                     |
-| Agent Skills spec coordination                                                                                    | In Progress |             | [@jonathanhefner](https://github.com/jonathanhefner), [@pja-ant](https://github.com/pja-ant) |
-| Registry skills.json proposal                                                                                     | In Progress |             | [@JAORMX](https://github.com/JAORMX)                                                         |
+Track proposals, implementation work, and coordination in
+[ext-skills issues](https://github.com/modelcontextprotocol/ext-skills/issues),
+with links to SDK or client issues where the implementation lives.
+Owners, progress, and priorities are maintained there rather than in this charter.
 
 ### Success Criteria
 
-* **Short-term**: Documented consensus on requirements and evaluation of existing approaches
-* **Medium-term**: Clear recommendation (convention vs. protocol extension vs. both) — the draft Skills Extension SEP represents the WG's current direction: a formal extension using existing Resources primitives
-* **Long-term**: Interoperable skill distribution across MCP servers and clients
+* **Specification**: A published Resources-based Skills extension — achieved with Final SEP-2640.
+* **Implementation**: SDK and host implementations that pass the applicable conformance scenarios.
+* **Interoperability**: Independent MCP servers and clients that discover and load skills consistently.
 
 ## Changelog
 
diff --git a/content/mcp/extensions/skills/overview.md b/content/mcp/extensions/skills/overview.md
index 4fb029e8f3..3c7277e14b 100644
--- a/content/mcp/extensions/skills/overview.md
+++ b/content/mcp/extensions/skills/overview.md
@@ -7,7 +7,14 @@
 > Discover and read Agent Skills from MCP servers
 
 The [ext-skills repository](https://github.com/modelcontextprotocol/ext-skills)
-contains the specification for Skills over MCP.
+contains the published specification for the official Skills extension
+(`io.modelcontextprotocol/skills`). [SEP-2640](/seps/2640-skills-extension) is Final.
+
+The [Skills Over MCP Working Group](/community/working-groups/skills-over-mcp)
+maintains the extension. SDK and host support is still being implemented;
+see the [client support matrix](/extensions/client-matrix) and
+[implementations list](https://github.com/modelcontextprotocol/ext-skills/blob/main/docs/implementations.md)
+for current coverage.
 
 <Card title="modelcontextprotocol/ext-skills" icon="github" href="https://github.com/modelcontextprotocol/ext-skills">
   Specification and documentation for Skills over MCP.
diff --git a/content/support/10310342-how-do-i-log-out-of-all-active-sessions.md b/content/support/10310342-how-do-i-log-out-of-all-active-sessions.md
index 1b05dfd049..a343d0356b 100644
--- a/content/support/10310342-how-do-i-log-out-of-all-active-sessions.md
+++ b/content/support/10310342-how-do-i-log-out-of-all-active-sessions.md
@@ -38,7 +38,7 @@ To regain access to your account on any device, you'll need to authenticate agai
 
 If you used your Claude account to authenticate into Claude Code, you can manage your authorization tokens by navigating to **[Settings > Claude Code](https://claude.ai/settings/claude-code)**. To remove a token and log out of Claude Code, click the trash can icon.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1608263923/b4fa7d6f6f08f2adffb4ea63bc58/image+%287%29.png?expires=1789727400&amp;signature=a42ee5b9da9c6719611d3397596cb1ecb4b226bbb0238b8d1c3e947ab8bb1450&amp;req=dSYnHst4nohdWvMW1HO4zVuHihX61GC%2FAQofdwM8qVeqWLoMikDIQAKZvwYy%0APWtym%2B0MZ4BCDAA1SbI%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1608263923/b4fa7d6f6f08f2adffb4ea63bc58/image+%287%29.png?expires=1789796700&amp;signature=2bee2a4dd1b1df5a4b4b09a71d34bc97f6be8854925c4974c004c69b0069db54&amp;req=dSYnHst4nohdWvMW1HO4zVuHihX632G8AQofdwM8qVd6MuecS2BiWpvSijfl%0AKEaqZe%2BB8KOciWORUOE%3D%0A)
 
 ## Unable to access your account?
 
diff --git a/content/support/10366376-how-can-i-delete-my-claude-console-account.md b/content/support/10366376-how-can-i-delete-my-claude-console-account.md
index c2ab68062c..61afa1bc4e 100644
--- a/content/support/10366376-how-can-i-delete-my-claude-console-account.md
+++ b/content/support/10366376-how-can-i-delete-my-claude-console-account.md
@@ -36,7 +36,7 @@ If you followed the steps above to delete your Console organization but want to
 
 If you have an outstanding balance, you will see a message during the deletion flow that prompts you to pay the balance first by routing you to [Settings > Billing](https://platform.claude.com/settings/billing).
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1973957766/5c2dd87c0818a0400099a833c9b3/4cc3130a-f696-4967-9fe3-e5623c6f02bd?expires=1789727400&amp;signature=f690be98afff42ca13ad72be7774486218ea2231cc9b35d5ccaaf2294e33d14e&amp;req=dSkgFcB7moZZX%2FMW1HO4zbYXUB5lXuMfFZRyvJPpBZ%2Fm4DiYvGWmwcF5riSu%0ApM7CU21PiL5NqdQeaMA%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1973957766/5c2dd87c0818a0400099a833c9b3/4cc3130a-f696-4967-9fe3-e5623c6f02bd?expires=1789796700&amp;signature=89b3dc02111c27bac4891408812c737653da1570f9d2565e113c5fd56b3bd3cd&amp;req=dSkgFcB7moZZX%2FMW1HO4zbYXUB5lVeIcFZRyvJPpBZ%2FJ9A%2FJ%2F8vo1ahvvujK%0AK7%2BfqCgH8Sh01uPcXQo%3D%0A)
 
 You must pay this outstanding balance before you’re able to move forward with the deletion process.
 
@@ -44,6 +44,6 @@ You must pay this outstanding balance before you’re able to move forward with
 
 There are some scenarios where you will need to contact our team to delete your account. If this is the case, it will be noted when you try to delete your organization:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1973957765/19dda72a40db95d78c00c27a1a1c/6ce89be6-93ce-409c-bbea-d34be09db348?expires=1789727400&amp;signature=4792418f51790ec86ff3a758253d48d643b5f155d2a6873c100c89fe60419ca7&amp;req=dSkgFcB7moZZXPMW1HO4zRW12%2BzKeqP9ZxDZGlqR6GiE8AdoViyF9J52eGiE%0Aue%2F4OqxiluNvjG4ex5c%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1973957765/19dda72a40db95d78c00c27a1a1c/6ce89be6-93ce-409c-bbea-d34be09db348?expires=1789796700&amp;signature=9d98697bab6318dcb95cf668e20d974887469da0251d4722a79e8f0e04ca805a&amp;req=dSkgFcB7moZZXPMW1HO4zRW12%2BzKcaL%2BZxDZGlqR6GiQdzgZQ2%2FntWDur8yK%0AWxs5e1kHz0viYusHgqg%3D%0A)
 
 If you are seeing this message, this indicates that your Console organization cannot be deleted via the self-service pathway.
\ No newline at end of file
diff --git a/content/support/10504844-manage-user-feedback-settings-on-team-and-enterprise-plans.md b/content/support/10504844-manage-user-feedback-settings-on-team-and-enterprise-plans.md
index bdc266f5c8..a2152c995d 100644
--- a/content/support/10504844-manage-user-feedback-settings-on-team-and-enterprise-plans.md
+++ b/content/support/10504844-manage-user-feedback-settings-on-team-and-enterprise-plans.md
@@ -6,6 +6,6 @@ As a Primary Owner or Owner of a Team or Enterprise plan, you can manage the abi
 
 2. Use the toggle to change the **Rate chats** setting for your organization:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2058292603/75752add0bed6a9f3ab217f01708/CleanShot%2B2026-02-12%2Bat%2B08_55_14-402x.png?expires=1789727400&amp;signature=33ba91892dda2cef09c84ce6789ab9c9aeb3e030e8aad6cd517571fde5df2048&amp;req=diAiHst3n4dfWvMW1HO4zYGm8i4bEq%2FI085gFtEpvcSRuZG7o2uIR0gC4Fu6%0ACan9bKLudTVA273yiWQ%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2058292603/75752add0bed6a9f3ab217f01708/CleanShot%2B2026-02-12%2Bat%2B08_55_14-402x.png?expires=1789796700&amp;signature=dbe2c11bc6355b89d69606c8762dbac06523d958de352b7f7712d4d3f1fb4c7a&amp;req=diAiHst3n4dfWvMW1HO4zYGm8i4bGa7L085gFtEpvcTaw6wPwiz0m21c4CX0%0AJW29ErdB%2FQIXem9i%2BFc%3D%0A)
 
 More information on how Anthropic collects, uses, and stores feedback data can be found in our Privacy Center: **[How long do you store my organization’s data?](https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data)**
\ No newline at end of file
diff --git a/content/support/10504853-manage-user-feedback-settings-on-claude-console.md b/content/support/10504853-manage-user-feedback-settings-on-claude-console.md
index 8d90e26d14..cb450caf2d 100644
--- a/content/support/10504853-manage-user-feedback-settings-on-claude-console.md
+++ b/content/support/10504853-manage-user-feedback-settings-on-claude-console.md
@@ -8,6 +8,6 @@ To manage feedback for your Console organization:
 
 2. Toggle the feedback switch on or off.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1729186182/ebf4032a12a8c56959ca927726ce/Screenshot+2025-09-16+at+12_32_31%E2%80%AFPM.png?expires=1789727400&amp;signature=b1b1cc80aea0eb6df01b33e26ff347f2cc141291da3897ccc538570035c52f2c&amp;req=dSclH8h2m4BXW%2FMW1HO4zVpN5H4aW29BJ%2FadMup7FQdkEtyqk3GN6hIRby1Z%0AfNgkcW50pMdbJMWSHpw%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1729186182/ebf4032a12a8c56959ca927726ce/Screenshot+2025-09-16+at+12_32_31%E2%80%AFPM.png?expires=1789796700&amp;signature=f95e8f08fa88da105a1f20c74df004a8a54d5328e644434b0cb51d865d207364&amp;req=dSclH8h2m4BXW%2FMW1HO4zVpN5H4aUG5CJ%2FadMup7FQdosXEf4jHGlLzOTjnO%0AYD9XFHrxREe%2BzjXQnyA%3D%0A)
 
 More information on how Anthropic collects, uses, and stores feedback data can be found in our Privacy Center: [How long do you store my organization’s data?](https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data)
\ No newline at end of file
diff --git a/content/support/10593882-share-and-unshare-chats.md b/content/support/10593882-share-and-unshare-chats.md
index a5d6755c35..93312e72b7 100644
--- a/content/support/10593882-share-and-unshare-chats.md
+++ b/content/support/10593882-share-and-unshare-chats.md
@@ -38,12 +38,12 @@ To unshare a chat:
 
 Users on free, Pro, or Max plans can review a log of shared chats by navigating to **[Settings > Privacy](https://claude.ai/settings/data-privacy-controls)**. Find the **Privacy settings** section and click “Manage” next to **Shared chats:**
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1921669913/7cc7be48cfc7a18f9f469d6cd83c/CleanShot+2026-01-08+at+10_20_43%402x.png?expires=1789727400&amp;signature=67526dcb5c6f7dc4313773bf5ef672f79755de4ff05dab859e93ba748252df7a&amp;req=dSklF894lIheWvMW1HO4zWn5HzoaYEJvc9cNIYuX0GFa7VIPufGOvi5mSs3K%0AxKldDgXnTm%2FdV1tuyYQ%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1921669913/7cc7be48cfc7a18f9f469d6cd83c/CleanShot+2026-01-08+at+10_20_43%402x.png?expires=1789796700&amp;signature=6bec59838827effc70fe7abcea89437e9645a87ecf91b6ca65c4b4fef2d9240d&amp;req=dSklF894lIheWvMW1HO4zWn5Hzoaa0Nsc9cNIYuX0GHX8bfDOe2zVLpYUkhy%0AHjm7vhFaPbH6I23Hgng%3D%0A)
 
 This will open a **Shared chats** modal listing the title, date shared, and link to each chat, allowing you to easily review and access all your previously-shared content. From here, you also have the option to click “Unshare” next to each listed chat to revoke access to the last snapshot you shared:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1624243810/e6fe1d262597446c7fe21dff9f10/AD_4nXdW-GhByF8uKV7fCq9lTbkVB91FglSL6TSyXAOUk_MLcTV9YsEMBMkm9rgm1oXqv0k3sJh1JhlzZP6tHVkKbDJJ71pDRRtM3aVNG64MDuKDIzgmknh-XDZdNa7biTsTdwGoPr5GRg?expires=1789727400&amp;signature=3e9788f78f1ad464be6098d75a64d3b19d62f241ca898b260393b87e59d8d1df&amp;req=dSYlEst6noleWfMW1HO4ze44eC5mlhU6guvTv9woD7bL6bzp47cJyI99CkeA%0ABIkt4pqV%2FbLTE3ElakU%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1624243810/e6fe1d262597446c7fe21dff9f10/AD_4nXdW-GhByF8uKV7fCq9lTbkVB91FglSL6TSyXAOUk_MLcTV9YsEMBMkm9rgm1oXqv0k3sJh1JhlzZP6tHVkKbDJJ71pDRRtM3aVNG64MDuKDIzgmknh-XDZdNa7biTsTdwGoPr5GRg?expires=1789796700&amp;signature=eb6fd8a8a56ce3fdf03717c33d293a5c8050888b8f612dd249dbd34197121835&amp;req=dSYlEst6noleWfMW1HO4ze44eC5mnRQ5guvTv9woD7YK4PWtjsLdHuKbtYEo%0AL3WgtdZOkdymKz1QOWU%3D%0A)
 
 If you don’t have any shared chat snapshots, the **Shared chats** modal will show “No shared content found”:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1624243808/b025db8e598f0c88fb16d83d48d5/AD_4nXeUwCKnmFzzrjMHhfr5By4zk5pJlkEn3wbJ8-aNfu13Yl99IjBywpqPx9G07QRzpH1EwRY7uG7Q9m9fib98Gql1cIV7XwUCTzEgBNu79Ey8tCOS5CEVmwveIcEOxJ4fonBhe3g9MA?expires=1789727400&amp;signature=06893622314d1e8326d187b84c7b18ae0864ccc13aead81f94dc81cdfc6fe509&amp;req=dSYlEst6nolfUfMW1HO4zdaFncxzg461DeZsm0Gz1HssGOxUwf6jhsDPmOPY%0AHy9ITPKOj1kH%2F6Ba%2BQk%3D%0A)
\ No newline at end of file
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1624243808/b025db8e598f0c88fb16d83d48d5/AD_4nXeUwCKnmFzzrjMHhfr5By4zk5pJlkEn3wbJ8-aNfu13Yl99IjBywpqPx9G07QRzpH1EwRY7uG7Q9m9fib98Gql1cIV7XwUCTzEgBNu79Ey8tCOS5CEVmwveIcEOxJ4fonBhe3g9MA?expires=1789796700&amp;signature=90b2c00dbd13c9e28f33198c968ad1bd27e90fd976e3ab803fbce04b8e24e36d&amp;req=dSYlEst6nolfUfMW1HO4zdaFncxziI%2B2DeZsm0Gz1Hth2cdcsno4CBzWBSC%2B%0AfD3PA3YRXjOFZiv6pXQ%3D%0A)
\ No newline at end of file
diff --git a/content/support/10949351-getting-started-with-local-mcp-servers-on-claude-desktop.md b/content/support/10949351-getting-started-with-local-mcp-servers-on-claude-desktop.md
index 54bbe35ead..03aaf7ff04 100644
--- a/content/support/10949351-getting-started-with-local-mcp-servers-on-claude-desktop.md
+++ b/content/support/10949351-getting-started-with-local-mcp-servers-on-claude-desktop.md
@@ -48,7 +48,7 @@ for specific instructions.
 
 Custom desktop extensions uploads allow Team and Enterprise plans to leverage organization-specific workflows that aren’t available in the public directory. After creating a custom desktop extension, Owners and Primary Owners can navigate to Settings > Extensions within Claude Desktop and click “Advanced settings” to access the **Extension Developer** section:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1681607607/ba6e379d2769d190f0970a0adaed/AD_4nXd4aZkqjJFpiXMPF28Pih7HmSJ9pPsnoWAfVgiLdFRFiTkO92YtXteIjvDHaPl7T0tjfpRTBOlyrMbQ_aciCNDgfIuEvV3szmKvt72x5O51DMSClXOYWk1JIRIzylwkj3joXqZcLw?expires=1789727400&amp;signature=f5533607db1606da72a1417ec125e950a3b46d247b409896e0ffa88e65f258c8&amp;req=dSYvF89%2BmodfXvMW1HO4zWbPxEl4NTo2Hn9K2IaIG2IEwjmA3gZZv6PhygGc%0A7lEvRq4LSu%2FL9f7k4Xo%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1681607607/ba6e379d2769d190f0970a0adaed/AD_4nXd4aZkqjJFpiXMPF28Pih7HmSJ9pPsnoWAfVgiLdFRFiTkO92YtXteIjvDHaPl7T0tjfpRTBOlyrMbQ_aciCNDgfIuEvV3szmKvt72x5O51DMSClXOYWk1JIRIzylwkj3joXqZcLw?expires=1789796700&amp;signature=b0fd00ad88fd0d16ab78b497837dddbd16605de99729cc5bb278a2c135e2d5c4&amp;req=dSYvF89%2BmodfXvMW1HO4zWbPxEl4Pjs1Hn9K2IaIG2I0vzy%2FTEzs4TPCRFqL%0A4QpReHr8iHWb1D2ZlAw%3D%0A)
 
 Click “Install Extension…” and select the .mcpb file. Follow the prompts to install and configure your custom desktop extension. For more in-depth information, please refer to our [desktop extension developer documentation](https://github.com/anthropics/mcpb).
 
diff --git a/content/support/11101966-use-voice-mode.md b/content/support/11101966-use-voice-mode.md
index 94f7e2f83f..69b649b51f 100644
--- a/content/support/11101966-use-voice-mode.md
+++ b/content/support/11101966-use-voice-mode.md
@@ -24,7 +24,7 @@ Voice mode transforms how you interact with Claude by:
 
 2. Tap the sound wave symbol in the lower right corner of the chat window to activate voice mode:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2042358620/1bf2311353615c1c494da1312a17/124b93a8-0a9b-4c84-9d1f-ede6ca3498dd?expires=1789727400&amp;signature=b4a5f19b5d64e789f18a8fdc18bc563cea34425cbd0d83751c4c827abd89b792&amp;req=diAjFMp7lYddWfMW1HO4zZyGrsd1uVAUF6uXnTLMvvAufUMUq1X2A%2B4lG%2BJQ%0AAEyf%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2042358620/1bf2311353615c1c494da1312a17/124b93a8-0a9b-4c84-9d1f-ede6ca3498dd?expires=1789796700&amp;signature=23613be76f624cc726632fb09156cf6c78cf7d4357ec5c561719fe670b611728&amp;req=diAjFMp7lYddWfMW1HO4zZyGrsd1slEXF6uXnTLMvvDCYAHkksWHcs9J%2BKO7%0AGWFP%0A)
 
 3. Start talking and see your prompt automatically populate in the chat input.
 
@@ -32,7 +32,7 @@ Voice mode transforms how you interact with Claude by:
 
 5. Claude will remain in voice mode until you click the “Stop” button in the lower right corner of the chat window:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2042352060/162f9e61f7fbeb689201dfc1cac1/6a7fafb2-31df-43be-a43f-0059d735e3c4?expires=1789727400&amp;signature=57c5d2f03c2ca25c03949c0051477913caf5f7cbcc3b6ec3c708659cf758e2e9&amp;req=diAjFMp7n4FZWfMW1HO4zU6VRfTNSrttxNdRzYWrfF5FKIBgJgDB1JaP6k2d%0A7SmL9gUplyru58CzDWA%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2042352060/162f9e61f7fbeb689201dfc1cac1/6a7fafb2-31df-43be-a43f-0059d735e3c4?expires=1789796700&amp;signature=32a4c4fbb57b5566435f75033e70b57ac98a7053096f7887f1253562c0aa59c8&amp;req=diAjFMp7n4FZWfMW1HO4zU6VRfTNQbpuxNdRzYWrfF7nEnuKczBuSEVGdWn%2B%0Au2S5XqpJmPcCfdcsrlc%3D%0A)
 
 ### On mobile (iOS and Android)
 
@@ -40,7 +40,7 @@ Voice mode transforms how you interact with Claude by:
 
 2. Tap the voice mode icon (sound wave symbol next to the microphone icon) in the text input field:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2042359690/68879db64559ecf87991f73ce058/671ff972-9e08-4686-bc04-955dab4b2de3?expires=1789727400&amp;signature=90d31ed95cc7889ed1ec405dec45b0f823210db0b4409f7f14e93d645d997a61&amp;req=diAjFMp7lIdWWfMW1HO4zQTUIf19kt9KD%2FRXAPlQ7LZy1VX8C6Ua1FNv9oUm%0AF2yS%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2042359690/68879db64559ecf87991f73ce058/671ff972-9e08-4686-bc04-955dab4b2de3?expires=1789796700&amp;signature=4730bf34f7c56b8d2b53ad5ca455dcd051beadceb562b8b4c58d2af755567d5a&amp;req=diAjFMp7lIdWWfMW1HO4zQTUIf19md5JD%2FRXAPlQ7LbEzxHxQJf572SNBc4A%0Aqvq3%0A)
 
 3. Choose a voice to personalize your experience.
 
@@ -78,7 +78,7 @@ To change the voice later:
 
 - **On mobile:** Click the settings button in the bottom left corner while chatting with Claude in voice mode, then tap your preferred voice and pace:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2042352063/25eca25bcfd573ecab30dd53158c/074454a6-fa5a-4c49-8b19-02d434b4ca50?expires=1789727400&amp;signature=676498d12df42d92928572a9b4eceecc635a444b8cf1095b33f4825354ea02b5&amp;req=diAjFMp7n4FZWvMW1HO4zZ3%2FGGOSYlcOy8OQfYsvK3zjqxDxLKtuv%2FB1ut9K%0AbsglsRwmDVYY4KtNheM%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2042352063/25eca25bcfd573ecab30dd53158c/074454a6-fa5a-4c49-8b19-02d434b4ca50?expires=1789796700&amp;signature=00e5e5d3d61c20a9e444d460a15663fd65394496e348bda982b3be3e4aa8e378&amp;req=diAjFMp7n4FZWvMW1HO4zZ3%2FGGOSaVYNy8OQfYsvK3xG98RwfpfCZ1mindkC%0A7nJiarXbOU1gvpk%2BaEk%3D%0A)
 
 ## Choose a model
 
diff --git a/content/support/11725453-set-up-the-claude-lti-in-canvas-by-instructure.md b/content/support/11725453-set-up-the-claude-lti-in-canvas-by-instructure.md
index 3fe4c1a97d..eb45087b68 100644
--- a/content/support/11725453-set-up-the-claude-lti-in-canvas-by-instructure.md
+++ b/content/support/11725453-set-up-the-claude-lti-in-canvas-by-instructure.md
@@ -44,7 +44,7 @@ This article provides information on how to enable the Claude LTI integration in
 
 5. Click "Install" and refresh the course page.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1611422430/c8e0875feac1f2c7cb033be74fc9/AD_4nXfLU_bui3EXcCjQ0qm70HD97neqjGayKeDer_t76utlci8gZSUjYRhw6ZSOlDdqSEcwXBzd_shAh7pQEJ-8OoE0O21DM5coOgxmO_WD5hlwiuwtS2iYXcTavhIRyQT5zKFWvfn3NA?expires=1789727400&amp;signature=6aeefe10679b6431d7636deee6c676d77b200e1b22204879e77b22964e4e021c&amp;req=dSYmF818n4VcWfMW1HO4zTEDauIZmfSFEv2ojHLMylYbovxTFiiBahgcUKTk%0AtswTJ6wIjT1vUxsDkUQ%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1611422430/c8e0875feac1f2c7cb033be74fc9/AD_4nXfLU_bui3EXcCjQ0qm70HD97neqjGayKeDer_t76utlci8gZSUjYRhw6ZSOlDdqSEcwXBzd_shAh7pQEJ-8OoE0O21DM5coOgxmO_WD5hlwiuwtS2iYXcTavhIRyQT5zKFWvfn3NA?expires=1789796700&amp;signature=8ef55f9c93f8b2abc690b953f0c696f791ce49626e352066fe88b330f1bb4240&amp;req=dSYmF818n4VcWfMW1HO4zTEDauIZkvWGEv2ojHLMylbiBjh3x%2BkXAAIhls2j%0AsB46NzFnjsfFz2kHWxg%3D%0A)
 
 ## Turn on the Claude LTI Integration in Claude for Education organization settings
 
diff --git a/content/support/11817273-use-claude-s-chat-search-and-memory-to-build-on-previous-context.md b/content/support/11817273-use-claude-s-chat-search-and-memory-to-build-on-previous-context.md
index 2057836331..b35a758788 100644
--- a/content/support/11817273-use-claude-s-chat-search-and-memory-to-build-on-previous-context.md
+++ b/content/support/11817273-use-claude-s-chat-search-and-memory-to-build-on-previous-context.md
@@ -40,7 +40,7 @@ When Claude searches your previous chats, you will see this reflected in your cu
 
 Yes, navigate to **[Settings > Memory](https://claude.ai/new#settings/customize-memory)** and switch the toggle next to "Search and reference chats" off:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2533482439/4dee2d7b267f865205feefc8f4f3/cb60c334-d1e2-4828-a01d-dfb36bbaa7eb?expires=1789728300&amp;signature=eb41000c4716564386abb2cedb417a2c682ecaabaf55463dd00a0c674952ead5&amp;req=diUkFc12n4VcUPMW1HO4zY9IRANrV9l0YNcz5nFaZkGMx%2B3qBAcDiBYfiQ2u%0A9DH6I3zDMpLBHs9KZUA%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2533482439/4dee2d7b267f865205feefc8f4f3/cb60c334-d1e2-4828-a01d-dfb36bbaa7eb?expires=1789796700&amp;signature=e5153c4ec31db0c3a526496495e06ff844c622b4197165bbf0a9d4f0ec5b4f1c&amp;req=diUkFc12n4VcUPMW1HO4zY9IRANrXNdwYNcz5nFaZkHbKj10M485bai4ZyDf%0AXSksNHYR1kU%2Fd0XBBfc%3D%0A)
 
 ## Can I exclude a specific past chat from searches?
 
@@ -84,7 +84,7 @@ What Claude remembers from your chats is available when you hand it a task in Co
 
 You can toggle Claude’s memory on by navigating to **[Settings > Memory](https://claude.ai/new#settings/customize-memory)** and turning on **Generate memory from chats**:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2533482441/b5c806a8e3f68bf34c4a70724d38/d30be013-d099-4c93-99d1-23d404792f08?expires=1789728300&amp;signature=a7787be68844b2a8f93c175b8bd4ae6f8482bc93050b8a42bc5b9320a44e96d2&amp;req=diUkFc12n4VbWPMW1HO4zRlYrpJq4FgvNshWSMEMw9dGha3nGMQyEXw%2Bkx%2Fs%0AHPNr21GdNYEkzNhvVpo%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2533482441/b5c806a8e3f68bf34c4a70724d38/d30be013-d099-4c93-99d1-23d404792f08?expires=1789796700&amp;signature=409b1a2825056a79b84547a4d59c3859f7db1ef83c1409bc31c1e3b957c3223a&amp;req=diUkFc12n4VbWPMW1HO4zRlYrpJq61YrNshWSMEMw9ck5h2nWh70qmxrAVpp%0AmqigkxxBj03acnoAFas%3D%0A)
 
 If you want to disable Claude’s memory, click the toggle and you'll see two options:
 
@@ -240,7 +240,7 @@ When Claude searches your previous chats, you will see this reflected in your cu
 
 Yes, navigate to **[Settings > Capabilities](https://claude.ai/settings/capabilities)** and find the **Preferences** section. Switch the toggle next to “Search and reference chats” off:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1719730889/3fafbf5ecaa0ae31d7d84a66229b/c25536c1-7433-4b94-a5e9-cd5acf97a4fd?expires=1789728300&amp;signature=ac1ecd3e33c6ac032a9386cc893985ae07a8034cff392c49cffd8d0af9c162f8&amp;req=dScmH859nYlXUPMW1HO4zRzXH1Y3ITnBJG68qZhl7830VzoebmUTjIPrvYGl%0AmWvgMLc6D7efJcV59P4%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1719730889/3fafbf5ecaa0ae31d7d84a66229b/c25536c1-7433-4b94-a5e9-cd5acf97a4fd?expires=1789796700&amp;signature=3c432e1e46cafe0e8b15524a8bfef2035aa1081276afe67a20598fc71c8214df&amp;req=dScmH859nYlXUPMW1HO4zRzXH1Y3KjfFJG68qZhl780K9G%2FOHfFhcZH5HiEo%0AC5veb2VwOMYNaCdKXnc%3D%0A)
 
 ### Can I exclude a specific past chat from searches?
 
@@ -248,7 +248,7 @@ Incognito chats are available to all Claude users (free, Pro, Max, Team, and Ent
 
 When starting a new chat with Claude outside of a project, you'll see a ghost icon in the upper right corner of your screen:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1719730893/9549b21954e0070ceb6b85231fd5/88e59234-6fc2-4229-84fe-733b33efff26?expires=1789728300&amp;signature=4746e1d99efda1c368308df27b80c363b8272f8874397dd0ab4d215ab23a68a5&amp;req=dScmH859nYlWWvMW1HO4za54sKprPo64XDpzhlKsgjMIMlf4Uze6fmxKx0hn%0ALJawEYCMMgqQ8jdvXP8%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1719730893/9549b21954e0070ceb6b85231fd5/88e59234-6fc2-4229-84fe-733b33efff26?expires=1789796700&amp;signature=1a3621d3a5155927e5702c642f3bb492e6bf1a3c28b8807dc7454d2f805e242d&amp;req=dScmH859nYlWWvMW1HO4za54sKprNYC8XDpzhlKsgjMSZqBjUUu32hI2G0Or%0A%2FRM8%2BfVLRPUn4oZLwJM%3D%0A)
 
 Clicking the ghost icon will open an incognito chat, creating a temporary conversation that isn’t saved to your chat history. Claude won’t pull information from incognito chats when searching previous conversations.
 
