# Claude Enterprise > Connect your Claude Enterprise deployment to Tidal Control for AI governance and access control tests. Read-only, covering organisation settings and membership. Source: https://tidalcontrol.com/docs/integrations/claude-enterprise Tidal Control's Claude Enterprise integration monitors your Claude Enterprise deployment for AI governance and access control purposes. All access is read-only. Tidal Control never creates, modifies, or deletes anything in your Claude organisation. > **warning:** **Claude Enterprise or Anthropic?** Anthropic offers two separate products with two separate keys. Use **this** integration if your **employees use Claude** for chat and projects through Claude Enterprise (`claude.ai`). If your company builds with the Anthropic API through the Claude Console, use the [Anthropic](/docs/integrations/anthropic) integration instead. The keys are not interchangeable. If you use both products, connect both integrations. ## What this integration monitors - **Organisations:** The linked organisations under compliance governance - **Users:** Full name, email, organisation role, and when the account was created - **Roles:** The role catalogue each organisation can assign - **Groups:** Name, description, granted roles, and whether the group is managed directly or provisioned through SCIM - **Group members:** Who belongs to each group - **Organization settings:** Data retention periods, content redaction, IP allowlist configuration, and SSO provisioning mode - **Compliance API keys:** Name, granted scopes, active state, expiry date, and the user who created the key ## Requirements - Super User role in Tidal Control - A **Claude Enterprise** plan (the Compliance API is not available on Claude Team or Pro) - The Compliance API enabled for your organisation - The **primary owner** role for a key that covers every linked organisation, or an **organisation owner** for a key scoped to that one organisation > **info:** **Not on Enterprise?** If **claude.ai → Organization settings** has no **API** page, your organisation is either not on the Enterprise plan or the Compliance API has not been enabled yet. On Claude Enterprise, enabling it is self-service, and it happens at the parent organisation level and cascades to every linked organisation. ## Configuration step-by-step plan We'll create a **Compliance API key** with the two read scopes this integration needs, then add the connection in Tidal Control. **Configuration steps:** 1. **Create a Compliance API key in Claude** 2. **Configure the integration in Tidal Control** ## Step 1: Create a Compliance API key in Claude - Sign in to [claude.ai](https://claude.ai) as the primary owner or an organisation owner - Go to **Organization settings → API** and find the **Keys** section - Click **Create key** and enter a name (e.g. `Tidal Control`) - Select **both** scopes: - `read:compliance_org_data`: organisations, roles, groups, settings, and key inventory - `read:compliance_user_data`: organisation users and group members - Click **Create key** - **Copy the key**: it starts with `sk-ant-api01-` and is only shown once > **warning:** **Save the Compliance API key immediately.** Anthropic only shows the full key value once at creation. If you close the dialog without copying it, you will need to create a new key. > **warning:** **Treat this key as a production secret.** A Compliance API key with `read:compliance_user_data` can read chats, files, and projects across every linked organisation. Tidal Control uses it strictly read-only, for governance and directory data only. It never reads chat or file content, and it never requests the `delete:compliance_user_data` scope. Store the key nowhere else and revoke it in Claude if you suspect it has been exposed. ## Step 2: Configure the integration in Tidal Control - Go to **Settings → Integrations** in Tidal Control - Click the **plus icon** next to **Claude Enterprise** - Fill in the configuration: - **Name:** A descriptive name, e.g. `Claude Enterprise` - **Compliance API Key:** The key from step 1 - Click **"Create"** to save the integration ## Configuration fields explained The integration dialog asks for the following values: **Name:** - A descriptive name for this connection - For example: `Claude Enterprise`, `Claude Enterprise Production` **Compliance API Key:** - The Compliance API key from claude.ai, starting with `sk-ant-api01-` - Created in step 1 - A Claude Console Admin key (`sk-ant-admin01-`) will not work. The Compliance API rejects it - Needs both `read:compliance_org_data` and `read:compliance_user_data` - Keep this value secure ## Available checks The integration runs the following checks, grouped by the area they cover: **AI governance (ISO/IEC 42001):** - Data retention periods configured for the organisation - Whether content redaction is enabled - SSO provisioning mode - Who can access the AI deployment and at what role **Access control (ISO 27001 A.5.15, A.5.18, SOC 2 CC6.1):** - Organisation user roles and the role catalogue - Which roles each group grants, and who belongs to those groups - Compliance API key inventory: active keys, keys without an expiry date, granted scopes, and who created them **Identity management (ISO 27001 A.5.16):** - Whether groups are provisioned through SCIM or managed directly - User and group membership lifecycle **Network security (ISO 27001 A.8.20, SOC 2 CC6.6):** - Whether the IP allowlist is enabled and which ranges it permits **Information deletion (ISO 27001 A.8.10):** - The configured data retention periods > **info:** **The activity feed is not read.** The Compliance API also exposes an activity and event feed covering several years of events. That is an unbounded stream better suited to SIEM ingestion than to compliance snapshots, so this integration deliberately leaves it alone. ## Verification The integration is working when all of the following are true: - Settings → Integrations shows Claude Enterprise under **Configured Integrations** - Claude Enterprise tests are available in the Tests section - Test refresh delivers results without authentication errors ## Frequently asked questions **Does Tidal Control read our Claude conversations, files, or projects?** No. The integration reads governance and directory data only: organisations, users, roles, groups, settings, and key metadata. **Can I use this on Claude Team or Pro?** No. The Compliance API is only available on Claude Enterprise. **Do I need the primary owner role?** Only if you want one key to cover every linked organisation. An organisation owner can create a key scoped to their own organisation. **Can I skip the `read:compliance_user_data` scope?** You can, but the user and group member checks will then fail with an authorization error. The other checks continue to work. ## Common problems **Authentication fails with a 401 error** - Confirm the key starts with `sk-ant-api01-`. A Console Admin key (`sk-ant-admin01-`) is rejected by the Compliance API - Check that the key was copied in full and has not expired or been revoked **User or group member checks fail with a 403 error** - The key is missing the `read:compliance_user_data` scope - Scopes cannot be added to an existing key. Create a new key with both scopes and update the integration **Organization settings return no data** - Compliance settings are not enabled for that linked organisation - Confirm the settings are configured in **Organization settings** for the organisation itself, not only the parent organisation **There is no API page under Organization settings** - Your organisation is not on the Enterprise plan, or the Compliance API has not been enabled yet **Test refresh is slow for large deployments** - Users, roles, and settings are read per organisation, and group members per group, so large deployments take longer to refresh ### Still can't figure it out? Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible. > **info:** **Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably.