diff --git a/content/.metadata.json b/content/.metadata.json
index 28518efa52..74134402a5 100644
--- a/content/.metadata.json
+++ b/content/.metadata.json
@@ -1,7 +1,7 @@
 {
   "metadata": {
     "version": "2.0",
-    "fetch_date": "2026-10-23T05:31:16.679559Z",
+    "fetch_date": "2026-10-23T10:38:02.514858Z",
     "section": "all"
   },
   "items": [
@@ -30,15 +30,15 @@
       "url": "https://platform.claude.com/docs/en/get-started",
       "status": "success",
       "path": "en/get-started.md",
-      "sha256": "b9a2f4d7be92cfe4f7ea097ba494788f002ed42dd8200ab496f557b30625d27b",
+      "sha256": "5d534f76e0081f7b5eab02e80bd9418f4b7a33878967e05fd2fb97e737a66f50",
       "size": 19385
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/authentication",
       "status": "success",
       "path": "en/manage-claude/authentication.md",
-      "sha256": "02d92937e4ae5e7408818b1907f3ee28d4bd33aaea36b136ccd66839a3159760",
-      "size": 25942
+      "sha256": "fc9d6ce33ee879d3fda6bd325818339351f21a865de6629620ac03aa5ad31fdb",
+      "size": 25953
     },
     {
       "url": "https://platform.claude.com/docs/en/build-with-claude/overview",
@@ -51,22 +51,22 @@
       "url": "https://platform.claude.com/docs/en/build-with-claude/working-with-messages",
       "status": "success",
       "path": "en/build-with-claude/working-with-messages.md",
-      "sha256": "3188eab5ed69cce1a81291def99e054102e953d50e41eb9ef1090a27db1705da",
-      "size": 33213
+      "sha256": "0a66bef1b30c5d0207f14d43720c88ee7658f2e1a4a2c3bf8f5a088cdc39d22f",
+      "size": 33198
     },
     {
       "url": "https://platform.claude.com/docs/en/build-with-claude/handling-stop-reasons",
       "status": "success",
       "path": "en/build-with-claude/handling-stop-reasons.md",
-      "sha256": "7471523ae850366cd15c0ab1b16846583358dda88a113ead73eb4f2513755a8b",
-      "size": 120346
+      "sha256": "eeca7b4a3f68d26c3ebffe614aed17af07213bfb2c7ac56a8b2c21d9f4538cf6",
+      "size": 120336
     },
     {
       "url": "https://platform.claude.com/docs/en/build-with-claude/refusals-and-fallback",
       "status": "success",
       "path": "en/build-with-claude/refusals-and-fallback.md",
-      "sha256": "88beb2ebb992de6d4c2cbfaa9d57f8a0e29618d2ee2e849da4328e434c2fcd16",
-      "size": 66018
+      "sha256": "cd21458b5d39840bf9d5d72d2908006b1389ce2a62b4acf2f16a7880b3ffe113",
+      "size": 66044
     },
     {
       "url": "https://platform.claude.com/docs/en/build-with-claude/fallback-credit",
@@ -79,63 +79,63 @@
       "url": "https://platform.claude.com/docs/en/build-with-claude/effort",
       "status": "success",
       "path": "en/build-with-claude/effort.md",
-      "sha256": "725fe89abb7e466aa4b60edb72ff4fc951f5d6be3a0d1b2f70b0ca7e0e3aecdc",
-      "size": 43003
+      "sha256": "c0b2147dcb5b60c6d9eb9b097c509257bfd408e3851395fa5e55c35a2b387c83",
+      "size": 42999
     },
     {
       "url": "https://platform.claude.com/docs/en/build-with-claude/task-budgets",
       "status": "success",
       "path": "en/build-with-claude/task-budgets.md",
-      "sha256": "cfe8d0ead86a8134c1498c9ec5b584f051924ca161b4f4b214d323ab5146db61",
+      "sha256": "9e3a53827df18eaf61fbe8f4243e57a45fdfa5f49effa48e1ef241e8a8615051",
       "size": 28853
     },
     {
       "url": "https://platform.claude.com/docs/en/build-with-claude/fast-mode",
       "status": "success",
       "path": "en/build-with-claude/fast-mode.md",
-      "sha256": "06306b4f7647b2496a372dffe25f3832b517a7b01dcbb8a104223ea55145ba14",
-      "size": 25225
+      "sha256": "415843c22b82ea85d270685c4189bb01dbf055ed541838375e342904f6f64b1b",
+      "size": 25220
     },
     {
       "url": "https://platform.claude.com/docs/en/build-with-claude/structured-outputs",
       "status": "success",
       "path": "en/build-with-claude/structured-outputs.md",
-      "sha256": "dc8f0f237a616cd18245d4dda0c9c1486231b66b8cccdf991bb4eda914a616f5",
-      "size": 102659
+      "sha256": "16a91ab7cfcdc7fb3ed9bf5c03c3babf85455bf17e06c69d5067951899b4d14a",
+      "size": 102614
     },
     {
       "url": "https://platform.claude.com/docs/en/build-with-claude/citations",
       "status": "success",
       "path": "en/build-with-claude/citations.md",
-      "sha256": "1e295a802ead582e5c38180e2a4e829601bc1f9c29c3e35f1d11e3fb61800861",
-      "size": 75337
+      "sha256": "78b3d52503f11ca8c13ce33ccdd5c87592c7c34d97c40f30bfd62703da3c5cb3",
+      "size": 75331
     },
     {
       "url": "https://platform.claude.com/docs/en/build-with-claude/streaming",
       "status": "success",
       "path": "en/build-with-claude/streaming.md",
-      "sha256": "2cc55ee7663fb9d4818f619c14701ebb3cbc7b566ccfb2ec25137a77f2dcc320",
-      "size": 51270
+      "sha256": "c40ac9efa314ee01f11ec7ae9dd3b5b86a1e584df345202822cdbe8ae99ebc71",
+      "size": 51261
     },
     {
       "url": "https://platform.claude.com/docs/en/build-with-claude/batch-processing",
       "status": "success",
       "path": "en/build-with-claude/batch-processing.md",
-      "sha256": "05fb0d6183f1596dd472f462f91b9854f56ac1682a71cf6c90173df6c396b233",
-      "size": 77860
+      "sha256": "bb702d6d70dbde954536a9579996d3e3627320ab568c7d947d3df8d276a4e082",
+      "size": 77851
     },
     {
       "url": "https://platform.claude.com/docs/en/build-with-claude/search-results",
       "status": "success",
       "path": "en/build-with-claude/search-results.md",
-      "sha256": "40de9f54deb768e8ad21cfff2c2e1a3009d66116301f9e72f6931c8e337c522e",
-      "size": 84185
+      "sha256": "808ebe03b40efa9357b747e3e1ceec9b0a848ba8a538a32eec9aa5115bd7ddbf",
+      "size": 84180
     },
     {
       "url": "https://platform.claude.com/docs/en/test-and-evaluate/strengthen-guardrails/handle-streaming-refusals",
       "status": "success",
       "path": "en/test-and-evaluate/strengthen-guardrails/handle-streaming-refusals.md",
-      "sha256": "da14525b94093daa17d0738a4035e27ccf0754a05c116c5dbee4278676f9e413",
+      "sha256": "62c2040622af9f53955f862553984fad2dd595eda695c1310f016e8badd1aa7d",
       "size": 13907
     },
     {
@@ -149,36 +149,36 @@
       "url": "https://platform.claude.com/docs/en/build-with-claude/embeddings",
       "status": "success",
       "path": "en/build-with-claude/embeddings.md",
-      "sha256": "b7d5a601a31d12dd3bfc093ffcd624a0723de9da42900c968dd6282a39a31914",
-      "size": 25434
+      "sha256": "be69599559b945e7e4e2dc102dcb63a087e50b1e1f53c5739bd92c9d986d6889",
+      "size": 25429
     },
     {
       "url": "https://platform.claude.com/docs/en/build-with-claude/thinking",
       "status": "success",
       "path": "en/build-with-claude/thinking.md",
-      "sha256": "4a4ba546b763bafcb2441024da046d0a63f2ca373af54bbfd60f6a4336cd0852",
-      "size": 85160
+      "sha256": "a9f3daf7130dc22c1761a94b8044db1128af26e8cfdddfb08bd35954826ccf9a",
+      "size": 85147
     },
     {
       "url": "https://platform.claude.com/docs/en/build-with-claude/thinking-steering-and-cost",
       "status": "success",
       "path": "en/build-with-claude/thinking-steering-and-cost.md",
-      "sha256": "4365a0ef40131cea8394567d10f804a84d26f1fcb1f513eda90ff3b005209b93",
-      "size": 41396
+      "sha256": "edfde87b4531aac70cc8f89ac93b52d3df1a0049d10be4df6e04be80d0c95990",
+      "size": 41391
     },
     {
       "url": "https://platform.claude.com/docs/en/build-with-claude/thinking-tool-workflows",
       "status": "success",
       "path": "en/build-with-claude/thinking-tool-workflows.md",
-      "sha256": "d34e47b365450d70bf28544e7339a9232ed8e6fd0586f9116f696032f300dd7e",
-      "size": 31434
+      "sha256": "f727a8c9a6620876a3948c9f4b7a07bd4511fd51320d2f8690fe0f76ce0f0afc",
+      "size": 31429
     },
     {
       "url": "https://platform.claude.com/docs/en/build-with-claude/preserved-thinking",
       "status": "success",
       "path": "en/build-with-claude/preserved-thinking.md",
-      "sha256": "5e8eea7d2ea012f36a6c9c264ccf0de20c13f8c45797e3f13560e5460c6e4afd",
-      "size": 116220
+      "sha256": "8b7cd54f0eda1ef0324d8463c928340206415b1dadf0fad233bac91cae75e487",
+      "size": 116200
     },
     {
       "url": "https://platform.claude.com/docs/en/build-with-claude/thinking-troubleshooting",
@@ -198,8 +198,8 @@
       "url": "https://platform.claude.com/docs/en/agents-and-tools/tool-use/overview",
       "status": "success",
       "path": "en/agents-and-tools/tool-use/overview.md",
-      "sha256": "5d669525449035e393f900f8d62add301e8a0b0137e770a968633361067505d2",
-      "size": 36605
+      "sha256": "578426b9b1401213cff8d440bd276ccad149c7084b4e1e133cc834e05f7232de",
+      "size": 36600
     },
     {
       "url": "https://platform.claude.com/docs/en/agents-and-tools/tool-use/how-tool-use-works",
@@ -219,15 +219,15 @@
       "url": "https://platform.claude.com/docs/en/agents-and-tools/tool-use/define-tools",
       "status": "success",
       "path": "en/agents-and-tools/tool-use/define-tools.md",
-      "sha256": "667fab5d70bdf0240239a2a8a465197d91295f37215440c14f9504898635360e",
+      "sha256": "08cc175105049f01fa8d83491438892f7b9d2e838c5cbacbb8d64f0477098ea9",
       "size": 38564
     },
     {
       "url": "https://platform.claude.com/docs/en/agents-and-tools/tool-use/handle-tool-calls",
       "status": "success",
       "path": "en/agents-and-tools/tool-use/handle-tool-calls.md",
-      "sha256": "380b8caf2330b3241cb86eac1a3ff1841a7bb1302146ffa3d4bd17c1c0d9659b",
-      "size": 13438
+      "sha256": "b739788e7022c083ea121ffad9ccf7011ef10522f736811cf104a1d91ffe0ff7",
+      "size": 13433
     },
     {
       "url": "https://platform.claude.com/docs/en/agents-and-tools/tool-use/parallel-tool-use",
@@ -247,71 +247,71 @@
       "url": "https://platform.claude.com/docs/en/agents-and-tools/tool-use/strict-tool-use",
       "status": "success",
       "path": "en/agents-and-tools/tool-use/strict-tool-use.md",
-      "sha256": "61d54d5d504e747e9ec39d9ea087b634cb2b2c967c1f8282c6bdf7d4fa05eed0",
-      "size": 40271
+      "sha256": "430fb6eb8e05d76b7bac61ec500aef9e11aeb6e047a535d88942fc93a00f1865",
+      "size": 40266
     },
     {
       "url": "https://platform.claude.com/docs/en/agents-and-tools/tool-use/server-tools",
       "status": "success",
       "path": "en/agents-and-tools/tool-use/server-tools.md",
-      "sha256": "304d13fab7b839878a8ee8a7ed31b5a6b351f11777f33d956a5752b1aeda74a6",
-      "size": 43856
+      "sha256": "d985cb56e606c9b031271d7e5ce54b5b7a4a7b2040ac114fd949831c5886f4f3",
+      "size": 43852
     },
     {
       "url": "https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-search-tool",
       "status": "success",
       "path": "en/agents-and-tools/tool-use/web-search-tool.md",
-      "sha256": "073c50dfa1953c8021ae389c7aa1f934ff02e306ed5b2f83bbe5713a7cd42644",
-      "size": 28183
+      "sha256": "23253a069bf9142f1448fa833aa47d438236839c86656546495bd7ed3ef077dd",
+      "size": 28177
     },
     {
       "url": "https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-fetch-tool",
       "status": "success",
       "path": "en/agents-and-tools/tool-use/web-fetch-tool.md",
-      "sha256": "6acfc25b544c09d7eb380051029ba3dda97a1ac8248a002e013c9976bb1383c7",
-      "size": 39509
+      "sha256": "0302061bcd7919e76a8f80f82d601537cbcb14ec21c0f86c1aee406b2406626e",
+      "size": 39498
     },
     {
       "url": "https://platform.claude.com/docs/en/agents-and-tools/tool-use/code-execution-tool",
       "status": "success",
       "path": "en/agents-and-tools/tool-use/code-execution-tool.md",
-      "sha256": "71120ce9038a5a3147f8282e3196327968f684d5a17cdff9fca385e3da414eb4",
-      "size": 61162
+      "sha256": "7ea32b9c34a5208f6da75d9c8f1ff014e237c52244bed3fce6d0ff0ae969427c",
+      "size": 61167
     },
     {
       "url": "https://platform.claude.com/docs/en/agents-and-tools/tool-use/advisor-tool",
       "status": "success",
       "path": "en/agents-and-tools/tool-use/advisor-tool.md",
-      "sha256": "8187bfe5b13edc25ad70276eeae3ab2990badd93fc4509425e7690ceb60c1b66",
-      "size": 101809
+      "sha256": "4d12952fabfde5dac0bd8e34ce15aacea14cffab6699afae56f05b245ddfa43e",
+      "size": 101799
     },
     {
       "url": "https://platform.claude.com/docs/en/agents-and-tools/tool-use/tool-search-tool",
       "status": "success",
       "path": "en/agents-and-tools/tool-use/tool-search-tool.md",
-      "sha256": "2d37a5a68e7604d9e650ac8ff76c5329caab9404f07a84eb5aace107b1d150a4",
-      "size": 37374
+      "sha256": "abb40864398a27c6d6bd4d8333f28d94b756306ff86647381ebaa3c20196efc6",
+      "size": 37368
     },
     {
       "url": "https://platform.claude.com/docs/en/agents-and-tools/tool-use/memory-tool",
       "status": "success",
       "path": "en/agents-and-tools/tool-use/memory-tool.md",
-      "sha256": "ba88b3399fd18bcfead4cebc5da0794829903cd4d2242a712816eee100f4f15a",
-      "size": 39699
+      "sha256": "77bc770ae8208b83a0eac5eb39187b3541f0916f6da82e0b3e6d937e62c61cda",
+      "size": 39689
     },
     {
       "url": "https://platform.claude.com/docs/en/agents-and-tools/tool-use/bash-tool",
       "status": "success",
       "path": "en/agents-and-tools/tool-use/bash-tool.md",
-      "sha256": "e22f67cea8c733f34a3b78c858f089bbeabf5ddcc7f06c1069f93adea7e5e388",
-      "size": 71284
+      "sha256": "0b634a4b029c413600b637c0e42f85b99bfc1f22fe66d9a789cb4b354e9b1b7f",
+      "size": 71279
     },
     {
       "url": "https://platform.claude.com/docs/en/agents-and-tools/tool-use/text-editor-tool",
       "status": "success",
       "path": "en/agents-and-tools/tool-use/text-editor-tool.md",
-      "sha256": "c159b5c07ebb45bf14c5620b74f65de78d952f16cf6578e6c94237897805a469",
-      "size": 82227
+      "sha256": "f283741fe3f95cc6b163635ba86acf8425f683ddfc062f0d420d12b65bcfac38",
+      "size": 82212
     },
     {
       "url": "https://platform.claude.com/docs/en/agents-and-tools/tool-use/browser-use-sdk",
@@ -324,15 +324,15 @@
       "url": "https://platform.claude.com/docs/en/agents-and-tools/tool-use/computer-use-tool",
       "status": "success",
       "path": "en/agents-and-tools/tool-use/computer-use-tool.md",
-      "sha256": "8e097fa15535b284b7682a3271b4931a97d3099c083d9f52a0a287045c1be448",
-      "size": 119228
+      "sha256": "9e6dbe1ae529532f41a03f94c20fc90500d024b226bdb2d85ff150156c9dee0f",
+      "size": 119224
     },
     {
       "url": "https://platform.claude.com/docs/en/agents-and-tools/tool-use/browser-use-tool",
       "status": "success",
       "path": "en/agents-and-tools/tool-use/browser-use-tool.md",
-      "sha256": "2a648cdaae261477610659e73637e493b5a604285758db57363d56eae3a9f791",
-      "size": 108473
+      "sha256": "39e5eee193fcdfbef9b33b5359a0d3400091ca6498f17ffffd904c618092f2e7",
+      "size": 108463
     },
     {
       "url": "https://platform.claude.com/docs/en/agents-and-tools/tool-use/troubleshooting-tool-use",
@@ -373,8 +373,8 @@
       "url": "https://platform.claude.com/docs/en/agents-and-tools/tool-use/programmatic-tool-calling",
       "status": "success",
       "path": "en/agents-and-tools/tool-use/programmatic-tool-calling.md",
-      "sha256": "131fbbba69f20b267c1d7f079a1a61ebef233b06c0680b36050a27aa19b6f8bc",
-      "size": 61161
+      "sha256": "75051edcb39dc93897a1d0c0b63ad70679f04a43fba553d18b58a90c7a8f3f55",
+      "size": 61168
     },
     {
       "url": "https://platform.claude.com/docs/en/agents-and-tools/tool-use/fine-grained-tool-streaming",
@@ -394,21 +394,21 @@
       "url": "https://platform.claude.com/docs/en/build-with-claude/context-editing",
       "status": "success",
       "path": "en/build-with-claude/context-editing.md",
-      "sha256": "41223e95f5dac130e629f0391283feabb1229cb4ba943680bcd6c251e43940d2",
-      "size": 103404
+      "sha256": "17ec0a50255d9eaa539acc596ce246acbb72416d8d16b2ffebb8b40e7d1865c4",
+      "size": 103383
     },
     {
       "url": "https://platform.claude.com/docs/en/build-with-claude/prompt-caching",
       "status": "success",
       "path": "en/build-with-claude/prompt-caching.md",
-      "sha256": "d575f8360eac718b4e12eeb370f249ac8c60818bc36a1eecbcb61518bc78433c",
-      "size": 162342
+      "sha256": "877d675a151da3dc66132fcb0226551a6484ad70c3f8a610e11f363a9b3d8aaa",
+      "size": 162332
     },
     {
       "url": "https://platform.claude.com/docs/en/build-with-claude/mid-conversation-system-messages",
       "status": "success",
       "path": "en/build-with-claude/mid-conversation-system-messages.md",
-      "sha256": "c2a5a44c43eccc6e08577654e664c0c4717c17e00a22ec186d6464108a53072a",
+      "sha256": "3dd3efba07e8a7502d137f46ff862c3bb9a5cfffb59e3575a77027340424db92",
       "size": 105284
     },
     {
@@ -422,15 +422,15 @@
       "url": "https://platform.claude.com/docs/en/build-with-claude/cache-diagnostics",
       "status": "success",
       "path": "en/build-with-claude/cache-diagnostics.md",
-      "sha256": "6a6dee9af50dfc058ea308c6cc1a9359efd90daa4d4fae5797e063d4e93decfd",
-      "size": 46489
+      "sha256": "447862277d94b24085ce5c7bc2959074bfaa31dab8bd99a69be77ad595fc0de2",
+      "size": 46484
     },
     {
       "url": "https://platform.claude.com/docs/en/build-with-claude/token-counting",
       "status": "success",
       "path": "en/build-with-claude/token-counting.md",
-      "sha256": "35902be9b7816b32e95d896064db02aa6852047b06b3195d15fdb626cc27614a",
-      "size": 44283
+      "sha256": "012ebe6155984b65d290bf4d16251f9fce90be46c00188928e6f727e9329aaba",
+      "size": 44259
     },
     {
       "url": "https://platform.claude.com/docs/en/build-with-claude/compaction",
@@ -443,7 +443,7 @@
       "url": "https://platform.claude.com/docs/en/build-with-claude/compaction-on-demand",
       "status": "success",
       "path": "en/build-with-claude/compaction-on-demand.md",
-      "sha256": "33f696a50f2aac78ec03e119167dad3b1659a418e6de5790ffe6cdd9f0893bd8",
+      "sha256": "d83632272cdbfec188352a3e42deb2bb7288a9c4c294f352911f5759e83c3b1a",
       "size": 46869
     },
     {
@@ -471,22 +471,22 @@
       "url": "https://platform.claude.com/docs/en/build-with-claude/compaction-threshold",
       "status": "success",
       "path": "en/build-with-claude/compaction-threshold.md",
-      "sha256": "87463e2386b17d214e7e24da452ff22d0ff72255048d05e333ee272fc46be998",
-      "size": 114612
+      "sha256": "53c43804de512cbab41f7126fdd27a41ab8d068f422ce429620773a95e8bb4fe",
+      "size": 114607
     },
     {
       "url": "https://platform.claude.com/docs/en/build-with-claude/files",
       "status": "success",
       "path": "en/build-with-claude/files.md",
-      "sha256": "a97fa89c496fdf7eaaca7dc1b42e336e4706c1da33036e8acf2f426fac5d985a",
-      "size": 38354
+      "sha256": "2251a6ee3a36c7d277faecbe4ea886e8e28421bff613bab3f9c7f30440169da5",
+      "size": 38344
     },
     {
       "url": "https://platform.claude.com/docs/en/build-with-claude/pdf-support",
       "status": "success",
       "path": "en/build-with-claude/pdf-support.md",
-      "sha256": "655afb4c4b4c7db3ec25c9c3ad4669175065e37c681ba812ba3a58c3571c2967",
-      "size": 62660
+      "sha256": "312c870b2623533077ab17d816962af9537ac3838bbab7b3116884e25e861f92",
+      "size": 62655
     },
     {
       "url": "https://platform.claude.com/docs/en/build-with-claude/vision",
@@ -520,22 +520,22 @@
       "url": "https://platform.claude.com/docs/en/agents-and-tools/agent-skills/best-practices",
       "status": "success",
       "path": "en/agents-and-tools/agent-skills/best-practices.md",
-      "sha256": "f0a5d61b67123a31527e64aae7c5cfc05c4c7e27fff16f5b35ea14b135423960",
-      "size": 42169
+      "sha256": "a1145a06cdf3dbd0c152165d759290ae69f5c72a4cfa47de161cc2bd94de1259",
+      "size": 42155
     },
     {
       "url": "https://platform.claude.com/docs/en/agents-and-tools/agent-skills/enterprise",
       "status": "success",
       "path": "en/agents-and-tools/agent-skills/enterprise.md",
-      "sha256": "138fc1abcd1dbf7579c9b60377dde47a88fd18a4681b37c31bac87bf306f565a",
-      "size": 16441
+      "sha256": "70e15560248c97a8cd5491b3486affcb1f137daa1c234c7f93be87f3efb242e1",
+      "size": 16744
     },
     {
       "url": "https://platform.claude.com/docs/en/build-with-claude/skills-guide",
       "status": "success",
       "path": "en/build-with-claude/skills-guide.md",
-      "sha256": "2ca5b6515423695d709f982b343bdd53b02f7a035183a45c4e42621b999caf39",
-      "size": 145344
+      "sha256": "4c75616d6003796c681404401622b51899ae4bc30af0bc7171cb7bd61899bb89",
+      "size": 145358
     },
     {
       "url": "https://platform.claude.com/docs/en/agents-and-tools/remote-mcp-servers",
@@ -548,8 +548,8 @@
       "url": "https://platform.claude.com/docs/en/agents-and-tools/mcp-connector",
       "status": "success",
       "path": "en/agents-and-tools/mcp-connector.md",
-      "sha256": "58cc0c0a8e88cfd4d1b84a78aa11e5439251358ad9891be035ddaddff68564c5",
-      "size": 73226
+      "sha256": "baf6e8afccc2eb79ccc9cc9b6c1790f070e286fbb99c590ea87bef965acc7984",
+      "size": 73211
     },
     {
       "url": "https://platform.claude.com/docs/en/agents-and-tools/mcp-tunnels/overview",
@@ -590,8 +590,8 @@
       "url": "https://platform.claude.com/docs/en/agents-and-tools/mcp-tunnels/deploy-compose",
       "status": "success",
       "path": "en/agents-and-tools/mcp-tunnels/deploy-compose.md",
-      "sha256": "6aea63f10a02932835663747ef12b398b01017868d849f1ed403f6d4abab4cfc",
-      "size": 22968
+      "sha256": "4681694b242182ede8b4b6c910892bfb2d5949beb17aebcf583ab3f559c066a5",
+      "size": 22967
     },
     {
       "url": "https://platform.claude.com/docs/en/agents-and-tools/mcp-tunnels/security",
@@ -653,8 +653,8 @@
       "url": "https://platform.claude.com/docs/en/build-with-claude/claude-models-on-google-cloud/anthropic-managed",
       "status": "success",
       "path": "en/build-with-claude/claude-models-on-google-cloud/anthropic-managed.md",
-      "sha256": "de44b6f8d794eeb44ebc52e5caf1f433aa8317725e7d829a6454314d1f017a6c",
-      "size": 50625
+      "sha256": "f7eaa725628bd2470cb0dc283c4d20e8b09dbfe77b69e3bbd597e6508464a93a",
+      "size": 50621
     },
     {
       "url": "https://platform.claude.com/docs/en/build-with-claude/claude-models-on-google-cloud/google-managed",
@@ -695,15 +695,15 @@
       "url": "https://platform.claude.com/docs/en/managed-agents/agent-setup",
       "status": "success",
       "path": "en/managed-agents/agent-setup.md",
-      "sha256": "c25342a609d90305b3074a2709757156fccbb9bf00918f330cbcd3639297304c",
-      "size": 41665
+      "sha256": "c473fec6c976abf261e4be21e2d4018bc63daebb82b9d3e827eaa63a31930bf8",
+      "size": 41660
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/tools",
       "status": "success",
       "path": "en/managed-agents/tools.md",
-      "sha256": "d3a94792b766fb99c5811f4c56c50313bebdc790ef0f1310b0b94aa2179b7bec",
-      "size": 19791
+      "sha256": "b558dbcb86be898a9786dc77144002882c391bfd35764a1b371590ce864eb585",
+      "size": 19767
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/tools-web-restrictions",
@@ -723,15 +723,15 @@
       "url": "https://platform.claude.com/docs/en/managed-agents/permission-policies",
       "status": "success",
       "path": "en/managed-agents/permission-policies.md",
-      "sha256": "e67245d60fd8e6d83e6996481167591da583b8b8f90346470191544a68bb6fe8",
-      "size": 47495
+      "sha256": "d04f1f752169deafc515c3b44db2e048a913840194031ab472f1fcbe3c8189d0",
+      "size": 47437
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/skills",
       "status": "success",
       "path": "en/managed-agents/skills.md",
-      "sha256": "b200748fa455cae6d6a83dcc7cccce70640d4f754afa5c5568d7da23280526be",
-      "size": 23090
+      "sha256": "1d11a1d37c9179f96f4e3df120ff5cd009e8c49d3abcab3fa8a86971f314b666",
+      "size": 23084
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/choosing-an-environment",
@@ -744,8 +744,8 @@
       "url": "https://platform.claude.com/docs/en/managed-agents/environments",
       "status": "success",
       "path": "en/managed-agents/environments.md",
-      "sha256": "f51a82d0e011926435d11d4108c196bb7b6951ec0317d5c882dd4ed7d50fefee",
-      "size": 36018
+      "sha256": "3b3cc680dfab8bfd19e25f19450c445f0f6731d81593546909b0512b95866d86",
+      "size": 35970
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/cloud-sandboxes-reference",
@@ -786,8 +786,8 @@
       "url": "https://platform.claude.com/docs/en/managed-agents/self-hosted-sandboxes-operations",
       "status": "success",
       "path": "en/managed-agents/self-hosted-sandboxes-operations.md",
-      "sha256": "c88b1739e976b9eb1a0f6821ff2aa44151aa9947f719a355964c8d4c597c8d73",
-      "size": 18715
+      "sha256": "3691edc9577d77ed7f18cc73d7cfec4d16476a86198ed1fa4a5153a2d0dbe256",
+      "size": 18710
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/self-hosted-sandboxes-reference",
@@ -807,43 +807,43 @@
       "url": "https://platform.claude.com/docs/en/managed-agents/sessions",
       "status": "success",
       "path": "en/managed-agents/sessions.md",
-      "sha256": "559dc5016d13d2d4df20ea8f8f0a019675cd7dee4e84ceeff81307ebf8e00dac",
-      "size": 42682
+      "sha256": "5ae5c5153ca501ea71c0b12ebc596e7e52cb9e02120a455aecd6f17ff71bbc35",
+      "size": 42686
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/session-operations",
       "status": "success",
       "path": "en/managed-agents/session-operations.md",
-      "sha256": "7644fc9ebfc8ca05112016312ed8e15dcdec3a285ee2bcd59c81237ce33de89a",
-      "size": 28082
+      "sha256": "af5ca47b72de780ecd805b5bda87488a04dcbea05ea9e092e5d098e86fb6aad2",
+      "size": 28085
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/events-and-streaming",
       "status": "success",
       "path": "en/managed-agents/events-and-streaming.md",
-      "sha256": "bf686a0233c8da3608952debc83591000b564a4621bc821e5379d762023f10ba",
-      "size": 65559
+      "sha256": "fefd76e2ea9817fc0a8a5f5be66b33722f1d3358504c610322b18d798cf280d6",
+      "size": 64801
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/event-deltas",
       "status": "success",
       "path": "en/managed-agents/event-deltas.md",
-      "sha256": "9ec44c6d9e2a34e978eb1b2b3c20cefcb1fa1f4c15885a00e568880b5ce73873",
-      "size": 41370
+      "sha256": "4492473434a21ce16eac561e3efe3fd23509565310d4898a6e67b481cad47f01",
+      "size": 41360
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/session-observability",
       "status": "success",
       "path": "en/managed-agents/session-observability.md",
-      "sha256": "eadcf9ca539704ee8c4da7326876f093f298a7ba2d6b788a1e3d8b930c7566ee",
-      "size": 11632
+      "sha256": "4cf37f31ac01ac7ac489c8b17433f71575555521cbaf1d24bd55e3f4e444557a",
+      "size": 11627
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/budgets",
       "status": "success",
       "path": "en/managed-agents/budgets.md",
-      "sha256": "95b160607eb189fc725741f7d0ee6f951c20a8479eff5bdc6f76d81315968ed9",
-      "size": 25643
+      "sha256": "adb753ec88e42ea3db64c7678a656119ba1edce55f02fa862d026d0f8e25fc82",
+      "size": 25715
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/webhooks",
@@ -856,15 +856,15 @@
       "url": "https://platform.claude.com/docs/en/managed-agents/define-outcomes",
       "status": "success",
       "path": "en/managed-agents/define-outcomes.md",
-      "sha256": "d65da4b33d667a40ad2216e4ccc3eaddaf4f9db5750c6dde81ccbd7bfa46c50c",
-      "size": 31496
+      "sha256": "1bbaee181240d64e4bdf4b2b2beb685c46312dae8d86947092bd72a60e5629a9",
+      "size": 31486
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/vaults",
       "status": "success",
       "path": "en/managed-agents/vaults.md",
-      "sha256": "9888145f0967f31757205211543e2ca36841ff775e047f5727daffed2d660dc2",
-      "size": 47562
+      "sha256": "62918c32a5b181e761e42b6a729a2a725491a258a1cabc699726f1050f82351b",
+      "size": 47525
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/github",
@@ -891,8 +891,8 @@
       "url": "https://platform.claude.com/docs/en/managed-agents/dreams",
       "status": "success",
       "path": "en/managed-agents/dreams.md",
-      "sha256": "fc74b206ff8c33cf26b89bcfbfdf80f24260ff570754e90cc271b92c3c7dd254",
-      "size": 25290
+      "sha256": "fb076873e1ed0d22176e61727333146f619f1767931b226d2dfd9d806478c393",
+      "size": 25330
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/multiagent-orchestration",
@@ -905,29 +905,29 @@
       "url": "https://platform.claude.com/docs/en/managed-agents/session-threads",
       "status": "success",
       "path": "en/managed-agents/session-threads.md",
-      "sha256": "3b373934c4da94fe97bdf6a48fdbc6368f338042662ab822a16289f191424a32",
-      "size": 36605
+      "sha256": "a37ceda27dc9198bb0aa3ed125f6fb1b03df9029f3667bf014696bcdd959e5a8",
+      "size": 36603
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/workflow-runs",
       "status": "success",
       "path": "en/managed-agents/workflow-runs.md",
-      "sha256": "ff3b5d7f3763e1511fc885b6fce419c1600dc8e25d5fba624dbc001785f61fcf",
-      "size": 76174
+      "sha256": "a1e08132c77071f914b91600ec4c35f5a3a6db34687498fd0f695baf0fe23404",
+      "size": 76164
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/scheduled-deployments",
       "status": "success",
       "path": "en/managed-agents/scheduled-deployments.md",
-      "sha256": "45e18293da1288407acc54571ad4aa00ac0a0a3435698a4052ce38155c6cec64",
-      "size": 29011
+      "sha256": "6f98fa8bab17dafae117b757d15ef1d46e3eb9b019731e74802f89aaffc9e2b4",
+      "size": 29006
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/secure-deployment",
       "status": "success",
       "path": "en/managed-agents/secure-deployment.md",
-      "sha256": "44cd7444fd1fe86894997a24019eaae84c3794d72822d6ce0190e816ce557523",
-      "size": 73480
+      "sha256": "3032aaa455af2bac25655bf6f63491958d7c1bd84714ed054f402fdba78b9a3a",
+      "size": 73438
     },
     {
       "url": "https://platform.claude.com/docs/en/managed-agents/secure-deployment-monitoring",
@@ -954,50 +954,50 @@
       "url": "https://platform.claude.com/docs/en/manage-claude/admin-api",
       "status": "success",
       "path": "en/manage-claude/admin-api.md",
-      "sha256": "60d53c5ed69d1c159dfb6cd5aa4f31e2b3a637f5feb538774cfcccd8a761e277",
-      "size": 54367
+      "sha256": "dd85234e1d703cdd49469ceef457395d216476b8ef1d6f944b8dbc343e1a95ad",
+      "size": 54362
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/user-management",
       "status": "success",
       "path": "en/manage-claude/user-management.md",
-      "sha256": "ec63f3f8f055fe2a83e35b2bbcc420aa2673c95490e2abb2054041d6772a016a",
-      "size": 87500
+      "sha256": "0e80ddb405a0698c4aa6861ab3adb9b73d343576f3143af9596160b87f990561",
+      "size": 87449
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/plugins-api",
       "status": "success",
       "path": "en/manage-claude/plugins-api.md",
-      "sha256": "83ba7acf496beaee31849c364f340198128491484ec552082903a9000a2c147a",
-      "size": 184365
+      "sha256": "89aff83dcf505024a78b7421de120e011ecf857daf7eb08366482cba38e30bb6",
+      "size": 185136
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/workspaces",
       "status": "success",
       "path": "en/manage-claude/workspaces.md",
-      "sha256": "6f9da0b980885490f62bec6aebcc802ebcdeaf2fdf38499bf2181125b750745b",
-      "size": 45549
+      "sha256": "63b85ef98d6b26277e1b929058aba57f1ebd9b424472c966e78985aa120c460d",
+      "size": 45544
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/organization-webhooks",
       "status": "success",
       "path": "en/manage-claude/organization-webhooks.md",
-      "sha256": "aaa370f334bb7b74cc92738cee3d3a1812fef9628a4bd1db8a09bda6e70f71fe",
-      "size": 20944
+      "sha256": "34ebca1a9217a96b55519034bd97fc91703d5aee0f6db192a715600b8e7c32a7",
+      "size": 20934
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/user-profiles",
       "status": "success",
       "path": "en/manage-claude/user-profiles.md",
-      "sha256": "116ffd6517f1f774610128cd3682f76f332a148560c3f3b218cf986dc801e664",
-      "size": 34538
+      "sha256": "2bfc01ceabead4908044874393c6d6d3d4898215208e16d77dc5db006a1316cb",
+      "size": 34528
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/user-profiles-verification-portal",
       "status": "success",
       "path": "en/manage-claude/user-profiles-verification-portal.md",
-      "sha256": "f5a47d8d1ec45c1bc041fca4767607da715388c803d6aba901a1542d8e19b279",
-      "size": 11083
+      "sha256": "b9b47b2ca9aff237eb4e487810f60e51bb23b5a41b2e99810f719ed101018b90",
+      "size": 11078
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/admin-api-keys",
@@ -1017,15 +1017,15 @@
       "url": "https://platform.claude.com/docs/en/manage-claude/workload-identity-federation",
       "status": "success",
       "path": "en/manage-claude/workload-identity-federation.md",
-      "sha256": "036e0180e11e08797167aa053486451ae05c30c6a3eb28fae1804f1af89ef6ea",
-      "size": 26212
+      "sha256": "d57a95831c07fa9529cdc1b1fd824ae9983f5af5667d36ab97dc8514cb5c34f5",
+      "size": 26211
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/wif-admin-api",
       "status": "success",
       "path": "en/manage-claude/wif-admin-api.md",
-      "sha256": "4d9e36c0fa738b1ac119cff2c6e68c0536887c0d1f2c8b38898d4ef9ca17945a",
-      "size": 46621
+      "sha256": "ad35dc4657c663b838a56c95e15fe65c616852225b5bf637522733e30dfd3e6b",
+      "size": 46623
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/wif-reference",
@@ -1038,22 +1038,22 @@
       "url": "https://platform.claude.com/docs/en/manage-claude/wif-providers/aws",
       "status": "success",
       "path": "en/manage-claude/wif-providers/aws.md",
-      "sha256": "338c0226a30b4cba192c0ad782e9e2d695a3ec045eac1e9fc3eb90d252c83fd4",
-      "size": 34701
+      "sha256": "468405f7d8a02d40f45c1abee604e3264216c50db6e51eaf58182bb8299534e4",
+      "size": 34700
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/wif-providers/gcp",
       "status": "success",
       "path": "en/manage-claude/wif-providers/gcp.md",
-      "sha256": "c608f919b5922be7f2e71914e5d190d92c218b023f466225332e9fd1b0991223",
+      "sha256": "b52b24853f81fe04abcd7a1d06152bf5218da6a149f44a779f9b60534d1c047e",
       "size": 22425
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/wif-providers/azure",
       "status": "success",
       "path": "en/manage-claude/wif-providers/azure.md",
-      "sha256": "b7dc2375ab150d92280e0ba642d4eb32005f51a317bf34f35959f9fdbc284c48",
-      "size": 69646
+      "sha256": "5dc890df5ee8befcf71f74075ef75386aecfb8a22acdd69e26b2a2875c1d7d6c",
+      "size": 69650
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/wif-providers/github-actions",
@@ -1066,22 +1066,22 @@
       "url": "https://platform.claude.com/docs/en/manage-claude/wif-providers/kubernetes",
       "status": "success",
       "path": "en/manage-claude/wif-providers/kubernetes.md",
-      "sha256": "e24b34849f24d6ea811f7d53800f29df82d164dfcc33b4a8c0297979dadf4419",
+      "sha256": "c94016b357c004fe384e4cf25dc25ed37c156db0c51cee17d00928ca9b84a09b",
       "size": 14484
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/wif-providers/spiffe",
       "status": "success",
       "path": "en/manage-claude/wif-providers/spiffe.md",
-      "sha256": "8bb474a1bff0eb8e7c925111ab681c69500ff7196c3aaa1311e7468ce732d66b",
-      "size": 30592
+      "sha256": "1124872c10aa678961fe4f2c92885397b34959665f9131d99f0b13744a732b50",
+      "size": 30593
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/wif-providers/okta",
       "status": "success",
       "path": "en/manage-claude/wif-providers/okta.md",
-      "sha256": "31bcb88bd8402ca6e8c0b98caabf6df45b251c08219af836b6e8ac6fc1300e09",
-      "size": 24025
+      "sha256": "7dcdb6d08f2aeb16b2484e0bd71344e70637e92311a065cb614aab8a8c971edf",
+      "size": 24042
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/usage-cost-api",
@@ -1094,36 +1094,36 @@
       "url": "https://platform.claude.com/docs/en/manage-claude/rate-limits-api",
       "status": "success",
       "path": "en/manage-claude/rate-limits-api.md",
-      "sha256": "7de9ec719310d3946b2b4315351cf4f4a17bd33aca9700dc4fbaa5e774048edc",
-      "size": 39725
+      "sha256": "eeb5dc802723f8d9d7cbc6498455d4eeeba3f5527884f6bfe797f0214170ab3c",
+      "size": 39710
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/analytics-api",
       "status": "success",
       "path": "en/manage-claude/analytics-api.md",
-      "sha256": "3b2db8692039ce6136ce51040e8ff3e54049c26fe6fde9be3f1c6b168c78f71b",
-      "size": 14095
+      "sha256": "ffa57cb226263944e74ccd3cdc8efb2bafdf383fc0ae6ec2552e7ef88ed4e093",
+      "size": 14099
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/claude-code-analytics-api",
       "status": "success",
       "path": "en/manage-claude/claude-code-analytics-api.md",
-      "sha256": "41452f13e1221c7430e93561ed2c9d7188733d0071f059d8fedf572043a81883",
-      "size": 14118
+      "sha256": "968b512d6499ef624e9b7915abaca37a9b880c73ca780af7f77d893414b88660",
+      "size": 14113
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/spend-limits-api",
       "status": "success",
       "path": "en/manage-claude/spend-limits-api.md",
-      "sha256": "2ec9de97a7af0a3a61f6e84c4038dc0b3c3bf5a3b776af59644fc0afce5a5505",
-      "size": 82739
+      "sha256": "e686eb86197ce86be4ff951d6e872999a17514850f9441b8288fc75e0381d4d7",
+      "size": 82729
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/opentelemetry",
       "status": "success",
       "path": "en/manage-claude/opentelemetry.md",
-      "sha256": "ceb4c8b7d331e58990d8c1f0e1107233e15817b1f7e0a56848544006d79264ec",
-      "size": 27831
+      "sha256": "cde19f785e579a9c04f0a3ce8df0d778e378e2400d3cd076eaa67f0714c639ba",
+      "size": 27882
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/opentelemetry/sdk",
@@ -1143,147 +1143,203 @@
       "url": "https://platform.claude.com/docs/en/manage-claude/data-residency",
       "status": "success",
       "path": "en/manage-claude/data-residency.md",
-      "sha256": "601a64d7aefb772a146f6e10d7d00575ebc29ae236835a188ef4894aa60f5841",
-      "size": 16117
+      "sha256": "1015b6e869f84dba8a0e4ccc852bf0bcb78df46995e7de199b70dc6d8d98d00d",
+      "size": 16112
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/api-and-data-retention",
       "status": "success",
       "path": "en/manage-claude/api-and-data-retention.md",
-      "sha256": "de7e763f231d88eee02c01a91daf9d0c16661df028f7f650ff7b7ad2a6ebfb3a",
+      "sha256": "cfb552d049eb1c7ba2d674d0d3ee05d70542e9c0ea894b2ea89173dc30747a9d",
       "size": 62221
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/access-transparency",
       "status": "success",
       "path": "en/manage-claude/access-transparency.md",
-      "sha256": "8a247c50edd90985dbb3c86abd33560d79debeacd354e863f724535fdfc9008f",
-      "size": 25377
+      "sha256": "b0b526d9346df00af68a12d56b33e840361dbf34ce237a19b04cc4f6d472ccee",
+      "size": 25412
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/access-transparency-log",
       "status": "success",
       "path": "en/manage-claude/access-transparency-log.md",
-      "sha256": "a54015c499ee74c51de863c550287efda1330a3d3690a163afd0b5143e56ce65",
-      "size": 56898
+      "sha256": "77c10520753a9993116f3877b165315ce6a62f9956e07e7e05ce89f68dc1b495",
+      "size": 65450
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/cmek",
       "status": "success",
       "path": "en/manage-claude/cmek.md",
-      "sha256": "9a0ccf684229f5ea0831357a1f8d8e463323dbfd566005e2ccc649b2be117871",
-      "size": 18272
+      "sha256": "3f1c8863190157fdb4c6ae962da47614c67f7afc07deb2dd02e22058dca343b8",
+      "size": 3876
     },
     {
-      "url": "https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms",
+      "url": "https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works",
       "status": "success",
-      "path": "en/manage-claude/cmek-google-cloud-kms.md",
-      "sha256": "74b1980af64039cf32440efcb9c414a1cd3dad2fa34c54de31839a0dcb492ee4",
-      "size": 28201
+      "path": "en/manage-claude/cmek-how-it-works.md",
+      "sha256": "c2e252af4f45386223a72681d1ac2cc27a3b418dfb0fbbac2366df103d1f4b48",
+      "size": 3750
     },
     {
-      "url": "https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault",
+      "url": "https://platform.claude.com/docs/en/manage-claude/cmek-data-retention",
       "status": "success",
-      "path": "en/manage-claude/cmek-azure-key-vault.md",
-      "sha256": "76862795881b50820bfa8820f9865272acebd51106d6b615711e71a3765be725",
-      "size": 30077
+      "path": "en/manage-claude/cmek-data-retention.md",
+      "sha256": "a199ccae76270a6bcdfa3fa1ddaef8d05fbd614da93ed7a18dbd3118e86c6ca5",
+      "size": 3044
+    },
+    {
+      "url": "https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-platform",
+      "status": "success",
+      "path": "en/manage-claude/cmek-coverage-claude-platform.md",
+      "sha256": "b2f6ae582f3aae23ebbc69f30c77398061e802ea43e6fc69961df1c376ab719d",
+      "size": 8288
+    },
+    {
+      "url": "https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise",
+      "status": "success",
+      "path": "en/manage-claude/cmek-coverage-claude-enterprise.md",
+      "sha256": "78c15dabfa4066d794bd62c349800f26a4303b79a3ab90bfbb22bc614fa81489",
+      "size": 12661
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms",
       "status": "success",
       "path": "en/manage-claude/cmek-aws-kms.md",
-      "sha256": "06f264444ae1aad8fcae37b1ff53ea22bd0b67528d1103baef5dd7ed9798d754",
-      "size": 28545
+      "sha256": "7a9f5a824c2c7287959296799cacb56ae602a994805060edb0c8afe2e6412b9e",
+      "size": 11643
+    },
+    {
+      "url": "https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms",
+      "status": "success",
+      "path": "en/manage-claude/cmek-google-cloud-kms.md",
+      "sha256": "4c79282ef6fa60ad446a4ad5645d795b74258d0473c36796171246c6c3c99c45",
+      "size": 13059
+    },
+    {
+      "url": "https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault",
+      "status": "success",
+      "path": "en/manage-claude/cmek-azure-key-vault.md",
+      "sha256": "a41374147642280131242e24538b9cc16c45d976898c188559755afa8dccf401",
+      "size": 14202
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/cmek-claude-platform-on-aws",
       "status": "success",
       "path": "en/manage-claude/cmek-claude-platform-on-aws.md",
-      "sha256": "396c4afd70ff455ebdeae5c97794620c176c80ae924ec8dea1d3df288cc5a58a",
-      "size": 12320
+      "sha256": "30662ef166436d256bd3e9ea8929898c31e8957bf3cba2100970b28be2f7ceb7",
+      "size": 9574
+    },
+    {
+      "url": "https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms-workspaces",
+      "status": "success",
+      "path": "en/manage-claude/cmek-aws-kms-workspaces.md",
+      "sha256": "de0a99c502bf3c1d1df75d91a26877fac1c264298d6f790c23f0b1c0d6bee463",
+      "size": 2546
+    },
+    {
+      "url": "https://platform.claude.com/docs/en/manage-claude/cmek-admin-api",
+      "status": "success",
+      "path": "en/manage-claude/cmek-admin-api.md",
+      "sha256": "36fc4a6f853d0308f899b371649e99f64b3c08af57c0ab803b6370f85f33dbf3",
+      "size": 25716
+    },
+    {
+      "url": "https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle",
+      "status": "success",
+      "path": "en/manage-claude/cmek-key-lifecycle.md",
+      "sha256": "5241f16dee1921b5967fdd5851db067f6d0927fde3581866d98e2f651c3c0026",
+      "size": 5974
+    },
+    {
+      "url": "https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting",
+      "status": "success",
+      "path": "en/manage-claude/cmek-troubleshooting.md",
+      "sha256": "c433b9579b8c92d87acd0839f30fbc24092db00a47c5c0dc6a39fa3bc89ed00b",
+      "size": 12338
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/inference-hooks",
       "status": "success",
       "path": "en/manage-claude/inference-hooks.md",
-      "sha256": "2d15ae2296d7fc03f9509f3ad911eecf089d000990f110de16b97a5848ea0f80",
-      "size": 12770
+      "sha256": "f2404d9eb17731aae14b1095c401d1ff0dd27cfaf73b8359c4c734d7e1390dc0",
+      "size": 12796
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/inference-hooks-configuration",
       "status": "success",
       "path": "en/manage-claude/inference-hooks-configuration.md",
-      "sha256": "8c445052ab2c5cebfc3b858a71f3e131717802137810b8b83db155e88b1fb1da",
-      "size": 22832
+      "sha256": "d541619ea9f1e337519cdcc6411a47decb9b3373761c6d345e825e8ee68ae789",
+      "size": 22837
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/inference-hooks-endpoint",
       "status": "success",
       "path": "en/manage-claude/inference-hooks-endpoint.md",
-      "sha256": "839fc0872b3f8d714e8c9db65a7c2ad484f89fa0dc9fc8e66767adcfad8e30a5",
-      "size": 53887
+      "sha256": "9bf180705628bb6632d0ddf53b9f642c677d24ec1f55eaf5810f04f4429ab45b",
+      "size": 53921
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/compliance-api",
       "status": "success",
       "path": "en/manage-claude/compliance-api.md",
-      "sha256": "d6b9814e15da65c7d58d1bb73647f9060f6c6dc65f3f782eb347dec62c4c4b85",
-      "size": 10163
+      "sha256": "2d0e180a05868b662cc4a337d9a6bacbb2f7c89f55a80e55501f99f36c22960d",
+      "size": 10158
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/compliance-api-access",
       "status": "success",
       "path": "en/manage-claude/compliance-api-access.md",
-      "sha256": "20a6172dbbb723edbf14becf2141ecdd513c4c42e2c3647884b4b29858198e8b",
+      "sha256": "f1787c44bff7b624c542df4b41dcdecaa6aab67e3400b36c9ee726e037f21405",
       "size": 17743
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed",
       "status": "success",
       "path": "en/manage-claude/compliance-activity-feed.md",
-      "sha256": "54b5bfe86120f84e2d8825f043dd872c6b251ad95fe44846ac1e69d77d7f8e02",
-      "size": 17869
+      "sha256": "87c141d7708abaddce4ef7b3d13b019ddbbd799861613aba81bbff3f2a9d5fab",
+      "size": 18019
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/compliance-content-data",
       "status": "success",
       "path": "en/manage-claude/compliance-content-data.md",
-      "sha256": "53ab155a21c8cedec7a6458da7ad1cf7c7eec37d2b6ed20a75190d285de8fcad",
-      "size": 26254
+      "sha256": "27fd10a949568bb01c27c5267408c04f241bd9a2d8e3985be079ebc40e044aa5",
+      "size": 26243
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/compliance-sessions",
       "status": "success",
       "path": "en/manage-claude/compliance-sessions.md",
-      "sha256": "e5ce156febd46fa621de761d8ef5231f1b9e18dd18f1bbb617ecbdd4c087e0d7",
-      "size": 54557
+      "sha256": "72895f3ba9b44ff48d7fc7dfe90755bb9cbacc7ab70b1f4fdd12db02111f241d",
+      "size": 54643
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/compliance-org-data",
       "status": "success",
       "path": "en/manage-claude/compliance-org-data.md",
-      "sha256": "436572f8114b107e988e9072d8f21e80a44430a6c5a105b0d07807cf3093cf43",
-      "size": 26672
+      "sha256": "3be5f75a0c55ad00f806a2bf5eb7920a603f314ea340cf5e2ca7531d4a9cde70",
+      "size": 26706
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/compliance-integration-patterns",
       "status": "success",
       "path": "en/manage-claude/compliance-integration-patterns.md",
-      "sha256": "cebd613ca7e45f4cacb8daef0dd4233f18a5cd39bdc66faf9787a15e23519d37",
+      "sha256": "63911abc1ba53fd9023657c0eaa912b1da544e29e53f32c5d3b3cd5e2e3e2c7b",
       "size": 18073
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/compliance-errors",
       "status": "success",
       "path": "en/manage-claude/compliance-errors.md",
-      "sha256": "52d28b50d3db614d72ee94dd5fa0bad045a09171c574d8b80eda41599b91ad9c",
-      "size": 55482
+      "sha256": "0cde09215c54036b7042c2c5a882c5f38c99a0917c0260f03439164bd0d8b5b8",
+      "size": 55553
     },
     {
       "url": "https://platform.claude.com/docs/en/manage-claude/compliance-faq",
       "status": "success",
       "path": "en/manage-claude/compliance-faq.md",
-      "sha256": "0c5e293603b5a4c4c157f5a18d9587b02a5867ece05ff4d9105b5061a66f98e2",
+      "sha256": "4dfd4809a213f92470d50adf709984589f68c6827e8245a8de0dd73ffe233748",
       "size": 26799
     },
     {
@@ -1297,8 +1353,8 @@
       "url": "https://platform.claude.com/docs/en/about-claude/use-case-guides/ticket-routing",
       "status": "success",
       "path": "en/about-claude/use-case-guides/ticket-routing.md",
-      "sha256": "846b07c435e5f32d39d3217425b18026998b3ef3ecb92a3c978664f63836ea98",
-      "size": 75176
+      "sha256": "6658388a329a150e48b6f6c994163483a34c79768f840095510e3ecd22368134",
+      "size": 75228
     },
     {
       "url": "https://platform.claude.com/docs/en/about-claude/use-case-guides/customer-support-chat",
@@ -1325,8 +1381,8 @@
       "url": "https://platform.claude.com/docs/en/about-claude/use-case-guides/commerce-agents",
       "status": "success",
       "path": "en/about-claude/use-case-guides/commerce-agents.md",
-      "sha256": "cfb63cb0db823c9a24e010e3ef204c3d5bbbec859bfc2482b1c5bbc9df1500c8",
-      "size": 9351
+      "sha256": "b08cfbaae394ea24d22ce960c95de0309692c029facb793d99797bbac1d2aa25",
+      "size": 9375
     },
     {
       "url": "https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/overview",
@@ -1360,8 +1416,8 @@
       "url": "https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/prompting-claude-opus-5-5",
       "status": "success",
       "path": "en/build-with-claude/prompt-engineering/prompting-claude-opus-5-5.md",
-      "sha256": "37c81d6119dc00a5bf131cd13eb0eb108e8bfbe66bff27f2bc64456299df2a95",
-      "size": 28855
+      "sha256": "b826453f6e710fd9b2d4a3fc0e2bcc192cf69dc9d3ae59e79c92bb111677d9bf",
+      "size": 28877
     },
     {
       "url": "https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/prompting-claude-opus-5",
@@ -1430,8 +1486,8 @@
       "url": "https://platform.claude.com/docs/en/test-and-evaluate/strengthen-guardrails/mitigate-jailbreaks",
       "status": "success",
       "path": "en/test-and-evaluate/strengthen-guardrails/mitigate-jailbreaks.md",
-      "sha256": "5495a44ff5413c20f5e98ef9169f33bd28a919c13a68979c1281a7c6e02bbca7",
-      "size": 12506
+      "sha256": "ed6fb5f98ce8cc9656b2924725951468f98796ffcf4f4ebba7ef394cb455e883",
+      "size": 12533
     },
     {
       "url": "https://platform.claude.com/docs/en/test-and-evaluate/strengthen-guardrails/reduce-prompt-leak",
@@ -1465,22 +1521,22 @@
       "url": "https://platform.claude.com/docs/en/models/fable-5-1/overview",
       "status": "success",
       "path": "en/models/fable-5-1/overview.md",
-      "sha256": "2429aba21158890ee7c5d62719439da0ffe36e4f45fbcf47d03e739efb4704bd",
-      "size": 16993
+      "sha256": "1259f314e53d88c596d5e42b0bbd1f4f3aeda3934babbf4857a232cd63afd104",
+      "size": 17009
     },
     {
       "url": "https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1",
       "status": "success",
       "path": "en/models/fable-5-1/whats-new-fable-5-1.md",
-      "sha256": "4f0be79f76b26670d5d2b72c241192847eea72eee3d6e71b15d365ac0ec4c56a",
-      "size": 40482
+      "sha256": "1cc6dc09817e26281dafb7fd912c1c6596d9b6f4cfd1209447981898b99668fc",
+      "size": 40498
     },
     {
       "url": "https://platform.claude.com/docs/en/models/fable-5-1/migration-guide",
       "status": "success",
       "path": "en/models/fable-5-1/migration-guide.md",
-      "sha256": "0fd2ff8261e58295c181c964f95ce537933f314096e7aa4aa0ba62a4048eec1b",
-      "size": 96017
+      "sha256": "a117c7896b441e12ec387bd5e15d73931f642128b25b3b8137487d9bf4208afa",
+      "size": 96042
     },
     {
       "url": "https://platform.claude.com/docs/en/models/opus-5-5/overview",
@@ -1493,8 +1549,8 @@
       "url": "https://platform.claude.com/docs/en/models/opus-5-5/whats-new-opus-5-5",
       "status": "success",
       "path": "en/models/opus-5-5/whats-new-opus-5-5.md",
-      "sha256": "62b7646d5388a15d4fddb20902635538db660df95e0695b0eb4ba38d31022d56",
-      "size": 22789
+      "sha256": "488cc9d6b37800cf60dd34b41f4cf79253306a05950008241f0a26c61ea24cff",
+      "size": 22787
     },
     {
       "url": "https://platform.claude.com/docs/en/models/opus-5-5/migration-guide",
@@ -1521,8 +1577,8 @@
       "url": "https://platform.claude.com/docs/en/models/sonnet-5-5/migration-guide",
       "status": "success",
       "path": "en/models/sonnet-5-5/migration-guide.md",
-      "sha256": "f0fea79ac3f0b34ef023f5a9b9f45c777c80ea79bb729f08568ef6380faeb576",
-      "size": 55886
+      "sha256": "1d217c6c3d269043381d07f2f5be9d120b275dd99c40dc480cab396b116a94ec",
+      "size": 55895
     },
     {
       "url": "https://platform.claude.com/docs/en/models/haiku-5-5/overview",
@@ -1675,8 +1731,8 @@
       "url": "https://platform.claude.com/docs/en/about-claude/pricing",
       "status": "success",
       "path": "en/about-claude/pricing.md",
-      "sha256": "7290220dcde922ef0cfc83fe37213bc709c47723c0ae38bfed38374e40cce998",
-      "size": 53412
+      "sha256": "f71573e3b8280316d567a310cdc9a469c6c56a3a0c13d9156446e4af340be39e",
+      "size": 53397
     },
     {
       "url": "https://platform.claude.com/docs/en/about-claude/api-credits-for-subscribers",
@@ -1850,7 +1906,7 @@
       "url": "https://platform.claude.com/docs/en/cli-sdks-libraries/overview",
       "status": "success",
       "path": "en/cli-sdks-libraries/overview.md",
-      "sha256": "b8879a558aed8bf6e2ea09218a7e11c55e8162600dfaace5b869c8fac7d78ab0",
+      "sha256": "7ed6de38c9fca3862f82abd788d8d8d0dc4ac7207dbf6ca6e62a605a1126d29b",
       "size": 5488
     },
     {
@@ -1871,15 +1927,15 @@
       "url": "https://platform.claude.com/docs/en/cli-sdks-libraries/cli/using",
       "status": "success",
       "path": "en/cli-sdks-libraries/cli/using.md",
-      "sha256": "760cce36a0438a3fb26a2bc7999b482d34836bde8b9a872b4b02f3983732ccca",
-      "size": 14087
+      "sha256": "1b4fba4192f7a4557f6791002bf7fd592e5a95d13cd33e0fc376cb86c7c4663b",
+      "size": 14083
     },
     {
       "url": "https://platform.claude.com/docs/en/cli-sdks-libraries/cli/scripting",
       "status": "success",
       "path": "en/cli-sdks-libraries/cli/scripting.md",
-      "sha256": "0c0a1aa9ec97e08105dec9ee42c0b6286321b8d4af23aaefdadc02857a842426",
-      "size": 5956
+      "sha256": "31bd86d8d95e36450f9e96cf769fe0a5143be3565ee710ed82517f56b40631c2",
+      "size": 5951
     },
     {
       "url": "https://platform.claude.com/docs/en/cli-sdks-libraries/cli/apply",
@@ -1906,8 +1962,8 @@
       "url": "https://platform.claude.com/docs/en/cli-sdks-libraries/sdks/python",
       "status": "success",
       "path": "en/cli-sdks-libraries/sdks/python.md",
-      "sha256": "f2ba382b050673a33ae9f770cfd2263b79769d6fa22ea18bc891e03395ef0bf7",
-      "size": 28534
+      "sha256": "9deda204e2f6a6d686d14beb10f70fb7095b2278ea01ff6a83c459d4eaff3c21",
+      "size": 28533
     },
     {
       "url": "https://platform.claude.com/docs/en/cli-sdks-libraries/sdks/typescript",
@@ -1920,22 +1976,22 @@
       "url": "https://platform.claude.com/docs/en/cli-sdks-libraries/sdks/csharp",
       "status": "success",
       "path": "en/cli-sdks-libraries/sdks/csharp.md",
-      "sha256": "8537bb6178cf31b808422b4d9e46a17a271f7f275bfe96727917b06ead15971a",
-      "size": 17006
+      "sha256": "6df25df8deeb31f5e2440a0484646e76436507a99263f06f327b6b08eae943b8",
+      "size": 16986
     },
     {
       "url": "https://platform.claude.com/docs/en/cli-sdks-libraries/sdks/go",
       "status": "success",
       "path": "en/cli-sdks-libraries/sdks/go.md",
-      "sha256": "93631d5364f386e23596cf9056143f834cc7714516d23e81c4b6dd0313891d95",
-      "size": 27662
+      "sha256": "20045c9dd76e1bb640757d878cbfe3940a65c3fe8b0930d431ac5440ca1ee331",
+      "size": 27682
     },
     {
       "url": "https://platform.claude.com/docs/en/cli-sdks-libraries/sdks/java",
       "status": "success",
       "path": "en/cli-sdks-libraries/sdks/java.md",
-      "sha256": "c6ea46a368a906c992b8604fcb64f292c5db07810f1ca8afd91e02908b32a7fd",
-      "size": 49397
+      "sha256": "ea24ef360243dd9d995c35b7b28adf776567076e142b4ec2775fe8dbd486d196",
+      "size": 49377
     },
     {
       "url": "https://platform.claude.com/docs/en/cli-sdks-libraries/sdks/php",
@@ -1976,36 +2032,36 @@
       "url": "https://platform.claude.com/docs/en/api/beta-headers",
       "status": "success",
       "path": "en/api/beta-headers.md",
-      "sha256": "2fcac246e1e805d3babfe37e9d158b0be45b134e8e9ca53b685666ae5fc41f82",
+      "sha256": "d3463c19ba0109b25705a74a4358901c86cb6a4274ef8b9cb4796e3db9fadb3f",
       "size": 9973
     },
     {
       "url": "https://platform.claude.com/docs/en/api/errors",
       "status": "success",
       "path": "en/api/errors.md",
-      "sha256": "f585ff299488436f560617e398ddf4f00c7bfa100ae03e1a3796a6a72f818874",
-      "size": 33606
+      "sha256": "3b1b28dd5d21ac904b670c962dfd00b5e9d92579b55d79d3e1754eaed4530a67",
+      "size": 33550
     },
     {
       "url": "https://platform.claude.com/docs/en/api/opentelemetry/spans",
       "status": "success",
       "path": "en/api/opentelemetry/spans.md",
-      "sha256": "895de05d039f962819dc22ddb0b000e58c1540e5bb93cd48c386863ddb94f828",
-      "size": 93852
+      "sha256": "98ab07ac94661550d52d48cd48cd2b4be56b6f4e6af942b733917cc9e0ad06a7",
+      "size": 94344
     },
     {
       "url": "https://platform.claude.com/docs/en/api/rate-limits",
       "status": "success",
       "path": "en/api/rate-limits.md",
-      "sha256": "08eb77143716077b2ce21284b8344e274c1cf65f2441ebd711cefc51b54f0cc9",
+      "sha256": "21db8cea7a47f6ed42bbbd7fd18a7fb5ee240e3e801d92ed23d47470eecb5db1",
       "size": 37366
     },
     {
       "url": "https://platform.claude.com/docs/en/api/service-tiers",
       "status": "success",
       "path": "en/api/service-tiers.md",
-      "sha256": "51cdd4d4e828cbad93654af0155599cc3ab52719ad8443bcb31628d973b04c65",
-      "size": 8856
+      "sha256": "c07b77eaafebe0db2980d2131269e701767c3294d09e44ec010b99407228340f",
+      "size": 8851
     },
     {
       "url": "https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions",
@@ -2046,22 +2102,22 @@
       "url": "https://platform.claude.com/docs/en/api/claude-code/routines-fire",
       "status": "success",
       "path": "en/api/claude-code/routines-fire.md",
-      "sha256": "d9b0cef615a27eefdb1317f279f835d5c3f197eb7b2ed0606b961a5f36d09f4a",
-      "size": 13779
+      "sha256": "f5d9da1370dd2c6642af8f9ef0405c587c125b6c00deb0cf3bb3885d5e2d2569",
+      "size": 13774
     },
     {
       "url": "https://platform.claude.com/docs/en/agents-and-tools/agent-skills/claude-api-skill",
       "status": "success",
       "path": "en/agents-and-tools/agent-skills/claude-api-skill.md",
-      "sha256": "a5c238abe25be126a8ddb7d111724b8e26bdb752d6084adfa09cbcc30f4646d9",
-      "size": 17174
+      "sha256": "e07c426f4d436b9b81a279c5d0c45e3af479057aa77edfb4ca5444d077e322df",
+      "size": 17173
     },
     {
       "url": "https://platform.claude.com/docs/en/release-notes/overview",
       "status": "success",
       "path": "en/release-notes/overview.md",
-      "sha256": "5fafb53d43f0ba1ca015378b0d192fa3639738a4f1944dba78f78fdade148e83",
-      "size": 132705
+      "sha256": "86b5800f628df8378837bb051ddb9c4ce1ac6e07bcecc96653ec3da64a4721ce",
+      "size": 132811
     },
     {
       "url": "https://platform.claude.com/docs/en/api/completions",
@@ -5679,8 +5735,8 @@
       "url": "https://platform.claude.com/docs/en/claude_api_primer",
       "status": "success",
       "path": "en/claude_api_primer.md",
-      "sha256": "062dbd71e081cb217c51d57afeebb97a4cf113d66cf5daab7fb5d1ead2e6d93b",
-      "size": 27074
+      "sha256": "b3577db64e8ad9ba9a2ff74dfb6081435eb68ce2ad6920554bcbe5f347a3282b",
+      "size": 27053
     },
     {
       "url": "https://platform.claude.com/docs/en/api/migration-2026-10-21",
@@ -9858,8 +9914,8 @@
       "url": "https://support.claude.com/en/articles/8114491-get-started-with-claude",
       "status": "success",
       "path": "support/8114491-get-started-with-claude.md",
-      "sha256": "db42b88c6ed1a36f61c2e9c6692d1df0639397f476eb2f84abfd2ef80392ca21",
-      "size": 5203
+      "sha256": "655a94d441c6eab0f7e41cfd1f833c891cc7ce3b4d52495b2501df0b639d417e",
+      "size": 5205
     },
     {
       "url": "https://support.claude.com/en/articles/8114494-how-up-to-date-is-claude-s-training-data",
@@ -9935,8 +9991,8 @@
       "url": "https://support.claude.com/en/articles/8230524-delete-or-rename-a-conversation",
       "status": "success",
       "path": "support/8230524-delete-or-rename-a-conversation.md",
-      "sha256": "511ae0cb2411420f19c99d4e9823aa133f8b1827589865ddba72ce9aa6e61b1b",
-      "size": 5885
+      "sha256": "09f3f02cf7b5a0c1c46f5f3a2bc9b73ae58a13f48d4e035f311bbf25eb3e327b",
+      "size": 5883
     },
     {
       "url": "https://support.claude.com/en/articles/8241126-upload-files-to-claude",
@@ -10005,8 +10061,8 @@
       "url": "https://support.claude.com/en/articles/8325618-paid-plan-billing-faqs",
       "status": "success",
       "path": "support/8325618-paid-plan-billing-faqs.md",
-      "sha256": "be7cb6061f39dabcd4c97a82bcb1e8c11dbce7edb97d232d649fcf70760905a9",
-      "size": 4951
+      "sha256": "5260a37d7aa8abc8949ae049f238ae601c1c6cbca19f8972c2522f0d81c65017",
+      "size": 4949
     },
     {
       "url": "https://support.claude.com/en/articles/8325621-i-would-like-to-input-sensitive-data-into-my-chats-with-claude-who-can-view-my-conversations",
@@ -10068,8 +10124,8 @@
       "url": "https://support.claude.com/en/articles/8887527-customizing-your-appearance-settings",
       "status": "success",
       "path": "support/8887527-customizing-your-appearance-settings.md",
-      "sha256": "036f71f45f25f83932bd233692dda13dd77fddb813ebebfef6a9fb545ded0a0d",
-      "size": 1876
+      "sha256": "4dca4e43db9ba6374c251ebb6912a9603ed5fb79a17c9ed13953a5e0450e2596",
+      "size": 1880
     },
     {
       "url": "https://support.claude.com/en/articles/8896518-does-anthropic-crawl-data-from-the-web-and-how-can-site-owners-block-the-crawler",
@@ -10243,8 +10299,8 @@
       "url": "https://support.claude.com/en/articles/9267400-move-your-personal-claude-account-to-a-team-or-enterprise-organization",
       "status": "success",
       "path": "support/9267400-move-your-personal-claude-account-to-a-team-or-enterprise-organization.md",
-      "sha256": "5a2bbea9f8c282c1ad59d0e11bb23d24ab812bd932f596fc2ec8afb74cebf193",
-      "size": 10266
+      "sha256": "dd2aa480912a0325eecb9dfdb72d8b4bb728e93c0f2aaee3e696ee157c2e73d2",
+      "size": 10270
     },
     {
       "url": "https://support.claude.com/en/articles/9301722-updates-to-our-acceptable-use-policy-now-usage-policy-consumer-terms-of-service-and-privacy-policy",
@@ -10285,8 +10341,8 @@
       "url": "https://support.claude.com/en/articles/9519177-how-can-i-create-and-manage-projects",
       "status": "success",
       "path": "support/9519177-how-can-i-create-and-manage-projects.md",
-      "sha256": "cfee0627c4c0b9743b853897d539e7814fe3e1484a946fc2fb25c3dcf0c53c2c",
-      "size": 9201
+      "sha256": "9150f4a2ea1216ca1fd14e4018b9c29f4643548371ad5ba992f77a03a635344a",
+      "size": 9209
     },
     {
       "url": "https://support.claude.com/en/articles/9519189-manage-project-visibility-and-sharing",
@@ -10537,8 +10593,8 @@
       "url": "https://support.claude.com/en/articles/10310342-how-do-i-log-out-of-all-active-sessions",
       "status": "success",
       "path": "support/10310342-how-do-i-log-out-of-all-active-sessions.md",
-      "sha256": "8a21236879d9f9200f214949e0a94dedf7ea5c3412fd814ace4d8d7ba6d63b24",
-      "size": 2494
+      "sha256": "143a915ce66e361a205f667d4cec6da54c0c98639c21779a449da12acc1b8c41",
+      "size": 2492
     },
     {
       "url": "https://support.claude.com/en/articles/10366376-how-can-i-delete-my-claude-console-account",
@@ -10586,8 +10642,8 @@
       "url": "https://support.claude.com/en/articles/10504844-manage-user-feedback-settings-on-team-and-enterprise-plans",
       "status": "success",
       "path": "support/10504844-manage-user-feedback-settings-on-team-and-enterprise-plans.md",
-      "sha256": "de1d9177fa9be456723da64b147ad07219e645b3963549c0a04c52f72220c1f3",
-      "size": 1038
+      "sha256": "6d8618c53b49b940eee8fb9ac69bec3966ebd4dd3d63b115b4d493b925a790d2",
+      "size": 1034
     },
     {
       "url": "https://support.claude.com/en/articles/10504853-manage-user-feedback-settings-on-claude-console",
@@ -10607,8 +10663,8 @@
       "url": "https://support.claude.com/en/articles/10593882-share-and-unshare-chats",
       "status": "success",
       "path": "support/10593882-share-and-unshare-chats.md",
-      "sha256": "153e6629eda7f0c462ef5a35ca704929c829716b54c62739a1ad16133613ee2d",
-      "size": 4012
+      "sha256": "16be315d632c205618d07eed1f7f9c115bc0f03164e6668f115eca24e120b707",
+      "size": 4018
     },
     {
       "url": "https://support.claude.com/en/articles/10684626-enable-and-use-web-search",
@@ -10635,7 +10691,7 @@
       "url": "https://support.claude.com/en/articles/10949351-getting-started-with-local-mcp-servers-on-claude-desktop",
       "status": "success",
       "path": "support/10949351-getting-started-with-local-mcp-servers-on-claude-desktop.md",
-      "sha256": "d40a01b35faeb588a47281a87870b93db1089bdf9197552e253409784475034d",
+      "sha256": "46ad13c782d755d8404a7c397f2804aa1c0a0ec7c8cea72ca305c8cb0ee89bb5",
       "size": 8392
     },
     {
@@ -10670,8 +10726,8 @@
       "url": "https://support.claude.com/en/articles/11101966-use-voice-mode",
       "status": "success",
       "path": "support/11101966-use-voice-mode.md",
-      "sha256": "ed9129559bdac21f14771cffa89565681d9d62ff8b2839700805ad5fbc2e699e",
-      "size": 10551
+      "sha256": "efeaf6388473ff295832906da67196cfa26665f5ee705e4111ffa6b4e3d90078",
+      "size": 10557
     },
     {
       "url": "https://support.claude.com/en/articles/11107691-why-is-a-coupon-or-promotion-not-available-for-my-account",
@@ -10803,8 +10859,8 @@
       "url": "https://support.claude.com/en/articles/11725453-set-up-the-claude-lti-in-canvas-by-instructure",
       "status": "success",
       "path": "support/11725453-set-up-the-claude-lti-in-canvas-by-instructure.md",
-      "sha256": "5b7a7f0c2107dbba246cc6ea461bd10e6fe600c591b0dd2862db81ef0128ef1a",
-      "size": 2748
+      "sha256": "1bdabd0f94b470ddc4540e03f3463c699d1380dccfe7a99ec6313ad91678a252",
+      "size": 2750
     },
     {
       "url": "https://support.claude.com/en/articles/11732894-who-owns-and-manages-the-data-of-my-claude-for-education-account",
@@ -10824,7 +10880,7 @@
       "url": "https://support.claude.com/en/articles/11818288-why-am-i-being-asked-to-verify-my-payment-method",
       "status": "success",
       "path": "support/11818288-why-am-i-being-asked-to-verify-my-payment-method.md",
-      "sha256": "5462ef8329516b756617efe98011dd77c74456ebb6c7c6eb368a022d571ab2ad",
+      "sha256": "e80ae1728f142a7aa3f7494b5e9ef064a2269ca0c88d3c1e1e2a115ccab3933c",
       "size": 816
     },
     {
@@ -10859,8 +10915,8 @@
       "url": "https://support.claude.com/en/articles/11869629-use-claude-with-android-apps",
       "status": "success",
       "path": "support/11869629-use-claude-with-android-apps.md",
-      "sha256": "8ae50048c6a7cc81d463a0fb8571328f2323fd4a5ab94cc0d6d51e985573069c",
-      "size": 13995
+      "sha256": "136241c7d920ded9076612d506797abc13345c2bd3728dfa57b9bcb97a87eeba",
+      "size": 13991
     },
     {
       "url": "https://support.claude.com/en/articles/11932705-automated-security-reviews-in-claude-code",
@@ -10894,15 +10950,15 @@
       "url": "https://support.claude.com/en/articles/12005970-manage-usage-credits-for-team-and-seat-based-enterprise-plans",
       "status": "success",
       "path": "support/12005970-manage-usage-credits-for-team-and-seat-based-enterprise-plans.md",
-      "sha256": "b2240bac1711e19e6fc80cba84176d5bbc50f53976fdf5863592891faab833ea",
-      "size": 9709
+      "sha256": "3b27c6923cc2a5eeb087dd698c9e0ebe0d025d2eb5d8d5b489a812bdab73934a",
+      "size": 9713
     },
     {
       "url": "https://support.claude.com/en/articles/12012173-get-started-with-claude-in-chrome",
       "status": "success",
       "path": "support/12012173-get-started-with-claude-in-chrome.md",
-      "sha256": "dd3b602d47003a3123f75550d3c1ae832913064b349d35da4ba9c3e6075fbb7e",
-      "size": 14855
+      "sha256": "ea4526ff597af60e123f34b34cf65b23451881513abc973e27856942216b28e5",
+      "size": 14859
     },
     {
       "url": "https://support.claude.com/en/articles/12053672-what-happens-to-a-user-s-data-when-they-are-removed-from-a-team-or-enterprise-organization",
@@ -10929,8 +10985,8 @@
       "url": "https://support.claude.com/en/articles/12111783-create-and-edit-files-with-claude",
       "status": "success",
       "path": "support/12111783-create-and-edit-files-with-claude.md",
-      "sha256": "35308e84580dde5dc719ecd3750a3c94e24ef940cf69ab414592cf207a7957a9",
-      "size": 17964
+      "sha256": "d2d932b4a0df47f3a9f7bc7779262a498e5197b3091172ad50a9a648cf8e051f",
+      "size": 17960
     },
     {
       "url": "https://support.claude.com/en/articles/12119250-model-safety-bug-bounty-program",
@@ -10957,22 +11013,22 @@
       "url": "https://support.claude.com/en/articles/12157520-claude-code-usage-analytics",
       "status": "success",
       "path": "support/12157520-claude-code-usage-analytics.md",
-      "sha256": "f66e9bf3b7418614c7f01b6df6f66cc17896741c7ec22434709042d724caf090",
+      "sha256": "307743a17c4032ad7d657dc5bc8e3dcc7191ab2018e3acbfb0fa6efe087d7ea5",
       "size": 6366
     },
     {
       "url": "https://support.claude.com/en/articles/12260368-use-incognito-chats",
       "status": "success",
       "path": "support/12260368-use-incognito-chats.md",
-      "sha256": "7986d6e2f4e320d60204491263a7bdfb34699be1e98bbdf2ea397993659a53ed",
-      "size": 4374
+      "sha256": "880a8db5abba9b2bc6cd8763ea3a382e5fb0e8c7247e91d8dcc5d039b8a5d9cf",
+      "size": 4376
     },
     {
       "url": "https://support.claude.com/en/articles/12293051-use-claude-in-xcode",
       "status": "success",
       "path": "support/12293051-use-claude-in-xcode.md",
-      "sha256": "f6ee5e63778ef58bf560213fa7f4e4facaf85859f615365504c0793c7074e433",
-      "size": 1905
+      "sha256": "bf7b9bd5326c4ed44814a12e6ad56aae34c878a714732ebe6b3a808e7ef856fe",
+      "size": 1907
     },
     {
       "url": "https://support.claude.com/en/articles/12304248-manage-api-key-environment-variables-in-claude-code",
@@ -11013,15 +11069,15 @@
       "url": "https://support.claude.com/en/articles/12429409-manage-usage-credits-for-paid-claude-plans",
       "status": "success",
       "path": "support/12429409-manage-usage-credits-for-paid-claude-plans.md",
-      "sha256": "cc3695636a060acdb1558481f2fcfbc8fcf104aca6cb524db80af0b7d2b5e80c",
-      "size": 7972
+      "sha256": "6895c04bd378b1c8e64919692f69e6ce7e0b813fe1afe79352f75f00219f13a6",
+      "size": 7970
     },
     {
       "url": "https://support.claude.com/en/articles/12466728-troubleshoot-claude-error-messages",
       "status": "success",
       "path": "support/12466728-troubleshoot-claude-error-messages.md",
-      "sha256": "377494a7759692bbfccde1ac1baad492919da62b4cd7637ce3ee014cb01c5df7",
-      "size": 5143
+      "sha256": "18ecb93271c359c107ee5a81976fa9856eee960d23fe5780a39da095c7adc24a",
+      "size": 5141
     },
     {
       "url": "https://support.claude.com/en/articles/12489464-use-enterprise-search",
@@ -11041,7 +11097,7 @@
       "url": "https://support.claude.com/en/articles/12512180-use-skills-in-claude",
       "status": "success",
       "path": "support/12512180-use-skills-in-claude.md",
-      "sha256": "9862a372dadc4d953e7a124d777eb0297172838c60eb634314064729e04e2d49",
+      "sha256": "d248c965d4f89c84acc8d045647c170691546b334a6f122519ed556aba07353d",
       "size": 19148
     },
     {
@@ -11062,8 +11118,8 @@
       "url": "https://support.claude.com/en/articles/12592343-enabling-and-using-the-desktop-extension-allowlist",
       "status": "success",
       "path": "support/12592343-enabling-and-using-the-desktop-extension-allowlist.md",
-      "sha256": "70e0927527271fd490e2b75733805cba6721b2d0fe6412fa7703199ba166b76e",
-      "size": 5712
+      "sha256": "01cac06ec87c06ea54a68e3b1014bbd8aeb4fe1314dc48add3f64e0ecb73f391",
+      "size": 5716
     },
     {
       "url": "https://support.claude.com/en/articles/12611117-deploy-claude-desktop-for-macos",
@@ -11076,8 +11132,8 @@
       "url": "https://support.claude.com/en/articles/12618689-use-claude-code-in-the-cloud",
       "status": "success",
       "path": "support/12618689-use-claude-code-in-the-cloud.md",
-      "sha256": "c3e46c90db03d2e6ee222290ff8389be002bd5c2fa5594e18174056c5f90aa62",
-      "size": 11056
+      "sha256": "fe639121b1cbb02d1a4eb0152bf046bd32f4d11a7f02263cec0a7c53899fc99a",
+      "size": 11062
     },
     {
       "url": "https://support.claude.com/en/articles/12622667-enterprise-configuration-for-claude-desktop",
@@ -11097,8 +11153,8 @@
       "url": "https://support.claude.com/en/articles/12626668-use-quick-entry-with-claude-desktop-on-mac",
       "status": "success",
       "path": "support/12626668-use-quick-entry-with-claude-desktop-on-mac.md",
-      "sha256": "5f4dae72a3212afc5ada5f1fa80da49dd6e8dfdaaf7c8ede7d84ff09d62001b5",
-      "size": 5974
+      "sha256": "1adf736acb6cef3a3a4971e12c885a3769712765559c26aaf85e053ffc99827a",
+      "size": 5970
     },
     {
       "url": "https://support.claude.com/en/articles/12684923-microsoft-365-connector-security-guide",
@@ -11132,8 +11188,8 @@
       "url": "https://support.claude.com/en/articles/12883420-view-usage-analytics-for-team-and-enterprise-plans",
       "status": "success",
       "path": "support/12883420-view-usage-analytics-for-team-and-enterprise-plans.md",
-      "sha256": "edb48e3170e81e49d2bc1028782a276c44caaa8c3b98abee9b4e3cf4cedb50d1",
-      "size": 15111
+      "sha256": "52331c3849eb472f2fd0484b6f9043ab9b0a7964f7e1efb34dcf91d40eabaa43",
+      "size": 15095
     },
     {
       "url": "https://support.claude.com/en/articles/12902405-claude-in-chrome-troubleshooting",
@@ -11181,8 +11237,8 @@
       "url": "https://support.claude.com/en/articles/12997503-team-plan-billing-faqs",
       "status": "success",
       "path": "support/12997503-team-plan-billing-faqs.md",
-      "sha256": "84ddcb94a0bce9e7b21c4c9144275e47f7eb9337db1cc7fd5e8c945880e7f816",
-      "size": 5413
+      "sha256": "e4c88e50157198aa1741ffa1058eb6d03f6eac9ccc9f9fffaddc40fc78e30b1d",
+      "size": 5417
     },
     {
       "url": "https://support.claude.com/en/articles/13015708-access-the-compliance-api",
@@ -11230,15 +11286,15 @@
       "url": "https://support.claude.com/en/articles/13132885-set-up-single-sign-on-sso",
       "status": "success",
       "path": "support/13132885-set-up-single-sign-on-sso.md",
-      "sha256": "61bf0ed7a6b2bc4f74e1b36404283b1b7bb215ea132f8bd2398dbbe06f563ece",
-      "size": 13647
+      "sha256": "1aec91d77dc614dd46d180f1e0e21c4d8f183cbd81c03d2a5ebff9cb7b9db2dc",
+      "size": 13641
     },
     {
       "url": "https://support.claude.com/en/articles/13133195-set-up-jit-or-scim-provisioning",
       "status": "success",
       "path": "support/13133195-set-up-jit-or-scim-provisioning.md",
-      "sha256": "d012c9ed98aa74a6356efdbbf2f8a4b6325f7544fc629ca8f0ac88aa0a53227c",
-      "size": 22523
+      "sha256": "5c3b4e49f351304586560a140778712afde4905104447c975b37e9039a66b37e",
+      "size": 22525
     },
     {
       "url": "https://support.claude.com/en/articles/13133750-manage-members-on-team-and-enterprise-plans",
@@ -11265,8 +11321,8 @@
       "url": "https://support.claude.com/en/articles/13163631-configuring-session-security-settings",
       "status": "success",
       "path": "support/13163631-configuring-session-security-settings.md",
-      "sha256": "853159b4d1c9a804f40350b368bc5c5334e32cc48aa87acdca5ce857d92413d2",
-      "size": 3697
+      "sha256": "d668e431752d5e195a5455976a4d487ebafccd9551beda5f9bcb80683cbac211",
+      "size": 3703
     },
     {
       "url": "https://support.claude.com/en/articles/13171706-crisis-helpline-support-in-claude",
@@ -11279,8 +11335,8 @@
       "url": "https://support.claude.com/en/articles/13189465-log-in-to-your-claude-account",
       "status": "success",
       "path": "support/13189465-log-in-to-your-claude-account.md",
-      "sha256": "b381763c686a68cdb65ba8b6247d06b0dc6f7a294b18a40b8f6345fc437b48f9",
-      "size": 7043
+      "sha256": "095601e899fcd5fa0b587b1c98dfbafca01b596dd3c94b6320e7426cd59d250f",
+      "size": 7037
     },
     {
       "url": "https://support.claude.com/en/articles/13198485-enforce-network-level-access-control-with-tenant-restrictions",
@@ -11307,8 +11363,8 @@
       "url": "https://support.claude.com/en/articles/13325567-account-management-faqs",
       "status": "success",
       "path": "support/13325567-account-management-faqs.md",
-      "sha256": "139cf8206356884fb057e003b51c225957ea85022a4cf3463648455f5c689b1e",
-      "size": 2638
+      "sha256": "019c3ad65c77b5e2d91cbc810739686e42b788bce313ab53b052ee29e4b55889",
+      "size": 2636
     },
     {
       "url": "https://support.claude.com/en/articles/13345190-get-started-with-claude-cowork",
@@ -11342,8 +11398,8 @@
       "url": "https://support.claude.com/en/articles/13371040-log-in-to-your-console-account",
       "status": "success",
       "path": "support/13371040-log-in-to-your-console-account.md",
-      "sha256": "03045e712092a57f5b463863fe440b8aaa3deaea4cc3cc197b847b1265b77e7d",
-      "size": 4611
+      "sha256": "a61554f2443aff085e6c74f5c6115cb2b286c3fdc7817ea44ae14a0646ad4149",
+      "size": 4615
     },
     {
       "url": "https://support.claude.com/en/articles/13393991-purchase-and-manage-seats-on-enterprise-plans",
@@ -11398,7 +11454,7 @@
       "url": "https://support.claude.com/en/articles/13641943-visual-and-interactive-content",
       "status": "success",
       "path": "support/13641943-visual-and-interactive-content.md",
-      "sha256": "d27b2ee301e3c2216318054847c3afda083789eace8bac810b0fe77788b19425",
+      "sha256": "bcaa4390703dd2120b35b8b4b2dc07b5247b4c913ff7a014741b626ed7dffe8d",
       "size": 6509
     },
     {
@@ -11454,8 +11510,8 @@
       "url": "https://support.claude.com/en/articles/13837440-use-plugins-in-claude",
       "status": "success",
       "path": "support/13837440-use-plugins-in-claude.md",
-      "sha256": "49783de42465cacd0c5d07b9bb65606114eb2063f1fd71cb34fe1756154a46c9",
-      "size": 15193
+      "sha256": "ec4e1c9ebbbae777b9975458aa8e004bddb8224452b110e68fec1464f4e0e3cb",
+      "size": 15191
     },
     {
       "url": "https://support.claude.com/en/articles/13854387-schedule-recurring-tasks-in-claude-cowork",
@@ -11552,8 +11608,8 @@
       "url": "https://support.claude.com/en/articles/13947068-assign-tasks-from-anywhere-in-claude-cowork",
       "status": "success",
       "path": "support/13947068-assign-tasks-from-anywhere-in-claude-cowork.md",
-      "sha256": "ddcce2d46e99133cf570f0ba154ba13e175a81eb6efbb0928f7a446ce831f702",
-      "size": 9458
+      "sha256": "bba4a2617dbcaf27e9d15f295261b6b23a708e0f2cf53a3ef7cb5aafe2f8e7ab",
+      "size": 9464
     },
     {
       "url": "https://support.claude.com/en/articles/13979539-custom-visuals-in-chat-and-cowork",
@@ -11573,8 +11629,8 @@
       "url": "https://support.claude.com/en/articles/14116274-organize-your-tasks-with-projects-in-claude-cowork",
       "status": "success",
       "path": "support/14116274-organize-your-tasks-with-projects-in-claude-cowork.md",
-      "sha256": "f8b8083ab523bef378e6d5489ec5db660f4624ad2eb5406444efa6bc20b79992",
-      "size": 8383
+      "sha256": "00005562c86308937aa72f78bdd5a983f705d51c90db679906df9d2a5703ab07",
+      "size": 8407
     },
     {
       "url": "https://support.claude.com/en/articles/14128542-let-claude-use-your-computer-in-cowork",
@@ -11643,8 +11699,8 @@
       "url": "https://support.claude.com/en/articles/14499648-how-scim-sync-works-for-enterprise-organizations",
       "status": "success",
       "path": "support/14499648-how-scim-sync-works-for-enterprise-organizations.md",
-      "sha256": "16a586be304024512e793cd0764b9cec618a9929166b3c19001d56c39b1b94c3",
-      "size": 7674
+      "sha256": "e5d44634e4941eddd918eafb9b00ee54432e5eb8e539dffdde963f9e01042561",
+      "size": 7670
     },
     {
       "url": "https://support.claude.com/en/articles/14503520-available-beta-and-research-preview-features",
@@ -11867,8 +11923,8 @@
       "url": "https://support.claude.com/en/articles/15330088-set-a-default-model-for-your-organization",
       "status": "success",
       "path": "support/15330088-set-a-default-model-for-your-organization.md",
-      "sha256": "7fee3008080e6d6b67be039f9ba421c646263b901502f9ff8e34e35f7a81a86a",
-      "size": 11309
+      "sha256": "71750e64c3b37c074030d51a5377f2907fdf5141f0328fcac8d4450db567bc83",
+      "size": 11313
     },
     {
       "url": "https://support.claude.com/en/articles/15330651-claude-enterprise-admin-api-reference-guide",
@@ -11979,8 +12035,8 @@
       "url": "https://support.claude.com/en/articles/15694740-manage-model-access-for-your-organization",
       "status": "success",
       "path": "support/15694740-manage-model-access-for-your-organization.md",
-      "sha256": "b40e5ff21c93854c4d232e27f1fc71881c5c274486e114dd57e78dad61b0e9b2",
-      "size": 10340
+      "sha256": "d82e57c731ea5e04b39a358baadf41ae0625a4dd541fdcaab4c3d23928d16046",
+      "size": 10332
     },
     {
       "url": "https://support.claude.com/en/articles/15707726-using-claude-for-legal-work-privilege-confidentiality-and-how-to-think-about-configuration",
@@ -12014,7 +12070,7 @@
       "url": "https://support.claude.com/en/articles/15936181-get-started-with-1password-for-claude",
       "status": "success",
       "path": "support/15936181-get-started-with-1password-for-claude.md",
-      "sha256": "fa717f13cbdc415513838b716e6fc575c91264ebfd6826c0ffc7246835a45821",
+      "sha256": "63a266faf43a02dae8e2b4393ac7fec8f4fbaf8ed4046fe698aac571fe11c157",
       "size": 5058
     },
     {
@@ -12063,8 +12119,8 @@
       "url": "https://support.claude.com/en/articles/16607638-understanding-your-pro-or-max-plan-invoices",
       "status": "success",
       "path": "support/16607638-understanding-your-pro-or-max-plan-invoices.md",
-      "sha256": "876162d5950448ad4c7272955aedd4fba2d5143615db6ded89d3d79215dba8cf",
-      "size": 5832
+      "sha256": "eec67ccf4a85d97e2af9b4cec7a6273d34cff5bd75aff5fe3c66ee39fc0bab75",
+      "size": 5836
     },
     {
       "url": "https://support.claude.com/en/articles/16607668-understanding-your-team-plan-invoices",
@@ -12147,7 +12203,7 @@
       "url": "https://support.claude.com/en/articles/16893491-get-started-with-smart-reports",
       "status": "success",
       "path": "support/16893491-get-started-with-smart-reports.md",
-      "sha256": "0a25b1df61a52e3814a5c4bb46b27e715178eeb54decc7afe09def866b67cb03",
+      "sha256": "fe087d478a2f6bdf5eda40c7a63bfc09dbe2328dd7a2f504902989b4e5fe1040",
       "size": 15957
     },
     {
@@ -12168,8 +12224,8 @@
       "url": "https://support.claude.com/en/articles/16951679-use-claude-in-google-docs-sheets-and-slides",
       "status": "success",
       "path": "support/16951679-use-claude-in-google-docs-sheets-and-slides.md",
-      "sha256": "08fb2be4c46384c45907e7b926e9dd420a6f9f16ef0df526a95c14cb78423656",
-      "size": 21894
+      "sha256": "310290e9ae4b75de9551170cc79d6d20fa9193f215411cfa9d264c23cfd3f74b",
+      "size": 21892
     },
     {
       "url": "https://support.claude.com/en/articles/16952184-set-up-salesforce-in-claude-for-your-organization",
@@ -12196,7 +12252,7 @@
       "url": "https://support.claude.com/en/articles/17005973-manage-pooled-group-budgets-on-enterprise-plans",
       "status": "success",
       "path": "support/17005973-manage-pooled-group-budgets-on-enterprise-plans.md",
-      "sha256": "eb1e08f044d9dea06266169d70556e89c2416e09b3cfd007b6fed199ffcc1715",
+      "sha256": "ffeb04dc135f53743f9e0321a1abd3913230a0a8b4faec64583bd8dae891e9d3",
       "size": 6980
     },
     {
@@ -12245,8 +12301,8 @@
       "url": "https://support.claude.com/en/articles/17203415-set-up-claude-for-intune",
       "status": "success",
       "path": "support/17203415-set-up-claude-for-intune.md",
-      "sha256": "6cc12509a3207defc645043fed118f6031ff718a7c8e0c8b7f54209d325cb04f",
-      "size": 11379
+      "sha256": "741023968838b46be3566e4464833a8115b1a8f36530a659188fddf552a8cbab",
+      "size": 11371
     },
     {
       "url": "https://support.claude.com/en/articles/17318731-use-claude-code-local-mode-and-claude-cowork-local-mode-on-a-hipaa-ready-enterprise-plan",
@@ -29700,21 +29756,16 @@
       "size": 170
     }
   ],
-  "failures": [
-    {
-      "url": "https://support.claude.com/en/articles/17440474-migrate-from-standalone-claude-design-to-claude",
-      "error": "moved to https://support.claude.com/en/articles/17440474-move-from-standalone-claude-design-to-claude.md"
-    },
-    {
-      "url": "https://platform.claude.com/docs/en/build-with-claude/claude-on-vertex-ai",
-      "error": "moved to https://platform.claude.com/docs/en/build-with-claude/claude-models-on-google-cloud/google-managed.md"
-    }
-  ],
+  "failures": [],
   "dead": [
     {
       "url": "https://code.claude.com/docs/en/claude-tag",
       "reason": "moved -> https://claude.com/docs/claude-tag/overview"
     },
+    {
+      "url": "https://support.claude.com/en/articles/17440474-migrate-from-standalone-claude-design-to-claude",
+      "reason": "moved -> https://support.claude.com/en/articles/17440474-move-from-standalone-claude-design-to-claude"
+    },
     {
       "url": "https://platform.claude.com/docs/en/agent-sdk/stop-reasons",
       "reason": "moved -> https://code.claude.com/docs/en/agent-sdk"
@@ -29727,6 +29778,10 @@
       "url": "https://platform.claude.com/docs/en/agents-and-tools/claude-for-sheets",
       "reason": "HTTP 404"
     },
+    {
+      "url": "https://platform.claude.com/docs/en/build-with-claude/claude-on-vertex-ai",
+      "reason": "moved -> https://platform.claude.com/docs/en/build-with-claude/claude-models-on-google-cloud/google-managed"
+    },
     {
       "url": "https://code.claude.com/docs/en/sdk/migration-guide",
       "reason": "moved -> https://code.claude.com/docs/en/agent-sdk"
@@ -30905,8 +30960,8 @@
     }
   ],
   "summary": {
-    "total": 4542,
-    "downloaded": 4242,
+    "total": 4550,
+    "downloaded": 4250,
     "skipped": 0,
     "failed": 0,
     "dead": 300,
diff --git a/content/en/about-claude/pricing.md b/content/en/about-claude/pricing.md
index 0960a7fd87..b41c16ccd4 100644
--- a/content/en/about-claude/pricing.md
+++ b/content/en/about-claude/pricing.md
@@ -300,7 +300,7 @@ When used without these tools, code execution is billed by execution time, track
 
 Code execution usage is tracked in the response:
 
-```text wrap
+```json
 {
   "usage": {
     "input_tokens": 105,
@@ -329,7 +329,7 @@ See [tool use pricing](https://platform.claude.com/docs/en/about-claude/pricing#
 
 Web search usage is charged in addition to token usage:
 
-```text wrap
+```json
 {
   "usage": {
     "input_tokens": 105,
@@ -351,7 +351,7 @@ Each web search counts as one use, regardless of the number of results returned.
 
 Web fetch usage has **no additional charges** beyond standard token costs:
 
-```text wrap
+```json
 {
   "usage": {
     "input_tokens": 25039,
diff --git a/content/en/about-claude/use-case-guides/commerce-agents.md b/content/en/about-claude/use-case-guides/commerce-agents.md
index f9ac4019d2..7b29fe3a76 100644
--- a/content/en/about-claude/use-case-guides/commerce-agents.md
+++ b/content/en/about-claude/use-case-guides/commerce-agents.md
@@ -4,7 +4,11 @@ url: https://platform.claude.com/docs/en/about-claude/use-case-guides/commerce-a
 description: Build a shopping agent and a merchant agent on Claude using Claude for commerce, an open-source blueprint with working implementations on the Messages API, the Claude Agent SDK, and Claude Managed Agents.
 ---
 
-This guide shows how to build commerce agents on Claude: a shopping agent that customers use inside your app, and a merchant agent for the people running the store, whether that is the business's own operations staff or the sellers on its platform. It does that through Claude for commerce, an open-source blueprint with a working implementation of each agent on the [Messages API](https://platform.claude.com/docs/en/build-with-claude/working-with-messages), the [Claude Agent SDK](https://code.claude.com/docs/en/agent-sdk/overview), and [Claude Managed Agents](https://platform.claude.com/docs/en/managed-agents/overview), runnable examples for retail, travel, telecom, and entertainment, and a Claude Code plugin that scaffolds the same design against your own systems.
+This guide shows how to build commerce agents on Claude: a shopping agent that customers use inside your app, and a merchant agent for the people running the store, whether that is the business's own operations staff or the sellers on its platform. It does that through Claude for commerce, an open-source blueprint that includes the following:
+
+* A working implementation of each agent on the [Messages API](https://platform.claude.com/docs/en/build-with-claude/working-with-messages), the [Claude Agent SDK](https://code.claude.com/docs/en/agent-sdk/overview), and [Claude Managed Agents](https://platform.claude.com/docs/en/managed-agents/overview)
+* Runnable examples for retail, travel, telecom, and entertainment
+* A Claude Code plugin that scaffolds the same design against your own systems
 
 The code, setup instructions, and safety documentation are in the [Claude for commerce repository on GitHub](https://github.com/anthropics/commerce-agents). For how the agents are built and why, including the single-agent-with-skills design, UI components as tools, harness-enforced safety, prompt caching, memory, and evals, read the engineering post [A guide to the anatomy of effective commerce agents](https://claude.com/blog/the-anatomy-of-effective-commerce-agents).
 
diff --git a/content/en/about-claude/use-case-guides/ticket-routing.md b/content/en/about-claude/use-case-guides/ticket-routing.md
index 546d4ed2b2..a212227473 100644
--- a/content/en/about-claude/use-case-guides/ticket-routing.md
+++ b/content/en/about-claude/use-case-guides/ticket-routing.md
@@ -1058,7 +1058,7 @@ To assess this, first modify the script so that it compares the predicted intent
   DEFAULT_MODEL = "claude-haiku-5-5"
 
 
-  def classify_support_request(request, actual_intent):
+  def classify_support_request(ticket_contents, actual_intent):
       # Define the prompt for the classification task
       classification_prompt = f"""You will be acting as a customer support ticket classification system.
           […]
@@ -1101,7 +1101,7 @@ To assess this, first modify the script so that it compares the predicted intent
   const DEFAULT_MODEL = "claude-haiku-5-5";
 
   async function classifySupportRequest(
-    request: string,
+    ticketContents: string,
     actualIntent: string
   ): Promise<{ reasoning: string; intent: string; correct: boolean; usage: Anthropic.Usage }> {
     // Define the prompt for the classification task
@@ -1147,7 +1147,7 @@ To assess this, first modify the script so that it compares the predicted intent
   // Set the default model
   const Model DefaultModel = Model.ClaudeHaiku5_5;
 
-  async Task<(string Reasoning, string Intent, bool Correct, Usage Usage)> ClassifySupportRequest(string request, string actualIntent)
+  async Task<(string Reasoning, string Intent, bool Correct, Usage Usage)> ClassifySupportRequest(string ticketContents, string actualIntent)
   {
       // Define the prompt for the classification task
       var classificationPrompt = """
@@ -1205,7 +1205,7 @@ To assess this, first modify the script so that it compares the predicted intent
   // Set the default model
   const defaultModel = anthropic.ModelClaudeHaiku5_5
 
-  func classifySupportRequest(ctx context.Context, request, actualIntent string) (reasoning, intent string, correct bool, usage anthropic.Usage, err error) {
+  func classifySupportRequest(ctx context.Context, ticketContents, actualIntent string) (reasoning, intent string, correct bool, usage anthropic.Usage, err error) {
   	// Define the prompt for the classification task
   	classificationPrompt := `You will be acting as a customer support ticket classification system.
   		[…]
@@ -1264,7 +1264,7 @@ To assess this, first modify the script so that it compares the predicted intent
 
   record Classification(String reasoning, String intent, boolean correct, Usage usage) {}
 
-  Classification classifySupportRequest(String request, String actualIntent) {
+  Classification classifySupportRequest(String ticketContents, String actualIntent) {
       // Define the prompt for the classification task
       String classificationPrompt = """
           You will be acting as a customer support ticket classification system.
@@ -1316,7 +1316,7 @@ To assess this, first modify the script so that it compares the predicted intent
   /**
    * @return array{string, string, bool, Usage} the reasoning, the intent, whether the intent is correct, and the usage
    */
-  function classifySupportRequest(Client $client, string $request, string $actualIntent): array
+  function classifySupportRequest(Client $client, string $ticketContents, string $actualIntent): array
   {
       // Define the prompt for the classification task
       $classificationPrompt = <<<PROMPT
@@ -1366,7 +1366,7 @@ To assess this, first modify the script so that it compares the predicted intent
   # Set the default model
   DEFAULT_MODEL = Anthropic::Model::CLAUDE_HAIKU_5_5
 
-  def classify_support_request(client, request, actual_intent)
+  def classify_support_request(client, ticket_contents, actual_intent)
     # Define the prompt for the classification task
     classification_prompt = <<~PROMPT
       You will be acting as a customer support ticket classification system.
@@ -1411,7 +1411,7 @@ A proper evaluation requires clear thresholds and benchmarks to determine what i
 * **Accuracy:** 95% (out of 100 tests)
 * **Cost per classification:** 50% reduction on average (across 100 tests) from current routing method
 
-Having these thresholds allows you to tell at scale, and with impartial empiricism, what method is best for you and what changes might need to be made to better fit your requirements.
+Having these thresholds allows you to tell at scale, and with impartial empiricism, what method is best for you and what changes you might need to make to better fit your requirements.
 
 ***
 
diff --git a/content/en/agents-and-tools/agent-skills/best-practices.md b/content/en/agents-and-tools/agent-skills/best-practices.md
index 9eeb8fa8a1..18e8083334 100644
--- a/content/en/agents-and-tools/agent-skills/best-practices.md
+++ b/content/en/agents-and-tools/agent-skills/best-practices.md
@@ -909,7 +909,7 @@ def process_file(path):
     return open(path).read()
 ```
 
-Configuration parameters should also be justified and documented to avoid "voodoo constants" (Ousterhout's law). If you don't know the right value, how will Claude determine it?
+Also justify and document configuration parameters to avoid "voodoo constants" (Ousterhout's law). If you don't know the right value, how will Claude determine it?
 
 **Good example: Self-documenting:**
 
diff --git a/content/en/agents-and-tools/agent-skills/claude-api-skill.md b/content/en/agents-and-tools/agent-skills/claude-api-skill.md
index 0c4f8e285d..7be933138b 100644
--- a/content/en/agents-and-tools/agent-skills/claude-api-skill.md
+++ b/content/en/agents-and-tools/agent-skills/claude-api-skill.md
@@ -183,7 +183,7 @@ Let Claude Code set up your agent for you
 /claude-api managed-agents-onboard
 ```
 
-The skill runs an interview that walks you through the Managed Agents mental model (Agent configs versus Sessions), templates an agent config, configures environments and tools, sets up the session loop, and emits runnable code for your language. The skill also covers the mandatory **Agent (once) → Session (every run)** flow: `model`, `system`, and `tools` live on the agent, never on the session, and agents should be created once and referenced by ID.
+The skill runs an interview that walks you through the Managed Agents mental model (Agent configs versus Sessions), templates an agent config, configures environments and tools, sets up the session loop, and emits runnable code for your language. The skill also covers the mandatory **Agent (once) → Session (every run)** flow: `model`, `system`, and `tools` live on the agent, never on the session, and you create each agent once and reference it by ID.
 
 Managed Agents requires the `managed-agents-2026-04-01` beta header, which the SDK sets automatically for all `client.beta.agents.*`, `client.beta.environments.*`, `client.beta.sessions.*`, and `client.beta.vaults.*` calls.
 
diff --git a/content/en/agents-and-tools/agent-skills/enterprise.md b/content/en/agents-and-tools/agent-skills/enterprise.md
index 5414ebf3df..2aff33f30e 100644
--- a/content/en/agents-and-tools/agent-skills/enterprise.md
+++ b/content/en/agents-and-tools/agent-skills/enterprise.md
@@ -46,7 +46,19 @@ Before deploying any Skill from a third party or internal contributor, complete
 
 ### Skill content scanning
 
-Claude Enterprise organizations can turn on automated security scanning for custom Skills in claude.ai and Claude Cowork. After you turn on **Skill and plugin security scanning** at [claude.ai > Organization settings > Skills](https://claude.ai/admin-settings/skills), Skills that members then upload or edit in claude.ai or Cowork are scanned for signs of malicious behavior, such as hidden code execution, sending your data to an outside service, or instructions that tamper with Claude's safeguards. A Skill that fails the scan, or whose scan hasn't completed, is blocked from use. An administrator can allow some Skills that failed the scan. A Skill that passes with a warning stays usable behind a caution notice. If scanning is available to your organization, turn it on. It complements, but doesn't replace, the [review checklist](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/enterprise#review-checklist).
+Claude Enterprise organizations can turn on automated security scanning for custom Skills in claude.ai and Claude Cowork. The setting is **Skill and plugin security scanning** at [claude.ai > Organization settings > Skills](https://claude.ai/admin-settings/skills).
+
+After you turn on the setting, scanning applies to Skills that members then upload or edit in claude.ai or Cowork. Each scan checks for signs of malicious behavior. These signs include hidden code execution, transfer of your data to an outside service, and instructions that tamper with Claude's safeguards.
+
+Whether a Skill is usable depends on its scan:
+
+* A Skill that fails the scan is blocked from use.
+* A Skill whose scan hasn't completed is blocked from use.
+* A Skill that passes with a warning stays usable behind a caution notice.
+
+Organization owners can allow some Skills that failed the scan. So can members whose [custom role](https://platform.claude.com/docs/en/manage-claude/user-management#custom-roles) can manage **Libraries**.
+
+If scanning is available to your organization, turn it on. Scanning complements, but doesn't replace, the [review checklist](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/enterprise#review-checklist).
 
 Scanning doesn't cover the Claude API. Skills you upload through the Skills API (`/v1/skills`), including from the Claude Console, aren't scanned, so for API deployments, rely on the review checklist and [version pinning](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/enterprise#versioning-strategy). Scanning also doesn't apply to Skills that were already in your organization when you turned it on, or to organizations with certain data handling configurations, such as customer-managed encryption keys (CMEK), zero data retention (ZDR), or HIPAA readiness. For setup steps, exclusions, and result types, see [Get started with skill and plugin scanning](https://support.claude.com/en/articles/15927065-get-started-with-skill-and-plugin-scanning) in the Claude Help Center.
 
diff --git a/content/en/agents-and-tools/mcp-connector.md b/content/en/agents-and-tools/mcp-connector.md
index efc7ab3c3f..dc72c69669 100644
--- a/content/en/agents-and-tools/mcp-connector.md
+++ b/content/en/agents-and-tools/mcp-connector.md
@@ -498,7 +498,7 @@ When Claude uses MCP tools, the response includes two new content block types:
 
 ### MCP tool use block
 
-```text wrap
+```json
 {
   "type": "mcp_tool_use",
   "id": "mcptoolu_014Q35RayjACSWkSj4X2yov1",
@@ -510,7 +510,7 @@ When Claude uses MCP tools, the response includes two new content block types:
 
 ### MCP tool result block
 
-```text wrap
+```json
 {
   "type": "mcp_tool_result",
   "tool_use_id": "mcptoolu_014Q35RayjACSWkSj4X2yov1",
@@ -530,7 +530,7 @@ An MCP server can change its tools at any time. The `mcp-client-2026-09-15` beta
 
 When the API asks an MCP server for its tools while producing a response, the response starts with an `mcp_tool_listing` block for that server, one block for each server it asked:
 
-```text wrap
+```json
 {
   "type": "mcp_tool_listing",
   "mcp_server_name": "example-mcp",
diff --git a/content/en/agents-and-tools/mcp-tunnels/deploy-compose.md b/content/en/agents-and-tools/mcp-tunnels/deploy-compose.md
index 801c1e2160..12c69501db 100644
--- a/content/en/agents-and-tools/mcp-tunnels/deploy-compose.md
+++ b/content/en/agents-and-tools/mcp-tunnels/deploy-compose.md
@@ -383,7 +383,7 @@ This guide provides one reference approach using Docker Compose. You are respons
   </Tab>
 </Tabs>
 
-The compose file reads `TUNNEL_TOKEN` from the host environment with no default, so the export must be repeated in every fresh shell and after a reboot.
+The compose file reads `TUNNEL_TOKEN` from the host environment with no default, so you must repeat the export in every fresh shell and after a reboot.
 
 For a multi-VM deployment, copy the `mcp-tunnel/` directory to each host, set `TUNNEL_TOKEN`, and run `docker compose up -d`. In the programmatic flow `TUNNEL_TOKEN` is `$(sudo cat data/tunnel-token)`; in the manual flow it's the value you copied from the Console. The same tunnel token and certificates work across all replicas.
 
diff --git a/content/en/agents-and-tools/tool-use/advisor-tool.md b/content/en/agents-and-tools/tool-use/advisor-tool.md
index ace3179948..8099a9d6be 100644
--- a/content/en/agents-and-tools/tool-use/advisor-tool.md
+++ b/content/en/agents-and-tools/tool-use/advisor-tool.md
@@ -300,7 +300,7 @@ The advisor tool also accepts the generic properties available on any tool defin
 
 When the advisor is called, a `server_tool_use` block is followed by an `advisor_tool_result` block in the assistant's content. The following example shows the plaintext `advisor_result` variant returned by a Claude Opus 4.8 advisor. The [Quick start](https://platform.claude.com/docs/en/agents-and-tools/tool-use/advisor-tool#quick-start) uses Claude Opus 5.5, which returns the encrypted `advisor_redacted_result` variant instead; see [Result variants](https://platform.claude.com/docs/en/agents-and-tools/tool-use/advisor-tool#result-variants) for both shapes side by side.
 
-```text
+```json
 {
   "role": "assistant",
   "content": [
@@ -349,7 +349,7 @@ Here is the same request sent twice, identical except for the advisor `model` in
 
 With `"model": "claude-opus-4-8"`, the advice is plaintext:
 
-```text
+```json
 {
   "type": "advisor_tool_result",
   "tool_use_id": "srvtoolu_abc123",
@@ -362,7 +362,7 @@ With `"model": "claude-opus-4-8"`, the advice is plaintext:
 
 With `"model": "claude-opus-5-5"`, the advice is encrypted:
 
-```text
+```json
 {
   "type": "advisor_tool_result",
   "tool_use_id": "srvtoolu_abc123",
@@ -383,7 +383,7 @@ In both cases, round-trip the content verbatim on subsequent turns. If you switc
 
 If the advisor call fails, the result carries an error:
 
-```text wrap
+```json
 {
   "type": "advisor_tool_result",
   "tool_use_id": "srvtoolu_abc123",
@@ -1250,7 +1250,7 @@ A `message_delta` event follows with the updated `usage.iterations` array reflec
 
 Advisor calls run as a separate sub-inference billed at the advisor model's rates. Usage is reported in the `usage.iterations[]` array:
 
-```text wrap
+```json
 {
   "usage": {
     "input_tokens": 1760,
@@ -1777,7 +1777,7 @@ Hard reasoning tasks elicit substantially longer advisor output than the [typica
 
 When the advisor does hit the cap, the result block carries `stop_reason: "max_tokens"` on both [result variants](https://platform.claude.com/docs/en/agents-and-tools/tool-use/advisor-tool#result-variants), whichever advisor model you use. Use `stop_reason` to detect truncated advice and decide whether to raise the cap or let the executor proceed with partial guidance. The API also appends `[Advisor output truncated at max_tokens=2048.]` (naming your cap) to the advice text, so the executor receives the truncation notice in its own context; with a plaintext `advisor_result` advisor that marker is visible to your client as well. Both signals appear only when you set `max_tokens` on the tool definition.
 
-```text
+```json
 {
   "type": "advisor_tool_result",
   "tool_use_id": "srvtoolu_abc123",
diff --git a/content/en/agents-and-tools/tool-use/bash-tool.md b/content/en/agents-and-tools/tool-use/bash-tool.md
index 2642556acc..667690e1b4 100644
--- a/content/en/agents-and-tools/tool-use/bash-tool.md
+++ b/content/en/agents-and-tools/tool-use/bash-tool.md
@@ -181,7 +181,7 @@ The current version of the tool is `bash_20250124`. For model support, beta head
 
 Claude responds with `stop_reason: "tool_use"` and a `tool_use` block that contains the command for your application to run:
 
-```text Output wrap
+```json Output
 {
   "id": "msg_01XAbCDeFgHiJkLmNoPQrStU",
   "model": "claude-opus-5-5",
diff --git a/content/en/agents-and-tools/tool-use/browser-use-tool.md b/content/en/agents-and-tools/tool-use/browser-use-tool.md
index f2f04fbcbe..9ed870c123 100644
--- a/content/en/agents-and-tools/tool-use/browser-use-tool.md
+++ b/content/en/agents-and-tools/tool-use/browser-use-tool.md
@@ -205,7 +205,7 @@ The browser use tool is available on the Claude API and [Claude Models on Google
 
 Claude's first response ends with `stop_reason: "tool_use"` and carries one or more member `tool_use` blocks, each naming a member tool in `name` and carrying `"toolset_name": "browser"`:
 
-```text Output
+```json Output
 {
   "id": "msg_01HCDu4XSTLzTAcodEQ58vDo",
   "type": "message",
@@ -1062,7 +1062,7 @@ When you stream the response, each member's `input` arrives as one complete `inp
 
 A turn with several member calls is a batch action: run the calls in the order they appear, stop at the first failure, and answer every later call with `is_error: true` and the exact text `Not executed: an earlier action in this turn failed.` A batch uses the same response shape as [parallel tool use](https://platform.claude.com/docs/en/agents-and-tools/tool-use/parallel-tool-use); the difference is that you run the blocks in order rather than concurrently. Here Claude clicks the search box it found earlier, types a query, and presses Enter in one turn:
 
-```text wrap
+```json
 {
   "role": "assistant",
   "content": [
@@ -1139,7 +1139,7 @@ Browser use carries risks that standard API features don't, because Claude reads
 
   1. Run the browser and your executor in a dedicated container or virtual machine with minimal privileges, a fresh profile that holds no credentials, and no access to sensitive filesystems or internal networks; isolate any tool you run alongside it the same way.
   2. Restrict the hosts the browser can reach to a domain allowlist enforced at the network layer and re-checked in your `navigate` handler after redirects, and block loopback, link-local, and private ranges unless the task needs them.
-  3. Treat everything a page supplies as untrusted input, including the tab titles and URLs, and each download's `url`, `path`, and `error`, that you report in a [`browser_state`](https://platform.claude.com/docs/en/agents-and-tools/tool-use/browser-use-tool#track-tabs-and-page-state) block, and build page reads from what the page renders (the accessibility tree or visible text), not raw DOM source, so hidden text doesn't reach Claude.
+  3. Treat everything a page supplies as untrusted input. That includes the tab titles and URLs, and each download's `url`, `path`, and `error`, that you report in a [`browser_state`](https://platform.claude.com/docs/en/agents-and-tools/tool-use/browser-use-tool#track-tabs-and-page-state) block. Build page reads from what the page renders (the accessibility tree or visible text), not raw DOM source, so hidden text doesn't reach Claude.
   4. In your `navigate` handler, accept the history keywords `"back"`, `"forward"`, and `"reload"`, treat a URL without a scheme as `https://`, then parse the URL and refuse any scheme other than `http` or `https` (`javascript:`, `file:`, `data:`, `chrome:`, and so on) with an [error result](https://platform.claude.com/docs/en/agents-and-tools/tool-use/browser-use-tool#return-errors-from-your-executor). Check the scheme with a URL parser rather than a string prefix; the API doesn't filter the URLs Claude opens, so it can't reject one for you.
   5. Leave `javascript_exec` and `file_upload` disabled unless you need them, and read [Enable optional members](https://platform.claude.com/docs/en/agents-and-tools/tool-use/browser-use-tool#enable-optional-member-tools) before turning either on.
   6. Have a human confirm consequential actions and anything that requires affirmative consent (purchasing, modifying accounts, messaging, and accepting terms), and make that check in your executor before each call, because one turn can carry several.
@@ -1271,7 +1271,7 @@ Four member tools are disabled by default: `javascript_exec` and `file_upload` b
 * `paths` are file paths on the executor's filesystem, for deployments where the executor can read your application's files directly (the same condition under which you populate a download's `path`).
 * `document_ids` are identifiers for files your application has staged for the browser, for deployments where it can't. Your application defines what the identifiers mean; scope their resolution the way you scope `paths`, to files staged for this task.
 
-```text wrap
+```json
 {
   "type": "tool_use",
   "id": "toolu_01N7gVzFEfZjLjgsYwnrPgrF",
diff --git a/content/en/agents-and-tools/tool-use/code-execution-tool.md b/content/en/agents-and-tools/tool-use/code-execution-tool.md
index 136391ed37..02092ed8a5 100644
--- a/content/en/agents-and-tools/tool-use/code-execution-tool.md
+++ b/content/en/agents-and-tools/tool-use/code-execution-tool.md
@@ -938,7 +938,7 @@ The code execution tool can return two types of results depending on the operati
 
 ### Bash command response
 
-```text Output
+```json Output
 {
   "type": "server_tool_use",
   "id": "srvtoolu_01B3C4D5E6F7G8H9I0J1K2L3",
@@ -964,7 +964,7 @@ The code execution tool can return two types of results depending on the operati
 
 **View file:**
 
-```text Output wrap
+```json Output
 {
   "type": "server_tool_use",
   "id": "srvtoolu_01C4D5E6F7G8H9I0J1K2L3M4",
@@ -990,7 +990,7 @@ The code execution tool can return two types of results depending on the operati
 
 **Create file:**
 
-```text Output wrap
+```json Output
 {
   "type": "server_tool_use",
   "id": "srvtoolu_01D5E6F7G8H9I0J1K2L3M4N5",
@@ -1013,7 +1013,7 @@ The code execution tool can return two types of results depending on the operati
 
 **Edit file (str\_replace):**
 
-```text Output wrap
+```json Output
 {
   "type": "server_tool_use",
   "id": "srvtoolu_01E6F7G8H9I0J1K2L3M4N5O6",
@@ -1060,7 +1060,7 @@ Each tool type can return specific errors:
 
 **Common errors (all tools):**
 
-```text Output wrap
+```json Output
 {
   "type": "bash_code_execution_tool_result",
   "tool_use_id": "srvtoolu_01VfmxgZ46TiHbmXgy928hQR",
@@ -1100,10 +1100,10 @@ The code execution tool runs in a secure, containerized environment designed spe
 
 ### Resource limits
 
-* **Memory:** 5 GiB RAM
-* **Disk space:** 5 GiB workspace storage
-* **CPU:** 1 CPU
-* **Execution time:** A tool call that runs past the maximum execution time returns an `execution_time_exceeded` [error](https://platform.claude.com/docs/en/agents-and-tools/tool-use/code-execution-tool#errors). With [programmatic tool calling](https://platform.claude.com/docs/en/agents-and-tools/tool-use/programmatic-tool-calling), each REPL cell also has a 90-second wall-clock limit
+* **Memory:** The container has 5 GiB of RAM.
+* **Disk space:** The container has 5 GiB of workspace storage.
+* **CPU:** The container has 1 CPU.
+* **Execution time:** A tool call that runs past the maximum execution time returns an `execution_time_exceeded` [error](https://platform.claude.com/docs/en/agents-and-tools/tool-use/code-execution-tool#errors). With [programmatic tool calling](https://platform.claude.com/docs/en/agents-and-tools/tool-use/programmatic-tool-calling), each REPL cell also has a 90-second wall-clock limit.
 
 ### Networking and security
 
@@ -1111,8 +1111,8 @@ The code execution tool runs in a secure, containerized environment designed spe
 * **External connections:** No outbound network requests allowed
 * **Sandbox isolation:** Full isolation from host system and other containers
 * **File access:** Limited to workspace directory only
-* **Workspace scoping:** Like the [Files API](https://platform.claude.com/docs/en/build-with-claude/files), containers are scoped to the request's workspace
-* **Expiration:** Containers expire 30 days after creation
+* **Workspace scoping:** Scoped to the request's workspace, like the [Files API](https://platform.claude.com/docs/en/build-with-claude/files)
+* **Expiration:** 30 days after creation
 
 ### Pre-installed libraries
 
@@ -1443,7 +1443,7 @@ When Claude calls one of your client tools alongside code execution, the API ret
 
 With [streaming](https://platform.claude.com/docs/en/build-with-claude/streaming) enabled (`"stream": true`), you'll receive code execution events as they occur. The sub-tool input streams as `input_json_delta` events, and each result block arrives whole in a single `content_block_start` event:
 
-```text
+```sse
 event: content_block_start
 data: {"type": "content_block_start", "index": 1, "content_block": {"type": "server_tool_use", "id": "srvtoolu_xyz789", "name": "bash_code_execution"}}
 
@@ -1475,7 +1475,7 @@ When used without these tools, code execution is billed by execution time, track
 
 Code execution usage is tracked in the response:
 
-```text wrap
+```json
 {
   "usage": {
     "input_tokens": 105,
diff --git a/content/en/agents-and-tools/tool-use/computer-use-tool.md b/content/en/agents-and-tools/tool-use/computer-use-tool.md
index 415a3cc264..5d0e7ea81a 100644
--- a/content/en/agents-and-tools/tool-use/computer-use-tool.md
+++ b/content/en/agents-and-tools/tool-use/computer-use-tool.md
@@ -277,7 +277,7 @@ Add the computer use toolset to the `tools` array of a [Messages API](https://pl
 
 When Claude acts on the desktop, the response has a `stop_reason` of `tool_use` and contains one or more member `tool_use` blocks, each naming a member tool and carrying `"toolset_name": "computer"`. Partway through this task, after Claude has received a screenshot of the desktop, a response might look like this:
 
-```text Output wrap
+```json Output
 {
   "id": "msg_01UZ3bXcQH8mTqNhVfL9eK2p",
   "type": "message",
@@ -347,7 +347,7 @@ Claude can plan a short sequence of actions, such as click, type, and then take
 
 A response with a three-action batch looks like this:
 
-```text wrap
+```json
 {
   "role": "assistant",
   "content": [
@@ -761,7 +761,7 @@ Keep the following in mind when implementing the members:
 
   Shift+click at a position, for example, to extend a selection. Unlike `hold_key`, `text` holds the modifiers only for the duration of that click or scroll:
 
-  ```text wrap
+  ```json
   {
     "type": "tool_use",
     "id": "toolu_01Qg8m3XqC5aRy7tD2eS4jUg",
@@ -773,7 +773,7 @@ Keep the following in mind when implementing the members:
 
   Drag from one point to another:
 
-  ```text wrap
+  ```json
   {
     "type": "tool_use",
     "id": "toolu_01Ed6j9VnA3yPw5rB8cQ2gSe",
@@ -788,7 +788,7 @@ Keep the following in mind when implementing the members:
 
   Scroll down three clicks of the wheel:
 
-  ```text wrap
+  ```json
   {
     "type": "tool_use",
     "id": "toolu_01Yc5h8UmZ2xNv4qA7bP9fRd",
@@ -804,7 +804,7 @@ Keep the following in mind when implementing the members:
 
   Press Tab four times:
 
-  ```text wrap
+  ```json
   {
     "type": "tool_use",
     "id": "toolu_01Sb4g7TkY9wLu3pX6zM8eQc",
@@ -816,7 +816,7 @@ Keep the following in mind when implementing the members:
 
   Zoom in to inspect a region at full resolution:
 
-  ```text wrap
+  ```json
   {
     "type": "tool_use",
     "id": "toolu_01Kf7k2WpB4zQx6sC9dR3hTf",
@@ -828,7 +828,7 @@ Keep the following in mind when implementing the members:
 
   Report the cursor position. Answer this call with a short text result that gives the position in screenshot pixels, for example, `X=512, Y=384`:
 
-  ```text wrap
+  ```json
   {
     "type": "tool_use",
     "id": "toolu_01Ekh3vqB6yTs2mNc4Rw8pLd",
@@ -887,7 +887,7 @@ To combine computer use with thinking, see [Thinking](https://platform.claude.co
 
 To add other tools alongside computer use, include them in the same `tools` array. The [Quick start](https://platform.claude.com/docs/en/agents-and-tools/tool-use/computer-use-tool#quick-start) section shows this pattern with the [bash tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/bash-tool) and [text editor tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/text-editor-tool). You can add your own [custom tool definitions](https://platform.claude.com/docs/en/agents-and-tools/tool-use/define-tools) the same way.
 
-For tasks that stay inside webpages, you can also [declare the browser use tool in the same request](https://platform.claude.com/docs/en/agents-and-tools/tool-use/browser-use-tool#combine-with-other-tools): the two toolsets work independently, each in its own coordinate frame, and calls to members that share a name, such as `screenshot` or `key`, are told apart by `toolset_name`.
+For tasks that stay inside webpages, you can also [declare the browser use tool in the same request](https://platform.claude.com/docs/en/agents-and-tools/tool-use/browser-use-tool#combine-with-other-tools). The two toolsets work independently, each in its own coordinate frame. The `toolset_name` value distinguishes calls to members that share a name, such as `screenshot` or `key`.
 
 ### Build a custom computer use environment
 
@@ -1859,7 +1859,7 @@ If clicks miss their targets, the cause is usually one of the following:
       ```typescript TypeScript
       async function clickAndWait(x: number, y: number, waitMs = 500): Promise<void> {
         clickAt(x, y);
-        await setTimeout(waitMs); // Allow UI to update
+        await new Promise((resolve) => setTimeout(resolve, waitMs)); // Allow UI to update
       }
       ```
 
diff --git a/content/en/agents-and-tools/tool-use/define-tools.md b/content/en/agents-and-tools/tool-use/define-tools.md
index faba526e7d..c88ca0b1fe 100644
--- a/content/en/agents-and-tools/tool-use/define-tools.md
+++ b/content/en/agents-and-tools/tool-use/define-tools.md
@@ -869,7 +869,7 @@ When using tools, Claude often comments on what it's doing or responds naturally
 
 For example, given the prompt "What's the weather like in San Francisco right now, and what time is it there?", Claude might respond with:
 
-```text JSON
+```json JSON
 {
   "role": "assistant",
   "content": [
diff --git a/content/en/agents-and-tools/tool-use/handle-tool-calls.md b/content/en/agents-and-tools/tool-use/handle-tool-calls.md
index c154cde17d..b6205619d7 100644
--- a/content/en/agents-and-tools/tool-use/handle-tool-calls.md
+++ b/content/en/agents-and-tools/tool-use/handle-tool-calls.md
@@ -23,7 +23,7 @@ The response has a `stop_reason` of `tool_use` and one or more `tool_use` conten
 A `tool_use` block for a member of the [computer use](https://platform.claude.com/docs/en/agents-and-tools/tool-use/computer-use-tool) or [browser use](https://platform.claude.com/docs/en/agents-and-tools/tool-use/browser-use-tool) toolset also carries a `toolset_name` field (`"computer"` or `"browser"`). Its `name` is the member tool Claude is calling, such as `screenshot` or `navigate`, so dispatch those blocks on both fields.
 
 <Accordion title="Example API response with a `tool_use` content block">
-  ```text JSON wrap
+  ```json JSON
   {
     "id": "msg_01Aq9w938a90dw8q",
     "model": "claude-opus-5-5",
diff --git a/content/en/agents-and-tools/tool-use/memory-tool.md b/content/en/agents-and-tools/tool-use/memory-tool.md
index c12d13f5a6..8cdbae2fdf 100644
--- a/content/en/agents-and-tools/tool-use/memory-tool.md
+++ b/content/en/agents-and-tools/tool-use/memory-tool.md
@@ -48,7 +48,7 @@ A typical interaction looks like this:
 
 Claude calls the memory tool:
 
-```text wrap
+```json
 {
   "type": "tool_use",
   "id": "toolu_01C4D5E6F7G8H9I0J1K2L3M4",
@@ -72,7 +72,7 @@ Claude calls the memory tool:
 
 **4. Claude reads relevant files:**
 
-```text wrap
+```json
 {
   "type": "tool_use",
   "id": "toolu_01D5E6F7G8H9I0J1K2L3M4N5",
diff --git a/content/en/agents-and-tools/tool-use/overview.md b/content/en/agents-and-tools/tool-use/overview.md
index e13f472cda..a377014062 100644
--- a/content/en/agents-and-tools/tool-use/overview.md
+++ b/content/en/agents-and-tools/tool-use/overview.md
@@ -654,7 +654,7 @@ Each server tool's page describes its own trigger boundary in more detail.
 
   For example, given a `get_weather` tool that requires a `location` parameter, if you ask Claude "What's the weather?" without specifying a location, Claude (particularly Claude Sonnet) might guess values you didn't supply:
 
-  ```text JSON wrap
+  ```json JSON
   {
     "type": "tool_use",
     "id": "toolu_01A09q90qw90lq917835lq9",
diff --git a/content/en/agents-and-tools/tool-use/programmatic-tool-calling.md b/content/en/agents-and-tools/tool-use/programmatic-tool-calling.md
index c25f1d98d6..507d9fb047 100644
--- a/content/en/agents-and-tools/tool-use/programmatic-tool-calling.md
+++ b/content/en/agents-and-tools/tool-use/programmatic-tool-calling.md
@@ -368,7 +368,7 @@ The response stops with `stop_reason: "tool_use"`, a `container` ID, and a `tool
 
 When you configure a tool to be callable from code execution and Claude determines that tool is needed:
 
-1. Claude writes Python code that calls the tool as a function. The code can include multiple tool calls and pre/post-processing logic.
+1. Claude writes Python code that calls the tool as a function. The code can include multiple tool calls, plus preprocessing and post-processing logic.
 2. Claude runs this code in a sandboxed container through code execution.
 3. When a tool function is called, code execution pauses and the API returns a `tool_use` block.
 4. You provide the tool result, and code execution continues (intermediate results are not loaded into Claude's context window).
@@ -423,7 +423,7 @@ Every tool use block includes a `caller` field indicating how it was called:
 
 **Direct call (traditional tool use):**
 
-```text wrap
+```json
 {
   "type": "tool_use",
   "id": "toolu_abc123",
@@ -435,7 +435,7 @@ Every tool use block includes a `caller` field indicating how it was called:
 
 **Programmatic call:**
 
-```text wrap
+```json
 {
   "type": "tool_use",
   "id": "toolu_xyz789",
@@ -481,7 +481,7 @@ The request shape is identical to the [Quick start](https://platform.claude.com/
 
 Claude writes code that calls your tool. The API pauses and returns:
 
-```text Output
+```json Output
 {
   "role": "assistant",
   "content": [
@@ -1143,13 +1143,13 @@ Send the full conversation history plus your tool result. Three details matter o
 
 ### Step 4: Next tool call or completion
 
-The code picks up where it paused and processes your result. Each continuation response either pauses again with more programmatic `tool_use` blocks, or completes the code execution and lets Claude continue the turn (Step 5). Check `stop_reason` and each `tool_use` block's `caller` to tell the two apart: a response that pauses for you has `stop_reason: "tool_use"` and a `tool_use` block whose `caller` names a code execution version, and you repeat Step 3 with a `tool_result` for every pending programmatic call in one user message.
+The code picks up where it paused and processes your result. Each continuation response either pauses again with more programmatic `tool_use` blocks, or completes the code execution and lets Claude continue the turn (Step 5). Check `stop_reason` and each `tool_use` block's `caller` to tell the two apart. A response that pauses for you has `stop_reason: "tool_use"` and a `tool_use` block whose `caller` names a code execution version. In that case, repeat Step 3 with a `tool_result` for every pending programmatic call in one user message.
 
 ### Step 5: Final response
 
 Once the code execution completes, Claude provides the final response:
 
-```text Output
+```json Output
 {
   "content": [
     {
@@ -1238,7 +1238,7 @@ for error in errors[-10:]:  # Only return last 10 errors
 
 When code execution calls a tool:
 
-```text wrap
+```json
 {
   "type": "tool_use",
   "id": "toolu_abc123",
@@ -1272,7 +1272,7 @@ Your tool result is passed back to the running code:
 
 When all tool calls are satisfied and code completes:
 
-```text
+```json
 {
   "type": "code_execution_tool_result",
   "tool_use_id": "srvtoolu_xyz789",
@@ -1299,7 +1299,7 @@ When all tool calls are satisfied and code completes:
 
 If your tool result doesn't arrive within about 4 minutes, the pending call raises a `TimeoutError` inside Claude's running code. Claude receives the error in `stderr` and typically retries the call:
 
-```text
+```json
 {
   "type": "code_execution_tool_result",
   "tool_use_id": "srvtoolu_abc123",
diff --git a/content/en/agents-and-tools/tool-use/server-tools.md b/content/en/agents-and-tools/tool-use/server-tools.md
index ff53d3eb86..551be7a17f 100644
--- a/content/en/agents-and-tools/tool-use/server-tools.md
+++ b/content/en/agents-and-tools/tool-use/server-tools.md
@@ -10,7 +10,7 @@ Server-executed tools share these mechanics: the `server_tool_use` block, `pause
 
 The `server_tool_use` block appears in Claude's response when a server-executed tool runs. Its `id` field uses the `srvtoolu_` prefix to distinguish it from client tool calls:
 
-```text wrap
+```json
 {
   "type": "server_tool_use",
   "id": "srvtoolu_01A2B3C4D5E6F7G8H9",
@@ -408,7 +408,7 @@ Claude can call a server tool and a client tool in the same group of parallel to
   With [programmatic tool calling](https://platform.claude.com/docs/en/agents-and-tools/tool-use/programmatic-tool-calling), the same response shape means something different. The client `tool_use` block comes from code that is running in the `code_execution` tool rather than from Claude directly, and its `caller` field names the `code_execution` block that called it. That code has already started: it is paused waiting for your `tool_result` blocks, and sending them resumes the execution instead of starting a deferred tool. The `code_execution` block's own result block arrives once the code completes, which can take more than one round of tool results. The follow-up user message itself is the same in both cases; with programmatic tool calling, also pass back the `id` from the response's `container` field, as that page shows.
 </Note>
 
-```text wrap
+```json
 {
   "stop_reason": "tool_use",
   "content": [
@@ -449,7 +449,7 @@ To continue the turn, run the client tools and send a user message whose content
 
 The API attaches your results to the still-open assistant turn, runs the deferred server tool (for paused code execution, resumes it), and then lets Claude continue. For a server tool Claude called directly, the next response starts with the result block that answers the previous response's `server_tool_use` `id`, followed by the newly generated content and a fresh `stop_reason`:
 
-```text wrap
+```json
 {
   "stop_reason": "end_turn",
   "content": [
@@ -1010,7 +1010,7 @@ The following example enables web fetch together with a user-defined `run_comman
   ```
 </CodeGroup>
 
-This code is also correct when Claude does not mix the two kinds of call. A turn with only client `tool_use` blocks takes the same continuation path, and a turn with only server tool calls needs no client `tool_result` blocks from you: its result blocks are normally already present, and one that comes back suspended, such as a [`pause_turn` response](https://platform.claude.com/docs/en/agents-and-tools/tool-use/server-tools#the-server-side-loop-and-pause-turn), is re-sent as-is instead.
+This code is also correct when Claude does not mix the two kinds of call. A turn with only client `tool_use` blocks takes the same continuation path. A turn with only server tool calls needs no client `tool_result` blocks from you, because its result blocks are normally already present. If that turn comes back suspended, for example as a [`pause_turn` response](https://platform.claude.com/docs/en/agents-and-tools/tool-use/server-tools#the-server-side-loop-and-pause-turn), re-send it as-is instead.
 
 ## ZDR and allowed\_callers
 
diff --git a/content/en/agents-and-tools/tool-use/strict-tool-use.md b/content/en/agents-and-tools/tool-use/strict-tool-use.md
index 08065436ee..e6b92d03d4 100644
--- a/content/en/agents-and-tools/tool-use/strict-tool-use.md
+++ b/content/en/agents-and-tools/tool-use/strict-tool-use.md
@@ -349,7 +349,7 @@ For example, suppose a booking system needs `passengers: int`. Without strict mo
 
 **Response format:** Tool use blocks with validated inputs in `response.content[x].input`
 
-```text Output wrap
+```json Output
 {
   "type": "tool_use",
   "name": "get_weather",
diff --git a/content/en/agents-and-tools/tool-use/text-editor-tool.md b/content/en/agents-and-tools/tool-use/text-editor-tool.md
index d32b50522d..ed8bd82cfc 100644
--- a/content/en/agents-and-tools/tool-use/text-editor-tool.md
+++ b/content/en/agents-and-tools/tool-use/text-editor-tool.md
@@ -274,7 +274,7 @@ Parameters:
 <Accordion title="Example view commands">
   Example for viewing a file:
 
-  ```text wrap
+  ```json
   {
     "type": "tool_use",
     "id": "toolu_01A09q90qw90lq917835lq9",
@@ -288,7 +288,7 @@ Parameters:
 
   Example for viewing a directory:
 
-  ```text wrap
+  ```json
   {
     "type": "tool_use",
     "id": "toolu_02B19r91rw91mr917835mr9",
@@ -313,7 +313,7 @@ Parameters:
 * `new_str`: The new text to insert in place of the old text
 
 <Accordion title="Example str_replace command">
-  ```text wrap
+  ```json
   {
     "type": "tool_use",
     "id": "toolu_01A09q90qw90lq917835lq9",
@@ -339,7 +339,7 @@ Parameters:
 * `file_text`: The content to write to the new file
 
 <Accordion title="Example create command">
-  ```text
+  ```json
   {
     "type": "tool_use",
     "id": "toolu_01A09q90qw90lq917835lq9",
@@ -365,7 +365,7 @@ Parameters:
 * `insert_text`: The text to insert
 
 <Accordion title="Example insert command">
-  ```text
+  ```json
   {
     "type": "tool_use",
     "id": "toolu_01A09q90qw90lq917835lq9",
@@ -560,7 +560,7 @@ First, your application provides Claude with the text editor tool and a prompt t
 
 Claude uses the text editor tool first to view the file:
 
-```text Output
+```json Output
 {
   "id": "msg_01XAbCDeFgHiJkLmNoPQrStU",
   "model": "claude-opus-5-5",
@@ -1021,7 +1021,7 @@ Your application should then read the file and return its contents to Claude:
 
 Claude identifies the syntax error and uses the `str_replace` command to fix it:
 
-```text Output
+```json Output
 {
   "id": "msg_01VwXyZAbCdEfGhIjKlMnO",
   "model": "claude-opus-5-5",
@@ -1461,7 +1461,7 @@ Your application should then make the edit and return the result:
 
 Finally, Claude provides a complete explanation of the fix:
 
-````text Output
+````json Output
 {
   "id": "msg_01IjKlMnOpQrStUvWxYzAb",
   "model": "claude-opus-5-5",
diff --git a/content/en/agents-and-tools/tool-use/tool-search-tool.md b/content/en/agents-and-tools/tool-use/tool-search-tool.md
index 5a05c62be2..862505f1aa 100644
--- a/content/en/agents-and-tools/tool-use/tool-search-tool.md
+++ b/content/en/agents-and-tools/tool-use/tool-search-tool.md
@@ -604,7 +604,7 @@ Internally, the API excludes deferred tools from the system-prompt prefix. When
 
 When Claude uses the tool search tool, the response includes the following block types:
 
-```text JSON
+```json JSON
 {
   "role": "assistant",
   "content": [
@@ -693,7 +693,7 @@ These errors prevent the API from processing the request:
 
 **All tools deferred:**
 
-```text
+```json
 {
   "type": "error",
   "error": {
@@ -705,7 +705,7 @@ These errors prevent the API from processing the request:
 
 **Missing tool definition:**
 
-```text wrap
+```json
 {
   "type": "error",
   "error": {
@@ -719,7 +719,7 @@ These errors prevent the API from processing the request:
 
 When a tool search operation fails during execution, the API returns a 200 response with the error in the body:
 
-```text JSON
+```json JSON
 {
   "type": "tool_search_tool_result",
   "tool_use_id": "srvtoolu_01ABC123",
@@ -793,7 +793,7 @@ A tool with `defer_loading: true` can't also carry `cache_control`: the API retu
 
 With streaming enabled, you'll receive tool search events as part of the stream:
 
-```text
+```sse
 event: content_block_start
 data: {"type": "content_block_start", "index": 1, "content_block": {"type": "server_tool_use", "id": "srvtoolu_xyz789", "name": "tool_search_tool_regex"}}
 
diff --git a/content/en/agents-and-tools/tool-use/web-fetch-tool.md b/content/en/agents-and-tools/tool-use/web-fetch-tool.md
index 537f2c8f01..1025b90e22 100644
--- a/content/en/agents-and-tools/tool-use/web-fetch-tool.md
+++ b/content/en/agents-and-tools/tool-use/web-fetch-tool.md
@@ -426,7 +426,7 @@ The web fetch tool supports the following parameters:
   "type": "web_fetch_20250910",
   "name": "web_fetch",
 
-  // Optional: Limit the number of fetches per request
+  // Optional: Limit the number of fetches for each request
   "max_uses": 10,
 
   // Optional: Only fetch from these domains
@@ -524,7 +524,7 @@ Unlike web search, where citations are always enabled, citations are optional fo
 
 Here's an example response structure:
 
-```text Output
+```json Output
 {
   "role": "assistant",
   "content": [
@@ -608,7 +608,7 @@ Fetch results include:
 
 For PDF documents, content is returned as base64-encoded data:
 
-```text Output wrap
+```json Output
 {
   "type": "web_fetch_tool_result",
   "tool_use_id": "srvtoolu_02",
@@ -633,7 +633,7 @@ For PDF documents, content is returned as base64-encoded data:
 
 When the web fetch tool encounters an error, the Claude API returns a 200 (success) response with the error represented in the response body. Claude receives the error result and continues the turn. For example:
 
-```text Output wrap
+```json Output
 {
   "type": "web_fetch_tool_result",
   "tool_use_id": "srvtoolu_a93jad",
@@ -962,7 +962,7 @@ To cache tool definitions across turns, see [Tool use with prompt caching](https
 
 With streaming enabled, fetch events are part of the stream with a pause during content retrieval:
 
-```text Output
+```sse Output
 event: message_start
 data: {"type": "message_start", "message": {"id": "msg_abc123", "type": "message"}}
 
@@ -995,7 +995,7 @@ You can include the web fetch tool in the [Messages Batches API](https://platfor
 
 Web fetch usage has **no additional charges** beyond standard token costs:
 
-```text wrap
+```json
 {
   "usage": {
     "input_tokens": 25039,
diff --git a/content/en/agents-and-tools/tool-use/web-search-tool.md b/content/en/agents-and-tools/tool-use/web-search-tool.md
index 779789ec3f..a3e078aa97 100644
--- a/content/en/agents-and-tools/tool-use/web-search-tool.md
+++ b/content/en/agents-and-tools/tool-use/web-search-tool.md
@@ -415,7 +415,7 @@ The web search tool supports the following parameters:
   "type": "web_search_20250305",
   "name": "web_search",
 
-  // Optional: Limit the number of searches per request
+  // Optional: Limit the number of searches for each request
   "max_uses": 5,
 
   // Optional: Only include results from these domains.
@@ -488,7 +488,7 @@ The `response_inclusion` parameter controls how search result blocks appear in t
 
 Here's an example response structure:
 
-```text Output
+```json Output
 {
   "role": "assistant",
   "content": [
@@ -583,7 +583,7 @@ The web search citation fields `cited_text`, `title`, and `url` do not count tow
 
 When the web search tool encounters an error (such as hitting rate limits), the Claude API still returns a 200 (success) response. The error is represented within the response body using the following structure:
 
-```text Output wrap
+```json Output
 {
   "type": "web_search_tool_result",
   "tool_use_id": "srvtoolu_a93jad",
@@ -621,7 +621,7 @@ To cache tool definitions across turns, see [Tool use with prompt caching](https
 
 With streaming enabled, you'll receive search events as part of the stream. There is a pause while the search runs:
 
-```text Output
+```sse Output
 event: message_start
 data: {"type": "message_start", "message": {"id": "msg_abc123", "type": "message"}}
 
@@ -656,7 +656,7 @@ To protect shared capacity, the Batches API throttles web search requests for ea
 
 Web search usage is charged in addition to token usage:
 
-```text wrap
+```json
 {
   "usage": {
     "input_tokens": 105,
diff --git a/content/en/api/beta-headers.md b/content/en/api/beta-headers.md
index 0abc1fa8b5..c4addac7d1 100644
--- a/content/en/api/beta-headers.md
+++ b/content/en/api/beta-headers.md
@@ -209,7 +209,7 @@ Beta feature names typically follow the pattern `feature-name-YYYY-MM-DD`, where
 
 If you use an invalid beta name, or a beta your organization doesn't have access to, you'll receive a `400` error response:
 
-```text Output
+```json Output
 {
   "type": "error",
   "error": {
diff --git a/content/en/api/claude-code/routines-fire.md b/content/en/api/claude-code/routines-fire.md
index 0bc9dc82aa..489c8dabba 100644
--- a/content/en/api/claude-code/routines-fire.md
+++ b/content/en/api/claude-code/routines-fire.md
@@ -95,7 +95,7 @@ The body is optional. Unknown fields in the body are ignored.
 
 A successful request returns `200 OK` with the new session details:
 
-```text
+```json
 {
   "type": "routine_fire",
   "claude_code_session_id": "session_01HJKLMNOPQRSTUVWXYZ",
@@ -113,7 +113,7 @@ A successful request returns `200 OK` with the new session details:
 
 Errors use the standard Anthropic [error envelope](https://platform.claude.com/docs/en/api/errors):
 
-```text wrap
+```json
 {
   "type": "error",
   "error": {
diff --git a/content/en/api/errors.md b/content/en/api/errors.md
index f8cec9875e..00c041cba4 100644
--- a/content/en/api/errors.md
+++ b/content/en/api/errors.md
@@ -57,7 +57,7 @@ If you exceed these limits, you'll receive a 413 `request_too_large` error. On t
 
 The API always returns errors as JSON, with a top-level `error` object that always includes a `type` and `message` value. The response also includes a `request_id` field for easier tracking and debugging. For example:
 
-```text JSON wrap
+```json JSON
 {
   "type": "error",
   "error": {
@@ -430,7 +430,7 @@ See [Get the final message without handling events](https://platform.claude.com/
 
 Claude 4.6 and later models and [Claude Mythos Preview](https://anthropic.com/glasswing) do not support prefilling assistant messages. Sending a request with a prefilled last assistant message to any of these models returns a 400 `invalid_request_error`:
 
-```text
+```json
 {
   "type": "error",
   "error": {
@@ -450,7 +450,7 @@ If the most recent assistant message contains `thinking` or `redacted_thinking`
 `thinking` or `redacted_thinking` blocks in the latest assistant message cannot be modified. These blocks must remain as they were in the original response.
 ```
 
-With tool use, every `thinking` and `redacted_thinking` block from the assistant turn must be passed back exactly as received, including blocks whose `thinking` field is empty. Pass thinking blocks back unchanged, and if your application filters content blocks by type before resending, include both `thinking` and `redacted_thinking`. See the [fix for modified thinking blocks](https://platform.claude.com/docs/en/build-with-claude/thinking-troubleshooting#error-thinking-blocks-modified) in Troubleshooting thinking, and also [Preserving thinking blocks](https://platform.claude.com/docs/en/build-with-claude/thinking#preserving-thinking-blocks) and [Preserved thinking](https://platform.claude.com/docs/en/build-with-claude/thinking#preserved-thinking).
+With tool use, pass back every `thinking` and `redacted_thinking` block from the assistant turn exactly as received, including blocks whose `thinking` field is empty. If your application filters content blocks by type before resending, include both `thinking` and `redacted_thinking`. See the [fix for modified thinking blocks](https://platform.claude.com/docs/en/build-with-claude/thinking-troubleshooting#error-thinking-blocks-modified) in Troubleshooting thinking, and also [Preserving thinking blocks](https://platform.claude.com/docs/en/build-with-claude/thinking#preserving-thinking-blocks) and [Preserved thinking](https://platform.claude.com/docs/en/build-with-claude/thinking#preserved-thinking).
 
 ### Extended thinking not supported
 
diff --git a/content/en/api/opentelemetry/spans.md b/content/en/api/opentelemetry/spans.md
index 74d3120bab..a27849f690 100644
--- a/content/en/api/opentelemetry/spans.md
+++ b/content/en/api/opentelemetry/spans.md
@@ -439,15 +439,15 @@ A span covers its whole request, retries included, and has each attribute of the
 
 Every SDK span for a request, including [`anthropic.messages.create`](https://platform.claude.com/docs/en/api/opentelemetry/spans#anthropic-messages-create), [`anthropic.messages.count_tokens`](https://platform.claude.com/docs/en/api/opentelemetry/spans#anthropic-messages-count-tokens), and [`anthropic.messages.batches.<method>`](https://platform.claude.com/docs/en/api/opentelemetry/spans#anthropic-messages-batches-method), has the following attributes:
 
-| Attribute                   | Type     | Description                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| --------------------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `gen_ai.conversation.id`    | `string` | The conversation ID passed with the [`conversation_id` (typescript, java, php: `conversationId`; csharp: `ConversationId`; go: `option.WithOpenTelemetryConversationID()`) option](https://platform.claude.com/docs/en/manage-claude/opentelemetry/sdk#configure-the-sdk). Without one, the session thread ID on requests to one session thread, and on the request in which the session tool runner sends a tool's result. Absent on other requests. |
-| `anthropic.<resource>.id`   | `string` | One attribute for each ID in the request's path and one for the ID of an object that the method creates. The name comes from the path, in the singular, for example `anthropic.session.id` or `anthropic.session.thread.id`.                                                                                                                                                                                                                          |
-| `gen_ai.agent.id`           | `string` | The agent ID, on the agent methods.                                                                                                                                                                                                                                                                                                                                                                                                                   |
-| `gen_ai.memory.store.id`    | `string` | The memory store ID, on the memory store methods.                                                                                                                                                                                                                                                                                                                                                                                                     |
-| `gen_ai.memory.record.id`   | `string` | The memory ID, on the memory methods.                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| `http.request.resend_count` | `int`    | The number of times that the SDK resent the request, for any reason, such as a retry. Absent when the SDK didn't resend it.                                                                                                                                                                                                                                                                                                                           |
-| `error.type`                | `string` | A failed call's [error type](https://platform.claude.com/docs/en/api/errors#http-errors), for example `rate_limit_error`. The HTTP status code, for example `502`, when the error response doesn't have an error type. `connection_error`, `client_timeout_error`, or `client_error` when the call failed in the SDK. `api_error` when the server ended a stream early.                                                                               |
-| `server.address`            | `string` | The host of the client's base URL, `api.anthropic.com` by default. On a cloud platform's client, that platform's host.                                                                                                                                                                                                                                                                                                                                |
-| `url.query`                 | `string` | The URL's query string, with only the query parameters that the endpoint defines. Absent when there are none. In metadata-only mode, absent when the query has a sensitive parameter, such as `email`.                                                                                                                                                                                                                                                |
-| `url.full`                  | `string` | The URL, made of `url.scheme`, `server.address`, the port when the base URL has one, `url.path`, and `url.query`. In metadata-only mode, absent whenever that mode leaves out `url.query`.                                                                                                                                                                                                                                                            |
+| Attribute                   | Type     | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| --------------------------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `gen_ai.conversation.id`    | `string` | The conversation ID passed with the [`conversation_id` (typescript, java, php: `conversationId`; csharp: `ConversationId`; go: `option.WithOpenTelemetryConversationID()`) option](https://platform.claude.com/docs/en/manage-claude/opentelemetry/sdk#configure-the-sdk). Without one, the ID of the session thread that the span belongs to, as in [Session attributes](https://platform.claude.com/docs/en/api/opentelemetry/spans#session-attributes), and absent on spans with no thread. |
+| `anthropic.<resource>.id`   | `string` | One attribute for each ID in the request's path and one for the ID of an object that the method creates. The name comes from the path, in the singular, for example `anthropic.session.id` or `anthropic.session.thread.id`.                                                                                                                                                                                                                                                                   |
+| `gen_ai.agent.id`           | `string` | The agent ID, on the agent methods.                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| `gen_ai.memory.store.id`    | `string` | The memory store ID, on the memory store methods.                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `gen_ai.memory.record.id`   | `string` | The memory ID, on the memory methods.                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `http.request.resend_count` | `int`    | The number of times that the SDK resent the request, for any reason, such as a retry. Absent when the SDK didn't resend it.                                                                                                                                                                                                                                                                                                                                                                    |
+| `error.type`                | `string` | A failed call's [error type](https://platform.claude.com/docs/en/api/errors#http-errors), for example `rate_limit_error`. The HTTP status code, for example `502`, when the error response doesn't have an error type. `connection_error`, `client_timeout_error`, or `client_error` when the call failed in the SDK. `api_error` when the server ended a stream early.                                                                                                                        |
+| `server.address`            | `string` | The host of the client's base URL, `api.anthropic.com` by default. On a cloud platform's client, that platform's host.                                                                                                                                                                                                                                                                                                                                                                         |
+| `url.query`                 | `string` | The URL's query string, with only the query parameters that the endpoint defines. Absent when there are none. In metadata-only mode, absent when the query has a sensitive parameter, such as `email`.                                                                                                                                                                                                                                                                                         |
+| `url.full`                  | `string` | The URL, made of `url.scheme`, `server.address`, the port when the base URL has one, `url.path`, and `url.query`. In metadata-only mode, absent whenever that mode leaves out `url.query`.                                                                                                                                                                                                                                                                                                     |
diff --git a/content/en/api/rate-limits.md b/content/en/api/rate-limits.md
index 952416a8f2..1ebbff4ab3 100644
--- a/content/en/api/rate-limits.md
+++ b/content/en/api/rate-limits.md
@@ -46,7 +46,7 @@ Organizations on the Custom tier have no monthly spend cap; limits are arranged
 
 Once you reach your tier's spend cap, API usage pauses until 00:00 UTC on the first day of the next month, unless you request a higher limit sooner. While usage is paused, API requests return HTTP 429:
 
-```text
+```json
 {
   "type": "error",
   "error": {
diff --git a/content/en/api/service-tiers.md b/content/en/api/service-tiers.md
index 2bfb766185..2e0995a652 100644
--- a/content/en/api/service-tiers.md
+++ b/content/en/api/service-tiers.md
@@ -187,7 +187,7 @@ The `service_tier` parameter accepts the following values:
 
 The response `usage` object also includes the service tier assigned to the request:
 
-```text wrap
+```json
 {
   "usage": {
     "input_tokens": 410,
diff --git a/content/en/build-with-claude/batch-processing.md b/content/en/build-with-claude/batch-processing.md
index 191e3d3b05..90060e388c 100644
--- a/content/en/build-with-claude/batch-processing.md
+++ b/content/en/build-with-claude/batch-processing.md
@@ -421,7 +421,7 @@ In this example, two separate requests are batched together for asynchronous pro
 
 When a batch is first created, the response has a processing status of `in_progress`.
 
-```text Output wrap
+```json Output
 {
   "id": "msgbatch_01HkcTjaV5uDC8jWR4ZsDV8d",
   "type": "message_batch",
@@ -918,7 +918,7 @@ Results of the batch are available for download at the `results_url` property on
 
 The results are in `.jsonl` format, where each line is a valid JSON object representing the result of a single request in the Message Batch. For each streamed result, you can do something different depending on its `custom_id` and result type. Here is an example set of results:
 
-```text .jsonl file
+```jsonl .jsonl file
 {"custom_id":"my-second-request","result":{"type":"succeeded","message":{"id":"msg_014VwiXbi91y3JMjcpyGBHX5","type":"message","role":"assistant","model":"claude-opus-5-5","content":[{"type":"text","text":"Hello again! It's nice to see you. How can I assist you today? Is there anything specific you'd like to chat about or any questions you have?"}],"stop_reason":"end_turn","stop_sequence":null,"usage":{"input_tokens":11,"output_tokens":36}}}}
 {"custom_id":"my-first-request","result":{"type":"succeeded","message":{"id":"msg_01FqfsLoHwgeFbguDgpz48m7","type":"message","role":"assistant","model":"claude-opus-5-5","content":[{"type":"text","text":"Hello! How can I assist you today? Feel free to ask me any questions or let me know if there's anything you'd like to chat about."}],"stop_reason":"end_turn","stop_sequence":null,"usage":{"input_tokens":10,"output_tokens":34}}}}
 ```
@@ -1017,7 +1017,7 @@ You can cancel a Message Batch that is currently processing using the [cancel en
 
 The response shows the batch in a `canceling` state:
 
-```text Output wrap
+```json Output
 {
   "id": "msgbatch_013Zva2CMHLNnXjNJJKqJ2EF",
   "type": "message_batch",
diff --git a/content/en/build-with-claude/cache-diagnostics.md b/content/en/build-with-claude/cache-diagnostics.md
index dc0c404426..2c1895bb5e 100644
--- a/content/en/build-with-claude/cache-diagnostics.md
+++ b/content/en/build-with-claude/cache-diagnostics.md
@@ -973,7 +973,7 @@ The `diagnostics` field on the response `Message` has three possible values:
 
 When `cache_miss_reason` is non-null, it looks like this:
 
-```text wrap
+```json
 {
   "id": "msg_01Xyz...",
   "type": "message",
diff --git a/content/en/build-with-claude/citations.md b/content/en/build-with-claude/citations.md
index 8926f4c583..2e5213363f 100644
--- a/content/en/build-with-claude/citations.md
+++ b/content/en/build-with-claude/citations.md
@@ -982,7 +982,7 @@ Plain text documents are automatically chunked into sentences. You can provide t
 </Tabs>
 
 <Accordion title="Example plain text citation">
-  ```text
+  ```json
   {
     "type": "char_location",
     "cited_text": "The exact text being cited", // not counted toward output tokens
@@ -1810,7 +1810,7 @@ PDF documents can be provided as base64-encoded data, as a URL, or by `file_id`.
 </Tabs>
 
 <Accordion title="Example PDF citation">
-  ```text
+  ```json
   {
     "type": "page_location",
     "cited_text": "The exact text being cited", // not counted toward output tokens
@@ -2137,7 +2137,7 @@ Custom content documents give you control over citation granularity. No addition
 </CodeGroup>
 
 <Accordion title="Example citation">
-  ```text
+  ```json
   {
     "type": "content_block_location",
     "cited_text": "The exact text being cited", // not counted toward output tokens
@@ -2155,7 +2155,7 @@ Custom content documents give you control over citation granularity. No addition
 
 When citations are enabled, responses include multiple text blocks with citations:
 
-```text wrap
+```json
 {
   "content": [
     { "type": "text", "text": "According to the document, " },
@@ -2234,7 +2234,7 @@ For streaming responses, citations arrive as a `citations_delta` delta type insi
 
 <AccordionGroup>
   <Accordion title="Example streaming events">
-    ```text
+    ```sse
     event: message_start
     data: {"type": "message_start", ...}
 
diff --git a/content/en/build-with-claude/claude-models-on-google-cloud/anthropic-managed.md b/content/en/build-with-claude/claude-models-on-google-cloud/anthropic-managed.md
index 2b1bee8d01..f449302713 100644
--- a/content/en/build-with-claude/claude-models-on-google-cloud/anthropic-managed.md
+++ b/content/en/build-with-claude/claude-models-on-google-cloud/anthropic-managed.md
@@ -504,9 +504,9 @@ The following features work on Claude Models on Google Cloud (Anthropic managed)
 
 * **Fast mode:** [Fast mode](https://platform.claude.com/docs/en/build-with-claude/fast-mode) for Claude Opus 5.5.
 
-- **Beta features:** If a beta is limited to selected organizations on the Claude API, the Anthropic organization that setup creates needs the same access.
+* **Beta features:** If a beta is limited to selected organizations on the Claude API, the Anthropic organization that setup creates needs the same access.
 
-- **Tools:** [Tool use](https://platform.claude.com/docs/en/agents-and-tools/tool-use/overview), including:
+* **Tools:** [Tool use](https://platform.claude.com/docs/en/agents-and-tools/tool-use/overview), including:
 
   * Web search
   * Web fetch
@@ -515,9 +515,9 @@ The following features work on Claude Models on Google Cloud (Anthropic managed)
   * The advisor tool
   * The MCP connector
 
-- **Skills and files:** [Agent Skills](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/overview) and the [Files API](https://platform.claude.com/docs/en/build-with-claude/files).
+* **Skills and files:** [Agent Skills](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/overview) and the [Files API](https://platform.claude.com/docs/en/build-with-claude/files).
 
-- **Model capabilities:**
+* **Model capabilities:**
 
   * [Prompt caching](https://platform.claude.com/docs/en/build-with-claude/prompt-caching)
   * [Extended thinking](https://platform.claude.com/docs/en/build-with-claude/thinking)
@@ -526,11 +526,11 @@ The following features work on Claude Models on Google Cloud (Anthropic managed)
   * [Structured outputs](https://platform.claude.com/docs/en/build-with-claude/structured-outputs)
   * [Token counting](https://platform.claude.com/docs/en/build-with-claude/token-counting)
 
-- **Batches and models:** The [Message Batches API](https://platform.claude.com/docs/en/build-with-claude/batch-processing) and the Models API.
+* **Batches and models:** The [Message Batches API](https://platform.claude.com/docs/en/build-with-claude/batch-processing) and the Models API.
 
 To turn the [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api) on or off for the Anthropic organization that setup creates, [open the Claude Console](https://platform.claude.com/docs/en/build-with-claude/claude-models-on-google-cloud/anthropic-managed#using-the-claude-console), go to **Settings > Compliance**, and use the **Compliance API** toggle.
 
-Customer-managed encryption keys (CMEK) are available with Google Cloud KMS keys. To activate CMEK for the Anthropic organization that setup creates, see [Customer-managed encryption keys](https://platform.claude.com/docs/en/manage-claude/cmek). To set up a key, follow [Configure Google Cloud KMS for CMEK](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms). Then register, verify, and attach the key in the [Claude Console](https://platform.claude.com/docs/en/build-with-claude/claude-models-on-google-cloud/anthropic-managed#using-the-claude-console), as the setup page's **Claude Console** tab describes.
+Customer-managed encryption keys (CMEK) are available with Google Cloud KMS keys. To activate CMEK for the Anthropic organization that setup creates, see [Who can use CMEK](https://platform.claude.com/docs/en/manage-claude/cmek#availability). To set up a key, follow [Set up CMEK with Google Cloud KMS](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms). Then register, verify, and attach the key in the [Claude Console](https://platform.claude.com/docs/en/build-with-claude/claude-models-on-google-cloud/anthropic-managed#using-the-claude-console), as the setup page's **Claude Platform** tab describes.
 
 ### Claude Managed Agents
 
diff --git a/content/en/build-with-claude/compaction-on-demand.md b/content/en/build-with-claude/compaction-on-demand.md
index b419faa992..5f84817b04 100644
--- a/content/en/build-with-claude/compaction-on-demand.md
+++ b/content/en/build-with-claude/compaction-on-demand.md
@@ -280,7 +280,7 @@ Send the conversation as it stands with `"compaction": {"type": "summarize"}`. T
   ```
 </CodeGroup>
 
-```text Response
+```json Response
 {
   "id": "msg_013Zva2CMHLNnXjNJJKqJ2EF",
   "type": "message",
diff --git a/content/en/build-with-claude/compaction-threshold.md b/content/en/build-with-claude/compaction-threshold.md
index 1c948e0f02..645a70dd40 100644
--- a/content/en/build-with-claude/compaction-threshold.md
+++ b/content/en/build-with-claude/compaction-threshold.md
@@ -1365,7 +1365,7 @@ When compaction is triggered, the API returns a `compaction` block at the start
 
 A long-running conversation might result in multiple compactions. The last compaction block reflects the final state of the prompt, replacing content prior to it with the generated summary.
 
-```text Output
+```json Output
 {
   "content": [
     {
@@ -2256,7 +2256,7 @@ This keeps long system prompts cached across multiple compaction events througho
 
 Compaction requires an additional sampling step, which contributes to rate limits and billing. The API returns detailed usage information in the response:
 
-```text Output wrap
+```json Output
 {
   "usage": {
     "input_tokens": 23000,
diff --git a/content/en/build-with-claude/context-editing.md b/content/en/build-with-claude/context-editing.md
index 81a7c8e169..023aea8972 100644
--- a/content/en/build-with-claude/context-editing.md
+++ b/content/en/build-with-claude/context-editing.md
@@ -1334,7 +1334,7 @@ Keep all thinking blocks (maximizes cache hits):
 You can use both thinking block clearing and tool result clearing together:
 
 <Note>
-  When using multiple strategies, the `clear_thinking_20251015` strategy must be listed first in the `edits` array.
+  When using multiple strategies, you must list the `clear_thinking_20251015` strategy first in the `edits` array.
 </Note>
 
 <CodeGroup>
@@ -1735,7 +1735,7 @@ You can use both thinking block clearing and tool result clearing together:
 
 You can see which context edits were applied to your request using the `context_management` response field, along with helpful statistics about the content and input tokens cleared.
 
-```text Output wrap
+```json Output
 {
   "id": "msg_013Zva2CMHLNnXjNJJKqJ2EF",
   "type": "message",
@@ -1767,7 +1767,7 @@ You can see which context edits were applied to your request using the `context_
 
 For streaming responses, the context edits are included in the final `message_delta` event:
 
-```text Streaming Response wrap
+```json Streaming Response
 {
   "type": "message_delta",
   "delta": {
@@ -2069,7 +2069,7 @@ The [token counting](https://platform.claude.com/docs/en/build-with-claude/token
   ```
 </CodeGroup>
 
-```text Output wrap
+```json Output
 {
   "input_tokens": 25000,
   "context_management": {
@@ -2798,7 +2798,7 @@ When using server-side tools, the SDK might incorrectly calculate token usage, c
 
 For example, after a web search operation, the API response might show:
 
-```text Output wrap
+```json Output
 {
   "usage": {
     "input_tokens": 63000,
diff --git a/content/en/build-with-claude/effort.md b/content/en/build-with-claude/effort.md
index cc7ab94e88..f8e9560558 100644
--- a/content/en/build-with-claude/effort.md
+++ b/content/en/build-with-claude/effort.md
@@ -268,7 +268,7 @@ Claude Opus 5.5 supports all five effort levels, and `medium` is the default (Cl
 
 ### Recommended effort levels for Claude Opus 5
 
-Claude Opus 5 supports all five effort levels. **Start with `high`, the default**, and adjust based on your evals: step up to `xhigh` for demanding coding and agentic work, or to `max` when a task justifies unconstrained token spending, and use `low` and `medium` liberally as your primary control for token cost and response time wherever your evals show quality holds. If you carried effort settings over from an earlier model, run a fresh effort sweep on your evals rather than reusing them.
+Claude Opus 5 supports all five effort levels. **Start with `high`, the default**, and adjust based on your evals: step up to `xhigh` for demanding coding and agentic work, or to `max` when a task justifies unconstrained token spending. Use `low` and `medium` liberally as your primary control for token cost and response time wherever your evals show quality holds. If you carried effort settings over from an earlier model, run a fresh effort sweep on your evals rather than reusing them.
 
 Effort controls thinking volume, not visible response length: on Claude Opus 5, changing effort does not reliably shorten responses, so [prompt for length](https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/prompting-claude-opus-5#response-length-and-verbosity) instead.
 
diff --git a/content/en/build-with-claude/embeddings.md b/content/en/build-with-claude/embeddings.md
index c3ff78443e..68e368e034 100644
--- a/content/en/build-with-claude/embeddings.md
+++ b/content/en/build-with-claude/embeddings.md
@@ -142,7 +142,7 @@ curl https://ai.mongodb.com/v1/embeddings \
 
 The response is a JSON object containing the embeddings and the token usage:
 
-```text wrap
+```json
 {
   "object": "list",
   "data": [
diff --git a/content/en/build-with-claude/fast-mode.md b/content/en/build-with-claude/fast-mode.md
index ce368edb42..d54ca225e7 100644
--- a/content/en/build-with-claude/fast-mode.md
+++ b/content/en/build-with-claude/fast-mode.md
@@ -375,7 +375,7 @@ The response `usage` object includes a `speed` field that indicates which speed
   ```
 </CodeGroup>
 
-```text Output wrap
+```json Output
 {
   "id": "msg_01XFDUDYJgAACzvnptvVoYEL",
   "type": "message",
diff --git a/content/en/build-with-claude/files.md b/content/en/build-with-claude/files.md
index f6dd42dbbb..5135745360 100644
--- a/content/en/build-with-claude/files.md
+++ b/content/en/build-with-claude/files.md
@@ -143,7 +143,7 @@ Upload a file to reference in future API calls:
 
 The response from uploading a file includes:
 
-```text Response wrap
+```json Response
 {
   "id": "file_011CNha8iCJcU1wXNR6q4V8w",
   "type": "file",
@@ -997,7 +997,7 @@ Common errors when using the Files API include:
 * **File too large (413):** The file exceeds the 500 MB limit.
 * **Storage limit exceeded (400):** Your organization has reached the 1 TB storage limit.
 
-```text Output wrap
+```json Output
 {
   "type": "error",
   "error": {
diff --git a/content/en/build-with-claude/handling-stop-reasons.md b/content/en/build-with-claude/handling-stop-reasons.md
index 1530d2cf6f..15ee4b69de 100644
--- a/content/en/build-with-claude/handling-stop-reasons.md
+++ b/content/en/build-with-claude/handling-stop-reasons.md
@@ -24,7 +24,7 @@ For the full response schema, see the [Messages API reference](https://platform.
 
 The `stop_reason` field is part of every successful Messages API response. Unlike errors, which indicate failures in processing your request, `stop_reason` tells you why Claude completed its response generation.
 
-```text Example response wrap
+```json Example response
 {
   "id": "msg_01234",
   "type": "message",
@@ -1484,7 +1484,7 @@ A `tool_use` response can also contain a `server_tool_use` block whose `id` has
   With [programmatic tool calling](https://platform.claude.com/docs/en/agents-and-tools/tool-use/programmatic-tool-calling), the same response shape means something different. The client `tool_use` block comes from code that is running in the `code_execution` tool rather than from Claude directly, and its `caller` field names the `code_execution` block that called it. That code has already started: it is paused waiting for your `tool_result` blocks, and sending them resumes the execution instead of starting a deferred tool. The `code_execution` block's own result block arrives once the code completes, which can take more than one round of tool results. The follow-up user message itself is the same in both cases; with programmatic tool calling, also pass back the `id` from the response's `container` field, as that page shows.
 </Note>
 
-```text A mixed tool_use response wrap
+```json A mixed tool_use response
 {
   "stop_reason": "tool_use",
   "content": [
diff --git a/content/en/build-with-claude/mid-conversation-system-messages.md b/content/en/build-with-claude/mid-conversation-system-messages.md
index 5517cacdbb..bd9b86d7df 100644
--- a/content/en/build-with-claude/mid-conversation-system-messages.md
+++ b/content/en/build-with-claude/mid-conversation-system-messages.md
@@ -993,7 +993,7 @@ The following request keeps `get_weather` in `tools` and defines `db_query` afte
 
 The response's `content` includes a `tool_use` block for the new tool, for example:
 
-```text
+```json
 {
   "type": "tool_use",
   "id": "toolu_01A09q90qw90lq917835lq9",
diff --git a/content/en/build-with-claude/pdf-support.md b/content/en/build-with-claude/pdf-support.md
index 1be8c95e6a..f44034676e 100644
--- a/content/en/build-with-claude/pdf-support.md
+++ b/content/en/build-with-claude/pdf-support.md
@@ -85,7 +85,7 @@ If Claude isn't seeing images or charts in your PDFs when using the Converse API
 </Note>
 
 <Note>
-  Plain text files such as .txt, .csv, or .md can be used directly in document blocks: upload them to the Files API with MIME type `text/plain` and reference them by `file_id`. Binary formats such as .xlsx or .docx are not supported in document blocks and must be converted to text or PDF first. See [Working with other file formats](https://platform.claude.com/docs/en/build-with-claude/files#working-with-other-file-formats).
+  Plain text files such as .txt, .csv, or .md can be used directly in document blocks: upload them to the Files API with MIME type `text/plain` and reference them by `file_id`. Binary formats such as .xlsx or .docx are not supported in document blocks, so convert them to text or PDF first. See [Working with other file formats](https://platform.claude.com/docs/en/build-with-claude/files#working-with-other-file-formats).
 </Note>
 
 ## Process PDFs with Claude
@@ -349,7 +349,7 @@ The simplest approach is to reference a PDF directly from a URL:
 
 The response returns Claude's analysis as text blocks in `content`, with token consumption in `usage`:
 
-```text Output
+```json Output
 {
   "id": "msg_01Hfp8YuFjQ55VgWbpdHDehB",
   "type": "message",
diff --git a/content/en/build-with-claude/preserved-thinking.md b/content/en/build-with-claude/preserved-thinking.md
index 156bd45433..e08de69702 100644
--- a/content/en/build-with-claude/preserved-thinking.md
+++ b/content/en/build-with-claude/preserved-thinking.md
@@ -53,7 +53,7 @@ Keep sending the full history on every request, thinking blocks included, and le
 
 With the `thinking-binding-controls-2026-08-01` [beta header](https://platform.claude.com/docs/en/api/beta-headers), the response lists each dropped block in a top-level `input_transformations` array with `reason: "model_binding_mismatch"`:
 
-```text wrap
+```json
 {
   "input_transformations": [
     {
@@ -716,7 +716,7 @@ Neither turn drops a block because nothing earlier changed. Check that the first
 
 Log `input_transformations` on every turn of your own integration. When the API drops a block, the entry looks like the following:
 
-```text wrap
+```json
 {
   "input_transformations": [
     {
@@ -746,7 +746,7 @@ Two plain turns rarely show the problem. Run a session through each of the follo
 
 On an older account, you can also watch production traffic without opting into enforcement: send the beta header, leave `block_binding` out, and log `input_transformations`. Sending the header alone doesn't change what the model receives. Every thinking block that comes after the content you edited fails the check and gets its own `thinking_mismatch_allowed` entry, with the same `path` and `reason` fields as a `thinking_dropped` entry. Blocks before the edit still pass. An edit to `system` or `tools` comes before every block, so it fails every thinking block in the request. One entry looks like this:
 
-```text wrap
+```json
 {
   "input_transformations": [
     {
@@ -1475,7 +1475,7 @@ Pass the compacted history as `messages` and set `block_binding` on the `thinkin
 
 The response carries the new assistant turn as usual, plus one `input_transformations` entry for each dropped block. For the history in the diagram, that's the thinking on assistant turns 3 and 4:
 
-```text wrap
+```json
 {
   "input_transformations": [
     {
diff --git a/content/en/build-with-claude/prompt-caching.md b/content/en/build-with-claude/prompt-caching.md
index 71c90360a6..2f0eea1a92 100644
--- a/content/en/build-with-claude/prompt-caching.md
+++ b/content/en/build-with-claude/prompt-caching.md
@@ -821,7 +821,7 @@ To use the extended cache, include `ttl` in the `cache_control` definition like
 
 The response includes detailed cache information like the following:
 
-```text Output wrap
+```json Output
 {
   "usage": {
     "input_tokens": 2048,
@@ -1090,7 +1090,7 @@ Place the `cache_control` breakpoint on the last block that is shared with the f
 
 The API returns an empty `content` array:
 
-```text Output wrap
+```json Output
 {
   "id": "msg_01XFDUDYJgAACzvnptvVoYEL",
   "type": "message",
diff --git a/content/en/build-with-claude/prompt-engineering/prompting-claude-opus-5-5.md b/content/en/build-with-claude/prompt-engineering/prompting-claude-opus-5-5.md
index 53583b0098..3386044c0f 100644
--- a/content/en/build-with-claude/prompt-engineering/prompting-claude-opus-5-5.md
+++ b/content/en/build-with-claude/prompt-engineering/prompting-claude-opus-5-5.md
@@ -50,7 +50,7 @@ Changing the top-level `effort` value between requests invalidates the prompt ca
 Claude Opus 5 accepts `thinking: {"type": "disabled"}` at `high` effort or below; Claude Opus 5.5 doesn't, and the [migration guide](https://platform.claude.com/docs/en/models/opus-5-5/migration-guide#migrating-from-claude-opus-5) covers the request change. If your Claude Opus 5 integration ran with thinking disabled, four changes go with it:
 
 * **Start at `low` effort and measure.** At `low` the model keeps its thinking short. How often it skips thinking altogether depends on your prompts, so measure latency and quality on your own traffic and move to `medium` if quality drops. If time to first token still matters after that, a system prompt line such as "Answer directly without deliberating." can reduce thinking further; measure quality when you add it, because less thinking can lower it.
-* **Remove instructions that stood in for thinking.** If your prompt asked the model to write its reasoning in the response as a substitute for thinking, remove that instruction and read the reasoning from [summarized thinking](https://platform.claude.com/docs/en/build-with-claude/thinking#summarized-thinking) blocks instead (`display: "summarized"`); a prompt that pushes the model to reproduce its reasoning in the response text might be declined with the `reasoning_extraction` [refusal category](https://platform.claude.com/docs/en/build-with-claude/refusals-and-fallback#refusal-response).
+* **Remove instructions that stood in for thinking.** If your prompt asked the model to write its reasoning in the response as a substitute for thinking, remove that instruction. Read the reasoning from [summarized thinking](https://platform.claude.com/docs/en/build-with-claude/thinking#summarized-thinking) blocks instead (`display: "summarized"`). A prompt that pushes the model to reproduce its reasoning in the response text might be declined with the `reasoning_extraction` [refusal category](https://platform.claude.com/docs/en/build-with-claude/refusals-and-fallback#refusal-response).
 * **Re-test the thinking-disabled mitigations.** [Running with thinking disabled](https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/prompting-claude-opus-5#running-with-thinking-disabled) recommends a combined instruction (permission to speak before a tool call, what to do when no tool fits, no internal tags) and removing any rule that tells the model not to think. Both address artifacts that appear on Claude Opus 5 only when thinking is disabled. With thinking always on, check whether you still need the instruction, and remove the no-thinking rule either way.
 * **Read the response by block type.** Check each block's type instead of assuming the first content block is text: a response might or might not start with a `thinking` block, whose `thinking` field is empty under the default `display: "omitted"`.
 
@@ -68,7 +68,7 @@ If something the model started is still running, such as a background command or
 
 A system prompt addition can also make these early stops less frequent. Claude Opus 5.5 is responsive to instructions that name the specific kinds of early stop you want it to avoid, such as ending the turn with a summary that announces the next step instead of taking it. It also helps to name the stops you do want, for example when no work can advance without the user's input.
 
-The following paragraph is one example of such an addition, written for agents that run fully unattended, where you want the model to keep working rather than stop to report. Treat it as a starting point: you might need to adapt it for your own application. Add it at the end of your system prompt from the first request of the session: adding it partway through changes the `system` prompt and invalidates the conversation's earlier thinking blocks (see [Add instructions with a mid-conversation system message](https://platform.claude.com/docs/en/build-with-claude/preserved-thinking#new-instructions)). Because it tells the model to put status notes in the same message as its next tool call, those notes arrive between tool calls as progress updates, whose text comes back empty at the default `thinking.display`; set `display: "updates"` to receive a summary of each (see [User-facing progress updates](https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/prompting-claude-opus-5-5#user-facing-progress-updates)). With this addition the model carries on where it would otherwise have stopped to check in, so keep your own confirmation step for risky or irreversible actions, and leave the addition out of human-in-the-loop applications, where someone is there to answer. Expect somewhat more tool calls and output tokens per task.
+The following paragraph is one example of such an addition, written for agents that run fully unattended, where you want the model to keep working rather than stop to report. Treat it as a starting point: you might need to adapt it for your own application. Add it at the end of your system prompt from the first request of the session: adding it partway through changes the `system` prompt and invalidates the conversation's earlier thinking blocks (see [Add instructions with a mid-conversation system message](https://platform.claude.com/docs/en/build-with-claude/preserved-thinking#new-instructions)). Because it tells the model to put status notes in the same message as its next tool call, those notes arrive between tool calls as progress updates. The text of these updates comes back empty at the default `thinking.display`. Set `display: "updates"` to receive a summary of each (see [User-facing progress updates](https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/prompting-claude-opus-5-5#user-facing-progress-updates)). With this addition the model carries on where it would otherwise have stopped to check in, so keep your own confirmation step for risky or irreversible actions, and leave the addition out of human-in-the-loop applications, where someone is there to answer. Expect somewhat more tool calls and output tokens per task.
 
 ```text wrap
 A standing instruction from the user, the person you are working for. It is about how your turns end. A message with no tool call in it ends your turn, and the work stops there until you are asked to continue. The user has seen you end turns in four ways while work they asked for was still owed, and does not want any of them. One: a long summary of what was done that closes by announcing the next step and has no tool call, so the next thing never starts. Two: an offer to carry on with something unless the user would prefer otherwise, which stops to wait for an answer the user was not going to give. Three: a list of decisions for the user when, by your own account, none of them blocks the rest of the work. Four: deciding that this is a good place to report, because the turn has been long or a milestone is done. Status notes are welcome, and so are your recommendations on open decisions, but put them in the same message as your next tool call and carry on with whatever does not depend on the user's answer. If you notice yourself inviting the user to redirect you or offering to wait, delete it and do the next thing. The stops the user does want are the ones where nothing can move without them, or where the thing blocking you is deliberately protected from you. This does not override the need for confirmation on risky or destructive actions.
@@ -88,7 +88,7 @@ A classifier decline arrives as a normal response with `stop_reason: "refusal"`
 
 Between tool calls, Claude Opus 5.5 writes short user-facing progress updates: what it just found and what it's doing next. Four levers control what your users see.
 
-First, check that your client receives them: on Claude Opus 5.5 these notes come back as [progress-update `thinking` blocks](https://platform.claude.com/docs/en/build-with-claude/thinking#progress-updates) rather than `text` blocks, and their text is empty at the default `thinking.display`, so a client that renders only `text` blocks can look silent during a long agentic turn. Set `display: "updates"` (beta, `thinking-display-updates-2026-08-18` header) to receive a short summary of each note; see [Text between tool calls is returned in thinking blocks](https://platform.claude.com/docs/en/models/opus-5-5/migration-guide#text-between-tool-calls) for how to render them.
+First, check that your client receives them. On Claude Opus 5.5 these notes come back as [progress-update `thinking` blocks](https://platform.claude.com/docs/en/build-with-claude/thinking#progress-updates) rather than `text` blocks, and their text is empty at the default `thinking.display`. As a result, a client that renders only `text` blocks can look silent during a long agentic turn. Set `display: "updates"` (beta, `thinking-display-updates-2026-08-18` header) to receive a short summary of each note; see [Text between tool calls is returned in thinking blocks](https://platform.claude.com/docs/en/models/opus-5-5/migration-guide#text-between-tool-calls) for how to render them.
 
 Second, if the model might need to hand the user something verbatim partway through a long turn, such as a code snippet, give it a simple tool for sending the user a message and tell it to reserve the tool for that content. Declare the tool in `tools` from the first request of the session: adding it to `tools` later edits the conversation's prefix and invalidates earlier thinking blocks (see [tool changes in Preserved thinking](https://platform.claude.com/docs/en/build-with-claude/preserved-thinking#tool-changes)).
 
diff --git a/content/en/build-with-claude/refusals-and-fallback.md b/content/en/build-with-claude/refusals-and-fallback.md
index b636b415f0..1000ff6f09 100644
--- a/content/en/build-with-claude/refusals-and-fallback.md
+++ b/content/en/build-with-claude/refusals-and-fallback.md
@@ -152,7 +152,7 @@ The following sections cover what a refusal response contains, when to use serve
 
 A refusal is a successful HTTP 200 response with `stop_reason: "refusal"`:
 
-```text
+```json
 {
   "id": "msg_01XFUDYJgAACzvnptvVoYEL",
   "type": "message",
@@ -484,7 +484,7 @@ Only a safety classifier decline triggers the fallback. A rate limit, overload,
 
 Instead of default routing, you can set `fallbacks` to a list of up to three models. When the requested model declines, the API runs the next model in the chain on the same request. Use this form when you want to control exactly which models serve refused requests, such as pinning a model your application has qualified.
 
-Named fallback models count toward the [oversized-image check](https://platform.claude.com/docs/en/build-with-claude/vision-coordinates#oversized-image-error): a request whose image block sets `"oversized_image": "error"` is checked up front against the requested model and every named fallback, is rejected if any of them would resize that image, and the rejection's reported rescale target fits them all.
+Named fallback models count toward the [oversized-image check](https://platform.claude.com/docs/en/build-with-claude/vision-coordinates#oversized-image-error). A request whose image block sets `"oversized_image": "error"` is checked up front against the requested model and every named fallback. The request is rejected if any of them would resize that image, and the rejection's reported rescale target fits them all.
 
 The highlighted lines are the only difference from the default-routing request.
 
@@ -645,7 +645,7 @@ The response looks like any other message, with two additions:
 
 On a refusal before any output, the `fallback` block is the first content block. For example, when default routing selects Claude Opus 4.8 for the refusal's category:
 
-```text wrap
+```json
 {
   "id": "msg_01XFUDYJgAACzvnptvVoYEL",
   "type": "message",
@@ -726,7 +726,7 @@ On a streaming request, the retry occurs on the same stream, and nothing you hav
 
 ### Non-streaming responses
 
-On a non-streaming request, a mid-output decline behaves differently: the response omits the declined model's partial output, and the fallback model starts a new answer. The result looks like a decline before any output, with the `fallback` block first. The declined attempt and its output tokens still appear in `usage.iterations`.
+On a non-streaming request, a mid-output decline behaves differently: the response omits the declined model's partial output, and the fallback model answers without that output as context. The result looks like a decline before any output, with the `fallback` block first. The declined attempt and its output tokens still appear in `usage.iterations`.
 
 <Note>
   **Declines during tool use:** completed tool work does not block fallback. When a decline fires after server tools (for example, web search or code execution) have finished executing within a request, the fallback attempt proceeds: the completed tool results carry over, and the fallback model can keep invoking server tools. The one case that does not retry is a streaming decline that fires while a tool-use block of any type (a client tool, a server tool, or an MCP tool call) is still open on the stream: that refusal is returned directly, and if the `fallback-credit-2026-07-01` header is set it still carries a credit token redeemable by continuing the partial response. Non-streaming requests are unaffected; the API clears the partial work and retries before responding.
diff --git a/content/en/build-with-claude/search-results.md b/content/en/build-with-claude/search-results.md
index c8e007de0a..6e36e31662 100644
--- a/content/en/build-with-claude/search-results.md
+++ b/content/en/build-with-claude/search-results.md
@@ -1179,7 +1179,7 @@ You can also provide search results directly in user messages. This is useful fo
 
 Regardless of how search results are provided, Claude automatically includes citations when using information from them:
 
-```text
+```json
 {
   "role": "assistant",
   "content": [
@@ -1266,7 +1266,7 @@ Search results can contain multiple text blocks in the `content` array:
 
 A citation referencing the rate limits block looks like:
 
-```text wrap
+```json
 {
   "type": "search_result_location",
   "cited_text": "Rate Limits: The API allows 1000 requests per hour per key.",
@@ -2005,7 +2005,7 @@ The following example replays a complete conversation. The first user message ca
 
 The response cites both sources. The pre-fetched result is `search_result_index: 0` and the tool-returned result is `search_result_index: 1`, matching the order the `search_result` blocks appear in the conversation:
 
-```text
+```json
 {
   "role": "assistant",
   "content": [
diff --git a/content/en/build-with-claude/skills-guide.md b/content/en/build-with-claude/skills-guide.md
index db33289367..00c7df1e45 100644
--- a/content/en/build-with-claude/skills-guide.md
+++ b/content/en/build-with-claude/skills-guide.md
@@ -1949,7 +1949,7 @@ Combine multiple Skills in a single request to handle complex workflows:
 ## Managing custom Skills
 
 <Warning id="workspace-scoped-access">
-  **Custom Skills are accessible to your entire workspace, not scoped to an end user, conversation, or session.** Any API key with access to a workspace can read, use, and delete every custom Skill uploaded to that workspace. Every service account, and every user whose organization role allows API access, can use the Default Workspace in addition to any workspace you add them to, so keep Skills that must stay separate in their own workspace and access them only with [keys scoped to that workspace](https://platform.claude.com/docs/en/manage-claude/workspaces#api-keys-and-resource-scoping).
+  **Custom Skills are accessible to your entire workspace, not scoped to an end user, conversation, or session.** Any API key with access to a workspace can read, use, and delete every custom Skill uploaded to that workspace. Every service account, and every user whose organization role allows API access, can use the Default Workspace in addition to any workspace you add them to. For that reason, keep Skills that must stay separate in their own workspace and access them only with [keys scoped to that workspace](https://platform.claude.com/docs/en/manage-claude/workspaces#api-keys-and-resource-scoping).
 
   If you are building a multitenant platform on the Skills API, create a separate [workspace](https://platform.claude.com/docs/en/manage-claude/workspaces) for each tenant. The workspace is the isolation boundary for custom Skills, so a workspace for each tenant gives that tenant's Skills hard isolation from every other tenant. Each organization can have up to 100 workspaces by default (see [How workspaces work](https://platform.claude.com/docs/en/manage-claude/workspaces#how-workspaces-work)); if you need more for tenant isolation, contact your account team.
 </Warning>
diff --git a/content/en/build-with-claude/streaming.md b/content/en/build-with-claude/streaming.md
index 47911088f9..8d18934974 100644
--- a/content/en/build-with-claude/streaming.md
+++ b/content/en/build-with-claude/streaming.md
@@ -309,7 +309,7 @@ Event streams might also include any number of `ping` events.
 
 The API might occasionally send [errors](https://platform.claude.com/docs/en/api/errors) in the event stream. For example, during periods of high usage, you might receive an `overloaded_error`, which would normally correspond to an HTTP 529 in a non-streaming context:
 
-```text Example error
+```sse Example error
 event: error
 data: {"type": "error", "error": {"type": "overloaded_error", "message": "Overloaded"}}
 ```
@@ -326,7 +326,7 @@ Each `content_block_delta` event contains a `delta` of a type that updates the `
 
 A `text` content block delta looks like:
 
-```text Text delta
+```sse Text delta
 event: content_block_delta
 data: {"type": "content_block_delta","index": 0,"delta": {"type": "text_delta", "text": "ello frien"}}
 ```
@@ -339,7 +339,7 @@ You can accumulate the string deltas and parse the JSON once you receive a `cont
 
 A `tool_use` content block delta looks like:
 
-```text Input JSON delta
+```sse Input JSON delta
 event: content_block_delta
 data: {"type": "content_block_delta","index": 1,"delta": {"type": "input_json_delta","partial_json": "{\"location\": \"San Fra"}}}
 ```
@@ -356,14 +356,14 @@ When `display: "omitted"` is set on the thinking configuration, no thinking text
 
 A typical thinking delta looks like:
 
-```text Thinking delta
+```sse Thinking delta
 event: content_block_delta
 data: {"type": "content_block_delta", "index": 0, "delta": {"type": "thinking_delta", "thinking": "I need to find the GCD of 1071 and 462 using the Euclidean algorithm.\n\n1071 = 2 × 462 + 147"}}
 ```
 
 The signature delta looks like:
 
-```text Signature delta
+```sse Signature delta
 event: content_block_delta
 data: {"type": "content_block_delta", "index": 0, "delta": {"type": "signature_delta", "signature": "EqQBCgIYAhIM1gbcDa9GJwZA2b3hGgxBdjrkzLoky3dl1pkiMOYds..."}}
 ```
@@ -530,7 +530,7 @@ There might be `ping` events dispersed throughout the response as well. See [Eve
   ```
 </CodeGroup>
 
-```text Response
+```sse Response
 event: message_start
 data: {"type": "message_start", "message": {"id": "msg_1nZdL29xx5MUA1yADyHTEsnR8uuvGzszyY", "type": "message", "role": "assistant", "content": [], "model": "claude-opus-5-5", "stop_reason": null, "stop_sequence": null, "usage": {"input_tokens": 25, "output_tokens": 1}}}
 
@@ -872,7 +872,7 @@ This request asks Claude to use a tool to report the weather.
   ```
 </CodeGroup>
 
-```text Response
+```sse Response
 event: message_start
 data: {"type":"message_start","message":{"id":"msg_014p7gG3wDgGV9EUtLvnow3U","type":"message","role":"assistant","model":"claude-opus-5","stop_sequence":null,"usage":{"input_tokens":472,"output_tokens":2},"content":[],"stop_reason":null}}
 
@@ -1165,7 +1165,7 @@ This request enables thinking with streaming. The `display: "summarized"` settin
   ```
 </CodeGroup>
 
-```text Response
+```sse Response
 event: message_start
 data: {"type": "message_start", "message": {"id": "msg_01...", "type": "message", "role": "assistant", "content": [], "model": "claude-opus-5-5", "stop_reason": null, "stop_sequence": null}}
 
@@ -1396,7 +1396,7 @@ This request asks Claude to search the web for current weather information.
   ```
 </CodeGroup>
 
-```text Response
+```sse Response
 event: message_start
 data: {"type":"message_start","message":{"id":"msg_01G...","type":"message","role":"assistant","model":"claude-opus-5-5","content":[],"stop_reason":null,"stop_sequence":null,"usage":{"input_tokens":2679,"cache_creation_input_tokens":0,"cache_read_input_tokens":0,"output_tokens":3}}}
 
diff --git a/content/en/build-with-claude/structured-outputs.md b/content/en/build-with-claude/structured-outputs.md
index f128aabad0..6943d4d39b 100644
--- a/content/en/build-with-claude/structured-outputs.md
+++ b/content/en/build-with-claude/structured-outputs.md
@@ -110,7 +110,7 @@ Structured outputs guarantee schema-compliant responses through constrained deco
 
     Claude returns JSON like this in the response's text content block:
 
-    ```text Output wrap
+    ```json Output
     {
       "name": "John Smith",
       "email": "john@example.com",
@@ -148,7 +148,7 @@ Structured outputs guarantee schema-compliant responses through constrained deco
 
     Claude returns JSON like this in the response's text content block:
 
-    ```text Output wrap
+    ```json Output
     {
       "name": "John Smith",
       "email": "john@example.com",
@@ -374,7 +374,7 @@ Structured outputs guarantee schema-compliant responses through constrained deco
 
     The previous example outputs:
 
-    ```text Output wrap
+    ```json Output
     {"name":"John Smith","email":"john@example.com","plan_interest":"Enterprise","demo_requested":true}
     ```
 
@@ -463,7 +463,7 @@ Structured outputs guarantee schema-compliant responses through constrained deco
 
       The JSON output has this nested structure:
 
-      ```text Output wrap
+      ```json Output
       {
         "composedA": { "a": "hello" },
         "composedB": { "b": "world" }
@@ -484,7 +484,7 @@ Structured outputs guarantee schema-compliant responses through constrained deco
 
       The JSON output has this flat structure:
 
-      ```text Output wrap
+      ```json Output
       {
         "a": "hello",
         "b": "world"
@@ -791,7 +791,7 @@ To use a JSON schema from a file, an OpenAPI spec, or code that builds it at run
 
     Claude returns JSON like this in the response's text content block:
 
-    ```text Output wrap
+    ```json Output
     {
       "name": "John Smith",
       "email": "john@example.com",
@@ -829,7 +829,7 @@ To use a JSON schema from a file, an OpenAPI spec, or code that builds it at run
 
     Claude returns JSON like this in the response's text content block:
 
-    ```text Output wrap
+    ```json Output
     {
       "name": "John Smith",
       "email": "john@example.com",
@@ -983,7 +983,7 @@ To use a JSON schema from a file, an OpenAPI spec, or code that builds it at run
 
     The previous example outputs:
 
-    ```text Output wrap
+    ```json Output
     {"name":"John Smith","email":"john@example.com","plan_interest":"Enterprise","demo_requested":true}
     ```
   </Tab>
@@ -1097,7 +1097,7 @@ To use a JSON schema from a file, an OpenAPI spec, or code that builds it at run
 
     The previous example outputs:
 
-    ```text Output wrap
+    ```json Output
     {"name":"John Smith","email":"john@example.com","plan_interest":"Enterprise"}
     ```
 
diff --git a/content/en/build-with-claude/task-budgets.md b/content/en/build-with-claude/task-budgets.md
index 6c300b12be..b5cc04bb11 100644
--- a/content/en/build-with-claude/task-budgets.md
+++ b/content/en/build-with-claude/task-budgets.md
@@ -312,7 +312,7 @@ Consider a loop with `task_budget: {type: "tokens", total: 100000}` and a single
 
 Claude thinks, then emits a tool call and stops with `stop_reason: "tool_use"`:
 
-```text
+```json
 {
   "role": "assistant",
   "content": [
diff --git a/content/en/build-with-claude/thinking-steering-and-cost.md b/content/en/build-with-claude/thinking-steering-and-cost.md
index 39be734395..bcd3f0db74 100644
--- a/content/en/build-with-claude/thinking-steering-and-cost.md
+++ b/content/en/build-with-claude/thinking-steering-and-cost.md
@@ -889,7 +889,7 @@ What you're billed for is the same regardless of the `display` setting; only wha
 
 To see how many billed output tokens were spent on internal reasoning, read `usage.output_tokens_details.thinking_tokens` in the response. This value reflects the raw reasoning the model generated (not the summarized text returned in the body) and is always less than or equal to `output_tokens`. Subtract it from `output_tokens` to approximate the non-reasoning portion of the output. When streaming, this breakdown appears only on the final `message_delta` event.
 
-```text wrap
+```json
 {
   "usage": {
     "input_tokens": 25,
diff --git a/content/en/build-with-claude/thinking-tool-workflows.md b/content/en/build-with-claude/thinking-tool-workflows.md
index 2bd9683855..d5486f6e11 100644
--- a/content/en/build-with-claude/thinking-tool-workflows.md
+++ b/content/en/build-with-claude/thinking-tool-workflows.md
@@ -287,7 +287,7 @@ The example defines a `get_weather` tool, lets Claude think and request a tool c
       To see thinking text like this output, add `display: "summarized"` to the request. On models where display defaults to omitted, including Claude Opus 5.5, the `thinking` field otherwise comes back as an empty string with only the `signature` populated. Either way, echo the content array back unchanged; see [Controlling thinking display](https://platform.claude.com/docs/en/build-with-claude/thinking#controlling-thinking-display).
     </Note>
 
-    ```text Output
+    ```json Output
     {
       "content": [
         {
@@ -753,7 +753,7 @@ The example defines a `get_weather` tool, lets Claude think and request a tool c
   <Step title="Read the final response">
     You should see Claude complete the turn with text. Because [interleaved thinking](https://platform.claude.com/docs/en/build-with-claude/thinking#interleaved-thinking) is automatic in adaptive mode, the continuation can also open with a new thinking block before the final text:
 
-    ```text Output wrap
+    ```json Output
     {
       "content": [
         {
diff --git a/content/en/build-with-claude/thinking.md b/content/en/build-with-claude/thinking.md
index 53666b3093..9e785d3de4 100644
--- a/content/en/build-with-claude/thinking.md
+++ b/content/en/build-with-claude/thinking.md
@@ -24,7 +24,7 @@ Whether Claude thinks on a given request, and how deeply, depends on your thinki
 
 Here is what up-front thinking looks like in a response: one or more `thinking` content blocks arrive before the `text` blocks. The thinking block is still generated content, like the `text` block that follows it, but it is separated from the canonical response. Each thinking block also carries a `signature` field, an encrypted copy of the full reasoning that you pass back unchanged in multi-turn and tool-use conversations (see [Thinking encryption](https://platform.claude.com/docs/en/build-with-claude/thinking#thinking-encryption)):
 
-```text
+```json
 {
   "content": [
     {
@@ -482,7 +482,7 @@ Set `display: "omitted"` when your application doesn't surface thinking content
 
 With `display: "omitted"`, the response contains `thinking` blocks with an empty `thinking` field:
 
-```text Output wrap
+```json Output
 {
   "content": [
     {
@@ -800,7 +800,7 @@ The following examples stream a response with adaptive thinking, printing thinki
 To reassemble complete thinking blocks with their signatures after streaming, use your SDK's message-accumulation helper, `stream.get_final_message()` (typescript: `stream.finalMessage()`; ruby: `stream.accumulated_message`; csharp: `.Aggregate()`; go: `message.Accumulate(event)`; java, php: `MessageAccumulator`), instead of concatenating deltas yourself.
 
 <Accordion title="Full streaming event trace">
-  ```text Output
+  ```sse Output
   event: message_start
   data: {"type": "message_start", "message": {"id": "msg_01...", "type": "message", "role": "assistant", "content": [], "model": "claude-opus-5-5", "stop_reason": null, "stop_sequence": null}}
 
@@ -842,7 +842,7 @@ To reassemble complete thinking blocks with their signatures after streaming, us
 
 When `display: "omitted"` is set, the thinking block opens, a `thinking_delta` with an empty `thinking` string arrives, a single `signature_delta` follows, and the block closes. Text streaming starts immediately after:
 
-```text Output
+```sse Output
 event: content_block_start
 data: {"type":"content_block_start","index":0,"content_block":{"type":"thinking","thinking":"","signature":""}}
 
@@ -861,7 +861,7 @@ data: {"type":"content_block_start","index":1,"content_block":{"type":"text","te
 
 With `display: "updates"` (beta), reasoning blocks stream as they do under `"omitted"`. Each [progress-update block](https://platform.claude.com/docs/en/build-with-claude/thinking#progress-updates) streams its text as `thinking_delta` events before the `tool_use` block it introduces. A pause of several seconds before the progress-update block opens is normal:
 
-```text Output
+```sse Output
 event: content_block_start
 data: {"type":"content_block_start","index":1,"content_block":{"type":"thinking","thinking":"","signature":""}}
 
@@ -1021,7 +1021,7 @@ Use `display: "updates"` for an agent interface that keeps reasoning hidden and
 
 Under `"updates"`, the start of the response that follows a `tool_result` looks like this. The first block is reasoning and stays empty, as it would under `"omitted"`. The second carries text, so it's a progress update. Under `"summarized"` both blocks carry text, and under `"omitted"` both are empty.
 
-```text Output
+```json Output
 {
   "content": [
     {
@@ -1168,7 +1168,7 @@ Keep the following in mind when working with signatures:
 
 In addition to regular `thinking` blocks, the API might return `redacted_thinking` blocks when portions of Claude's reasoning are safety-redacted. A `redacted_thinking` block contains encrypted thinking content in a `data` field, with no readable text:
 
-```text wrap
+```json
 {
   "type": "redacted_thinking",
   "data": "..."
diff --git a/content/en/build-with-claude/token-counting.md b/content/en/build-with-claude/token-counting.md
index 4689c3677a..8a51b05abf 100644
--- a/content/en/build-with-claude/token-counting.md
+++ b/content/en/build-with-claude/token-counting.md
@@ -27,7 +27,13 @@ Token counting lets you determine the number of tokens in a message before you s
 
 The [token counting](https://platform.claude.com/docs/en/api/messages/count_tokens) endpoint accepts the same structured list of inputs for creating a message, including support for system prompts, [tools](https://platform.claude.com/docs/en/agents-and-tools/tool-use/overview), [images](https://platform.claude.com/docs/en/build-with-claude/vision), and [PDFs](https://platform.claude.com/docs/en/build-with-claude/pdf-support). The response contains the total number of input tokens.
 
-This endpoint returns an `invalid_request_error` for a few inputs that the Messages API accepts: [server tools](https://platform.claude.com/docs/en/agents-and-tools/tool-use/server-tools) such as web search, web fetch, code execution, and tool search (every server tool except the [advisor tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/advisor-tool)), the [MCP connector](https://platform.claude.com/docs/en/agents-and-tools/mcp-connector), and `image` or `document` blocks with a `url` or `file` source. Send images and PDFs as base64 to count them. For requests that use server tools or MCP servers, the Messages API response reports the tokens used in its `usage` object.
+This endpoint returns an `invalid_request_error` for a few inputs that the Messages API accepts:
+
+* [Server tools](https://platform.claude.com/docs/en/agents-and-tools/tool-use/server-tools) such as web search, web fetch, code execution, and tool search (every server tool except the [advisor tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/advisor-tool))
+* The [MCP connector](https://platform.claude.com/docs/en/agents-and-tools/mcp-connector)
+* `image` or `document` blocks with a `url` or `file` source
+
+Send images and PDFs as base64 to count them. For requests that use server tools or MCP servers, the Messages API response reports the tokens used in its `usage` object.
 
 <Note>
   The token count is an **estimate**. In some cases, the actual number of input tokens used when creating a message might differ by a small amount.
@@ -186,7 +192,7 @@ All [active models](https://platform.claude.com/docs/en/models/overview) support
   ```
 </CodeGroup>
 
-```text Output wrap
+```json Output
 { "input_tokens": 14 }
 ```
 
@@ -469,7 +475,7 @@ All [active models](https://platform.claude.com/docs/en/models/overview) support
   ```
 </CodeGroup>
 
-```text Output wrap
+```json Output
 { "input_tokens": 403 }
 ```
 
@@ -778,7 +784,7 @@ All [active models](https://platform.claude.com/docs/en/models/overview) support
   ```
 </CodeGroup>
 
-```text Output wrap
+```json Output
 { "input_tokens": 1028 }
 ```
 
@@ -1103,7 +1109,7 @@ An embedded image block that sets [`"oversized_image": "error"`](https://platfor
   ```
 </CodeGroup>
 
-```text Output wrap
+```json Output
 { "input_tokens": 88 }
 ```
 
@@ -1389,7 +1395,7 @@ An embedded image block that sets [`"oversized_image": "error"`](https://platfor
   ```
 </CodeGroup>
 
-```text Output wrap
+```json Output
 { "input_tokens": 2188 }
 ```
 
diff --git a/content/en/build-with-claude/working-with-messages.md b/content/en/build-with-claude/working-with-messages.md
index e83130ec40..5bf96740f0 100644
--- a/content/en/build-with-claude/working-with-messages.md
+++ b/content/en/build-with-claude/working-with-messages.md
@@ -133,7 +133,7 @@ This guide covers common patterns for working with the Messages API, including b
   ```
 </CodeGroup>
 
-```text Output wrap
+```json Output
 {
   "id": "msg_01XFDUDYJgAACzvnptvVoYEL",
   "type": "message",
@@ -300,7 +300,7 @@ The Messages API is stateless, which means that you always send the full convers
   ```
 </CodeGroup>
 
-```text Output wrap
+```json Output
 {
   "id": "msg_018gCsTGsXkYJVqYPxTgDHBU",
   "type": "message",
@@ -478,7 +478,7 @@ You can prefill part of Claude's response in the last position of the input mess
   ```
 </CodeGroup>
 
-```text Output wrap
+```json Output
 {
   "id": "msg_01Q8Faay6S7QPTvEUUQARt7h",
   "type": "message",
@@ -1007,7 +1007,7 @@ Claude can read both text and images in requests. You can supply images using th
   ```
 </CodeGroup>
 
-```text Output
+```json Output
 {
   "id": "msg_011CdKmWtV3oFx1C5yUbf5CY",
   "type": "message",
diff --git a/content/en/claude_api_primer.md b/content/en/claude_api_primer.md
index c4a1cc6366..5a56993579 100644
--- a/content/en/claude_api_primer.md
+++ b/content/en/claude_api_primer.md
@@ -44,7 +44,7 @@ Previous Haiku model: Claude Haiku 4.5: claude-haiku-4-5-20251001
   ```
 </CodeGroup>
 
-```text Output wrap
+```json Output
 {
   "id": "msg_01XFDUDYJgAACzvnptvVoYEL",
   "type": "message",
@@ -590,7 +590,7 @@ The response has a `stop_reason` of `tool_use` and one or more `tool_use` conten
 * `name`: The name of the tool being used
 * `input`: An object containing the input being passed to the tool
 
-```text wrap
+```json
 {
   "role": "assistant",
   "content": [
@@ -699,7 +699,7 @@ Each server-sent event includes a named event type and associated JSON data. Eac
 
 #### Text delta
 
-```text wrap
+```json
 {
   "type": "content_block_delta",
   "index": 0,
@@ -711,7 +711,7 @@ Each server-sent event includes a named event type and associated JSON data. Eac
 
 For `tool_use` content blocks, deltas are *partial JSON strings*:
 
-```text
+```json
 {"type": "content_block_delta","index": 1,"delta": {"type": "input_json_delta","partial_json": "{\"location\": \"San Fra"}}}
 ```
 
@@ -719,7 +719,7 @@ For `tool_use` content blocks, deltas are *partial JSON strings*:
 
 When using thinking with streaming:
 
-```text wrap
+```json
 {
   "type": "content_block_delta",
   "index": 0,
@@ -732,7 +732,7 @@ When using thinking with streaming:
 
 ### Basic streaming request example
 
-```text
+```sse
 event: message_start
 data: {"type": "message_start", "message": {"id": "msg_1nZdL29xx5MUA1yADyHTEsnR8uuvGzszyY", "type": "message", "role": "assistant", "content": [], "model": "claude-opus-5-5", "stop_reason": null, "stop_sequence": null, "usage": {"input_tokens": 25, "output_tokens": 1}}}
 
diff --git a/content/en/cli-sdks-libraries/cli/scripting.md b/content/en/cli-sdks-libraries/cli/scripting.md
index cb917848d7..00e5d78da2 100644
--- a/content/en/cli-sdks-libraries/cli/scripting.md
+++ b/content/en/cli-sdks-libraries/cli/scripting.md
@@ -25,7 +25,7 @@ Once an agent and environment exist, you can drive a session from the shell:
       --title "Summarization task"
     ```
 
-    ```text Output wrap
+    ```json Output
     {
       "id": "session_01JZCh78XvmxJjiXVy3oSi7K",
       "status": "running"
diff --git a/content/en/cli-sdks-libraries/cli/using.md b/content/en/cli-sdks-libraries/cli/using.md
index dab4b7db8b..aced72d7fb 100644
--- a/content/en/cli-sdks-libraries/cli/using.md
+++ b/content/en/cli-sdks-libraries/cli/using.md
@@ -48,7 +48,7 @@ ant beta:sessions:events list --session-id session_01...
 ant models retrieve --model-id claude-opus-5-5 --format yaml
 ```
 
-```text Output wrap
+```yaml Output
 type: model
 id: claude-opus-5-5
 display_name: Claude Opus 5.5
@@ -74,7 +74,7 @@ Use `--transform` to reshape responses before printing. The expression is a [GJS
 ant beta:agents list --transform "{id,name,model}" --format jsonl
 ```
 
-```text Output
+```jsonl Output
 {"id": "agent_011CYm1BLqPX...", "name": "Docs CLI Test Agent", "model": "claude-opus-5-5"}
 {"id": "agent_011CYkVwfaEt...", "name": "Coffee Making Assistant", "model": "claude-opus-5-5"}
 {"id": "agent_011CYixHhtUP...", "name": "Coding Assistant", "model": "claude-opus-5-5"}
diff --git a/content/en/cli-sdks-libraries/overview.md b/content/en/cli-sdks-libraries/overview.md
index 707cab321a..edd4ef9f4b 100644
--- a/content/en/cli-sdks-libraries/overview.md
+++ b/content/en/cli-sdks-libraries/overview.md
@@ -61,13 +61,13 @@ Each major version of a client SDK sends one [API version](https://platform.clau
 | Tool       | Latest version | Package                                                                                                     |
 | ---------- | -------------- | ----------------------------------------------------------------------------------------------------------- |
 | ant CLI    | `2.1.0`        | [`github.com/anthropics/anthropic-cli`](https://github.com/anthropics/anthropic-cli/releases)               |
-| Python     | `2.1.0`        | [`anthropic`](https://pypi.org/project/anthropic/)                                                          |
+| Python     | `2.1.0`        | [`anthropic` on PyPI](https://pypi.org/project/anthropic/)                                                  |
 | TypeScript | `1.1.0`        | [`@anthropic-ai/sdk`](https://www.npmjs.com/package/@anthropic-ai/sdk)                                      |
 | C#         | `13.1.0`       | [`Anthropic`](https://www.nuget.org/packages/Anthropic)                                                     |
 | Go         | `2.1.0`        | [`github.com/anthropics/anthropic-sdk-go/v2`](https://pkg.go.dev/github.com/anthropics/anthropic-sdk-go/v2) |
 | Java       | `3.1.0`        | [`com.anthropic:anthropic-java`](https://central.sonatype.com/artifact/com.anthropic/anthropic-java)        |
 | PHP        | `1.1.0`        | [`anthropic-ai/sdk`](https://packagist.org/packages/anthropic-ai/sdk)                                       |
-| Ruby       | `2.1.0`        | [`anthropic`](https://rubygems.org/gems/anthropic)                                                          |
+| Ruby       | `2.1.0`        | [`anthropic` on RubyGems](https://rubygems.org/gems/anthropic)                                              |
 
 The same versions are available as JSON at `https://platform.claude.com/docs/sdk-versions.json`.
 
diff --git a/content/en/cli-sdks-libraries/sdks/csharp.md b/content/en/cli-sdks-libraries/sdks/csharp.md
index 86056d53f1..603a8bdbf8 100644
--- a/content/en/cli-sdks-libraries/sdks/csharp.md
+++ b/content/en/cli-sdks-libraries/sdks/csharp.md
@@ -324,7 +324,7 @@ Console.WriteLine(await chatClient.GetResponseAsync("Tell me about IChatClient",
 
 To send a request to the Claude API, build an instance of a `Params` class and pass it to the corresponding client method. When the response is received, it's deserialized into an instance of a C# class.
 
-For example, `client.Messages.Create` should be called with an instance of `MessageCreateParams`, and it returns an instance of `Task<Message>`.
+For example, `client.Messages.Create` takes an instance of `MessageCreateParams` and returns an instance of `Task<Message>`.
 
 ## Advanced usage
 
diff --git a/content/en/cli-sdks-libraries/sdks/go.md b/content/en/cli-sdks-libraries/sdks/go.md
index 8e41cba097..caff9e9d8d 100644
--- a/content/en/cli-sdks-libraries/sdks/go.md
+++ b/content/en/cli-sdks-libraries/sdks/go.md
@@ -540,7 +540,7 @@ This SDK will also return an error if a non-streaming request is expected to be
 
 ## File uploads
 
-Request parameters that correspond to file uploads in multipart requests are typed as `io.Reader`. The contents of the `io.Reader` are sent by default as a multipart form part with the file name of `anonymous_file` and content type of `application/octet-stream`, so the recommended approach is to specify a custom content type with the `anthropic.File(reader io.Reader, filename string, contentType string)` helper, which wraps any `io.Reader` with the appropriate file name and content type.
+Request parameters that correspond to file uploads in multipart requests are typed as `io.Reader`. The contents of the `io.Reader` are sent by default as a multipart form part with the file name of `anonymous_file` and content type of `application/octet-stream`. For this reason, the recommended approach is to specify a custom content type with the `anthropic.File(reader io.Reader, filename string, contentType string)` helper. This helper wraps any `io.Reader` with the appropriate file name and content type.
 
 ```go
 // A file from the filesystem
diff --git a/content/en/cli-sdks-libraries/sdks/java.md b/content/en/cli-sdks-libraries/sdks/java.md
index a51322e2d1..9eed248461 100644
--- a/content/en/cli-sdks-libraries/sdks/java.md
+++ b/content/en/cli-sdks-libraries/sdks/java.md
@@ -819,7 +819,7 @@ Because each class is immutable, builder modification never affects already buil
 
 To send a request to the Claude API, build an instance of some `Params` class and pass it to the corresponding client method. When the response is received, it is deserialized into an instance of a Java class.
 
-For example, `client.messages().create(...)` should be called with an instance of `MessageCreateParams`, and it returns an instance of `Message`.
+For example, `client.messages().create(...)` takes an instance of `MessageCreateParams` and returns an instance of `Message`.
 
 ### Undocumented parameters
 
diff --git a/content/en/cli-sdks-libraries/sdks/python.md b/content/en/cli-sdks-libraries/sdks/python.md
index c235ad78af..22b19703b1 100644
--- a/content/en/cli-sdks-libraries/sdks/python.md
+++ b/content/en/cli-sdks-libraries/sdks/python.md
@@ -611,7 +611,7 @@ message = (
 print(message.content)
 ```
 
-These methods return an `APIResponse` object. On the async client they return an `AsyncAPIResponse`, and `.parse()`, `.read()`, `.text()`, and `.json()` must be awaited.
+These methods return an `APIResponse` object. On the async client they return an `AsyncAPIResponse`, and you must await `.parse()`, `.read()`, `.text()`, and `.json()`.
 
 ### Streaming response body
 
diff --git a/content/en/get-started.md b/content/en/get-started.md
index 4c1eff960c..c23119d4e2 100644
--- a/content/en/get-started.md
+++ b/content/en/get-started.md
@@ -44,7 +44,7 @@ description: Make your first API call to Claude and build a simple web search as
 
         Claude returns a JSON response containing the assistant's message:
 
-        ```text Output
+        ```json Output
         {
           "model": "claude-opus-5-5",
           "id": "msg_013mHbppMPd2PrVJzGMZPt2D",
@@ -112,7 +112,7 @@ description: Make your first API call to Claude and build a simple web search as
 
         The CLI prints the JSON response:
 
-        ```text Output
+        ```json Output
         {
           "model": "claude-opus-5-5",
           "id": "msg_01N1ycuCkM5Mzd7WhTU4fwST",
diff --git a/content/en/manage-claude/access-transparency-log.md b/content/en/manage-claude/access-transparency-log.md
index bd0404c453..783de748cc 100644
--- a/content/en/manage-claude/access-transparency-log.md
+++ b/content/en/manage-claude/access-transparency-log.md
@@ -13,6 +13,8 @@ Learn how to cryptographically verify that no [Access Transparency](https://plat
 
   Your log is created when the first Access Transparency event is recorded for your organization after enablement. Until then, every transparency log endpoint returns `404`.
 
+  If you already run `axt-verify` on a schedule, see [Upgrade for a new leaf version](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#upgrade-for-a-new-leaf-version).
+
   The transparency log is provided for your information. It is not designed or certified to satisfy any security, privacy, or regulatory requirement. You are responsible for determining whether it fits your own obligations.
 </Note>
 
@@ -38,12 +40,12 @@ When Access Transparency is enabled, Anthropic maintains a transparency log for
 
 * It does not prove that every access was recorded, or that a recorded event accurately describes the access. It proves only that what Anthropic committed to the log has not changed since.
 * It does not change [what Access Transparency covers](https://platform.claude.com/docs/en/manage-claude/access-transparency#what-access-transparency-covers) or when events arrive.
-* Served fields outside the leaf, such as `workspace_uuid` and any field added later, are not covered by the proof.
+* Served fields that no [leaf version](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#how-an-event-becomes-a-leaf) includes, such as `workspace_uuid`, are not covered by the proof. A field added to events later is covered only once a leaf version includes it.
 * An inclusion proof speaks for an event you were served. It does not by itself prove that the feed listed every leaf the log holds. The log's [entry bundles](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#read-an-entry-bundle) contain every leaf, so you can read the complete set of committed events directly when you need it.
 * The presence of `transparency_log_leaf_index` on an event is a pointer, not a proof. Always verify inclusion before treating an event as committed in the log.
 * The protection against a rewritten history comes from the checkpoints you keep. A checkpoint's signature by a key listed in [Published key fingerprints](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#published-key-fingerprints) proves that it came from Anthropic's log. A consistency proof from the checkpoint you saved last time proves that the history you already observed only grew.
 
-## Before you begin
+## Before you start
 
 You need:
 
@@ -148,7 +150,7 @@ curl --fail-with-body -sS \
   -H "anthropic-version: 2023-06-01"
 ```
 
-```text
+```json
 {
   "type": "transparency_log_keys",
   "origin": "axt.anthropic.com/25f6429a-3293-49bf-afed-cb312911554b",
@@ -212,7 +214,7 @@ curl --fail-with-body -sS -G \
   -H "anthropic-version: 2023-06-01"
 ```
 
-```text
+```json
 {
   "type": "transparency_log_inclusion_proof",
   "leaf_index": 41,
@@ -258,7 +260,7 @@ curl --fail-with-body -sS -G \
   -H "anthropic-version: 2023-06-01"
 ```
 
-```text
+```json
 {
   "type": "transparency_log_consistency_proof",
   "hashes": [
@@ -309,19 +311,31 @@ Returns `application/octet-stream`: consecutive leaf entries, each prefixed with
 
 ## How an event becomes a leaf
 
-A leaf entry is the schema-version byte `0x01` followed by canonical JSON of 11 fields. The JSON follows [RFC 8785](https://www.rfc-editor.org/rfc/rfc8785) (JSON Canonicalization Scheme), and the fields are taken from the event exactly as the Activity Feed serves it:
+A leaf entry is one schema-version byte followed by canonical JSON of that version's fields. The JSON follows [RFC 8785](https://www.rfc-editor.org/rfc/rfc8785) (JSON Canonicalization Scheme), and the fields are taken from the event exactly as the Activity Feed serves it.
+
+A leaf version is a fixed set of fields, and each field is either required or optional.
+
+Version `0x01` has 11 required fields and no optional field:
 
 * `id`, `type`, `created_at`, `accessed_at`, `organization_id`, `organization_uuid`, `workspace_id`, `accessor_department`, and `reason_code`
 * `actor`, with its nested `type` and `email_address`
 * `resource_details`, with its nested `type`, `id`, and `parent`
 
+Version `0x02` has the same 11 required fields and one optional field:
+
+* `user_profile_id`, the ID of the [user profile](https://platform.claude.com/docs/en/api/beta/user_profiles) the accessed or preserved data was created under
+
+Once your log starts writing a version, it writes every new leaf under that version until it starts writing the next one, even when the event has none of the version's optional fields. [Upgrade for a new leaf version](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#upgrade-for-a-new-leaf-version) says when your log can start writing a new version. A leaf never changes once it is written, so it keeps its version for good. One log can therefore hold leaves of more than one version. Nothing the Activity Feed or the proof endpoints serve says which version a leaf has (only the leaf's own bytes in an [entry bundle](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#read-an-entry-bundle) do), and you do not need to know: the last of the following rules says which entries to rebuild for an event.
+
 The rules:
 
-* Served fields outside that set, such as `workspace_uuid` and `transparency_log_leaf_index` itself, are ignored.
+* Served fields outside a version's set, such as `workspace_uuid` and `transparency_log_leaf_index` itself, are ignored.
+
+* A required field that the served event omits, or serves as `null`, enters the leaf as `null`. An empty string is distinct from `null`.
 
-* A documented field that the served event omits enters the leaf as `null`. An empty string is distinct from `null`.
+* An optional field enters the leaf only when the served event has it as a string, the empty string included, and it enters as that string. When the served event omits it or serves it as `null`, the leaf has no such key at all. An optional field is never `null` in a leaf. Reject a served event that has any other JSON value for an optional field.
 
-* `actor` and `resource_details` are objects with exactly their documented keys when the served event carries them. Under version `0x01`, `actor.email_address` and `resource_details.parent` are always `null`. When the served event omits one of these objects or serves it as `null`, the whole value is `null` in the leaf, not an object of `null` fields. Many access events carry no `resource_details`.
+* `actor` and `resource_details` are objects with exactly their documented keys when the served event carries them. `actor.email_address` and `resource_details.parent` are always `null`. When the served event omits one of these objects or serves it as `null`, the whole value is `null` in the leaf, not an object of `null` fields. Many access events carry no `resource_details`.
 
 * String values, including both timestamps and `reason_code`, are taken byte for byte as served. If you re-derive a timestamp from another representation, reproduce the served rendering exactly:
 
@@ -333,11 +347,13 @@ The rules:
 
 * The leaf hash is RFC 6962's `SHA-256(0x00 || entry)`. Interior nodes hash as `SHA-256(0x01 || left || right)`.
 
-* A verifier rejects an unknown version byte, and a `0x01` leaf whose `type` is not one of the two Access Transparency types. New event types or rule changes ship under a new version byte. Existing leaves never re-hash.
+* A verifier that reads leaf entries, for example from an [entry bundle](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#read-an-entry-bundle), rejects an unknown version byte, and a leaf whose `type` is not one of the two Access Transparency types. New fields, new event types, and rule changes ship under a new version byte. Existing leaves never re-hash.
+
+* Rebuild a served event's entry under each leaf version whose fields include every optional field the served event has as a string (every version, when it has none), and under no other version. The event verifies if its inclusion proof matches the leaf hash of any one of them. If an optional field is removed from, added to, or changed in the event you are served, the event fails verification on any verifier that rebuilds a leaf version with that field, whichever leaf the log holds.
 
 For example, this access event as the Activity Feed serves it:
 
-```text wrap
+```json
 {
   "id": "activity_01GPXmAhizavrUuoXNn3tzeA",
   "type": "anthropic_access",
@@ -355,13 +371,21 @@ For example, this access event as the Activity Feed serves it:
 }
 ```
 
-becomes this canonical JSON. It has exactly the 11 documented keys, sorted, on one line. `workspace_uuid` and `transparency_log_leaf_index` drop out, and `resource_details.parent`, absent from the served event, enters as `null`:
+becomes this canonical JSON. It has exactly the 11 required keys, sorted, on one line. `workspace_uuid` and `transparency_log_leaf_index` drop out, and `resource_details.parent`, absent from the served event, enters as `null`:
 
-```text wrap
+```json
 {"accessed_at":"2025-07-08T18:39:58Z","accessor_department":"Trust & Safety","actor":{"email_address":null,"type":"anthropic_actor"},"created_at":"2025-07-08T18:40:00Z","id":"activity_01GPXmAhizavrUuoXNn3tzeA","organization_id":"org_015gtSHLz269eTwgrH8NX5yk","organization_uuid":"25f6429a-3293-49bf-afed-cb312911554b","reason_code":"safety_review","resource_details":{"id":"msg_01HXAMPLE12345678","parent":null,"type":"message"},"type":"anthropic_access","workspace_id":"wrkspc_01PaGUP2rbg1XDh7Z9W1CEpd"}
 ```
 
-The leaf entry is the byte `0x01` followed by those UTF-8 bytes. Its leaf hash, `SHA-256(0x00 || entry)`, is `6ro7vTcFq+sYDZiiGvZaFetUIoMSLig3DGDrCKK1HFU=` in base64. Use this example as a test vector for your own canonicalization code.
+This event has no optional field, so its version `0x02` and version `0x01` entries hold the same JSON and differ only in the first byte. The version `0x02` entry is the byte `0x02` followed by those UTF-8 bytes. Its leaf hash, `SHA-256(0x00 || entry)`, is `1iKC1LbEakcNTfp8OwW4LtItQu4+/K/pzaDDLVIA5XE=` in base64. The version `0x01` entry is the byte `0x01` followed by the same bytes, with leaf hash `6ro7vTcFq+sYDZiiGvZaFetUIoMSLig3DGDrCKK1HFU=`.
+
+The same event served with an optional field, here `"user_profile_id": "uprof_01H7Z9W1CEpdPaGUP2rbg1XD"`, has 12 keys in its version `0x02` JSON. The optional key sorts with the others, between `type` and `workspace_id`:
+
+```json
+{"accessed_at":"2025-07-08T18:39:58Z","accessor_department":"Trust & Safety","actor":{"email_address":null,"type":"anthropic_actor"},"created_at":"2025-07-08T18:40:00Z","id":"activity_01GPXmAhizavrUuoXNn3tzeA","organization_id":"org_015gtSHLz269eTwgrH8NX5yk","organization_uuid":"25f6429a-3293-49bf-afed-cb312911554b","reason_code":"safety_review","resource_details":{"id":"msg_01HXAMPLE12345678","parent":null,"type":"message"},"type":"anthropic_access","user_profile_id":"uprof_01H7Z9W1CEpdPaGUP2rbg1XD","workspace_id":"wrkspc_01PaGUP2rbg1XDh7Z9W1CEpd"}
+```
+
+Its version `0x02` entry, the only one to rebuild, is the byte `0x02` followed by those UTF-8 bytes, with leaf hash `onAlpkDfdXmHPvbffiTpHAgBacf/mJCzTfNDibDrYp4=`. Use these three hashes as test vectors for your own canonicalization code.
 
 ## Verify your log
 
@@ -372,13 +396,37 @@ Verification runs on your own infrastructure. Everything the API returns is untr
 3. Check the checkpoint's origin line first. Compare its first line, byte for byte, with the origin you derived. Reject any checkpoint whose origin differs, before doing anything else.
 4. Verify the checkpoint's signature. Find the signature line named for your origin whose first four decoded bytes equal the `key_hash` of a currently valid key you kept. Verify the remaining bytes as an ECDSA P-256 signature over the SHA-256 of the note body, using that key's `public_key`. If no signature line matches such a key, or the signature does not verify, reject the checkpoint.
 5. Prove append-only. If the new tree size is smaller than the one you saved, fail. If it is equal, the root hashes must match. If it is larger, verify the RFC 9162 consistency proof from your saved size and root hash to the new size and root hash.
-6. Prove each event is included. Read every Access Transparency event the Activity Feed serves. For each new one, rebuild its [leaf](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#how-an-event-becomes-a-leaf), hash it, and fetch its [inclusion proof](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#fetch-an-inclusion-proof). Walk the audit path from your leaf hash at the event's index up to the checkpoint's root hash. A mismatch means the event you were served is not the event the log committed. The proof response can carry a different checkpoint from the one you hold. Link it into your history with a consistency proof before you verify anything against it.
+6. Prove each event is included. Read every Access Transparency event the Activity Feed serves. For each new one, rebuild each [leaf to rebuild for it](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#how-an-event-becomes-a-leaf), hash each, and fetch its [inclusion proof](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#fetch-an-inclusion-proof). Walk the audit path from each leaf hash at the event's index up to the checkpoint's root hash. The event verifies if one of them reproduces the root hash. If none does, the event you were served is not the event the log committed. The proof response can carry a different checkpoint from the one you hold. Check its origin line and signature (steps 3 and 4), and link it into your history with a consistency proof (step 5), before you verify anything against it.
 7. Re-check what you saw before. Whenever you read an event again, it must be served with the same index and the same leaf bytes as when you verified it. No event may lose the index it had, and while you are enrolled no event may newly appear without one. The events served without an index on your first run are your pre-log history. A run that re-reads only recent events re-checks only those. To re-check older ones, verify the copies you kept (step 8) again.
 8. Save the checkpoint you verified and a record of each event you verified. They are your evidence and your starting point for the next run.
 
+### Upgrade for a new leaf version
+
+Each `axt-verify` release rebuilds only [leaf versions](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#how-an-event-becomes-a-leaf) that were defined when it was released. Assume that your log can start writing a new version at any time once a release that rebuilds it is published. Install that release as soon as it is published.
+
+| Leaf version | `axt-verify` releases that rebuild it |
+| ------------ | ------------------------------------- |
+| `0x01`       | Every release                         |
+| `0x02`       | `v0.2.0` and later                    |
+
+`axt-verify version` prints the release you run. A new installation gets the newest release. If the table's last row does not include your release, upgrade to a release in that row. If none is published yet, upgrade as soon as one is:
+
+1. Install the newest release the way you installed before (the `go install` line in [Verify with axt-verify](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#verify-with-axt-verify)).
+2. Keep running it as before: same `--org`, same `--state` file, same schedule.
+
+What to expect:
+
+* **Before your log starts writing the new version.** The newer release verifies your log as before, because it also rebuilds the earlier leaf versions.
+* **After your log starts writing the new version, on a release that does not rebuild it.** The release reports every event whose leaf has that version as a verification failure, with exit status `1`, even when the event has none of the version's optional fields. Leaves of the versions your release rebuilds are not affected. They verify as they did before. The failures clear once you run a release that rebuilds the version on the same `--state` file, and the append-only check continues from where your last run ended.
+* **If you return to an earlier release.** Do not give an earlier release a state file that a newer release has saved. The earlier release reports every event that was waiting for a checkpoint as a verification failure. If you may need to return to the earlier release, copy the state file before the first run of the newer one, and give the earlier release that copy.
+
+A verifier you maintain yourself needs a new version's fields, and the rule for which entries to rebuild, from [How an event becomes a leaf](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#how-an-event-becomes-a-leaf) before your log starts writing that version.
+
 ### Verify with axt-verify
 
-[`axt-verify`](https://github.com/anthropics/axt-verify) is Anthropic's open-source verifier for this log. It is a single Go binary that you run on your own infrastructure. Each release has exactly one log signing key from [Published key fingerprints](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#published-key-fingerprints) built in, so it never asks the API which key to trust. When Anthropic rotates the key, you upgrade to the release that carries the new one on the switch date. `axt-verify` derives your origin from the organization UUID you pass with `--org`, which is the one you took from the Console in [Before you begin](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#before-you-begin). It rejects any checkpoint whose origin line differs.
+If you already run `axt-verify` on a schedule, read [Upgrade for a new leaf version](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#upgrade-for-a-new-leaf-version) first.
+
+[`axt-verify`](https://github.com/anthropics/axt-verify) is Anthropic's open-source verifier for this log. It is a single Go binary that you run on your own infrastructure. Each release has exactly one log signing key from [Published key fingerprints](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#published-key-fingerprints) built in, so it never asks the API which key to trust. When Anthropic rotates the key, you upgrade to the release that carries the new one on the switch date. `axt-verify` derives your origin from the organization UUID you pass with `--org`, which is the one you took from the Console in [Before you start](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#before-you-begin). It rejects any checkpoint whose origin line differs.
 
 Install it with Go 1.26 or newer. It reads your Compliance Access Key from the `ANTHROPIC_COMPLIANCE_ACCESS_KEY` environment variable, never from a flag or a file. The `run` command is the one to schedule:
 
@@ -391,7 +439,7 @@ axt-verify --org 25f6429a-3293-49bf-afed-cb312911554b \
   run
 ```
 
-Each `run` fetches the latest checkpoint and verifies its signature and origin line. It then proves the log is an append-only extension of the checkpoint the previous run saved. Next it pages through the Access Transparency events on your Activity Feed. It starts seven days (by `created_at`) before the newest event the previous run read, so that events listed late or out of order are still picked up. It rebuilds each event's leaf, verifies an inclusion proof for it, and compares any event it verified before against what it recorded then. Finally, it saves the new checkpoint and its progress to the `--state` file, which the next run starts from. Run it at least daily. Hourly is reasonable. With a parent-organization key, run one copy per child organization, each with its own `--org` and `--state` file. Each child organization's UUID also comes from the Claude Console, not from the Compliance API responses you are verifying. To find it, switch to the child organization in the account menu at the bottom of the Console sidebar, then open the [Organization](https://platform.claude.com/settings/organization) page (`platform.claude.com/settings/organization`). You can also find it in your parent organization's list of organizations in the Console. `axt-verify checkpoint` does only the checkpoint and append-only steps. `axt-verify events FILE` verifies events you already hold, such as an auditor's sample or your own export. It proves that each event in the file is still committed in the log under the current checkpoint. It does not read the feed or touch the state file.
+Each `run` fetches the latest checkpoint and verifies its signature and origin line. It then proves the log is an append-only extension of the checkpoint the previous run saved. Next it pages through the Access Transparency events on your Activity Feed. It starts 7 days (by `created_at`) before the newest event the previous run read, so that events listed late or out of order are still picked up. It rebuilds each [leaf to rebuild for the event](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#how-an-event-becomes-a-leaf), verifies an inclusion proof against them, and compares any event it verified before against what it recorded then. Finally, it saves the new checkpoint and its progress to the `--state` file, which the next run starts from. Run it at least daily. Hourly is reasonable. With a parent-organization key, run one copy for each child organization, each with its own `--org` and `--state` file. Each child organization's UUID also comes from the Claude Console, not from the Compliance API responses you are verifying. To find it, switch to the child organization in the account menu at the bottom of the Console sidebar, then open the [Organization](https://platform.claude.com/settings/organization) page (`platform.claude.com/settings/organization`). You can also find it in your parent organization's list of organizations in the Console. `axt-verify checkpoint` does only the checkpoint and append-only steps. `axt-verify events FILE` verifies events you already hold, such as an auditor's sample or your own export. It proves that each event in the file is still committed in the log under the current checkpoint. It does not read the feed or touch the state file.
 