@@ -280,7 +280,7 @@ Each project has its own separate memory space and dedicated project summary, so
 
 You can toggle Claude’s memory on by navigating to **[Settings > Capabilities](https://claude.ai/settings/capabilities)**:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1719730892/62f9f2b68d675a8e33393f06024f/89198978-192f-4c52-915d-5294b16f3fe1?expires=1789728300&amp;signature=3fb9b73bf795316c3c96f1ad6b53f8101dfe04314c220140c3f1b532a5cc6a04&amp;req=dScmH859nYlWW%2FMW1HO4zTD5MMjhdexGBq9N9dRTKYdSN6n8QqXxbTc%2BZvaW%0A%2BCSC8QKVEXKP9edXaS4%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1719730892/62f9f2b68d675a8e33393f06024f/89198978-192f-4c52-915d-5294b16f3fe1?expires=1789796700&amp;signature=e14556e71d8df22dede68a5d639487395a53daaff9fdd6883516413a77ca5e2e&amp;req=dScmH859nYlWW%2FMW1HO4zTD5MMjhfuJCBq9N9dRTKYeFwn2ttfS%2F01QE5vhr%0AhM6kjbrtCdJS8mJ44mc%3D%0A)
 
 If you want to disable Claude’s memory, click the toggle to see two options:
 
diff --git a/content/support/11818288-why-am-i-being-asked-to-verify-my-payment-method.md b/content/support/11818288-why-am-i-being-asked-to-verify-my-payment-method.md
index 0c9db737c0..f860151fca 100644
--- a/content/support/11818288-why-am-i-being-asked-to-verify-my-payment-method.md
+++ b/content/support/11818288-why-am-i-being-asked-to-verify-my-payment-method.md
@@ -2,7 +2,7 @@
 
 If you see the following pop-up when you log in to your Claude account, you’ll need to click the “Verify now” button to verify your payment method:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1631413861/42c3b13d7fc44a11a88ec2b9cd03/AD_4nXeMx8QXpeZZCkfAnVSwx8KZ9n4Vr2rvPdQddyE6ZNxch__F6ZqFs1G4ZmU52Wvb7gRlwRqquTLdw8IQv-gICDyP-MXqiQK_Oe7gX3SKsCKKt2IEpMx4qDeMeeZufMaJfv16XgOH5g?expires=1789727400&amp;signature=6465bbfa1242c8ed571ea7191538abe00a84d37bec533c0740d6e5ea22afb186&amp;req=dSYkF81%2FnolZWPMW1HO4zf7%2BjE3p6of2n6MrEicvimBS10jg3rsCeDdU51Tj%0A57aY4nFSlFxxj%2FfebGI%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1631413861/42c3b13d7fc44a11a88ec2b9cd03/AD_4nXeMx8QXpeZZCkfAnVSwx8KZ9n4Vr2rvPdQddyE6ZNxch__F6ZqFs1G4ZmU52Wvb7gRlwRqquTLdw8IQv-gICDyP-MXqiQK_Oe7gX3SKsCKKt2IEpMx4qDeMeeZufMaJfv16XgOH5g?expires=1789796700&amp;signature=ee53226a8bfbdaa27b1d92a6000212fa833a262c7af96ce6c1dc97bb7fcfb9a8&amp;req=dSYkF81%2FnolZWPMW1HO4zf7%2BjE3p4Yb1n6MrEicvimCkT2zuEIu%2BTg9xn6kR%0AWyrXy%2BE3KXCUa12r0C4%3D%0A)
 
 ## What happens if I click “Remind me later?”
 
diff --git a/content/support/11869629-use-claude-with-android-apps.md b/content/support/11869629-use-claude-with-android-apps.md
index 3220cae4cc..ae50d71460 100644
--- a/content/support/11869629-use-claude-with-android-apps.md
+++ b/content/support/11869629-use-claude-with-android-apps.md
@@ -222,7 +222,7 @@ Permission requirements vary by feature:
 
 For features requiring permissions (like location or calendar access), Claude will request permission contextually with clear explanations of why the access is needed. You’ll be prompted to approve the action with three options: Allow once, Always allow, or Don't allow.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1707351614/ccb910e4b87b1e96ad9a11bbd835/b57b2130-d8d6-4499-89f6-6c12de236fd4?expires=1789727400&amp;signature=d0f3ecc0e48076630bceb6ca5df2d153c539b9aea49214079c9a5737f5405ff1&amp;req=dScnEcp7nIdeXfMW1HO4zQe5GlaI2SLwS5x65TIld%2FC6tP%2B%2Feci64iAqBfRW%0A%2Bl90kmm%2FGM2nrXQOtdU%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1707351614/ccb910e4b87b1e96ad9a11bbd835/b57b2130-d8d6-4499-89f6-6c12de236fd4?expires=1789796700&amp;signature=86a9738a6c3ab6bac61d5ae8468139dc0cf3e9f02db477b226dd6a1d5db0379a&amp;req=dScnEcp7nIdeXfMW1HO4zQe5GlaI0iPzS5x65TIld%2FCZrjmq66EtM%2Bfc8pry%0AoaD39o4FxBkaXtYWDbQ%3D%0A)
 
 These permissions can be managed at any time in your device settings by going to Settings > Apps > Claude > Permissions. Click into each permission listed under **Allowed** and **Not allowed** to make changes. You can toggle between “Allow only while using the app” or “Ask every time” to change Claude’s access, or remove permissions by choosing “Don’t allow.” Claude will only request permissions if needed for specific features, and you can always choose to decline while still using other capabilities.
 
diff --git a/content/support/12005970-manage-usage-credits-for-team-and-seat-based-enterprise-plans.md b/content/support/12005970-manage-usage-credits-for-team-and-seat-based-enterprise-plans.md
index 6091b2816b..86cffe0a78 100644
--- a/content/support/12005970-manage-usage-credits-for-team-and-seat-based-enterprise-plans.md
+++ b/content/support/12005970-manage-usage-credits-for-team-and-seat-based-enterprise-plans.md
@@ -70,7 +70,7 @@ After navigating to **[Organization settings > Usage](https://claude.ai/admin-se
 
 The **Usage and spend limits** section will show the current limit (if any) or **Unlimited**. Clicking on "Adjust limit" opens a modal where you can either input an amount and click "Set spend limit," or click "Set to unlimited" to remove the organization-wide monthly spend limit.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2149347604/936ac4eb025d3ef1f00c3b8a26b0/image.png?expires=1789727400&amp;signature=c54e63b0ad42e32f810813f07e11ae4f5480a08bc05c472c70db6192b8baf47b&amp;req=diEjH8p6modfXfMW1HO4zQHwg6jQlCmi6DwhVVpk1mA%2FTfp9eVSsX7np0aVX%0A7EsJ8h%2Bzf0H5em%2BBql8%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2149347604/936ac4eb025d3ef1f00c3b8a26b0/image.png?expires=1789796700&amp;signature=69b581d4be3f142c2642607a07b8e0a4147f9ebf3286f0c471938582d71bdfd5&amp;req=diEjH8p6modfXfMW1HO4zQHwg6jQnyih6DwhVVpk1mCoqN8XIOdbGsaU7Qnf%0AP6g5jVQjgQCCLwOXVC0%3D%0A)
 
 Changes to your organization’s overall spend limit go into effect immediately.
 
@@ -78,11 +78,11 @@ Changes to your organization’s overall spend limit go into effect immediately.
 
 Owners and Primary Owners on **seat-based Enterprise plans only** can set spend limits that apply to all users within a specific seat tier.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2149351600/c5b979c366ac2738f60ea84e85b3/CleanShot+2026-03-10+at+15_37_41%402x.png?expires=1789727400&amp;signature=af40301bcef1a95fd164c7a8f0c90b9d526da0c75d97b8a08a0690ab35c5748d&amp;req=diEjH8p7nIdfWfMW1HO4zYnqMIyTIXeN0wfO62ivdG%2B1JChFql0wR9jKpT4T%0AivfNDQku75VYjw9efLI%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2149351600/c5b979c366ac2738f60ea84e85b3/CleanShot+2026-03-10+at+15_37_41%402x.png?expires=1789796700&amp;signature=a563f9a65f8fda9535ecbb402dba2d9f57208a94fdb31e12b83ed3a9aedb4060&amp;req=diEjH8p7nIdfWfMW1HO4zYnqMIyTKnaO0wfO62ivdG99JpUF72Lii5K63VJb%0Auv3TKxso9i037hY1XQ4%3D%0A)
 
 Select the "By group" tab to see **Standard seats** and **Premium seats** groups. Click the "..." icon next to the current limit, then "Edit limit." This opens a modal where you can either select "Set dollar amount" and input an amount, or click "Unlimited" to remove the limit for that seat type. Click "Set limit" to save your changes.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2149362056/44993661ca2db771fe924d0346f6/image.png?expires=1789727400&amp;signature=f3c30c7e3d9ce5b4929ef4fdc3aa9098a736dbb2776066ac08ba03dff6d9b9e4&amp;req=diEjH8p4n4FaX%2FMW1HO4zRzvvIwMckpCq7nEDCGq9G74Y6%2BCDT083qOwG8Xa%0AvdOwSJk%2FkRORWGEvR5A%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2149362056/44993661ca2db771fe924d0346f6/image.png?expires=1789796700&amp;signature=1e6235f14a52e0ef3ad3862de3f8592849c67f2ec9e55deb1b82bdd453aa61d4&amp;req=diEjH8p4n4FaX%2FMW1HO4zRzvvIwMeUtBq7nEDCGq9G4iQmFGjhu02so6Mvr7%0AA7pEcqDM%2FaXyPDvvxlw%3D%0A)
 
 ---
 
@@ -90,11 +90,11 @@ Select the "By group" tab to see **Standard seats** and **Premium seats** groups
 
 Owners and Primary Owners can also set individual monthly spend limits for each member by finding **Spend limits by user** and clicking the "..." button next to the user, then "Edit limit."
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2149370853/db66f5cd03683b9cc119d0dcd6b8/image.png?expires=1789727400&amp;signature=9103694a9683150bde27a148f33921f3a22f1d973e66386656a6d2b88848adcf&amp;req=diEjH8p5nYlaWvMW1HO4zaPdGQ5QVyhCe9HwvwG7ubi9i1kE8nsXeO1HSjFu%0Ac324hr7FzLbmL63X9oU%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2149370853/db66f5cd03683b9cc119d0dcd6b8/image.png?expires=1789796700&amp;signature=acaa4a771413e13998eed6e8af97f2cd8f6146550834bfc40f43c510fd3453a9&amp;req=diEjH8p5nYlaWvMW1HO4zaPdGQ5QXClBe9HwvwG7ubiUHbSgmFqzHqR3uNgv%0AaG0nxWeEOVzpdOgwSek%3D%0A)
 
 Enter the amount and click "Set limit." Alternatively, selecting "Set to unlimited" will remove that member's monthly spend limit (they will still be subject to any organization or seat-level spend limits).
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2149374028/97813fe3b515c2e839d8d92abd79/image.png?expires=1789727400&amp;signature=3c61fbecfddc183cef100c6d470a3651012a0966e8e0d40ddbaf7040118166ac&amp;req=diEjH8p5mYFdUfMW1HO4zevsAv6NMeyOw6z2wGSwkbtljSOqAdgP8CoZp25D%0A2As1nuBprx3%2Br2W1gHE%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2149374028/97813fe3b515c2e839d8d92abd79/image.png?expires=1789796700&amp;signature=26d2277ad400a2960fb61684091cd1ee9e13a879071e17236fc2a8fb3c75894f&amp;req=diEjH8p5mYFdUfMW1HO4zevsAv6NOu2Nw6z2wGSwkbsu2GIV8qB7UvjHe%2Fdo%0ABncDB16ybNl3ESWEXos%3D%0A)
 
 This allows owners fine control over usage credits, so you can set limits for different members based on their roles or individual needs. Once a user reaches their defined spend limit, this will automatically pause their usage credits until the end of the month. They will need to wait for their usage limits to reset before using Claude again.
 
diff --git a/content/support/12012173-get-started-with-claude-in-chrome.md b/content/support/12012173-get-started-with-claude-in-chrome.md
index 6720aeaa5d..c24a33b163 100644
--- a/content/support/12012173-get-started-with-claude-in-chrome.md
+++ b/content/support/12012173-get-started-with-claude-in-chrome.md
@@ -38,7 +38,7 @@ Follow these steps to connect Claude in Chrome in your desktop app:
 
 4. Toggle the connector on, then download and install the extension if you haven’t already.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2604933811/ae37c41fc808dbdf48d135338334/6cc9ba4b-9d31-43a2-ab80-8048b5f9d791?expires=1789727400&amp;signature=3ee54da6e9a20976a6695bc90dce7fc8cc84f3c77a3a12ba8c3275f5ae950d33&amp;req=diYnEsB9noleWPMW1HO4zUOPbPXBlOWJnt%2F2nPMwUPgh6yV8pVSLnx9l1DyK%0AqrfnXpHslzQgbVTs16Q%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2604933811/ae37c41fc808dbdf48d135338334/6cc9ba4b-9d31-43a2-ab80-8048b5f9d791?expires=1789796700&amp;signature=4ae006875469ce47da3dfed424fa01d4cba84f2393276e4c0a6acf88dc0d7b25&amp;req=diYnEsB9noleWPMW1HO4zUOPbPXBn%2BSKnt%2F2nPMwUPgUU3oXo23x4JHgTUBe%0ATRB5H9a78kMzSDsP%2BZE%3D%0A)
 
 Completing these steps will add Claude in Chrome to the “Connectors” drop-down on your chats with Claude. This is disabled by default, so you’ll need to enable it manually for each conversation.
 
diff --git a/content/support/12083917-change-your-team-plan-from-monthly-to-annual-billing.md b/content/support/12083917-change-your-team-plan-from-monthly-to-annual-billing.md
index 19acf5900d..7f39264fe7 100644
--- a/content/support/12083917-change-your-team-plan-from-monthly-to-annual-billing.md
+++ b/content/support/12083917-change-your-team-plan-from-monthly-to-annual-billing.md
@@ -8,11 +8,11 @@ Owners and Primary Owners of Team plans with monthly subscriptions can switch fr
 
 3. Or from /upgrade, click the “Switch to Annual plan” button:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1690325734/d47f714680d78408d6022d06b8d1/image.png?expires=1789830000&amp;signature=d60f5221ee4f59e6458ad0dcccfe71a0fa70a122fc229a4d103bf599f00b297f&amp;req=dSYuFsp8mIZcXfMW3Hu4gZzas%2FXtsDdRnWrRiVwqPzbRgY89n31eP%2BpILL%2Bh%0AiA%3D%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1690325734/d47f714680d78408d6022d06b8d1/image.png?expires=1789884000&amp;signature=50c68d0df524e383b3c90eb835dd5254d0b539a1cc967daee61b9bfbd8448f31&amp;req=dSYuFsp8mIZcXfMW3Hu4gZzas%2FXtsDdamWrRiVwqPzak4KkKQVX%2FJPBEL2Ga%0AfQ%3D%3D%0A)
 
 4. The confirmation screen will display the total cost for your upgrade from monthly to annual billing:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1690326039/3a91cdc5fff57d188a18ecc6273f/image.png?expires=1789830000&amp;signature=94bbf3a30480b7d2c99fb059a944167e44f1f53665424bdfc792907e67913179&amp;req=dSYuFsp8m4FcUPMW3Hu4gbNj%2Bk78VQXii%2B5vzcg6znUixze7WkI1mAHKrGsA%0Aqw%3D%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1690326039/3a91cdc5fff57d188a18ecc6273f/image.png?expires=1789884000&amp;signature=a4f3a7d0373b89cd933ee6c1eeb1550b1019799648633b9ffba0a317fe9d82ca&amp;req=dSYuFsp8m4FcUPMW3Hu4gbNj%2Bk78VQXpj%2B5vzcg6znUADsMyHLqJvqKLPZ15%0AeA%3D%3D%0A)
 
 5. Click “Confirm subscription.”
 
diff --git a/content/support/12111783-create-and-edit-files-with-claude.md b/content/support/12111783-create-and-edit-files-with-claude.md
index 8990518e2f..4cb9864a96 100644
--- a/content/support/12111783-create-and-edit-files-with-claude.md
+++ b/content/support/12111783-create-and-edit-files-with-claude.md
@@ -48,7 +48,7 @@ These capabilities make it easy to produce professional documents by simply chat
 
 To give Claude access to external data sources, toggle **Allow network egress** on:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2054774005/25bcfffba6c249cd128d6c3f6d52/CleanShot+2026-02-11+at+16_34_47%402x.png?expires=1789727400&amp;signature=9ac6150115d1b4cdffc08f848b445ee3100642c31781b412aa9be75c9e5dc091&amp;req=diAiEs55mYFfXPMW1HO4zYFJywRCDp7KPQVowIiib2lvXcP3lhPZVwzQ%2BtKb%0ANv3AmQUexyxo0%2Fqrojw%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2054774005/25bcfffba6c249cd128d6c3f6d52/CleanShot+2026-02-11+at+16_34_47%402x.png?expires=1789796700&amp;signature=2296d724f53cd3fa5f4d22b39a0ca7460391d9987456bdc8323662fc65e3e1ca&amp;req=diAiEs55mYFfXPMW1HO4zYFJywRCBZ%2FJPQVowIiib2lNIAt2didZJYZTo3XN%0AegWA8K%2BgNPUHKfLAOoY%3D%0A)
 
 ### Enabling on Claude Mobile
 
@@ -66,11 +66,11 @@ Team and Enterprise organization owners can control network access settings in *
 
 - **Allow network egress to package managers and specific domains:** Claude can access package managers plus additional domains you specify. Add domains individually to whitelist specific resources your organization needs:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1789945362/ad72504d5429960f369b8b91b43c/86f06c0e-6eaa-4574-a4cb-2c38b273613a?expires=1789727400&amp;signature=2e18babef75d4f36cd7b6833c586a4b3aaba8f1e5bc24037deaebf2a88730058&amp;req=dScvH8B6mIJZW%2FMW1HO4zXJcBmREly5PpMW6Iph6YZdxRTqtrGJFl1%2FTZei9%0ASctG2CvU1FTr6E2V5hs%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1789945362/ad72504d5429960f369b8b91b43c/86f06c0e-6eaa-4574-a4cb-2c38b273613a?expires=1789796700&amp;signature=d971aa2092d461b2bf450c777417d00c82f7f71d861d281df82c185b9b692ab2&amp;req=dScvH8B6mIJZW%2FMW1HO4zXJcBmREnC9MpMW6Iph6YZfB1rTZ1EmY2JDfM6uX%0AWkZj5l4%2FQpeCEWAUxy8%3D%0A)
 
 **All domains:** Claude has full internet access except for domains on Anthropic's legal blocklist. While this provides maximum flexibility for file creation and analysis tasks, it’s also the riskiest option. Please review the **[security considerations below](#h_0ee9d698a1)** before enabling “All domains”:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1789945361/e3188cb8edb9ca7c303615da6378/f1c99a7d-5956-48d5-9ec7-b7ae6c8c3d28?expires=1789727400&amp;signature=c6067f2b7250b47629b7204258fe8165b17fd1e9cf0c4f4618336907c80a53e9&amp;req=dScvH8B6mIJZWPMW1HO4zdnseB2V7DimqgKIA6CM1tqFqLCWBc5VkWI7yxnb%0AXFdFz9N1d20W3ubbOYk%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1789945361/e3188cb8edb9ca7c303615da6378/f1c99a7d-5956-48d5-9ec7-b7ae6c8c3d28?expires=1789796700&amp;signature=633a6f193a71220ce4eb21c531cbfed29defbcb302a4e14fb70a23f554bda9e6&amp;req=dScvH8B6mIJZWPMW1HO4zdnseB2V5zmlqgKIA6CM1topqhHxkpKFTfyzYs2p%0A55AShNRAV4rLJWJAh9s%3D%0A)
 
 ---
 
diff --git a/content/support/12157520-claude-code-usage-analytics.md b/content/support/12157520-claude-code-usage-analytics.md
index 49a22629c6..f630792b8d 100644
--- a/content/support/12157520-claude-code-usage-analytics.md
+++ b/content/support/12157520-claude-code-usage-analytics.md
@@ -50,7 +50,7 @@ The **Usage** tab displays the following metrics for your organization. Data on
 
 - **Top commands**: The Claude Code commands used most often across your organization.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1717579277/46c512f4b3ed05c359cecd78ed5c/e0ce2c19-39e2-411f-9a1f-cb1d46439a42?expires=1789727400&amp;signature=9053eddcf7efb918e3d0827bbd6bdbca18d415be61e750c0a54b911eeca3da3a&amp;req=dScmEcx5lINYXvMW1HO4zfiEP69XjX7KCX9h5MbdDjOfMKoTkORfPpbS3j8m%0ASa4pZDq0Dk%2BLoJnV9oM%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1717579277/46c512f4b3ed05c359cecd78ed5c/e0ce2c19-39e2-411f-9a1f-cb1d46439a42?expires=1789796700&amp;signature=44ef84460b9640ea9dd21e22bd392f41d47c1cdd78ad47ce17477fa9a9bf362c&amp;req=dScmEcx5lINYXvMW1HO4zfiEP69Xhn%2FJCX9h5MbdDjNYBuVuw6%2FVThE%2BMkMY%0Afpc5xXxxWnurEnshRDA%3D%0A)
 
 ### User-level metrics
 
diff --git a/content/support/12260368-use-incognito-chats.md b/content/support/12260368-use-incognito-chats.md
index d78726fa4a..89ea6dcdfa 100644
--- a/content/support/12260368-use-incognito-chats.md
+++ b/content/support/12260368-use-incognito-chats.md
@@ -34,7 +34,7 @@ These differ from regular chats in several ways:
 
 When starting a new chat with Claude outside of a project, you'll see a ghost icon in the upper right corner of your screen:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1719768744/c7a2fa56cf284e48472f3b9c4dbf/030563f8-9f97-4891-a749-9ae95968a063?expires=1789727400&amp;signature=7edb70155f9fa5843223ea91f6b8c34b78c775a8f1e553ad0f538b1cb424ddc0&amp;req=dScmH854lYZbXfMW1HO4zeUcuwu6bOKPDCAt3Cx%2FSO3ISXh%2B%2B6ShAIIv0OAn%0AApi5ANo%2BFxO%2FtbiDBoA%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1719768744/c7a2fa56cf284e48472f3b9c4dbf/030563f8-9f97-4891-a749-9ae95968a063?expires=1789796700&amp;signature=16149e8d3f9004134198489266da4f609be29f254e606b29ccdfd537588eda83&amp;req=dScmH854lYZbXfMW1HO4zeUcuwu6Z%2BOMDCAt3Cx%2FSO27c4m1cVFHGQQruttB%0AgILwVdNRhZV3k%2BezrTk%3D%0A)
 
 1. Click the ghost icon to enable incognito mode.
 
diff --git a/content/support/12293051-use-claude-in-xcode.md b/content/support/12293051-use-claude-in-xcode.md
index 9185455856..7e71d25b9a 100644
--- a/content/support/12293051-use-claude-in-xcode.md
+++ b/content/support/12293051-use-claude-in-xcode.md
@@ -34,7 +34,7 @@ To start using Claude in Xcode:
 
 3. Log in with your Claude account.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1727371585/b18ca03a6357c52d12d10386f28e/dab2dcb2-f670-4173-b77d-38767a34cec1?expires=1789727400&amp;signature=eb27d3b015038448486aebc0a795b0574baacfbab6da7b493f5bccb68d7280ba&amp;req=dSclEcp5nIRXXPMW1HO4zUAXI8UFUK%2FQFalhp3bugHJELJnHsLeYeLESQ%2Bns%0AT6di%2Fal1WB7pSobWAiE%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1727371585/b18ca03a6357c52d12d10386f28e/dab2dcb2-f670-4173-b77d-38767a34cec1?expires=1789796700&amp;signature=35c4e5e80c62e5a7a9c011d28d8d8f1a72cd79daf2780c195332c73051de70d8&amp;req=dSclEcp5nIRXXPMW1HO4zUAXI8UFW67TFalhp3bugHLhuRzqgFuebss1A4HK%0ALgvndpqpm0tQRyVVdJo%3D%0A)
 
 ## Usage limits
 
diff --git a/content/support/12429409-manage-usage-credits-for-paid-claude-plans.md b/content/support/12429409-manage-usage-credits-for-paid-claude-plans.md
index f5a9b0fa97..ea7bb09319 100644
--- a/content/support/12429409-manage-usage-credits-for-paid-claude-plans.md
+++ b/content/support/12429409-manage-usage-credits-for-paid-claude-plans.md
@@ -46,7 +46,7 @@ To enable usage credits on your paid Claude plan:
 
 8. You can also enable auto-reload to automatically make a purchase when your balance falls below a threshold you set:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1805819785/5e203c38e6ba3f76bfd1dab0d5ce/fe062e7c-18cb-48cc-a7e2-754ac6e6c4be?expires=1789727400&amp;signature=a73c4c9b099b974c81c04ec19fd6f339945faf43101bd26162d487aa31d2b584&amp;req=dSgnE8F%2FlIZXXPMW1HO4zYj2ARuep%2Fc8opE7m38Ydffcs8%2BAQOztfQB19dlS%0Av%2F6%2BROvBTQmd3MzyVYE%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1805819785/5e203c38e6ba3f76bfd1dab0d5ce/fe062e7c-18cb-48cc-a7e2-754ac6e6c4be?expires=1789796700&amp;signature=da337004929fc39817f09981eee51aa7063ee1a593cfc7c27807208b44d8058f&amp;req=dSgnE8F%2FlIZXXPMW1HO4zYj2ARuerPY%2FopE7m38YdfeJBjqRZDp9TwKImUNF%0AcyHuf6XUeHhMlYKDGFs%3D%0A)
 
 **Note:** There is a daily redemption limit of $2000.
 
diff --git a/content/support/12466728-troubleshoot-claude-error-messages.md b/content/support/12466728-troubleshoot-claude-error-messages.md
index 4afec0ba94..1a209a6525 100644
--- a/content/support/12466728-troubleshoot-claude-error-messages.md
+++ b/content/support/12466728-troubleshoot-claude-error-messages.md
@@ -58,4 +58,4 @@ Capacity issues will not appear on our status page because they represent normal
 
 Service incidents are disruptions where Claude is unavailable or significantly degraded for all or most users. These represent actual technical problems with our systems. To check for confirmed incidents, visit status.claude.com, where you'll find real-time updates on scope, impact, and resolution progress for any active incidents.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1753796247/e6a8c6ef8653b229c5758e881242/c2fc6fc0-d163-4119-93e0-394104d86bc9?expires=1789727400&amp;signature=59d284cf8c821b060db9f91d24dbeceadc26bcbde0c3743cad809f7bc1240de0&amp;req=dSciFc53m4NbXvMW1HO4za4BXqYk0LXA7y68oYp%2BYg%2BsGsI3%2FlJK9KRNyvRz%0AxQGzeiKwgAVaZd8zzxw%3D%0A)
\ No newline at end of file
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1753796247/e6a8c6ef8653b229c5758e881242/c2fc6fc0-d163-4119-93e0-394104d86bc9?expires=1789796700&amp;signature=a77dda2015174386ab708c314f8ff8bd32e4c15798b87c3af7acc13cbefe0aae&amp;req=dSciFc53m4NbXvMW1HO4za4BXqYk27TD7y68oYp%2BYg8QE31dNxtM5d4LM36s%0ASfz3S%2F8N7qQ%2FCNvbEzE%3D%0A)
\ No newline at end of file
diff --git a/content/support/12512180-use-skills-in-claude.md b/content/support/12512180-use-skills-in-claude.md
index e53e0b22a7..6b49d8778c 100644
--- a/content/support/12512180-use-skills-in-claude.md
+++ b/content/support/12512180-use-skills-in-claude.md
@@ -166,7 +166,7 @@ To remove a custom skill you've uploaded:
 
