Anthropic's Compliance API can read saved Claude instructions

On 15 October 2026, Anthropic’s release notes said the Compliance API now returns the text each organization member saved as Instructions for Claude in claude.ai and as Global instructions in Cowork. The note says this is in beta for Claude Enterprise organizations. The call it names is GET /v1/compliance/organizations/{org_uuid}/user_preferences, using an existing Compliance Access Key and the read:compliance_user_data scope. It points to the List user preferences section of the organization-data guide.

What the docs say the call returns

That section says the endpoint returns conversation_preferences, the Instructions for Claude text from claude.ai, and cowork_global_instructions, the Global instructions text from Cowork. Both are account-level settings, so the same text is returned under every organization a member belongs to. The section says the endpoint is in beta. It requires read:compliance_user_data on a Compliance Access Key. A key that lacks that scope is refused. The page’s directory endpoints are described as the directory side of a Claude Enterprise organization.

By default, the response lists only members who have set at least one of the two values. The docs say include_unset=true lists every current member, with a null where a value is not set, and that a caller can pass up to 10 user IDs. Pagination uses limit (default 20, maximum 100) and a page token. The JSON sample on the page is an example of the shape, not a record from a named customer.

The List user preferences section does not say whether members are notified when an organization reads this text.

Which key the docs describe

Set up the Compliance API says Claude Enterprise organizations and eligible standalone Claude Console organizations have self-service access to the Compliance API. A Compliance Access Key is created in claude.ai and is the key type that reaches the wider API. An Admin API key created in Claude Console reaches the Activity Feed only. The Compliance API overview says the same split: a Compliance Access Key reaches every endpoint, and an Admin API key reaches the Activity Feed only. The 15 October note attaches this new call to a Compliance Access Key and to Claude Enterprise organizations. The scope list on the setup page includes user preferences under read:compliance_user_data, together with chats, messages, files, projects, session transcripts, organization users, and group members.

Earlier entries on the same page

The same release notes page dates earlier Compliance API expansions, separate from this one. On 11 August 2026 it said the API could return transcripts of Cowork and Claude Code sessions that run on users’ machines, then in beta for Claude Enterprise organizations, with the same key and scope. On 26 August 2026 it said the session endpoints were out of beta for Cowork and Claude Code sessions. On 18 September 2026 it said local session endpoints also return Claude in Chrome sessions, in beta for Claude Enterprise organizations. On 8 October 2026 it said chat endpoints also return chats from the unified Claude experience, in beta for Claude Enterprise organizations, with an existing Compliance Access Key. The 15 October entry adds the saved instruction text. It does not change those session or chat endpoints.

For an Enterprise program that already holds a Compliance Access Key, the documented change is a read of two standing-instruction fields, repeated for every organization the member belongs to. The pages opened here describe the scope, the fields, and the beta. They do not say members are told when that read happens. A workplace notice about this access has to be decided outside these docs.