 One limit follows from that window: `run` re-reads only the last 7 days of events, so it re-checks recently served events (step 7), not your whole history. Keep the events you export (see [Keep your own checkpoint archive](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#keep-your-own-checkpoint-archive)). `axt-verify events FILE` proves at any later date that those copies are still committed in the log, but it does not re-read the feed. To detect an older event removed from or rewritten on the feed, re-export that range from the Activity Feed and compare it with the copies you kept. You can also verify the re-export itself with `axt-verify events FILE`. The 7-day overlap is longer than the feed's 2-business-day delivery time, so a late-arriving event still falls inside a later run's window. `--overlap` changes the duration if you need to.
 
@@ -401,8 +449,8 @@ If you need your own implementation instead, follow the preceding checklist with
 
 `axt-verify` prints your origin, the tree size and root hash of the checkpoint it verified, the tree size the append-only check started from, and a count of events by outcome. Pass `--json` to get the same report as one JSON object on each line. Each event has one of four outcomes:
 
-* **Verified:** the leaf rebuilt from the served event is committed at the event's index in the signed log.
-* **Pending:** the event's index is beyond the latest published checkpoint. This is normal for a short time after an event appears. In `run`, `axt-verify` remembers the event, verifies it on a later run once a checkpoint covers it, and fails it if that takes longer than 24 hours. `events FILE` has no later run to settle it, so it waits up to a minute for a covering checkpoint to be published. If none arrives, it reports the event as not yet covered and ends with exit status `3`. Run it again later. If `events FILE` reports the same event as not yet covered on two runs at least a day apart, treat it as a verification failure and escalate as for exit status `1`.
+* **Verified:** a leaf rebuilt from the served event is committed at the event's index in the signed log.
+* **Pending:** the event's index is beyond the latest published checkpoint. This is normal for a short time after an event appears. In `run`, `axt-verify` records the event, verifies it on a later run once a checkpoint covers it, and fails it if that takes longer than 24 hours. `events FILE` has no later run to settle it, so it waits up to a minute for a covering checkpoint to be published. If none arrives, it reports the event as not yet covered and ends with exit status `3`. Run it again later. If `events FILE` reports the same event as not yet covered on two runs at least a day apart, treat it as a verification failure and escalate as for exit status `1`.
 * **Not logged:** the event was served without an index. An event is served without `transparency_log_leaf_index` only while your organization is not enrolled in Access Transparency, or when it was recorded before your organization's log was created (see [The `transparency_log_leaf_index` field on Activity Feed events](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#the-transparency-log-leaf-index-field-on-activity-feed-events)). `axt-verify` reports such events as not logged and does not fail the run on them. An index-less event is not expected when it is dated after your log was created and falls inside a period when you were enrolled. Review the not-logged list in the run's summary or `--json` output rather than relying on the exit status alone.
 * **Failed:** see exit status `1`.
 
@@ -410,14 +458,14 @@ The exit status tells your scheduler what occurred:
 
 * **`0`:** Nothing failed. Not-logged events are reported, not failed, and so are pending events in `run`.
 
-* **`1`:** A verification failure. This is a security finding, not a transient error. Keep the state file and the output, and report it to your Anthropic account representative or [Anthropic support](https://support.claude.com). The causes are:
+* **`1`:** A verification failure. If every new event fails because its inclusion proof does not reproduce the signed root hash, first rule out a release that does not rebuild your log's newest leaf version, as that item in this list describes. If that is not the cause, and for any other failure, treat it as a security finding, not a transient error. Keep the state file and the output, and report it to your Anthropic account representative or [Anthropic support](https://support.claude.com). The causes are:
 
   * A checkpoint with the wrong origin, or a signature that does not verify under the key built into your `axt-verify` release. Compare the `key_hash` on the failing checkpoint's signature line with [Published key fingerprints](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#published-key-fingerprints). A key listed there with a switch date you have not upgraded for means you need the matching release. A key not listed there is a security finding, whatever release you run. On this failure `axt-verify` prints the key hash of every signature on the served checkpoint and the key hash of the key it trusts, as eight hex digits each. That output is enough to make the comparison.
   * A checkpoint that is not a well-formed signed note, for example one whose root hash is not 32 bytes.
   * A log that shrank, or that cannot prove it extends the checkpoint you saved. The output then carries both checkpoints and the proof, so the evidence stands on its own.
   * Two signed checkpoints for the same tree size with different root hashes. The output carries both checkpoints.
   * A checkpoint file passed with `--from` whose signature does not verify under the key built into your `axt-verify` release, or a `--from` or `--from-trusted` file whose origin is not yours. For an archive signed before a key rotation, see [Keep your own checkpoint archive](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#keep-your-own-checkpoint-archive).
-  * An inclusion proof that does not reproduce the signed root hash for the event you were served.
+  * An inclusion proof that does not reproduce the signed root hash for the event you were served. A release that does not rebuild a leaf version reports this for every event whose leaf has that version. If every new event fails this way at once, check first that you run the newest `axt-verify` release (see [Upgrade for a new leaf version](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#upgrade-for-a-new-leaf-version)). If you do not, copy the state file, keep the copy and the output, and run the newest release on the original `--state` file. The failures clear once you run a release that rebuilds the version. If you already run the newest release, or the failures remain after you upgrade, it is a security finding.
   * An event inside the run's window served differently from how an earlier run recorded it: different leaf bytes, a different index, or no index where it had one.
   * An event still pending 24 hours after the run first saw it.
   * A refused inclusion proof (`400`, `401`, or `403`) for an event the feed served you.
@@ -462,6 +510,10 @@ The strongest evidence you can hold is your own record of what the log said on a
     Planned rotations are announced in [Published key fingerprints](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#published-key-fingerprints) at least 30 days ahead, with a switch date. On the switch date Anthropic starts signing with the new key and publishes the `axt-verify` release that carries it. On the same date Anthropic re-issues every organization's latest checkpoint under the new key, even for a log that has not grown. Each `axt-verify` release carries one key, so upgrade on the switch date. Running the old release after the switch fails with exit status `1`, and so does running the new release before it. Either failure clears once you run the matching release. Checkpoints you saved under the old key stay valid starting points, because the append-only proof from a saved checkpoint to a new one does not depend on which key signed the old one. The new key appears at the front of the [verifier key set](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#read-the-verifier-keys) and earlier keys stay listed. Checkpoints you already verified or archived therefore keep verifying against that set. A verifier of your own that pins the published fingerprints needs the new fingerprint, with its switch date, added before that date. A verifier that holds the key set locally re-fetches it when it meets a signature whose key hash it does not hold. A checkpoint commits to the whole history. Once one checkpoint signed by the new key verifies, and a consistency proof from your saved checkpoint leads to it, every earlier entry is re-established as well.
   </Accordion>
 
+  <Accordion title="What is a leaf version, and do I need to track which one a leaf has?">
+    A leaf version is the first byte of a leaf entry. It says which set of fields the leaf commits to (see [How an event becomes a leaf](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#how-an-event-becomes-a-leaf)). You do not need to track it. Your log can hold leaves of more than one version, and a verifier rebuilds the entries that the last rule in that section names for an event, and accepts the event if its inclusion proof matches one. What you do need is an `axt-verify` release that rebuilds the newest version your log writes (see [Upgrade for a new leaf version](https://platform.claude.com/docs/en/manage-claude/access-transparency-log#upgrade-for-a-new-leaf-version)).
+  </Accordion>
+
   <Accordion title="Can I compute proofs myself instead of calling the proof endpoints?">
     Yes. Hash tiles are the primary interface, and a tlog-tiles client that supports ECDSA note keys can compute inclusion and consistency proofs from them. The proof endpoints are a convenience. A generic client needs a thin wrapper to send the `x-api-key` header and, for a parent-organization key, the `organization_id` parameter.
   </Accordion>
diff --git a/content/en/manage-claude/access-transparency.md b/content/en/manage-claude/access-transparency.md
index f5a497b876..1263738791 100644
--- a/content/en/manage-claude/access-transparency.md
+++ b/content/en/manage-claude/access-transparency.md
@@ -95,7 +95,7 @@ Each `anthropic_access` activity carries the standard Activity fields plus the f
 
 Example JSON message:
 
-```text wrap
+```json
 {
   "id": "activity_013b013744txqZtFHLUaRqLr",
   "type": "anthropic_access",
@@ -132,7 +132,7 @@ curl --fail-with-body -sS -G \
 
 Example JSON message:
 
-```text wrap
+```json
 {
   "id": "activity_01AbCdEfGhJkMnPqRsTuVwXy",
   "type": "cmek_preserve",
@@ -186,7 +186,7 @@ Access Transparency applies from the time it is enabled for your organization. C
 
 ### Notification timing
 
-`anthropic_access` and `cmek_preserve` events are delivered to your Compliance API feed within 2 business days of the access or preservation they record. This feed should not be treated as a real-time alerting channel, and the `accessed_at` timestamp reflects when the access occurred, which might be up to 2 business days before the activity becomes visible in your feed. The `created_at` field reflects the time Anthropic recorded the event, and the event usually becomes visible in your feed shortly after that time. These events do not follow the Activity Feed's usual 1-minute [indexing lag](https://platform.claude.com/docs/en/manage-claude/compliance-integration-patterns#window-polling): an event can become visible up to 2 business days after its `created_at`. If you poll the feed by `created_at` window, overlap consecutive windows by at least 2 business days for `anthropic_access` and `cmek_preserve` events so that a late-indexed event is not dropped.
+`anthropic_access` and `cmek_preserve` events are delivered to your Compliance API feed within 2 business days of the access or preservation they record. Do not treat this feed as a real-time alerting channel. The `accessed_at` timestamp reflects when the access occurred, which might be up to 2 business days before the activity becomes visible in your feed. The `created_at` field reflects the time Anthropic recorded the event, and the event usually becomes visible in your feed shortly after that time. These events do not follow the Activity Feed's usual 1-minute [indexing lag](https://platform.claude.com/docs/en/manage-claude/compliance-integration-patterns#window-polling): an event can become visible up to 2 business days after its `created_at`. If you poll the feed by `created_at` window, overlap consecutive windows by at least 2 business days for `anthropic_access` and `cmek_preserve` events so that a late-indexed event is not dropped.
 
 ### Automated processing does not generate access events
 
@@ -232,7 +232,7 @@ For organizations that also enable CMEK, your cloud KMS audit log (CloudTrail, C
   </Accordion>
 
   <Accordion title="How does Access Transparency relate to CMEK?">
-    They are independent. With CMEK, safety preservation outside your key emits a separate `cmek_preserve` event on the same feed. See [CMEK content preservation](https://platform.claude.com/docs/en/manage-claude/access-transparency#cmek-content-preservation) and [Customer-managed encryption keys](https://platform.claude.com/docs/en/manage-claude/cmek).
+    They are independent. With CMEK, safety preservation outside your key emits a separate `cmek_preserve` event on the same feed. See [CMEK content preservation](https://platform.claude.com/docs/en/manage-claude/access-transparency#cmek-content-preservation) and [Limited preservation outside your key](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#limited-preservation-outside-your-key).
   </Accordion>
 
   <Accordion title="How can I tell that my Access Transparency record has not been altered?">
diff --git a/content/en/manage-claude/admin-api.md b/content/en/manage-claude/admin-api.md
index c90143dbc1..c81ce27cd2 100644
--- a/content/en/manage-claude/admin-api.md
+++ b/content/en/manage-claude/admin-api.md
@@ -345,7 +345,7 @@ Update a member's role:
 
 <CodeGroup>
   ```bash cURL
-  curl "https://api.anthropic.com/v1/organizations/users/user_01XyDMpzjS89pFZXqSFUBDr6" \
+  curl "https://api.anthropic.com/v1/organizations/users/user_01WxYzAbCdEfGhJkMnPqRsTu" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01" \
     -H "content-type: application/json" \
@@ -354,7 +354,7 @@ Update a member's role:
 
   ```bash CLI
   ant organization:users update \
-    --user-id user_01XyDMpzjS89pFZXqSFUBDr6 \
+    --user-id user_01WxYzAbCdEfGhJkMnPqRsTu \
     --role developer
   ```
 
@@ -362,7 +362,7 @@ Update a member's role:
   client = anthropic.Anthropic()
 
   user = client.organization.users.update(
-      "user_01XyDMpzjS89pFZXqSFUBDr6", role="developer"
+      "user_01WxYzAbCdEfGhJkMnPqRsTu", role="developer"
   )
 
   print(f"id: {user.id}")
@@ -372,7 +372,7 @@ Update a member's role:
   ```typescript TypeScript
   const client = new Anthropic();
 
-  const user = await client.organization.users.update("user_01XyDMpzjS89pFZXqSFUBDr6", {
+  const user = await client.organization.users.update("user_01WxYzAbCdEfGhJkMnPqRsTu", {
     role: "developer"
   });
 
@@ -387,7 +387,7 @@ Update a member's role:
   AnthropicClient client = new();
 
   var user = await client.Organization.Users.Update(
-      "user_01XyDMpzjS89pFZXqSFUBDr6",
+      "user_01WxYzAbCdEfGhJkMnPqRsTu",
       new() { Role = Role.Developer }
   );
 
@@ -400,7 +400,7 @@ Update a member's role:
 
   user, err := client.Organization.Users.Update(
   	context.Background(),
-  	"user_01XyDMpzjS89pFZXqSFUBDr6",
+  	"user_01WxYzAbCdEfGhJkMnPqRsTu",
   	anthropic.OrganizationUserUpdateParams{
   		Role: anthropic.OrganizationUserUpdateParamsRoleDeveloper,
   	},
@@ -423,7 +423,7 @@ Update a member's role:
           .role(UserUpdateParams.Role.DEVELOPER)
           .build();
       var user = client.organization().users()
-          .update("user_01XyDMpzjS89pFZXqSFUBDr6", params);
+          .update("user_01WxYzAbCdEfGhJkMnPqRsTu", params);
 
       IO.println("id: " + user.id());
       IO.println("role: " + user.role().asString());
@@ -437,7 +437,7 @@ Update a member's role:
   $client = new Client();
 
   $user = $client->organization->users->update(
-      userID: 'user_01XyDMpzjS89pFZXqSFUBDr6',
+      userID: 'user_01WxYzAbCdEfGhJkMnPqRsTu',
       role: Role::DEVELOPER,
   );
 
@@ -448,7 +448,7 @@ Update a member's role:
   ```ruby Ruby
   client = Anthropic::Client.new
 
-  user_id = "user_01XyDMpzjS89pFZXqSFUBDr6"
+  user_id = "user_01WxYzAbCdEfGhJkMnPqRsTu"
   user = client.organization.users.update(user_id, role: :developer)
 
   puts "id: #{user.id}"
@@ -460,19 +460,19 @@ Remove a member from the organization:
 
 <CodeGroup>
   ```bash cURL
-  curl -X DELETE "https://api.anthropic.com/v1/organizations/users/user_01XyDMpzjS89pFZXqSFUBDr6" \
+  curl -X DELETE "https://api.anthropic.com/v1/organizations/users/user_01WxYzAbCdEfGhJkMnPqRsTu" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01"
   ```
 
   ```bash CLI
-  ant organization:users remove --user-id user_01XyDMpzjS89pFZXqSFUBDr6
+  ant organization:users remove --user-id user_01WxYzAbCdEfGhJkMnPqRsTu
   ```
 
   ```python Python
   client = anthropic.Anthropic()
 
-  removed_user = client.organization.users.remove("user_01XyDMpzjS89pFZXqSFUBDr6")
+  removed_user = client.organization.users.remove("user_01WxYzAbCdEfGhJkMnPqRsTu")
 
   print(f"id: {removed_user.id}")
   ```
@@ -480,7 +480,7 @@ Remove a member from the organization:
   ```typescript TypeScript
   const client = new Anthropic();
 
-  const removedUser = await client.organization.users.remove("user_01XyDMpzjS89pFZXqSFUBDr6");
+  const removedUser = await client.organization.users.remove("user_01WxYzAbCdEfGhJkMnPqRsTu");
 
   console.log(`id: ${removedUser.id}`);
   ```
@@ -488,7 +488,7 @@ Remove a member from the organization:
   ```csharp C#
   AnthropicClient client = new();
 
-  var removedUser = await client.Organization.Users.Remove("user_01XyDMpzjS89pFZXqSFUBDr6");
+  var removedUser = await client.Organization.Users.Remove("user_01WxYzAbCdEfGhJkMnPqRsTu");
 
   Console.WriteLine($"id: {removedUser.ID}");
   ```
@@ -496,7 +496,7 @@ Remove a member from the organization:
   ```go Go
   client := anthropic.NewClient()
 
-  removedUser, err := client.Organization.Users.Remove(context.Background(), "user_01XyDMpzjS89pFZXqSFUBDr6")
+  removedUser, err := client.Organization.Users.Remove(context.Background(), "user_01WxYzAbCdEfGhJkMnPqRsTu")
   if err != nil {
   	log.Fatal(err)
   }
@@ -508,7 +508,7 @@ Remove a member from the organization:
   AnthropicClient client = AnthropicOkHttpClient.fromEnv();
 
   var removedUser = client.organization().users()
-      .remove("user_01XyDMpzjS89pFZXqSFUBDr6");
+      .remove("user_01WxYzAbCdEfGhJkMnPqRsTu");
 
   IO.println("id: " + removedUser.id());
   ```
@@ -517,7 +517,7 @@ Remove a member from the organization:
   $client = new Client();
 
   $removedUser = $client->organization->users->remove(
-      userID: 'user_01XyDMpzjS89pFZXqSFUBDr6',
+      userID: 'user_01WxYzAbCdEfGhJkMnPqRsTu',
   );
 
   echo "id: {$removedUser->id}\n";
@@ -526,7 +526,7 @@ Remove a member from the organization:
   ```ruby Ruby
   client = Anthropic::Client.new
 
-  user_id = "user_01XyDMpzjS89pFZXqSFUBDr6"
+  user_id = "user_01WxYzAbCdEfGhJkMnPqRsTu"
   removed_user = client.organization.users.remove(user_id)
 
   puts "id: #{removed_user.id}"
@@ -859,7 +859,7 @@ Add a member to a workspace:
     -H "anthropic-version: 2023-06-01" \
     -H "content-type: application/json" \
     -d '{
-      "user_id": "user_01XyDMpzjS89pFZXqSFUBDr6",
+      "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
       "workspace_role": "workspace_developer"
     }'
   ```
@@ -867,7 +867,7 @@ Add a member to a workspace:
   ```bash CLI
   ant organization:workspaces:members add \
     --workspace-id wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ \
-    --user-id user_01XyDMpzjS89pFZXqSFUBDr6 \
+    --user-id user_01WxYzAbCdEfGhJkMnPqRsTu \
     --workspace-role workspace_developer
   ```
 
@@ -876,7 +876,7 @@ Add a member to a workspace:
 
   member = client.organization.workspaces.members.add(
       "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
-      user_id="user_01XyDMpzjS89pFZXqSFUBDr6",
+      user_id="user_01WxYzAbCdEfGhJkMnPqRsTu",
       workspace_role="workspace_developer",
   )
 
@@ -890,7 +890,7 @@ Add a member to a workspace:
   const member = await client.organization.workspaces.members.add(
     "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
     {
-      user_id: "user_01XyDMpzjS89pFZXqSFUBDr6",
+      user_id: "user_01WxYzAbCdEfGhJkMnPqRsTu",
       workspace_role: "workspace_developer"
     }
   );
@@ -908,7 +908,7 @@ Add a member to a workspace:
       "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
       new()
       {
-          UserID = "user_01XyDMpzjS89pFZXqSFUBDr6",
+          UserID = "user_01WxYzAbCdEfGhJkMnPqRsTu",
           WorkspaceRole = NoBillingWorkspaceRole.WorkspaceDeveloper
       }
   );
@@ -924,7 +924,7 @@ Add a member to a workspace:
   	context.Background(),
   	"wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
   	anthropic.OrganizationWorkspaceMemberAddParams{
-  		UserID:        "user_01XyDMpzjS89pFZXqSFUBDr6",
+  		UserID:        "user_01WxYzAbCdEfGhJkMnPqRsTu",
   		WorkspaceRole: anthropic.NoBillingWorkspaceRoleWorkspaceDeveloper,
   	},
   )
@@ -944,7 +944,7 @@ Add a member to a workspace:
       AnthropicClient client = AnthropicOkHttpClient.fromEnv();
 
       var params = MemberAddParams.builder()
-          .userId("user_01XyDMpzjS89pFZXqSFUBDr6")
+          .userId("user_01WxYzAbCdEfGhJkMnPqRsTu")
           .workspaceRole(NoBillingWorkspaceRole.WORKSPACE_DEVELOPER)
           .build();
       var member = client.organization().workspaces().members()
@@ -963,7 +963,7 @@ Add a member to a workspace:
 
   $member = $client->organization->workspaces->members->add(
       workspaceID: 'wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ',
-      userID: 'user_01XyDMpzjS89pFZXqSFUBDr6',
+      userID: 'user_01WxYzAbCdEfGhJkMnPqRsTu',
       workspaceRole: NoBillingWorkspaceRole::WORKSPACE_DEVELOPER,
   );
 
@@ -977,7 +977,7 @@ Add a member to a workspace:
   workspace_id = "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
   member = client.organization.workspaces.members.add(
     workspace_id,
-    user_id: "user_01XyDMpzjS89pFZXqSFUBDr6",
+    user_id: "user_01WxYzAbCdEfGhJkMnPqRsTu",
     workspace_role: :workspace_developer
   )
 
@@ -1107,7 +1107,7 @@ Update a workspace member's role:
 
 <CodeGroup>
   ```bash cURL
-  curl "https://api.anthropic.com/v1/organizations/workspaces/wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ/members/user_01XyDMpzjS89pFZXqSFUBDr6" \
+  curl "https://api.anthropic.com/v1/organizations/workspaces/wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ/members/user_01WxYzAbCdEfGhJkMnPqRsTu" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01" \
     -H "content-type: application/json" \
@@ -1116,7 +1116,7 @@ Update a workspace member's role:
 
   ```bash CLI
   ant organization:workspaces:members update \
-    --user-id user_01XyDMpzjS89pFZXqSFUBDr6 \
+    --user-id user_01WxYzAbCdEfGhJkMnPqRsTu \
     --workspace-id wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ \
     --workspace-role workspace_admin
   ```
@@ -1125,7 +1125,7 @@ Update a workspace member's role:
   client = anthropic.Anthropic()
 
   member = client.organization.workspaces.members.update(
-      "user_01XyDMpzjS89pFZXqSFUBDr6",
+      "user_01WxYzAbCdEfGhJkMnPqRsTu",
       workspace_id="wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
       workspace_role="workspace_admin",
   )
@@ -1138,7 +1138,7 @@ Update a workspace member's role:
   const client = new Anthropic();
 
   const member = await client.organization.workspaces.members.update(
-    "user_01XyDMpzjS89pFZXqSFUBDr6",
+    "user_01WxYzAbCdEfGhJkMnPqRsTu",
     {
       workspace_id: "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
       workspace_role: "workspace_admin"
@@ -1155,7 +1155,7 @@ Update a workspace member's role:
   AnthropicClient client = new();
 
   var member = await client.Organization.Workspaces.Members.Update(
-      "user_01XyDMpzjS89pFZXqSFUBDr6",
+      "user_01WxYzAbCdEfGhJkMnPqRsTu",
       new()
       {
           WorkspaceID = "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
@@ -1172,7 +1172,7 @@ Update a workspace member's role:
 
   member, err := client.Organization.Workspaces.Members.Update(
   	context.Background(),
-  	"user_01XyDMpzjS89pFZXqSFUBDr6",
+  	"user_01WxYzAbCdEfGhJkMnPqRsTu",
   	anthropic.OrganizationWorkspaceMemberUpdateParams{
   		WorkspaceID:   "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
   		WorkspaceRole: anthropic.WorkspaceRoleWorkspaceAdmin,
@@ -1198,7 +1198,7 @@ Update a workspace member's role:
           .workspaceRole(WorkspaceRole.WORKSPACE_ADMIN)
           .build();
       var member = client.organization().workspaces().members()
-          .update("user_01XyDMpzjS89pFZXqSFUBDr6", params);
+          .update("user_01WxYzAbCdEfGhJkMnPqRsTu", params);
 
       IO.println("user_id: " + member.userId());
       IO.println("workspace_role: " + member.workspaceRole().asString());
@@ -1212,7 +1212,7 @@ Update a workspace member's role:
   $client = new Client();
 
   $member = $client->organization->workspaces->members->update(
-      userID: 'user_01XyDMpzjS89pFZXqSFUBDr6',
+      userID: 'user_01WxYzAbCdEfGhJkMnPqRsTu',
       workspaceID: 'wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ',
       workspaceRole: WorkspaceRole::WORKSPACE_ADMIN,
   );
@@ -1224,7 +1224,7 @@ Update a workspace member's role:
   ```ruby Ruby
   client = Anthropic::Client.new
 
-  user_id = "user_01XyDMpzjS89pFZXqSFUBDr6"
+  user_id = "user_01WxYzAbCdEfGhJkMnPqRsTu"
   member = client.organization.workspaces.members.update(
     user_id,
     workspace_id: "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
@@ -1240,14 +1240,14 @@ Remove a member from a workspace:
 
 <CodeGroup>
   ```bash cURL
-  curl -X DELETE "https://api.anthropic.com/v1/organizations/workspaces/wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ/members/user_01XyDMpzjS89pFZXqSFUBDr6" \
+  curl -X DELETE "https://api.anthropic.com/v1/organizations/workspaces/wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ/members/user_01WxYzAbCdEfGhJkMnPqRsTu" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01"
   ```
 
   ```bash CLI
   ant organization:workspaces:members remove \
-    --user-id user_01XyDMpzjS89pFZXqSFUBDr6 \
+    --user-id user_01WxYzAbCdEfGhJkMnPqRsTu \
     --workspace-id wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ
   ```
 
@@ -1255,7 +1255,7 @@ Remove a member from a workspace:
   client = anthropic.Anthropic()
 
   removed_member = client.organization.workspaces.members.remove(
-      "user_01XyDMpzjS89pFZXqSFUBDr6", workspace_id="wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
+      "user_01WxYzAbCdEfGhJkMnPqRsTu", workspace_id="wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
   )
 
   print(f"user_id: {removed_member.user_id}")
@@ -1265,7 +1265,7 @@ Remove a member from a workspace:
   const client = new Anthropic();
 
   const removedMember = await client.organization.workspaces.members.remove(
-    "user_01XyDMpzjS89pFZXqSFUBDr6",
+    "user_01WxYzAbCdEfGhJkMnPqRsTu",
     { workspace_id: "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" }
   );
 
@@ -1276,7 +1276,7 @@ Remove a member from a workspace:
   AnthropicClient client = new();
 
   var removedMember = await client.Organization.Workspaces.Members.Remove(
-      "user_01XyDMpzjS89pFZXqSFUBDr6",
+      "user_01WxYzAbCdEfGhJkMnPqRsTu",
       new() { WorkspaceID = "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" }
   );
 
@@ -1288,7 +1288,7 @@ Remove a member from a workspace:
 
   removedMember, err := client.Organization.Workspaces.Members.Remove(
   	context.Background(),
-  	"user_01XyDMpzjS89pFZXqSFUBDr6",
+  	"user_01WxYzAbCdEfGhJkMnPqRsTu",
   	anthropic.OrganizationWorkspaceMemberRemoveParams{
   		WorkspaceID: "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
   	},
@@ -1310,7 +1310,7 @@ Remove a member from a workspace:
           .workspaceId("wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ")
           .build();
       var removedMember = client.organization().workspaces().members()
-          .remove("user_01XyDMpzjS89pFZXqSFUBDr6", params);
+          .remove("user_01WxYzAbCdEfGhJkMnPqRsTu", params);
 
       IO.println("user_id: " + removedMember.userId());
   }
@@ -1320,7 +1320,7 @@ Remove a member from a workspace:
   $client = new Client();
 
   $removedMember = $client->organization->workspaces->members->remove(
-      userID: 'user_01XyDMpzjS89pFZXqSFUBDr6',
+      userID: 'user_01WxYzAbCdEfGhJkMnPqRsTu',
       workspaceID: 'wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ',
   );
 
@@ -1330,7 +1330,7 @@ Remove a member from a workspace:
   ```ruby Ruby
   client = Anthropic::Client.new
 
-  user_id = "user_01XyDMpzjS89pFZXqSFUBDr6"
+  user_id = "user_01WxYzAbCdEfGhJkMnPqRsTu"
   removed_member = client.organization.workspaces.members.remove(
     user_id,
     workspace_id: "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
@@ -1704,7 +1704,7 @@ The `/v1/organizations/me` endpoint returns the organization that your credentia
   ```
 </CodeGroup>
 
-```text wrap
+```json
 {
   "id": "12345678-1234-5678-1234-567812345678",
   "type": "organization",
diff --git a/content/en/manage-claude/analytics-api.md b/content/en/manage-claude/analytics-api.md
index d851fd9f49..dcc5023061 100644
--- a/content/en/manage-claude/analytics-api.md
+++ b/content/en/manage-claude/analytics-api.md
@@ -95,7 +95,11 @@ Claude Enterprise Analytics API data is available for dates on or after January
 
 ## How metrics are defined
 
-**Active users.** A user counts as active for a day if any of the following is true: they sent at least one chat message in Claude, they had at least one Claude Code session (local or remote) associated with your Claude Enterprise organization that included tool use or git activity, or they had at least one Cowork session with tool use or message activity.
+**Active users.** A user counts as active for a day if any of the following is true:
+
+* They sent at least one chat message in Claude.
+* They had at least one Claude Code session (local or remote) associated with your Claude Enterprise organization that included tool use or git activity.
+* They had at least one Cowork session with tool use or message activity.
 
 **Chat and Cowork unified (beta).** Chat and Cowork unified brings Cowork's features into claude.ai chat. Most activity in Chat and Cowork unified is reported under the `chat_cowork_unified` product value, not `chat` or `cowork`.
 
diff --git a/content/en/manage-claude/api-and-data-retention.md b/content/en/manage-claude/api-and-data-retention.md
index bca4660a76..c768c1f81c 100644
--- a/content/en/manage-claude/api-and-data-retention.md
+++ b/content/en/manage-claude/api-and-data-retention.md
@@ -78,7 +78,7 @@ When using [structured outputs](https://platform.claude.com/docs/en/build-with-c
 
 Your signed BAA is the official source of truth for which features are covered. The API also enforces these restrictions automatically. When a HIPAA-enabled organization sends a request that includes a non-eligible feature, the API returns a `400` error to prevent accidental use of features not covered by your BAA:
 
-```text
+```json
 {
   "type": "error",
   "error": {
@@ -126,7 +126,7 @@ Whichever path you use, confirm which features are supported in the [feature eli
 
 Claude Fable 5.1, Claude Mythos 5.1, Claude Fable 5, and Claude Mythos 5 are designated Covered Models (see the [Covered Models support article](https://support.claude.com/en/articles/15425695)) and require 30-day data retention; ZDR is therefore not available for any of them unless expressly authorized by Anthropic. On the Claude API, requests to Claude Fable 5 from an organization whose data retention configuration does not meet this requirement return a `400 invalid_request_error`:
 
-```text
+```json
 {
   "type": "error",
   "error": {
@@ -202,7 +202,7 @@ Each eligibility column uses three values:
 | [Thinking](https://platform.claude.com/docs/en/build-with-claude/thinking)                                                 | `/v1/messages`<br />with `thinking`                      | <Eligible>Yes</Eligible>                                | <Eligible>Yes</Eligible>            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
 | [Token counting](https://platform.claude.com/docs/en/build-with-claude/token-counting)                                     | `/v1/messages/count_tokens`                              | <Eligible>Yes</Eligible>                                | <Eligible>Yes</Eligible>            | Count tokens before sending requests.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
 | [Tool search](https://platform.claude.com/docs/en/agents-and-tools/tool-use/tool-search-tool)                              | `/v1/messages`<br />with `tool_search` tool              | <Eligible>Yes</Eligible>                                | <Eligible status="no">No</Eligible> | Server-side tool run by Anthropic; the tool definitions in the request are searched in memory per call and nothing is stored after the response.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
-| [User profiles](https://platform.claude.com/docs/en/manage-claude/user-profiles)                                           | `/v1/user_profiles`                                      | <Eligible status="no">No</Eligible>                     | <Eligible status="no">No</Eligible> | Profiles are metadata about your end customers and don't contain prompts or outputs. The profile data you send is retained according to standard policy until you delete the profile. Not covered under HIPAA readiness; requests to `/v1/user_profiles` are not blocked. See [What a profile contains and how Anthropic uses it](https://platform.claude.com/docs/en/manage-claude/user-profiles#what-a-profile-contains-and-how-anthropic-uses-it).                                                                                                                                                                           |
+| [User profiles](https://platform.claude.com/docs/en/manage-claude/user-profiles)                                           | `/v1/user_profiles`                                      | <Eligible status="no">No</Eligible>                     | <Eligible status="no">No</Eligible> | Profiles are metadata about your end customers and don't contain prompts or outputs. The profile data you send is retained according to standard policy until you delete the profile. HIPAA-enabled organizations can use user profiles, but the user profiles API is not a HIPAA-eligible service and PHI must not be included in the profile data you send. See [What a profile contains and how Anthropic uses it](https://platform.claude.com/docs/en/manage-claude/user-profiles#what-a-profile-contains-and-how-anthropic-uses-it).                                                                                       |
 | [Web fetch](https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-fetch-tool)                                  | `/v1/messages`<br />with `web_fetch` tool                | <Eligible>Yes</Eligible>                                | <Eligible status="no">No</Eligible> | Fetched web content returned in the API response. [Dynamic filtering for web fetch](https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-fetch-tool#dynamic-filtering) is not eligible for ZDR or HIPAA. Website publishers might retain request data (such as fetched URLs and request metadata) according to their own policies.                                                                                                                                                                                                                                                                                 |
 | [Web search](https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-search-tool)                                | `/v1/messages`<br />with `web_search` tool               | <Eligible>Yes</Eligible>                                | <Eligible>Yes</Eligible>            | Real-time web search results returned in the API response. [Dynamic filtering for web search](https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-search-tool#dynamic-filtering) is not eligible for ZDR or HIPAA.                                                                                                                                                                                                                                                                                                                                                                                                |
 
diff --git a/content/en/manage-claude/authentication.md b/content/en/manage-claude/authentication.md
index 30ae2fe983..d7a6d205df 100644
--- a/content/en/manage-claude/authentication.md
+++ b/content/en/manage-claude/authentication.md
@@ -311,7 +311,7 @@ You can find a workspace's ID in the **ID** column on the [Workspaces](https://p
 
 If a request made with a key that isn't scoped to a workspace omits the header, the API returns a 400 `invalid_request_error`:
 
-```text JSON
+```json JSON
 {
   "type": "error",
   "error": {
@@ -354,7 +354,7 @@ To replace a workspace key with a personal or service account key:
 
 ## Workload Identity Federation
 
-Workload Identity Federation (WIF) lets a workload authenticate with a short-lived identity token issued by an identity provider (IdP) you already trust, such as AWS IAM, Google Cloud, or any standards-compliant OIDC issuer (such as GitHub Actions, Kubernetes service accounts, SPIFFE, Microsoft Entra ID, or Okta). The workload exchanges its IdP-issued JWT at `POST /v1/oauth/token` for a short-lived Claude API access token, and the SDK refreshes that token automatically before it expires. There is no `sk-ant-api...` string to mint, distribute, or rotate.
+Workload Identity Federation (WIF) lets a workload authenticate with a short-lived identity token issued by an identity provider (IdP) you already trust. Such IdPs include AWS IAM, Google Cloud, and any standards-compliant OIDC issuer (such as GitHub Actions, Kubernetes service accounts, SPIFFE, Microsoft Entra ID, or Okta). The workload exchanges its IdP-issued JWT at `POST /v1/oauth/token` for a short-lived Claude API access token, and the SDK refreshes that token automatically before it expires. There is no `sk-ant-api...` string to mint, distribute, or rotate.
 
 Federation removes long-lived Claude API keys from your environment, which limits the damage that a leaked credential can cause and lets you manage access with the same IdP controls you already use for cloud resources. It does not, on its own, guarantee end-to-end security: the trust chain is only as strong as your identity provider's configuration, and a long-lived secret one step earlier in that chain (for example, a static cloud credential that can mint IdP tokens) can still undermine it. Pair federation with your provider's controls, such as IP allowlists, MFA, and audit logging.
 
diff --git a/content/en/manage-claude/claude-code-analytics-api.md b/content/en/manage-claude/claude-code-analytics-api.md
index 26b906d8e3..b4889c0300 100644
--- a/content/en/manage-claude/claude-code-analytics-api.md
+++ b/content/en/manage-claude/claude-code-analytics-api.md
@@ -147,7 +147,7 @@ For each Claude model used:
 
 The API returns data in the following format:
 
-```text wrap
+```json
 {
   "data": [
     {
diff --git a/content/en/manage-claude/cmek-admin-api.md b/content/en/manage-claude/cmek-admin-api.md
new file mode 100644
index 0000000000..d195b42930
--- /dev/null
+++ b/content/en/manage-claude/cmek-admin-api.md
@@ -0,0 +1,740 @@
+---
+title: Add and attach an encryption key with the Admin API
+url: https://platform.claude.com/docs/en/manage-claude/cmek-admin-api
+description: Create, validate, and attach a customer-managed encryption key with three Admin API calls.
+---
+
+These calls work on Claude Platform. On Claude Enterprise or Claude Platform on AWS, follow [your setup page](https://platform.claude.com/docs/en/manage-claude/cmek#set-it-up).
+
+Creating an external key is what **Add key** does in the Claude Console, and validating it is what **Verify** does.
+
+## Before you start
+
+* Customer-managed encryption keys (CMEK) are [turned on for your organization](https://platform.claude.com/docs/en/manage-claude/cmek#availability).
+* You have an [Admin API key](https://platform.claude.com/docs/en/manage-claude/admin-api-keys). The samples read it from `ANTHROPIC_API_KEY`.
+* You've created your key in [AWS KMS](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#encryption-key-setup), [Google Cloud KMS](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#encryption-key-setup), or [Azure Key Vault](https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault#encryption-key-setup), and kept the values the setup steps tell you to copy.
+* You have a workspace that [retains data](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#data-retention), ideally a new one, because [existing data stays under Anthropic's key](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect).
+
+## Create, validate, and attach the key
+
+<Steps>
+  <Step title="Create the external key">
+    <Tabs>
+      <Tab title="AWS">
+        Replace `<friendly-name>` with a display name and `<key-arn-from-create-key-step>` with the key ARN.
+
+        <CodeGroup>
+          ```bash cURL
+          curl -sS "https://api.anthropic.com/v1/organizations/external_keys" \
+            -H "x-api-key: $ANTHROPIC_API_KEY" \
+            -H "anthropic-version: 2023-06-01" \
+            -H "content-type: application/json" \
+            -d '{
+              "display_name": "<friendly-name>",
+              "geo": "us",
+              "provider_config": {
+                "type": "aws",
+                "kms_arn": "<key-arn-from-create-key-step>"
+              }
+            }'
+          ```
+
+          ```bash CLI
+          ant organization:external-keys create <<'YAML'
+          display_name: "<friendly-name>"
+          geo: us
+          provider_config:
+            type: aws
+            kms_arn: "<key-arn-from-create-key-step>"
+          YAML
+          ```
+
+          ```python Python
+          client = anthropic.Anthropic()
+
+          external_key = client.organization.external_keys.create(
+              display_name="<friendly-name>",
+              geo="us",
+              provider_config={"type": "aws", "kms_arn": "<key-arn-from-create-key-step>"},
+          )
+
+          print(f"id: {external_key.id}")
+          print(f"display_name: {external_key.display_name}")
+          ```
+
+          ```typescript TypeScript
+          const client = new Anthropic();
+
+          const externalKey = await client.organization.externalKeys.create({
+            display_name: "<friendly-name>",
+            geo: "us",
+            provider_config: {
+              type: "aws",
+              kms_arn: "<key-arn-from-create-key-step>"
+            }
+          });
+
+          console.log(`id: ${externalKey.id}`);
+          console.log(`display_name: ${externalKey.display_name}`);
+          ```
+
+          ```csharp C#
+          using Anthropic.Models.Organization.ExternalKeys;
+
+          AnthropicClient client = new();
+
+          var externalKey = await client.Organization.ExternalKeys.Create(new()
+          {
+              DisplayName = "<friendly-name>",
+              Geo = Geo.Us,
+              ProviderConfig = new AwsExternalKeyConfig
+              {
+                  KmsArn = "<key-arn-from-create-key-step>"
+              }
+          });
+
+          Console.WriteLine($"id: {externalKey.ID}");
+          Console.WriteLine($"display_name: {externalKey.DisplayName}");
+          ```
+
+          ```go Go
+          client := anthropic.NewClient()
+
+          externalKey, err := client.Organization.ExternalKeys.New(context.Background(), anthropic.OrganizationExternalKeyNewParams{
+          	DisplayName: anthropic.String("<friendly-name>"),
+          	Geo:         anthropic.OrganizationExternalKeyNewParamsGeoUs,
+          	ProviderConfig: anthropic.OrganizationExternalKeyNewParamsProviderConfigUnion{
+          		OfAWS: &anthropic.AWSExternalKeyConfigParam{
+          			KMSARN: "<key-arn-from-create-key-step>",
+          		},
+          	},
+          })
+          if err != nil {
+          	log.Fatal(err)
+          }
+
+          fmt.Printf("id: %s\n", externalKey.ID)
+          fmt.Printf("display_name: %s\n", externalKey.DisplayName)
+          ```
+
+          ```java Java
+          import com.anthropic.models.organization.externalkeys.AwsExternalKeyConfig;
+          import com.anthropic.models.organization.externalkeys.ExternalKeyCreateParams;
+
+          void main() {
+              AnthropicClient client = AnthropicOkHttpClient.fromEnv();
+
+              var params = ExternalKeyCreateParams.builder()
+                  .displayName("<friendly-name>")
+                  .geo(ExternalKeyCreateParams.Geo.US)
+                  .providerConfig(AwsExternalKeyConfig.builder()
+                      .kmsArn("<key-arn-from-create-key-step>")
+                      .build())
+                  .build();
+              var externalKey = client.organization().externalKeys().create(params);
+
+              IO.println("id: " + externalKey.id());
+              IO.println("display_name: " + externalKey.displayName().orElseThrow());
+          }
+          ```
+
+          ```php PHP
+          use Anthropic\Organization\ExternalKeys\ExternalKeyCreateParams\Geo;
+          // ...
+
+          $client = new Client();
+
+          $externalKey = $client->organization->externalKeys->create(
+              displayName: '<friendly-name>',
+              geo: Geo::US,
+              providerConfig: [
+                  'type' => 'aws',
+                  'kmsARN' => '<key-arn-from-create-key-step>',
+              ],
+          );
+
+          echo "id: {$externalKey->id}\n";
+          echo "display_name: {$externalKey->displayName}\n";
+          ```
+
+          ```ruby Ruby
+          client = Anthropic::Client.new
+
+          external_key = client.organization.external_keys.create(
+            display_name: "<friendly-name>",
+            geo: :us,
+            provider_config: {
+              type: :aws,
+              kms_arn: "<key-arn-from-create-key-step>"
+            }
+          )
+
+          puts "id: #{external_key.id}"
+          puts "display_name: #{external_key.display_name}"
+          ```
+        </CodeGroup>
+      </Tab>
+
+      <Tab title="Google Cloud">
+        Replace `<friendly-name>` with a display name. Replace the value that starts with `projects/` with the full key resource name.
+
+        <CodeGroup>
+          ```bash cURL
+          curl -sS "https://api.anthropic.com/v1/organizations/external_keys" \
+            -H "x-api-key: $ANTHROPIC_API_KEY" \
+            -H "anthropic-version: 2023-06-01" \
+            -H "content-type: application/json" \
+            -d '{
+              "display_name": "<friendly-name>",
+              "geo": "us",
+              "provider_config": {
+                "type": "gcp",
+                "key_name": "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
+              }
+            }'
+          ```
+
+          ```bash CLI
+          ant organization:external-keys create <<'YAML'
+          display_name: "<friendly-name>"
+          geo: us
+          provider_config:
+            type: gcp
+            key_name: "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
+          YAML
+          ```
+
+          ```python Python
+          client = anthropic.Anthropic()
+
+          external_key = client.organization.external_keys.create(
+              display_name="<friendly-name>",
+              geo="us",
+              provider_config={
+                  "type": "gcp",
+                  "key_name": "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>",
+              },
+          )
+
+          print(f"id: {external_key.id}")
+          print(f"display_name: {external_key.display_name}")
+          ```
+
+          ```typescript TypeScript
+          const client = new Anthropic();
+
+          const externalKey = await client.organization.externalKeys.create({
+            display_name: "<friendly-name>",
+            geo: "us",
+            provider_config: {
+              type: "gcp",
+              key_name:
+                "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
+            }
+          });
+
+          console.log(`id: ${externalKey.id}`);
+          console.log(`display_name: ${externalKey.display_name}`);
+          ```
+
+          ```csharp C#
+          using Anthropic.Models.Organization.ExternalKeys;
+
+          AnthropicClient client = new();
+
+          var externalKey = await client.Organization.ExternalKeys.Create(new()
+          {
+              DisplayName = "<friendly-name>",
+              Geo = Geo.Us,
+              ProviderConfig = new GcpExternalKeyConfig
+              {
+                  KeyName = "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
+              }
+          });
+
+          Console.WriteLine($"id: {externalKey.ID}");
+          Console.WriteLine($"display_name: {externalKey.DisplayName}");
+          ```
+
+          ```go Go
+          client := anthropic.NewClient()
+
+          externalKey, err := client.Organization.ExternalKeys.New(context.Background(), anthropic.OrganizationExternalKeyNewParams{
+          	DisplayName: anthropic.String("<friendly-name>"),
+          	Geo:         anthropic.OrganizationExternalKeyNewParamsGeoUs,
+          	ProviderConfig: anthropic.OrganizationExternalKeyNewParamsProviderConfigUnion{
+          		OfGCP: &anthropic.GCPExternalKeyConfigParam{
+          			KeyName: "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>",
+          		},
+          	},
+          })
+          if err != nil {
+          	log.Fatal(err)
+          }
+
+          fmt.Printf("id: %s\n", externalKey.ID)
+          fmt.Printf("display_name: %s\n", externalKey.DisplayName)
+          ```
+
+          ```java Java
+          import com.anthropic.models.organization.externalkeys.ExternalKeyCreateParams;
+
+          void main() {
+              AnthropicClient client = AnthropicOkHttpClient.fromEnv();
+
+              var params = ExternalKeyCreateParams.builder()
+                  .displayName("<friendly-name>")
+                  .geo(ExternalKeyCreateParams.Geo.US)
+                  .gcpProviderConfig("projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>")
+                  .build();
+              var externalKey = client.organization().externalKeys().create(params);
+
+              IO.println("id: " + externalKey.id());
+              IO.println("display_name: " + externalKey.displayName().orElseThrow());
+          }
+          ```
+
+          ```php PHP
+          use Anthropic\Organization\ExternalKeys\ExternalKeyCreateParams\Geo;
+          // ...
+
+          $client = new Client();
+
+          $externalKey = $client->organization->externalKeys->create(
+              displayName: '<friendly-name>',
+              geo: Geo::US,
+              providerConfig: [
+                  'type' => 'gcp',
+                  'keyName' => 'projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>',
+              ],
+          );
+
+          echo "id: {$externalKey->id}\n";
+          echo "display_name: {$externalKey->displayName}\n";
+          ```
+
+          ```ruby Ruby
+          client = Anthropic::Client.new
+
+          external_key = client.organization.external_keys.create(
+            display_name: "<friendly-name>",
+            geo: :us,
+            provider_config: {
+              type: :gcp,
+              key_name: "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
+            }
+          )
+
+          puts "id: #{external_key.id}"
+          puts "display_name: #{external_key.display_name}"
+          ```
+        </CodeGroup>
+      </Tab>
+
+      <Tab title="Azure">
+        Replace the placeholders:
+
+        * `<friendly-name>`: a display name
+        * `https://<your-vault-name>.vault.azure.net/`: the vault URI
+        * `<your-key-name>`: the key name
+        * `<your-tenant-id>`: the vault's tenant ID
+
+        <CodeGroup>
+          ```bash cURL
+          curl -sS "https://api.anthropic.com/v1/organizations/external_keys" \
+            -H "x-api-key: $ANTHROPIC_API_KEY" \
+            -H "anthropic-version: 2023-06-01" \
+            -H "content-type: application/json" \
+            -d '{
+              "display_name": "<friendly-name>",
+              "geo": "us",
+              "provider_config": {
+                "type": "azure",
+                "vault_uri": "https://<your-vault-name>.vault.azure.net/",
+                "key_name": "<your-key-name>",
+                "tenant_id": "<your-tenant-id>"
+              }
+            }'
+          ```
+
+          ```bash CLI
+          ant organization:external-keys create <<'YAML'
+          display_name: "<friendly-name>"
+          geo: us
+          provider_config:
+            type: azure
+            vault_uri: "https://<your-vault-name>.vault.azure.net/"
+            key_name: "<your-key-name>"
+            tenant_id: "<your-tenant-id>"
+          YAML
+          ```
+
+          ```python Python
+          client = anthropic.Anthropic()
+
+          external_key = client.organization.external_keys.create(
+              display_name="<friendly-name>",
+              geo="us",
+              provider_config={
+                  "type": "azure",
+                  "vault_uri": "https://<your-vault-name>.vault.azure.net/",
+                  "key_name": "<your-key-name>",
+                  "tenant_id": "<your-tenant-id>",
+              },
+          )
+
+          print(f"id: {external_key.id}")
+          print(f"display_name: {external_key.display_name}")
+          ```
+
+          ```typescript TypeScript
+          const client = new Anthropic();
+
+          const externalKey = await client.organization.externalKeys.create({
+            display_name: "<friendly-name>",
+            geo: "us",
+            provider_config: {
+              type: "azure",
+              vault_uri: "https://<your-vault-name>.vault.azure.net/",
+              key_name: "<your-key-name>",
+              tenant_id: "<your-tenant-id>"
+            }
+          });
+
+          console.log(`id: ${externalKey.id}`);
+          console.log(`display_name: ${externalKey.display_name}`);
+          ```
+
+          ```csharp C#
+          using Anthropic.Models.Organization.ExternalKeys;
+
+          AnthropicClient client = new();
+
+          var externalKey = await client.Organization.ExternalKeys.Create(new()
+          {
+              DisplayName = "<friendly-name>",
+              Geo = Geo.Us,
+              ProviderConfig = new AzureExternalKeyConfigParam
+              {
+                  VaultUri = "https://<your-vault-name>.vault.azure.net/",
+                  KeyName = "<your-key-name>",
+                  TenantID = "<your-tenant-id>"
+              }
+          });
+
+          Console.WriteLine($"id: {externalKey.ID}");
+          Console.WriteLine($"display_name: {externalKey.DisplayName}");
+          ```
+
+          ```go Go
+          client := anthropic.NewClient()
+
+          externalKey, err := client.Organization.ExternalKeys.New(context.Background(), anthropic.OrganizationExternalKeyNewParams{
+          	DisplayName: anthropic.String("<friendly-name>"),
+          	Geo:         anthropic.OrganizationExternalKeyNewParamsGeoUs,
+          	ProviderConfig: anthropic.OrganizationExternalKeyNewParamsProviderConfigUnion{
+          		OfAzure: &anthropic.AzureExternalKeyConfigParam{
+          			VaultURI: "https://<your-vault-name>.vault.azure.net/",
+          			KeyName:  "<your-key-name>",
+          			TenantID: "<your-tenant-id>",
+          		},
+          	},
+          })
+          if err != nil {
+          	log.Fatal(err)
+          }
+
+          fmt.Printf("id: %s\n", externalKey.ID)
+          fmt.Printf("display_name: %s\n", externalKey.DisplayName)
+          ```
+
+          ```java Java
+          import com.anthropic.models.organization.externalkeys.AzureExternalKeyConfigParam;
+          import com.anthropic.models.organization.externalkeys.ExternalKeyCreateParams;
+
+          void main() {
+              AnthropicClient client = AnthropicOkHttpClient.fromEnv();
+
+              var params = ExternalKeyCreateParams.builder()
+                  .displayName("<friendly-name>")
+                  .geo(ExternalKeyCreateParams.Geo.US)
+                  .providerConfig(AzureExternalKeyConfigParam.builder()
+                      .vaultUri("https://<your-vault-name>.vault.azure.net/")
+                      .keyName("<your-key-name>")
+                      .tenantId("<your-tenant-id>")
+                      .build())
+                  .build();
+              var externalKey = client.organization().externalKeys().create(params);
+
+              IO.println("id: " + externalKey.id());
+              IO.println("display_name: " + externalKey.displayName().orElseThrow());
+          }
+          ```
+
+          ```php PHP
+          use Anthropic\Organization\ExternalKeys\ExternalKeyCreateParams\Geo;
+          // ...
+
+          $client = new Client();
+
+          $externalKey = $client->organization->externalKeys->create(
+              displayName: '<friendly-name>',
+              geo: Geo::US,
+              providerConfig: [
+                  'type' => 'azure',
+                  'vaultURI' => 'https://<your-vault-name>.vault.azure.net/',
+                  'keyName' => '<your-key-name>',
+                  'tenantID' => '<your-tenant-id>',
+              ],
+          );
+
+          echo "id: {$externalKey->id}\n";
+          echo "display_name: {$externalKey->displayName}\n";
+          ```
+
+          ```ruby Ruby
+          client = Anthropic::Client.new
+
+          external_key = client.organization.external_keys.create(
+            display_name: "<friendly-name>",
+            geo: :us,
+            provider_config: {
+              type: :azure,
+              vault_uri: "https://<your-vault-name>.vault.azure.net/",
+              key_name: "<your-key-name>",
+              tenant_id: "<your-tenant-id>"
+            }
+          )
+
+          puts "id: #{external_key.id}"
+          puts "display_name: #{external_key.display_name}"
+          ```
+        </CodeGroup>
+      </Tab>
+    </Tabs>
+
+    The `id` in the response is the external key ID. Copy it for the next two steps.
+
+    ```json
+    {
+      "type": "external_key",
+      "id": "ekey_<id>",
+      "display_name": "<friendly-name>"
+    }
+    ```
+  </Step>
+
+  <Step title="Validate the key">
+    Replace `ekey_<id>` with the external key ID.
+
+    <CodeGroup>
+      ```bash cURL
+      curl -sS -X POST "https://api.anthropic.com/v1/organizations/external_keys/ekey_<id>/validate" \
+        -H "x-api-key: $ANTHROPIC_API_KEY" \
+        -H "anthropic-version: 2023-06-01"
+      ```
+
+      ```bash CLI
+      ant organization:external-keys validate --external-key-id "ekey_<id>"
+      ```
+
+      ```python Python
+      client = anthropic.Anthropic()
+
+      validation = client.organization.external_keys.validate("ekey_<id>")
+
+      print(f"status: {validation.status}")
+      print(f"error: {validation.error}")
+      ```
+
+      ```typescript TypeScript
+      const client = new Anthropic();
+
+      const validation = await client.organization.externalKeys.validate("ekey_<id>");
+
+      console.log(`status: ${validation.status}`);
+      console.log(`error: ${validation.error}`);
+      ```
+
+      ```csharp C#
+      AnthropicClient client = new();
+
+      var validation = await client.Organization.ExternalKeys.Validate("ekey_<id>");
+
+      Console.WriteLine($"status: {validation.Status.Raw()}");
+      Console.WriteLine($"error: {validation.Error}");
+      ```
+
+      ```go Go
+      client := anthropic.NewClient()
+
+      validation, err := client.Organization.ExternalKeys.Validate(context.Background(), "ekey_<id>")
+      if err != nil {
+      	log.Fatal(err)
+      }
+
+      fmt.Printf("status: %s\n", validation.Status)
+      fmt.Printf("error: %s\n", validation.Error)
+      ```
+
+      ```java Java
+      AnthropicClient client = AnthropicOkHttpClient.fromEnv();
+
+      var validation = client.organization().externalKeys().validate("ekey_<id>");
+
+      IO.println("status: " + validation.status().asString());
+      IO.println("error: " + validation.error().orElse(""));
+      ```
+
+      ```php PHP
+      $client = new Client();
+
+      $validation = $client->organization->externalKeys->validate(
+          externalKeyID: 'ekey_<id>',
+      );
+
+      echo "status: {$validation->status}\n";
+      echo "error: {$validation->error}\n";
+      ```
+
+      ```ruby Ruby
+      client = Anthropic::Client.new
+
+      external_key_id = "ekey_<id>"
+      validation = client.organization.external_keys.validate(external_key_id)
+
+      puts "status: #{validation.status}"
+      puts "error: #{validation.error}"
+      ```
+    </CodeGroup>
+
+    A successful response looks like this:
+
+    ```json
+    { "type": "external_key_validation", "status": "success", "error": null }
+    ```
+
+    If `status` is `failure`, the `error` field says why. See [Troubleshoot CMEK](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting).
+  </Step>
+
+  <Step title="Attach the key to a workspace">
+    <Warning>
+      Attaching a key [can't be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). If the key is deleted, Anthropic can't recover the data it protects.
+    </Warning>
+
+    Replace `<workspace-id>` with the workspace ID, which starts with `wrkspc_`, and `ekey_<id>` with the external key ID.
+
+    <CodeGroup>
+      ```bash cURL
+      curl -sS -X POST "https://api.anthropic.com/v1/organizations/workspaces/<workspace-id>" \
+        -H "x-api-key: $ANTHROPIC_API_KEY" \
+        -H "anthropic-version: 2023-06-01" \
+        -H "content-type: application/json" \
+        -d '{
+          "external_key_id": "ekey_<id>"
+        }'
+      ```
+
+      ```bash CLI
+      ant organization:workspaces update \
+        --workspace-id "<workspace-id>" \
+        --external-key-id "ekey_<id>"
+      ```
+
+      ```python Python
+      client = anthropic.Anthropic()
+
+      workspace = client.organization.workspaces.update(
+          "<workspace-id>", external_key_id="ekey_<id>"
+      )
+
+      print(f"id: {workspace.id}")
+      print(f"external_key_id: {workspace.external_key_id}")
+      ```
+
+      ```typescript TypeScript
+      const client = new Anthropic();
+
+      const workspace = await client.organization.workspaces.update("<workspace-id>", {
+        external_key_id: "ekey_<id>"
+      });
+
+      console.log(`id: ${workspace.id}`);
+      console.log(`external_key_id: ${workspace.external_key_id}`);
+      ```
+
+      ```csharp C#
+      AnthropicClient client = new();
+
+      var workspace = await client.Organization.Workspaces.Update("<workspace-id>", new()
+      {
+          ExternalKeyID = "ekey_<id>"
+      });
+
+      Console.WriteLine($"id: {workspace.ID}");
+      Console.WriteLine($"external_key_id: {workspace.ExternalKeyID}");
+      ```
+
+      ```go Go
+      client := anthropic.NewClient()
+
+      workspace, err := client.Organization.Workspaces.Update(
+      	context.Background(),
+      	"<workspace-id>",
+      	anthropic.OrganizationWorkspaceUpdateParams{
+      		ExternalKeyID: anthropic.String("ekey_<id>"),
+      	},
+      )
+      if err != nil {
+      	log.Fatal(err)
+      }
+
+      fmt.Printf("id: %s\n", workspace.ID)
+      fmt.Printf("external_key_id: %s\n", workspace.ExternalKeyID)
+      ```
+
+      ```java Java
+      import com.anthropic.models.organization.workspaces.WorkspaceUpdateParams;
+
+      void main() {
+          AnthropicClient client = AnthropicOkHttpClient.fromEnv();
+
+          var params = WorkspaceUpdateParams.builder()
+              .externalKeyId("ekey_<id>")
+              .build();
+          var workspace = client.organization().workspaces().update("<workspace-id>", params);
+
+          IO.println("id: " + workspace.id());
+          IO.println("external_key_id: " + workspace.externalKeyId().orElseThrow());
+      }
+      ```
+
+      ```php PHP
+      $client = new Client();
+
+      $workspace = $client->organization->workspaces->update(
+          workspaceID: '<workspace-id>',
+          externalKeyID: 'ekey_<id>',
+      );
+
+      echo "id: {$workspace->id}\n";
+      echo "external_key_id: {$workspace->externalKeyID}\n";
+      ```
+
+      ```ruby Ruby
+      client = Anthropic::Client.new
+
+      workspace_id = "<workspace-id>"
+      workspace = client.organization.workspaces.update(
+        workspace_id,
+        external_key_id: "ekey_<id>"
+      )
+
+      puts "id: #{workspace.id}"
+      puts "external_key_id: #{workspace.external_key_id}"
+      ```
+    </CodeGroup>
+
+    The response shows the attached key's ID in `external_key_id`. If the request is refused, [look up the error](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#refused).
+  </Step>
+</Steps>
diff --git a/content/en/manage-claude/cmek-aws-kms-workspaces.md b/content/en/manage-claude/cmek-aws-kms-workspaces.md
new file mode 100644
index 0000000000..2201280cdf
--- /dev/null
+++ b/content/en/manage-claude/cmek-aws-kms-workspaces.md
@@ -0,0 +1,47 @@
+---
+title: Limit an AWS KMS key to specific workspaces
+url: https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms-workspaces
+description: Add a key policy condition that names the workspaces allowed to use your AWS KMS key.
+---
+
+The [key policy from setup](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#key-policy) lets every workspace in your organization use the key. With this optional condition, a workspace that isn't listed can't use it.
+
+Add a workspace's [compartment ID](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#what-one-key-protects) to the policy before you [attach the key](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#register-the-key-with-anthropic) to that workspace. For a new workspace, that means creating it without the key.
+
+## Copy the workspace's compartment ID
+
+In the Claude Console, open the [Data retention](https://platform.claude.com/settings/privacy) page and select the workspace from the dropdown menu at the top. Copy the **Compartment ID** under **Encryption key**. The [Get Workspace](https://platform.claude.com/docs/en/api/organization/workspaces/retrieve) endpoint returns it as `compartment_id`.
+
+A Claude Enterprise organization has one compartment ID. Copy it from your key under **Encryption keys** in [claude.ai > Organization settings > Data and privacy](https://claude.ai/admin-settings/data-privacy-controls).
+
+## Add the condition to the key policy
+
+Replace the `AllowAnthropicCMEKCrypto` statement with this one. Fill in your Anthropic organization ID and the compartment ID of every workspace that uses the key. A key that already protects data [needs one more statement](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#existing-data).
+
+```json
+{
+  "Sid": "AllowAnthropicCMEKCrypto",
+  "Effect": "Allow",
+  "Principal": {
+    "AWS": "arn:aws:iam::915198916910:role/anthropic-cmek-client-us"
+  },
+  "Action": ["kms:Encrypt", "kms:Decrypt"],
+  "Resource": "*",
+  "Condition": {
+    "StringEquals": {
+      "kms:EncryptionContext:anthropic:org_uuid": ["<ORGANIZATION_UUID>"]
+    },
+    "StringEqualsIfExists": {
+      "kms:EncryptionContext:anthropic:compartment_uuid": ["<COMPARTMENT_UUID>"]
+    }
+  }
+}
+```
+
+## Replace the key policy on an existing key
+
+1. In the [AWS KMS console](https://console.aws.amazon.com/kms), open the key and click the **Key policy** tab.
+2. If you see **Switch to policy view**, click it.
+3. Click **Edit**.
+4. Replace the JSON with your key policy.
+5. Click **Save changes**.
diff --git a/content/en/manage-claude/cmek-aws-kms.md b/content/en/manage-claude/cmek-aws-kms.md
index 9ea7cbcfac..0d9678b7da 100644
--- a/content/en/manage-claude/cmek-aws-kms.md
+++ b/content/en/manage-claude/cmek-aws-kms.md
@@ -1,7 +1,7 @@
 ---
-title: Configure AWS KMS for CMEK
+title: Set up CMEK with AWS KMS
 url: https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms
-description: Use AWS KMS to provide an encryption key for your organization.
+description: Create an AWS KMS key, give Anthropic access to it, and put it to use in Claude Platform or Claude Enterprise.
 ---
 
 Let Claude Code set up this feature for you
@@ -10,39 +10,30 @@ Let Claude Code set up this feature for you
 /claude-api help me configure a customer-managed encryption key with AWS KMS
 ```
 
-This guide shows how to use an [AWS KMS](https://aws.amazon.com/kms/) key as a [customer-managed encryption key (CMEK)](https://platform.claude.com/docs/en/manage-claude/cmek) for your Anthropic organization.
+If your Claude Console sidebar shows **Account managed by AWS**, follow [Set up CMEK on Claude Platform on AWS](https://platform.claude.com/docs/en/manage-claude/cmek-claude-platform-on-aws) instead.
 