 4. To delete the custom skill entirely, click the "..." button next to the toggle, then select "Delete":
 
-  ![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2105391273/8359cbf8be20dce0f1cd3fd40e6f/CleanShot-2B2026-02-25-2Bat-2B15_50_16.png?expires=1789727400&amp;signature=88a4d1dfd12095126f85d6b7c602e592a899a1a5bdb5fb19deed1e6aff4cb93a&amp;req=diEnE8p3nINYWvMW1HO4zSOgDyIvwOGpH%2BdCnFXB0uhc%2BTaEGoDxzhBvn7OL%0A%2Bcsh%0A)
+  ![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2105391273/8359cbf8be20dce0f1cd3fd40e6f/CleanShot-2B2026-02-25-2Bat-2B15_50_16.png?expires=1789796700&amp;signature=bc47e86a4b9493d2e300acd1dedea1f086d3f888bce7b7f83894a65b20a50312&amp;req=diEnE8p3nINYWvMW1HO4zSOgDyIvy%2BCqH%2BdCnFXB0uhXzUeQ5gvgJ4Zmmbuv%0A7ciL%0A)
 
 5. Click "Delete" in the confirmation prompt.
 
diff --git a/content/support/12542951-set-up-the-microsoft-365-connector.md b/content/support/12542951-set-up-the-microsoft-365-connector.md
index 937c276632..717226b7fa 100644
--- a/content/support/12542951-set-up-the-microsoft-365-connector.md
+++ b/content/support/12542951-set-up-the-microsoft-365-connector.md
@@ -260,6 +260,8 @@ The following permissions support write tools and are included in the updated co
 
 - `Chat.Create`: Start a new chat on the user’s behalf
 
+- `People.Read`: Find people in the organization to start a chat with
+
 **User directory**
 
 - `User.ReadBasic.All`: Read basic profile information for all users in the organization (used for finding meeting availability)
diff --git a/content/support/12592343-enabling-and-using-the-desktop-extension-allowlist.md b/content/support/12592343-enabling-and-using-the-desktop-extension-allowlist.md
index 4f80d2ae38..4b393cfb93 100644
--- a/content/support/12592343-enabling-and-using-the-desktop-extension-allowlist.md
+++ b/content/support/12592343-enabling-and-using-the-desktop-extension-allowlist.md
@@ -20,11 +20,11 @@ The desktop extension allowlist is disabled by default, so an organization Owner
 
 4. Switch to the "Desktop" tab:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1781755172/63c92550571842577ad435860ec5/6f5cc4e1-ff7d-48de-863a-c4e6184d4605?expires=1789727400&amp;signature=2395048449aa91877aa4b5d9544b50bc03991d588c91f28c149e578cb39bb117&amp;req=dScvF857mIBYW%2FMW1HO4zQ9pXUMN%2FXff0ugSQm1MFW8UZBotq7Tn5AO3QmxQ%0AoESh%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1781755172/63c92550571842577ad435860ec5/6f5cc4e1-ff7d-48de-863a-c4e6184d4605?expires=1789796700&amp;signature=198991c2ec8d70fa949f0a71e9b6ec7577d9ad776fcc340a8cbb80f434276591&amp;req=dScvF857mIBYW%2FMW1HO4zQ9pXUMN9nbc0ugSQm1MFW89fP6OoCP55hctp9VZ%0AZGA7%0A)
 
 5. Toggle **Allowlist** on:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1781755578/a6bafff5f084dc86ae463703fd3d/6cf0ee18-4e71-4129-98e8-cc08174e3c3a?expires=1789727400&amp;signature=9dd349c03c754ebd34c7d09f2ea10c06075643498904eef78df263aeb77d29ef&amp;req=dScvF857mIRYUfMW1HO4zaj0BHgsS6AATAorLxpdoc%2Bp6TaVSUlxNUyYGmTr%0AwX7E%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1781755578/a6bafff5f084dc86ae463703fd3d/6cf0ee18-4e71-4129-98e8-cc08174e3c3a?expires=1789796700&amp;signature=5dbba751f425925f8785796dcdaf3de119ae2bcee4d6df2f573485eac52335a4&amp;req=dScvF857mIRYUfMW1HO4zaj0BHgsQKEDTAorLxpdoc9kAFgJDn9bLQHpfQkM%0AymR3%0A)
 
 ## What happens after enabling the allowlist?
 
@@ -42,7 +42,7 @@ Consider completing the allowlist setup during off-hours to minimize disruption
 
 **Important:** The allowlist requires Claude Desktop version 0.13.91 or higher, so users should update the desktop app by clicking “Claude”, then either “Check for updates” or “Restart to update to Claude 0.13.91”:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1781756960/ad18af50c83d35f2673656c23e00/a7ee450f-0c7d-42d6-a75f-fb1bc088cb52?expires=1789727400&amp;signature=101a03eeabf036040edf06559d6ce43f6d42f80a3d124182380839cd2f73e8d1&amp;req=dScvF857m4hZWfMW1HO4zYUJqYqtCDXvCEDZ5AdBjIabUUQ%2B9Hzp7%2Bn2bU9O%0AYJA9TpoFMLPmeI8fEX8%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1781756960/ad18af50c83d35f2673656c23e00/a7ee450f-0c7d-42d6-a75f-fb1bc088cb52?expires=1789796700&amp;signature=f36192a89958a8d7a0afce60f9d9959978523772e5056fd07ffe655fba326771&amp;req=dScvF857m4hZWfMW1HO4zYUJqYqtAzTsCEDZ5AdBjIbmSyivFmEMKJHVnJan%0A5AyznKnzNMGg5Hde%2FME%3D%0A)
 
 ## Managing allowed extensions
 
@@ -60,7 +60,7 @@ After enabling the allowlist, you can choose which extensions to allow:
 
 If you want to remove an extension from the allowlist, click the “...” button and “Remove from allowlist.”
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1781751250/6558c0f59aea7976bd44b0213d76/e750f02b-cd0d-437e-a83f-9ac362cdf456?expires=1789727400&amp;signature=10aadaab07b0c3771a77090a93471731226c4abe26561790f76e995da2bef001&amp;req=dScvF857nINaWfMW1HO4zTrxBaEu%2FVCRqXridZhfx1J%2FuDZSJYbgcKXQxQS%2F%0Awt9I7%2FYWRRiKnwre%2BAE%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1781751250/6558c0f59aea7976bd44b0213d76/e750f02b-cd0d-437e-a83f-9ac362cdf456?expires=1789796700&amp;signature=b7fb471b03545a381324f56c6febb333d40c3d8e9ed113a44237c49a0a57c7a1&amp;req=dScvF857nINaWfMW1HO4zTrxBaEu9lGSqXridZhfx1KVw44Bim09g%2B43mu0U%0A7ISiISBquPi8z2iYqOc%3D%0A)
 
 ## Uploading custom extensions
 
diff --git a/content/support/12618689-claude-code-on-the-web.md b/content/support/12618689-claude-code-on-the-web.md
index 9fea5960e9..70d0ef57cf 100644
--- a/content/support/12618689-claude-code-on-the-web.md
+++ b/content/support/12618689-claude-code-on-the-web.md
@@ -10,7 +10,7 @@ This feature works with repositories you may not have on your local machine. You
 
 Claude Code for web enables asynchronous development workflows. With Claude Code in your terminal or editor, you typically work synchronously: you make a request, wait for Claude to respond, review the changes, then make another request. Synchronous work like this gives you fine-grained control but requires your attention throughout the process. Claude Code on the web handles this differently: you can assign a larger task, let Claude work independently, and return later to review the completed work.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1786446157/07ec74cd46317f8278083a317841/6448f3ee-c6df-4417-8a13-90d8c2ca3d55?expires=1789727400&amp;signature=3c7a217533cf52051b90400600daa07eb7776d5341453974a3cc385a5c6ca99e&amp;req=dScvEM16m4BaXvMW1HO4zR8%2BAFqHQJpy7XrRA1YwWGv%2B7B69KBSmspvOtjE6%0AOaKio7tHdu4Fmpdh8Us%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1786446157/07ec74cd46317f8278083a317841/6448f3ee-c6df-4417-8a13-90d8c2ca3d55?expires=1789796700&amp;signature=6cc7a46eff7d9ab8877b6967f9616d48399cda291c05756fad0d467635dc65b9&amp;req=dScvEM16m4BaXvMW1HO4zR8%2BAFqHS5tx7XrRA1YwWGtn2jwSbOUxoM2kYA7K%0Acew61IPSClh7oWjapj4%3D%0A)
 
 You can also run multiple tasks in parallel. Since each task runs in its own isolated environment, you can have Claude working on several different issues or repositories simultaneously. Each task proceeds independently and creates its own pull request when complete. More than one task can work on the same repository at the same time.
 
@@ -18,13 +18,13 @@ You can also run multiple tasks in parallel. Since each task runs in its own iso
 
 When you start a task, Claude Code on the web creates an isolated virtual machine for your work. Your GitHub repository is cloned into this environment, which comes pre-configured with common development tools and language ecosystems.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1786446158/c092f1383826cb871493f74169d4/97b7cb98-5da2-438e-a920-e170b8b9790e?expires=1789727400&amp;signature=dbe07b552716085320c05545b7a2c97d1772e8cd63be0c905e624fe81bac0fb3&amp;req=dScvEM16m4BaUfMW1HO4zcR0rZ8zje7E7DtpMiX%2FBYms3VkdoPz4KNNjPVow%0Ao0YTlACpUYcl2hugVyo%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1786446158/c092f1383826cb871493f74169d4/97b7cb98-5da2-438e-a920-e170b8b9790e?expires=1789796700&amp;signature=ec409e33143f52f864b64f106da213c6aa185c8d178d6e964fc56042b5f7a8ed&amp;req=dScvEM16m4BaUfMW1HO4zcR0rZ8zhu%2FH7DtpMiX%2FBYkHiEauLZ7eQsbYCEyo%0AZUCCvWzmSCDtWYmRUtg%3D%0A)
 
 Claude prepares the environment by running any setup commands you've defined in your repository's configuration. This includes installing dependencies, setting up databases, or running other initialization steps your project needs. If your task requires network access, maybe to install packages or fetch data, you can configure the level of internet access the environment has.
 
 Once the environment is ready, Claude begins working on your task. Claude reads your code, makes changes, writes tests, and runs commands to verify the work. You can monitor progress and provide guidance through the web interface if needed.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1786446156/83ecf0a5b98eddc9ffc9694c50f7/353589ce-b678-441d-8909-71b45fa2d065?expires=1789727400&amp;signature=909ea132bbc283bf3cd82017c64688fbe86ced3549921519114dfa2364408aad&amp;req=dScvEM16m4BaX%2FMW1HO4zVbcTGqE4cPKUQl3YqgIJdarh%2BmiqO%2BmUb1yG%2Bbt%0ArEpY1NenP2xlHuzPgQo%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1786446156/83ecf0a5b98eddc9ffc9694c50f7/353589ce-b678-441d-8909-71b45fa2d065?expires=1789796700&amp;signature=51f921a7b6ddb277af816d6c0614dfb366a9910ddfba73380c54b0cecc746d9e&amp;req=dScvEM16m4BaX%2FMW1HO4zVbcTGqE6sLJUQl3YqgIJdakFVW9QUOiAD5CHO%2Fc%0AMGnXFHJRBIEt9LP2OpA%3D%0A)
 
 When Claude completes the task, it pushes the changes to a new branch in your GitHub repository. You receive a notification and can review the changes, then create a pull request directly from the interface. The pull request includes all of Claude's work, ready for your review and any additional changes you want to make.
 
diff --git a/content/support/12626668-use-quick-entry-with-claude-desktop-on-mac.md b/content/support/12626668-use-quick-entry-with-claude-desktop-on-mac.md
index baab80b2c5..4130520719 100644
--- a/content/support/12626668-use-quick-entry-with-claude-desktop-on-mac.md
+++ b/content/support/12626668-use-quick-entry-with-claude-desktop-on-mac.md
@@ -40,7 +40,7 @@ When you first open the updated version of Claude Desktop, you'll see a prompt t
 
 Once enabled, double-tapping Option will open a text box where you can type your message and start a new chat. You can also click "New chat" to see your five most recent conversations.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1893088365/2ca4b782dda90abea1fe5f4150af/CleanShot+2025-12-18+at+13_14_30%402x.png?expires=1789727400&amp;signature=31fdc91db83ba2fa7bcdf9f2a3ef55bb2902e1e7919ab1d05330a63b8326a513&amp;req=dSguFcl2lYJZXPMW1HO4zWggD9dWpJueRC8c%2FcM5c2Lrw8RRjOO0WeyPnEZ1%0Aw8QomtQQlGnirV%2FoPDQ%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1893088365/2ca4b782dda90abea1fe5f4150af/CleanShot+2025-12-18+at+13_14_30%402x.png?expires=1789796700&amp;signature=41b5870cb439151614bfee2808f5e21f181b1ad90280c5034db4c086761d8ff8&amp;req=dSguFcl2lYJZXPMW1HO4zWggD9dWr5qdRC8c%2FcM5c2Kul8kYaUdeIw1Rii3p%0AU%2BTZAxVv%2FL5bI78pH68%3D%0A)
 
 ### Enable the voice shortcut (optional)
 
diff --git a/content/support/12684923-microsoft-365-connector-security-guide.md b/content/support/12684923-microsoft-365-connector-security-guide.md
index 3a212c7ee0..69fc35b25f 100644
--- a/content/support/12684923-microsoft-365-connector-security-guide.md
+++ b/content/support/12684923-microsoft-365-connector-security-guide.md
@@ -285,6 +285,8 @@ Requested as part of the updated consent set; used only when write tools are ena
 
 - **[Chat.Create](https://learn.microsoft.com/en-us/graph/permissions-reference#chatcreate)** - Start a new Teams chat on the user's behalf
 
+- **[People.Read](https://learn.microsoft.com/en-us/graph/permissions-reference#peopleread)**: Find people in the organization to start a chat with
+
 ## Current limitations
 
 - **Teams write access is limited to messaging**: Claude can send a chat message, post or reply in a channel, or start a new chat, but can't modify Teams settings, memberships, or permissions. All write tools require an admin to enable them, and Teams write tools are enabled individually.
diff --git a/content/support/12883420-view-usage-analytics-for-team-and-enterprise-plans.md b/content/support/12883420-view-usage-analytics-for-team-and-enterprise-plans.md
index 52ceed169a..2caf37dadc 100644
--- a/content/support/12883420-view-usage-analytics-for-team-and-enterprise-plans.md
+++ b/content/support/12883420-view-usage-analytics-for-team-and-enterprise-plans.md
@@ -22,7 +22,7 @@ This page includes the following analytics:
 
 - Sessions in Cowork
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515895966/9f231a620f47d49e0ee648152189/848c1787-4eaa-4809-8fd2-1dbe2722560f?expires=1789727400&amp;signature=63b1071edeb5935c4e681a4f926f83f368dc3e25b3844347a1c7ecc0cc6ff166&amp;req=diUmE8F3mIhZX%2FMW1HO4zZL6wa91mYJ1ExEG4dCAGDYPTz2NFa%2F3Xl5yJnjZ%0AraklEIaowzp0d315gVc%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515895966/9f231a620f47d49e0ee648152189/848c1787-4eaa-4809-8fd2-1dbe2722560f?expires=1789796700&amp;signature=d65abc0d3d3af6b4f1fe0afe98ccf6f6e5764f4ac2d6b26f6c0a105d6b2d5988&amp;req=diUmE8F3mIhZX%2FMW1HO4zZL6wa91koN2ExEG4dCAGDZ3s6UWlu%2Fl4C%2Bd4WPk%0AFK4PigdtiVT5EzbnYpk%3D%0A)
 
 ### Who’s using Claude?
 
@@ -34,7 +34,7 @@ This page includes the following analytics:
 
 Use the dropdown on the **Active members and assigned seats** chart to filter by product, including Claude Design.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515896351/4d955858e6662c37489cc1470871/457cf159-8c2a-4403-ba22-cb92cb47e459?expires=1789727400&amp;signature=fa264113fe378d05d0f23cc8eb8bf458c3acc8d4a2cd6d96fa690ae63a3ac562&amp;req=diUmE8F3m4JaWPMW1HO4zYEqej6uQJerYqPRsgaNdTyUtH%2FFNDwzDMRtmyIy%0AsGjy2UszxPRnlyPdlI4%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515896351/4d955858e6662c37489cc1470871/457cf159-8c2a-4403-ba22-cb92cb47e459?expires=1789796700&amp;signature=096e774f259a7aa4a705be0c0dc9562f67b9bf506d028dbb7241b93366936106&amp;req=diUmE8F3m4JaWPMW1HO4zYEqej6uS5aoYqPRsgaNdTzobPmR%2FGogV672aiHO%0A46lqO9wA2fDUd%2FoJNuA%3D%0A)
 
 ### How are they using Claude?
 
@@ -48,9 +48,9 @@ Use the dropdown on the **Active members and assigned seats** chart to filter by
 
 - How agentic is their work? (beta)
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2583875713/e3cb3c329f3b643cb9a3809876b3/image.png?expires=1789727400&amp;signature=4ac0e74d2c34b6fbd07796c64723cb92187502a08dda1b883dab25d983ce2499&amp;req=diUvFcF5mIZeWvMW1HO4zciS3aHumLlvDFD6TO7tG4i13%2Fide0QKWPxTTqr1%0AS1AuoHFyQiZMbfCyuiw%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2583875713/e3cb3c329f3b643cb9a3809876b3/image.png?expires=1789796700&amp;signature=f5487f81ba4d53da191c6db53abac09fdadd6ec6fd5b829a46a2dd9eca55280a&amp;req=diUvFcF5mIZeWvMW1HO4zciS3aHuk7hsDFD6TO7tG4jdZ8gvBEujOh%2FX%2FvE9%0A2iBhwkdGHxondw9eK84%3D%0A)
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515896563/abf008596ce5501297a609696362/fce5423c-4769-4b73-9a0a-c50f6407ebea?expires=1789727400&amp;signature=915ed491e2054d05ee13b3ae4fea756276244f91f49d057afdab1c79deaaac37&amp;req=diUmE8F3m4RZWvMW1HO4zR%2BIDo5pv%2FDzLS3kobW3ZgSpGev8PyxmLNXTb%2F%2Br%0Af2EzQ%2ByAX22c3AoUOB0%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515896563/abf008596ce5501297a609696362/fce5423c-4769-4b73-9a0a-c50f6407ebea?expires=1789796700&amp;signature=c14b1a8649e441262647f74cc8d7f366f2a7acb8547ac524d95379e8e41c6416&amp;req=diUmE8F3m4RZWvMW1HO4zR%2BIDo5ptPHwLS3kobW3ZgQNLT%2F5hBS5UW8WyIIx%0AV%2FCjxOvRPfWUfoh0%2Fds%3D%0A)
 
 ### What are the results?
 
@@ -66,7 +66,7 @@ Use the dropdown on the **Active members and assigned seats** chart to filter by
 
 - Estimated time saved
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515896943/dd415f03afe56ca38308ef987f86/189e8ebc-5594-4f4b-bd84-e3c11c824d5b?expires=1789727400&amp;signature=ec59d143fde601fd0e4b477f17f6f076575265deaad92958748f4b0e5603b7aa&amp;req=diUmE8F3m4hbWvMW1HO4zfJThC04q9tCiovaLYNN7RkTIo%2FMG5pt%2F1LQzjpO%0AYotF5gyaV7oCXCcPqf0%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515896943/dd415f03afe56ca38308ef987f86/189e8ebc-5594-4f4b-bd84-e3c11c824d5b?expires=1789796700&amp;signature=3b6641327004b458db384a61cdd5840db43116daa125f4e5b70f2ea86ec4ace6&amp;req=diUmE8F3m4hbWvMW1HO4zfJThC04oNpBiovaLYNN7RmMNXR51DiiDr%2FygfaQ%0AIccW5ya5LNxiKdRa47o%3D%0A)
 
 ### How much is Claude costing?
 
@@ -82,9 +82,9 @@ This section includes the following analytics:
 
 - Spend by model (month-to-date, quarter-to-date, year-to-date, 1 year)
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515896942/b403f2d216fc40b5195911020b8e/446b99f1-3187-4b79-b2be-9f17b1632ff8?expires=1789727400&amp;signature=395de4c3ba4c694d3a92ba980d3996dd8dc1e0a1142a9ac6546bc3958e530717&amp;req=diUmE8F3m4hbW%2FMW1HO4zYE%2BQ9cF7jbZWbBLGZ4vBJVj0cLxUlCDbmPFwXlZ%0AWOpU8g4vhCUNjvc%2FeVk%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515896942/b403f2d216fc40b5195911020b8e/446b99f1-3187-4b79-b2be-9f17b1632ff8?expires=1789796700&amp;signature=6ffe9bb38a515cec29dc1a82608134a73983ca56f051992b53871cb246ff5b43&amp;req=diUmE8F3m4hbW%2FMW1HO4zYE%2BQ9cF5TfaWbBLGZ4vBJWeJiMxLxgiTKO%2BIClb%0AhQKHXkNKmi283HHZfoo%3D%0A)
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515896941/2239ce38639df339b24d5af1cb50/f829bc2a-ee52-4135-9b13-09ef1b7d66d6?expires=1789727400&amp;signature=603e952c8cc7f91991c49f149f2f7e08016c1ea5b0f191a7480d1123c4d020e9&amp;req=diUmE8F3m4hbWPMW1HO4zTz0NuMFJc5UC%2BtvTPa1I7Ejcb3wCpaXwBXNQeGS%0AOGHQPrRwYtArBlGErgo%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515896941/2239ce38639df339b24d5af1cb50/f829bc2a-ee52-4135-9b13-09ef1b7d66d6?expires=1789796700&amp;signature=f76e3c015eb6ab15afbb9080a7b309ca4963f09cc3846c3405022da5e2b7f017&amp;req=diUmE8F3m4hbWPMW1HO4zTz0NuMFLs9XC%2BtvTPa1I7EyXWumRJaxd884h49c%0A3Z4Qsn9FOA%2Feer9BhH0%3D%0A)
 
 ## Export a spend report
 
@@ -160,7 +160,7 @@ Navigate to **[Analytics > Claude Chat](https://claude.ai/analytics/usage)** to
 
 - Top members by chats
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515898793/405db0c492da11886c28a2b82731/71a55afc-1cef-4c50-b7e1-86775cb9a168?expires=1789727400&amp;signature=5ebaf4700037bea1ecc9280eaed37444790c94b47deedc037af87a2ffe56a0b2&amp;req=diUmE8F3lYZWWvMW1HO4zbhc8fSbY%2BMlTcfMEUwBBiUAgqmlkxfcMB%2F1CWIv%0A9LKMPILsxNiL7LT0fys%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515898793/405db0c492da11886c28a2b82731/71a55afc-1cef-4c50-b7e1-86775cb9a168?expires=1789796700&amp;signature=9bdf1bc99c56a111db0990b8b6c9c64511b62e4c6be55ef939bfe148c6ebdb3a&amp;req=diUmE8F3lYZWWvMW1HO4zbhc8fSbaOImTcfMEUwBBiWw0dw2Kt1bp1iMpSSL%0AxAwxfMazJuB6YuNzuew%3D%0A)
 
 ### Projects
 
@@ -172,7 +172,7 @@ Navigate to **[Analytics > Claude Chat](https://claude.ai/analytics/usage)** to
 
 - Top members by project usage
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515899610/91d93108f0767e795fb9e488e882/71607d6d-dff1-4a13-a445-aa1d79850eed?expires=1789727400&amp;signature=58447fa5e6b412f394a81d4e36151239e12cef47ae2e1b21b631ec805a7a7034&amp;req=diUmE8F3lIdeWfMW1HO4zWhGoTWemSSmExu5cYiHHN9IS%2Fn9VWEzhNiNhkaS%0Aulyk5lg9%2FQPqOBEoIXA%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515899610/91d93108f0767e795fb9e488e882/71607d6d-dff1-4a13-a445-aa1d79850eed?expires=1789796700&amp;signature=2351eb65666ab837c16b6b7dc05737fbb0cde22bea5cfaa5253c9e88c335c0b2&amp;req=diUmE8F3lIdeWfMW1HO4zWhGoTWekiWlExu5cYiHHN%2B4Q08ltVKz4fLKzF6M%0AegwSObMGjsO4maXdBog%3D%0A)
 
 ### Artifacts
 
@@ -182,7 +182,7 @@ Navigate to **[Analytics > Claude Chat](https://claude.ai/analytics/usage)** to
 
 - Top 10 users by artifacts generated (month-to-date, quarter-to-date, year-to-date, 1 year)
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515899838/33d737f2357d6e485704669962ae/43faadc3-47da-4a93-bbb7-47a7983e7441?expires=1789727400&amp;signature=54455ec02f01162a44069063edf0aa020cb2266a670946dd878419c003cccbea&amp;req=diUmE8F3lIlcUfMW1HO4zcSk4rPVfOnEjHDogqK0V%2Bw44fBqpEQTR1vROe72%0AJMwnGEN9fig99unsnXg%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515899838/33d737f2357d6e485704669962ae/43faadc3-47da-4a93-bbb7-47a7983e7441?expires=1789796700&amp;signature=2ad0c2e260c18e0b60425cf8a8dc4b5660b6af53af8d0a47629b8e1d2ac7ed73&amp;req=diUmE8F3lIlcUfMW1HO4zcSk4rPVd%2BjHjHDogqK0V%2BzUN5RloikZCRmVpgO%2B%0AiESjtOYLcfyJShcJaKw%3D%0A)
 
 ---
 
@@ -278,7 +278,7 @@ Navigate to **[Analytics > Cowork](https://claude.ai/analytics/cowork)** to view
 
 - Daily, weekly, and monthly active Cowork users
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515901489/8005693d55b7fefbfe9233258d39/106c22a0-3f47-47a6-abbd-4788dd70f218?expires=1789727400&amp;signature=b333fa4d2558aff6593e03e44b32fbb40da79026d392ef225faca4c3696ce045&amp;req=diUmE8B%2BnIVXUPMW1HO4zX7WEoG2X0asFSi1Z3SzLLucUbdgzafupT74bW3K%0AmTEt1qKdOnPME5qdN10%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515901489/8005693d55b7fefbfe9233258d39/106c22a0-3f47-47a6-abbd-4788dd70f218?expires=1789796700&amp;signature=fdc6332280ad09f801bc02a0403368c8dc17e9abd3f80a32fa2c8920240f62e6&amp;req=diUmE8B%2BnIVXUPMW1HO4zX7WEoG2VEevFSi1Z3SzLLuOwHRZeb0YMubyoOKA%0Aii8yRJxy2fNI7VPYrNM%3D%0A)
 
 **Note:** Cowork analytics are available alongside Chat and Claude Code data in the **[Analytics API](https://platform.claude.com/docs/en/manage-claude/analytics-api)**.
 
@@ -294,7 +294,7 @@ Navigate to **[Analytics > Surveys](https://claude.ai/analytics/surveys)** to as
 
 On Enterprise plans with usage-based billing, when your admin turns on individual usage analytics, any member of the organization can see their own usage broken down by product, model, and skill, along with where they stand against any spend limits set for them. Individual usage analytics are available in **[Settings > Usage](https://claude.ai/settings/usage)**.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2533906328/1f5cd0a57def40676410f8f379b4/member-usage-30d-model.png?expires=1789727400&amp;signature=07b01735f46b7587adcead5e2c253a7399db94a8bc9d958285bc08d79c70eb26&amp;req=diUkFcB%2Bm4JdUfMW1HO4zfveB6bCfuzeWGUKUw6QS49pPW7TRORvJ6VGbdsU%0A6Evp0GgPPnpLStapqzs%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2533906328/1f5cd0a57def40676410f8f379b4/member-usage-30d-model.png?expires=1789796700&amp;signature=73a2e03dcba541831efe0ca9e43486789101399334a167c56e6cb756028e2bd4&amp;req=diUkFcB%2Bm4JdUfMW1HO4zfveB6bCde3dWGUKUw6QS49jktqzuBjdorTfkG0Z%0AXkCxrAUTfecx98UqcoA%3D%0A)
 
 ---
 
diff --git a/content/support/12902446-claude-in-chrome-permissions-guide.md b/content/support/12902446-claude-in-chrome-permissions-guide.md
index 761127dd53..89ae8c3af3 100644
--- a/content/support/12902446-claude-in-chrome-permissions-guide.md
+++ b/content/support/12902446-claude-in-chrome-permissions-guide.md
@@ -28,7 +28,7 @@ In "Manually approve," Claude checks with you before it acts. What that looks li
 
 Claude creates a plan from your prompt, which you can approve before Claude starts. The plan specifies which websites you're allowing Claude to access, as well as the approach it will follow:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1843320727/8d1c859ae9b8e0cdb536d024bf40/9bc3d239-8eb6-4bae-a032-a236f88ee606?expires=1789727400&amp;signature=19750ac30558ee6c6a47947fdbdeb79c7ca2c4e5558bceb9a762176014eed2d5&amp;req=dSgjFcp8nYZdXvMW1HO4zYqyZctK%2FoWzgN0ADj5oqFAPOUQUTCQPyny7zDAQ%0AjHiBRUKkoeliD0%2F2N0s%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1843320727/8d1c859ae9b8e0cdb536d024bf40/9bc3d239-8eb6-4bae-a032-a236f88ee606?expires=1789796700&amp;signature=2e5f8bcc3933d9bc175a25c406cb684f8438ffd0de9be2f8d911f114bd391d62&amp;req=dSgjFcp8nYZdXvMW1HO4zYqyZctK9YSwgN0ADj5oqFApkDwwKm%2B5OKUtbzzv%0AqS0ZvkIuZlzAXDeItPs%3D%0A)
 
 Note that Claude will only use the websites listed in the plan, so you’ll need to manually approve any additional access requests.
 
@@ -62,7 +62,7 @@ When you choose "Skip all approvals," Claude doesn't pause to ask, and nothing c
 
 There are some websites on which Claude requires approval for every action. If you navigate to one of these sites, a **New permissions required** prompt will appear in the extension side panel, Claude Cowork, or Claude Code where Claude will ask for permission before accessing the page or taking any action.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2604970825/d7b961271be69e7541b406df1efd/d845324e-6b4a-4f54-83b9-0bea86ec09c6?expires=1789727400&amp;signature=185453308ce497e463bd21a337f5e5491a89fd665634a1460bf46c6b2164616b&amp;req=diYnEsB5nYldXPMW1HO4zZ3Nqm93iivo7A4lHPBihAUypLe506f4X3HbXCsU%0Amjh7XUw8JXoCDzFy1NI%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2604970825/d7b961271be69e7541b406df1efd/d845324e-6b4a-4f54-83b9-0bea86ec09c6?expires=1789796700&amp;signature=2c37d1b4fc360aaa13acaaaee8cc90e4e9744bbb5a5d9bcc3eef2924399a1f68&amp;req=diYnEsB5nYldXPMW1HO4zZ3Nqm93gSrr7A4lHPBihAW%2FycgT4JwyLmPCj9c4%0ATarFdXjsWE4FETdDh2s%3D%0A)
 
 ### Permission options
 
diff --git a/content/support/12997503-team-plan-billing-faqs.md b/content/support/12997503-team-plan-billing-faqs.md
index 1134563e0f..c9a5c126b2 100644
--- a/content/support/12997503-team-plan-billing-faqs.md
+++ b/content/support/12997503-team-plan-billing-faqs.md
@@ -18,7 +18,7 @@ Your organization's billing address determines where your invoices are sent. You
 
 If you want to use a name other than the one tied to your payment method, an organization Owner should check the "Use a different name on invoices" box when adding or updating your payment method in **[Organization settings > Billing](https://claude.ai/admin-settings/billing)**:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1922145253/f2e3d4e0fe43a2ea07e89244764c/image.png?expires=1789727400&amp;signature=d05e832749918c6b5c30d60d9d0c407880bc1da1adf0416f97af0ced1718090f&amp;req=dSklFMh6mINaWvMW1HO4zRZTxFPGuczXKAqLF4ERnlUpuZpdO%2BUJhvjtf9MC%0A8VnLe6p10fuamDMP8TI%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1922145253/f2e3d4e0fe43a2ea07e89244764c/image.png?expires=1789796700&amp;signature=f75c76599401c9ef65263bb69bd96bb24524cdf9877255a9ef614d6920535eba&amp;req=dSklFMh6mINaWvMW1HO4zRZTxFPGss3UKAqLF4ERnlWoA66fZhfWl%2Ft7NcMy%0Ab3rcIw6tQrrv9Q2epP0%3D%0A)
 
 ## When will I be billed?
 
diff --git a/content/support/13132885-set-up-single-sign-on-sso.md b/content/support/13132885-set-up-single-sign-on-sso.md
index 2bc7e61844..720fa516ed 100644
--- a/content/support/13132885-set-up-single-sign-on-sso.md
+++ b/content/support/13132885-set-up-single-sign-on-sso.md
@@ -42,7 +42,7 @@ You can verify multiple domains for a single organization, but all domains must
 
 3. Enter the domain(s) you want to verify in the **Update organization email domains** modal and click the “+” button:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2498843282/561d5ceb1c3a5df75bdfee8bfc3f/d2491145-362d-490b-bdcf-66a0a7656ddc?expires=1789727400&amp;signature=00d8c133bee22f85e11c911bf03e5ccdce8c7c4b8e1b33417e5d06b121855f7d&amp;req=diQuHsF6noNXW%2FMW1HO4zSdmHnU%2B%2BMOIe3H0OpmIzWFOrCtue%2FH3l0Lb5cK%2B%0An%2FPT%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2498843282/561d5ceb1c3a5df75bdfee8bfc3f/d2491145-362d-490b-bdcf-66a0a7656ddc?expires=1789796700&amp;signature=414c607210c505ef8d45f741af6bbd68863cfa65f1c06952b6d7b859c8c3d9a4&amp;req=diQuHsF6noNXW%2FMW1HO4zSdmHnU%2B88KLe3H0OpmIzWEEoUo0AuscjR%2BYl%2B3M%0AQq13%0A)
 
 4. Click “Save” when you’re finished adding domains.
 
@@ -50,7 +50,7 @@ You can verify multiple domains for a single organization, but all domains must
 
 6. Enter your domain in the text box and click “Continue”:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2047042630/0617a562cd28a7ff0e607d66a30b/6bd08e1d-2b65-40ab-bc79-a257153854c1?expires=1789727400&amp;signature=2821bb74e2754774bd3f298d69985a56caffbed64bfe239c60131cdb3f2a2bb3&amp;req=diAjEcl6n4dcWfMW1HO4zWHctRSQldauyoyXAW0OlXr9ASifY4bdUjG%2FW%2BxV%0AxiMs%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2047042630/0617a562cd28a7ff0e607d66a30b/6bd08e1d-2b65-40ab-bc79-a257153854c1?expires=1789796700&amp;signature=f12bae848b677bfff83a51274013eb0fa5e37abc4b80f0ea5d75dd4654320984&amp;req=diAjEcl6n4dcWfMW1HO4zWHctRSQntetyoyXAW0OlXojhRmdJbxjm7FkMR0u%0AiZBt%0A)
 
 7. The setup screen displays a TXT record. **Copy the full Value using the copy button**—it begins with `anthropic-domain-verification-` and is longer than what's visible in the box. In your DNS provider, add a TXT record to your domain and **Value** set to the copied string. The domain must match exactly what you entered in the previous step, including any subdomains. Add it alongside any existing TXT records; don't replace them. The value is case-sensitive, so paste it exactly. Please refer to your DNS provider's documentation on this topic.
 
@@ -76,7 +76,7 @@ Clicking "Refresh" re-checks your DNS; it won't show Verified until the publishe
 
 If the record is correct and propagated but the status still shows Pending, contact Support.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2047044496/b8df54a0331784cc9ae8f00112aa/bf9609c1-dc93-4665-a066-4cae2fe4b002?expires=1789727400&amp;signature=a38df366f9c9fc636875d56ccf550869bbbf938845029c2d8ae12566da4915c2&amp;req=diAjEcl6mYVWX%2FMW1HO4zVjmWSAHbXO9PM2D8ZcdgrhldEkvURnln%2Fj71XAM%0Aov0Bw%2BLrx7nwV0wRtaY%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2047044496/b8df54a0331784cc9ae8f00112aa/bf9609c1-dc93-4665-a066-4cae2fe4b002?expires=1789796700&amp;signature=dfffbb7c5253f38d293d71fa4461e8e13c22c01e0e7f888245736bf7af229a0e&amp;req=diAjEcl6mYVWX%2FMW1HO4zVjmWSAHZnK%2BPM2D8Zcdgrj1Pq%2FgbOT78THVrusO%0Ac6votpPyP1WSMZwdCfE%3D%0A)
 
 **Note:** Once your domain is verified, you'll see a **Restrict organization creation** toggle under **Security** on the Organization and access organization settings page. Enable this if you want to prevent users from creating new Claude or Console organizations—including personal accounts—using your verified domains.
 
@@ -116,7 +116,7 @@ For IdP-specific setup instructions, see:
 
 You can now choose to toggle on **Require SSO for Console** and/or **Require SSO for Claude,** on the **Organization and access** page, under the **Authentication** section:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2312690200/bd2403586d4f6651ccd79e2a45af/b9f8d7ce-0def-49d9-bfb2-3a14352d7214?expires=1789727400&amp;signature=5d673b2529d13d6310c92798cdf79f7cada7cb288f4c845131d6cff70b6905c7&amp;req=diMmFM93nYNfWfMW1HO4zdAICwamAHsOItXtKivx6ZGh4m9iVBXWWIQunxNV%0ALSL%2FY9ZFhzISDQ2c8Ok%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2312690200/bd2403586d4f6651ccd79e2a45af/b9f8d7ce-0def-49d9-bfb2-3a14352d7214?expires=1789796700&amp;signature=93a7dd23dd4a285dc26a1d3a23ca4e3267981cb5db348240f941aeea2650330e&amp;req=diMmFM93nYNfWfMW1HO4zdAICwamC3oNItXtKivx6ZEbLRB8KvkVkSb%2BgRDX%0ALmvf%2FvqFxw%2F%2Bnzmk%2BYs%3D%0A)
 
 When SSO is required, users must use the “Continue with SSO” option to log in to their Claude/Console accounts. When SSO is not required, they will have the option to choose “Continue with SSO” or “Continue with email.”
 
diff --git a/content/support/13133195-set-up-jit-or-scim-provisioning.md b/content/support/13133195-set-up-jit-or-scim-provisioning.md
index a91bb5a22d..2cb5c6af23 100644
--- a/content/support/13133195-set-up-jit-or-scim-provisioning.md
+++ b/content/support/13133195-set-up-jit-or-scim-provisioning.md
@@ -40,7 +40,7 @@ Use this table to help decide which provisioning mode is right for your organiza
 
 Both JIT and SCIM can be combined with **Enable group mappings** to control role or seat tier assignment based on IdP group membership. If you select either of these options for your provisioning mode, **Enable group mappings** will appear within the **User provisioning** section:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2312706099/35d5d3ec149880a96bb7acec59f6/a4cfce55-86bf-40b0-b455-c8f412d48e9e?expires=1789727400&amp;signature=dd8dba7ff46113fcf5fe610a484737dadc802074cf507195c9aa30896b871324&amp;req=diMmFM5%2Bm4FWUPMW1HO4zXBDQ6JTD11yxFMG%2BIEvQSeTfyv5a3bUO4KA7DWK%0AmIU5l8esMPMnNFl6OZA%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2312706099/35d5d3ec149880a96bb7acec59f6/a4cfce55-86bf-40b0-b455-c8f412d48e9e?expires=1789796700&amp;signature=c29398e6cdfbd3bbe76b41c9115cfb8570b21c7e66e4b64cb2fee2008885d0ec&amp;req=diMmFM5%2Bm4FWUPMW1HO4zXBDQ6JTBFxxxFMG%2BIEvQSde7ANmCFOwWIwphypm%0AzaglwgYVUNRFEquFcaI%3D%0A)
 
 **Important:** Group mappings set a user’s role type and seat tier only. Users with the Custom role get their permissions from groups in Claude, and those groups sync from your IdP only when your provisioning mode is SCIM directory sync. With JIT, you need to create groups and add users to them manually in **[Organization settings > Groups](https://claude.ai/admin-settings/groups)**. If you map an IdP group to the Custom role under JIT without doing this, those users have no permissions when they log in. Learn more about **[managing groups on Enterprise plans](https://support.claude.com/en/articles/13799932)**.
 
@@ -126,7 +126,7 @@ Once your IdP is connected, continue to Step 3.
 
 4. Toggle **Enable group mappings** on (if it’s not already):
 
-  ![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2312714635/b57870b51e6511c8293637bceee2/da1ceabc-b6bc-451b-9cda-24ff6aa90d02?expires=1789727400&amp;signature=2beecacce43bdfd06c4002eb577edb2a4ea9a2ae8676f7a197b162a612cf6070&amp;req=diMmFM5%2FmYdcXPMW1HO4zeBEbszflf1Myb72rapuHpN%2BQZHukuhqXpkcWI%2Br%0AEojF%0A)
+  ![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2312714635/b57870b51e6511c8293637bceee2/da1ceabc-b6bc-451b-9cda-24ff6aa90d02?expires=1789796700&amp;signature=55b914349aa186408a7b6630c136754615d83f46a7e4103c277573dd74cc65f8&amp;req=diMmFM5%2FmYdcXPMW1HO4zeBEbszfnvxPyb72rapuHpP4u8hXlWRO1%2B2YRz9%2B%0AQd0Q%0A)
 
 5. In the **Enable group mappings** section, click “Add” next to each role and select the corresponding group from your IdP in the dropdown.
 
@@ -178,7 +178,7 @@ Verify you have enough seats purchased and available to add members to your org.
 
 4. **For SCIM:** Click "Sync" to prompt an immediate sync, or wait for the automatic sync cycle:
 
-  ![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2312717421/c97fce49ad17d4660880a05fbaaf/59fbfa2a-1072-4662-8ca5-102970d5a795?expires=1789727400&amp;signature=18bffb6795b05192abd735c9a00e55f3477610c72a80b4f688044e6b8a1d7e3b&amp;req=diMmFM5%2FmoVdWPMW1HO4zZ9La1SqG83G5hujYvMis4ckj0f%2FbKM0AOGTGgpw%0AfH5T%0A)
+  ![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2312717421/c97fce49ad17d4660880a05fbaaf/59fbfa2a-1072-4662-8ca5-102970d5a795?expires=1789796700&amp;signature=01cab8bc2be7dbb995cea8084137709514a009eae56b56078cb1389a487df94f&amp;req=diMmFM5%2FmoVdWPMW1HO4zZ9La1SqEMzF5hujYvMis4deY3kJsZNcGZZSqQ8S%0ATR8J%0A)
 
 ### Users mapped to the Custom role can't access anything after logging in
 
diff --git a/content/support/13163631-configuring-session-security-settings.md b/content/support/13163631-configuring-session-security-settings.md
index b3c512104f..7c34cd0763 100644
--- a/content/support/13163631-configuring-session-security-settings.md
+++ b/content/support/13163631-configuring-session-security-settings.md
@@ -18,7 +18,7 @@ Session duration controls allow Enterprise and Console Admins to set a maximum s
 
 5. Confirm your selection by clicking “Enable.”
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1888469436/1725e63ea1a2615948faecf4ec73/9bd276a1-7329-414d-87a1-d04dac93fff7?expires=1789727400&amp;signature=11d77f1703b578b4b9425eca39999a33b6d6f2c8f41312d332d526269abae324&amp;req=dSgvHs14lIVcX%2FMW1HO4zQNx6%2BsgQV1Ug%2F6XaftFnjxlHTEoW1VKyVLPhkYk%0A0EvnZjjrCyiHh4j9mbI%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1888469436/1725e63ea1a2615948faecf4ec73/9bd276a1-7329-414d-87a1-d04dac93fff7?expires=1789796700&amp;signature=05d249c34ec71cfc55c9b49f8c88c51af76ed47ab98894aafd22ce567f11704c&amp;req=dSgvHs14lIVcX%2FMW1HO4zQNx6%2BsgSlxXg%2F6XaftFnjyrzY2EIWxb25vpmwo9%0AZRVEzndpER7FPmfW7F0%3D%0A)
 
 ### For Console Admins
 
@@ -32,7 +32,7 @@ Session duration controls allow Enterprise and Console Admins to set a maximum s
 
 5. Confirm your selection by clicking “Enable.”
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1888469435/7a766bbe02e61c7d8f05deb5b8f0/b0bda400-47c6-43dd-9907-131ebe180b36?expires=1789727400&amp;signature=7a13084b027bd54be33a2d9e06db4656d95e08a783b0fc95f0eb50b18f617a4e&amp;req=dSgvHs14lIVcXPMW1HO4zWzx2LAxJXglXZ5D7eVpMtftNzeH6bqfrTc3RzXS%0AqsxFUXCWx5j7VdHrj4c%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1888469435/7a766bbe02e61c7d8f05deb5b8f0/b0bda400-47c6-43dd-9907-131ebe180b36?expires=1789796700&amp;signature=6e5830e5c8297dd58cbdd78e5fc4ab9e464c9b91c585d6aae627782beb8d4b20&amp;req=dSgvHs14lIVcXPMW1HO4zWzx2LAxLnkmXZ5D7eVpMteqXBw5CslS3Z16G4gp%0A95uIs7gwBJiXVR%2FsDNM%3D%0A)
 
 ### What happens after enabling shortened session length?
 
@@ -50,7 +50,7 @@ You can change the session duration at any time by selecting a new value from th
 
 - Sessions scheduled to expire beyond the new duration will have their expiration shortened accordingly.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1888469437/46ac5bc55484ca01556d87a5ade7/b01a7651-ad65-4b32-93ff-16dbc9ca97c0?expires=1789727400&amp;signature=8803fd50cc1c2dae1457177025f772825de7046e4987695987c78d43b6039e5a&amp;req=dSgvHs14lIVcXvMW1HO4zZ7mWsGc5T6nA00cbyPOLDVQdvoitrqQUnfAPw7w%0AUfXwxjNhqXmeKyd%2FcxE%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1888469437/46ac5bc55484ca01556d87a5ade7/b01a7651-ad65-4b32-93ff-16dbc9ca97c0?expires=1789796700&amp;signature=12345e20dd5e252da004503ceabbce8699986f491c9fa163aa86ddd16334e01f&amp;req=dSgvHs14lIVcXvMW1HO4zZ7mWsGc7j%2BkA00cbyPOLDXb7CPJKUFlLCWU1Nce%0Auh9PmI49tP8VsBey4rw%3D%0A)
 
 ## Disabling session length settings
 
diff --git a/content/support/13189465-log-in-to-your-claude-account.md b/content/support/13189465-log-in-to-your-claude-account.md
index 67c74f3cb0..23108f70c0 100644
--- a/content/support/13189465-log-in-to-your-claude-account.md
+++ b/content/support/13189465-log-in-to-your-claude-account.md
@@ -2,7 +2,7 @@
 
 When you open Claude on a web browser ([claude.ai](http://claude.ai)), the desktop app, or a mobile app, you will see two different options for logging in to your Claude account.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1893216804/f2209c3ec6cf4fc2e803d13bbc9d/40520c9e-ff82-4a7c-adca-5a064fe18d8c?expires=1789727400&amp;signature=0868a2e321734959e81b897778187e71f2babcc0aab971afd63119ee0dd0f164&amp;req=dSguFct%2Fm4lfXfMW1HO4zXg5BouL4RWwzWhrqpWiTMlmgr2zrSMoy3fobSGo%0AvB6rUfvlPa%2FwH1akzJA%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1893216804/f2209c3ec6cf4fc2e803d13bbc9d/40520c9e-ff82-4a7c-adca-5a064fe18d8c?expires=1789796700&amp;signature=2c7600b1cb826f6872f50a21517109d5acf82f2e24aa888430542ea2472c8906&amp;req=dSguFct%2Fm4lfXfMW1HO4zXg5BouL6hSzzWhrqpWiTMkNvA2nYx2jVI50pibb%0AcOSQjln4OWD7j%2BU60rk%3D%0A)
 
 ## Continue with Google
 
diff --git a/content/support/13325567-account-management-faqs.md b/content/support/13325567-account-management-faqs.md
index d23d494512..da83ffea93 100644
--- a/content/support/13325567-account-management-faqs.md
+++ b/content/support/13325567-account-management-faqs.md
@@ -44,6 +44,6 @@ The email domain that was used to create your Team or Enterprise plan organizati
 
 Owners can remove domains by opening up the same modal and clicking the trash can icon to the right of the domain:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2053873852/1cbccea3b7067e03205f2ff8546b/CleanShot+2026-02-11+at+11_16_07%402x.png?expires=1789727400&amp;signature=e5f70f72d62dd22c3b3da77c42e0e1a74f8fc8f6b071bed5b36f9afbf5ec24a7&amp;req=diAiFcF5nolaW%2FMW1HO4zUrhFuKfaw8ekeFUnrkrQZjZaTeWugusLVYKboar%0AB67KH%2FbmRCaBNqj6wUU%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2053873852/1cbccea3b7067e03205f2ff8546b/CleanShot+2026-02-11+at+11_16_07%402x.png?expires=1789796700&amp;signature=f4cdf9ebb6aa95c5c64c236caa61351b6df4d80d7f86fde59d826811eb64430d&amp;req=diAiFcF5nolaW%2FMW1HO4zUrhFuKfYA4dkeFUnrkrQZjqr8VMXe2uah5tKBlk%0A91IIOz0nf%2BfGbTvoNDc%3D%0A)
 
 While the account creator must use a business email address, you can add public domains like @gmail.com, @yahoo.com, and @hotmail.com as allowed domains for other members of your organization.
\ No newline at end of file
diff --git a/content/support/13345190-get-started-with-claude-cowork.md b/content/support/13345190-get-started-with-claude-cowork.md
index de274b6986..ba74f2a462 100644
--- a/content/support/13345190-get-started-with-claude-cowork.md
+++ b/content/support/13345190-get-started-with-claude-cowork.md
@@ -42,10 +42,6 @@ With Cowork, you can describe an outcome, step away, and come back to finished w
 
 - You control your Cowork tasks and can delete a task at any time using the "Delete" option (click "⋮" next to the task, or select tasks from your Tasks list and click the trash icon). Your Cowork task will be removed from your task history immediately, and deleted from our backend storage systems within 30 days, in accordance with our **[data retention periods](https://privacy.claude.com/en/articles/10023548-how-long-do-you-store-my-data)**.
 
-- Cowork via mobile and web is captured in the Compliance API. Learn more about **[retrieving remote sessions in the Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-content-data)**.
-
-- If you're a Team or Enterprise plan admin, you can **[use OpenTelemetry (OTel) to monitor Claude Cowork activity](https://support.claude.com/en/articles/14477985-monitor-claude-cowork-activity-with-opentelemetry)** across your organization.
-
 - For more information, review **[Use Cowork safely](https://support.claude.com/en/articles/13364135-using-cowork-safely)**.
 
 For important limitations and considerations for Team and Enterprise organizations using Cowork, see **[Cowork for Team and Enterprise plans](https://support.claude.com/en/articles/13455879-cowork-for-team-and-enterprise-plans)**.
@@ -188,7 +184,7 @@ To set global instructions:
 
 3. Type your instructions in the text box and click "Save":
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2525926874/15324ac4155d7802272e8bdef04b/ec66cd09-a4db-4f1d-8f30-226c9d126333?expires=1789728300&amp;signature=b4225d5cc4011ba5c6eeab4d2c6fe2aee6e28cf2324179c63b847c91a4bc4422&amp;req=diUlE8B8m4lYXfMW1HO4zcDl6tHrNFmz8iWjaktE9422UF9%2FRn4%2BeUUesf63%0AnPuhgs4EF0lUItZsv6g%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2525926874/15324ac4155d7802272e8bdef04b/ec66cd09-a4db-4f1d-8f30-226c9d126333?expires=1789905600&amp;signature=d91f87d764acfda3254258870fe5dd00a50a16c78ca0b69283b00c7d44469d6b&amp;req=diUlE8B8m4lYXfMW3nq%2BgcqgxG%2BD1b%2FcbleMqW%2FkK1cQqaESOuGW96n%2BNIKq%0A7orMRHP%2BGQRWksRJ9uwPvmEoPqo%3D%0A)
 
 ### Folder instructions
 
diff --git a/content/support/13346458-customizing-your-console-appearance-settings.md b/content/support/13346458-customizing-your-console-appearance-settings.md
index 90bae08b6d..4b11163b82 100644
--- a/content/support/13346458-customizing-your-console-appearance-settings.md
+++ b/content/support/13346458-customizing-your-console-appearance-settings.md
@@ -8,4 +8,4 @@
 
 3. Select from Light, System, or Dark under **Color mode**.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1922579101/ede30d38dca693c59f9c15d79e69/CleanShot+2026-01-08+at+15_45_20%402x.png?expires=1789727400&amp;signature=407265e1b5c00ee1e133dd81bc5cd9a655ea77c3d5273d67dc3afbec6fe8f023&amp;req=dSklFMx5lIBfWPMW1HO4zRpFC8EDTxVyO9Kw38RlAYKAXfF2ufuniCnG17VI%0ADYkifBv7ElKRww7YqBI%3D%0A)
\ No newline at end of file
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1922579101/ede30d38dca693c59f9c15d79e69/CleanShot+2026-01-08+at+15_45_20%402x.png?expires=1789796700&amp;signature=8c8c1f1251de158720f2328f26e1b24076138860d3ffcbcd378b8b1fa81dc510&amp;req=dSklFMx5lIBfWPMW1HO4zRpFC8EDRBRxO9Kw38RlAYIWY%2BEgBvSuiZbD1NYw%0A%2FjaTHXVjKkNm0N7KoQA%3D%0A)
\ No newline at end of file
diff --git a/content/support/13371040-log-in-to-your-console-account.md b/content/support/13371040-log-in-to-your-console-account.md
index 1554774943..3e8ec56315 100644
--- a/content/support/13371040-log-in-to-your-console-account.md
+++ b/content/support/13371040-log-in-to-your-console-account.md
@@ -2,7 +2,7 @@
 
 When you navigate to the **[Claude Console](https://platform.claude.com)**, you will see two different options for logging in to your Console account.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1935026646/d90d1613a3dbe763fef5abb96e3c/image.png?expires=1789727400&amp;signature=fff6ade747ed335617e80b830a86875ce634f01dfa8b45f7407e322ae57235b8&amp;req=dSkkE8l8m4dbX%2FMW1HO4zcrI54DroocJ8vUNcPt4%2B72t1whSZcYNfiHXUSNF%0AwGlH1GCKISyoVFKRodI%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1935026646/d90d1613a3dbe763fef5abb96e3c/image.png?expires=1789796700&amp;signature=21dec458a52aab85b7c965bf100c3860b685ef1259eccffb23f25baddfebf531&amp;req=dSkkE8l8m4dbX%2FMW1HO4zcrI54DrqYYK8vUNcPt4%2B71T7Lig2Jmx6mEPb2lW%0A6Z1Y%2BZYKXsHXoZmNpE4%3D%0A)
 
 ## Continue with Google
 
diff --git a/content/support/13455879-use-claude-cowork-on-team-and-enterprise-plans.md b/content/support/13455879-use-claude-cowork-on-team-and-enterprise-plans.md
index 729f9c999c..431032cfe3 100644
--- a/content/support/13455879-use-claude-cowork-on-team-and-enterprise-plans.md
+++ b/content/support/13455879-use-claude-cowork-on-team-and-enterprise-plans.md
@@ -128,33 +128,31 @@ Cowork now surfaces your organization's branding, including a redesigned home sc
 
 ---
 
-## Compliance and monitoring
+## Security, compliance, and monitoring
 
-Team and Enterprise owners can stream Cowork events to your SIEM and observability tools through OpenTelemetry. This gives security teams visibility into tool calls, file access, human approval decisions, and more—though it doesn't replace audit logging for compliance purposes. For setup, supported events, and security considerations, see **[Monitor Cowork activity with OpenTelemetry](https://support.claude.com/en/articles/14477985-monitor-cowork-activity-with-opentelemetry).**
+**Note:** For the most up-to-date and extensive guide see **[Cowork security best practices](https://trust.anthropic.com/resources?s=uukz8hyx7jmdmo80lys36s&name=claude-cowork-security-best-practices)**.
 
-You can also refer to[**Monitoring**](https://claude.com/docs/cowork/monitoring) on **claude.com/docs** for more information.
+### Monitoring
 
-Cowork via Claude, Claude Desktop, and Claude Mobile is captured in the Compliance API. Learn more about **[retrieving remote sessions in the Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-content-data)**.
+**Compliance API**
 
-### Local conversation storage
+Cowork sessions via Claude, Claude Desktop, and Claude Mobile are captured in the Compliance API. Learn more about **[retrieving remote sessions in the Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-content-data)**.
 
