Claude Enterprise

Configuring Claude Enterprise integration

Tidal Control's Claude Enterprise integration monitors your Claude Enterprise deployment for AI governance and access control purposes. All access is read-only — Tidal Control never creates, modifies, or deletes anything in your Claude organisation.

What this integration monitors:

• Organisations: The linked organisations under compliance governance
• Users: Full name, email, organisation role, and when the account was created
• Roles: The role catalogue each organisation can assign
• Groups: Name, description, granted roles, and whether the group is managed directly or provisioned through SCIM
• Group members: Who belongs to each group
• Organisation settings: Data retention periods, content redaction, IP allowlist configuration, and SSO provisioning mode
• Compliance API keys: Name, granted scopes, active state, expiry date, and the user who created the key

Requirements:

• Super User role in Tidal Control
• A Claude Enterprise plan — the Compliance API is not available on Claude Team or Pro
• The Compliance API enabled for your organisation
• The primary owner role for a key that covers every linked organisation, or an organisation owner for a key scoped to that one organisation

Configuration step-by-step plan

What we're going to do: We'll create a Compliance API key with the two read scopes this integration needs, then add the connection in Tidal Control.

Configuration steps:

1. Create a Compliance API key in Claude
2. Configure the integration in Tidal Control

Step 1: Create a Compliance API key in Claude

• Sign in to claude.ai as the primary owner or an organisation owner
• Go to Organization settings → API and find the Keys section
• Click Create key and enter a name (e.g. Tidal Control)
• Select both scopes:
  • read:compliance_org_data — organisations, roles, groups, settings, and key inventory
  • read:compliance_user_data — organisation users and group members
• Click Create key
• Copy the key — it starts with sk-ant-api01- and is only shown once

Step 2: Configure the integration in Tidal Control

• Go to Settings → Integrations in Tidal Control
• Click the plus icon next to Claude Enterprise
• Fill in the configuration:
  • Name: A descriptive name, e.g. Claude Enterprise
  • Compliance API Key: The key from step 1
• Click "Create" to save the integration

Configuration fields explained

Name:

• A descriptive name for this connection
• For example: Claude Enterprise, Claude Enterprise Production

Compliance API Key:

• The Compliance API key from claude.ai, starting with sk-ant-api01-
• Created in step 1
• A Claude Console Admin key (sk-ant-admin01-) will not work — the Compliance API rejects it
• Needs both read:compliance_org_data and read:compliance_user_data
• Keep this value secure

Available checks

AI governance (ISO/IEC 42001):

• Data retention periods configured for the organisation
• Whether content redaction is enabled
• SSO provisioning mode
• Who can access the AI deployment and at what role

Access control (ISO 27001 A.5.15, A.5.18, SOC 2 CC6.1):

• Organisation user roles and the role catalogue
• Which roles each group grants, and who belongs to those groups
• Compliance API key inventory — active keys, keys without an expiry date, granted scopes, and who created them

Identity management (ISO 27001 A.5.16):

• Whether groups are provisioned through SCIM or managed directly
• User and group membership lifecycle

Network security (ISO 27001 A.8.20, SOC 2 CC6.6):

• Whether the IP allowlist is enabled and which ranges it permits

Information deletion (ISO 27001 A.8.10):

• The configured data retention periods

Verification

Check integration status:

• Settings → Integrations shows "Connected" status for Claude Enterprise
• Claude Enterprise tests are available in the Tests section
• Test refresh delivers results without authentication errors

Frequently asked questions

Does Tidal Control read our Claude conversations, files, or projects? No. The integration reads governance and directory data only: organisations, users, roles, groups, settings, and key metadata.

Can I use this on Claude Team or Pro? No. The Compliance API is only available on Claude Enterprise.

Do I need the primary owner role? Only if you want one key to cover every linked organisation. An organisation owner can create a key scoped to their own organisation.

Can I skip the read:compliance_user_data scope? You can, but the user and group member checks will then fail with an authorization error. The other checks continue to work.

Common problems

Authentication fails with a 401 error

• Confirm the key starts with sk-ant-api01- — a Console Admin key (sk-ant-admin01-) is rejected by the Compliance API
• Check that the key was copied in full and has not expired or been revoked

User or group member checks fail with a 403 error

• The key is missing the read:compliance_user_data scope
• Scopes cannot be added to an existing key — create a new key with both scopes and update the integration

Organisation settings return no data

• Compliance settings are not enabled for that linked organisation
• Confirm the settings are configured in Organization settings for the organisation itself, not only the parent organisation

There is no API page under Organization settings

• Your organisation is not on the Enterprise plan, or the Compliance API has not been enabled yet

Test refresh is slow for large deployments

• Users, roles, and settings are read per organisation, and group members per group, so large deployments take longer to refresh

Still can't figure it out?

Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible.