Telemetry Content Gates, Audit Events and the Usage & Cost API

1.What telemetry records by default, and the gates that reveal more

By default, telemetry records what happened, not what was said. Raw file contents and code snippets are not included in metrics or events. Prompts and responses are recorded only as lengths. A set of separate OTEL_LOG_* variables reveals more, and each one opens a specific kind of content. Telemetry is sent only to the endpoint you configure, never to Anthropic, but anything you reveal will be stored in your backend. The guide therefore advises configuring that backend to filter or redact sensitive attributes.

Two interactions between the gates catch people out. First, OTEL_LOG_ASSISTANT_RESPONSES falls back to OTEL_LOG_USER_PROMPTS when it is unset. Turning on prompts alone therefore turns on responses too, unless you explicitly set the response flag to 0. Second, raw API bodies contain the whole conversation history, so enabling them amounts to enabling every other content gate. Content-bearing attributes are truncated at a content limit of 60 KB by default, which CLAUDE_CODE_OTEL_CONTENT_MAX_LENGTH can change.

Sources12

2.Tagging deployments and routing audit events

Telemetry from many agents is only useful if you can tell them apart. In the Agent SDK, the standard OTEL_SERVICE_NAME and OTEL_RESOURCE_ATTRIBUTES variables label everything an agent emits. The guide's example uses them for service, version and deployment environment. A second example sets enduser.id and tenant.id per request, so that cost and latency can be broken down by customer.

options = ClaudeAgentOptions(
    env={
        # ... exporter configuration from the Enable telemetry export example ...
        "OTEL_SERVICE_NAME": "support-triage-agent",
        "OTEL_RESOURCE_ATTRIBUTES": "service.version=1.4.0,deployment.environment=production",
    },
)

Log events also serve as an audit trail. tool_decision records whether a tool call was allowed or denied, and by what. permission_mode_changed records escalations. hook_execution_complete shows policy hooks that blocked an action. auth and mcp_server_connection record logins and server failures. To record the actual commands run and files touched, OTEL_LOG_TOOL_DETAILS=1 must be set as well. The guide's SIEM example sends only the logs signal to a security collector.

{
  "env": {
    "CLAUDE_CODE_ENABLE_TELEMETRY": "1",
    "OTEL_LOGS_EXPORTER": "otlp",
    " ? ": "1",
    "OTEL_EXPORTER_OTLP_LOGS_PROTOCOL": "http/protobuf",
    "OTEL_EXPORTER_OTLP_LOGS_ENDPOINT": "https://siem.example.com:4318/v1/logs",
    "OTEL_EXPORTER_OTLP_HEADERS": "Authorization=Bearer your-siem-token"
  }
}

Sources1

3.Organisation-wide trends with the Usage & Cost Admin API

OpenTelemetry shows what one deployment is doing. The Usage & Cost Admin API shows the whole organisation's historical API usage, the same data as the Console's Usage and Cost pages. Its stated uses include tracking product performance, checking whether a change to the system improved it, setting up alerts, and tuning prompt caching for capacity. It requires an Admin API key. Claude Enterprise organisations use the Analytics API with an Analytics API key instead.

/v1/organizations/usage_report/messages reports token counts split into uncached input, cached input, cache creation and output. You can filter and group by API key, workspace, model, service tier, context window, data residency, or speed.

curl "https://api.anthropic.com/v1/organizations/usage_report/messages?\
starting_at=2025-01-01T00:00:00Z&\
ending_at=2025-01-08T00:00:00Z&\
group_by[]=model&\
bucket_width=1d" \
  -H "anthropic-version: 2023-06-01" \
  -H "x-api-key: $ANTHROPIC_ADMIN_KEY"

/v1/organizations/cost_report returns costs in USD as decimal strings in cents. It covers token usage, web search and code execution, but only in daily buckets. For a sub-daily view, use the usage endpoint's token counts. Both endpoints return results in pages.

Sources3

4.The Claude Code analytics dashboard

For Claude Code specifically, there is also an analytics dashboard that needs no backend. Teams and Enterprise plans use claude.ai/analytics/claude-code. API customers use platform.claude.com/claude-code. Both show adoption-level signals: daily active users and sessions, lines of code accepted, and suggestion accept rate. The Console version adds spend, which is daily API costs in dollars shown alongside user count, plus per-user spend for the month. The guide suggests watching for dips in usage, which may point to friction or problems. Telemetry and the Usage API are where you then look for the cause.

Sources4

Exam traps

Each one states something that sounds right. Open it to see what is actually true.

1. 1.Enabling OTEL_LOG_USER_PROMPTS only exposes prompt text. Response text stays redacted unless you turn it on separately.Why is that wrong?

   OTEL_LOG_ASSISTANT_RESPONSES falls back to OTEL_LOG_USER_PROMPTS when unset. Responses stay redacted only if it is explicitly set to 0.

   Covered in What telemetry records by default, and the gates that reveal more

2. 2.The cost_report endpoint can be bucketed hourly, like usage_report.Why is that wrong?

   Cost reports are daily only. For minute or hour granularity, use the token counts from usage_report/messages.

   Covered in Organisation-wide trends with the Usage & Cost Admin API

Practise it for real

Pull a week of token usage grouped by model and check whether prompt caching is taking effect

1. 1.Export an Admin API key as ANTHROPIC_ADMIN_KEY and run the usage_report curl from this page with group_by[]=model and bucket_width=1d

   Why: The Usage API needs an Admin API key and reports historical usage for the whole organisation

   You should see: Daily buckets for the requested range, with token counts broken down by model

2. 2.Compare the cached input and cache creation token counts with uncached input for each model

   Why: The usage report separates these token types, which shows whether prompts are being served from the cache

   You should see: Cached input should be non-zero for workloads that reuse prompt prefixes

3. 3.If the response contains has_more: true, repeat the request with page set to the next_page value

   Why: Both endpoints return large datasets in pages

   You should see: The final page returns has_more: false

4. 4.Run the cost_report request grouped by workspace_id and description for the same range

   Why: Cost reports give USD figures to set beside the token counts

   You should see: Daily cost buckets with costs as decimal strings in cents