-For local sessions, Cowork stores conversation history locally on users' computers. This data is not subject to Anthropic's standard **[data retention policies](https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data)** and cannot be centrally managed or exported by admins. Claude Enterprise admins can retrieve this session content through the Compliance API; deletion endpoints for local sessions aren't available yet.
-​
-For sessions in the cloud, your sessions and files are saved to your Claude account.
+**Local conversation storage**
 
-### Access controls
+For local sessions, Cowork stores conversation history on users' computers. This data is not subject to Anthropic's standard **[data retention policies](https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data)**, and admins cannot centrally manage or delete it. Claude Enterprise admins can retrieve this content through the Compliance API. Deletion endpoints for local sessions aren't available yet.
 
-The Cowork toggle is organization-wide—either all members have access or none do. On Enterprise plans, admins who need per-team control can use **[groups and custom roles](https://support.claude.com/en/articles/13799932-manage-groups-and-group-spend-limits-on-enterprise-plans)** to selectively enable Cowork or grant the "Run Cowork in the cloud" capability to specific users or teams. Team plans don't have access to these controls, so Cowork remains all-or-nothing.
+For sessions in the cloud, sessions and files are saved to the member's Claude account.
 
-Within Cowork, admins have more granular control over plugins. You can set per-plugin installation preferences to control which plugins are auto-installed, available for self-service, or hidden from your organization's catalog. On Enterprise plans, these preferences can also be customized per group. See **[Manage plugins for your organization](https://support.claude.com/en/articles/13837433-manage-cowork-plugins-for-your-organization)** for details.
+**OpenTelemetry**
 
----
+Team and Enterprise owners can stream Cowork events to your SIEM and observability tools through OpenTelemetry. This gives security teams visibility into tool calls, file access, human approval decisions, and more. It doesn't replace audit logging for compliance purposes.
 
-## Security considerations
+For setup, supported events, and security considerations, see **[Monitor Cowork activity with OpenTelemetry](https://support.claude.com/en/articles/14477985-monitor-cowork-activity-with-opentelemetry)**. You can also refer to **[Monitoring](https://claude.com/docs/cowork/monitoring)** in our Claude Docs.
 
 ### Prompt injection risks
 
-Cowork has unique risks due to its agentic nature and internet access. While we've implemented safety measures including model training and content classifiers, the risk of prompt injection attacks is non-zero.
+Cowork has unique risks due to its agentic nature and internet access. We've implemented safety measures including model training and content classifiers, but the risk of prompt injection attacks is non-zero.
 
 Users should:
 
@@ -166,12 +164,10 @@ Users should:
 
 - Report suspicious behavior immediately
 
-For detailed guidance, see **[Use Cowork safely](https://support.claude.com/en/articles/13364135-use-cowork-safely)**.
-
 ### Network access
 
-Cowork respects your organization's current network egress permissions. Review your network access settings in **[Organization settings > Capabilities](https://claude.ai/admin-settings/capabilities)** under **Code execution** before enabling Cowork.
+Cowork respects your organization's current network egress permissions. Before enabling Cowork, review your network access settings in **[Organization settings > Capabilities](https://claude.ai/admin-settings/capabilities)** under **Code execution**.
 
-Network settings are applied when a new Cowork session is created. If you change the network access mode or add domains to the allowlist while a conversation is already active, those changes will not take effect in that session. Start a new conversation for the updated settings to apply.
+Network settings are applied when a new Cowork session is created. If you change the network access mode or add domains to the allowlist during an active conversation, those changes won't take effect in that session. Start a new conversation for the updated settings to apply.
 
-**Important:** Network egress permissions don't apply to the web fetch or **[web search](https://support.claude.com/en/articles/10684626-enabling-and-using-web-search)** tools or MCPs, including Claude in Chrome. Web fetch runs server-side and is limited to search results and URLs you've shared. Team or Enterprise plan owners can turn off web search for Cowork and Chat in **[Organization settings > Capabilities](https://claude.ai/admin-settings/capabilities)**, or Claude in Chrome via **[Organization settings > Claude in Chrome](https://claude.ai/admin-settings/browser-extension)**.
\ No newline at end of file
+Network egress permissions don't apply to the web fetch or **[web search](https://support.claude.com/en/articles/10684626-enabling-and-using-web-search)** tools, or to MCPs, including Claude in Chrome. Web fetch runs server-side and is limited to search results and URLs you've shared. Team and Enterprise owners can turn off web search for Cowork and Chat in **[Organization settings > Capabilities](https://claude.ai/admin-settings/capabilities)**, and Claude in Chrome in **[Organization settings > Claude in Chrome](https://claude.ai/admin-settings/browser-extension)**.
\ No newline at end of file
diff --git a/content/support/13641943-visual-and-interactive-content.md b/content/support/13641943-visual-and-interactive-content.md
index 862bc91189..25af541a6e 100644
--- a/content/support/13641943-visual-and-interactive-content.md
+++ b/content/support/13641943-visual-and-interactive-content.md
@@ -18,7 +18,7 @@ Claude can show current weather conditions and forecasts when you ask about the
 
 Claude automatically displays temperatures in Fahrenheit for US locations and Celsius for everywhere else.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2040544927/3a9c695b24df387ecdd766ad308c/8be9f393-dcb0-4ff8-89e8-5fa47bedaa38?expires=1789728300&amp;signature=c4318a849cfe151ef9530cba3a4f54d9b1dde8a78b68ed5efaa0182bd78d0a66&amp;req=diAjFsx6mYhdXvMW1HO4zXlB7Te91xCLdgndksVD5R0E6oHnseQSf5cP4V5q%0A2J2jiTvniJO9LLifEBs%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2040544927/3a9c695b24df387ecdd766ad308c/8be9f393-dcb0-4ff8-89e8-5fa47bedaa38?expires=1789796700&amp;signature=d5283a2a708f8fec37b4a50de53510f7b8ea7aac3cced191d7f7de744694bd67&amp;req=diAjFsx6mYhdXvMW1HO4zXlB7Te93B6PdgndksVD5R22hxC6dHNa5TLHCNN9%0ArUKDHmrpdyX%2By9xnP5Y%3D%0A)
 
 Weather is powered by Google Maps (<https://policies.google.com/privacy>).
 
@@ -28,7 +28,7 @@ When you ask about recipes, Claude can display formatted recipe cards that are e
 
 **Note:** Visual recipe cards are available on web and desktop only. On mobile, Claude provides recipe information as text in the conversation.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2040544929/12f4c51eda7779d65d3ea2c7ab16/d0f4a314-cff8-421a-b401-10c2bf50374e?expires=1789728300&amp;signature=f047e7469092f5144f70ee0b16b95f41f493bc2e3f11ecfd8955ae456401ae0f&amp;req=diAjFsx6mYhdUPMW1HO4zUQpe7kS0FyUrIPm%2FImZVg3i%2BygHGytXAVEnkOVy%0Ajbt7suRRpm%2BwcItpYII%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2040544929/12f4c51eda7779d65d3ea2c7ab16/d0f4a314-cff8-421a-b401-10c2bf50374e?expires=1789796700&amp;signature=33c99e728cb0e3ae5b5885ab2470274be2487afeaa741ec7a4dde2a93f32bffd&amp;req=diAjFsx6mYhdUPMW1HO4zUQpe7kS21KQrIPm%2FImZVg3QayTMsdjmc4w4kLjp%0AKBoMLl69w1KE3jlgHhk%3D%0A)
 
 ### Custom visuals
 
@@ -76,7 +76,7 @@ For example, if you ask Claude to help you plan a trip, it might ask you to:
 
 This content appears at the bottom of the chat. You can still type a response if you prefer.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2040544930/9ad066e137d11e4b559b0217e12d/9bf30d2d-1715-42b3-9da5-2a9298f41f08?expires=1789728300&amp;signature=1cc0a092f42bb8c2a76c29daa04c6ea8da86c53e33682262e48ea40b57669549&amp;req=diAjFsx6mYhcWfMW1HO4zWmF5%2Fy5axahx4wz0C7CTALq3Hr4tTYRzABFd4Z3%0AzLk2o%2BBMiO06CMINKvU%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2040544930/9ad066e137d11e4b559b0217e12d/9bf30d2d-1715-42b3-9da5-2a9298f41f08?expires=1789796700&amp;signature=fa6f671cfcaaf8b588a794d3fb9a1d0d2d7972bcb1a13ecf4d1b9967c271b76b&amp;req=diAjFsx6mYhcWfMW1HO4zWmF5%2Fy5YBilx4wz0C7CTAJMYUSozW0pjjWpqZAu%0AQ3S7ToO2RKmjuttcRzs%3D%0A)
 
 ---
 
diff --git a/content/support/13756069-public-sector-faqs.md b/content/support/13756069-public-sector-faqs.md
index b9cf52507e..2e2a59c572 100644
--- a/content/support/13756069-public-sector-faqs.md
+++ b/content/support/13756069-public-sector-faqs.md
@@ -6,7 +6,7 @@
 
 Select your product based on both your technical/functional requirements, and also your compliance/security/deployment environment requirements. Here is a list of options:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2197717161/79965a24090029e9e58c727c3c24/pubsec-product-matrix_png+%281%29.jpg?expires=1789728300&amp;signature=b88ee8f396fb735a7e9b382875cf5ae4450c8adbb315c38c0f9da7f966e0ff80&amp;req=diEuEc5%2FmoBZWPMW1HO4zU94LlAiH9Uz2WxtU42UVC1BwqWCboGhuw%2BqJtiM%0AhXQpF7AOVSErfU5Vvmk%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2197717161/79965a24090029e9e58c727c3c24/pubsec-product-matrix_png+%281%29.jpg?expires=1789796700&amp;signature=9f5e62c1f1d41b8f1e1368fa833d96312faf26beb95bd8bf92b50d489c14bd49&amp;req=diEuEc5%2FmoBZWPMW1HO4zU94LlAiFNs32WxtU42UVC27XFLYVZE%2B%2BJ4bG%2Fvf%0Amat9hfvczXD8Jz2duEY%3D%0A)
 
 ### What is Claude for Government (C4G)?
 
diff --git a/content/support/13799932-manage-groups-and-group-spend-limits-on-enterprise-plans.md b/content/support/13799932-manage-groups-and-group-spend-limits-on-enterprise-plans.md
index 57c74ea1d1..369ada24f6 100644
--- a/content/support/13799932-manage-groups-and-group-spend-limits-on-enterprise-plans.md
+++ b/content/support/13799932-manage-groups-and-group-spend-limits-on-enterprise-plans.md
@@ -150,7 +150,7 @@ Group spend limits let you control spending across your organization by assignin
 
 Group spend limits work alongside individual spend limits. If a member has an individual spend limit set, their individual limit takes precedence over any group limit.
 
-## Set a group spend limit
+### Set a group spend limit
 
 1. Navigate to **[Organization settings > Usage](https://claude.ai/admin-settings/usage)**.
 
@@ -164,7 +164,7 @@ Group spend limits work alongside individual spend limits. If a member has an in
 
 The spend limit applies to all members of the group. Members who also have an individual spend limit set are governed by their individual limit instead.
 
-## Choose how multi-group spend limits resolve
+### Choose how multi-group spend limits resolve
 
 If a member belongs to more than one group with a spend limit, the **Multi-group spend limit** setting controls which limit applies.
 
@@ -176,7 +176,7 @@ If a member belongs to more than one group with a spend limit, the **Multi-group
 
 Select "Lower group limit" to set a broad limit on a large group and create subgroups with tighter budgets. Select "Higher group limit" to set a conservative baseline on a large group and grant more headroom to specific teams.
 
-## How spend limits are resolved
+### How spend limits are resolved
 
 When determining a member's effective spend limit, the system evaluates in this order:
 
diff --git a/content/support/13837433-manage-plugins-for-your-organization.md b/content/support/13837433-manage-plugins-for-your-organization.md
index b5ef8d3bff..496f493051 100644
--- a/content/support/13837433-manage-plugins-for-your-organization.md
+++ b/content/support/13837433-manage-plugins-for-your-organization.md
@@ -112,7 +112,7 @@ Your personal GitHub token is verified to confirm you have access, then Cowork u
 
 An initial sync runs automatically when you connect a repository. After that, organization owners can opt-in to continued automatic updates per marketplace by going to **[Organization settings > Plugins](https://claude.ai/admin-settings/plugins)**, clicking the menu button in the upper right corner of the marketplace, then toggling "Sync automatically" on:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2193200015/a239033a9ab19fbd39f1a0d9edce/CleanShot+2026-03-23+at+11_41_31%402x.png?expires=1789728300&amp;signature=1e34cd38f05f3089870ed1b26f0f751bb99316e538d52b46cd2febe4a6feb8e3&amp;req=diEuFct%2BnYFeXPMW1HO4zUYv5tT%2Bw3cXRDH%2FtUo5ov5b0WGmM5WCKCXo5dGr%0ArHFxu8dbSQocdNgC0rA%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2193200015/a239033a9ab19fbd39f1a0d9edce/CleanShot+2026-03-23+at+11_41_31%402x.png?expires=1789796700&amp;signature=590aeb66bd9aa7e7cdcee114227571cac265a632b78e712b0944fe793141d56c&amp;req=diEuFct%2BnYFeXPMW1HO4zUYv5tT%2ByHkTRDH%2FtUo5ov53mVU5KRpUF%2FD7e9Av%0AAGljd8hlOGGdWUe8y1A%3D%0A)
 
 Enabling automatic sync creates a webhook on the connected repository. The person turning the toggle on must have admin-level access to that repository on GitHub. This is checked through their personal GitHub connection, which is separate from the Claude GitHub App installation. Without admin access, the page shows "Cannot access repository. Ensure the repository exists and the Claude GitHub App is installed," even when the App is installed correctly and manual updates work.
 
diff --git a/content/support/13837440-use-plugins-in-claude.md b/content/support/13837440-use-plugins-in-claude.md
index 6b2f236d38..cf590000df 100644
--- a/content/support/13837440-use-plugins-in-claude.md
+++ b/content/support/13837440-use-plugins-in-claude.md
@@ -40,7 +40,7 @@ In Cowork, open the "Cowork" tab first, then open **Customize**.
 
 You can also upload a custom plugin file if you built one yourself. On Team and Enterprise plans, a colleague can share a plugin with you directly instead of sending you the file. See **[Use a plugin shared with you](#h_ef985546b4)** below. On Claude Desktop and in Cowork, plugins you add yourself are saved locally to your computer.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2100409211/fc01614dde1a616fa31ffaa9cb04/47bacf5b-a810-45b5-a468-9769f1a58ef8?expires=1789728300&amp;signature=502f4bf9f1e689a0774064850e8424f551802c45203bd7891f315302813bf9b0&amp;req=diEnFs1%2BlINeWPMW1HO4zZF3IhzaMf1WxakFVfq5WwxLXRzlZ4mRs2Ha%2B76v%0AzM7Rlx%2FudMIjKsP%2Bn5c%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2100409211/fc01614dde1a616fa31ffaa9cb04/47bacf5b-a810-45b5-a468-9769f1a58ef8?expires=1789796700&amp;signature=8cc962adb5036ac553f9fd78b4ac4248cc23da957a91f79160c48e1917540a09&amp;req=diEnFs1%2BlINeWPMW1HO4zZF3IhzaOvNSxakFVfq5Wwwq6ItfGJ0f3e0EGyPM%0ATwkJ%2BKvuiyVaHxolo08%3D%0A)
 
 If you're on the Enterprise plan and your organization has skill scanning turned on, plugins are checked for malicious content when they're installed or updated. A plugin with malicious content is blocked, and one that may carry risk shows a caution banner. Learn more about **[skill and plugin scanning](https://support.claude.com/en/articles/15927065)**.
 
@@ -50,7 +50,7 @@ If you're on the Enterprise plan and your organization has skill scanning turned
 
 Each plugin you install adds skills you can use while working with Claude. Type "/" or click the "+" button to see the available skills from your installed plugins, in chat and in Cowork. Click any skill to see its details.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2157396844/4a790e10f5b88df770783df1d7e9/image.png?expires=1789728300&amp;signature=baa223eaddea1acb0fb792c740f0dbc25be496097ae8b8049ddcc1cfe1434905&amp;req=diEiEcp3m4lbXfMW1HO4zf4NBP%2F7gUiXmKUxugP2BQu81aRWCL5wG%2FUV6BS%2B%0AhjhRmp%2FPt5is69oABpw%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2157396844/4a790e10f5b88df770783df1d7e9/image.png?expires=1789796700&amp;signature=bc258b7f82b6400590c56e462c86f342f3c7e61bf6ff2a758721beda2d9658e5&amp;req=diEiEcp3m4lbXfMW1HO4zf4NBP%2F7ikaTmKUxugP2BQvomt0LfgT3Xk9jNd%2Fj%0A1UYAlm4lUymOvd1%2FPJU%3D%0A)
 
 ---
 
diff --git a/content/support/13947068-assign-tasks-from-anywhere-in-claude-cowork.md b/content/support/13947068-assign-tasks-from-anywhere-in-claude-cowork.md
index ae84683eb3..b959230fa2 100644
--- a/content/support/13947068-assign-tasks-from-anywhere-in-claude-cowork.md
+++ b/content/support/13947068-assign-tasks-from-anywhere-in-claude-cowork.md
@@ -52,11 +52,11 @@ Follow these steps to get started:
 
 5. You’ll land on a page describing the functionality. Click “Get started”:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2169954086/419674f781edb2977b93cce062b4/93b1893c-d79a-4eb6-b2f1-2fe3e043bd90?expires=1789728300&amp;signature=7f577f21b0e609ed7743692761180f85721ef34c376f4e4ddd638c805843b5bc&amp;req=diEhH8B7mYFXX%2FMW1HO4zSZP0puMFwb8B32drIe5EDnvFjuwI3DEq2JNfrWL%0ANUS4%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2169954086/419674f781edb2977b93cce062b4/93b1893c-d79a-4eb6-b2f1-2fe3e043bd90?expires=1789796700&amp;signature=75494f276e92b8c1ff0be409074674a00334bc5a508f136bfa29f342f2a11fe0&amp;req=diEhH8B7mYFXX%2FMW1HO4zSZP0puMHAj4B32drIe5EDmGMx9Dyp5D1ifCVxaM%0Aphyq%0A)
 
 6. On the next screen, you can give Claude access to your files and keep your computer awake by toggling those on:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2169955082/de4053ee0eab8fcb9263584bb171/d39b77da-1a69-4682-9fdb-7ed488f236b0?expires=1789728300&amp;signature=22bb5d4c3ae0e18aae5b6ae975aaaf772117c649f34138deabfbb9dab3fb1424&amp;req=diEhH8B7mIFXW%2FMW1HO4zaZWs9OfXwkdepuGRb1rD3Lb5QJAZIs5fHCb08nY%0AjTct%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2169955082/de4053ee0eab8fcb9263584bb171/d39b77da-1a69-4682-9fdb-7ed488f236b0?expires=1789796700&amp;signature=0b059aa080116866462b214c108fd08fe9ed43aaaf83513b01c603ec6c33e72c&amp;req=diEhH8B7mIFXW%2FMW1HO4zaZWs9OfVAcZepuGRb1rD3IbXWnk5lEIFzdakU%2Bm%0AVMY2%0A)
 
 7. Click “Finish setup.”
 
diff --git a/content/support/14116274-organize-your-tasks-with-projects-in-claude-cowork.md b/content/support/14116274-organize-your-tasks-with-projects-in-claude-cowork.md
index 098ba8075c..d449ca2bff 100644
--- a/content/support/14116274-organize-your-tasks-with-projects-in-claude-cowork.md
+++ b/content/support/14116274-organize-your-tasks-with-projects-in-claude-cowork.md
@@ -24,23 +24,23 @@ Cowork is available for paid plans (Pro, Max, Team, Enterprise) on:
 
 Find **Projects** in the left navigation panel and click the “+” button to see the three different ways to create a project:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2183720240/6f6ef438913391703598d86d606c/CleanShot+2026-03-20+at+09_11_43.png?expires=1789728300&amp;signature=3342cb2e5b5829fd81526eb32176b10d28aa4c47a1d4c050358ddfd28e6fd0ee&amp;req=diEvFc58nYNbWfMW1HO4zcOgiwy90yB2ZwSvwegvtgyjbnyEaCDGCrOi9Cdt%0A%2Byqecapnqos%2F3XV0yN4%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2183720240/6f6ef438913391703598d86d606c/CleanShot+2026-03-20+at+09_11_43.png?expires=1789796700&amp;signature=5b92c77dae26aca1f102346f2dc9468abbd2fd33f686bc168938b80806077bd1&amp;req=diEvFc58nYNbWfMW1HO4zcOgiwy92C5yZwSvwegvtgxX9r5M%2BiiQ2W7PkTQK%0AGjRmyP0zaCA4zy1p0J8%3D%0A)
 
 ### Start from scratch
 
 Selecting “Start from scratch” allows you to set up a new folder with instructions and files:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2177090014/07832b50003cf7fd3b4e9c7c448b/3385d9b8-c3e7-42b9-ae3f-4d213baa53a7?expires=1789728300&amp;signature=bbee587bfdd9e04f8b0d0741bae3390977c5377de4b44e045f892c840a7ec9c5&amp;req=diEgEcl3nYFeXfMW1HO4zZCoQ4RCTH2Vvb0suCMAnj2P366hAcdUCu4r06mM%0AeZ0wKDoxA3OyfU9hZT8%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2177090014/07832b50003cf7fd3b4e9c7c448b/3385d9b8-c3e7-42b9-ae3f-4d213baa53a7?expires=1789796700&amp;signature=54acaa37f3dbc5cdab9a419d701a275e45d57d210839ea3c363cb93bdff9d971&amp;req=diEgEcl3nYFeXfMW1HO4zZCoQ4RCR3ORvb0suCMAnj0X1y70M3pNcaOVQ4Br%0A8dRy8QLh%2F%2BAPIFqqjNA%3D%0A)
 
 ### Import from a Claude project
 
 After selecting “Import from project,” you’ll see a “Search projects in Chat…” field:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2183717962/acdc11bcc825ae76a13f508365bc/CleanShot+2026-03-20+at+09_12_08.png?expires=1789728300&amp;signature=aba16c8a340c63c6bc1a5eeeb7a19338995ac2da2bd931972bc1db479fe11e5d&amp;req=diEvFc5%2FmohZW%2FMW1HO4zQQ7UGpayJAcjggUT7FIJz9q%2FZGEMP4HZrI%2BcGC7%0Aft9JxPU6O2Q%2FGbpuDVY%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2183717962/acdc11bcc825ae76a13f508365bc/CleanShot+2026-03-20+at+09_12_08.png?expires=1789796700&amp;signature=8158360ddf0afe421bc5902fe9962ff7a84a8c6132947d6e3850a27959455b24&amp;req=diEvFc5%2FmohZW%2FMW1HO4zQQ7UGpaw54YjggUT7FIJz9giFPSE%2BN3De6GzFsM%0AOdLWy4eqQnWww2AJZxE%3D%0A)
 
 Clicking into the field will display a drop-down showing your recent projects, but you can also use it to search all your projects. After you select a chat project (bulk upload is not supported), you can name the new Cowork project and choose where to save it on your computer:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2183727973/7a25430123d9e13e7c3cdd411f70/CleanShot+2026-03-20+at+09_13_41.png?expires=1789728300&amp;signature=6684556113b84085bc29895f263c203005ae479d874f8ea831193df996ecb98e&amp;req=diEvFc58mohYWvMW1HO4zU%2FKAipB%2FivPI7f%2FdY0VL6iIlgbLeg4eUeuxRvRY%0AmC3PhJ5kJRoEm3vmjO4%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2183727973/7a25430123d9e13e7c3cdd411f70/CleanShot+2026-03-20+at+09_13_41.png?expires=1789796700&amp;signature=eb15f1478447980606fac4dfb5fda0a1f362e2b8bc93c430e126116bd0c03c0c&amp;req=diEvFc58mohYWvMW1HO4zU%2FKAipB9SXLI7f%2FdY0VL6jskQAck3TlaWiL2Pk5%0ATYobB7sCAvmBk525utc%3D%0A)
 
 Clicking “Create” will transfer the files and instructions from your existing Claude project and create a new Cowork project.
 
@@ -48,11 +48,11 @@ Clicking “Create” will transfer the files and instructions from your existin
 
 If you select “Use an existing folder,” you’ll be prompted to pick a file to use as context for the new Cowork project:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2177087935/2f0052dae601d0b7fecdc029e1c3/2e3ca9e7-23b1-436e-bbdb-edcd31c41f15?expires=1789728300&amp;signature=bc6d9bbcf1819c9d47fb88ead93c1cf12ba7ccd0ff54ca24e6f580540794bc53&amp;req=diEgEcl2mohcXPMW1HO4zejrnz%2FRFytcuv8e2Xj2xOUfR8GctmogRXupTy6l%0Awr%2FD5LWpSLlqzbHOrFI%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2177087935/2f0052dae601d0b7fecdc029e1c3/2e3ca9e7-23b1-436e-bbdb-edcd31c41f15?expires=1789796700&amp;signature=7a2dedaf3c28d4ee054c2252be724708358c21d624ed2d9fcf56d25aba39e679&amp;req=diEgEcl2mohcXPMW1HO4zejrnz%2FRHCVYuv8e2Xj2xOWOFPSuegebyTi6Z7Ui%0AoAmxzCsi2pkE2yyOVq4%3D%0A)
 
 After selecting a folder, you can name the new Cowork project, choose where to save it on your computer, add instructions, and attach any additional files. Click “Create” to start using your new project:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2177087937/f59dbe3fc28448a9597ea097cb4d/96a59acb-4054-4b4b-a208-751f9711f535?expires=1789728300&amp;signature=2d955e81282be4bb481f3049d5de5ad2e4e19bcbae34bf4822fc001d4765c9fe&amp;req=diEgEcl2mohcXvMW1HO4zUq4V%2Bqzgao5MfnqHouW6MLLuXndlykeRJ4X1abe%0Ale8owc08lrFacdUzMcY%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2177087937/f59dbe3fc28448a9597ea097cb4d/96a59acb-4054-4b4b-a208-751f9711f535?expires=1789796700&amp;signature=883b1ed8ddaa4c75b23af5805c42855d4ec06103e5475481fd76f7a205f80488&amp;req=diEgEcl2mohcXvMW1HO4zUq4V%2BqziqQ9MfnqHouW6MJmMsyoii8LkOk32xVR%0AnRIeNIgeWsjgRyyb4hU%3D%0A)
 
 ---
 
diff --git a/content/support/14499648-how-scim-sync-works-for-enterprise-organizations.md b/content/support/14499648-how-scim-sync-works-for-enterprise-organizations.md
index cad9c23bdf..b7b2199aac 100644
--- a/content/support/14499648-how-scim-sync-works-for-enterprise-organizations.md
+++ b/content/support/14499648-how-scim-sync-works-for-enterprise-organizations.md
@@ -50,7 +50,7 @@ You can trigger a manual sync from two places in your admin settings.
 
 2. Click "Check for updates" under **SCIM sync**:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2312613548/44cd5970ee3c3b2c7f8dcd592d71/image+%2824%29.png?expires=1789728300&amp;signature=b436d45186a6ee47b768d4e3fa8bc970b5853ec160342b872ccebdd831d35237&amp;req=diMmFM9%2FnoRbUfMW1HO4zW4gbDyqN8W3rgfl7PnOiulIB%2BHrIwwlB9emOwXY%0ACPY3%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2312613548/44cd5970ee3c3b2c7f8dcd592d71/image+%2824%29.png?expires=1789796700&amp;signature=7acc7d526c846b090f2e321466c004060036b3fdd1dcc00dd6b5029ee2ac9f07&amp;req=diMmFM9%2FnoRbUfMW1HO4zW4gbDyqPMuzrgfl7PnOiukzHgGV2Z9RkzWZnAsn%0ADf2%2F%0A)
 
 3. Select whether to sync members, groups, or both.
 
@@ -62,7 +62,7 @@ You can trigger a manual sync from two places in your admin settings.
 