-<Warning>
-  Enabling CMEK is permanent. If your key is deleted or disabled, Anthropic cannot recover the data encrypted under it. Review the [warnings and limitations](https://platform.claude.com/docs/en/manage-claude/cmek) before you start.
-</Warning>
+## Before you start
 
-<Note>
-  **Claude Platform on AWS:** If your Claude Console sidebar shows **Account managed by AWS**, your organization is on Claude Platform on AWS. Follow [Set up CMEK on Claude Platform on AWS](https://platform.claude.com/docs/en/manage-claude/cmek-claude-platform-on-aws) instead.
-</Note>
+In Claude:
 
-## Prerequisites
+* Customer-managed encryption keys (CMEK) are [turned on for your organization](https://platform.claude.com/docs/en/manage-claude/cmek#availability).
+* You have your Anthropic organization ID, the UUID without the `org_` prefix. Copy it from [Organization](https://platform.claude.com/settings/organization) in the Claude Console, or from **Organization settings > Organization and access** on claude.ai. Whoever creates the key needs it.
+* You're an Organization Admin on Claude Platform, or an Owner or Primary Owner on Claude Enterprise.
+* On Claude Platform, you have a workspace that [retains data](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#data-retention), ideally a new one, because [existing data stays under Anthropic's key](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect).
+* On Claude Enterprise, you know [which features turn off or change](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#turned-off-or-changed).
 
-* An AWS account with permissions to create KMS keys and set key policies (`kms:CreateKey` and `kms:PutKeyPolicy`).
-* To create the key from the command line, the [AWS CLI](https://aws.amazon.com/cli/) installed and authenticated.
-* To register the key through the API, an Anthropic Admin API key for your organization.
+In AWS:
 
-## Amazon Resource Name (ARN) for Anthropic
+* You can create AWS KMS keys and set their key policies (`kms:CreateKey` and `kms:PutKeyPolicy`).
+* Any IP restriction on AWS KMS access allows [Anthropic's outbound IP addresses](https://platform.claude.com/docs/en/api/ip-addresses#outbound-ip-addresses).
 
-The key policy in this guide gives the following Anthropic IAM role access to your key:
+## In AWS: create the key
 
-```text wrap
-arn:aws:iam::915198916910:role/anthropic-cmek-client-us
-```
-
-<Warning>
-  Use only this published ARN. Never trust an identifier provided over email, chat, or any onboarding channel.
-</Warning>
+After a failed **Verify** or **Add**, see the [fixes for AWS KMS](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#aws-kms).
 
-## Encryption key setup
+### Write the key policy
 
-### Prepare the key policy
-
-Copy this policy into a text editor:
+This policy gives Anthropic's IAM role access to your key. Use only the role ARN published on this page, never one sent by email or chat. Copy the policy into a text editor:
 
 ```json key-policy.json
 {
@@ -84,79 +75,15 @@ Copy this policy into a text editor:
 }
 ```
 
-Replace the two placeholders:
-
-* **`<AWS_ACCOUNT_ID>`:** your [AWS account ID](https://docs.aws.amazon.com/IAM/latest/UserGuide/console-account-id.html). To print it with the AWS CLI, run `aws sts get-caller-identity --query Account --output text`.
-* **`<ORGANIZATION_UUID>`:** your Anthropic organization ID
-
-<Note>
-  **Finding your organization ID:** Use the bare UUID, not the `org_`-prefixed ID. Copy it from one of these places:
-
-  * **Claude Console:** the **Organization ID** field on the [Organization](https://platform.claude.com/settings/organization) page (`platform.claude.com/settings/organization`)
-  * **claude.ai:** the **Organization ID** field under **Organization settings > Organization**
-  * **Admin API:** the `id` field from the [Organization Info](https://platform.claude.com/docs/en/api/organization/retrieve) endpoint
-</Note>
-
-Don't remove the `kms:EncryptionContext:anthropic:org_uuid` condition, or validation fails. To share one key among several Anthropic organizations, list each organization ID in it. To limit the key to specific workspaces, see the [optional workspace condition](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#workspace-condition).
-
-<Warning>
-  **Keys that already protect data:** If the key is already configured for CMEK, add this fourth statement so that Anthropic can still decrypt the existing data. In its condition, list the [compartment ID](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#compartment-id) of every workspace the key is or was attached to.
-
-  ```json
-  {
-    "Sid": "AllowAnthropicCMEKDecryptExistingData",
-    "Effect": "Allow",
-    "Principal": {
-      "AWS": "arn:aws:iam::915198916910:role/anthropic-cmek-client-us"
-    },
-    "Action": "kms:Decrypt",
-    "Resource": "*",
-    "Condition": {
-      "StringEquals": {
-        "kms:EncryptionContext:anthropic:compartment_uuid": ["<COMPARTMENT_UUID>"]
-      }
-    }
-  }
-  ```
-</Warning>
-
-<Note>
-  **Optional:** To limit the key to specific workspaces, replace the `AllowAnthropicCMEKCrypto` statement in the key policy with this one. List one compartment ID for each workspace.
-
-  ```json
-  {
-    "Sid": "AllowAnthropicCMEKCrypto",
-    "Effect": "Allow",
-    "Principal": {
-      "AWS": "arn:aws:iam::915198916910:role/anthropic-cmek-client-us"
-    },
-    "Action": ["kms:Encrypt", "kms:Decrypt"],
-    "Resource": "*",
-    "Condition": {
-      "StringEquals": {
-        "kms:EncryptionContext:anthropic:org_uuid": ["<ORGANIZATION_UUID>"]
-      },
-      "StringEqualsIfExists": {
-        "kms:EncryptionContext:anthropic:compartment_uuid": ["<COMPARTMENT_UUID>"]
-      }
-    }
-  }
-  ```
-
-  Add each workspace's compartment ID before you attach the key to it. For a new workspace:
-
-  1. Create the workspace without the key.
-  2. Add its compartment ID to the policy.
-  3. Attach the key.
+Replace `<AWS_ACCOUNT_ID>` with your [AWS account ID](https://docs.aws.amazon.com/IAM/latest/UserGuide/console-account-id.html) and `<ORGANIZATION_UUID>` with your [Anthropic organization ID](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#prerequisites). Keep the `kms:EncryptionContext:anthropic:org_uuid` condition, or verification fails.
 
-  **Finding your compartment ID:** In the Claude Console, go to the [Data retention](https://platform.claude.com/settings/privacy) page (`platform.claude.com/settings/privacy`). Select the workspace from the dropdown menu at the top of the page. The ID is under **Encryption key**, in the **Compartment ID** field. You can also read the `compartment_id` field returned by the [Get Workspace](https://platform.claude.com/docs/en/api/organization/workspaces/retrieve) endpoint.
-
-  On Claude Enterprise, the organization has one compartment ID. Copy it from your key under **Encryption keys** in [claude.ai > Organization settings > Data and privacy](https://claude.ai/admin-settings/data-privacy-controls).
-</Note>
+You can also [limit the key to specific workspaces](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms-workspaces) by listing their compartment IDs. If you're replacing the policy on a key that already protects Claude data, [add one more statement](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#existing-data).
 
 ### Create the key
 
-Create the key in a [US region](https://platform.claude.com/docs/en/manage-claude/cmek#availability-and-regions). For the lowest latency, use `us-east-2`.
+Create the key in a US region. For the lowest latency, use `us-east-2`.
+
+To use a key you already have in AWS KMS, [replace its key policy](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms-workspaces#replace-the-key-policy).
 
 <Tabs>
   <Tab title="AWS Console">
@@ -176,7 +103,7 @@ Create the key in a [US region](https://platform.claude.com/docs/en/manage-claud
         Click **Next**.
 
         <Frame caption="Symmetric, encrypt and decrypt, single-Region key.">
-          ![AWS KMS Create key wizard on the Configure key step, with Symmetric key type, Encrypt and decrypt key usage, and Single-Region key selected.](https://platform.claude.com/docs/images/cmek/aws-configure-key.png)
+          ![AWS KMS Configure key step with Symmetric key type, Encrypt and decrypt key usage, and Single-Region key selected.](https://platform.claude.com/docs/images/cmek/aws-configure-key.png)
         </Frame>
       </Step>
 
@@ -209,17 +136,9 @@ Create the key in a [US region](https://platform.claude.com/docs/en/manage-claud
       </Step>
 
       <Step title="Copy the key ARN">
-        In **Customer managed keys**, open the new key and copy its ARN. You need the ARN to register the key.
+        In **Customer managed keys**, open the new key and copy its ARN. Whoever adds the key in Claude needs it.
       </Step>
     </Steps>
-
-    To replace the key policy on a key that already exists:
-
-    1. Open the key and click the **Key policy** tab.
-    2. If you see **Switch to policy view**, click it.
-    3. Click **Edit**.
-    4. Replace the JSON with your key policy.
-    5. Click **Save changes**.
   </Tab>
 
   <Tab title="AWS CLI">
@@ -233,430 +152,59 @@ Create the key in a [US region](https://platform.claude.com/docs/en/manage-claud
       --policy file://key-policy.json
     ```
 
-    Copy `KeyMetadata.Arn` from the output. You need it to register the key.
+    Copy `KeyMetadata.Arn` from the output. Whoever adds the key in Claude needs the ARN.
   </Tab>
 </Tabs>
 
-## Register the key with Anthropic
+Each check of the key in Claude adds four expected access-denied errors to CloudTrail. You can [filter them out](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#cloudtrail).
+
+## In Claude: add and attach the key
 
-Validating the key adds expected access-denied errors to CloudTrail. If you alert on these errors, see [Expected errors in CloudTrail](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#expected-errors-in-cloud-trail) first.
+To script this part on Claude Platform, [use the Admin API](https://platform.claude.com/docs/en/manage-claude/cmek-admin-api) instead.
 
 <Tabs>
   <Tab title="Claude Platform">
-    <Tabs>
-      <Tab title="Claude Console">
-        <Steps>
-          <Step title="Open the encryption key settings">
-            In the Claude Console, go to the [Data retention](https://platform.claude.com/settings/privacy#encryption-keys) page (`platform.claude.com/settings/privacy`). If you don't see **Encryption keys**, select **Organization** from the dropdown menu at the top of the page.
-          </Step>
-
-          <Step title="Add the key">
-            Under **Encryption keys**, click **Add key**. Enter a **Display name** and select **AWS KMS**. Click **Continue**.
-          </Step>
-
-          <Step title="Enter the key ARN">
-            The dialog box shows the **Organization ID for the key policy**. Check that your [key policy](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#key-policy) contains this ID. Paste the key ARN into **KMS key ARN** and click **Add**.
-          </Step>
-
-          <Step title="Validate the key">
-            In the **Encryption keys** list, click **Verify** next to the key. **Connected** appears when the check passes. If it fails, see [Troubleshoot validation](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#troubleshoot-validation) for common causes.
-          </Step>
-
-          <Step title="Attach the key to a workspace">
-            Attaching a key can't be undone. If you can, attach it to a new workspace before that workspace receives any requests. In a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).
-
-            On the Data retention page, select the workspace from the dropdown menu at the top of the page. Under **Encryption key**, select the key and click **Save**.
-          </Step>
-
-          <Step title="Confirm the change">
-            Select the checkbox to confirm that you have read the CMEK documentation, then click **Confirm**.
-          </Step>
-        </Steps>
-      </Tab>
-
-      <Tab title="API">
-        <Steps>
-          <Step title="Create the external key">
-            Replace `<friendly-name>` with a display name and `<key-arn-from-create-key-step>` with the key ARN.
-
-            <CodeGroup>
-              ```bash cURL
-              curl -sS "https://api.anthropic.com/v1/organizations/external_keys" \
-                -H "x-api-key: $ANTHROPIC_API_KEY" \
-                -H "anthropic-version: 2023-06-01" \
-                -H "content-type: application/json" \
-                -d '{
-                  "display_name": "<friendly-name>",
-                  "geo": "us",
-                  "provider_config": {
-                    "type": "aws",
-                    "kms_arn": "<key-arn-from-create-key-step>"
-                  }
-                }'
-              ```
-
-              ```bash CLI
-              ant organization:external-keys create <<'YAML'
-              display_name: "<friendly-name>"
-              geo: us
-              provider_config:
-                type: aws
-                kms_arn: "<key-arn-from-create-key-step>"
-              YAML
-              ```
-
-              ```python Python
-              client = anthropic.Anthropic()
-
-              external_key = client.organization.external_keys.create(
-                  display_name="<friendly-name>",
-                  geo="us",
-                  provider_config={"type": "aws", "kms_arn": "<key-arn-from-create-key-step>"},
-              )
-
-              print(f"id: {external_key.id}")
-              print(f"display_name: {external_key.display_name}")
-              ```
-
-              ```typescript TypeScript
-              const client = new Anthropic();
-
-              const externalKey = await client.organization.externalKeys.create({
-                display_name: "<friendly-name>",
-                geo: "us",
-                provider_config: {
-                  type: "aws",
-                  kms_arn: "<key-arn-from-create-key-step>"
-                }
-              });
-
-              console.log(`id: ${externalKey.id}`);
-              console.log(`display_name: ${externalKey.display_name}`);
-              ```
-
-              ```csharp C#
-              using Anthropic.Models.Organization.ExternalKeys;
-
-              AnthropicClient client = new();
-
-              var externalKey = await client.Organization.ExternalKeys.Create(new()
-              {
-                  DisplayName = "<friendly-name>",
-                  Geo = Geo.Us,
-                  ProviderConfig = new AwsExternalKeyConfig
-                  {
-                      KmsArn = "<key-arn-from-create-key-step>"
-                  }
-              });
-
-              Console.WriteLine($"id: {externalKey.ID}");
-              Console.WriteLine($"display_name: {externalKey.DisplayName}");
-              ```
-
-              ```go Go
-              client := anthropic.NewClient()
-
-              externalKey, err := client.Organization.ExternalKeys.New(context.Background(), anthropic.OrganizationExternalKeyNewParams{
-              	DisplayName: anthropic.String("<friendly-name>"),
-              	Geo:         anthropic.OrganizationExternalKeyNewParamsGeoUs,
-              	ProviderConfig: anthropic.OrganizationExternalKeyNewParamsProviderConfigUnion{
-              		OfAWS: &anthropic.AWSExternalKeyConfigParam{
-              			KMSARN: "<key-arn-from-create-key-step>",
-              		},
-              	},
-              })
-              if err != nil {
-              	log.Fatal(err)
-              }
-
-              fmt.Printf("id: %s\n", externalKey.ID)
-              fmt.Printf("display_name: %s\n", externalKey.DisplayName)
-              ```
-
-              ```java Java
-              import com.anthropic.models.organization.externalkeys.AwsExternalKeyConfig;
-              import com.anthropic.models.organization.externalkeys.ExternalKeyCreateParams;
-
-              void main() {
-                  AnthropicClient client = AnthropicOkHttpClient.fromEnv();
-
-                  var params = ExternalKeyCreateParams.builder()
-                      .displayName("<friendly-name>")
-                      .geo(ExternalKeyCreateParams.Geo.US)
-                      .providerConfig(AwsExternalKeyConfig.builder()
-                          .kmsArn("<key-arn-from-create-key-step>")
-                          .build())
-                      .build();
-                  var externalKey = client.organization().externalKeys().create(params);
-
-                  IO.println("id: " + externalKey.id());
-                  IO.println("display_name: " + externalKey.displayName().orElseThrow());
-              }
-              ```
-
-              ```php PHP
-              use Anthropic\Organization\ExternalKeys\ExternalKeyCreateParams\Geo;
-              // ...
-
-              $client = new Client();
-
-              $externalKey = $client->organization->externalKeys->create(
-                  displayName: '<friendly-name>',
-                  geo: Geo::US,
-                  providerConfig: [
-                      'type' => 'aws',
-                      'kmsARN' => '<key-arn-from-create-key-step>',
-                  ],
-              );
-
-              echo "id: {$externalKey->id}\n";
-              echo "display_name: {$externalKey->displayName}\n";
-              ```
-
-              ```ruby Ruby
-              client = Anthropic::Client.new
-
-              external_key = client.organization.external_keys.create(
-                display_name: "<friendly-name>",
-                geo: :us,
-                provider_config: {
-                  type: :aws,
-                  kms_arn: "<key-arn-from-create-key-step>"
-                }
-              )
-
-              puts "id: #{external_key.id}"
-              puts "display_name: #{external_key.display_name}"
-              ```
-            </CodeGroup>
-
-            The `id` field of the response contains the external key ID. Copy it for the next two steps:
-
-            ```json
-            {
-              "type": "external_key",
-              "id": "ekey_<id>",
-              "display_name": "<friendly-name>"
-            }
-            ```
-          </Step>
-
-          <Step title="Validate the key">
-            Replace `ekey_<id>` with the external key ID.
-
-            <CodeGroup>
-              ```bash cURL
-              curl -sS -X POST "https://api.anthropic.com/v1/organizations/external_keys/ekey_<id>/validate" \
-                -H "x-api-key: $ANTHROPIC_API_KEY" \
-                -H "anthropic-version: 2023-06-01"
-              ```
-
-              ```bash CLI
-              ant organization:external-keys validate --external-key-id "ekey_<id>"
-              ```
-
-              ```python Python
-              client = anthropic.Anthropic()
-
-              validation = client.organization.external_keys.validate("ekey_<id>")
-
-              print(f"status: {validation.status}")
-              print(f"error: {validation.error}")
-              ```
-
-              ```typescript TypeScript
-              const client = new Anthropic();
-
-              const validation = await client.organization.externalKeys.validate("ekey_<id>");
-
-              console.log(`status: ${validation.status}`);
-              console.log(`error: ${validation.error}`);
-              ```
-
-              ```csharp C#
-              AnthropicClient client = new();
-
-              var validation = await client.Organization.ExternalKeys.Validate("ekey_<id>");
-
-              Console.WriteLine($"status: {validation.Status.Raw()}");
-              Console.WriteLine($"error: {validation.Error}");
-              ```
-
-              ```go Go
-              client := anthropic.NewClient()
-
-              validation, err := client.Organization.ExternalKeys.Validate(context.Background(), "ekey_<id>")
-              if err != nil {
-              	log.Fatal(err)
-              }
-
-              fmt.Printf("status: %s\n", validation.Status)
-              fmt.Printf("error: %s\n", validation.Error)
-              ```
-
-              ```java Java
-              AnthropicClient client = AnthropicOkHttpClient.fromEnv();
-
-              var validation = client.organization().externalKeys().validate("ekey_<id>");
-
-              IO.println("status: " + validation.status().asString());
-              IO.println("error: " + validation.error().orElse(""));
-              ```
-
-              ```php PHP
-              $client = new Client();
-
-              $validation = $client->organization->externalKeys->validate(
-                  externalKeyID: 'ekey_<id>',
-              );
-
-              echo "status: {$validation->status}\n";
-              echo "error: {$validation->error}\n";
-              ```
-
-              ```ruby Ruby
-              client = Anthropic::Client.new
-
-              external_key_id = "ekey_<id>"
-              validation = client.organization.external_keys.validate(external_key_id)
-
-              puts "status: #{validation.status}"
-              puts "error: #{validation.error}"
-              ```
-            </CodeGroup>
-
-            A successful response looks like this:
-
-            ```json
-            { "type": "external_key_validation", "status": "success", "error": null }
-            ```
-
-            If validation fails, see [Troubleshoot validation](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#troubleshoot-validation).
-          </Step>
-
-          <Step title="Attach the key to a workspace">
-            Attaching a key can't be undone. If you can, attach it to a new workspace before that workspace receives any requests. In a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).
+    <Steps>
+      <Step title="Open the encryption key settings">
+        In the Claude Console, open [Encryption keys](https://platform.claude.com/settings/privacy#encryption-keys) on the Data retention page. If the section isn't there, select **Organization** from the dropdown menu at the top.
+      </Step>
 
-            Replace `<workspace-id>` with the workspace ID and `ekey_<id>` with the external key ID.
+      <Step title="Add the key">
+        Under **Encryption keys**, click **Add key**. Enter a **Display name**, select **AWS KMS**, and click **Continue**.
+      </Step>
 
-            <CodeGroup>
-              ```bash cURL
-              curl -sS -X POST "https://api.anthropic.com/v1/organizations/workspaces/<workspace-id>" \
-                -H "x-api-key: $ANTHROPIC_API_KEY" \
-                -H "anthropic-version: 2023-06-01" \
-                -H "content-type: application/json" \
-                -d '{
-                  "external_key_id": "ekey_<id>"
-                }'
-              ```
+      <Step title="Enter the key ARN">
+        Check that your [key policy](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#key-policy) contains the **Organization ID for the key policy** shown in the dialog box. Paste the key ARN into **KMS key ARN** and click **Add**.
+      </Step>
 
-              ```bash CLI
-              ant organization:workspaces update \
-                --workspace-id "<workspace-id>" \
-                --external-key-id "ekey_<id>"
-              ```
+      <Step title="Verify the key">
+        In the **Encryption keys** list, click **Verify** next to the key. **Connected** appears when the check passes. If **Connection failed** appears instead, see [Troubleshoot CMEK](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting).
+      </Step>
 
-              ```python Python
-              client = anthropic.Anthropic()
+      <Step title="Attach the key to a workspace">
+        <Warning>
+          Attaching a key [can't be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). You can't remove it from the workspace or replace it. If the key is deleted, Anthropic can't recover the data it protects.
+        </Warning>
 
-              workspace = client.organization.workspaces.update(
-                  "<workspace-id>", external_key_id="ekey_<id>"
-              )
+        1. At the top of the Data retention page, select the workspace from the dropdown menu.
+        2. Under **Encryption key**, select the key and click **Save**.
+        3. Select the checkbox to confirm that you have read the CMEK documentation, then click **Confirm**.
 
-              print(f"id: {workspace.id}")
-              print(f"external_key_id: {workspace.external_key_id}")
-              ```
+        You see **Workspace settings updated.** Once the key [takes effect](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect), your cloud provider's audit log shows Anthropic's calls to the key.
 
-              ```typescript TypeScript
-              const client = new Anthropic();
-
-              const workspace = await client.organization.workspaces.update("<workspace-id>", {
-                external_key_id: "ekey_<id>"
-              });
-
-              console.log(`id: ${workspace.id}`);
-              console.log(`external_key_id: ${workspace.external_key_id}`);
-              ```
-
-              ```csharp C#
-              AnthropicClient client = new();
-
-              var workspace = await client.Organization.Workspaces.Update("<workspace-id>", new()
-              {
-                  ExternalKeyID = "ekey_<id>"
-              });
-
-              Console.WriteLine($"id: {workspace.ID}");
-              Console.WriteLine($"external_key_id: {workspace.ExternalKeyID}");
-              ```
-
-              ```go Go
-              client := anthropic.NewClient()
-
-              workspace, err := client.Organization.Workspaces.Update(
-              	context.Background(),
-              	"<workspace-id>",
-              	anthropic.OrganizationWorkspaceUpdateParams{
-              		ExternalKeyID: anthropic.String("ekey_<id>"),
-              	},
-              )
-              if err != nil {
-              	log.Fatal(err)
-              }
-
-              fmt.Printf("id: %s\n", workspace.ID)
-              fmt.Printf("external_key_id: %s\n", workspace.ExternalKeyID)
-              ```
-
-              ```java Java
-              import com.anthropic.models.organization.workspaces.WorkspaceUpdateParams;
-
-              void main() {
-                  AnthropicClient client = AnthropicOkHttpClient.fromEnv();
-
-                  var params = WorkspaceUpdateParams.builder()
-                      .externalKeyId("ekey_<id>")
-                      .build();
-                  var workspace = client.organization().workspaces().update("<workspace-id>", params);
-
-                  IO.println("id: " + workspace.id());
-                  IO.println("external_key_id: " + workspace.externalKeyId().orElseThrow());
-              }
-              ```
-
-              ```php PHP
-              $client = new Client();
-
-              $workspace = $client->organization->workspaces->update(
-                  workspaceID: '<workspace-id>',
-                  externalKeyID: 'ekey_<id>',
-              );
-
-              echo "id: {$workspace->id}\n";
-              echo "external_key_id: {$workspace->externalKeyID}\n";
-              ```
-
-              ```ruby Ruby
-              client = Anthropic::Client.new
-
-              workspace_id = "<workspace-id>"
-              workspace = client.organization.workspaces.update(
-                workspace_id,
-                external_key_id: "ekey_<id>"
-              )
-
-              puts "id: #{workspace.id}"
-              puts "external_key_id: #{workspace.external_key_id}"
-              ```
-            </CodeGroup>
-          </Step>
-        </Steps>
-      </Tab>
-    </Tabs>
+        In a [ZDR organization](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#zdr-organizations), after you select the workspace, select **Standard data retention** so that **Encryption key** appears. After you click **Save**, click **Accept** on the data retention terms.
+      </Step>
+    </Steps>
   </Tab>
 
   <Tab title="Claude Enterprise">
-    On Claude Enterprise, CMEK applies to the whole organization, and an organization can have only one key.
+    On Claude Enterprise, CMEK applies to the whole organization, and you can add only one key.
+
+    <Warning>
+      Adding a key [can't be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). You can't remove it from the organization or replace it. If the key is deleted, Anthropic can't recover the data it protects.
+    </Warning>
+
+    Adding the key [turns off or changes some features](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#turned-off-or-changed) for every user. To try CMEK first, use a separate organization.
 
     <Steps>
       <Step title="Open the encryption key settings">
@@ -668,38 +216,14 @@ Validating the key adds expected access-denied errors to CloudTrail. If you aler
       </Step>
 
       <Step title="Enter the key ARN">
-        The dialog box shows the **Organization ID for the key policy**. Check that your [key policy](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#key-policy) contains this ID. Paste the key ARN into **KMS key ARN** and click **Add**.
+        Check that your [key policy](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#key-policy) contains the **Organization ID for the key policy** shown in the dialog box. Paste the key ARN into **KMS key ARN** and click **Add**.
       </Step>
 
-      <Step title="Confirm that validation passed">
-        When the check passes, **Encryption key configured** appears, and your organization is CMEK-protected from then on. If the check fails, see [Troubleshoot validation](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#troubleshoot-validation).
+      <Step title="Confirm that the key was added">
+        The check can take up to 30 seconds. When **Encryption key configured.** appears, click **Done**. If **The encryption key couldn’t be added.** appears instead, [find the cause and retry](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#claude-ai-add-fails).
+
+        Your key protects data written from then on. Tell your users [which features changed](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#turned-off-or-changed).
       </Step>
     </Steps>
   </Tab>
 </Tabs>
-
-## Troubleshoot validation
-
-If validation fails, common causes are:
-
-* **Wrong organization ID:** Make sure the `org_uuid` condition lists your bare organization ID, not the `org_`-prefixed ID.
-* **Encryption context mismatch:** If the policy has a `kms:EncryptionContext:anthropic:compartment_uuid` condition, make sure it lists the [compartment ID](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#compartment-id) of each workspace the key is attached to.
-* **Resource control policies (RCPs):** Some RCPs deny KMS operations when `aws:PrincipalOrgID` does not match your AWS organization. An RCP like this blocks Anthropic's role. Add an exception to it for this key or for Anthropic's role ARN. Service control policies do not apply here.
-* **Access granted through IAM instead of the key policy:** Grant Anthropic's role access in the key policy itself, not through an IAM policy in your account. To check the key policy, run `aws kms get-key-policy --region <REGION> --key-id <KEY_ARN> --policy-name default`.
-* **Region mismatch:** Confirm that the key is in a US region.
-
-### Expected errors in CloudTrail
-
-Anthropic validates the key whenever you verify it, attach it to a workspace, or view it in the Claude Enterprise settings. Each validation adds four access-denied errors to CloudTrail. These errors are expected.
-
-To filter them out, match all three of these values:
-
-* `requestParameters.encryptionContext.associatedData`: `Y21lay12YWxpZGF0aW9u`
-* `userIdentity.accountId`: `915198916910`
-* `resources.ARN`: `arn:aws:kms:<REGION>:<AWS_ACCOUNT_ID>:key/<KEY_ID>`
-
-The first value alone isn't enough, because any caller can set it.
-
-## Terraform
-
-To create the key with Terraform, use the `aws_kms_key` and `aws_kms_alias` resources from the `aws` provider.
diff --git a/content/en/manage-claude/cmek-azure-key-vault.md b/content/en/manage-claude/cmek-azure-key-vault.md
index 336cb97f55..759dc3a9f4 100644
--- a/content/en/manage-claude/cmek-azure-key-vault.md
+++ b/content/en/manage-claude/cmek-azure-key-vault.md
@@ -1,7 +1,7 @@
 ---
-title: Configure Azure Key Vault for CMEK
+title: Set up CMEK with Azure Key Vault
 url: https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault
-description: Use Azure Key Vault to provide an encryption key for your organization.
+description: Create an Azure Key Vault key, give Anthropic access to it, and put it to use in Claude Platform or Claude Enterprise.
 ---
 
 Let Claude Code set up this feature for you
@@ -10,61 +10,55 @@ Let Claude Code set up this feature for you
 /claude-api help me configure a customer-managed encryption key with Azure Key Vault
 ```
 
-This guide shows how to use an Azure Key Vault key as a [customer-managed encryption key (CMEK)](https://platform.claude.com/docs/en/manage-claude/cmek) for your Anthropic organization.
+## Before you start
 
-<Warning>
-  Enabling CMEK is permanent. If your key is deleted or disabled, Anthropic cannot recover the data encrypted under it. Review the [warnings and limitations](https://platform.claude.com/docs/en/manage-claude/cmek) before you start.
-</Warning>
+In Claude:
 
-## Prerequisites
+* Customer-managed encryption keys (CMEK) are [turned on for your organization](https://platform.claude.com/docs/en/manage-claude/cmek#availability).
+* You have your Anthropic organization ID, the UUID without the `org_` prefix. Copy it from [Organization](https://platform.claude.com/settings/organization) in the Claude Console, or from **Organization settings > Organization and access** on claude.ai. Whoever creates the key needs it.
+* You're an Organization Admin on Claude Platform, or an Owner or Primary Owner on Claude Enterprise.
+* On Claude Platform, you have a workspace that [retains data](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#data-retention), ideally a new one, because [existing data stays under Anthropic's key](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect).
+* On Claude Enterprise, you know [which features turn off or change](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#turned-off-or-changed).
 
-* An Azure Key Vault with these settings:
+In Azure:
 
-  * RBAC authorization is enabled (`enableRbacAuthorization: true`).
-  * Public network access is allowed. Private endpoints are not supported.
-  * Purge protection is enabled (`enablePurgeProtection: true`). You can't turn off purge protection after you enable it.
-  * Diagnostic settings route the `AuditEvent` log category to Log Analytics, a storage account, or an event hub. Without them, you have no audit trail of Anthropic's key operations, such as `KeyWrap`, `KeyUnwrap`, and `KeyGet`.
+* You can create keys in your key vault and assign RBAC roles on it.
+* You can create service principals in your Entra tenant (Application Administrator, Cloud Application Administrator, or an equivalent custom role).
+* The vault has a diagnostic setting for the `AuditEvent` log category. Without one, Anthropic's key operations leave no audit trail.
 
-* Permissions to create keys in the vault and to assign RBAC roles on it.
+## In Azure: create the key
 
-* Permissions to create service principals in your Entra tenant (`Application Administrator`, `Cloud Application Administrator`, or an equivalent custom role).
+After a failed **Verify** or **Add**, see the [fixes for Azure Key Vault](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#azure-key-vault).
 
-* The [`az` CLI](https://learn.microsoft.com/en-us/cli/azure/?view=azure-cli-latest) installed and authenticated, or Cloud Shell in the Azure portal. Some steps have no portal equivalent.
+These steps give Anthropic's multitenant application access to your key:
 
-* To register the key through the API, an Anthropic Admin API key for your organization.
+* **Name:** `anthropic-cmek-client-us`
+* **Client ID:** `8635ae1a-3e5d-44e8-a4ed-e0f614466f87`
 
-## Anthropic app information
+Use only this client ID and name, never ones sent by email or chat. The application requests no Microsoft Graph permissions.
 
-You give the following Anthropic multitenant application access to your key. The application requests no Microsoft Graph permissions.
+### Check the vault
 
-| Field                          | Value                                  |
-| ------------------------------ | -------------------------------------- |
-| Multitenant app client ID (US) | `8635ae1a-3e5d-44e8-a4ed-e0f614466f87` |
-| App display name               | `anthropic-cmek-client-us`             |
+For the lowest latency, use a vault in `northcentralus` or `eastus2`. Run this first, in the Azure CLI or Cloud Shell:
 
-<Warning>
-  Use only this published client ID and display name. Never trust an identifier provided over email, chat, or any onboarding channel.
-</Warning>
-
-## Encryption key setup
-
-The key must meet these requirements:
-
-* **Type:** RSA, 3072-bit or larger. For an HSM-backed key, use `RSA-HSM`, which requires a Premium-SKU vault.
-* **Permitted operations:** `wrapKey` and `unwrapKey`. The steps in this guide turn off every other operation, so Anthropic can only read the key and wrap and unwrap with it.
-* **Organization tag:** `anthropic-org-<ORGANIZATION_UUID>` with the value `true`. Replace `<ORGANIZATION_UUID>` with your Anthropic organization ID in lowercase. Validation fails without the tag.
-* **Access:** the `Key Vault Crypto User` role for Anthropic's service principal, assigned on the key.
+```bash
+az keyvault show --name <your-vault-name> \
+  --query "{rbac:properties.enableRbacAuthorization, purge:properties.enablePurgeProtection, pub:properties.publicNetworkAccess, net:properties.networkAcls.defaultAction, ipRules:properties.networkAcls.ipRules, uri:properties.vaultUri, tenantId:properties.tenantId}"
+```
 
-<Note>
-  **Finding your organization ID:** Use the bare UUID, not the `org_`-prefixed ID. Copy it from one of these places:
+| Field   | Must be                                                                                                                                                  |
+| ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `rbac`  | `true`                                                                                                                                                   |
+| `purge` | `true`. If it's `false` or `null`, turn on purge protection first. You can't turn it off again.                                                          |
+| `pub`   | `"Enabled"`. Private endpoints aren't supported.                                                                                                         |
+| `net`   | `"Allow"`, or `"Deny"` with [Anthropic's outbound IP addresses](https://platform.claude.com/docs/en/api/ip-addresses#outbound-ip-addresses) in `ipRules` |
 
-  * **Claude Console:** the **Organization ID** field on the [Organization](https://platform.claude.com/settings/organization) page (`platform.claude.com/settings/organization`)
-  * **claude.ai:** the **Organization ID** field under **Organization settings > Organization**
-  * **Admin API:** the `id` field from the [Organization Info](https://platform.claude.com/docs/en/api/organization/retrieve) endpoint
-</Note>
+Copy `uri` (the vault URI) and `tenantId`.
 
 ### Create the key and grant access
 
+On this page, `<ORGANIZATION_UUID>` is your [Anthropic organization ID](https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault#prerequisites) in lowercase. To use a key you already have, [add the organization tag](https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault#organization-tag) first.
+
 <Tabs>
   <Tab title="Azure portal">
     <Steps>
@@ -137,14 +131,6 @@ The key must meet these requirements:
         On the **Review + assign** tab, click **Review + assign**.
       </Step>
     </Steps>
-
-    To use a key you already have, follow these steps instead of steps 3 to 6, then continue from step 7:
-
-    1. In your key vault, select **Keys** and open the key. Open its current version.
-    2. Click the link next to **Tags**.
-    3. Add the organization tag and click **OK**.
-    4. Under **Permitted operations**, clear every checkbox except **Wrap Key** and **Unwrap Key**.
-    5. Click **Save**.
   </Tab>
 
   <Tab title="Azure CLI">
@@ -200,499 +186,74 @@ The key must meet these requirements:
         * **`<your-key-name>`:** the name of the key
       </Step>
     </Steps>
-
-    To use a key you already have, run this command instead of step 2:
-
-    ```bash
-    az keyvault key set-attributes \
-      --vault-name <your-vault-name> \
-      --name <your-key-name> \
-      --ops wrapKey unwrapKey \
-      --tags anthropic-org-<ORGANIZATION_UUID>=true
-    ```
-
-    This replaces the version's existing tags. Add each existing tag to `--tags` as `name=value`.
   </Tab>
 </Tabs>
 
-<Note>
-  **Optional:**
+Whoever adds the key in Claude needs the vault URI, the key name, and the tenant ID.
 
-  * To share one key among several Anthropic organizations, add one organization tag for each. A key version can carry at most 15 tags, including your own.
-  * If the vault holds only this key, you can assign the role on the vault instead of the key.
-</Note>
+### Add the organization tag to a key you already have
 
-### Check your vault configuration
+Verification fails without the organization tag. The key must be RSA, 3072-bit or larger.
 
-Run this command with the Azure CLI or in Cloud Shell. Replace `<your-vault-name>` with the name of your key vault.
+Instead of creating a key, run this command in the Azure CLI or Cloud Shell. It limits the key to `wrapKey` and `unwrapKey`. It also replaces the current version's tags, so list any you want to keep in `--tags` as `name=value`.
 
 ```bash
-az keyvault show --name <your-vault-name> \
-  --query "{rbac:properties.enableRbacAuthorization, purge:properties.enablePurgeProtection, pub:properties.publicNetworkAccess, net:properties.networkAcls.defaultAction, ipRules:properties.networkAcls.ipRules, uri:properties.vaultUri, tenantId:properties.tenantId}"
+az keyvault key set-attributes \
+  --vault-name <your-vault-name> \
+  --name <your-key-name> \
+  --ops wrapKey unwrapKey \
+  --tags anthropic-org-<ORGANIZATION_UUID>=true
 ```
 
-Confirm these values:
+You still need the service principal and role assignment steps.
 
-* `rbac`: `true`
-* `purge`: `true`. If it's `false` or `null`, enable purge protection before you continue.
-* `pub`: `"Enabled"`. If it's `"Disabled"`, turn on public network access.
-* `net`: `"Allow"`, or `"Deny"` with Anthropic's outbound IP ranges in `ipRules`. For the ranges, see [Outbound IP addresses](https://platform.claude.com/docs/en/api/ip-addresses#outbound-ip-addresses).
+## In Claude: add and attach the key
 
-Copy these values to register the key:
-
-* `uri`: the vault URI
-* `tenantId`: the ID of the tenant that governs the vault
-
-## Register the key with Anthropic
+To script this part on Claude Platform, [use the Admin API](https://platform.claude.com/docs/en/manage-claude/cmek-admin-api) instead.
 
 <Tabs>
   <Tab title="Claude Platform">
-    <Tabs>
-      <Tab title="Claude Console">
-        <Steps>
-          <Step title="Open the encryption key settings">
-            In the Claude Console, go to the [Data retention](https://platform.claude.com/settings/privacy#encryption-keys) page (`platform.claude.com/settings/privacy`). If you don't see **Encryption keys**, select **Organization** from the dropdown menu at the top of the page.
-          </Step>
-
-          <Step title="Add the key">
-            Under **Encryption keys**, click **Add key**. Enter a **Display name** and select **Azure Key Vault**. Click **Continue**.
-          </Step>
-
-          <Step title="Enter the key details">
-            The dialog box shows an **Organization tag**. Check that your key has this tag. Enter these values:
-
-            * **Vault URI:** the `uri` value that you copied
-            * **Key name:** the name of the key
-            * **Tenant ID:** the `tenantId` value that you copied
-
-            Click **Add**.
-          </Step>
-
-          <Step title="Validate the key">
-            In the **Encryption keys** list, click **Verify** next to the key. **Connected** appears when the check passes. If it fails, see [Troubleshoot validation](https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault#troubleshoot-validation) for common causes.
-          </Step>
-
-          <Step title="Attach the key to a workspace">
-            Attaching a key can't be undone. If you can, attach it to a new workspace before that workspace receives any requests. In a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).
-
-            On the Data retention page, select the workspace from the dropdown menu at the top of the page. Under **Encryption key**, select the key and click **Save**.
-          </Step>
-
-          <Step title="Confirm the change">
-            Select the checkbox to confirm that you have read the CMEK documentation, then click **Confirm**.
-          </Step>
-        </Steps>
-      </Tab>
-
-      <Tab title="API">
-        <Steps>
-          <Step title="Create the external key">
-            Replace the placeholders:
-
-            * **`<friendly-name>`:** a display name for the key
-            * **`<your-vault-name>`:** the name of your key vault
-            * **`<your-key-name>`:** the name of the key
-            * **`<your-tenant-id>`:** the `tenantId` value that you copied
-
-            <CodeGroup>
-              ```bash cURL
-              curl -sS "https://api.anthropic.com/v1/organizations/external_keys" \
-                -H "x-api-key: $ANTHROPIC_API_KEY" \
-                -H "anthropic-version: 2023-06-01" \
-                -H "content-type: application/json" \
-                -d '{
-                  "display_name": "<friendly-name>",
-                  "geo": "us",
-                  "provider_config": {
-                    "type": "azure",
-                    "vault_uri": "https://<your-vault-name>.vault.azure.net/",
-                    "key_name": "<your-key-name>",
-                    "tenant_id": "<your-tenant-id>"
-                  }
-                }'
-              ```
-
-              ```bash CLI
-              ant organization:external-keys create <<'YAML'
-              display_name: "<friendly-name>"
-              geo: us
-              provider_config:
-                type: azure
-                vault_uri: "https://<your-vault-name>.vault.azure.net/"
-                key_name: "<your-key-name>"
-                tenant_id: "<your-tenant-id>"
-              YAML
-              ```
-
-              ```python Python
-              client = anthropic.Anthropic()
-
-              external_key = client.organization.external_keys.create(
-                  display_name="<friendly-name>",
-                  geo="us",
-                  provider_config={
-                      "type": "azure",
-                      "vault_uri": "https://<your-vault-name>.vault.azure.net/",
-                      "key_name": "<your-key-name>",
-                      "tenant_id": "<your-tenant-id>",
-                  },
-              )
-
-              print(f"id: {external_key.id}")
-              print(f"display_name: {external_key.display_name}")
-              ```
-
-              ```typescript TypeScript
-              const client = new Anthropic();
-
-              const externalKey = await client.organization.externalKeys.create({
-                display_name: "<friendly-name>",
-                geo: "us",
-                provider_config: {
-                  type: "azure",
-                  vault_uri: "https://<your-vault-name>.vault.azure.net/",
-                  key_name: "<your-key-name>",
-                  tenant_id: "<your-tenant-id>"
-                }
-              });
-
-              console.log(`id: ${externalKey.id}`);
-              console.log(`display_name: ${externalKey.display_name}`);
-              ```
-
-              ```csharp C#
-              using Anthropic.Models.Organization.ExternalKeys;
-
-              AnthropicClient client = new();
-
-              var externalKey = await client.Organization.ExternalKeys.Create(new()
-              {
-                  DisplayName = "<friendly-name>",
-                  Geo = Geo.Us,
-                  ProviderConfig = new AzureExternalKeyConfigParam
-                  {
-                      VaultUri = "https://<your-vault-name>.vault.azure.net/",
-                      KeyName = "<your-key-name>",
-                      TenantID = "<your-tenant-id>"
-                  }
-              });
-
-              Console.WriteLine($"id: {externalKey.ID}");
-              Console.WriteLine($"display_name: {externalKey.DisplayName}");
-              ```
-
-              ```go Go
-              client := anthropic.NewClient()
-
-              externalKey, err := client.Organization.ExternalKeys.New(context.Background(), anthropic.OrganizationExternalKeyNewParams{
-              	DisplayName: anthropic.String("<friendly-name>"),
-              	Geo:         anthropic.OrganizationExternalKeyNewParamsGeoUs,
-              	ProviderConfig: anthropic.OrganizationExternalKeyNewParamsProviderConfigUnion{
-              		OfAzure: &anthropic.AzureExternalKeyConfigParam{
-              			VaultURI: "https://<your-vault-name>.vault.azure.net/",
-              			KeyName:  "<your-key-name>",
-              			TenantID: "<your-tenant-id>",
-              		},
-              	},
-              })
-              if err != nil {
-              	log.Fatal(err)
-              }
-
-              fmt.Printf("id: %s\n", externalKey.ID)
-              fmt.Printf("display_name: %s\n", externalKey.DisplayName)
-              ```
-
-              ```java Java
-              import com.anthropic.models.organization.externalkeys.AzureExternalKeyConfigParam;
-              import com.anthropic.models.organization.externalkeys.ExternalKeyCreateParams;
-
-              void main() {
-                  AnthropicClient client = AnthropicOkHttpClient.fromEnv();
-
-                  var params = ExternalKeyCreateParams.builder()
-                      .displayName("<friendly-name>")
-                      .geo(ExternalKeyCreateParams.Geo.US)
-                      .providerConfig(AzureExternalKeyConfigParam.builder()
-                          .vaultUri("https://<your-vault-name>.vault.azure.net/")
-                          .keyName("<your-key-name>")
-                          .tenantId("<your-tenant-id>")
-                          .build())
-                      .build();
-                  var externalKey = client.organization().externalKeys().create(params);
-
-                  IO.println("id: " + externalKey.id());
-                  IO.println("display_name: " + externalKey.displayName().orElseThrow());
-              }
-              ```
-
-              ```php PHP
-              use Anthropic\Organization\ExternalKeys\ExternalKeyCreateParams\Geo;
-              // ...
-
-              $client = new Client();
-
-              $externalKey = $client->organization->externalKeys->create(
-                  displayName: '<friendly-name>',
-                  geo: Geo::US,
-                  providerConfig: [
-                      'type' => 'azure',
-                      'vaultURI' => 'https://<your-vault-name>.vault.azure.net/',
-                      'keyName' => '<your-key-name>',
-                      'tenantID' => '<your-tenant-id>',
-                  ],
-              );
-
-              echo "id: {$externalKey->id}\n";
-              echo "display_name: {$externalKey->displayName}\n";
-              ```
-
-              ```ruby Ruby
-              client = Anthropic::Client.new
-
-              external_key = client.organization.external_keys.create(
-                display_name: "<friendly-name>",
-                geo: :us,
-                provider_config: {
-                  type: :azure,
-                  vault_uri: "https://<your-vault-name>.vault.azure.net/",
-                  key_name: "<your-key-name>",
-                  tenant_id: "<your-tenant-id>"
-                }
-              )
-
-              puts "id: #{external_key.id}"
-              puts "display_name: #{external_key.display_name}"
-              ```
-            </CodeGroup>
-
-            The `id` field of the response contains the external key ID. Copy it for the next two steps:
-
-            ```json
-            {
-              "type": "external_key",
-              "id": "ekey_<id>",
-              "display_name": "<friendly-name>"
-            }
-            ```
-          </Step>
-
-          <Step title="Validate the key">
-            Replace `ekey_<id>` with the external key ID.
-
-            <CodeGroup>
-              ```bash cURL
-              curl -sS -X POST "https://api.anthropic.com/v1/organizations/external_keys/ekey_<id>/validate" \
-                -H "x-api-key: $ANTHROPIC_API_KEY" \
-                -H "anthropic-version: 2023-06-01"
-              ```
-
-              ```bash CLI
-              ant organization:external-keys validate --external-key-id "ekey_<id>"
-              ```
-
-              ```python Python
-              client = anthropic.Anthropic()
-
-              validation = client.organization.external_keys.validate("ekey_<id>")
-
-              print(f"status: {validation.status}")
-              print(f"error: {validation.error}")
-              ```
-
-              ```typescript TypeScript
-              const client = new Anthropic();
-
-              const validation = await client.organization.externalKeys.validate("ekey_<id>");
-
-              console.log(`status: ${validation.status}`);
-              console.log(`error: ${validation.error}`);
-              ```
-
-              ```csharp C#
-              AnthropicClient client = new();
-
-              var validation = await client.Organization.ExternalKeys.Validate("ekey_<id>");
-
-              Console.WriteLine($"status: {validation.Status.Raw()}");
-              Console.WriteLine($"error: {validation.Error}");
-              ```
-
-              ```go Go
-              client := anthropic.NewClient()
-
-              validation, err := client.Organization.ExternalKeys.Validate(context.Background(), "ekey_<id>")
-              if err != nil {
-              	log.Fatal(err)
-              }
-
-              fmt.Printf("status: %s\n", validation.Status)
-              fmt.Printf("error: %s\n", validation.Error)
-              ```
-
-              ```java Java
-              AnthropicClient client = AnthropicOkHttpClient.fromEnv();
-
-              var validation = client.organization().externalKeys().validate("ekey_<id>");
-
-              IO.println("status: " + validation.status().asString());
-              IO.println("error: " + validation.error().orElse(""));
-              ```
-
-              ```php PHP
-              $client = new Client();
-
-              $validation = $client->organization->externalKeys->validate(
-                  externalKeyID: 'ekey_<id>',
-              );
-
-              echo "status: {$validation->status}\n";
-              echo "error: {$validation->error}\n";
-              ```
-
-              ```ruby Ruby
-              client = Anthropic::Client.new
-
-              external_key_id = "ekey_<id>"
-              validation = client.organization.external_keys.validate(external_key_id)
-
-              puts "status: #{validation.status}"
-              puts "error: #{validation.error}"
-              ```
-            </CodeGroup>
-
-            A successful response looks like this:
-
-            ```json
-            { "type": "external_key_validation", "status": "success", "error": null }
-            ```
-
-            If validation fails, see [Troubleshoot validation](https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault#troubleshoot-validation).
-          </Step>
-
-          <Step title="Attach the key to a workspace">
-            Attaching a key can't be undone. If you can, attach it to a new workspace before that workspace receives any requests. In a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).
+    <Steps>
+      <Step title="Open the encryption key settings">
+        In the Claude Console, open [Encryption keys](https://platform.claude.com/settings/privacy#encryption-keys) on the Data retention page. If the section isn't there, select **Organization** from the dropdown menu at the top.
+      </Step>
 
-            Replace `<workspace-id>` with the workspace ID and `ekey_<id>` with the external key ID.
+      <Step title="Add the key">
+        Under **Encryption keys**, click **Add key**. Enter a **Display name**, select **Azure Key Vault**, and click **Continue**.
+      </Step>
 
-            <CodeGroup>
-              ```bash cURL
-              curl -sS -X POST "https://api.anthropic.com/v1/organizations/workspaces/<workspace-id>" \
-                -H "x-api-key: $ANTHROPIC_API_KEY" \
-                -H "anthropic-version: 2023-06-01" \
-                -H "content-type: application/json" \
-                -d '{
-                  "external_key_id": "ekey_<id>"
-                }'
-              ```
+      <Step title="Enter the key details">
+        Check that your key has the **Organization tag** shown in the dialog box. Enter the **Vault URI**, **Key name**, and **Tenant ID**, leave **Client ID** empty, and click **Add**.
+      </Step>
 
-              ```bash CLI
-              ant organization:workspaces update \
-                --workspace-id "<workspace-id>" \
-                --external-key-id "ekey_<id>"
-              ```
+      <Step title="Verify the key">
+        In the **Encryption keys** list, click **Verify** next to the key. **Connected** appears when the check passes. If **Connection failed** appears instead, see [Troubleshoot CMEK](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting).
+      </Step>
 
-              ```python Python
-              client = anthropic.Anthropic()
+      <Step title="Attach the key to a workspace">
+        <Warning>
+          Attaching a key [can't be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). You can't remove it from the workspace or replace it. If the key is deleted, Anthropic can't recover the data it protects.
+        </Warning>
 
-              workspace = client.organization.workspaces.update(
-                  "<workspace-id>", external_key_id="ekey_<id>"
-              )
+        1. At the top of the Data retention page, select the workspace from the dropdown menu.
+        2. Under **Encryption key**, select the key and click **Save**.
+        3. Select the checkbox to confirm that you have read the CMEK documentation, then click **Confirm**.
 
-              print(f"id: {workspace.id}")
-              print(f"external_key_id: {workspace.external_key_id}")
-              ```
+        You see **Workspace settings updated.** Once the key [takes effect](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect), your cloud provider's audit log shows Anthropic's calls to the key.
 
