Claude Compliance API User Preferences: Curl Request Example

The Claude Compliance API user preferences endpoint is GET /v1/compliance/organizations/{org_uuid}/user_preferences. You call it with a Compliance Access Key that carries the read:compliance_user_data scope, and you send the anthropic-version header like on any other Claude API request. That's the whole shape of the call.

One caveat up front. The official release notes I have for this post confirm the Compliance API exists and that its guide now shows the anthropic-version header. They don't document the response body of this endpoint. So I'll show the request, explain how to check it, and point you to the Compliance API guide for the exact fields instead of guessing at them.

What the user preferences endpoint is#

The Compliance API is part of the Claude Enterprise side of the platform. The release notes mention one other endpoint by path, the Activity Feed at GET /v1/compliance/activities. It also became available on Claude Platform on AWS in June 2026, with a ListComplianceActivities IAM action authorizing it.

The user preferences endpoint follows the same URL pattern: everything lives under /v1/compliance/organizations/{org_uuid}/ and is scoped to one organization. Note the difference from the Activity Feed path, which has no organization segment in the form given in the release notes. Don't copy one pattern onto the other.

The request is a plain GET. No request body is involved.

What you need before the first call#

Three things, in this order:

1. The organization UUID. It goes into the path. Take it from your admin console or from whoever administers your Claude Enterprise organization.
2. A Compliance Access Key. This is a distinct credential for the Compliance API. A regular API key isn't what this endpoint expects.
3. The read:compliance_user_data scope on that key. Without it, I'd expect the request to be rejected. Check the scope when you create the key, because fixing it later usually means making a new key.

I'd treat the key like any other secret that can read user data. Keep it in an environment variable or a secrets manager, never in a script you commit.

Working curl example for the user preferences endpoint#

Here's the smallest request. The URL and the anthropic-version header come straight from the brief and the release notes. The key header name and the version value are the two things I'm deliberately not hard-coding, because the pack I'm working from doesn't state them. Copy both from the Compliance API guide and the API versions page.

export ORG_UUID="your-org-uuid"
export COMPLIANCE_KEY="your-compliance-access-key"
export ANTHROPIC_VERSION="value-from-the-api-versions-page"

curl --silent --show-error \
  "https://api.anthropic.com/v1/compliance/organizations/${ORG_UUID}/user_preferences" \
  --header "anthropic-version: ${ANTHROPIC_VERSION}" \
  --header "<auth header from the Compliance API guide>: ${COMPLIANCE_KEY}"

Replace the last --header line with the authentication header the Compliance API guide specifies for Compliance Access Keys. The base host api.anthropic.com is the standard Claude API host; confirm it in the guide too if your organization uses a different surface.

A few variations that help while debugging, all standard curl flags (see the curl manual):

# Show the HTTP status line and response headers too
curl --include ... 

# Print only the status code
curl --silent --output /dev/null --write-out "%{http_code}\n" ...

# Fail with a non-zero exit code on 4xx/5xx
curl --fail-with-body ...

The --write-out variant is my first move when a call fails. A 401 or 403 tells you something very different from a 404, and a pretty-printed body can hide that.

What the response contains#

The release notes don't describe the response schema for this endpoint, so I won't list fields. What I can say is how to find out safely:

• Run the call once against your organization and save the raw JSON to a local file.
• Pipe it through a JSON tool such as jq to list the top-level keys before you write any parsing code.
• Compare what you see with the Compliance API guide. If a field is in your response but not in the docs, don't build on it.

The endpoint name suggests it returns user preference data for people in the organization, and the scope name read:compliance_user_data tells you that you're reading user data, so treat the output as sensitive. Don't paste real responses into tickets or chat. If you need a sample for a bug report, redact it first.

If the response is large, check the guide for pagination before assuming you got everything. I can't tell you from the pack whether this endpoint paginates. The Files API got page and next_page pagination in August 2026, but that's a different endpoint family, so don't assume the same parameters apply here.