 3. Select whether to sync members, groups, or both:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2312608119/e4b0ef4f309f3c4eac8311a6ef47/image.png?expires=1789728300&amp;signature=e88e2d3ba14fadad8ce05f321c8df2ec85fcf76b30697e4020fad6ba3c15ace1&amp;req=diMmFM9%2BlYBeUPMW1HO4zX%2F4frP3yTMc43OpyTHzM9S344SPeyfd9hi9TbDU%0AFTSh%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2312608119/e4b0ef4f309f3c4eac8311a6ef47/image.png?expires=1789796700&amp;signature=d759030ea94ea985b78d98f8de176bf560faecf28558bf245ee960a39fe1c33a&amp;req=diMmFM9%2BlYBeUPMW1HO4zX%2F4frP3wj0Y43OpyTHzM9QykUhK4VHqPT1%2BQ5vG%0AkiZN%0A)
 
 **Note:** If you trigger a manual sync while background changes are processing, your organization takes the most recent change for each member or group. If multiple changes are queued for the same member or group, you may need to resync again to make sure everything applies correctly.
 
diff --git a/content/support/14503590-get-started-with-claude-for-government.md b/content/support/14503590-get-started-with-claude-for-government.md
index b516869dd7..7c46be1dc2 100644
--- a/content/support/14503590-get-started-with-claude-for-government.md
+++ b/content/support/14503590-get-started-with-claude-for-government.md
@@ -1,55 +1,11 @@
 # Get started with Claude for Government
 
+**Important:** All organizations will move to the updated Claude for Government (Desktop) offering by October 4, 2026. If your agency has already moved, see the **[Claude for Government administrator guide](https://claude.com/docs/government)** for current documentation for getting started.
+
 ## What is Claude for Government?
 
 Claude for Government brings Anthropic's Claude AI to environments requiring the highest security authorization levels. It delivers the same frontier reasoning, writing, and analysis capabilities that power Claude—deployed inside a FedRAMP High–authorized environment with the security controls, compliance authorizations, and procurement pathways that government agencies and high-security public sector enterprises require. Claude for Government gives teams direct access to Claude's most capable models for drafting, research, analysis, and coding, while meeting the stringent data handling and auditability standards of federal and state government missions.
 
 ## How do I access Claude for Government?
 
-Claude for Government is available to U.S. federal, state, and local government agencies and qualifying public sector organizations. To learn more or get started, contact Anthropic's public sector Sales team via the **[Contact sales form](https://claude.com/contact-sales)** (choose "Contact sales" for **What can we help you with?**) and select "Government & Public Sector" for the **Industry** field.
-
-## Product differentiation between Claude for Government and Claude Enterprise
-
-Claude for Government is built on the same foundation as Claude Enterprise but operates inside an isolated, dedicated FedRAMP boundary that provides additional compliance and security guarantees:
-
-- **FedRAMP High authorization.** Claude for Government operates under a FedRAMP High Authorization to Operate, meeting stringent federal security control baselines. Claude Enterprise operates on Anthropic's commercial infrastructure.
-
-- **Dedicated government environment.** Claude for Government is logically isolated from commercial tenants and hosted through Anthropic's government-authorized partner infrastructure. This supports agency data residency and boundary requirements.
-
-- **Classification banner support.** Claude for Government includes classification banner display at the application level for environments that require it—not available on the commercial Enterprise plan.
-
-- **Feature availability.** Core Enterprise features—projects, artifacts, integrations, audit logs, admin controls—are available in Claude for Government. New features are often available in Claude for Government shortly following their launch in the enterprise environment. In some cases, however, new features may either require additional compliance review or may not be supported in Claude for Government.
-
-## Which product is right for you?
-
-Choose Claude for Government if your agency requires FedRAMP-High authorization, handles CUI or sensitive data, or has compliance requirements that mandate an authorized cloud environment. This is the recommended choice for most federal civilian deployments.
-
-Choose Claude Enterprise if your use case involves only publicly available information, you need access to the latest commercial features immediately, or compliance requirements permit commercial cloud infrastructure.
-
-## Compliance and certifications
-
-### FedRAMP High
-
-Claude for Government is authorized at the FedRAMP High impact level. The authorization is held through Palantir Federal Cloud Service – Supporting Services (PFCS-SS), with independent assessment performed by Schellman Compliance, LLC.
-
-### Where to find compliance documentation
-
-Agencies can access compliance documentation through Anthropic's Trust Center. Instructions for requesting the full Claude for Government ATO package are available on request from your public sector contact.
-
-## Data handling
-
-Claude for Government is designed to give agencies control over their data.
-
-- By default, conversations and uploaded content in Claude for Government are not used to train Anthropic's models.
-
-- Encryption is applied in transit (TLS) and at rest.
-
-- A detailed Data Control, Visibility, and Retention overview is available and can be tailored to your agency's specific configuration.
-
-## Pricing and how to purchase
-
-There are two ways to procure Claude for Government, directly via Anthropic’s Sales team and via Carahsoft for customers requiring services via a GSA approved vehicle.
-
-Claude for Government is licensed on an annual, per-seat basis. A limited-time program currently makes Claude for Government available to federal agencies at $1 per agency (unlimited seats) through August 2026.
-
-Contact the public sector Sales team for current pricing for state, local, and non-federal public sector customers.
\ No newline at end of file
+Claude for Government is available to U.S. federal, state, and local government agencies and qualifying public sector organizations. To learn more or get started, see the **[Claude for Government administrator guide](https://claude.com/docs/government/overview)** or contact **[our Sales team](https://claude.com/solutions/government)**.
\ No newline at end of file
diff --git a/content/support/14503613-sso-login.md b/content/support/14503613-sso-login.md
index 0d4d9ea767..e04b5fe1ba 100644
--- a/content/support/14503613-sso-login.md
+++ b/content/support/14503613-sso-login.md
@@ -47,9 +47,9 @@ Before configuring your Identity Provider (IdP), you must verify ownership of yo
 
 3. Wait for the DNS propagation. Once the platform detects the record, the domain status will update to “**Verified**.”
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2256015862/476131c3139aec4db01b96127544/10c7a165-8b26-4443-b064-9d659659c65e?expires=1789728300&amp;signature=7cfdb2f8d3a95e4e6e0345e822f54abe0f2e138fa754e8be4a019a360b330965&amp;req=diIiEMl%2FmIlZW%2FMW1HO4zdpfuCOPGFuM006zz1SmF9XyjpVbwHWnm9nQFNPU%0AyoUjhEMFlc9xTW%2BqmRE%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2256015862/476131c3139aec4db01b96127544/10c7a165-8b26-4443-b064-9d659659c65e?expires=1789796700&amp;signature=34ea6e4652a18c28e14a878d7de40935d49f0594d0c47be7794c99f0086ef627&amp;req=diIiEMl%2FmIlZW%2FMW1HO4zdpfuCOPE1WI006zz1SmF9VQHErL56mWC2AiMXRM%0AxZ3IEt2ThPBitWcHeY4%3D%0A)
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2256025910/a82e2de9382824fa9db7666f67c4/CleanShot%2B2026-04-09%2Bat%2B16_25_20-402x.png?expires=1789728300&amp;signature=66427dc4435ba3847327536375456b8310ed42528a8cb732e0da565090d72267&amp;req=diIiEMl8mIheWfMW1HO4zV%2BGnRA4QbdEx57dwYq5DdKpmFvhsFNGGtZ4Hlby%0AoULJaDV0BXXVCqGenzs%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2256025910/a82e2de9382824fa9db7666f67c4/CleanShot%2B2026-04-09%2Bat%2B16_25_20-402x.png?expires=1789796700&amp;signature=5262936e7c0700f2835fd4a6c51a435d942dad5d38d8788318f454ad817e1e6f&amp;req=diIiEMl8mIheWfMW1HO4zV%2BGnRA4SrlAx57dwYq5DdI6RF6VYD8aDeUDJkTj%0AMwamX80EhXaqlbn%2F8qY%3D%0A)
 
 **Important:** Each domain can only have one identity provider. If multiple organizations share a single login domain, IT administrators from both organizations will be able to modify login settings. Contact **[Anthropic Support](https://claude.fedstart.com/support)** for assistance with multi-organization setups. For more details about multi-organization setups, see our **[SCIM provisioning guide](https://support.claude.com/en/articles/14503643-set-up-scim-in-claude-for-government)**.
 
@@ -77,7 +77,7 @@ Once your SAML application is set up in your IdP, provide Anthropic with the det
 
 - Claims Information — Attribute mappings for user name and email.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2256004522/a97b91092b393e93b2d7779f63e6/2db86a6d-1582-419e-925e-cbc914468fa1?expires=1789728300&amp;signature=6cc9a07c0978579cfbbf0e093cd62a7c5f13b44e86a22ed6b1916ebf2392c50d&amp;req=diIiEMl%2BmYRdW%2FMW1HO4zQE9Jr6x%2BBz4bfNHh%2Fvd8OGOCpJxMvXk5tyoInmN%0AGRTcjqnWopgJ0ODMMv0%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2256004522/a97b91092b393e93b2d7779f63e6/2db86a6d-1582-419e-925e-cbc914468fa1?expires=1789796700&amp;signature=33709715131772cc9a18fa9ed8cb06bc5df58fabfec9ab53fb089feb8a7f9ec4&amp;req=diIiEMl%2BmYRdW%2FMW1HO4zQE9Jr6x8xL8bfNHh%2Fvd8OGLH3i1PJtmJbUwkYAE%0AI25GkyGIQdRrAmkwuJM%3D%0A)
 
 **Tip:** Using a metadata XML file: Most IdPs let you download a metadata.xml file. Upload it on the identity settings page to auto-fill the Signing Certificate, IdP Entity ID, and SSO URL. Some IdPs (like Entra ID) also include claims information in the metadata file; if present, the system will suggest field mappings automatically.
 
diff --git a/content/support/14503643-set-up-scim-in-claude-for-government.md b/content/support/14503643-set-up-scim-in-claude-for-government.md
index 17ea0f503c..787b6ff133 100644
--- a/content/support/14503643-set-up-scim-in-claude-for-government.md
+++ b/content/support/14503643-set-up-scim-in-claude-for-government.md
@@ -41,7 +41,7 @@ With SCIM, login and provisioning are separate. Your IdP tells Anthropic who sho
 
 **Important**: Store this key securely. It cannot be retrieved after you leave the page.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2256040196/c3b045028c4c2edef9172b6fb424/9a71258e-ae73-41e3-83a2-d24a240ac0ae?expires=1789728300&amp;signature=7822efb9ce2e51fd71dd119d235f11e11e21ff330394e8906d40e10612b109fa&amp;req=diIiEMl6nYBWX%2FMW1HO4zSrRlaUYaz4XyIvvU1hav7M6%2FdjhPfe%2BYP1gMP4v%0AMVWSUty%2BX%2BdLbxbBh7E%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2256040196/c3b045028c4c2edef9172b6fb424/9a71258e-ae73-41e3-83a2-d24a240ac0ae?expires=1789796700&amp;signature=43c705d38701c6c6ec624129e93e26e3c93878f9f5f73ecf0a71199e8e6d6c0b&amp;req=diIiEMl6nYBWX%2FMW1HO4zSrRlaUYYDATyIvvU1hav7OYEIpnQV3kebyqRZKy%0AXfhuPcIgYHq71MN40jk%3D%0A)
 
 ### Step 2: Configure SCIM in your Identity Provider
 
@@ -67,7 +67,7 @@ After enabling the integration in your IdP:
 
 **Warning**: When you fully enable SCIM provisioning, any users who were **not** synced via SCIM will be removed from the organization. Confirm that all expected users appear in the sync before proceeding.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2256040198/da9188b8b968d5f900cc08e9ceb2/3814ab37-c3fa-4256-8d16-49c1e1b4c654?expires=1789728300&amp;signature=76561cef0be965b3aa5b15929aea25a5f254c919c4cc71a56edce594409013e6&amp;req=diIiEMl6nYBWUfMW1HO4zeLvMlFoSET5oWupW8zJgMocNcPyRl%2B74m7cwMfl%0AgVPef4WqSiaQoY5E2o0%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2256040198/da9188b8b968d5f900cc08e9ceb2/3814ab37-c3fa-4256-8d16-49c1e1b4c654?expires=1789796700&amp;signature=f7a10810edfc525cceacbdc41fdaa96e19033f36f5d788510b731c43386a147b&amp;req=diIiEMl6nYBWUfMW1HO4zeLvMlFoQ0r9oWupW8zJgMrUB8T%2FErvdCMyVr6Yc%0AGtIIqzlK1CIure7Rsog%3D%0A)
 
 ### Step 4: Map groups to roles and seat tiers
 
@@ -83,7 +83,7 @@ SCIM provisioning uses IdP groups to assign roles and seat tiers within Claude f
 
 3. Save your mappings.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2256056441/f7eb09bba549e9861fc81b961cc7/2760fa5b-87bb-491f-9354-ca3cd2bc4475?expires=1789728300&amp;signature=ad58fc28631ff4a068de1b242a25c98c66ab51ecec34af5622c0c473ef44cd0b&amp;req=diIiEMl7m4VbWPMW1HO4zaWhsXolsE8Yh340B79BYGby7VsUYHp4fDWVddX2%0AEumoBMMj9JQdnzBCXy8%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2256056441/f7eb09bba549e9861fc81b961cc7/2760fa5b-87bb-491f-9354-ca3cd2bc4475?expires=1789796700&amp;signature=9fdcf0f82ba8f2d98000692275512f98cb5a19a9940d38c0a7d69946dd9d0b7e&amp;req=diIiEMl7m4VbWPMW1HO4zaWhsXolu0Ech340B79BYGZahsefL1dKNt6kMUJt%0AYK1fFgq48mVImbXtMd8%3D%0A)
 
 If you manage multiple organizations under a single parent (see below), each organization maintains its own role and seat tier mappings. Switch between organizations using the organization selector in the bottom-left corner of the page.
 
diff --git a/content/support/14503775-mcp-web-search.md b/content/support/14503775-mcp-web-search.md
index 914ea14e52..fcf2a2dcf9 100644
--- a/content/support/14503775-mcp-web-search.md
+++ b/content/support/14503775-mcp-web-search.md
@@ -4,7 +4,7 @@ The Web Search connector gives Claude the ability to search the public internet
 
 For questions about web search in commercial Claude, see **[Enabling and using web search](https://support.claude.com/en/articles/10684626-enabling-and-using-web-search)**.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2256120763/7652c6c669446113eae75f3c5977/9c74d57e-aaa2-4f1c-bfe4-2b9b87fd41ab?expires=1789728300&amp;signature=e49b1c3a91db6fdc08edf91ba770a5264197b864ba8e903895e1fb9b44078419&amp;req=diIiEMh8nYZZWvMW1HO4zQvFLLtUj8z7M%2Fw5SJgC29GcNeBuFbpLsRSJdjKM%0AJH%2FSW8IX0Wpmlmszc6c%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2256120763/7652c6c669446113eae75f3c5977/9c74d57e-aaa2-4f1c-bfe4-2b9b87fd41ab?expires=1789796700&amp;signature=73b6ac30d9533f651dfcffbdead0b56f48a94f4e8df5ddf81ab5198501d9641b&amp;req=diIiEMh8nYZZWvMW1HO4zQvFLLtUhML%2FM%2Fw5SJgC29HyaIPU%2Bjf0iLWRMMzm%0AFavRzn2hBv3lRf8IjeI%3D%0A)
 
 ## How Web Search differs for Claude for Government
 
diff --git a/content/support/14604397-set-up-your-design-system-in-claude-design.md b/content/support/14604397-set-up-your-design-system-in-claude-design.md
index 685f25827e..49abd3be2f 100644
--- a/content/support/14604397-set-up-your-design-system-in-claude-design.md
+++ b/content/support/14604397-set-up-your-design-system-in-claude-design.md
@@ -74,7 +74,7 @@ To validate your design system, create a test project and see if the output matc
 
 Once you’re satisfied with the design system quality, make sure the “Published” toggle is switched on. After publishing, any projects created from the Claude Design homescreen while in your organization will use your design system instead of the default.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2287527007/b1c46cb8dba4cd7e8bbea85fb0c3/2819c6cf-9ce1-4df5-84c8-feae0164bf2e?expires=1789728300&amp;signature=46073aedfba7ad4fdce4ad0601c2912283b0c75ea4c77d80e4c8c7cd8b637bc7&amp;req=diIvEcx8moFfXvMW1HO4zWNHF%2FuMDDMUIQKNMXlu0T9JqluE35ASU9O22%2BJ7%0AAdZXs5OiyTf7d8ewVv8%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2287527007/b1c46cb8dba4cd7e8bbea85fb0c3/2819c6cf-9ce1-4df5-84c8-feae0164bf2e?expires=1789796700&amp;signature=6f1fb8ae1740aff0e5bf056b78dd90ec5c110e2c7b6c1ea24a6597cd0972a321&amp;req=diIvEcx8moFfXvMW1HO4zWNHF%2FuMBz0QIQKNMXlu0T89NTLjcxdQIj8HbdHj%0A6vXTXwbeiPGp7TmEd48%3D%0A)
 
 ## Other ways to create a design system
 
diff --git a/content/support/14604416-get-started-with-claude-design.md b/content/support/14604416-get-started-with-claude-design.md
index 440b391bce..98ff1e337a 100644
--- a/content/support/14604416-get-started-with-claude-design.md
+++ b/content/support/14604416-get-started-with-claude-design.md
@@ -1,6 +1,6 @@
 # Get started with Claude Design
 
-**[Claude Design](https://claude.ai/design)** lets you create designs, interactive prototypes, one-pagers, and other visual work by having a conversation with Claude. You can use it in any conversation with Claude, including in Claude Code and the Artifacts tab, and all of its features come with it, including on-canvas editing and importing your design system. To make presentations, use Claude Slides. This guide walks you through creating your first design, iterating on it, and getting the most out of the tool.
+**[Claude Design](https://claude.com/product/design)** lets you create designs, interactive prototypes, one-pagers, and other visual work by having a conversation with Claude. You can use it in any conversation with Claude, including in Claude Code and the Artifacts tab, and all of its features come with it, including on-canvas editing and importing your design system. To make presentations, use Claude Slides. This guide walks you through creating your first design, iterating on it, and getting the most out of the tool.
 
 Claude Design is available in beta on Pro, Max, Team, and Enterprise plans. It isn't available on the Free plan. It's on by default on Pro and Max plans, and you can turn it off in Settings > Capabilities. It's also on by default on Team plans. On Enterprise plans, it's off by default until an owner turns it on in **[Organization settings > Artifacts](https://claude.ai/admin-settings/artifacts)**. The standalone Claude Design experience at claude.ai/design keeps working and has its own separate setting.
 
@@ -166,7 +166,7 @@ Use the “Export” button in the upper right corner when viewing your project
 
   - Send to Claude Code Web
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2675065762/1a4b6d1921e063e14420f56a72d6/72422fce-b339-49b6-bc59-bebf752e0644?expires=1789728300&amp;signature=394f113656f01d6742a011aaf290917f550469e415496172eacf33901846152d&amp;req=diYgE8l4mIZZW%2FMW1HO4zYaJOofwHJT6T73yd%2FWN6blxYDv1EUDR2LvwRa69%0Ake2k1KZJuBcXIxcdY%2FQ%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2675065762/1a4b6d1921e063e14420f56a72d6/72422fce-b339-49b6-bc59-bebf752e0644?expires=1789905600&amp;signature=d65ee746f9fdbdfc3a2f321bfbadb6b180c57c5bb3bdf9ba172c416bb9b0925d&amp;req=diYgE8l4mIZZW%2FMW3nq%2BgSZsMZfe9b%2F%2BDiWXzwAXv0dTu51%2BpQ4r%2FkfHofM7%0A2LNuLH2Lfo%2Bddt0Yg0jmqMN7jC8%3D%0A)
 
 Designs are private until you share them:
 
diff --git a/content/support/15330088-set-a-default-model-for-your-organization.md b/content/support/15330088-set-a-default-model-for-your-organization.md
index 8d7889b294..9583351380 100644
--- a/content/support/15330088-set-a-default-model-for-your-organization.md
+++ b/content/support/15330088-set-a-default-model-for-your-organization.md
@@ -50,7 +50,7 @@ The organization default applies to every member. To set it:
 
 4. Click “Save changes.”
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2514722139/d05c94072a41ea9090ecf386c53e/c32ee31d-954a-4551-a2da-91677fbd0b6f?expires=1789727400&amp;signature=f916d481f7b9c9d05f5840306b819d17de21a1ec4a788d32a7e7e04a9d34adf5&amp;req=diUmEs58n4BcUPMW1HO4zelOdztHL09DfdGVZ664dGGM5WPT2CO6PUcEo4qp%0AaTlRGgaWxmhUaF1jnRo%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2514722139/d05c94072a41ea9090ecf386c53e/c32ee31d-954a-4551-a2da-91677fbd0b6f?expires=1789796700&amp;signature=45cee437a1a0c1d776c29ec748bbdadcacfe0b6baa5d483477f714c1cd27253d&amp;req=diUmEs58n4BcUPMW1HO4zelOdztHJE5AfdGVZ664dGE1mpLl8Ei9agwZp%2BPj%0AtIFRz8x8%2B1S7wNO323w%3D%0A)
 
 ---
 
diff --git a/content/support/15694740-manage-model-access-for-your-organization.md b/content/support/15694740-manage-model-access-for-your-organization.md
index 30a309aba4..c08d98be7a 100644
--- a/content/support/15694740-manage-model-access-for-your-organization.md
+++ b/content/support/15694740-manage-model-access-for-your-organization.md
@@ -42,9 +42,9 @@ The organization setting is the ceiling. A role can't grant access to a model th
 
 If any custom role uses the model you’re disabling as its default, you’ll be prompted to change that role’s default before the change can be saved.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2514693921/02ea72756f5163f14e5d158516dc/69102088-cd86-498e-97aa-c8a6e0004419?expires=1789727400&amp;signature=dc500d2db71a4bed2e19c03bf8de1fe0de767eee29cf5127d550034cebd22cb2&amp;req=diUmEs93nohdWPMW1HO4zXlxEu6%2BVdZTQf5Pb7M2Q0sZPJIQiZXYnDxhhpVB%0AztanQonG2BADXh%2BHZb4%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2514693921/02ea72756f5163f14e5d158516dc/69102088-cd86-498e-97aa-c8a6e0004419?expires=1789796700&amp;signature=b74be6e9e92b4e708688e5a723d91f4094c6e83cad0ff7c23bc1ba5faec52d15&amp;req=diUmEs93nohdWPMW1HO4zXlxEu6%2BXtdQQf5Pb7M2Q0t9BWfk712zC9IITNzB%0AwhFOv6rIfs1D%2BWjS0J8%3D%0A)
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2514693922/bfc5de6626eb19dca1d7caf818ca/c3cd8bb6-f86c-4d01-92da-6ae4ca966662?expires=1789727400&amp;signature=9f25b2a50b991f87c0b49d61473c25cea4074e4e6b9e9f61c6aea9395afe082c&amp;req=diUmEs93nohdW%2FMW1HO4zTqNsYDCRF9TAod9uc510lwvY%2B9Nu8xzSdxmsVSW%0A0d%2B0SUThH1AJ5dNceGY%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2514693922/bfc5de6626eb19dca1d7caf818ca/c3cd8bb6-f86c-4d01-92da-6ae4ca966662?expires=1789796700&amp;signature=2c6500693442832e6e5667ef1b088d657e29214974cd5c1133ccd009718f50cf&amp;req=diUmEs93nohdW%2FMW1HO4zTqNsYDCT15QAod9uc510ly529feZIVk7S4wzkQR%0A9FozigQDYdl9S%2Bv%2FlCA%3D%0A)
 
 ---
 
@@ -78,7 +78,7 @@ If any custom role has an effort cap higher than the new organization cap for th
 
 Only models the role grants access to can be selected as that role’s default model.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2514693923/880665a87dbd4776cf19d6063a37/29d30c6d-f9fc-408c-8c72-4320c6d88d14?expires=1789727400&amp;signature=0210f5ff06e8ccfd6c6cfe09b3f68715e99397a05b91dcd50102e8fab9edb4cf&amp;req=diUmEs93nohdWvMW1HO4zYj9SfwE74a5XsqpNqvyFRL9ZvQbbDhsJ2UwBXxQ%0AfGDK8GPwTSazVf0VPhI%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2514693923/880665a87dbd4776cf19d6063a37/29d30c6d-f9fc-408c-8c72-4320c6d88d14?expires=1789796700&amp;signature=c179048bccc5e3da35b9bc548c53001ce99c17adf4b85ecf9218f72edfb0beac&amp;req=diUmEs93nohdWvMW1HO4zYj9SfwE5Ie6XsqpNqvyFRKhw52mgt4pCPjcCEjA%0AFgmPFDU%2FAhJot2iz03U%3D%0A)
 
 ---
 
@@ -96,7 +96,7 @@ Effort limits determine how much computation members on a role can apply per res
 
 5. Click "Save" to save your changes.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2514693927/7a25673b3b075d72adb3cdc371e3/d2d7cd8d-a713-4e91-a706-f589ac46a9fe?expires=1789727400&amp;signature=937e0fd5b3982b786535bf8fbf6a43c49fa4572ffe6a86f660b2469f505bb3ed&amp;req=diUmEs93nohdXvMW1HO4ze1xBjq7cb4dDeA1RkowXUHIFqoytHZyIaC7xZyN%0AallzPmNeqSwsYTRLZKI%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2514693927/7a25673b3b075d72adb3cdc371e3/d2d7cd8d-a713-4e91-a706-f589ac46a9fe?expires=1789796700&amp;signature=f9ca98627b8bd22b651f078d2bfb6b41925e386e404399a8ad0ad89b2419c684&amp;req=diUmEs93nohdXvMW1HO4ze1xBjq7er8eDeA1RkowXUHIJpzvviu0FP4V7eCf%0A2YGCqc6124fRQeR6DoA%3D%0A)
 
 Members on the role see only effort levels at or below the cap in their model menu. Note that available effort levels differ depending on the model, and some models don’t support effort level settings at all. For an explanation of each level, see **[Change the model, effort, and thinking settings](https://support.claude.com/en/articles/8664678)**.
 
diff --git a/content/support/15936181-get-started-with-1password-for-claude.md b/content/support/15936181-get-started-with-1password-for-claude.md
index 4f92e63f67..9d96b7a362 100644
--- a/content/support/15936181-get-started-with-1password-for-claude.md
+++ b/content/support/15936181-get-started-with-1password-for-claude.md
@@ -52,7 +52,7 @@ Once the requirements are in place, you can set up 1Password from a few places i
 
 4. Toggle on **Password managers**:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2546126596/ba71ca47e2df21cec62c243831f8/5b1c67e1-607d-4c73-8f61-d1ceb081082a?expires=1789727400&amp;signature=27b3e733006ee137f23d92b64fde075b326347e9241ce9e78f2632d024376bfd&amp;req=diUjEMh8m4RWX%2FMW1HO4zU5lnmJpr8JnGkiu4hEpcPVbEtEY19UxtS68qqh1%0ATZwW8QfqkSGPRKbmA0U%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2546126596/ba71ca47e2df21cec62c243831f8/5b1c67e1-607d-4c73-8f61-d1ceb081082a?expires=1789796700&amp;signature=ec31100fdfe03edbc32aff89623d4e28cbbdcca4010f32777fa24e94ebe80a76&amp;req=diUjEMh8m4RWX%2FMW1HO4zU5lnmJppMNkGkiu4hEpcPWL3qo43vvPsq6wAUZc%0Ac%2BqyR4UKfOtX90pMjxs%3D%0A)
 
 Once enabled, eligible users will see the discovery options above. Users still need to install and set up the required apps and extensions themselves.
 
diff --git a/content/support/16607638-understanding-your-pro-or-max-plan-invoices.md b/content/support/16607638-understanding-your-pro-or-max-plan-invoices.md
index 3e20ac24c5..80e40225b9 100644
--- a/content/support/16607638-understanding-your-pro-or-max-plan-invoices.md
+++ b/content/support/16607638-understanding-your-pro-or-max-plan-invoices.md
@@ -40,7 +40,7 @@ You can also open any invoice from your account:
 
 **Amount due.** The invoice total minus any applied balance. This is what your payment method was charged.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2629072970/c514f489b65072ccad08e803864f/e8c7a7de-905f-4a40-815f-c9c66edcdbf6?expires=1789727400&amp;signature=49abb1f37725833067ba2947d62846bed5ee69c81368b1d08edb38d2b5d860d5&amp;req=diYlH8l5n4hYWfMW1HO4zdWraBg47FMaPZYKVlMiWEWhr6l7IwYII5hKHlOd%0A7yNgEYrtF8Wv%2FdH41U4%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2629072970/c514f489b65072ccad08e803864f/e8c7a7de-905f-4a40-815f-c9c66edcdbf6?expires=1789796700&amp;signature=994bcb419c904fd23a4f23a89b9661550fedbdf2cdae8441e8f28f1ee4751926&amp;req=diYlH8l5n4hYWfMW1HO4zdWraBg451IZPZYKVlMiWEXP3JpbMA8jvjYfBrWd%0AdfG0dW556ANmH1GF8rk%3D%0A)
 
 ## Billing details on your invoice
 
diff --git a/content/support/16764810-assign-a-program-to-workspaces-in-claude-console.md b/content/support/16764810-assign-a-program-to-workspaces-in-claude-console.md
index 07d63e41c5..df99e1b6dc 100644
--- a/content/support/16764810-assign-a-program-to-workspaces-in-claude-console.md
+++ b/content/support/16764810-assign-a-program-to-workspaces-in-claude-console.md
@@ -20,27 +20,27 @@ In the Console, programs are issued to your organization and apply to workspaces
 
 1. **[Sign in to the Console](https://platform.claude.com/)** as an organization Admin. Go to **[Organization settings > Programs](https://platform.claude.com/settings/organization/programs)**. The program card shows whether it applies automatically or needs workspaces assigned.
 
-  ![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2642744587/d4584e035604f3b7c08afa53a1c6/ee1183ff-e591-4484-a989-1f754245d39c?expires=1789727400&amp;signature=4c8c12e2850975e49da17d486499b446a8c183c0c51886553155e09d46966abc&amp;req=diYjFM56mYRXXvMW1HO4zT%2FymECAFg6jktHcEoeKC4cwjj0aFy7MJtcpfTgg%0ASN7u%0A)
+  ![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2642744587/d4584e035604f3b7c08afa53a1c6/ee1183ff-e591-4484-a989-1f754245d39c?expires=1789796700&amp;signature=f161c7515d78705b501f5a184c76d4b83d86deb9937af52e1cc9e97fa379ec70&amp;req=diYjFM56mYRXXvMW1HO4zT%2FymECAHQ%2BgktHcEoeKC4drV4YXyvSzXgh6ci8W%0ASnu2%0A)
 
 2. Select the program to open its page. The **Workspaces** table shows each workspace's status. A workspace marked with an issue does not meet a requirement yet.
 
-  ![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2642745562/253e55a3292b35f728fb5dc89fb2/0878a8a9-dce5-4df2-9826-3796605b52a0?expires=1789727400&amp;signature=15d22f5c03c2b647da23211d384d57e39675658eaa16e0c90b5649600a6aa601&amp;req=diYjFM56mIRZW%2FMW1HO4zc116gdvQle1MCr%2B42fbmkbI9Jfq4apigcFqY1kS%0AR2Vh%0A)
+  ![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2642745562/253e55a3292b35f728fb5dc89fb2/0878a8a9-dce5-4df2-9826-3796605b52a0?expires=1789796700&amp;signature=c37331169773fd9d3ca638fa54a1a5434ca2cf0d5472c00737004a5ad0b636d1&amp;req=diYjFM56mIRZW%2FMW1HO4zc116gdvSVa2MCr%2B42fbmkZ2wdFsh%2BEPLcjcfwDp%0Aqss2%0A)
 
 Hover over the issue to see which requirement is not met.
 
-  ![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2642746466/c49291119729e99f4dba8ec924e4/3f802c0e-7fbc-4e80-935a-05da58f65bde?expires=1789727400&amp;signature=4e18b58bc5a0e63abb60acaaa7d57e852cea8c5b346d2a14159ca38fb79d5755&amp;req=diYjFM56m4VZX%2FMW1HO4zaveae9llHrEVPpeIJbmktT09CCRs17m5SZGeHAc%0AJXUe%0A)
+  ![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2642746466/c49291119729e99f4dba8ec924e4/3f802c0e-7fbc-4e80-935a-05da58f65bde?expires=1789796700&amp;signature=8b93cdfe2cad3a7a4959660885231d3d31988e3b11f3bf53da187ed4502d7727&amp;req=diYjFM56m4VZX%2FMW1HO4zaveae9ln3vHVPpeIJbmktQmF0KKw4N7CN6mix5u%0A2%2Fur%0A)
 
 3. To give a workspace access, make it meet the requirements. Open the workspace, select "Manage," then "Programs," and check the **Qualifications** panel.
 
-  ![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2642768117/1304e6b1350fc9bd88c4238a00e3/db606eb5-39d5-4309-a5a9-ee33847fc233?expires=1789727400&amp;signature=90f4a3df63c096a9e45d17e5cab91208849eeae816ed990a6867cdbe0b25f9d8&amp;req=diYjFM54lYBeXvMW1HO4zTU0lNKXKUFD9BWcjfiNKI1WsHEWjeddWokHaZQa%0AVRcs%0A)
+  ![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2642768117/1304e6b1350fc9bd88c4238a00e3/db606eb5-39d5-4309-a5a9-ee33847fc233?expires=1789796700&amp;signature=db95c55cea787ae63e06010b17d1d7810a579ccfad869e0b2902a5e34f639d8b&amp;req=diYjFM54lYBeXvMW1HO4zTU0lNKXIkBA9BWcjfiNKI0nbeoiI0ThxAv%2F3un3%0A5b4W%0A)
 
 4. Fix the requirement. For the Cyber Verification Program, turn on data retention under Manage, then Privacy controls. Then select "Rerun."
 
-  ![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2642746995/87151a11687a9c631b7a9d681390/d40a6c12-283d-4b3b-b6d6-9f631a73e7c0?expires=1789727400&amp;signature=417000be77797c8cb44f08743b8bca39bacbbdab7f56ea55b14b82066c378035&amp;req=diYjFM56m4hWXPMW1HO4zQfcHTKp7Xkv9apHi%2BiM8oiZ1vd%2ButRZISFF13LC%0ALgc%2B%0A)
+  ![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2642746995/87151a11687a9c631b7a9d681390/d40a6c12-283d-4b3b-b6d6-9f631a73e7c0?expires=1789796700&amp;signature=ae2ea8a4cd14847d0bbfbcb1ec5be6a91b087fba31dac319b1b0fe47aaacf607&amp;req=diYjFM56m4hWXPMW1HO4zQfcHTKp5ngs9apHi%2BiM8oirLU8BVepRY3KC1XxD%0AT6Uf%0A)
 
 5. The program shows **Active** for the workspace.
 
-  ![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2642747200/a18bdccde474c9f4eba371cf6050/b0e9d5e3-1e5f-4f27-b682-5684084f92e8?expires=1789727400&amp;signature=904e1708d6948a39265df34259918e96bacf2476a5365f03bffe11425eaa2921&amp;req=diYjFM56moNfWfMW1HO4zaUR8q9g9Pk8fTukdAE3MWtJ3zndqbTQOBzIp%2BdY%0ACkMs%0A)
+  ![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2642747200/a18bdccde474c9f4eba371cf6050/b0e9d5e3-1e5f-4f27-b682-5684084f92e8?expires=1789796700&amp;signature=9a63d11f7bd15d6afd1f1cfbabb68413c3921b471edd77a01ef34fe351c99e51&amp;req=diYjFM56moNfWfMW1HO4zaUR8q9g%2F%2Fg%2FfTukdAE3MWsCYsDvhTcXQEVKLOLO%0A2j4r%0A)
 
 ## Troubleshooting
 
diff --git a/content/support/16893491-get-started-with-smart-reports.md b/content/support/16893491-get-started-with-smart-reports.md
index e1e31195c8..4fd6106e05 100644
--- a/content/support/16893491-get-started-with-smart-reports.md
+++ b/content/support/16893491-get-started-with-smart-reports.md
@@ -24,13 +24,13 @@ Each report includes the following sections:
 
 Workstreams shows what the group used Claude for most, by sessions and by spend, side by side.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2671030907/7b62b605189fe8e9474a20c1eaf2/image.png?expires=1789727400&amp;signature=699c72c26510f5af1f2ca6dfc3fa8700dd50de59a92405ca1d689cca1f27e323&amp;req=diYgF8l9nYhfXvMW1HO4zZse%2B2ubSQ8IVa%2FWhnGS4GkObUeL2B%2BhLtR0%2BVA1%0A6G9rEhbRNZ6SKEJnarM%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2671030907/7b62b605189fe8e9474a20c1eaf2/image.png?expires=1789796700&amp;signature=b7d6e4778cc169e89bab158af416a8306d6c9ce8c4ddd3c97861e92856f3276a&amp;req=diYgF8l9nYhfXvMW1HO4zZse%2B2ubQg4LVa%2FWhnGS4GnS8UQJkW9f6BwsxtLe%0AARkYZdMlJUzAdv%2FJ01s%3D%0A)
 
 ### Deliverables produced
 
 Deliverables produced groups sessions by the type of output that was produced. For example, analysis, documentation, content drafts, and code.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2671035220/2a582bc047a6ba46e7dbd6f05d9f/e17881ac-874c-4747-94ca-8679e0301455?expires=1789727400&amp;signature=9a961c13892a93a3bac12eb0c52930e69f9a26b2fad68c398944b7367e1d85a8&amp;req=diYgF8l9mINdWfMW1HO4zelj0q5ckdr2YDEFlKbF9Y%2BVKsSRwIAuvR6uwcIA%0AoPV8haVaGPKk6lEfyes%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2671035220/2a582bc047a6ba46e7dbd6f05d9f/e17881ac-874c-4747-94ca-8679e0301455?expires=1789796700&amp;signature=b2b72c01e338553b40ea03b84ae2e5489ee46449d38b21b2a504168e25671b9f&amp;req=diYgF8l9mINdWfMW1HO4zelj0q5cmtv1YDEFlKbF9Y%2BvlRpnE3P7nIc3tg%2Bf%0AzKTZx%2Frm2fLd%2FJbox8M%3D%0A)
 
 ### Cost per session by type of output
 
@@ -44,17 +44,17 @@ Task outcomes  shows what each session produced.
 
 Most common frictions shows what got in the way, by category. For example, a connector that wasn’t set up, output that didn’t match the ask, approval or sign-in gating, tool failures, or rework loops.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2671052365/b69f22b75729e5587563e7ab6830/b1647659-a7ea-403b-89fc-0b150ee97675?expires=1789727400&amp;signature=c1dd5e345afc64df40dacc6fa7ffa2b67e797e03f7e4688bac4c2167f303ba97&amp;req=diYgF8l7n4JZXPMW1HO4zdDit7MyVtpVjFK5P3Uf7RhG%2FFBi8SxnyxMjMdQY%0An9yI9Xf2TB4oWVRpHSU%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2671052365/b69f22b75729e5587563e7ab6830/b1647659-a7ea-403b-89fc-0b150ee97675?expires=1789796700&amp;signature=0e4548eaf5ca8b2487c30e90ff4abc696c7a04466ad5b68d74c1f188128cbf50&amp;req=diYgF8l7n4JZXPMW1HO4zdDit7MyXdtWjFK5P3Uf7RgvNi6UgD1zYJEIThiG%0AVsRbd3hni%2FlYa%2B7EoIU%3D%0A)
 
 Click into a category to see more information:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2671053199/b68936dd5d590c5fbcbbc092b332/5ec247b2-cd67-4f3f-97b5-23479b87a5c6?expires=1789727400&amp;signature=156cf25d3418465d8b1114f2fee842dc56f52d48a1212629119e08b4eedf223e&amp;req=diYgF8l7noBWUPMW1HO4zbuGOoIvJL4YodOVMLl17PWWw3igypGDmV2AZFRM%0AdNLq8EK%2BnBKBUqfCJYs%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2671053199/b68936dd5d590c5fbcbbc092b332/5ec247b2-cd67-4f3f-97b5-23479b87a5c6?expires=1789796700&amp;signature=256dbcfe0fa973e368f01bb9d1ee1a9e8620d4f579d9abca59c80806b576e240&amp;req=diYgF8l7noBWUPMW1HO4zbuGOoIvL78bodOVMLl17PWvYFomuuSUyFzOEoNp%0AZ6KnqnSg%2Be3DCYNjpsg%3D%0A)
 
 ### Inefficiencies
 
 Inefficiencies counts sessions that produced nothing usable and sessions that were personal or off-topic, with their cost (shown only as an aggregate count and cost, with no summaries or drilldown).
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2671036122/90dc848a7adf371a872bd89a2f5e/de86945b-ccfe-4e0f-892d-abacc475c5c4?expires=1789727400&amp;signature=21be39383e48a16f9d7143f6a655501a6484f07484a936e250cf8b3ff196957c&amp;req=diYgF8l9m4BdW%2FMW1HO4zcYfhwaRD%2FMeBas8rgXn%2Fb3AFwn7Y8d6l3%2F%2F4XxY%0AVPQw%2FC5%2FDY0JMG9CJ0M%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2671036122/90dc848a7adf371a872bd89a2f5e/de86945b-ccfe-4e0f-892d-abacc475c5c4?expires=1789796700&amp;signature=0a22c2f43dc9db7150e90a66d27cbebf9ca76905c6b5ba3c4aaf85076e98a519&amp;req=diYgF8l9m4BdW%2FMW1HO4zcYfhwaRBPIdBas8rgXn%2Fb3loHCbVwsu7d5C3wXU%0Asbvg3GAyB%2Br%2Bm8IP49M%3D%0A)
 
 ### Reusable skills and workflows to build
 
@@ -64,13 +64,13 @@ Reusable skills and workflows to build identifies repeated patterns that could b
 
 Most expensive sessions lists where spend concentrates.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2671032083/2b075387a4a3473f884a8ba26436/image.png?expires=1789727400&amp;signature=e533d8b98710f3d37559af9eae8de69560e7aeea43b0020d9eda1c811632f347&amp;req=diYgF8l9n4FXWvMW1HO4zdLkI2ai6EEtnUoxuhUXEhj2ipeb8LTX5Jc4Vc1P%0ASTiQ7YceQfzOiYrQXW8%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2671032083/2b075387a4a3473f884a8ba26436/image.png?expires=1789796700&amp;signature=d9ccc341f7925fda030b510bf84804fd0a2e420509d762940e31fcabaa71ae9b&amp;req=diYgF8l9n4FXWvMW1HO4zdLkI2ai40AunUoxuhUXEhh4BLEJlnIt%2FYhq34qT%0AlcBPFplnqkzfQlvoOL0%3D%0A)
 
 ### Complex, autonomous work
 
 Complex, autonomous work shows  sessions scoring highest on task complexity, time saved, how long Claude worked on its own, and the expertise required.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2671031695/3781b98c5cb9cdc069439aa3d9ab/image.png?expires=1789727400&amp;signature=800c43c4ee4da1ea851ee8c673d1df9b63d056b71c4ac32282dcf0e4e1e18161&amp;req=diYgF8l9nIdWXPMW1HO4zcPtgzv2CdjAtjDEKfEvx0NkYtWY7YbUvkexHCQm%0A4gvvE8DOWbSlr1h9zSA%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2671031695/3781b98c5cb9cdc069439aa3d9ab/image.png?expires=1789796700&amp;signature=8d9d105bca8a1865b8ce896923c7591ed8e5c15e5a8d18d2010277b01932a883&amp;req=diYgF8l9nIdWXPMW1HO4zcPtgzv2AtnDtjDEKfEvx0MtoMg%2Fp15rSmgqtqQ3%0ArLdwGCSoIsLhYIZoFYY%3D%0A)
 
 ### Answers to custom questions
 
diff --git a/content/support/16989529-invite-people-outside-your-organization-to-an-artifact.md b/content/support/16989529-invite-people-outside-your-organization-to-an-artifact.md
new file mode 100644
index 0000000000..bedba4d64c
--- /dev/null
+++ b/content/support/16989529-invite-people-outside-your-organization-to-an-artifact.md
@@ -0,0 +1,125 @@
+# Invite people outside your organization to an artifact
+
+You can invite specific people by email to access an artifact. They sign in to Claude with that email address and can then open the artifact with the access you give them. Unlike sharing with "Anyone with the link," an invitation works only for the person you invite.
+
+Inviting people by email is in beta and available on Pro, Max, Team, and Enterprise plans.
+
+## Before you invite someone
+
+- The artifact’s owner can invite people. On Team and Enterprise plans, anyone in your organization who can edit the artifact can also invite people after the owner sets a **Shared version**. The owner gets an email when someone else sends an invitation.
+
+- This feature is on by default for Team plans and off by default for Enterprise plans. Owners can adjust this setting in **[Organization settings > Artifacts](https://claude.ai/admin-settings/artifacts)** to control whether you can invite people outside your organization.
+
+- The person needs a Claude account with the email address you invite. If they don't have one, they need to create one with that address before they can open it. Claude doesn't tell you whether they have an account.
+
+- Some artifacts can’t be shared with people outside your organization, and the “Share” menu tells you when this applies. For example:
+
+  - Documents made with Claude Docs
+
+  - Artifacts that haven’t been published yet
+
+  - Artifacts that connect to outside websites
+
+  - Artifacts with an uploaded file that’s still being checked or didn’t pass the check
+
+## Invite someone
+
+1. Open the artifact and click “Share.”
+
+2. In the field at the top of the **Share** menu (**Add people**, or **Invite people by email** on Pro and Max plans), type the person’s email address.
+
+3. Select the **Invite** option that shows their address.
+
+4. Under **Their access**, choose “Can view,” “Commenter,” or “Can edit.”
+
+5. If you’re asked to choose a **Version they’ll see**, pick the version you want to share.
+
+6. Click “Invite.”
+
+On Team and Enterprise plans, if you type the email address of someone in your organization, they’re added to the artifact directly instead of getting an invitation.
+
+## Access levels
+
+| **Access**    | **What they can do**                                                                                           |
+| ------------- | -------------------------------------------------------------------------------------------------------------- |
+| **Can view**  | Open the version of the artifact you shared and read its comments.                                             |
+| **Commenter** | Everything in **Can view**, plus add comments and download any files the artifact offers. This is the default. |
+| **Can edit**  | Everything in **Commenter**, plus see the latest version, make changes, and publish new versions.              |
+
+At every level, people outside your organization can’t invite others or change sharing settings. Parts of the artifact that use Claude or your connectors don’t work for them. People with **Can edit** access can’t delete the artifact, and they can upload only images and videos to it.
+
+People you invite with **Commenter** or **Can edit** access can comment. They can’t mention people or ask Claude in a comment, and they don’t get email notifications about comments. They can’t comment on an artifact that’s also shared with "Anyone with the link."
+
+If the artifact is also shared with "Anyone with the link," the people you invited have the same access as anyone with the link, whatever level you gave them.
+
+## What invited people see
+
+1. They get an email from Claude (<no-reply-claude@mail.anthropic.com>) that shows the email address of the person who invited them and what access they’ll have.
+
+2. They click “View invitation” and sign in to Claude in a web browser with the email address you invited.
+
+3. They click “Accept and open” to open the artifact.
+
+To come back to the artifact later, they can open the link in the invitation email again or bookmark the artifact.
+
+## Manage people you’ve invited
+
+In the artifact’s **Share** menu, people you’ve invited appear under **Invited from outside your organization**. Pending invitations show when they expire. From there, you can change someone’s access or remove them. Removing someone takes away their access right away.
+
+If someone didn’t get an invitation email because they didn’t have a Claude account yet, ask them to create one with that address. Then remove the invitation and invite them again.
+
+## When access changes
+
+- **Pending invitations expire after 30 days.** Accepted invitations don’t expire.
+
+- **If you change who can open the artifact to “Only you”:** On Team and Enterprise plans, everyone you invited from outside your organization loses access and their invitations are removed. On Pro and Max plans, people you invited keep their access.
+
+- **If you delete the artifact:** Everyone you invited loses access.
+
+- **If the person who sent an invitation leaves your organization or loses edit access:** Their pending invitations stop working. People who already accepted keep access until someone removes them.
+
+- **If an owner turns off email invitations:** Invited people can’t open the artifact until the setting is turned back on. Accepted invitations aren’t deleted, and pending ones still expire 30 days after they were sent.
+
+## Limits
+
+- You can invite up to 50 people outside your organization per artifact. This includes pending and accepted invitations.
+
+- Invitation emails are in English.
+
+## If you got an invitation you didn’t expect
+
+Click “Report this invitation” in the email, or “Didn’t expect this? Report this invitation” on the invitation page. Reporting declines the invitation, and the person who sent it isn’t notified. After you report an invitation, that person can’t invite you by email again.
+
+## For Team and Enterprise plans
+
+This section applies to Team and Enterprise plans.
+
+When email invitations are on, anyone in your organization who can edit an artifact can invite people outside your organization to it, once the owner sets a **Shared version**. Invited people can't share the artifact further or use your connectors through it.
+
+### Turn email invitations on or off
+
+1. Navigate to **[Organization settings > Artifacts](https://claude.ai/admin-settings/artifacts)**.
+
+2. Turn **Email invitations outside your organization** on or off.
+
+This setting requires **Artifacts** to be on. It’s separate from **External sharing**, which controls sharing with "Anyone with the link."
+
+### Defaults
+
+- **Team:** On by default.
+
+- **Enterprise:** Off by default.
+
+Email invitations aren’t available for some organizations, including education and K-12 organizations, and organizations using customer-managed encryption keys (CMEK), zero data retention, or a HIPAA-ready configuration.
+
+### See and remove outside access
+
+1. Navigate to **[Organization settings > Artifacts](https://claude.ai/admin-settings/artifacts)**.
+
+2. Under **Published artifacts**, find an artifact marked **Shared outside**.
+
+3. Open the artifact’s menu and select “Manage outside access.”
+
+4. Select the remove button next to the person, then confirm with “Remove access” or “Remove invitation.”
+
+Admins can remove people here but can’t change their access level.
\ No newline at end of file
diff --git a/content/support/8114491-get-started-with-claude.md b/content/support/8114491-get-started-with-claude.md
index 4b4ee25e18..aac574c37c 100644
--- a/content/support/8114491-get-started-with-claude.md
+++ b/content/support/8114491-get-started-with-claude.md
@@ -36,7 +36,7 @@ You use **prompts** to communicate with Claude. The best approach is to speak to
 
 Type your prompt into the chat interface and click the submit button to start a conversation with Claude. You can click the "+" button in the lower left or type "/" to view additional options and commands:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1916208578/2cf2ea52f1f884084b57983a8805/image.png?expires=1789728300&amp;signature=07f74439286843d50f58234d91a1fe6ec34052c43dcfbced092f81ec353e1604&amp;req=dSkmEMt%2BlYRYUfMW1HO4zV2J7SbNto%2BC9crMELaMZPzpwyrTx3lb17ez9QCf%0AthVL6qZBqcRRFyT%2Fi0E%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1916208578/2cf2ea52f1f884084b57983a8805/image.png?expires=1789796700&amp;signature=400cfe753183fabd0534e6c639bf08fd0dc503f4596d8077f746a291a666de55&amp;req=dSkmEMt%2BlYRYUfMW1HO4zV2J7SbNvYGG9crMELaMZPw8IMYCraY0JYoM6f6Y%0AUfOG75c1H4NANVQkArg%3D%0A)
 
 ---
 
diff --git a/content/support/8230524-delete-or-rename-a-conversation.md b/content/support/8230524-delete-or-rename-a-conversation.md
index de526feee4..b72cdff5ee 100644
--- a/content/support/8230524-delete-or-rename-a-conversation.md
+++ b/content/support/8230524-delete-or-rename-a-conversation.md
@@ -44,15 +44,15 @@ These steps apply to Claude for iOS, listed on the App Store as Claude by Anthro
 
 4. If deleting, tap "Delete" again in the confirmation prompt.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2599501318/75c28edc693efbe8befd21e4da64/d18a921a-df4b-4788-833c-12c966a32527?expires=1789728300&amp;signature=b8b97c519e7b4fa8d3ad2bc68ab435b66a28ce40a95cd4efa4e657cf4324df39&amp;req=diUuH8x%2BnIJeUfMW1HO4zSc12addimio1DBI29QsIlHhRVdONh02eB04Yvw8%0AnVIJYq9oL8B17MBtsik%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2599501318/75c28edc693efbe8befd21e4da64/d18a921a-df4b-4788-833c-12c966a32527?expires=1789796700&amp;signature=4297acac304f1faaa715afe50f6411f4971837bd2b727cdac83bddc0fe54fc86&amp;req=diUuH8x%2BnIJeUfMW1HO4zSc12addgWas1DBI29QsIlFtGL%2FS8p2caT0QXgmn%0AmqSdADcC70a8FRRfefw%3D%0A)
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2599493852/2e58b92d18f307bb79ae30650f26/1bbe52f3-202b-4d5d-9f9a-eeda4d6952c3?expires=1789728300&amp;signature=bdf02bb4486711cc935321a0c2d99474a72c674613ecb9077f5036e61f9c6dc2&amp;req=diUuH813nolaW%2FMW1HO4zTjXMu6LLMjmj7blKEDtUI1pVN4vPsjuu9Gvab0y%0AC4rIpOHAHC1jkBaCMx0%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2599493852/2e58b92d18f307bb79ae30650f26/1bbe52f3-202b-4d5d-9f9a-eeda4d6952c3?expires=1789796700&amp;signature=9e15884bed3265683e78059394a2a8746e75b6259aff337d816d7f0d753ef9f0&amp;req=diUuH813nolaW%2FMW1HO4zTjXMu6LJ8bij7blKEDtUI2eB3juRjVeJajRpwmx%0AKuQwgPjOsDb4g%2F65eJQ%3D%0A)
 
 You can also delete the conversation you have open: tap the "⋯" button in the top right corner, tap "Delete," then confirm.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2599493848/997184c386d0e6fb0bd2d7c1f2b6/5d2bc394-25fc-4814-8c2a-2f54d004f83f?expires=1789728300&amp;signature=74d9fd2547ea6d3503607c807bce8117252f2cc5e1981fc93315af497cfaddc0&amp;req=diUuH813nolbUfMW1HO4zVCIqpPIydRFzQl%2BKgU984xbIyY6Ivs4pc0rbXPk%0A3gi2Otp9XXUEOOBQIXQ%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2599493848/997184c386d0e6fb0bd2d7c1f2b6/5d2bc394-25fc-4814-8c2a-2f54d004f83f?expires=1789796700&amp;signature=ad06816c18ea3c8d835bc40bffb5c4763083a8c3f27c821066e2f0d731c1605e&amp;req=diUuH813nolbUfMW1HO4zVCIqpPIwtpBzQl%2BKgU984x4d2FJqxyGNSp0%2FxmA%0AfwfI5Dfd0Nf9QM%2F2TuA%3D%0A)
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2599493856/799041da9fa918e90068c5ebf5bd/2e8d5cee-c45a-41d7-a14b-486e50a37f88?expires=1789728300&amp;signature=d08e2da4730177ad6c25f956d1edf2f7fedeeb0406b2abbd4b270c8ba2d2ae1b&amp;req=diUuH813nolaX%2FMW1HO4zVCl4AH1021OEDIU8RT6jk0691Ru%2Fs7aXmhuOwGw%0AtTzVWHfogMXWUWUD6OM%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2599493856/799041da9fa918e90068c5ebf5bd/2e8d5cee-c45a-41d7-a14b-486e50a37f88?expires=1789796700&amp;signature=b9cc939b8760d95fd329e7ee6bb019a0e70fccfcc747d92c683d4e8b68085a49&amp;req=diUuH813nolaX%2FMW1HO4zVCl4AH12GNKEDIU8RT6jk1Uw5YJtecsmA9MEqKM%0AqHt4%2BOcUbZeNqB95fX8%3D%0A)
 
 ## Delete or rename a conversation on Claude for Android
 
@@ -66,9 +66,9 @@ These steps apply to the Claude for Android, listed on Google Play as Claude by
 
 3. If deleting, tap "Delete" again in the confirmation prompt.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2599493850/a64e6561222d535f2f5bd03e71f0/5de429c2-d8ed-4e8a-89e8-a13ccaa49767?expires=1789728300&amp;signature=5f1cb23add9db3889381bb6293da19b23aa721a8ea011bc8dbf2abda9a81955c&amp;req=diUuH813nolaWfMW1HO4zVTdd9srwFh2rqtc0YNNUtIHOu40zsM84U2gFC69%0Am9MHxKh%2FRCPFC%2FdcEfQ%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2599493850/a64e6561222d535f2f5bd03e71f0/5de429c2-d8ed-4e8a-89e8-a13ccaa49767?expires=1789796700&amp;signature=be998225a4cb83cfc14fe5fe5571cdf88012d63768437968f703412fd1cc2e62&amp;req=diUuH813nolaWfMW1HO4zVTdd9sry1Zyrqtc0YNNUtLhz0K6F%2BpXAfycdLF9%0A3ePed7lJVZvEPyw15d8%3D%0A)
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2599493851/f21b39c60e88050d4b0745325f0d/0a8c0d08-dc53-4ef1-8d9f-2b995242c1f9?expires=1789728300&amp;signature=74c812e3fb5f88d70e7f4387574647bbae4fc7480f6d502cb02cc893fec17020&amp;req=diUuH813nolaWPMW1HO4zUYvw1wMoDZf%2FjekULCQNzXpq4v8WQCHrFg5kJRN%0AqoRoaZkkWFgTXHr1PLg%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2599493851/f21b39c60e88050d4b0745325f0d/0a8c0d08-dc53-4ef1-8d9f-2b995242c1f9?expires=1789796700&amp;signature=fa0b2e6a71e5d7f0797576e30c1b72138b660f30b202b35b471f3ed2467a8b44&amp;req=diUuH813nolaWPMW1HO4zUYvw1wMqzhb%2FjekULCQNzVGnsun3Yh9RvmO4QiT%0AKciz9jecs5uOmPY%2B0p0%3D%0A)
 
 **To delete multiple conversations at once:**
 
@@ -78,9 +78,9 @@ These steps apply to the Claude for Android, listed on Google Play as Claude by
 
 3. Tap the trash icon, then tap "Delete" in the confirmation prompt.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2599493849/3013a0ab921337b4544f7ffeffa6/e828ec14-fb52-4205-a840-707b6f2a848d?expires=1789728300&amp;signature=c9513bcd247acf74bf8bdcf87464458b3f63ce46d661e34c9f24b375e07d179f&amp;req=diUuH813nolbUPMW1HO4zWGamM5zeIXc4AqhTnZa84XJMkHjA1tAD9cpSaOH%0AjWupdgB4uhzFZpytCDU%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2599493849/3013a0ab921337b4544f7ffeffa6/e828ec14-fb52-4205-a840-707b6f2a848d?expires=1789796700&amp;signature=6574c89a5003a9ce211d0d7b2912ae9f63c08db3e01eb96bc905c2d6c7f0b916&amp;req=diUuH813nolbUPMW1HO4zWGamM5zc4vY4AqhTnZa84XLc2jCtr9UWvnMVx9d%0ADYEJfrcT0fK7iU9MepU%3D%0A)
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2599493853/e2507f53cce8a26776a22a457b1a/bd79bb8a-b078-420f-a4e1-75590367aa80?expires=1789728300&amp;signature=4e1c5d62f3730ca5e90b2dd3bb377100921b789af7ff753f2462b18ec5a2c8de&amp;req=diUuH813nolaWvMW1HO4zQTtExz2xkg7SBGfF3I2bRhUfCCTUJyeCO7hC%2BMX%0A1tZ7a3bF0X2yRO9zTg4%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2599493853/e2507f53cce8a26776a22a457b1a/bd79bb8a-b078-420f-a4e1-75590367aa80?expires=1789796700&amp;signature=9ab69dfdeaafc436d4c3224fb3081e4ac5ea7f735a74c07d23864dea3c7d14d3&amp;req=diUuH813nolaWvMW1HO4zQTtExz2zUY%2FSBGfF3I2bRhI90m13BC4UJLGyZEF%0AqQoEFn9jI%2FN%2FrC5MnzE%3D%0A)
 
 ## What happens when you delete a conversation
 
diff --git a/content/support/8325618-paid-plan-billing-faqs.md b/content/support/8325618-paid-plan-billing-faqs.md
index 898a0d052e..5a45a6a6c5 100644
--- a/content/support/8325618-paid-plan-billing-faqs.md
+++ b/content/support/8325618-paid-plan-billing-faqs.md
@@ -50,7 +50,7 @@ There's no separate option to remove a card, and updating to a new card replaces
 
 If you want to use a name other than the one tied to your payment method, check the "Use a different name on invoices" box when adding or updating your payment method in **[Settings > Billing](https://claude.ai/settings/billing)**.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1922141785/666191101c11030b05f03a668a74/image.png?expires=1789728300&amp;signature=47737a005f7259dcfde2be0180c61bb72766b4b9af0393366620ba5aed69f7c2&amp;req=dSklFMh6nIZXXPMW1HO4zVXW8GSsaTvPQoNvNFTb5cdcoUQQApBnGAcY5YIZ%0ATpnqzrwVL4dgTOWtZOg%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1922141785/666191101c11030b05f03a668a74/image.png?expires=1789796700&amp;signature=31b7bd71eaf615722b31cbb29cd4ba6c4abefe3deb3c4bdeb734e594a2cc1803&amp;req=dSklFMh6nIZXXPMW1HO4zVXW8GSsYjXLQoNvNFTb5ccCS9ghTqEh7ihWIDNN%0AGA0d0HM%2BIEbBTfOM2PE%3D%0A)
 
 ## How can I edit a paid invoice?
 
diff --git a/content/support/8887527-customizing-your-appearance-settings.md b/content/support/8887527-customizing-your-appearance-settings.md
index df182a0ac7..737afdb640 100644
--- a/content/support/8887527-customizing-your-appearance-settings.md
+++ b/content/support/8887527-customizing-your-appearance-settings.md
@@ -8,7 +8,7 @@
 
 3. Select from Light, Match System, and Dark under **Color mode**.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1648260417/d478c757c7115ad58a12026d4caf/AD_4nXc__Qop4X9hknWGfGj_y_DCpLutLruhxIclJIfir0ilsgNMg7X8ksIVnqk1Oce5FKlGIOYu9CKbVsu8DqD7iIY2aC0ZfXMyFTeAdNq-Cao2mXcj_WUpNF0kM2HoYR_dEx6N_cuJow?expires=1789728300&amp;signature=1dfda5f4af4f510fed6e27d911f4e08a0c96315994b766dce13b71ea97106eaf&amp;req=dSYjHst4nYVeXvMW1HO4zc2jJ6s6goPnSBkgeTglJrqbST30B6mHrQs%2F9QAw%0AUalEIgicU%2B1CwIRMC24%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1648260417/d478c757c7115ad58a12026d4caf/AD_4nXc__Qop4X9hknWGfGj_y_DCpLutLruhxIclJIfir0ilsgNMg7X8ksIVnqk1Oce5FKlGIOYu9CKbVsu8DqD7iIY2aC0ZfXMyFTeAdNq-Cao2mXcj_WUpNF0kM2HoYR_dEx6N_cuJow?expires=1789796700&amp;signature=96df1a14c29f04b5f2ea7b869520dec8f5b8d69c57cb787827d14b46f5fee454&amp;req=dSYjHst4nYVeXvMW1HO4zc2jJ6s6iY3jSBkgeTglJrocF2TzmI4bwo0PR4Ms%0AjWMvbE14w1j%2BpBN94ls%3D%0A)
 
 ## How to change your font
 
@@ -16,10 +16,10 @@
 
 2. Select from Default, Match System, and Dyslexic Friendly.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1648260416/7fc0803d44d8de40f8e6636b2eb6/AD_4nXf0UEDa1i2QmqlQtoB5BgpQ-FfZVzss_7wMVQdvkmEDSfoTxixnG0GSxC6qrOs21HdkXH-I2Yn_GHDAf8yjd6FJtoh9FadALozvIErFp9r8LychDGLPb7OpN1CN4PRcgVAYNCre?expires=1789728300&amp;signature=c860bf8f17bcb7accb2ad2d1c07e2c91fa16500bdf8e112ebfb9cba3a2a27980&amp;req=dSYjHst4nYVeX%2FMW1HO4zc8962niX3k%2FQtNFlF5%2FHEcNm9OdHx0Ws3I6hv0G%0Ar8paPbMATFLC9GDZxUc%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1648260416/7fc0803d44d8de40f8e6636b2eb6/AD_4nXf0UEDa1i2QmqlQtoB5BgpQ-FfZVzss_7wMVQdvkmEDSfoTxixnG0GSxC6qrOs21HdkXH-I2Yn_GHDAf8yjd6FJtoh9FadALozvIErFp9r8LychDGLPb7OpN1CN4PRcgVAYNCre?expires=1789796700&amp;signature=910648fd2955d7fbebede8acc6041379b08772006e12335fff3be6f73822325b&amp;req=dSYjHst4nYVeX%2FMW1HO4zc8962niVHc7QtNFlF5%2FHEcd4bZtjM1O8LCXxmzT%0ACD8buJPGEO1Z28v9jYw%3D%0A)
 
 ## Can I disable the sidebar?
 
 It's not currently possible to completely disable the sidebar. You can click the button on the top right of the sidebar to open or close it.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1941108004/5217903737ddd9bb62fe5d7a904c/CleanShot+2026-01-14+at+09_12_58.png?expires=1789728300&amp;signature=84d16a6f44bce79f24a4bff20611347b858ca90fc43803c02e8547b32d474973&amp;req=dSkjF8h%2BlYFfXfMW1HO4zUS%2BB1bxW3PsylfYa7uDb9kw7obyIDWJ1%2Bq70ExA%0AzwhLXBs3RBaDXMUfckI%3D%0A)
\ No newline at end of file
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1941108004/5217903737ddd9bb62fe5d7a904c/CleanShot+2026-01-14+at+09_12_58.png?expires=1789796700&amp;signature=af4320a8f720146f1a6e1536b9fd0cbbba682b374a35b907360408fae92b6e91&amp;req=dSkjF8h%2BlYFfXfMW1HO4zUS%2BB1bxUH3oylfYa7uDb9mZ%2Bfltsg5%2F4q%2FIA%2BJo%0ANJIH7iXzMyYWPn0Hgtw%3D%0A)
\ No newline at end of file
diff --git a/content/support/9267400-move-your-personal-claude-account-to-a-team-or-enterprise-organization.md b/content/support/9267400-move-your-personal-claude-account-to-a-team-or-enterprise-organization.md
index 285251bfb9..fe9399965e 100644
--- a/content/support/9267400-move-your-personal-claude-account-to-a-team-or-enterprise-organization.md
+++ b/content/support/9267400-move-your-personal-claude-account-to-a-team-or-enterprise-organization.md
@@ -126,7 +126,7 @@ For the full walkthrough of your options, deadlines, and what happens to your su
 
 You may have both a personal account and an organization account tied to the same email address. You can switch between them by clicking your initials or name in the lower left corner of the screen.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2312193347/712f763fc290b2488c103849f20c/0c135a6f-3442-4ee1-9ab7-98673f03ef6e?expires=1789727400&amp;signature=1f31bd42697d8b7b575728b75171d337977202637753eb27ea63653aa2bf304a&amp;req=diMmFMh3noJbXvMW1HO4zXhPndkxyhhlufhmlOXMdYbxbOj7c009DPqGy56e%0AF7DbX%2FXHWPwXjg0Sbe0%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2312193347/712f763fc290b2488c103849f20c/0c135a6f-3442-4ee1-9ab7-98673f03ef6e?expires=1789796700&amp;signature=f18a954382219372cf3759ec5ed4aae1a863c6371d409b30682f1587fdb2a82e&amp;req=diMmFMh3noJbXvMW1HO4zXhPndkxwRlmufhmlOXMdYanmUhTM3C42SSxa0sd%0AisTJ0j4eBmdTPZsAYKM%3D%0A)
 
 A blue checkmark shows which account you're currently using. Click the other account to switch to it and access its separate conversations and projects.
 
diff --git a/content/support/9487310-what-are-artifacts-and-how-do-i-use-them.md b/content/support/9487310-what-are-artifacts-and-how-do-i-use-them.md
index 579d4aaf20..d2f441414b 100644
--- a/content/support/9487310-what-are-artifacts-and-how-do-i-use-them.md
+++ b/content/support/9487310-what-are-artifacts-and-how-do-i-use-them.md
@@ -1,6 +1,6 @@
 # What are artifacts and how do I use them?
 
-An artifact is anything Claude makes for you that you'd put in front of someone: a design, a deck, a document, a dashboard, or a small interactive tool. It opens beside your conversation, and you can edit it, come back to it, and share it with a link. Ask for one in any conversation with Claude, including in Claude Code, or pick a template in the **Artifacts** tab.
+An **[artifact](https://claude.com/features/artifacts)** is anything Claude makes for you that you'd put in front of someone: a design, a deck, a document, a dashboard, or a small interactive tool. It opens beside your conversation, and you can edit it, come back to it, and share it with a link. Ask for one in any conversation with Claude, including in Claude Code, or pick a template in the **Artifacts** tab.
 
 Artifacts are available on Free, Pro, Max, Team, and Enterprise plans, and in Claude Code on every plan that includes Claude Code. Claude Design, Claude Slides, and Claude Docs are in beta on paid plans only. They're on by default on Pro, Max, and Team plans, and off by default on Enterprise plans until an owner turns each one on. On the Free plan, you can still create artifacts in any conversation.
 
diff --git a/content/support/9519177-how-can-i-create-and-manage-projects.md b/content/support/9519177-how-can-i-create-and-manage-projects.md
index 272d3820c7..075264e9db 100644
--- a/content/support/9519177-how-can-i-create-and-manage-projects.md
+++ b/content/support/9519177-how-can-i-create-and-manage-projects.md
@@ -104,15 +104,15 @@ Starring a project allows for quick access from your projects and chats list, vi
 
 You can move a standalone chat into a project by clicking on the dropdown arrow next to the chat name, then “Add to project”:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1784190248/0f19c8de18b494a27be252fdfaff/d4e7a5c5-25f5-4623-862b-c593d2dc0b39?expires=1789727400&amp;signature=09eb138995386027c0b2e87517e1365849ae12cd2aede1ed7baa567e05068a36&amp;req=dScvEsh3nYNbUfMW1HO4zQABaWhrSKcRBSXNVFXQ%2FVFv67MqLc2oQbuDDDPT%0AmRcZGwlSio%2FOSapLv8k%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1784190248/0f19c8de18b494a27be252fdfaff/d4e7a5c5-25f5-4623-862b-c593d2dc0b39?expires=1789796700&amp;signature=07b2d9dce14e2c0c6013c3774824c7fd29425af9336efff1b7f4c6ab43e3cc1a&amp;req=dScvEsh3nYNbUfMW1HO4zQABaWhrQ6YSBSXNVFXQ%2FVGNz%2FdAnzhXnOmLVRmD%0AsrZab2bRnOdAIj8hJxk%3D%0A)
 
 Browse or search for the correct project in the **Move chat** modal that appears, then click on it to move the chat.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1784190951/34dc256ccd4c0cf74976f31062e6/55365cf2-059d-41b2-ac95-4b00c4389a76?expires=1789727400&amp;signature=cb1ed6aaae7fd8a9cc11007290c703ddd9805c279b8bd9967fc3c4b17d42d47c&amp;req=dScvEsh3nYhaWPMW1HO4zSMECim3yQ4FgYbpTjViBxCYwXOr1GQsCNzMLRq4%0A8VCoKRTMshCT477WP38%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1784190951/34dc256ccd4c0cf74976f31062e6/55365cf2-059d-41b2-ac95-4b00c4389a76?expires=1789796700&amp;signature=c8cf27af9dcc7532348c260aaf68721dfeff13ca35edf2c388a098bc62fe8852&amp;req=dScvEsh3nYhaWPMW1HO4zSMECim3wg8GgYbpTjViBxAYpTbB5lAExVdD3mdL%0Ankx%2FmWSwIwzLdODL8HQ%3D%0A)
 
 You can also remove chats from projects, or move them between projects, using the same dropdown menu within the chat:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1784185682/8625eac15b9fa452f148a6c47250/c53a1bc4-a991-4684-a789-5447ed789d35?expires=1789727400&amp;signature=be8381509a22879c45e50b9a79ccbabb3a25a79d7c9baaaf4675005b91a4326c&amp;req=dScvEsh2mIdXW%2FMW1HO4zb6DuP4rDEIOS2r1%2FGRlqOTLfJL%2Br11%2FK2dgTKSb%0AALhneJaLQc5Vfr5iFUA%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1784185682/8625eac15b9fa452f148a6c47250/c53a1bc4-a991-4684-a789-5447ed789d35?expires=1789796700&amp;signature=ca9b1fb1cc63879c9d098d45bb9e2f3d5850451ccc4e9497a1f5452b4704577b&amp;req=dScvEsh2mIdXW%2FMW1HO4zb6DuP4rB0MNS2r1%2FGRlqOTCDiUNM53sGuGQhtqi%0AK5BPxr5n4J6DqogVHH4%3D%0A)
 
 ---
 
diff --git a/content/support/9519189-manage-project-visibility-and-sharing.md b/content/support/9519189-manage-project-visibility-and-sharing.md
index 992314a8b6..e979d5c358 100644
--- a/content/support/9519189-manage-project-visibility-and-sharing.md
+++ b/content/support/9519189-manage-project-visibility-and-sharing.md
@@ -12,7 +12,7 @@ When creating a project on a Team or Enterprise plan, you can choose between two
 
 - **Private:** Only invited members can view and use the project.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1740370991/2b6b16e5deff094e073a5b4bb0ea/63197103-24c0-41e5-aebd-9b8f431837bb?expires=1789727400&amp;signature=1bc6c88f4de954d0c2f658bb0114b1ee18a158baa8cbc03455fc5ea3d6661b58&amp;req=dScjFsp5nYhWWPMW1HO4zd3a2VUjJomjHK95%2FTFaPyl2DZPqeu4D3J11uxZK%0AxrhkURy%2FDn6%2Bs6r1NIw%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1740370991/2b6b16e5deff094e073a5b4bb0ea/63197103-24c0-41e5-aebd-9b8f431837bb?expires=1789796700&amp;signature=32acdd11124880941c62905774d0f56ccbc1fb9cfa771c43e985cf64eb7dad44&amp;req=dScjFsp5nYhWWPMW1HO4zd3a2VUjLYigHK95%2FTFaPylNLaDPJltzZx6I%2BdS6%0A9hKGhP343BKZNNeah00%3D%0A)
 
 ## What are public projects?
 
@@ -22,11 +22,11 @@ If you choose to share a project with the rest of your organization upon creatio
 
 Yes, you can switch the visibility of a project you created as public to private at any time by opening the project and clicking the “Share” button to the right of the project name:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1740370987/5d5db997e6b42e627ffa62fddf75/4823906b-9535-4a19-b89e-a1003f1e6e68?expires=1789727400&amp;signature=6046c0b30176b6085a025cbfa70f95e85dff52959e9812b4e64ff0632c8168dd&amp;req=dScjFsp5nYhXXvMW1HO4zUiDoiDwgwEtE8Kp5wh0MSAqN7uNCOSp%2FDgVxVOM%0A2WCFrSeC3foc4nypTgQ%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1740370987/5d5db997e6b42e627ffa62fddf75/4823906b-9535-4a19-b89e-a1003f1e6e68?expires=1789796700&amp;signature=2ef2ea1b1133dcc4d52297ce0d442a28ad63946664a4c10fb6f1542bc1bf3371&amp;req=dScjFsp5nYhXXvMW1HO4zUiDoiDwiAAuE8Kp5wh0MSAtYz09jFoBFia2SDzn%0AR586fQka7IdeN4%2Bv52I%3D%0A)
 
 Click “Everyone at [your organization]” under **General access** and select “Only people invited” to change the project from public to private:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1740370988/386407facbf3e73d2f5538623a18/69d8ffcd-e1ca-470f-a219-5b88704e41f2?expires=1789727400&amp;signature=5bc1caf9acee6041d8edf866487f25e685a61a4deb52775202f57b6a073020ba&amp;req=dScjFsp5nYhXUfMW1HO4zckCIftlYCWgl3XeGelDRW3gAE8vadXt2DEiAZsL%0AWVF%2FX76TEQVKx3BnEIk%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1740370988/386407facbf3e73d2f5538623a18/69d8ffcd-e1ca-470f-a219-5b88704e41f2?expires=1789796700&amp;signature=2b84b29f8c86b4cb92ea6412639a349978e85dba01ee88d0465f9931ac8fb9fe&amp;req=dScjFsp5nYhXUfMW1HO4zckCIftlaySjl3XeGelDRW2dFgSBkDLfA0HlVrYV%0ASOhepvFT1IQUQ3zp0DU%3D%0A)
 
 ## What are private projects?
 
@@ -36,11 +36,11 @@ Choosing “Only people invited” keeps your project private so that you are th
 
 Yes, you can switch the visibility of a project you created as private to public at any time by opening the project and clicking the “Share” button to the right of the project name:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1740370989/f829dcd8bdd88e944322f678323f/9d25eff1-6df3-40be-82eb-ba7fe09187e8?expires=1789727400&amp;signature=203830dc9ccabb0b74ad9f5f2f171eaacc1a7c42713d0d02681fbff78f430b17&amp;req=dScjFsp5nYhXUPMW1HO4zaSEGlqbSL8J2JrJefVtywms2CS%2Fu4XfYHU6c5AB%0Auud%2Fk4SrBZzRI2nd5ik%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1740370989/f829dcd8bdd88e944322f678323f/9d25eff1-6df3-40be-82eb-ba7fe09187e8?expires=1789796700&amp;signature=f42cb0bf1c571cd2090b9a00122156cbaa70835d00d6ef0217328cebca19b1b2&amp;req=dScjFsp5nYhXUPMW1HO4zaSEGlqbQ74K2JrJefVtywmoNPZCJClOFtirpMBX%0AWt0aMv8ox9Cj70ub5uc%3D%0A)
 
 Click “Only people invited” under General access and select “Everyone at [your organization]” to change the project from private to public:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1740370990/d173fbc6f030780d30c6d7b8e204/7e47b9d1-89fe-4607-8b5b-f7b06e7ad0d6?expires=1789727400&amp;signature=f823b6de287cd9531be87d93a2620a973ae09c87a166c572d09e17efca42b7b6&amp;req=dScjFsp5nYhWWfMW1HO4zT7Q08G8vwsSAmYRPrgMBZktVCnIXu6X5XZvsqKA%0AB%2Fr73g%2Fgh9kAFDxYfSI%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1740370990/d173fbc6f030780d30c6d7b8e204/7e47b9d1-89fe-4607-8b5b-f7b06e7ad0d6?expires=1789796700&amp;signature=f9d4ac846a2503d6cb6308945b8c452a595487d4b677968fbb823591058348b5&amp;req=dScjFsp5nYhWWfMW1HO4zT7Q08G8tAoRAmYRPrgMBZkk0KaOl86Gd0I5zgL4%0AJc%2FRiGUDDzgt9I2Ig0w%3D%0A)
 
 ## Add and remove access to private projects
 
diff --git a/content/support/9534590-cost-and-usage-reporting-in-the-claude-console.md b/content/support/9534590-cost-and-usage-reporting-in-the-claude-console.md
index a1b33d2dba..d82c7a5088 100644
--- a/content/support/9534590-cost-and-usage-reporting-in-the-claude-console.md
+++ b/content/support/9534590-cost-and-usage-reporting-in-the-claude-console.md
@@ -8,7 +8,7 @@ The Claude Console provides detailed cost and usage reporting to help you effect
 
 Users with access to these reports can click into them on the left navigation menu on the Console:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1584654217/db0a977417e38e43639f060d96e0/image.png?expires=1789727400&amp;signature=b6df2989170fd0281d539c5d0538f982f5a041d2366328dd3d1b25c788821ac5&amp;req=dSUvEs97mYNeXvMW1HO4zYCWiS0fg8GeuqqBX2puyxQX%2F75i3BWPr7rMuOVP%0Am3u6y%2BOcEVd7GA7ZAY0%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1584654217/db0a977417e38e43639f060d96e0/image.png?expires=1789796700&amp;signature=fd408a6ed6c99f53892e7cd62abcb720406e909b3916200da3020ea3b4344408&amp;req=dSUvEs97mYNeXvMW1HO4zYCWiS0fiMCduqqBX2puyxTPGsXxn6P9hio5hklg%0A1wZcfRxF6PVKBqe1hrA%3D%0A)
 
 ---
 
@@ -46,9 +46,9 @@ The [Usage page](https://platform.claude.com/usage) offers a detailed breakdown
 
 6. Use the export button to download a CSV of the displayed data.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1584664321/59b50eba0b61e0789f7055fcf9f4/image+%285%29.png?expires=1789727400&amp;signature=4f9b53b11cc6299347a149dc3434b0e4930fdf25a07065ef3bfa610920bd2fae&amp;req=dSUvEs94mYJdWPMW1HO4zQwER3otI4hiqMITUZbanFDfQ7ZUoD%2Bs1g6h7xMQ%0A94w%2BVDpA9bSOb8yU06k%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1584664321/59b50eba0b61e0789f7055fcf9f4/image+%285%29.png?expires=1789796700&amp;signature=9afcb2bf7b578f8ab82e4f5b22870112d7f725fc2c16150cf1b0ec76e1d8a43b&amp;req=dSUvEs94mYJdWPMW1HO4zQwER3otKIlhqMITUZbanFDajRRZolNeRtKyp4I4%0AE852n9MPujPsJz7nSFY%3D%0A)
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1584693386/aed472efe163abcbc14fa32f3699/rate+limited+requests.png?expires=1789727400&amp;signature=1dc4d119eb0168edcc0e78171d0cf7b4df22257566eddbdd29d3479c4268f0c6&amp;req=dSUvEs93noJXX%2FMW1HO4zRxEwWJK5FZo21D6pckxWMZHXMWtGvDDt1oJXnby%0AtlhhxPBSvFZjCbMY3GE%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1584693386/aed472efe163abcbc14fa32f3699/rate+limited+requests.png?expires=1789796700&amp;signature=dd693ad49942067370d90263fe0788f22957a5d5b23645c9e092ad9336894312&amp;req=dSUvEs93noJXX%2FMW1HO4zRxEwWJK71dr21D6pckxWMbBo6tc4H%2Bqi2%2BYAZRM%0ALmyGF%2BPDEJHcgMpwVAo%3D%0A)
 
 ### Rate Limit Use
 
@@ -88,6 +88,6 @@ The [Cost page](https://platform.claude.com/cost) helps you understand your spen
 
 5. Use the export button to download a CSV of the cost data.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1584679401/4d0bc8ed08625e1adee414e77030/CleanShot+2025-06-23+at+08_54_40%402x.png?expires=1789727400&amp;signature=b1399903b8d733006684080dfaf8ff0fa453b70c22958bb8bfd8aaba849a9884&amp;req=dSUvEs95lIVfWPMW1HO4zUR%2Bh5XEUddlCyIF5nuUsbzH1uP5vW2aurIcFKh8%0ACGVArCALAKJfHllUAak%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1584679401/4d0bc8ed08625e1adee414e77030/CleanShot+2025-06-23+at+08_54_40%402x.png?expires=1789796700&amp;signature=5192791ccbece151e8fecec3d91f7dae49b1d55dd9de3b5e820db1471f38f8f0&amp;req=dSUvEs95lIVfWPMW1HO4zUR%2Bh5XEWtZmCyIF5nuUsbzqwG27mypv9qaFUR%2B4%0ARUEpx1vN5PaTcYnl0Uo%3D%0A)
 
 **Note**: Currently, it's not possible to break down usage or cost by individual users.
\ No newline at end of file
diff --git a/content/support/9927533-disable-public-projects-for-your-organization.md b/content/support/9927533-disable-public-projects-for-your-organization.md
index e2074d5be7..01eaf94792 100644
--- a/content/support/9927533-disable-public-projects-for-your-organization.md
+++ b/content/support/9927533-disable-public-projects-for-your-organization.md
@@ -10,7 +10,7 @@ Follow these steps:
 
 2. Find **Public projects** and toggle it off
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2053902291/8c39d1a79dedc97411eed54dec5c/CleanShot+2026-02-11+at+11_25_34%402x.png?expires=1789727400&amp;signature=5d42fa57f0e4d7c08e8b0f05686f8f3c3c5bdfdf1a57a56dfba88181fbc1e81a&amp;req=diAiFcB%2Bn4NWWPMW1HO4zfGib26jaQdbYabJlVJ9VPwCi%2BZ6bMF70Tbg07fW%0AtndCjbijB0vQq0vXwKg%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2053902291/8c39d1a79dedc97411eed54dec5c/CleanShot+2026-02-11+at+11_25_34%402x.png?expires=1789796700&amp;signature=30cfe47ad485bb951222b5f0d32b3cb4c9497dd9986c0ba9c133c12b73bb44d7&amp;req=diAiFcB%2Bn4NWWPMW1HO4zfGib26jYgZYYabJlVJ9VPwXt%2F2xETo5KvgxId4R%0AUkRbR8aROEA1mH7ZJ1c%3D%0A)
 
 ## How does disabling public projects work?
 
diff --git a/discovery.json b/discovery.json
index 8652efb88f..32f63174c3 100644
--- a/discovery.json
+++ b/discovery.json
@@ -1,7 +1,7 @@
 {
   "version": 1,
   "note": "What the last full run could see outside sources.json. Written by the fetcher so a new source arrives as a diff a human reviews, not as a line in an Actions log nobody reads. Stable facts only: a change here is always news. `review` is the actionable list \u2014 domains we could archive today and do not.",
-  "updated": "2026-09-18",
+  "updated": "2026-09-19",
   "domains": {
     "anthropic.com": {
       "status": "frozen",
diff --git a/tombstones.json b/tombstones.json
index 461fb896a0..88ed3ef6cd 100644
--- a/tombstones.json
+++ b/tombstones.json
@@ -1,7 +1,7 @@
 {
   "version": 1,
   "note": "URLs confirmed gone upstream. Kept so a page that died once does not report as a fresh failure on every later run, which would bury the failure that is actually new. An entry clears itself if the URL answers again -- but only while something still probes it. Entries whose local file was removed are no longer fetched, so they stay as a record of the restructure rather than a live check.",
-  "updated": "2026-09-18",
+  "updated": "2026-09-19",
   "urls": {
     "https://claude.com/docs/claude-science/annotations": {
       "since": "2026-09-01",