-              ```typescript TypeScript
-              const client = new Anthropic();
-
-              const workspace = await client.organization.workspaces.update("<workspace-id>", {
-                external_key_id: "ekey_<id>"
-              });
-
-              console.log(`id: ${workspace.id}`);
-              console.log(`external_key_id: ${workspace.external_key_id}`);
-              ```
-
-              ```csharp C#
-              AnthropicClient client = new();
-
-              var workspace = await client.Organization.Workspaces.Update("<workspace-id>", new()
-              {
-                  ExternalKeyID = "ekey_<id>"
-              });
-
-              Console.WriteLine($"id: {workspace.ID}");
-              Console.WriteLine($"external_key_id: {workspace.ExternalKeyID}");
-              ```
-
-              ```go Go
-              client := anthropic.NewClient()
-
-              workspace, err := client.Organization.Workspaces.Update(
-              	context.Background(),
-              	"<workspace-id>",
-              	anthropic.OrganizationWorkspaceUpdateParams{
-              		ExternalKeyID: anthropic.String("ekey_<id>"),
-              	},
-              )
-              if err != nil {
-              	log.Fatal(err)
-              }
-
-              fmt.Printf("id: %s\n", workspace.ID)
-              fmt.Printf("external_key_id: %s\n", workspace.ExternalKeyID)
-              ```
-
-              ```java Java
-              import com.anthropic.models.organization.workspaces.WorkspaceUpdateParams;
-
-              void main() {
-                  AnthropicClient client = AnthropicOkHttpClient.fromEnv();
-
-                  var params = WorkspaceUpdateParams.builder()
-                      .externalKeyId("ekey_<id>")
-                      .build();
-                  var workspace = client.organization().workspaces().update("<workspace-id>", params);
-
-                  IO.println("id: " + workspace.id());
-                  IO.println("external_key_id: " + workspace.externalKeyId().orElseThrow());
-              }
-              ```
-
-              ```php PHP
-              $client = new Client();
-
-              $workspace = $client->organization->workspaces->update(
-                  workspaceID: '<workspace-id>',
-                  externalKeyID: 'ekey_<id>',
-              );
-
-              echo "id: {$workspace->id}\n";
-              echo "external_key_id: {$workspace->externalKeyID}\n";
-              ```
-
-              ```ruby Ruby
-              client = Anthropic::Client.new
-
-              workspace_id = "<workspace-id>"
-              workspace = client.organization.workspaces.update(
-                workspace_id,
-                external_key_id: "ekey_<id>"
-              )
-
-              puts "id: #{workspace.id}"
-              puts "external_key_id: #{workspace.external_key_id}"
-              ```
-            </CodeGroup>
-          </Step>
-        </Steps>
-      </Tab>
-    </Tabs>
+        In a [ZDR organization](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#zdr-organizations), after you select the workspace, select **Standard data retention** so that **Encryption key** appears. After you click **Save**, click **Accept** on the data retention terms.
+      </Step>
+    </Steps>
   </Tab>
 
   <Tab title="Claude Enterprise">
-    On Claude Enterprise, CMEK applies to the whole organization, and an organization can have only one key.
+    On Claude Enterprise, CMEK applies to the whole organization, and you can add only one key.
+
+    <Warning>
+      Adding a key [can't be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). You can't remove it from the organization or replace it. If the key is deleted, Anthropic can't recover the data it protects.
+    </Warning>
+
+    Adding the key [turns off or changes some features](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#turned-off-or-changed) for every user. To try CMEK first, use a separate organization.
 
     <Steps>
       <Step title="Open the encryption key settings">
@@ -704,31 +265,14 @@ Copy these values to register the key:
       </Step>
 
       <Step title="Enter the key details">
-        The dialog box shows an **Organization tag**. Check that your key has this tag. Enter these values:
-
-        * **Vault URI:** the `uri` value that you copied
-        * **Key name:** the name of the key
-        * **Tenant ID:** the `tenantId` value that you copied
-
-        Click **Add**.
+        Check that your key has the **Organization tag** shown in the dialog box. Enter the **Vault URI**, **Key name**, and **Tenant ID**, leave **Client ID** empty, and click **Add**.
       </Step>
 
-      <Step title="Confirm that validation passed">
-        When the check passes, **Encryption key configured** appears, and your organization is CMEK-protected from then on. If the check fails, see [Troubleshoot validation](https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault#troubleshoot-validation).
+      <Step title="Confirm that the key was added">
+        The check can take up to 30 seconds. When **Encryption key configured.** appears, click **Done**. If **The encryption key couldn’t be added.** appears instead, [find the cause and retry](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#claude-ai-add-fails).
+
+        Your key protects data written from then on. Tell your users [which features changed](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#turned-off-or-changed).
       </Step>
     </Steps>
   </Tab>
 </Tabs>
-
-## Troubleshoot validation
-
-If validation fails, common causes are:
-
-* **Wrong organization tag:** Make sure the key's current version has the tag `anthropic-org-<ORGANIZATION_UUID>` with the value `true`. The organization ID must be the bare UUID in lowercase.
-* **RBAC propagation delay:** Role assignments can take a few minutes to take effect. Wait and retry.
-* **Network ACLs blocking Anthropic:** Confirm public network access and `ipRules`, as described in [Check your vault configuration](https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault#check-your-vault-configuration).
-* **Conditional access policies on workload identities:** If your tenant has conditional access policies that target service principals, exclude the Anthropic service principal. Or add Anthropic's outbound IP ranges to the policy's named locations.
-
-## Terraform
-
-To create the key with Terraform, use the `azurerm` and `azuread` providers.
diff --git a/content/en/manage-claude/cmek-claude-platform-on-aws.md b/content/en/manage-claude/cmek-claude-platform-on-aws.md
index 3a9660ecf3..26df8ace2b 100644
--- a/content/en/manage-claude/cmek-claude-platform-on-aws.md
+++ b/content/en/manage-claude/cmek-claude-platform-on-aws.md
@@ -1,50 +1,38 @@
 ---
 title: Set up CMEK on Claude Platform on AWS
 url: https://platform.claude.com/docs/en/manage-claude/cmek-claude-platform-on-aws
-description: Use an AWS KMS key as a customer-managed encryption key on Claude Platform on AWS.
+description: Create an AWS KMS key in your AWS account and attach it to a workspace on Claude Platform on AWS.
 ---
 
-This guide shows how to use an [AWS KMS](https://aws.amazon.com/kms/) key as a [customer-managed encryption key (CMEK)](https://platform.claude.com/docs/en/manage-claude/cmek) on [Claude Platform on AWS](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws). For Claude Platform or Claude Enterprise, follow [Configure AWS KMS for CMEK](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms) instead.
+If your Claude Console sidebar doesn't show **Account managed by AWS**, follow [Set up CMEK with AWS KMS](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms) instead.
 
-<Warning>
-  Enabling CMEK is permanent. If your key is deleted or disabled, Anthropic cannot recover the data encrypted under it. Review the [warnings and limitations](https://platform.claude.com/docs/en/manage-claude/cmek) before you start.
-</Warning>
+## Before you start
 
-## Prerequisites
+* Customer-managed encryption keys (CMEK) are [turned on for your organization](https://platform.claude.com/docs/en/manage-claude/cmek#availability).
 
-* The AWS account that hosts your Claude Platform on AWS organization, with permissions to create KMS keys and set key policies (`kms:CreateKey` and `kms:PutKeyPolicy`).
+* In the AWS account that hosts your organization, you can create AWS KMS keys and set key policies (`kms:CreateKey` and `kms:PutKeyPolicy`).
 
-* To create the key from the command line, the [AWS CLI](https://aws.amazon.com/cli/) installed and authenticated.
+* You have the **Admin** role in the [Claude Console](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#using-the-claude-console).
 
-* The **Admin** role in the Claude Console for Claude Platform on AWS. See [Using the Claude Console](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#using-the-claude-console).
+* The IAM principal you sign in with has these permissions:
 
-* These permissions for the IAM principal you sign in to the Claude Console with:
+  * Sign in: `aws-external-anthropic:AssumeConsole`
+  * Add a key: `aws-external-anthropic:RegisterKey`
+  * View keys: `aws-external-anthropic:ListKeys` and `aws-external-anthropic:GetKey`
+  * Attach a key: `aws-external-anthropic:UpdateWorkspace` or `aws-external-anthropic:CreateWorkspace`, plus `kms:DescribeKey`, `kms:Encrypt`, and `kms:Decrypt` on the key
+  * Pick the key from a list (optional): `kms:ListKeys` and `kms:DescribeKey`
 
-  * **Sign in:** `aws-external-anthropic:AssumeConsole`
-  * **Register a key:** `aws-external-anthropic:RegisterKey`
-  * **View registered keys:** `aws-external-anthropic:ListKeys` and `aws-external-anthropic:GetKey`
-  * **Attach a key:** `aws-external-anthropic:UpdateWorkspace` or `aws-external-anthropic:CreateWorkspace`, plus `kms:DescribeKey`, `kms:Encrypt`, and `kms:Decrypt` on the key
-  * **Pick the key from a list (optional):** `kms:ListKeys` and `kms:DescribeKey`
+  To scope them, see [IAM actions](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#encryption-keys).
 
-  `aws-external-anthropic:RegisterKey`, `aws-external-anthropic:ListKeys`, `aws-external-anthropic:GetKey`, and `aws-external-anthropic:CreateWorkspace` are account-scoped. Grant them on `Resource: "*"`. See [IAM actions](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#encryption-keys).
+* You have a workspace with no key attached, ideally a new one, because [existing data stays under Anthropic's key](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect). The key policy lists its compartment ID.
 
-## AWS service principal for Anthropic
+In the Claude Console, open the [Data retention](https://platform.claude.com/settings/privacy) page and select the workspace from the dropdown menu at the top. Copy the **Compartment ID** under **Encryption key**. The [Get Workspace](https://platform.claude.com/docs/en/api/organization/workspaces/retrieve) endpoint returns it as `compartment_id`.
 
-The key policy in this guide gives the following AWS service principal access to your key:
+## In AWS: create the key
 
-```text wrap
-aws-external-anthropic.amazonaws.com
-```
-
-<Warning>
-  Use only this published service principal name. Never trust an identifier provided over email, chat, or any onboarding channel.
-</Warning>
-
-## Encryption key setup
+### Write the key policy
 
-### Prepare the key policy
-
-Copy this policy into a text editor:
+This policy gives the AWS service principal `aws-external-anthropic.amazonaws.com` access to your key. Use only the name published on this page, never one sent by email or chat. Copy the policy into a text editor:
 
 ```json key-policy.json
 {
@@ -86,37 +74,25 @@ Copy this policy into a text editor:
 }
 ```
 
-The `EncryptionContext` condition is optional. It limits the key to the workspaces you list. To remove it, delete the `Condition` block from the `AllowClaudePlatformOnAWSCrypto` statement.
-
-If you keep the condition, add each workspace's compartment ID before you attach the key to it. For a new workspace:
-
-1. Create the workspace without the key.
-2. Add its compartment ID to the policy.
-3. Attach the key.
+Replace `<AWS_ACCOUNT_ID>` with your [AWS account ID](https://docs.aws.amazon.com/IAM/latest/UserGuide/console-account-id.html) and `<COMPARTMENT_UUID>` with the [compartment ID](https://platform.claude.com/docs/en/manage-claude/cmek-claude-platform-on-aws#prerequisites).
 
-If you add the condition later, list the compartment ID of every workspace the key is already attached to.
+The optional `EncryptionContext` condition limits the key to the workspaces you list. Before you attach the key to another workspace, add that workspace's compartment ID and [replace the policy on the key](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms-workspaces#replace-the-key-policy). To do without the condition, delete the `Condition` block from the `AllowClaudePlatformOnAWSCrypto` statement. If you add the condition later, list every workspace the key is already attached to.
 
-To limit the key policy further, see the [optional `aws:SourceArn` condition](https://platform.claude.com/docs/en/manage-claude/cmek-claude-platform-on-aws#source-arn-condition).
+To narrow access further, use the key policy, not IP-based restrictions. Add an `aws:SourceArn` condition to both service principal statements. This one allows every workspace in your AWS account:
 
-Replace the placeholders:
-
-* **`<AWS_ACCOUNT_ID>`:** your [AWS account ID](https://docs.aws.amazon.com/IAM/latest/UserGuide/console-account-id.html). To print it with the AWS CLI, run `aws sts get-caller-identity --query Account --output text`.
-* **`<COMPARTMENT_UUID>`:** the compartment ID of the workspace you attach the key to
-
-<Note>
-  **Finding your compartment ID:** In the Claude Console, go to the [Data retention](https://platform.claude.com/settings/privacy) page (`platform.claude.com/settings/privacy`). Select the workspace from the dropdown menu at the top of the page. The ID is under **Encryption key**, in the **Compartment ID** field. You can also read the `compartment_id` field returned by the [Get Workspace](https://platform.claude.com/docs/en/api/organization/workspaces/retrieve) endpoint.
-</Note>
+```text wrap
+"ArnLike": {"aws:SourceArn": "arn:aws:aws-external-anthropic:*:<AWS_ACCOUNT_ID>:workspace/*"}
+```
 
-<Note>
-  **Optional:** To limit both service principal statements further, add an `aws:SourceArn` condition to each. The source ARN on every call is the [workspace's ARN](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#service-details), in the form `arn:aws:aws-external-anthropic:<REGION>:<AWS_ACCOUNT_ID>:workspace/<WORKSPACE_ID>`.
+For specific workspaces, list their full [workspace ARNs](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#service-details) instead, in this form:
 
-  * **All workspaces in your AWS account:** `"ArnLike": {"aws:SourceArn": "arn:aws:aws-external-anthropic:*:<AWS_ACCOUNT_ID>:workspace/*"}`
-  * **Specific workspaces:** the same condition, with a list of full workspace ARNs instead of the wildcard
-</Note>
+```text wrap
+arn:aws:aws-external-anthropic:<REGION>:<AWS_ACCOUNT_ID>:workspace/<WORKSPACE_ID>
+```
 
 ### Create the key
 
-Create the key in the AWS account that hosts your Claude Platform on AWS organization, in the same region as the workspace.
+Create the key in the AWS account that hosts your organization, in the same region as the workspace.
 
 <Tabs>
   <Tab title="AWS Console">
@@ -136,7 +112,7 @@ Create the key in the AWS account that hosts your Claude Platform on AWS organiz
         Click **Next**.
 
         <Frame caption="Symmetric, encrypt and decrypt, single-Region key.">
-          ![AWS KMS Create key wizard on the Configure key step, with Symmetric key type, Encrypt and decrypt key usage, and Single-Region key selected.](https://platform.claude.com/docs/images/cmek/aws-configure-key.png)
+          ![AWS KMS Configure key step with Symmetric key type, Encrypt and decrypt key usage, and Single-Region key selected.](https://platform.claude.com/docs/images/cmek/aws-configure-key.png)
         </Frame>
       </Step>
 
@@ -169,17 +145,9 @@ Create the key in the AWS account that hosts your Claude Platform on AWS organiz
       </Step>
 
       <Step title="Copy the key ARN">
-        In **Customer managed keys**, open the new key and copy its ARN. You need the ARN to register the key.
+        In **Customer managed keys**, open the new key and copy its ARN. Whoever adds the key in Claude needs it.
       </Step>
     </Steps>
-
-    To replace the key policy on a key that already exists:
-
-    1. Open the key and click the **Key policy** tab.
-    2. If you see **Switch to policy view**, click it.
-    3. Click **Edit**.
-    4. Replace the JSON with your key policy.
-    5. Click **Save changes**.
   </Tab>
 
   <Tab title="AWS CLI">
@@ -193,58 +161,38 @@ Create the key in the AWS account that hosts your Claude Platform on AWS organiz
       --policy file://key-policy.json
     ```
 
-    Copy `KeyMetadata.Arn` from the output. You need it to register the key.
+    Copy `KeyMetadata.Arn` from the output. Whoever adds the key in Claude needs the ARN.
   </Tab>
 </Tabs>
 
-## Register the key with Anthropic
+## In Claude: add and attach the key
 
-Sign in to the Claude Console through AWS with the Admin role.
+Sign in to the Claude Console through AWS. To script this part instead, use the endpoints listed in [IAM actions](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#encryption-keys).
 
 <Steps>
   <Step title="Open the encryption key settings">
-    In the Claude Console, go to the [Data retention](https://platform.claude.com/settings/privacy#encryption-keys) page (`platform.claude.com/settings/privacy`). If you don't see **Encryption keys**, select **Organization** from the dropdown menu at the top of the page.
+    In the Claude Console, open [Encryption keys](https://platform.claude.com/settings/privacy#encryption-keys) on the Data retention page. If the section isn't there, select **Organization** from the dropdown menu at the top.
   </Step>
 
   <Step title="Add the key">
-    Under **Encryption keys**, click **Add key**. Enter a **Display name**.
+    Under **Encryption keys**, click **Add key** and enter a **Display name**.
   </Step>
 
   <Step title="Enter the key ARN">
-    Anthropic rejects alias ARNs and multi-Region keys.
-
-    In **KMS key ARN**, paste the key ARN. If a list of keys appears instead, select your key, or click **Enter ARN manually** and paste the ARN. Click **Add**.
+    In **KMS key ARN**, select your key. If it isn't listed, click **Enter ARN manually** and paste the ARN. Anthropic rejects alias ARNs and multi-Region keys. Click **Add**.
   </Step>
 
   <Step title="Attach the key to a workspace">
-    Attaching a key can't be undone. If you can, attach it to a new workspace before that workspace receives any requests. In a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).
+    <Warning>
+      Attaching a key [can't be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). You can't remove it from the workspace or replace it. If the key is deleted, Anthropic can't recover the data it protects.
+    </Warning>
 
-    On the Data retention page, select the workspace from the dropdown menu at the top of the page. Under **Encryption key**, select the key and click **Save**.
-  </Step>
+    1. At the top of the Data retention page, select the workspace from the dropdown menu.
+    2. Under **Encryption key**, select the key and click **Save**.
+    3. Select the checkbox to confirm that you have read the CMEK documentation, then click **Confirm**.
+
+    You see **Workspace settings updated.** Once the key [takes effect](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect), CloudTrail records the calls to your key.
 
-  <Step title="Confirm the change">
-    Select the checkbox to confirm that you have read the CMEK documentation, then click **Confirm**.
+    Attaching checks the key with one encrypt call and one decrypt call, so a key policy problem shows up here. If you get a KMS access error, see the [causes and fixes](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#claude-platform-on-aws).
   </Step>
 </Steps>
-
-Attaching validates the key. If it fails with a KMS access error, see [Troubleshoot validation](https://platform.claude.com/docs/en/manage-claude/cmek-claude-platform-on-aws#troubleshoot-validation).
-
-You can also select a key when you create a workspace in the Claude Console, if your key policy has no `EncryptionContext` condition.
-
-To register and attach keys with the API instead, see [IAM actions](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#encryption-keys). The API identifies a key by its KMS key ARN.
-
-## Troubleshoot validation
-
-If validation fails, common causes are:
-
-* **Key policy mismatch:** Make sure the key policy matches the one in [Prepare the key policy](https://platform.claude.com/docs/en/manage-claude/cmek-claude-platform-on-aws#prepare-the-key-policy). To check the key policy, run `aws kms get-key-policy --region <REGION> --key-id <KEY_ARN> --policy-name default`.
-* **Condition mismatch:** Make sure any `EncryptionContext` or `aws:SourceArn` condition includes this workspace.
-* **Key state or location:** Confirm that the key is enabled, single-Region, and in the same AWS account and region as the workspace.
-* **Missing permissions:** The principal you are signed in as needs `kms:DescribeKey`, `kms:Encrypt`, and `kms:Decrypt` on the key.
-* **Organization policies:** Make sure no service control policy or resource control policy in your AWS organization blocks the service principal or your principal.
-
-If attaching still fails, find the denied `kms:` event in CloudTrail in the key's account. It shows the calling principal and, for cryptographic calls, the encryption context. After you fix the cause, click **Save** again.
-
-## Terraform
-
-To create the key with Terraform, use the `aws_kms_key` and `aws_kms_alias` resources from the `aws` provider.
diff --git a/content/en/manage-claude/cmek-coverage-claude-enterprise.md b/content/en/manage-claude/cmek-coverage-claude-enterprise.md
new file mode 100644
index 0000000000..39f53d370f
--- /dev/null
+++ b/content/en/manage-claude/cmek-coverage-claude-enterprise.md
@@ -0,0 +1,58 @@
+---
+title: What CMEK covers on Claude Enterprise
+url: https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise
+description: Look up which Claude Enterprise data your key encrypts, what turns off or changes, and what stays under Anthropic's key.
+---
+
+For Claude Platform, see [What CMEK covers on Claude Platform](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-platform). Beta and research preview features might not be covered by customer-managed encryption keys (CMEK) and can break in CMEK organizations.
+
+## Encrypted with your key
+
+* Chat content, including skills and plugins.
+* Chat attachments and project attachments.
+* Artifacts, including Claude Design, Claude Slides, and Claude Docs in conversations and the **Artifacts** tab.
+* Claude Code on the CLI, including message content.
+* Cowork in Claude Desktop.
+* Office agents.
+* Claude in Chrome.
+* Claude Science, which is in beta.
+* [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api#customer-managed-encryption-keys) (beta) plugin versions: each version's description, release notes, components, and files. That page lists which requests still work while your key can't be used.
+* Compliance API [local session transcripts](https://platform.claude.com/docs/en/manage-claude/compliance-sessions#retrieve-local-sessions) from sessions on users' machines. If your key can't be used, the messages endpoint returns [503 Service Unavailable](https://platform.claude.com/docs/en/manage-claude/compliance-errors#local-sessions-temporarily-unavailable) instead of transcript content. Session metadata is still listed.
+* Backups and snapshots, which inherit the key.
+
+## Turned off or changed
+
+This list is not exhaustive. Review it with your team before you set up CMEK.
+
+| Feature                                                                                                                                   | What people see                                                                                                                                                                                                                                                                                         |
+| ----------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Chat search                                                                                                                               | Off. Members can't search past chats, because chat titles and content are encrypted with your key. The **Search and reference chats** toggle stays off, so Claude can't either.                                                                                                                         |
+| [Project knowledge search](https://support.claude.com/en/articles/11473015-retrieval-augmented-generation-rag-for-projects) (RAG)         | Off. Project knowledge loads into each conversation's context instead of being indexed and searched. A project can use substantially less knowledge, and the rest is left out.                                                                                                                          |
+| Claude Code on the web                                                                                                                    | Off. New sessions can't be started, even if an admin turns the product on.                                                                                                                                                                                                                              |
+| Claude in Slack                                                                                                                           | Off. Claude declines requests, even if an admin turns the product on.                                                                                                                                                                                                                                   |
+| Claude Code Desktop                                                                                                                       | Off until an admin turns it on. Available for local sessions once turned on under [claude.ai > Organization settings > Claude Code](https://claude.ai/admin-settings/claude-code).                                                                                                                      |
+| Artifacts                                                                                                                                 | Changed. Artifacts, including Claude Design, Claude Slides, and Claude Docs in conversations and the **Artifacts** tab, cannot be turned on in organizations that also use ZDR. In organizations with HIPAA readiness, an Owner must first accept the terms for using them.                             |
+| Artifact publishing and sharing                                                                                                           | Changed. Claude Code cannot [publish artifacts](https://code.claude.com/docs/en/artifacts#availability). However, artifacts made in chat or Cowork can be shared within your organization, but not publicly.                                                                                            |
+| Standalone Claude Design app                                                                                                              | Not supported. See [Encrypted with Anthropic's key](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#encrypted-with-anthropics-key).                                                                                                                                   |
+| Analytics: smart reports and contribution metrics                                                                                         | Off. Certain analytics are disabled, regardless of admin settings: Claude smart reports (beta, under claude.ai/analytics/insights) and Claude Code contribution metrics from GitHub (beta, under claude.ai/analytics/claude-code).                                                                      |
+| Analytics: skills and connectors                                                                                                          | Changed. Admin analytics for skills and connectors, in the claude.ai analytics dashboard and through the [Claude Enterprise Analytics API](https://platform.claude.com/docs/en/manage-claude/analytics-api), don't include usage in chat, and hide the names of custom skills, plugins, and connectors. |
+| Organization data exports and audit log exports                                                                                           | Off. Both are under [claude.ai > Organization settings > Data and privacy](https://claude.ai/admin-settings/data-privacy-controls).                                                                                                                                                                     |
+| Response ratings (thumbs up and thumbs down)                                                                                              | Off. Members can't rate Claude's responses.                                                                                                                                                                                                                                                             |
+| [Skill and plugin security scanning](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/enterprise#skill-content-scanning) | Off. The setting can't be turned on, and skills and plugins are installed without a scan.                                                                                                                                                                                                               |
+| Claude Security and routines                                                                                                              | Off. Beta and research preview features, turned off regardless of admin settings.                                                                                                                                                                                                                       |
+
+## Encrypted with Anthropic's key
+
+The features that store this data stay available, but the data isn't encrypted with your key. You can turn off some of these features in **Settings**.
+
+| Data                                                | Details                                                                                                                                                                                                                                                                                                                                                                                                         |
+| --------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Existing data                                       | Written before [your key takes effect](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect).                                                                                                                                                                                                                                                                         |
+| Standalone Claude Design app                        | The standalone Claude Design app at claude.ai/design is not supported with CMEK, and its data might not be encrypted under your key. The standalone app is closing. Claude Design in conversations and the **Artifacts** tab is encrypted under your key, as listed under [Encrypted with your key](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#encrypted-with-your-key). |
+| Personal preferences and Cowork Global instructions | [Personal preferences - Instructions for Claude section](https://claude.ai/new#settings/account) and Cowork Global instructions. These are set at the account level and shared across all of a user's organizations.                                                                                                                                                                                            |
+| Account data for users in your organization         | Includes names, email addresses, and profile pictures.                                                                                                                                                                                                                                                                                                                                                          |
+| Preserved records                                   | Anthropic can preserve specific records [in three narrow cases](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#limited-preservation-outside-your-key).                                                                                                                                                                                                                                   |
+
+## Where CMEK does not apply: Claude Code telemetry
+
+When Claude Code connects through an LLM gateway or proxy (a custom `ANTHROPIC_BASE_URL`), CMEK does not apply to Claude Code's operational telemetry. To turn this telemetry off, set the `DISABLE_TELEMETRY` environment variable to `1`, as described under [Telemetry services](https://code.claude.com/docs/en/data-usage#telemetry-services) in the Claude Code documentation.
diff --git a/content/en/manage-claude/cmek-coverage-claude-platform.md b/content/en/manage-claude/cmek-coverage-claude-platform.md
new file mode 100644
index 0000000000..04ca491c29
--- /dev/null
+++ b/content/en/manage-claude/cmek-coverage-claude-platform.md
@@ -0,0 +1,48 @@
+---
+title: What CMEK covers on Claude Platform
+url: https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-platform
+description: Look up which Claude Platform data your key encrypts, what turns off or changes, and what stays under Anthropic's key.
+---
+
+For Claude Enterprise, see [What CMEK covers on Claude Enterprise](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise). Beta and research preview features that aren't listed here might not be covered by customer-managed encryption keys (CMEK).
+
+## Encrypted with your key
+
+* Message content.
+* Files and attachments, whether sent inline with a request or uploaded with the Files API.
+* MCP and tool configuration.
+* [Claude Managed Agents](https://platform.claude.com/docs/en/managed-agents/overview) (beta) data, including agent configurations, environments, webhooks, sessions and their events, [memory stores](https://platform.claude.com/docs/en/managed-agents/memory) (beta) and their memories and memory versions, and [dreams](https://platform.claude.com/docs/en/managed-agents/dreams) (research preview).
+* Batch API and Skills API data stored at rest.
+* Tool data stored at rest by web search, web fetch, code execution, bash, text editor, MCP connector (beta), structured outputs, advisor tool (beta), computer use, browser use, and context management.
+* Backups and snapshots, which inherit the key.
+
+## Turned off or changed
+
+This list is not exhaustive. Review it with your team before you set up CMEK.
+
+| Feature                                                                                                        | What changes                                                                                                                                                                                                                           |
+| -------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Playground in the Claude Console                                                                               | Turned off.                                                                                                                                                                                                                            |
+| Structured outputs, including `strict: true` on tools, with Claude Fable or Claude Mythos models               | Turned off in CMEK organizations. With other models, data that structured outputs store at rest is [encrypted with your key](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-platform#encrypted-with-your-key). |
+| [Organization webhooks](https://platform.claude.com/docs/en/manage-claude/organization-webhooks#errors) (beta) | Turned off for an organization whose default workspace uses a key. Requests return a 400 error.                                                                                                                                        |
+| Zero data retention (ZDR)                                                                                      | A workspace with your key retains data. See [CMEK, data retention, and ZDR](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention).                                                                                    |
+
+## Encrypted with Anthropic's key
+
+The features that store this data stay available, but the data isn't encrypted with your key. You can turn off some of these features in **Settings**.
+
+| Data                                                                                                                                                                                          | Details                                                                                                                                                                       |
+| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Existing data                                                                                                                                                                                 | Written before [your key takes effect](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect).                                       |
+| Data that isn't at rest, and data with a TTL shorter than 24 hours                                                                                                                            | For example, cache.                                                                                                                                                           |
+| Activity Feed, audit logs, and telemetry network traffic such as OpenTelemetry                                                                                                                | Kept under Anthropic's key so that you can maintain compliance even if your key can't be used.                                                                                |
+| Claude Managed Agents [vault credential](https://platform.claude.com/docs/en/managed-agents/vaults) values, such as OAuth tokens and client secrets                                           | Write-only and never returned in API responses.                                                                                                                               |
+| [User profiles](https://platform.claude.com/docs/en/manage-claude/user-profiles)                                                                                                              | Profile fields such as `name` and `metadata`. Don't store sensitive personal data in profile `metadata`.                                                                      |
+| Claude Console feedback                                                                                                                                                                       | Ratings and comments that members choose to send with the **Feedback** option. No setting turns it off.                                                                       |
+| [OpenTelemetry destination](https://platform.claude.com/docs/en/manage-claude/opentelemetry/api#add-a-destination) request headers, such as the API key header of your observability platform | Write-only and never returned in API responses.                                                                                                                               |
+| Account data for users in your organization                                                                                                                                                   | Includes names, email addresses, and profile pictures.                                                                                                                        |
+| Preserved records                                                                                                                                                                             | Anthropic can preserve specific records [in three narrow cases](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#limited-preservation-outside-your-key). |
+
+## Where CMEK does not apply: Claude Code telemetry
+
+When Claude Code connects through an LLM gateway or proxy (a custom `ANTHROPIC_BASE_URL`), CMEK does not apply to Claude Code's operational telemetry. To turn this telemetry off, set the `DISABLE_TELEMETRY` environment variable to `1`, as described under [Telemetry services](https://code.claude.com/docs/en/data-usage#telemetry-services) in the Claude Code documentation.
diff --git a/content/en/manage-claude/cmek-data-retention.md b/content/en/manage-claude/cmek-data-retention.md
new file mode 100644
index 0000000000..468a3a4463
--- /dev/null
+++ b/content/en/manage-claude/cmek-data-retention.md
@@ -0,0 +1,29 @@
+---
+title: CMEK, data retention, and ZDR
+url: https://platform.claude.com/docs/en/manage-claude/cmek-data-retention
+description: Why a workspace with a key retains data, what that means for ZDR, and what Anthropic can preserve outside your key.
+---
+
+On Claude Platform, customer-managed encryption keys (CMEK) and [zero data retention (ZDR)](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention) can't share a workspace. On Claude Enterprise, an organization can use CMEK and ZDR together, but it then [can't turn on artifacts](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#turned-off-or-changed).
+
+## A key needs a workspace that retains data
+
+CMEK encrypts stored data, and under ZDR on Claude Platform, Anthropic doesn't store your prompts or responses. So you can attach a key only to a workspace with **Standard data retention** (30 days).
+
+After you attach a key, you can't turn off data retention for that workspace. To return to ZDR, create a new workspace and move your traffic to it.
+
+## In a ZDR organization
+
+A ZDR organization on Claude Platform can use CMEK. You switch one workspace to **Standard data retention**, accept the data retention terms, and attach your key to it. The workspace you switch can't be the default workspace, whose retention follows the organization's. Your other workspaces keep ZDR.
+
+[Choose your setup page](https://platform.claude.com/docs/en/manage-claude/cmek#set-it-up) and follow its attach step.
+
+## Limited preservation outside your key
+
+In three narrow cases, Anthropic may preserve specific records under Anthropic-managed encryption:
+
+* Where Anthropic is required by law to retain records (for example, material reported to NCMEC under 18 U.S.C. § 2258A)
+* Exigent risk of serious harm (for example, CBRNE weapons development, offensive cyberattacks, or imminent threats of violence)
+* Violations of Section D.4 of Anthropic's [Commercial Terms of Service](https://www.anthropic.com/legal/commercial-terms) or equivalent terms in a customer's other applicable agreement with Anthropic
+
+Outside of [CSAM screening](https://support.claude.com/en/articles/9020328-csam-detection-and-reporting), preservation requires a human reviewer's explicit decision and follows Anthropic's [retention policy for commercial data](https://privacy.claude.com/en/articles/10023548-how-long-do-you-store-my-data). For every instance of preservation, a corresponding [Compliance API Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed) event is generated with a reason code conveying the purpose of the preservation. See [CMEK content preservation](https://platform.claude.com/docs/en/manage-claude/access-transparency#cmek-content-preservation) for details. Safety screening metadata is retained under Anthropic-managed encryption and remains readable after key revocation. These are records derived from Anthropic's automated safety scans, such as pattern identifiers and match indicators, not conversation content.
diff --git a/content/en/manage-claude/cmek-google-cloud-kms.md b/content/en/manage-claude/cmek-google-cloud-kms.md
index 1e8e245ec9..db4e064402 100644
--- a/content/en/manage-claude/cmek-google-cloud-kms.md
+++ b/content/en/manage-claude/cmek-google-cloud-kms.md
@@ -1,7 +1,7 @@
 ---
-title: Configure Google Cloud KMS for CMEK
+title: Set up CMEK with Google Cloud KMS
 url: https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms
-description: Use Google Cloud KMS to provide an encryption key for your organization.
+description: Create a Google Cloud KMS key, give Anthropic access to it, and put it to use in Claude Platform or Claude Enterprise.
 ---
 
 Let Claude Code set up this feature for you
@@ -10,53 +10,38 @@ Let Claude Code set up this feature for you
 /claude-api help me configure a customer-managed encryption key with Google Cloud KMS
 ```
 
-This guide shows how to use a Google Cloud KMS key as a [customer-managed encryption key (CMEK)](https://platform.claude.com/docs/en/manage-claude/cmek) for your Anthropic organization.
+## Before you start
 
-<Warning>
-  Enabling CMEK is permanent. If your key is deleted or disabled, Anthropic cannot recover the data encrypted under it. Review the [warnings and limitations](https://platform.claude.com/docs/en/manage-claude/cmek) before you start.
-</Warning>
+In Claude:
 
-## Prerequisites
+* Customer-managed encryption keys (CMEK) are [turned on for your organization](https://platform.claude.com/docs/en/manage-claude/cmek#availability).
+* You have your Anthropic organization ID, the UUID without the `org_` prefix. Copy it from [Organization](https://platform.claude.com/settings/organization) in the Claude Console, or from **Organization settings > Organization and access** on claude.ai. Whoever creates the key needs it.
+* You're an Organization Admin on Claude Platform, or an Owner or Primary Owner on Claude Enterprise.
+* On Claude Platform, you have a workspace that [retains data](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#data-retention), ideally a new one, because [existing data stays under Anthropic's key](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect).
+* On Claude Enterprise, you know [which features turn off or change](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#turned-off-or-changed).
 
-* A Google Cloud project with billing enabled.
-* The Cloud KMS API enabled (`cloudkms.googleapis.com`).
-* Permissions to create KMS key rings and keys, and to set IAM policy on them (`roles/cloudkms.admin` or equivalent).
-* Cloud KMS Data Access audit logs (Data Read and Data Write) turned on for the project, so that Cloud Logging records Anthropic's use of your key. They're off by default. To turn them on, see Google's [Enable Data Access audit logs](https://docs.cloud.google.com/logging/docs/audit/configure-data-access).
-* To create the key from the command line, the [`gcloud` CLI](https://cloud.google.com/cli) installed and authenticated.
-* To register the key through the API, an Anthropic Admin API key for your organization.
+In Google Cloud:
 
-## Anthropic service account email
+* The Cloud KMS API is turned on.
+* You can create key rings and keys, and set IAM policy on them (`roles/cloudkms.admin` or equivalent).
+* Cloud KMS [Data Access audit logs](https://docs.cloud.google.com/logging/docs/audit/configure-data-access) (Data Read and Data Write) are on, so Cloud Logging records Anthropic's use of your key. They're off by default.
+* If your Google Cloud organization enforces domain restricted sharing (`constraints/iam.allowedPolicyMemberDomains`), it blocks the grant to Anthropic's service account. Add a project-level exception, or allow Anthropic's Cloud Identity customer ID. Contact Anthropic for the ID.
 
-In this guide, you give the following Anthropic service account access to your key:
+## In Google Cloud: create the key
+
+After a failed **Verify** or **Add**, see the [fixes for Google Cloud KMS](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#google-cloud-kms).
+
+These steps label the key with your Anthropic organization ID in lowercase (`<ORGANIZATION_UUID>`) and grant access to Anthropic's service account:
 
 ```text wrap
 anthropic-cmek-client-us@gcp-anthropic-cmek-clients.iam.gserviceaccount.com
 ```
 
-<Warning>
-  Use only this published service account email. Never trust an identifier provided over email, chat, or any onboarding channel.
-</Warning>
-
-<Note>
-  **Domain restricted sharing:** If your Google Cloud organization enforces `constraints/iam.allowedPolicyMemberDomains`, it rejects the IAM bindings for this service account. Add a project-level exception to that constraint, or add Anthropic's Cloud Identity customer ID (format `C0xxxxxxxx`) to the allowed list. Contact Anthropic for the customer ID.
-</Note>
-
-## Encryption key setup
-
-The key must meet these requirements:
+Use only this address, never one sent by email or chat.
 
-* **Location:** Use a single-region US location, such as `us-east5`. Multi-region locations such as `us` and `global` aren't supported. See [Availability and regions](https://platform.claude.com/docs/en/manage-claude/cmek#availability-and-regions).
-* **Type:** Use a symmetric key with the `ENCRYPT_DECRYPT` purpose. Anthropic strongly recommends HSM protection.
-* **Organization label:** Add the label `anthropic-org-<ORGANIZATION_UUID>` with the value `true`. Replace `<ORGANIZATION_UUID>` with your Anthropic organization ID in lowercase. Validation fails without this label. To label an existing key, see [Keys you already have](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#existing-key-label).
-* **Access:** Give Anthropic's service account the `roles/cloudkms.cryptoKeyEncrypterDecrypter` and `roles/cloudkms.viewer` roles on the key itself.
+For the lowest latency, use `us-east5` or `us-central1`. Anthropic strongly recommends HSM protection.
 
-<Note>
-  **Finding your organization ID:** Use the bare UUID, not the `org_`-prefixed ID. Copy it from one of these places:
-
-  * **Claude Console:** the **Organization ID** field on the [Organization](https://platform.claude.com/settings/organization) page (`platform.claude.com/settings/organization`)
-  * **claude.ai:** the **Organization ID** field under **Organization settings > Organization**
-  * **Admin API:** the `id` field from the [Organization Info](https://platform.claude.com/docs/en/api/organization/retrieve) endpoint
-</Note>
+To use a key you already have, [add the organization label](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#organization-label) first.
 
 <Tabs>
   <Tab title="Google Cloud Console">
@@ -183,447 +168,73 @@ The key must meet these requirements:
   </Tab>
 </Tabs>
 
-You register the key with its full resource name, in this format:
+Whoever adds the key in Claude needs its full resource name, in this format:
 
 ```text wrap
 projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>
 ```
 
-<Note>
-  **Keys you already have:** Add the organization label with this command, in Cloud Shell or with the gcloud CLI:
+### Add the organization label to a key you already have
+
+Verification fails unless the key has the label `anthropic-org-<ORGANIZATION_UUID>` set to `true`, with your Anthropic organization ID in lowercase. To add the label, run:
 
-  ```bash
-  gcloud kms keys update <your-key-name> \
-    --project=<your-project-id> \
-    --location=<region> \
-    --keyring=<your-keyring-name> \
-    --update-labels=anthropic-org-<ORGANIZATION_UUID>=true
-  ```
+```bash
+gcloud kms keys update <your-key-name> \
+  --project=<your-project-id> \
+  --location=<region> \
+  --keyring=<your-keyring-name> \
+  --update-labels=anthropic-org-<ORGANIZATION_UUID>=true
+```
 
-  The placeholders match the parts of the key's full resource name. The command merges the label with any labels the key already has. Then grant access and copy the resource name as the preceding steps describe.
+The other values are in the key's full resource name, and the command keeps existing labels. Then skip to [the steps that grant access](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#encryption-key-setup).
 
-  To share one key among several Anthropic organizations, add one organization label for each.
-</Note>
+## In Claude: add and attach the key
 
-## Register the key with Anthropic
+To script this part on Claude Platform, [use the Admin API](https://platform.claude.com/docs/en/manage-claude/cmek-admin-api) instead.
 
 <Tabs>
   <Tab title="Claude Platform">
-    <Tabs>
-      <Tab title="Claude Console">
-        <Steps>
-          <Step title="Open the encryption key settings">
-            In the Claude Console, go to the [Data retention](https://platform.claude.com/settings/privacy#encryption-keys) page (`platform.claude.com/settings/privacy`). If you don't see **Encryption keys**, select **Organization** from the dropdown menu at the top of the page.
-          </Step>
-
-          <Step title="Add the key">
-            Under **Encryption keys**, click **Add key**. Enter a **Display name** and select **Google Cloud KMS**. Click **Continue**.
-          </Step>
-
-          <Step title="Enter the key resource name">
-            The dialog box shows an **Organization label**. Check that your key has this label. Paste the full key resource name into **Key resource name** and click **Add**.
-          </Step>
-
-          <Step title="Validate the key">
-            In the **Encryption keys** list, click **Verify** next to the key. **Connected** appears when the check passes. If it fails, see [Troubleshoot validation](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#troubleshoot-validation) for common causes.
-          </Step>
-
-          <Step title="Attach the key to a workspace">
-            Attaching a key can't be undone. If you can, attach it to a new workspace before that workspace receives any requests. In a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).
-
-            On the Data retention page, select the workspace from the dropdown menu at the top of the page. Under **Encryption key**, select the key and click **Save**.
-          </Step>
-
-          <Step title="Confirm the change">
-            Select the checkbox to confirm that you have read the CMEK documentation, then click **Confirm**.
-          </Step>
-        </Steps>
-      </Tab>
-
-      <Tab title="API">
-        <Steps>
-          <Step title="Create the external key">
-            Replace `<friendly-name>` with a display name. Replace the value that starts with `projects/` with the full key resource name.
-
-            <CodeGroup>
-              ```bash cURL
-              curl -sS "https://api.anthropic.com/v1/organizations/external_keys" \
-                -H "x-api-key: $ANTHROPIC_API_KEY" \
-                -H "anthropic-version: 2023-06-01" \
-                -H "content-type: application/json" \
-                -d '{
-                  "display_name": "<friendly-name>",
-                  "geo": "us",
-                  "provider_config": {
-                    "type": "gcp",
-                    "key_name": "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
-                  }
-                }'
-              ```
-
-              ```bash CLI
-              ant organization:external-keys create <<'YAML'
-              display_name: "<friendly-name>"
-              geo: us
-              provider_config:
-                type: gcp
-                key_name: "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
-              YAML
-              ```
-
-              ```python Python
-              client = anthropic.Anthropic()
-
-              external_key = client.organization.external_keys.create(
-                  display_name="<friendly-name>",
-                  geo="us",
-                  provider_config={
-                      "type": "gcp",
-                      "key_name": "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>",
-                  },
-              )
-
-              print(f"id: {external_key.id}")
-              print(f"display_name: {external_key.display_name}")
-              ```
-
-              ```typescript TypeScript
-              const client = new Anthropic();
-
-              const externalKey = await client.organization.externalKeys.create({
-                display_name: "<friendly-name>",
-                geo: "us",
-                provider_config: {
-                  type: "gcp",
-                  key_name:
-                    "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
-                }
-              });
-
-              console.log(`id: ${externalKey.id}`);
-              console.log(`display_name: ${externalKey.display_name}`);
-              ```
-
-              ```csharp C#
-              using Anthropic.Models.Organization.ExternalKeys;
-
-              AnthropicClient client = new();
-
-              var externalKey = await client.Organization.ExternalKeys.Create(new()
-              {
-                  DisplayName = "<friendly-name>",
-                  Geo = Geo.Us,
-                  ProviderConfig = new GcpExternalKeyConfig
-                  {
-                      KeyName = "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
-                  }
-              });
-
-              Console.WriteLine($"id: {externalKey.ID}");
-              Console.WriteLine($"display_name: {externalKey.DisplayName}");
-              ```
-
-              ```go Go
-              client := anthropic.NewClient()
-
-              externalKey, err := client.Organization.ExternalKeys.New(context.Background(), anthropic.OrganizationExternalKeyNewParams{
-              	DisplayName: anthropic.String("<friendly-name>"),
-              	Geo:         anthropic.OrganizationExternalKeyNewParamsGeoUs,
-              	ProviderConfig: anthropic.OrganizationExternalKeyNewParamsProviderConfigUnion{
-              		OfGCP: &anthropic.GCPExternalKeyConfigParam{
-              			KeyName: "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>",
-              		},
-              	},
-              })
-              if err != nil {
-              	log.Fatal(err)
-              }
-
-              fmt.Printf("id: %s\n", externalKey.ID)
-              fmt.Printf("display_name: %s\n", externalKey.DisplayName)
-              ```
-
-              ```java Java
-              import com.anthropic.models.organization.externalkeys.ExternalKeyCreateParams;
-
-              void main() {
-                  AnthropicClient client = AnthropicOkHttpClient.fromEnv();
-
-                  var params = ExternalKeyCreateParams.builder()
-                      .displayName("<friendly-name>")
-                      .geo(ExternalKeyCreateParams.Geo.US)
-                      .gcpProviderConfig("projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>")
-                      .build();
-                  var externalKey = client.organization().externalKeys().create(params);
-
-                  IO.println("id: " + externalKey.id());
-                  IO.println("display_name: " + externalKey.displayName().orElseThrow());
-              }
-              ```
-
-              ```php PHP
-              use Anthropic\Organization\ExternalKeys\ExternalKeyCreateParams\Geo;
-              // ...
-
-              $client = new Client();
-
-              $externalKey = $client->organization->externalKeys->create(
-                  displayName: '<friendly-name>',
-                  geo: Geo::US,
-                  providerConfig: [
-                      'type' => 'gcp',
-                      'keyName' => 'projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>',
-                  ],
-              );
-
-              echo "id: {$externalKey->id}\n";
-              echo "display_name: {$externalKey->displayName}\n";
-              ```
-
-              ```ruby Ruby
-              client = Anthropic::Client.new
-
-              external_key = client.organization.external_keys.create(
-                display_name: "<friendly-name>",
-                geo: :us,
-                provider_config: {
-                  type: :gcp,
-                  key_name: "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
-                }
-              )
-
-              puts "id: #{external_key.id}"
-              puts "display_name: #{external_key.display_name}"
-              ```
-            </CodeGroup>
-
-            The `id` field of the response contains the external key ID. Copy it for the next two steps:
-
-            ```json
-            {
-              "type": "external_key",
-              "id": "ekey_<id>",
-              "display_name": "<friendly-name>"
-            }
-            ```
-          </Step>
-
-          <Step title="Validate the key">
-            Replace `ekey_<id>` with the external key ID.
-
-            <CodeGroup>
-              ```bash cURL
-              curl -sS -X POST "https://api.anthropic.com/v1/organizations/external_keys/ekey_<id>/validate" \
-                -H "x-api-key: $ANTHROPIC_API_KEY" \
-                -H "anthropic-version: 2023-06-01"
-              ```
-
-              ```bash CLI
-              ant organization:external-keys validate --external-key-id "ekey_<id>"
-              ```
-
-              ```python Python
-              client = anthropic.Anthropic()
-
-              validation = client.organization.external_keys.validate("ekey_<id>")
-
-              print(f"status: {validation.status}")
-              print(f"error: {validation.error}")
-              ```
-
-              ```typescript TypeScript
-              const client = new Anthropic();
-
-              const validation = await client.organization.externalKeys.validate("ekey_<id>");
-
-              console.log(`status: ${validation.status}`);
-              console.log(`error: ${validation.error}`);
-              ```
-
-              ```csharp C#
-              AnthropicClient client = new();
-
-              var validation = await client.Organization.ExternalKeys.Validate("ekey_<id>");
-
-              Console.WriteLine($"status: {validation.Status.Raw()}");
-              Console.WriteLine($"error: {validation.Error}");
-              ```
-
-              ```go Go
-              client := anthropic.NewClient()
-
-              validation, err := client.Organization.ExternalKeys.Validate(context.Background(), "ekey_<id>")
-              if err != nil {
-              	log.Fatal(err)
-              }
-
-              fmt.Printf("status: %s\n", validation.Status)
-              fmt.Printf("error: %s\n", validation.Error)
-              ```
-
-              ```java Java
-              AnthropicClient client = AnthropicOkHttpClient.fromEnv();
-
-              var validation = client.organization().externalKeys().validate("ekey_<id>");
-
-              IO.println("status: " + validation.status().asString());
-              IO.println("error: " + validation.error().orElse(""));
-              ```
-
-              ```php PHP
-              $client = new Client();
-
-              $validation = $client->organization->externalKeys->validate(
-                  externalKeyID: 'ekey_<id>',
-              );
-
-              echo "status: {$validation->status}\n";
-              echo "error: {$validation->error}\n";
-              ```
-
-              ```ruby Ruby
-              client = Anthropic::Client.new
-
-              external_key_id = "ekey_<id>"
-              validation = client.organization.external_keys.validate(external_key_id)
-
-              puts "status: #{validation.status}"
-              puts "error: #{validation.error}"
-              ```
-            </CodeGroup>
-
-            A successful response looks like this:
-
-            ```json
-            { "type": "external_key_validation", "status": "success", "error": null }
-            ```
-
-            If validation fails, see [Troubleshoot validation](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#troubleshoot-validation).
-          </Step>
-
-          <Step title="Attach the key to a workspace">
-            Attaching a key can't be undone. If you can, attach it to a new workspace before that workspace receives any requests. In a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).
+    <Steps>
+      <Step title="Open the encryption key settings">
+        In the Claude Console, open [Encryption keys](https://platform.claude.com/settings/privacy#encryption-keys) on the Data retention page. If the section isn't there, select **Organization** from the dropdown menu at the top.
+      </Step>
 
-            Replace `<workspace-id>` with the workspace ID and `ekey_<id>` with the external key ID.
+      <Step title="Add the key">
+        Under **Encryption keys**, click **Add key**. Enter a **Display name**, select **Google Cloud KMS**, and click **Continue**.
+      </Step>
 
-            <CodeGroup>
-              ```bash cURL
-              curl -sS -X POST "https://api.anthropic.com/v1/organizations/workspaces/<workspace-id>" \
-                -H "x-api-key: $ANTHROPIC_API_KEY" \
-                -H "anthropic-version: 2023-06-01" \
-                -H "content-type: application/json" \
-                -d '{
-                  "external_key_id": "ekey_<id>"
-                }'
-              ```
+      <Step title="Enter the key resource name">
+        Check that your key has the **Organization label** shown in the dialog box. Paste the key's full resource name into **Key resource name** and click **Add**.
+      </Step>
 
-              ```bash CLI
-              ant organization:workspaces update \
-                --workspace-id "<workspace-id>" \
-                --external-key-id "ekey_<id>"
-              ```
+      <Step title="Verify the key">
+        In the **Encryption keys** list, click **Verify** next to the key. **Connected** appears when the check passes. If **Connection failed** appears instead, see [Troubleshoot CMEK](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting).
+      </Step>
 
-              ```python Python
-              client = anthropic.Anthropic()
+      <Step title="Attach the key to a workspace">
+        <Warning>
+          Attaching a key [can't be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). You can't remove it from the workspace or replace it. If the key is deleted, Anthropic can't recover the data it protects.
+        </Warning>
 
-              workspace = client.organization.workspaces.update(
-                  "<workspace-id>", external_key_id="ekey_<id>"
-              )
+        1. At the top of the Data retention page, select the workspace from the dropdown menu.
+        2. Under **Encryption key**, select the key and click **Save**.
+        3. Select the checkbox to confirm that you have read the CMEK documentation, then click **Confirm**.
 
-              print(f"id: {workspace.id}")
-              print(f"external_key_id: {workspace.external_key_id}")
-              ```
+        You see **Workspace settings updated.** Once the key [takes effect](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect), your cloud provider's audit log shows Anthropic's calls to the key.
 
-              ```typescript TypeScript
-              const client = new Anthropic();
-
-              const workspace = await client.organization.workspaces.update("<workspace-id>", {
-                external_key_id: "ekey_<id>"
-              });
-
-              console.log(`id: ${workspace.id}`);
-              console.log(`external_key_id: ${workspace.external_key_id}`);
-              ```
-
-              ```csharp C#
-              AnthropicClient client = new();
-
-              var workspace = await client.Organization.Workspaces.Update("<workspace-id>", new()
-              {
-                  ExternalKeyID = "ekey_<id>"
-              });
-
-              Console.WriteLine($"id: {workspace.ID}");
-              Console.WriteLine($"external_key_id: {workspace.ExternalKeyID}");
-              ```
-
-              ```go Go
-              client := anthropic.NewClient()
-
-              workspace, err := client.Organization.Workspaces.Update(
-              	context.Background(),
-              	"<workspace-id>",
-              	anthropic.OrganizationWorkspaceUpdateParams{
-              		ExternalKeyID: anthropic.String("ekey_<id>"),
-              	},
-              )
-              if err != nil {
-              	log.Fatal(err)
-              }
-
-              fmt.Printf("id: %s\n", workspace.ID)
-              fmt.Printf("external_key_id: %s\n", workspace.ExternalKeyID)
-              ```
-
-              ```java Java
-              import com.anthropic.models.organization.workspaces.WorkspaceUpdateParams;
-
-              void main() {
-                  AnthropicClient client = AnthropicOkHttpClient.fromEnv();
-
-                  var params = WorkspaceUpdateParams.builder()
-                      .externalKeyId("ekey_<id>")
-                      .build();
-                  var workspace = client.organization().workspaces().update("<workspace-id>", params);
-
-                  IO.println("id: " + workspace.id());
-                  IO.println("external_key_id: " + workspace.externalKeyId().orElseThrow());
-              }
-              ```
-
-              ```php PHP
-              $client = new Client();
-
-              $workspace = $client->organization->workspaces->update(
-                  workspaceID: '<workspace-id>',
-                  externalKeyID: 'ekey_<id>',
-              );
-
-              echo "id: {$workspace->id}\n";
-              echo "external_key_id: {$workspace->externalKeyID}\n";
-              ```
-
-              ```ruby Ruby
-              client = Anthropic::Client.new
-
-              workspace_id = "<workspace-id>"
-              workspace = client.organization.workspaces.update(
-                workspace_id,
-                external_key_id: "ekey_<id>"
-              )
-
-              puts "id: #{workspace.id}"
-              puts "external_key_id: #{workspace.external_key_id}"
-              ```
-            </CodeGroup>
-          </Step>
-        </Steps>
-      </Tab>
-    </Tabs>
+        In a [ZDR organization](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#zdr-organizations), after you select the workspace, select **Standard data retention** so that **Encryption key** appears. After you click **Save**, click **Accept** on the data retention terms.
+      </Step>
+    </Steps>
   </Tab>
 
   <Tab title="Claude Enterprise">
-    On Claude Enterprise, CMEK applies to the whole organization, and an organization can have only one key.
+    On Claude Enterprise, CMEK applies to the whole organization, and you can add only one key.
+
+    <Warning>
+      Adding a key [can't be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). You can't remove it from the organization or replace it. If the key is deleted, Anthropic can't recover the data it protects.
+    </Warning>
+
+    Adding the key [turns off or changes some features](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#turned-off-or-changed) for every user. To try CMEK first, use a separate organization.
 
