Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
374 changes: 194 additions & 180 deletions content/.metadata.json

Large diffs are not rendered by default.

1 change: 0 additions & 1 deletion content/claude-code-manifest.json
Original file line number Diff line number Diff line change
Expand Up @@ -104,7 +104,6 @@
"_nodeVersion": "24.19.0",
"dependencies": {},
"_hasShrinkwrap": false,
"readmeFilename": "README.md",
"optionalDependencies": {
"@anthropic-ai/claude-code-linux-x64": "2.1.260",
"@anthropic-ai/claude-code-win32-x64": "2.1.260",
Expand Down
36 changes: 36 additions & 0 deletions content/claude/cowork/changelog.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,42 @@

> Release notes for Claude Desktop

<Update label="v1.46388.3" description="2026-09-04">
**General**

* No user-facing changes.

**Code**

* No user-facing changes.

**Cowork**

* Added support for attaching your home folder, Windows Documents, AppData, the macOS Library folder, and whole drives; Claude's own configuration and session data inside them stay off-limits, as do certain credential and shell-startup locations (for example SSH keys, AWS and Google Cloud credentials, and bash, zsh and PowerShell profile files).

**3P**

* No user-facing changes.
</Update>

<Update label="v1.46388.2" description="2026-09-04">
**General**

* No user-facing changes.

**Code**

* Fixed Code sessions started in a git worktree failing to initialize on Windows.

**Cowork**

* No user-facing changes.

**3P**

* No user-facing changes.
</Update>

<Update label="v1.46388.1" description="2026-09-04">
**General**

Expand Down
4 changes: 4 additions & 0 deletions content/claude/government/changelog.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,10 @@

> Release notes for Claude for Government

<Update label="2026.09.04.1">
* Changed the limit on a member's active app sign-ins from 3 shared across the Claude apps to 6 in each app: a new sign-in over the limit now signs out the one closest to expiring instead of the oldest.
</Update>

<Update label="2026.09.03.1">
* Fixed Admin Console pages sometimes loading part light and part dark when your computer is set to dark mode, which made some text hard to read.
* Improved the Admin Console for tenant admins who manage several organizations: every page shows which organization or tenant your changes apply to.
Expand Down
42 changes: 34 additions & 8 deletions content/claude/government/config/settings.md
Original file line number Diff line number Diff line change
Expand Up @@ -52,31 +52,57 @@ Organization instructions guide how Claude responds, and they are not an enforce
**Set at the tenant and organization levels only.** This setting cannot be set for a group.
</Note>

### Telemetry endpoint (Claude Desktop)
### Telemetry endpoint

The base address of the collector where Claude Desktop sends usage telemetry using the [OpenTelemetry](https://opentelemetry.io/) protocol (OTLP), for example `https://otel-collector.example.gov:4318`. Claude Desktop appends the OTLP request paths `/v1/logs` and `/v1/metrics` itself, so enter the address without those suffixes. Leaving the value empty disables telemetry.

The value must begin with `https://` and may include a port and a path prefix. Its host must be a hostname or a private-network address, and a public IP address is refused. A matching **Telemetry endpoint (Claude for Microsoft 365)** setting covers that product.
The value must begin with `https://` and may include a port and a path prefix. Its host must be a hostname or a private-network address, and a public IP address is refused.

Point this address at a receiver that accepts OTLP over HTTP in both its protobuf and JSON encodings. An [OpenTelemetry Collector](https://opentelemetry.io/docs/collector/) does this by default and conventionally listens for OTLP over HTTP on port 4318. If your logging or SIEM platform accepts only its own HTTP ingestion format, run an OpenTelemetry Collector that receives OTLP and forwards to that platform, and enter the collector's address here.

Claude Desktop on each member's device connects to this address itself rather than through the Claude for Government service. The collector must therefore be reachable from your members' networks and must present a TLS certificate that their operating system trusts.

