---
title: Anthropic Compliance admin API key created
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Anthropic Compliance admin API key
  created
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Anthropic Compliance admin API key created

{% alert level="danger" %}
This rule is part of a beta feature. To learn more, [contact Support](https://docs.datadoghq.com/help/).
{% /alert %}
Classification:attackTactic:[TA0003-persistence](https://attack.mitre.org/tactics/TA0003)Technique:[T1098-account-manipulation](https://attack.mitre.org/techniques/T1098) 
## Goal{% #goal %}

Detects when a new Anthropic Admin API key is created.

## Strategy{% #strategy %}

This rule monitors Anthropic Compliance activities for `api_key_created` events that carry a `scopes` array (the field that distinguishes Admin API keys from Claude inference keys). Admin API keys authenticate Admin API requests for managing users, invites, workspaces, and platform API keys, and authenticate Activity Feed requests with the `read:compliance_activities` scope when the Compliance API is enabled. They are intrinsically higher-privilege than ordinary Claude (platform) API keys, so creation warrants Medium severity even with no other context. Note: the parallel `platform_api_key_created` event covers Claude inference keys, does not carry `scopes`, and is intentionally out of scope here.

## Triage and response{% #triage-and-response %}

- Confirm `{{@usr.email}}` is an organization admin authorized to create Admin API keys.
- Inspect the granted `@scopes` array for unexpected privileges.
- Examine the actor's recent authentication and privilege-change history for compromise indicators.
- Verify the documented intended use of the key (CI automation, internal tooling) and that it is stored in a secrets manager.
- If the action was unauthorized, revoke it via the Compliance console and audit any Admin API actions taken with the key.