Anthropic Integration

The Ledger Anthropic integration inventories Anthropic organization workspaces and API keys through the Anthropic Admin API. The integration also reads organization member data, but uses it only to enrich API key creator details.

Setup uses a single Admin API key that starts with sk-ant-admin. Defakto stores this onboarding key encrypted and uses it to scan the organization remotely.

What Data is Collected?

1. Identities - Anthropic organization workspaces.
2. Secrets - Anthropic API keys, including each key's name, status, redacted hint, creator, creation time, and last observed use.

Raw secret values are not retained in Ledger scan results.

This integration does not discover applications on its own. To correlate Anthropic API keys with the applications that use them, configure another workload integration, such as Kubernetes or Gemini Enterprise Agent Platform (Gemini EAP).

Supported Remediations

• Unused Secret: Ledger detects Anthropic API keys that have not been used within the defined threshold (default 60 days) and suggests them for archiving.
• Migrations: Migrate eligible API keys detected in Kubernetes or Gemini EAP to workload identity federation. See the Anthropic federation tutorial for details.

Integration Permissions

The integration requires an Anthropic organization Admin role to create the onboarding Admin API key. It reads organization details, workspaces, users, API key metadata, and API key usage through the Admin API. Full values for inventoried API keys are never returned by the Admin API.

See the Anthropic Admin API documentation for details.

Installation

No applications are required to be installed on the target environment. You provide an Admin API key, and Defakto uses it to scan the Anthropic organization remotely.

Prerequisites

You must have the Admin role in the Anthropic organization and an Admin API key that starts with sk-ant-admin.

Steps

1. Visit the "Integrations" page in the Defakto Console. Click "Create Integration".
2. Select "Anthropic" from the list of available integrations under "Mind". Configure the following fields:
   • Admin API key: An Anthropic Admin API key that starts with sk-ant-admin. (required)
   • Integration Name: A unique name for this integration. This will be used to identify the integration in the Console and CLI. (required)
3. Create the integration. The integration will automatically start scanning the connected Anthropic organization.
4. On the integration details page, use the "Run Now" button to trigger an immediate scan and refresh the inventory at any time.

Caveats

1. Each integration scans one Anthropic organization. Configure a separate integration for each organization.
2. Last-observed-use timestamps come from the Admin API's last_used_at field. When that field is empty, Ledger falls back to querying the previous six months of usage data. A key with no recorded use in that window shows no last observed use.
3. Inventoried API keys are represented by redacted hints. Workload integrations correlate candidate values using hashed fingerprints, but raw values are not retained in Ledger scan results.
4. The Anthropic Admin API is unavailable to individual accounts. This integration is unsupported for Claude Platform on AWS.