Members pick up a new or changed endpoint the next time they start Claude Desktop. From then on your collector receives OpenTelemetry logs and metrics for each member's activity under three `service.name` values:
Members pick up a new or changed endpoint the next time they start Claude Desktop. Once a member has signed in and the app has loaded their configuration from Claude for Government, it takes its telemetry settings from that configuration alone and ignores telemetry keys set on the device itself, such as the `otlp*` keys in the Claude Desktop [configuration reference](/docs/third-party/claude-desktop/configuration). From then on your collector receives OpenTelemetry logs and metrics for each member's activity under three `service.name` values:

* `cowork` for Chat and Cowork activity
* `claude-code-desktop` for Code sessions
* `claude-desktop` for error events from the application itself
* `claude-desktop` for events from the application itself, errors only by default

Each conversation turn produces events such as `user_prompt`, `api_request`, and `tool_result` that record the model, token counts, durations, and tool names. Every record also carries the member's operating-system login name as the `enduser.id` and `process.owner` resource attributes. Message text, file contents, and tool output are not included. See the [event reference in Monitoring](/docs/cowork/monitoring#events) for each event's attributes.
Each conversation turn produces events such as `user_prompt`, `api_request`, and `tool_result` that record the model, token counts, durations, and tool names. Every record also carries the member's operating-system login name as the `enduser.id` and `process.owner` resource attributes. Message text, file contents, and tool output are included only for the categories you select in **Telemetry content capture**. See the [event reference in Monitoring](/docs/cowork/monitoring#events) for each event's attributes.

Claude Desktop keeps working when the collector refuses requests or cannot be reached, and members see no error. To confirm telemetry is arriving, check your collector's own request logs or metrics for requests to `/v1/logs` after a member has restarted Claude Desktop and sent a message.

### Telemetry headers (Claude Desktop)
### Telemetry headers

Headers that Claude Desktop sends with every telemetry request, typically the credential your collector requires. Leave the setting empty if your collector does not require one. Because the value may contain a secret, it is never displayed after you save it; you see only that it is set.
Headers sent with every telemetry request, typically the credential your collector requires. Leave the setting empty if your collector does not require one. Because the value may contain a secret, it is never displayed after you save it; you see only that it is set.

Write each header as `Name=value`, for example `Authorization=Bearer <token>`. To send more than one header, separate them with commas, as in `Authorization=Bearer <token>,X-Tenant=agency`. Because the comma is the separator, a header value itself cannot contain one. Spaces and `=` characters within a value are fine.
Click **Add header**, then enter the header's name and value, for example `Authorization` and `Bearer <token>`, and add a row for each additional header. A value can contain spaces and `=` characters, but not a comma. Because saved headers are hidden, the headers you enter later replace all of the saved ones when you save, so enter every header again when you add or change one.

### Telemetry content capture

The content that Claude Desktop adds to the telemetry it sends to your collector, chosen from **Prompts**, **Claude's responses**, **Tool inputs**, **Tool results**, and **Full requests and responses**. Nothing is selected by default, so the export records activity such as models, token counts, durations, and tool names without any message or tool text.

**Tool results** content is delivered only while **Telemetry traces** is on. Captured content goes only to your collector and is never sent to Anthropic. [Content capture](/docs/third-party/claude-desktop/telemetry#content-capture) in the Claude Desktop telemetry reference shows what each category adds.

<Note>
**Telemetry content capture** applies to Claude Desktop 1.15962.0 and later. Earlier versions ignore the setting.
</Note>

### Application event level (Claude Desktop)

How much of Claude Desktop's own event log goes to your collector, in addition to the usage telemetry from Chat, Cowork, and Code. These records arrive under the `claude-desktop` service name. The default, **Errors only**, sends failures such as a crash or a request that could not complete. **Off** sends no application events while usage telemetry is still sent, the two levels between **Errors only** and **Debug** add warnings and then routine events such as sign-in, updates, and settings changes, and **Debug** adds verbose diagnostic events for use while troubleshooting with support.

### Telemetry resource attributes

Labels added to every telemetry record sent to your collector, such as your agency or environment name, so the collector can tell where each record comes from. Click **Add attribute**, then enter the attribute's name and value, for example `deployment.environment` and `production`. Attribute names are case-sensitive. A value can be up to 255 characters long when it uses only English letters, digits, and the characters `-`, `.`, `_`, and `~`. Any other character counts as three or more, so a space counts as three and an accented letter such as `é` counts as six. A list set at a more specific level, such as an organization, replaces the whole list inherited from the level above rather than adding to it, so repeat any attributes that should still apply.

### Telemetry traces

Sends a trace for each request in Cowork and Code sessions to the `/v1/traces` path of the address in **Telemetry endpoint**, so your monitoring tools can follow the events of one request together. The setting is off by default and is in beta. Traces carry message and tool content only for the categories selected in **Telemetry content capture**. [Traces](/docs/third-party/claude-desktop/telemetry#traces-beta) in the Claude Desktop telemetry reference describes what a trace contains.

<Note>
**Telemetry traces** applies to Claude Desktop 1.22209.0 and later. Earlier versions ignore the setting.
</Note>

### Block automatic updates

Expand Down
2 changes: 1 addition & 1 deletion content/claude/government/deploy-desktop/configure.md
Original file line number Diff line number Diff line change
Expand Up @@ -65,7 +65,7 @@ The configuration that the app downloads for a user includes the following setti
| The hosts that tools may reach | [Allowed network hosts](/docs/government/config/settings#allowed-network-hosts) |
| The folders a user can choose as a workspace | [Allowed workspace folders](/docs/government/config/settings#allowed-workspace-folders) |
| The banner shown across the top of the app | [Claude Desktop banner](/docs/government/config/settings#claude-desktop-banner) |
| Where the app sends your agency's own telemetry, if you have set a collector | [Telemetry endpoint (Claude Desktop)](/docs/government/config/settings#telemetry-endpoint-claude-desktop) |
| Where the app sends your agency's own telemetry, if you have set a collector | [Telemetry endpoint](/docs/government/config/settings#telemetry-endpoint) |
| Whether automatic updates are blocked, and the restart deadline for an update the app has downloaded | [Block automatic updates](/docs/government/config/settings#block-automatic-updates) and [Restart deadline for updates](/docs/government/config/settings#restart-deadline-for-updates) on the Config page |

## Configure a single machine
Expand Down
2 changes: 1 addition & 1 deletion content/claude/government/org-admin/compliance-api.md
Original file line number Diff line number Diff line change
Expand Up @@ -147,7 +147,7 @@ Listing and revoking existing keys in the portal remains available even when the

* The Claude for Government Compliance API is served from the Claude for Government service hostname, not from `api.anthropic.com`. Use the same host you use to reach the admin portal.
* There is no separate Splunk add-on. The polling pattern described under [Connecting to your SIEM](#connecting-to-your-siem) is the reference implementation for a Splunk HTTP Event Collector job.
* The desktop application's OpenTelemetry export is a separate log stream configured with **Telemetry endpoint (Claude Desktop)** on the [Config](/docs/government/config/settings#telemetry-endpoint-claude-desktop) page. It carries per-session tool and telemetry events to a collector you specify, while this API carries administrative audit events. See [Telemetry and egress](/docs/third-party/claude-desktop/telemetry) for what the OpenTelemetry export includes.
* The desktop application's OpenTelemetry export is a separate log stream configured with **Telemetry endpoint** on the [Config](/docs/government/config/settings#telemetry-endpoint) page. It carries per-session tool and telemetry events to a collector you specify, while this API carries administrative audit events. See [Telemetry and egress](/docs/third-party/claude-desktop/telemetry) for what the OpenTelemetry export includes.
* The Compliance API returns governance and audit events only. It does not return conversation content, files, or anything your users type into Claude.
* Each organization can hold up to 50 active keys at once. Revoked keys do not count toward this limit.
* Events are returned newest first within each page.
Expand Down
Loading
Loading