Build and sanity-check the request in code#

If you'd rather generate the request from a script, validate the UUID before sending anything. A malformed UUID in the path produces a confusing error that looks like an auth problem. This runnable example builds the URL and the header list, masks the key, and rejects a bad UUID. It makes no network calls.

import uuid

def build_request(org_uuid: str, key: str, version: str):
    # Raises ValueError if the org id isn't a valid UUID
    org = str(uuid.UUID(org_uuid))
    url = f"https://api.anthropic.com/v1/compliance/organizations/{org}/user_preferences"
    headers = {
        "anthropic-version": version,
        "x-key-placeholder": key[:4] + "..." if key else "(missing)",
    }
    return url, headers

for candidate in ["8f1c2d3e-4a5b-6c7d-8e9f-0a1b2c3d4e5f", "not-a-uuid"]:
    try:
        url, headers = build_request(candidate, "sk-example-key", "VERSION")
        print("OK ", url)
        print("    ", headers)
    except ValueError:
        print("BAD", candidate, "is not a valid UUID")

The header name x-key-placeholder is intentionally fake. Swap in the real one from the guide. The point of the example is the UUID check and keeping the key out of your logs, which uses only the standard library uuid module.

A second small check: confirm the three environment variables are set before calling curl. This catches the most common cause of a confusing first failure.

const required = ["ORG_UUID", "COMPLIANCE_KEY", "ANTHROPIC_VERSION"];
const missing = required.filter((name) => !process.env[name]);

if (missing.length) {
  console.log("Not ready. Missing:", missing.join(", "));
} else {
  console.log("All variables set. Safe to run the curl call.");
}

Common mistakes and gotchas#

Leaving out anthropic-version. The September 1, 2026 release notes say the guides for the Claude Enterprise Admin API endpoints, the Analytics API, and the Compliance API now show this header, and that you should send it on every request to these endpoints. Don't skip it because an older script worked without it.

Using the wrong kind of key. A normal API key isn't a Compliance Access Key. If you get an authentication error with a key that works elsewhere, that's the first thing I'd suspect.

Missing scope. The key needs read:compliance_user_data. A key with other compliance scopes may authenticate fine and still be refused here. If you can see the key's scopes in the console, check them before you debug anything else.

Mixing up the two path styles. The Activity Feed is GET /v1/compliance/activities. The user preferences endpoint is under /v1/compliance/organizations/{org_uuid}/. Typing the wrong one gives you a not-found style error, not a helpful hint.

Using the wrong organization UUID. If your company has more than one organization, the key and the UUID must belong together. I'd verify that before blaming the scope.

Logging the response. This is user data. Turn off verbose request logging in any wrapper, and don't dump responses into CI output.

Assuming AWS parity. The release notes say the Activity Feed is available on Claude Platform on AWS, with its own IAM action. They say nothing about user preferences there. If you're on that platform, check the IAM actions page before you build on the endpoint.

Where to check current details#

The Compliance API is a moving target, and the release notes are the quickest way to see when it changes. Read the Claude Platform release notes before you commit to field names, and check the Compliance API guide on docs.claude.com for the authentication header, the response schema, and any pagination or rate limit behavior. I haven't stated limits here because the pack I used doesn't state any.

My advice: treat your first successful call as a schema discovery step. Save one response, read it against the guide, and only then write the code that depends on it.

Quick reference checklist#

• Endpoint: GET /v1/compliance/organizations/{org_uuid}/user_preferences
• Credential: a Compliance Access Key, not a regular API key
• Scope: read:compliance_user_data
• Header: send anthropic-version on every request
• Auth header name and version value: copy from the official guides
• Validate the org UUID before sending
• Print the HTTP status first, then the body
• Treat the response as sensitive user data
• Confirm field names against the Compliance API guide before parsing
• Keep the key in an environment variable, never in committed code

Quick answers