     <Steps>
       <Step title="Open the encryption key settings">
@@ -635,25 +246,14 @@ projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/crypt
       </Step>
 
       <Step title="Enter the key resource name">
-        The dialog box shows an **Organization label**. Check that your key has this label. Paste the full key resource name into **Key resource name** and click **Add**.
+        Check that your key has the **Organization label** shown in the dialog box. Paste the key's full resource name into **Key resource name** and click **Add**.
       </Step>
 
-      <Step title="Confirm that validation passed">
-        When the check passes, **Encryption key configured** appears, and your organization is CMEK-protected from then on. If the check fails, see [Troubleshoot validation](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#troubleshoot-validation).
+      <Step title="Confirm that the key was added">
+        The check can take up to 30 seconds. When **Encryption key configured.** appears, click **Done**. If **The encryption key couldn’t be added.** appears instead, [find the cause and retry](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#claude-ai-add-fails).
+
+        Your key protects data written from then on. Tell your users [which features changed](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#turned-off-or-changed).
       </Step>
     </Steps>
   </Tab>
 </Tabs>
-
-## Troubleshoot validation
-
-If validation fails, common causes are:
-
-* **Wrong organization label:** Make sure the key has the [organization label](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#organization-label), with your bare organization ID in lowercase.
-* **VPC Service Controls:** A service perimeter that protects Cloud KMS in your project can block Anthropic. Add Anthropic to an access level on the perimeter, or exclude the key's project from it.
-* **Domain restricted sharing:** The `constraints/iam.allowedPolicyMemberDomains` org policy blocks the binding for Anthropic's service account. To check that the binding is there, run `gcloud kms keys get-iam-policy <your-key-name> --project=<your-project-id> --location=<region> --keyring=<your-keyring-name>`. To allow it, see [Anthropic service account email](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#anthropic-service-account-email).
-* **Disabled or destroyed key version:** Confirm that the key's primary version is enabled.
-
-## Terraform
-
-To create the key with Terraform, use the `google_kms_key_ring`, `google_kms_crypto_key`, and `google_kms_crypto_key_iam_member` resources from the `google` provider.
diff --git a/content/en/manage-claude/cmek-how-it-works.md b/content/en/manage-claude/cmek-how-it-works.md
new file mode 100644
index 0000000000..eba261ff69
--- /dev/null
+++ b/content/en/manage-claude/cmek-how-it-works.md
@@ -0,0 +1,49 @@
+---
+title: How CMEK works
+url: https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works
+description: How your key protects stored data, what one key covers, when it takes effect, and what you can see.
+---
+
+## Your key wraps the keys that encrypt your data
+
+Anthropic encrypts your stored data with data keys. With customer-managed encryption keys (CMEK), your key encrypts, or wraps, those data keys. This is envelope encryption. To write or read data, Anthropic asks your key management service (KMS) to wrap or unwrap a data key.
+
+Data keys cross between Anthropic and your cloud. Your key never leaves your KMS. Your data never goes to it.
+
+<Frame>
+  ![Your key stays in your cloud's KMS and wraps Anthropic's data keys, which encrypt your data. Your cloud can log each call.](https://platform.claude.com/docs/images/cmek/key-wrapping.svg)
+</Frame>
+
+Anthropic keeps no copy of your key, so without it, Claude [can't read the data it protects](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle).
+
+## What one key protects
+
+On Claude Platform and Claude Platform on AWS, a key protects a workspace, and one key can serve several. On Claude Enterprise, a key protects the whole organization, which can have only one key. [Which data your key protects](https://platform.claude.com/docs/en/manage-claude/cmek#what-cmek-protects) depends on your product.
+
+On Claude Platform and Claude Enterprise, your key carries your Anthropic organization ID, which ties the key to your organization. Depending on your KMS, the ID goes in a key policy condition, a label, or a tag. A key without the ID fails verification. A key shared between organizations carries each ID.
+
+An AWS KMS key policy can [name workspaces](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms-workspaces) by their compartment IDs. A compartment ID is the UUID Anthropic gives each workspace for encryption, not the workspace ID that starts with `wrkspc_`.
+
+## Where your key lives
+
+Your key lives in AWS KMS, Google Cloud KMS, or Azure Key Vault. Your provider might charge for it.
+
+On Claude Platform and Claude Enterprise, CMEK is available in US regions, and Anthropic processes all encryption operations there. [Each setup page](https://platform.claude.com/docs/en/manage-claude/cmek#set-it-up) names the lowest-latency regions.
+
+## When your key takes effect
+
+Your key protects only data written after it takes effect. Existing data (prior chats, files, and sessions) stays under Anthropic's key and isn't re-encrypted.
+
+On Claude Platform and Claude Platform on AWS, a key attached to a workspace before its first request takes effect with that request. In a workspace in use, your key can take up to a day to take effect, and data written meanwhile stays under Anthropic's key. That's why Anthropic recommends a new workspace.
+
+## What you can see
+
+Your cloud's audit log can record every operation Anthropic performs with your key. Where you have to turn that logging on, your setup page lists it as a prerequisite. In AWS CloudTrail, some entries are [expected errors](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#cloudtrail).
+
+Changes to your CMEK configuration appear in the [Compliance API Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed). Key operations don't.
+
+## Latency and standards
+
+Each wrap or unwrap is a round trip to your KMS, which can add a little latency to reading and writing stored data. For cryptographic standards such as FIPS, see the CMEK whitepaper in the [Trust Center](https://trust.anthropic.com/resources).
+
+Next, read [what each key action does](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does).
diff --git a/content/en/manage-claude/cmek-key-lifecycle.md b/content/en/manage-claude/cmek-key-lifecycle.md
new file mode 100644
index 0000000000..a20f2bc8ce
--- /dev/null
+++ b/content/en/manage-claude/cmek-key-lifecycle.md
@@ -0,0 +1,37 @@
+---
+title: What happens when you rotate, disable, or delete your encryption key
+url: https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle
+description: What each action on your key does to your data, how soon, and whether you can undo it.
+---
+
+With customer-managed encryption keys (CMEK), your key lives in your key management service (KMS), and Claude keeps a record that points to it. Deleting the key and deleting the record are different actions.
+
+## What each action does
+
+<Frame>
+  ![Key states: attaching is one-way, a disabled key can be re-enabled, and Anthropic can't recover data once the key is deleted.](https://platform.claude.com/docs/images/cmek/key-states.svg)
+</Frame>
+
+| Action                                                                              | What happens                                                                                                                                                                                                                                                                                                                     | Can you undo it?                                                                                                                                          |
+| ----------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Attach the key to a workspace (on Claude Enterprise, add it to the organization)    | Your key protects data written [after it takes effect](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect). On Claude Platform, attaching also locks the workspace's [data retention setting](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#data-retention). | No. The key can't be removed or replaced.                                                                                                                 |
+| Rotate the key material within the same key                                         | You rotate it in your KMS, on your own schedule. Rotation needs no action in Claude.                                                                                                                                                                                                                                             | Nothing to undo. Keep earlier key versions enabled.                                                                                                       |
+| Disable the key, or remove (revoke) Anthropic's access to it                        | The change can take up to 1 hour to apply, and requests in flight during that hour might still succeed. After that, Claude can't read or write the data the key protects, and requests fail.                                                                                                                                     | Re-enable the key or restore Anthropic's access. [Two limits apply](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#restore-access). |
+| Delete the key in your KMS, schedule it for deletion, or destroy its key material   | Anthropic can't recover the data the key protects.                                                                                                                                                                                                                                                                               | Not by Anthropic. It keeps no copy of your key.                                                                                                           |
+| Delete the key's record in Claude (**Delete encryption key** in the Claude Console) | You can do this only while no workspace, including an archived one, uses the key.                                                                                                                                                                                                                                                | No.                                                                                                                                                       |
+
+## What disabling does, and what comes back
+
+While the key is disabled, Messages API requests in a workspace that uses it return [a 400 error with the code `cmek_key_disabled`](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#cmek-key-disabled).
+
+Re-enabling the key, or restoring Anthropic's access to it, brings back access to the data the key protects. Two limits apply. Requests that failed while the key was disabled aren't retried. Disabling the key doesn't pause retention periods.
+
+## If Anthropic can't reach your key
+
+Requests that store data under your key fail while Anthropic can't reach it, for example during an outage of your KMS. On Claude Enterprise, these requests include messages in chat and in voice mode.
+
+On the Messages API, these requests return a 503 error with the code `cmek_key_unreachable`, and you can retry them. The Message Batches API retries them for you until your key is available or the batch expires.
+
+## Change keys or stop using CMEK
+
+A workspace or organization can't switch to a different key or go back to having none. On Claude Platform, you can create a new workspace with a different key, or with no key, and move your traffic to it. On Claude Enterprise, there's no way to change keys or stop using CMEK within the organization.
diff --git a/content/en/manage-claude/cmek-troubleshooting.md b/content/en/manage-claude/cmek-troubleshooting.md
new file mode 100644
index 0000000000..fdfb3a8d5f
--- /dev/null
+++ b/content/en/manage-claude/cmek-troubleshooting.md
@@ -0,0 +1,166 @@
+---
+title: Troubleshoot CMEK
+url: https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting
+description: Find the cause and fix for a CMEK error message, a failed verification, or an unexpected log entry.
+---
+
+**Verify** in the Claude Console, **Add** on claude.ai, and the Admin API's validate call all run the same check. When it fails (**Connection failed** in the Claude Console), see the causes for [AWS KMS](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#aws-kms), [Google Cloud KMS](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#google-cloud-kms), or [Azure Key Vault](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#azure-key-vault).
+
+If a feature stopped working, it might be one that customer-managed encryption keys (CMEK) turn off. Check the [Claude Platform list](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-platform#turned-off-or-changed) or [Claude Enterprise list](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#turned-off-or-changed).
+
+If nothing here fits, contact your Anthropic account team.
+
+## Requests fail after setup
+
+### `cmek_key_disabled`
+
+```text wrap
+Customer-managed encryption key is disabled or revoked. Re-enable the key to restore access.
+```
+
+This 400 error means your key management service refused Anthropic's call. Check these causes in order:
+
+1. The key is disabled.
+2. Anthropic's access to the key was removed. [Your setup page](https://platform.claude.com/docs/en/manage-claude/cmek#set-it-up) shows the access Anthropic needs.
+3. On AWS KMS, the key policy [lists workspaces](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms-workspaces) but not this one.
+4. On AWS KMS, an IP condition blocks [Anthropic's outbound IP addresses](https://platform.claude.com/docs/en/api/ip-addresses#outbound-ip-addresses).
+
+Fix the cause. [Two limits apply](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#restore-access) when access returns.
+
+### `cmek_key_network_blocked`
+
+```text wrap
+The request to your key management service was blocked by its network access controls (for example, a KMS firewall or IP allowlist). Verify that your KMS network rules allow requests from Anthropic's published IP addresses, or contact Anthropic support if your configuration looks correct.
+```
+
+This is a 400 error. The key itself might be healthy. Allow [Anthropic's published IP addresses](https://platform.claude.com/docs/en/api/ip-addresses) in your key management service's network rules.
+
+### `cmek_key_unreachable`
+
+```text wrap
+The workspace's customer-managed encryption key could not be reached. Try again shortly. If this continues, check that the key is available in your key management service, or contact Anthropic support.
+```
+
+This 503 error means [Anthropic couldn't reach your key](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#unreachable-key). Retry the request.
+
+## Verification fails: AWS KMS
+
+| Cause                                                | Fix                                                                                                                                                                                    |
+| ---------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Wrong organization ID                                | The `org_uuid` condition must list [your Anthropic organization ID](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#prerequisites), the UUID without the `org_` prefix. |
+| A workspace is missing from the policy               | A `compartment_uuid` condition must [list the compartment ID](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms-workspaces) of each workspace the key is attached to.     |
+| Access granted through IAM instead of the key policy | Anthropic's role needs access in [the key policy itself](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#key-policy).                                                   |
+
+To print the key policy, run:
+
+```bash
+aws kms get-key-policy \
+  --region <REGION> \
+  --key-id <KEY_ARN> \
+  --policy-name default
+```
+
+### A key that already protects data
+
+If you're [replacing the policy on a key](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms-workspaces#replace-the-key-policy) that already protects data, add this statement so Anthropic can still decrypt that data. In its condition, list the compartment ID of every workspace the key is or was attached to.
+
+```json
+{
+  "Sid": "AllowAnthropicCMEKDecryptExistingData",
+  "Effect": "Allow",
+  "Principal": {
+    "AWS": "arn:aws:iam::915198916910:role/anthropic-cmek-client-us"
+  },
+  "Action": "kms:Decrypt",
+  "Resource": "*",
+  "Condition": {
+    "StringEquals": {
+      "kms:EncryptionContext:anthropic:compartment_uuid": ["<COMPARTMENT_UUID>"]
+    }
+  }
+}
+```
+
+## Verification fails: Google Cloud KMS
+
+| Cause                             | Fix                                                                                                                                                                                   |
+| --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Wrong organization label          | The key needs the [organization label](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#organization-label), with your Anthropic organization ID in lowercase. |
+| Domain restricted sharing         | This organization policy blocks the grant to Anthropic's service account. [Add an exception](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#prerequisites).  |
+| Disabled or destroyed key version | The key's primary version must be enabled.                                                                                                                                            |
+
+To check the grant, run:
+
+```bash
+gcloud kms keys get-iam-policy <your-key-name> \
+  --project=<your-project-id> \
+  --location=<region> \
+  --keyring=<your-keyring-name>
+```
+
+## Verification fails: Azure Key Vault
+
+| Cause                                     | Fix                                                                                                                                                                  |
+| ----------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Wrong organization tag                    | The key's current version needs the [organization tag](https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault#organization-tag).                     |
+| Role assignment not yet in effect         | A new role assignment can take a few minutes. Wait, then try again.                                                                                                  |
+| The vault's network rules block Anthropic | Check the rules against the [vault settings Anthropic needs](https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault#check-your-vault-configuration). |
+
+## Attaching fails on Claude Platform on AWS
+
+Claude Platform on AWS has no **Verify** step, so a problem with the key shows when you attach it.
+
+| Cause                 | Fix                                                                                                                                                                                                                                                                                                |
+| --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Key policy mismatch   | Print the key policy with the [`get-key-policy` command](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#aws-kms) and compare it with the [policy on the setup page](https://platform.claude.com/docs/en/manage-claude/cmek-claude-platform-on-aws#prepare-the-key-policy). |
+| Condition mismatch    | Any `EncryptionContext` or `aws:SourceArn` condition must include this workspace.                                                                                                                                                                                                                  |
+| Key state or location | The key must be enabled, single-Region, and in the same AWS account and region as the workspace.                                                                                                                                                                                                   |
+| Missing permissions   | The principal you're signed in as needs `kms:DescribeKey`, `kms:Encrypt`, and `kms:Decrypt` on the key.                                                                                                                                                                                            |
+
+If attaching still fails, find the denied `kms:` event in CloudTrail in the key's account. It shows the calling principal and, for cryptographic calls, the encryption context. Fix the cause, then click **Save** again.
+
+## Attaching or adding a key is refused
+
+### The workspace doesn't retain data
+
+```text wrap
+CMEK keys can only be attached to workspaces in this organization that have inference data retention enabled.
+```
+
+[Your organization uses zero data retention (ZDR)](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#zdr-organizations), and a key needs a workspace that retains data. Switch the workspace to **Standard data retention** first.
+
+### The workspace has no Encryption key setting
+
+Only [a workspace that retains data](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#data-retention) has this setting, so select **Standard data retention** for the workspace first. A ZDR organization's default workspace can't be switched, so use another.
+
+### There is no Encryption keys section
+
+In the Claude Console, select **Organization** from the dropdown menu at the top of the Data retention page. If the section is still missing, your role doesn't include it or CMEK isn't turned on for your organization. Your Anthropic account team turns CMEK on.
+
+### The workspace already has a key
+
+```text wrap
+This workspace already has a different external key attached.
+```
+
+A workspace's key can't be replaced, so [create a new workspace](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#change-keys) for a different key.
+
+### Adding a key on claude.ai fails
+
+```text wrap
+The encryption key couldn’t be added.
+```
+
+The check on your key failed. Find the cause for [AWS KMS](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#aws-kms), [Google Cloud KMS](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#google-cloud-kms), or [Azure Key Vault](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#azure-key-vault). To retry, click **Add key** again. The dialog box opens with your earlier details. Select the checkbox, click **Continue**, then click **Add**.
+
+## Expected errors in CloudTrail
+
+On Claude Platform and Claude Enterprise, Anthropic checks the key whenever you verify it, attach it to a workspace, or view it on claude.ai. Each check adds four expected access-denied errors to CloudTrail.
+
+To filter them out, match all three values:
+
+* `requestParameters.encryptionContext.associatedData`: `Y21lay12YWxpZGF0aW9u`
+* `userIdentity.accountId`: `915198916910`
+* `resources.ARN`: `arn:aws:kms:<REGION>:<AWS_ACCOUNT_ID>:key/<KEY_ID>`
+
+The first value alone isn't enough, because any caller can set it.
diff --git a/content/en/manage-claude/cmek.md b/content/en/manage-claude/cmek.md
index ed54992ead..158f2fcee8 100644
--- a/content/en/manage-claude/cmek.md
+++ b/content/en/manage-claude/cmek.md
@@ -1,7 +1,7 @@
 ---
 title: Customer-managed encryption keys
 url: https://platform.claude.com/docs/en/manage-claude/cmek
-description: Encrypt Claude workspace data at rest with a key you control.
+description: Use a key you hold in your own cloud to encrypt data that Claude stores.
 ---
 
 Ask Claude Code about this feature
@@ -10,151 +10,70 @@ Ask Claude Code about this feature
 /claude-api tell me about customer-managed encryption keys
 ```
 
-A customer-managed encryption key (CMEK) lets you provision an encryption key in your own [AWS KMS](https://aws.amazon.com/kms/), [Google Cloud KMS](https://cloud.google.com/security/products/security-key-management), or [Azure Key Vault](https://azure.microsoft.com/en-us/products/key-vault) and have Anthropic use it to encrypt certain workspace data at rest. You retain full control of the key, including rotation, audit, and revocation, and the key operations Anthropic performs against your key are recorded in your cloud provider's audit logs.
+With customer-managed encryption keys (CMEK), you create a key in your own AWS KMS, Google Cloud KMS, or Azure Key Vault. Anthropic uses it to encrypt certain data at rest. The key stays under your control, so you can rotate it, audit its use, and remove Anthropic's access.
 
-The use of CMEK is optional. Eligible organizations can **opt in** to use customer-managed encryption keys instead of the default encryption that Anthropic provides. To activate CMEK, contact your Anthropic account team.
+## Choose your setup page
 
-<Warning>
-  **Enabling CMEK is permanent and can cause irreversible data loss**
+Choose the service that holds your key. Claude Platform on AWS, which also uses AWS KMS, has its own page.
 
-  Enabling CMEK is permanent. Anthropic keeps no copy of your key, so misconfiguration or key loss can permanently destroy your CMEK-protected data. If you are uncertain about any step, contact your Anthropic representative before applying changes.
-
-  * **Permanent data loss:** If your encryption key is deleted, scheduled for deletion, or has its key material destroyed, Anthropic cannot recover your data.
-  * **Identifier verification is mandatory:** Granting key access to an incorrect or spoofed principal can expose your data to an unauthorized party. Always verify the Anthropic identifier against the published production identities in each configuration guide. On Claude Platform on AWS, that identity is the AWS service principal published in [Set up CMEK on Claude Platform on AWS](https://platform.claude.com/docs/en/manage-claude/cmek-claude-platform-on-aws). Never trust an identifier provided over email, chat, or any onboarding channel.
-</Warning>
-
-## How it works
-
-Only Organization Admins (on Claude Platform; the Admin role on Claude Platform on AWS) or Owners and the Primary Owner (on Claude Enterprise) can configure CMEK. On Claude Platform, CMEK is scoped per workspace and configured in the Claude Console or with the Admin API (on Claude Platform on AWS, in the Claude Console or through the IAM-authorized external key and workspace endpoints). On Claude Enterprise, CMEK is scoped per organization and configured in [claude.ai > Organization settings > Data and privacy](https://claude.ai/admin-settings/data-privacy-controls). On either product, CMEK protects data written after your key takes effect. Existing data (prior chats, files, and sessions) remains encrypted with Anthropic-managed keys and is not re-encrypted under your key.
-
-On Claude Platform, Anthropic recommends attaching your key to a new workspace before you send any requests to that workspace. If you attach a key to a workspace that already receives requests, your key can take up to a day to take effect. Data written before then, like existing data, is encrypted with Anthropic-managed keys and is not re-encrypted.
-
-CMEK configuration events appear in the [Compliance API Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed). The key operations Anthropic performs against your key (such as wrapping and unwrapping data keys) do not appear in the Compliance API; they appear in your cloud provider's audit logs.
-
-Anthropic calls your key management service from its standard public IP range. If you restrict access to your key management service by IP, allow the addresses listed in [IP addresses](https://platform.claude.com/docs/en/api/ip-addresses). On Claude Platform on AWS, don't rely on IP-based restrictions for your key; scope access with the key policy described in [Set up CMEK on Claude Platform on AWS](https://platform.claude.com/docs/en/manage-claude/cmek-claude-platform-on-aws) instead.
-
-## Prerequisites
-
-* Permissions to create encryption keys and manage key access in the account, project, or subscription that will host the encryption key.
-* An Organization Admin role in the Claude Console on Claude Platform (the Admin role on Claude Platform on AWS), or an Owner or Primary Owner role on Claude Enterprise.
-* Data retention configuration: CMEK is allowed with [Zero data retention (ZDR)](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention) for both Claude Platform and Claude Enterprise.
-
-## Availability and regions
-
-Except on Claude Platform on AWS (covered at the end of this section), CMEK is currently available in US regions only, and all encryption operations are processed in US regions. For minimal latency, choose a region close to Anthropic's US infrastructure:
-
-| Provider     | Recommended regions         |
-| ------------ | --------------------------- |
-| AWS          | `us-east-2`                 |
-| Google Cloud | `us-central1`, `us-east5`   |
-| Azure        | `northcentralus`, `eastus2` |
-
-On [Claude Platform on AWS](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws), CMEK is available with AWS KMS keys only; Google Cloud KMS and Azure Key Vault keys cannot be registered. These region recommendations do not apply there: the key must be a single-region KMS key in the same AWS account and region as the workspace it is attached to, and its key policy must grant access to an AWS service principal rather than Anthropic's IAM role; see [Set up CMEK on Claude Platform on AWS](https://platform.claude.com/docs/en/manage-claude/cmek-claude-platform-on-aws). Register and attach keys in the Claude Console; the external key endpoints are also available on Claude Platform on AWS, authorized through [IAM actions](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#encryption-keys). There is no separate validation step: the key is implicitly validated when you attach it to a workspace (the attach call performs an encrypt/decrypt round), so a key policy problem surfaces at attach time rather than at registration.
-
-## What CMEK protects
-
-What CMEK covers depends on which product you use.
-
-### Encrypted with CMEK key
-
-**Claude Platform**
-
-* Message content, files and attachments (both inline attachments sent with a request and Files API uploads), and MCP and tool configuration.
-* [Claude Managed Agents](https://platform.claude.com/docs/en/managed-agents/overview) (beta) data, including agent configurations, environments, webhooks, sessions and their events, [memory stores](https://platform.claude.com/docs/en/managed-agents/memory) (beta) and their memories and memory versions, and [dreams](https://platform.claude.com/docs/en/managed-agents/dreams) (research preview).
-* Data stored at rest by the Batch and Skills APIs, and by these tools: web search, web fetch, code execution, bash, text editor, MCP connector (beta), structured outputs, advisor tool (beta), computer use, browser use, and context management.
-
-**Claude Enterprise**
-
-* Chat content, including skills and plugins.
-* Chat attachments and project attachments.
-* Artifacts, including Claude Design, Claude Slides, and Claude Docs in conversations and the **Artifacts** tab.
-* Claude Code on the CLI, including message content.
-* Cowork in Claude Desktop.
-* Compliance API [local session transcripts](https://platform.claude.com/docs/en/manage-claude/compliance-sessions#retrieve-local-sessions) captured from sessions on users' machines. If your key cannot be used, the messages endpoint returns [503 Service Unavailable](https://platform.claude.com/docs/en/manage-claude/compliance-errors#local-sessions-temporarily-unavailable) instead of transcript content. Session metadata is still listed.
-* Office agents.
-* Claude in Chrome.
-* Claude Science, which is in beta.
-
-On both products, backups and snapshots inherit the key.
-
-### Disabled or modified
-
-Some features are turned off or substantially modified when CMEK is enabled. This list is not exhaustive; review it with your team before enabling CMEK.
-
-**Claude Platform**
-
-* Playground in the Claude Console is disabled.
-* Structured outputs are not available for Claude Fable or Claude Mythos models in CMEK organizations.
-* Other beta and research preview features might not be covered by CMEK.
-
-**Claude Enterprise**
-
-* Chat search is disabled because chat titles and content are encrypted under your key. Members cannot search past chats, and the **Search and reference chats** toggle stays off, so Claude cannot search them either.
-* [Project knowledge search](https://support.claude.com/en/articles/11473015-retrieval-augmented-generation-rag-for-projects) (retrieval-augmented generation, or RAG) is disabled. Project knowledge loads directly into each conversation's context instead of being indexed and searched. As a result, a project can use substantially less knowledge than it could without CMEK. Knowledge beyond what can be loaded is left out of the conversation.
-* Claude Code on the web and Claude in Slack are unavailable: new sessions cannot be started and Claude in Slack declines requests, even if an admin turns these products on. Claude Code Desktop remains available for local sessions but is off unless an admin turns it on under [claude.ai > Organization settings > Claude Code](https://claude.ai/admin-settings/claude-code).
-* Artifacts, including Claude Design, Claude Slides, and Claude Docs in conversations and the **Artifacts** tab, cannot be turned on in organizations that also use ZDR. In organizations with HIPAA readiness, an Owner must first accept the terms for using them.
-* Claude Code cannot [publish artifacts](https://code.claude.com/docs/en/artifacts#availability). However, artifacts made in chat or Cowork can be shared within your organization, but not publicly.
-* Certain analytics are disabled, regardless of admin settings: Claude smart reports (beta, under claude.ai/analytics/insights) and Claude Code contribution metrics from GitHub (beta, under claude.ai/analytics/claude-code). Admin analytics for skills and connectors, in the claude.ai analytics dashboard and through the [Claude Enterprise Analytics API](https://platform.claude.com/docs/en/manage-claude/analytics-api), don't include usage in chat, and hide the names of custom skills, plugins, and connectors.
-* Organization data exports and audit log exports, both under [claude.ai > Organization settings > Data and privacy](https://claude.ai/admin-settings/data-privacy-controls), are disabled.
-* Response ratings (thumbs up and thumbs down on Claude's responses) are disabled.
-* [Skill and plugin security scanning](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/enterprise#skill-content-scanning) is unavailable: the setting cannot be turned on, and skills and plugins are installed without a scan.
-* The following beta and research preview features are unavailable in CMEK organizations, regardless of admin settings: Claude Security and routines.
-
-### Encrypted with Anthropic key
+<CardGroup cols={2}>
+  <Card title="AWS KMS" href="https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms">
+    For Claude Platform and Claude Enterprise.
+  </Card>
 
-These features remain available, but their data is not encrypted under your key. You can disable any feature that is not appropriate for your use case in **Settings**.
+  <Card title="Google Cloud KMS" href="https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms">
+    For Claude Platform and Claude Enterprise.
+  </Card>
 
-**Claude Platform**
+  <Card title="Azure Key Vault" href="https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault">
+    For Claude Platform and Claude Enterprise.
+  </Card>
 
-* Data that is not at rest (such as cache) and data with a TTL shorter than 24 hours.
-* Activity Feed, audit logs, and telemetry network traffic such as OTEL, so customers can maintain compliance even if a key is revoked.
-* Claude Managed Agents [vault credential](https://platform.claude.com/docs/en/managed-agents/vaults) values, such as OAuth tokens and client secrets. These are stored under Anthropic-managed encryption, are write-only, and are never returned in API responses.
-* [User profiles](https://platform.claude.com/docs/en/api/beta/user_profiles): the `name`, `external_id`, and `metadata` fields are stored under Anthropic-managed encryption, not your key. Do not store sensitive personal data in profile `metadata`.
-* Ratings and comments about the Claude Console that members send with its **Feedback** option. No setting turns these off; members send them only when they choose to.
-* [OpenTelemetry destination](https://platform.claude.com/docs/en/manage-claude/opentelemetry/api#add-a-destination) request headers, such as the API key header of your observability platform. These are stored under Anthropic-managed encryption. Their values are write-only and are never returned in API responses.
+  <Card title="Claude Platform on AWS" href="https://platform.claude.com/docs/en/manage-claude/cmek-claude-platform-on-aws">
+    For organizations whose Claude Console sidebar shows **Account managed by AWS**.
+  </Card>
+</CardGroup>
 
-**Claude Enterprise**
+On Claude Platform, you can also add and attach your key [with the Admin API](https://platform.claude.com/docs/en/manage-claude/cmek-admin-api).
 
-* Beta and research preview features might not be covered by CMEK and can break in CMEK organizations.
-* The standalone Claude Design app at claude.ai/design is not supported with CMEK, and its data might not be encrypted under your key. The standalone app is closing. Claude Design in conversations and the **Artifacts** tab is encrypted under your key, as listed under [Encrypted with CMEK key](https://platform.claude.com/docs/en/manage-claude/cmek#encrypted).
-* [Personal preferences - Instructions for Claude section](https://claude.ai/new#settings/account) and Cowork Global instructions. These are set at the account level and shared across all of a user's organizations.
+## Understand CMEK before you set it up
 
-On both products, account data for users in your organization (such as names, email addresses, and profile pictures) is not encrypted under your key.
+Which product you use decides what your key encrypts, what stays under Anthropic's key, and which features turn off or change.
 
-## Limited preservation outside your key
+<CardGroup cols={2}>
+  <Card title="How CMEK works" href="https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works">
+    How your key protects data, when it takes effect, and what you can see.
+  </Card>
 
-In three narrow cases, Anthropic may preserve specific records under Anthropic-managed encryption:
+  <Card title="CMEK, data retention, and ZDR" href="https://platform.claude.com/docs/en/manage-claude/cmek-data-retention">
+    Using a key with zero data retention (ZDR), and what Anthropic can preserve outside your key.
+  </Card>
 
-* Where Anthropic is required by law to retain records (for example, material reported to NCMEC under 18 U.S.C. § 2258A).
-* Exigent risk of serious harm (for example, CBRNE weapons development, offensive cyberattacks, or imminent threats of violence).
-* Violations of Section D.4 of Anthropic's [Commercial Terms of Service](https://www.anthropic.com/legal/commercial-terms) or equivalent terms in a customer's other applicable agreement with Anthropic.
+  <Card title="What CMEK covers on Claude Platform" href="https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-platform">
+    Look up a feature or a kind of data.
+  </Card>
 
-Outside of [CSAM screening](https://support.claude.com/en/articles/9020328-csam-detection-and-reporting), preservation requires a human reviewer's explicit decision and follows Anthropic's [retention policy for commercial data](https://privacy.claude.com/en/articles/10023548-how-long-do-you-store-my-data). For every instance of preservation, a corresponding [Compliance API Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed) event is generated with a reason code conveying the purpose of the preservation. See [CMEK content preservation](https://platform.claude.com/docs/en/manage-claude/access-transparency#cmek-content-preservation) for details. Safety screening metadata (records derived from Anthropic's automated safety scans, such as pattern identifiers and match indicators, not conversation content) is retained under Anthropic-managed encryption and remains readable after key revocation.
+  <Card title="What CMEK covers on Claude Enterprise" href="https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise">
+    Look up a feature, and see what your users will notice.
+  </Card>
+</CardGroup>
 
-## Limitations
+## What you commit to
 
-* **Irreversible action:** Once a key is attached to a workspace, it cannot be detached or swapped. On Claude Platform, attaching a key also locks the workspace's data retention setting: you cannot turn off 30-day data retention for that workspace, and returning to zero data retention requires creating a new workspace and moving your traffic to it. Rotating the key material within the same key (for example, AWS KMS automatic rotation, a Cloud KMS rotation schedule, or an Azure Key Vault rotation policy) is supported transparently and requires no change in Anthropic. Switching to a *different* key requires creating a new workspace with the new key and migrating your data. Revoking or disabling the key makes all CMEK-protected data in that workspace permanently inaccessible, with no backout path.
-* **No retroactive encryption:** CMEK only protects data written after your key takes effect (see [How it works](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works)).
-* **Latency:** Operations that wrap or unwrap data keys make a round-trip to your key management service, which can add a small amount of latency to actions that read or write data at rest.
-* **Revocation delay:** Key revocation can take up to 1 hour (the cache TTL). Requests already in flight during that window may continue to succeed.
-* **Unreachable key:** If Anthropic cannot get your key, for example, during an outage of your key management service, requests that store data under your key fail. On the Messages API, they return a 503 error with the code `cmek_key_unreachable`, and you can retry them. The Message Batches API retries them until your key is available or the batch expires. On Claude Enterprise, these requests include messages in chat and in voice mode.
-* **KMS costs:** CMEK requires a key in a third-party key management service (AWS KMS, Google Cloud KMS, or Azure Key Vault), which might incur separate charges billed by your KMS provider.
-* **Claude Code telemetry behind a gateway:** When Claude Code connects through an LLM gateway or proxy (a custom `ANTHROPIC_BASE_URL`), CMEK does not apply to Claude Code's operational telemetry. To turn this telemetry off, set the `DISABLE_TELEMETRY` environment variable to `1`, as described under [Telemetry services](https://code.claude.com/docs/en/data-usage#telemetry-services) in the Claude Code documentation.
+* Once you attach a key, you [can't remove or replace it](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does).
+* Your key protects only data written [after it takes effect](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect).
+* If your key is deleted, Anthropic can't recover the data it protects. [While the key is disabled](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#restore-access), Claude can't read that data.
+* On Claude Platform, a workspace with a key [must retain data](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#data-retention).
 
-## Configure your provider
+## Who can use CMEK
 
-Follow the guide for the key management service you use. On Claude Platform on AWS, follow [Set up CMEK on Claude Platform on AWS](https://platform.claude.com/docs/en/manage-claude/cmek-claude-platform-on-aws) instead.
+CMEK is optional. To turn it on for an eligible organization, contact your Anthropic account team. You need one of these roles to set it up:
 
-<CardGroup cols={3}>
-  <Card href="https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms" title="AWS KMS">
-    Create an AWS KMS key with a key policy that grants Anthropic access, then register it.
-  </Card>
+* Claude Platform: Organization Admin
+* Claude Platform on AWS: Admin
+* Claude Enterprise: Owner or Primary Owner
 
-  <Card href="https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms" title="Google Cloud KMS">
-    Create a Cloud KMS crypto key, grant Anthropic's service account access, then register it.
-  </Card>
+## After setup
 
-  <Card href="https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault" title="Azure Key Vault">
-    Create an RSA key, grant the Anthropic service principal access, then register and validate it.
-  </Card>
-</CardGroup>
+* [What happens when you rotate, disable, or delete your encryption key](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle)
+* [Troubleshoot CMEK](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting)
diff --git a/content/en/manage-claude/compliance-activity-feed.md b/content/en/manage-claude/compliance-activity-feed.md
index e794fa9d5a..dfa48d6778 100644
--- a/content/en/manage-claude/compliance-activity-feed.md
+++ b/content/en/manage-claude/compliance-activity-feed.md
@@ -23,11 +23,11 @@ curl --fail-with-body -sS \
   -H "anthropic-version: 2023-06-01"
 ```
 
-```text Response wrap
+```json Response
 {
   "data": [
     {
-      "id": "activity_01XyDMpzjS89pFZXqSFUBDr6",
+      "id": "activity_01DeFgHjKmNpQrStUvWxYzAb",
       "created_at": "2026-04-10T08:09:10Z",
       "organization_id": "org_01Wv6QeBcDfGhJkLmNpQrSt8",
       "organization_uuid": "abcdef01-2345-6789-abcd-ef0123456789",
@@ -39,13 +39,13 @@ curl --fail-with-body -sS \
         "user_agent": "Mozilla/5.0..."
       },
       "type": "claude_chat_created",
-      "claude_chat_id": "claude_chat_01XyDMpzjS89pFZXqSFUBDr6",
+      "claude_chat_id": "claude_chat_01CdEfGhJkMnPqRsTuVwXyZa",
       "claude_project_id": "claude_proj_01KGp4eZNug9ri4kE35RSppq"
     }
   ],
   "has_more": true,
-  "first_id": "activity_01XyDMpzjS89pFZXqSFUBDr6",
-  "last_id": "activity_01XyDMpzjS89pFZXqSFUBDr6"
+  "first_id": "activity_01DeFgHjKmNpQrStUvWxYzAb",
+  "last_id": "activity_01DeFgHjKmNpQrStUvWxYzAb"
 }
 ```
 
@@ -152,7 +152,7 @@ The `actor` field is a discriminated union. The `type` discriminator tells you w
 
 | `actor.type`                 | When it appears                                                                                                                                                                        | Key fields                                                                                                                                            |
 | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `user_actor`                 | A signed-in claude.ai or Claude Console user took the action, or a process Anthropic runs on that user's behalf did (see the paragraph after this table).                              | `email_address`, `user_id`, `ip_address`, `user_agent`                                                                                                |
+| `user_actor`                 | A signed-in claude.ai or Claude Console user took the action. Processes Anthropic runs on the user's behalf can also appear as this type; see the paragraph after this table.          | `email_address`, `user_id`, `ip_address`, `user_agent`                                                                                                |
 | `api_actor`                  | A request called the Claude API or the Compliance API with a customer-issued API key. Compliance API calls produce this actor type for both Compliance Access Keys and Admin API keys. | `api_key_id`, `ip_address`, `user_agent`                                                                                                              |
 | `admin_api_key_actor`        | An organization admin used an Admin API key to manage users, invites, workspaces, or API keys.                                                                                         | `admin_api_key_id`, `ip_address`, `user_agent`                                                                                                        |
 | `unauthenticated_user_actor` | An action occurred before sign-in completed, for example `sso_login_initiated`.                                                                                                        | `unauthenticated_email_address`, `ip_address`, `user_agent`                                                                                           |
@@ -160,7 +160,7 @@ The `actor` field is a discriminated union. The `type` discriminator tells you w
 | `system_actor`               | Automated background processing performed by Anthropic systems, acting without a user or customer credential.                                                                          | `service` (nullable; the name of the automated process that performed the action, when known)                                                         |
 | `scim_directory_sync_actor`  | An identity provider (such as Okta, Microsoft Entra ID, or JumpCloud) pushed a change through SCIM directory sync.                                                                     | `workos_event_id`, `directory_id`, `idp_connection_type` (nullable; for example `OktaSCIMV2`, `AzureSCIMV2`)                                          |
 
-A `user_actor` activity does not always mean the user took the action. Processes that Anthropic runs on a user's behalf can currently appear as `user_actor` for the affected user rather than as `system_actor`, and this attribution may change. For example, memory activities from a migration, such as `platform_memory_store_created`, `platform_memory_created`, and `platform_memory_deleted`, are attributed this way. Memory activities can show an `ip_address` of `0.0.0.0` whoever performed them, so this value does not on its own identify activity from a platform process.
+A `user_actor` activity does not always mean the user took the action. Processes that Anthropic runs on a user's behalf can currently appear as `user_actor` for the affected user rather than as `system_actor`, and this attribution may change. For example, memory activities from a migration, such as `platform_memory_store_created`, `platform_memory_created`, and `platform_memory_deleted`, are attributed this way. The memory activities `platform_memory_store_created`, `platform_memory_created`, `platform_memory_updated`, and `platform_memory_deleted` currently show an `ip_address` of `0.0.0.0` whoever performed them. As a result, this value does not on its own identify a process that Anthropic runs on the user's behalf.
 
 A `claude_*_viewed` activity means a Claude app loaded content, not that a person viewed it. Types such as `claude_chat_viewed`, `claude_file_viewed`, and `claude_project_viewed` are recorded each time a Claude app loads the chat, file, or project from Anthropic's servers. Repeated loads are not deduplicated. The web, desktop, and mobile apps load content at different moments, sometimes in the background, and can display a cached copy without loading it. Counts of these activities vary by platform as a result, and they do not correspond to messages sent or screens viewed.
 
diff --git a/content/en/manage-claude/compliance-api-access.md b/content/en/manage-claude/compliance-api-access.md
index 60e7d3be3f..cde81c62db 100644
--- a/content/en/manage-claude/compliance-api-access.md
+++ b/content/en/manage-claude/compliance-api-access.md
@@ -129,7 +129,7 @@ To inspect the scopes on a key you already have, use one of the following signal
 * **Settings UI.** For a Compliance Access Key, open the **Keys** section in [claude.ai > Organization settings > API](https://claude.ai/admin-settings/api-access) and read the **Scopes** column for the key. Admin API keys, listed on the [Admin keys](https://platform.claude.com/settings/admin-keys) page (`platform.claude.com/settings/admin-keys`) in the Claude Console, have no selectable scopes.
 * **Error responses.** A call that exceeds the key's scopes returns a 403 with a message in the format `Missing required scopes. Got: [<scopes the key carries>] Needed one of: [<scopes the endpoint accepts>]` (`Needed: [...]` on the delete endpoints). See [Handle Compliance API errors](https://platform.claude.com/docs/en/manage-claude/compliance-errors#403-forbidden) for the full error catalog.
 
-```text
+```json
 {
   "error": {
     "type": "permission_error",
diff --git a/content/en/manage-claude/compliance-api.md b/content/en/manage-claude/compliance-api.md
index 0c90a5695f..d6d424aeb0 100644
--- a/content/en/manage-claude/compliance-api.md
+++ b/content/en/manage-claude/compliance-api.md
@@ -21,11 +21,11 @@ curl --fail-with-body -sS \
 
 A successful response returns a JSON object containing `data` (an array of `Activity` records), `has_more`, `first_id`, and `last_id`:
 
-```text Response wrap
+```json Response
 {
   "data": [
     {
-      "id": "activity_01XyDMpzjS89pFZXqSFUBDr6",
+      "id": "activity_01DeFgHjKmNpQrStUvWxYzAb",
       "created_at": "2026-04-10T08:09:10Z",
       "organization_id": "org_01Wv6QeBcDfGhJkLmNpQrSt8",
       "organization_uuid": "abcdef01-2345-6789-abcd-ef0123456789",
@@ -37,13 +37,13 @@ A successful response returns a JSON object containing `data` (an array of `Acti
         "user_agent": "Mozilla/5.0..."
       },
       "type": "claude_chat_created",
-      "claude_chat_id": "claude_chat_01XyDMpzjS89pFZXqSFUBDr6",
+      "claude_chat_id": "claude_chat_01CdEfGhJkMnPqRsTuVwXyZa",
       "claude_project_id": "claude_proj_01KGp4eZNug9ri4kE35RSppq"
     }
   ],
   "has_more": true,
-  "first_id": "activity_01XyDMpzjS89pFZXqSFUBDr6",
-  "last_id": "activity_01XyDMpzjS89pFZXqSFUBDr6"
+  "first_id": "activity_01DeFgHjKmNpQrStUvWxYzAb",
+  "last_id": "activity_01DeFgHjKmNpQrStUvWxYzAb"
 }
 ```
 
diff --git a/content/en/manage-claude/compliance-content-data.md b/content/en/manage-claude/compliance-content-data.md
index 23df83522c..d7d75a7de3 100644
--- a/content/en/manage-claude/compliance-content-data.md
+++ b/content/en/manage-claude/compliance-content-data.md
@@ -38,7 +38,7 @@ curl --fail-with-body -sS -G \
   --data-urlencode "limit=100"
 ```
 
-```text Response
+```json Response
 {
   "data": [
     {
@@ -52,7 +52,7 @@ curl --fail-with-body -sS -G \
       "organization_uuid": "91012d09-e48b-438e-a489-1bebfd8fa6f9",
       "project_id": "claude_proj_01KGp4eZNug9ri4kE35RSppq",
       "user": {
-        "id": "user_01XyDMpzjS89pFZXqSFUBDr6",
+        "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
         "email_address": "user@example.com"
       }
     }
@@ -69,14 +69,14 @@ That forward walk is also how you keep an export current across runs: persist th
 
 A few constraints apply to these organization-wide queries. Cursors are opaque and bound to the sort key, so an `after_id` issued under one `order_by` value is rejected with a 400 error under the other. Time-filter bounds must match the sort key too: pair `updated_at.*` bounds with `order_by=updated_at`, and `created_at.*` bounds with the default `order_by=created_at`. Backward pagination with `before_id` is not supported, and the `project_ids[]` filter is not available. See [List chats](https://platform.claude.com/docs/en/api/compliance/apps/chats/list) for the full filter reference.
 
-To scope the list to specific users instead (for example, a legal hold on named custodians), pass 1–10 `user_ids[]` values. Obtain the IDs from [List organization users](https://platform.claude.com/docs/en/manage-claude/compliance-org-data#list-organization-users). User-filtered queries always sort by `created_at` (passing `order_by=updated_at` returns a 400 error) and support both `after_id` and `before_id`. Filtering by `project_ids[]` is only available in this user-filtered form. Combining `user_ids[]` with any `updated_at.*` bound is deprecated and will be rejected with a 400 error after 2026-09-22; to keep a custodian set current by update time, run the organization-wide `order_by=updated_at` walk without `user_ids[]` and select the custodians' chats from its results, and keep the user-filtered listing for `created_at`-ordered exports.
+To scope the list to specific users instead (for example, a legal hold on named custodians), pass 1–10 `user_ids[]` values. Obtain the IDs from [List organization users](https://platform.claude.com/docs/en/manage-claude/compliance-org-data#list-organization-users). User-filtered queries always sort by `created_at` (passing `order_by=updated_at` returns a 400 error) and support both `after_id` and `before_id`. Filtering by `project_ids[]` is only available in this user-filtered form. Combining `user_ids[]` with any `updated_at.*` bound is deprecated and will be rejected with a 400 error after 2026-09-22. To keep a custodian set current by update time, run the organization-wide `order_by=updated_at` walk without `user_ids[]` and select the custodians' chats from its results. Keep the user-filtered listing for `created_at`-ordered exports.
 
 ```bash cURL
 curl --fail-with-body -sS -G \
   "https://api.anthropic.com/v1/compliance/apps/chats" \
   --header "x-api-key: $ANTHROPIC_COMPLIANCE_ACCESS_KEY" \
   --header "anthropic-version: 2023-06-01" \
-  --data-urlencode "user_ids[]=user_01XyDMpzjS89pFZXqSFUBDr6" \
+  --data-urlencode "user_ids[]=user_01WxYzAbCdEfGhJkMnPqRsTu" \
   --data-urlencode "created_at.gte=2025-06-01T00:00:00Z" \
   --data-urlencode "limit=100"
 ```
@@ -92,7 +92,7 @@ curl --fail-with-body -sS \
 
 The messages endpoint returns the chat's metadata plus a `chat_messages` array sorted by `created_at`. When `limit` is omitted, the full message set is returned in one response; pass `limit`, `after_id`, or `before_id` to page through very long chats. The endpoint also accepts `created_at.*` and `updated_at.*` range bounds (`gt`, `gte`, `lt`, `lte`) and an `order` parameter (`asc` or `desc`). See [Get chat messages](https://platform.claude.com/docs/en/api/compliance/apps/chats/messages/list) for the full parameter list. For user messages, `created_at` is when the message was sent; for assistant messages, it is when Claude finished generating the message. Each message carries its text content and, when present, any uploaded files (typically on user messages), any tool-generated files, and any artifacts the assistant produced or updated (typically on assistant messages):
 
-```text Response
+```json Response
 {
   "id": "claude_chat_01H5CWunD7RpVJ5bHa8RCkja",
   "name": "Product Requirements Discussion",
@@ -104,7 +104,7 @@ The messages endpoint returns the chat's metadata plus a `chat_messages` array s
   "organization_uuid": "91012d09-e48b-438e-a489-1bebfd8fa6f9",
   "project_id": "claude_proj_01KGp4eZNug9ri4kE35RSppq",
   "user": {
-    "id": "user_01XyDMpzjS89pFZXqSFUBDr6",
+    "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
     "email_address": "user@example.com"
   },
   "chat_messages": [
@@ -200,7 +200,11 @@ curl --fail-with-body -sS \
   --output "dashboard_mockup_v1.pdf"
 ```
 
-In curl, the `--remote-header-name` (`-J`) option, which normally saves a download under the `Content-Disposition` file name, does not read the `filename*` form, so name the saved file yourself with `--output`. In a script, take the name from the file's `filename` field in the chat messages or [Get file metadata](https://platform.claude.com/docs/en/api/compliance/apps/chats/files/retrieve) response, or decode `filename*`. Either way, it is the name the user gave the upload, so treat it as untrusted before using it as an output path: keep only the base name, allow only characters that are safe on your filesystem, and refuse names that begin with `-` or `.`.
+In curl, the `--remote-header-name` (`-J`) option, which normally saves a download under the `Content-Disposition` file name, does not read the `filename*` form, so name the saved file yourself with `--output`. In a script, take the name from the file's `filename` field in the chat messages or [Get file metadata](https://platform.claude.com/docs/en/api/compliance/apps/chats/files/retrieve) response, or decode `filename*`. Either way, it is the name the user gave the upload, so treat it as untrusted before using it as an output path:
+
+* Keep only the base name.
+* Allow only characters that are safe on your filesystem.
+* Refuse names that begin with `-` or `.`.
 
 Unlike the file content endpoint, the artifact content endpoint returns a JSON object. Pass the `version_id` from one of the entries in an assistant message's `artifacts` array, not the artifact's stable `id`; each new version of an artifact has its own `version_id`. The response's `content` field holds exactly that version's text, and its `title` and `artifact_type` fields describe the artifact. [Get artifact metadata](https://platform.claude.com/docs/en/api/compliance/apps/artifacts/retrieve) computes `size_bytes` and `md5` over the UTF-8 encoding of that text, so compare them with the `content` value rather than the whole response body.
 
@@ -232,7 +236,7 @@ curl --fail-with-body -sS -G \
   -H "anthropic-version: 2023-06-01"
 ```
 
-```text Response wrap
+```json Response
 {
   "data": [
     {
@@ -289,7 +293,7 @@ curl --fail-with-body -sS -X DELETE \
   -H "anthropic-version: 2023-06-01"
 ```
 
-```text Response wrap
+```json Response
 {
   "id": "claude_chat_01H5CWunD7RpVJ5bHa8RCkja",
   "type": "claude_chat_deleted"
@@ -302,7 +306,7 @@ Each successful delete returns a small confirmation envelope with an `id` and a
 
 A project cannot be deleted while any chats remain attached to it. The API returns 409 with this body:
 
-```text
+```json
 {
   "error": {
     "type": "invalid_request_error",
diff --git a/content/en/manage-claude/compliance-errors.md b/content/en/manage-claude/compliance-errors.md
index 6d7be3f592..c501c06906 100644
--- a/content/en/manage-claude/compliance-errors.md
+++ b/content/en/manage-claude/compliance-errors.md
@@ -12,7 +12,7 @@ This page lists common Compliance API error responses by HTTP status code, with
 
 The Compliance API returns errors in the standard [Anthropic error format](https://platform.claude.com/docs/en/api/errors): a non-2xx status code, a `request-id` response header, and a JSON body with an `error` object containing `type` and `message`. Include the `request-id` header value when you escalate to support.
 
-```text
+```json
 {
   "error": {
     "type": "permission_error",
@@ -118,7 +118,7 @@ Invalid pagination cursor for 'after_id'
 
 The directory, project, and session endpoints (organizations, users, roles, role permissions, groups, group members, projects, project attachments, local and remote sessions, and session messages) paginate with an opaque `page` token rather than `after_id` and `before_id`. The same advice applies: pass the `next_page` value from the previous response unchanged, and stop when `has_more` is `false` (or, on the session endpoints, which return no `has_more`, when `next_page` is `null`). A malformed `page` token returns the same 400 `invalid_request_error` as a malformed `after_id` or `before_id`, with a message specific to the endpoint.
 
-The two paginated local session endpoints (the list and the messages endpoint) return the following 400 `invalid_request_error` for any `page` value they cannot decode, for example, a token that was truncated or altered after you stored it, or one issued by a different endpoint or under a different parent organization. On the local session messages endpoint (`GET /v1/compliance/apps/sessions/local/{session_id}/messages`), each `page` cursor is also bound to the session and `order` it was issued for, so a cursor issued for a different session or sort order returns the same body:
+The two paginated local session endpoints (the list and the messages endpoint) return the following 400 `invalid_request_error` for any `page` value they cannot decode. Examples include a token truncated or altered after you stored it, and one issued by a different endpoint or under a different parent organization. On the local session messages endpoint (`GET /v1/compliance/apps/sessions/local/{session_id}/messages`), each `page` cursor is also bound to the session and `order` it was issued for, so a cursor issued for a different session or sort order returns the same body:
 
 ```text wrap
 The page parameter is not a valid cursor for this request.
@@ -349,7 +349,14 @@ No project document found with the provided id, or it has already been deleted.
 Local session not found.
 ```
 
-**Cause:** The session ID passed to `GET /v1/compliance/apps/sessions/local/{session_id}` or `GET /v1/compliance/apps/sessions/local/{session_id}/messages` does not match a local session readable through the Compliance API. Both endpoints return this one message, without distinguishing the cause, when the ID is not a session in an organization your key can read (including IDs that belong to another parent organization), when the session never existed, when [zero data retention](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#zero-data-retention-zdr-scope) is in effect for the session, or when all of the session's activity has aged past the retention period that applies to the organization that ran it. The `Local session not found.` response has no transient form, because local sessions have no provisioning (`pending`) state; compare [Remote session not found](https://platform.claude.com/docs/en/manage-claude/compliance-errors#remote-session-not-found), where a `pending` session 404s until it starts. A session ID that is not a well-formed `clls_` identifier returns [400 Bad Request](https://platform.claude.com/docs/en/manage-claude/compliance-errors#400-bad-request) instead.
+**Cause:** The session ID passed to `GET /v1/compliance/apps/sessions/local/{session_id}` or `GET /v1/compliance/apps/sessions/local/{session_id}/messages` does not match a local session readable through the Compliance API. Both endpoints return this one message, without distinguishing the cause, in any of the following cases:
+
+* The ID is not a session in an organization your key can read (including IDs that belong to another parent organization).
+* The session never existed.
+* [Zero data retention](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#zero-data-retention-zdr-scope) is in effect for the session.
+* All of the session's activity has aged past the retention period that applies to the organization that ran it.
+
+The `Local session not found.` response has no transient form, because local sessions have no provisioning (`pending`) state; compare [Remote session not found](https://platform.claude.com/docs/en/manage-claude/compliance-errors#remote-session-not-found), where a `pending` session 404s until it starts. A session ID that is not a well-formed `clls_` identifier returns [400 Bad Request](https://platform.claude.com/docs/en/manage-claude/compliance-errors#400-bad-request) instead.
 
 The local session endpoints, including the list endpoint, return a different 404 message, `Local sessions are not available.`, while the endpoints themselves are unavailable to your parent organization. That response does not depend on the session ID; no customer-side key, scope, or setting changes it, and it can be temporary. Both responses carry the `not_found_error` type; the message text is what tells them apart.
 
@@ -363,7 +370,13 @@ The local session endpoints, including the list endpoint, return a different 404
 Remote session not found.
 ```
 
-**Cause:** The session ID passed to `GET /v1/compliance/apps/sessions/remote/{session_id}/messages` does not match a session transcript readable through the Compliance API. This occurs when the session ID (`cse_...`) does not exist or the session has been deleted, when the session belongs to an organization your key cannot read, or when the session's `status` is still `pending`: a pending session has no transcript yet, so the messages endpoint returns 404 until the session starts. A session ID that is not a well-formed `cse_` identifier returns [400 Bad Request](https://platform.claude.com/docs/en/manage-claude/compliance-errors#400-bad-request) instead.
+**Cause:** The session ID passed to `GET /v1/compliance/apps/sessions/remote/{session_id}/messages` does not match a session transcript readable through the Compliance API. This occurs in any of the following cases:
+
+* The session ID (`cse_...`) does not exist or the session has been deleted.
+* The session belongs to an organization your key cannot read.
+* The session's `status` is still `pending`: a pending session has no transcript yet, so the messages endpoint returns 404 until the session starts.
+
+A session ID that is not a well-formed `cse_` identifier returns [400 Bad Request](https://platform.claude.com/docs/en/manage-claude/compliance-errors#400-bad-request) instead.
 
 **Fix:** Confirm the session ID and its `status` against `GET /v1/compliance/apps/sessions/remote`; see [Sessions in the cloud](https://platform.claude.com/docs/en/manage-claude/compliance-sessions#retrieve-remote-sessions). If the session is `pending`, retry after it leaves that status. If the session no longer appears in the list, it has been deleted and its transcript is not retrievable.
 
@@ -389,7 +402,13 @@ The organization, role, and group endpoints return a 404 `not_found_error` in th
 organization `91012d09-e48b-438e-a489-1bebfd8fa6f9` not found in this organization's hierarchy
 ```
 
-**Cause:** `GET /v1/compliance/organizations/{organization_id}/settings` returns this 404 in three cases that intentionally share the same body so the response does not reveal whether an organization exists: the `organization_id` is not one of your parent's linked organizations, the value is not a valid UUID, or the settings endpoint is not yet enabled for your parent organization.
+**Cause:** `GET /v1/compliance/organizations/{organization_id}/settings` returns this 404 in three cases:
+
+* The `organization_id` is not one of your parent's linked organizations.
+* The `organization_id` is not a valid UUID.
+* The settings endpoint is not yet enabled for your parent organization.
+
+The endpoint intentionally returns the same body in all three cases, so a 404 does not reveal whether an organization exists.
 
 **Fix:** Verify the ID against [List organizations](https://platform.claude.com/docs/en/api/compliance/organizations/list). If a known-good organization ID still returns 404, the settings endpoint is not yet enabled for your parent organization; contact your Anthropic representative.
 
@@ -423,7 +442,7 @@ Once your API key authenticates, Compliance API responses report the shared budg
 
 A 429 response also carries a `retry-after` header with the number of seconds to wait before sending the next request. This value might include a small safety margin beyond `anthropic-ratelimit-requests-reset`; honor `retry-after`.
 
-```text wrap
+```http
 HTTP/1.1 429 Too Many Requests
 date: Tue, 21 Apr 2026 14:38:02 GMT
 retry-after: 25
@@ -432,7 +451,7 @@ anthropic-ratelimit-requests-remaining: 0
 anthropic-ratelimit-requests-reset: 2026-04-21T14:38:25Z
 ```
 
-```text
+```json
 {
   "error": {
     "type": "rate_limit_error",
diff --git a/content/en/manage-claude/compliance-faq.md b/content/en/manage-claude/compliance-faq.md
index b2246c6c43..1979a84e85 100644
--- a/content/en/manage-claude/compliance-faq.md
+++ b/content/en/manage-claude/compliance-faq.md
@@ -43,7 +43,7 @@ description: Answers to common questions about Compliance API access, scopes, re
   <Accordion title="Why does my Admin API key return 403 on chat or file endpoints?">
     An Admin API key's only Compliance API scope is `read:compliance_activities`, which authorizes the Activity Feed only. Every other Compliance API endpoint requires a scope that only a Compliance Access Key created in claude.ai can carry. Calling a content or directory endpoint with an Admin API key returns a 403 naming the scope that endpoint family requires: `read:compliance_user_data` for chats, files, projects, project attachments, sessions, users, and group members, and `read:compliance_org_data` for organizations, roles, groups, and effective organization settings. For example, listing chats returns the following response.
 
-    ```text Response
+    ```json Response
     {
       "error": {
         "type": "permission_error",
diff --git a/content/en/manage-claude/compliance-integration-patterns.md b/content/en/manage-claude/compliance-integration-patterns.md
index 5953a9a60b..97bec3b0d2 100644
--- a/content/en/manage-claude/compliance-integration-patterns.md
+++ b/content/en/manage-claude/compliance-integration-patterns.md
@@ -67,7 +67,7 @@ curl --fail-with-body -sS -G \
   -H "x-api-key: $ANTHROPIC_COMPLIANCE_ACCESS_KEY" \
   -H "anthropic-version: 2023-06-01" \
   --data-urlencode "limit=5000" \
-  --data-urlencode "before_id=activity_01XyDMpzjS89pFZXqSFUBDr6"
+  --data-urlencode "before_id=activity_01DeFgHjKmNpQrStUvWxYzAb"
 ```
 
 Page through until `has_more` is `false`, then persist `first_id` from the final response and pass it unchanged as `before_id` on the next run to retrieve activities newer than the saved cursor. To walk in the opposite direction for a backfill, persist `last_id` and pass it as `after_id` instead. For the full cursor-versus-page-token reference and retry semantics, see [Paginate results](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed#paginate-results).
diff --git a/content/en/manage-claude/compliance-org-data.md b/content/en/manage-claude/compliance-org-data.md
index eb2f226032..ee176eb125 100644
--- a/content/en/manage-claude/compliance-org-data.md
+++ b/content/en/manage-claude/compliance-org-data.md
@@ -29,7 +29,7 @@ curl --fail-with-body -sS \
   -H "anthropic-version: 2023-06-01"
 ```
 
-```text Response wrap
+```json Response
 {
   "data": [
     {
@@ -80,11 +80,11 @@ curl --fail-with-body -sS -G \
   --data-urlencode "limit=500"
 ```
 
-```text Response wrap
+```json Response
 {
   "data": [
     {
-      "id": "user_01XyDMpzjS89pFZXqSFUBDr6",
+      "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
       "full_name": "Priya Sharma",
       "email": "priya@example.com",
       "organization_role": "admin",
@@ -96,7 +96,7 @@ curl --fail-with-body -sS -G \
 }
 ```
 
-The user IDs returned here are the same `user_...` identifiers accepted by the [Query the Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed) `actor_ids[]` filter and the `user_ids[]` filters on [Retrieve chats and messages](https://platform.claude.com/docs/en/manage-claude/compliance-content-data#retrieve-chats-and-messages) and the [remote session list](https://platform.claude.com/docs/en/manage-claude/compliance-sessions#retrieve-remote-sessions); the [local session list](https://platform.claude.com/docs/en/manage-claude/compliance-sessions#retrieve-local-sessions) has no user filter, so attribute local sessions by the `user.id` on each session object. The `organization_role` field carries the user's built-in membership level within the listed organization (one of `admin`, `billing`, `claude_code_user`, `developer`, `managed`, `membership_admin`, `owner`, `primary_owner`, or `user`), an axis independent of any custom RBAC role assignments returned by [List roles](https://platform.claude.com/docs/en/manage-claude/compliance-org-data#list-roles). A typical eDiscovery flow lists users for one or more organizations, filters against your own external records, and feeds the resulting IDs into chat and project queries.
+The user IDs returned here are the same `user_...` identifiers accepted by the [Query the Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed) `actor_ids[]` filter. The `user_ids[]` filters on [Retrieve chats and messages](https://platform.claude.com/docs/en/manage-claude/compliance-content-data#retrieve-chats-and-messages) and the [remote session list](https://platform.claude.com/docs/en/manage-claude/compliance-sessions#retrieve-remote-sessions) accept the same identifiers. The [local session list](https://platform.claude.com/docs/en/manage-claude/compliance-sessions#retrieve-local-sessions) has no user filter, so attribute local sessions by the `user.id` on each session object. The `organization_role` field carries the user's built-in membership level within the listed organization (one of `admin`, `billing`, `claude_code_user`, `developer`, `managed`, `membership_admin`, `owner`, `primary_owner`, or `user`), an axis independent of any custom RBAC role assignments returned by [List roles](https://platform.claude.com/docs/en/manage-claude/compliance-org-data#list-roles). A typical eDiscovery flow lists users for one or more organizations, filters against your own external records, and feeds the resulting IDs into chat and project queries.
 
 A user only appears here while they are an active member of the organization. Removed users are dropped from the list immediately. Their historical activity remains queryable through the Activity Feed for the full retention window, indexed by the same `user_...` ID.
 
@@ -115,12 +115,12 @@ curl --fail-with-body -sS \
   -H "anthropic-version: 2023-06-01"
 ```
 
-```text Response wrap
+```json Response
 {
   "data": [
     {
       "user": {
-        "id": "user_01XyDMpzjS89pFZXqSFUBDr6",
+        "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
         "email_address": "priya@example.com"
       },
       "conversation_preferences": "Keep answers brief and cite sources.",
@@ -145,7 +145,7 @@ curl --fail-with-body -sS \
   -H "anthropic-version: 2023-06-01"
 ```
 
-```text Response
+```json Response
 {
   "data": [
     {
@@ -180,7 +180,7 @@ curl --fail-with-body -sS -G \
   -H "anthropic-version: 2023-06-01"
 ```
 
-```text Response wrap
+```json Response
 {
   "data": [
     {
@@ -207,11 +207,11 @@ curl --fail-with-body -sS -G \
   -H "anthropic-version: 2023-06-01"
 ```
 
-```text Response wrap
+```json Response
 {
   "data": [
     {
-      "user_id": "user_01XyDMpzjS89pFZXqSFUBDr6",
+      "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
       "email": "priya@example.com",
       "created_at": "2025-06-01T10:00:00Z",
       "updated_at": "2025-06-15T14:30:00Z"
@@ -228,7 +228,14 @@ See the [List Compliance Group Members](https://platform.claude.com/docs/en/api/
 
 The [Get effective organization settings](https://platform.claude.com/docs/en/api/compliance/organizations/settings/retrieve) endpoint returns the settings in force for one organization under your parent: the enforced state after regulatory restrictions (such as HIPAA), feature-availability rules, organization-type defaults, and inter-feature dependencies are applied, which can differ from what an administrator configured. Use it to attest that retention windows, content redaction, single sign-on enforcement, the IP allowlist, and session-duration controls match your documented baseline, without administrator Console access.
 
-This endpoint requires `read:compliance_org_data`; a key without that scope returns [403 Forbidden](https://platform.claude.com/docs/en/manage-claude/compliance-errors#403-forbidden). The target must be one of the parent's linked organizations: the parent organization itself is not a valid target. An unknown organization, an organization ID that is not a valid UUID, an organization outside your parent's tree, and a parent organization that does not yet have access to this endpoint all return the same [404 Not Found](https://platform.claude.com/docs/en/manage-claude/compliance-errors#404-not-found), so a 404 does not reveal whether an organization exists. The settings endpoint is enabled per parent organization separately from the rest of the Compliance API; if every request returns 404, contact your Anthropic representative.
+This endpoint requires `read:compliance_org_data`; a key without that scope returns [403 Forbidden](https://platform.claude.com/docs/en/manage-claude/compliance-errors#403-forbidden). The target must be one of the parent's linked organizations: the parent organization itself is not a valid target. All of the following return the same [404 Not Found](https://platform.claude.com/docs/en/manage-claude/compliance-errors#404-not-found):
+
+* An unknown organization
+* An organization ID that is not a valid UUID
+* An organization outside your parent's tree
+* A parent organization that does not yet have access to this endpoint
+
+A 404 therefore does not reveal whether an organization exists. The settings endpoint is enabled per parent organization separately from the rest of the Compliance API; if every request returns 404, contact your Anthropic representative.
 
 <Note>
   Before June 30, 2026, this endpoint required the separate `read:compliance_org_settings` scope. That scope has been retired: it can no longer be selected or granted when creating a key, and a key that carries only the retired scope returns [403 Forbidden](https://platform.claude.com/docs/en/manage-claude/compliance-errors#403-forbidden). Create a new Compliance Access Key with `read:compliance_org_data` instead.
@@ -243,7 +250,7 @@ curl --fail-with-body -sS \
 
 The response is a list of typed setting rows, and which rows appear varies by organization: a setting the organization's administrators cannot change, because it is controlled by Anthropic policy or not available to the organization, is omitted from the list. Treat a missing row as "not controllable by this organization's administrators", not as "off". The following abridged example shows three of the rows a response can contain:
 
-```text Response wrap
+```json Response
 {
   "type": "effective_organization_settings",
   "organization_id": "91012d09-e48b-438e-a489-1bebfd8fa6f9",
@@ -291,7 +298,11 @@ The `api_keys` array lists every Compliance Access Key configured for your paren
 
 The top-level `organization_id` is the organization's bare UUID: the same value as `uuid` in the organizations list, not the `org_`-prefixed form that `organization_id` carries on Activity Feed, chat, and project records (see the [organization identifier table](https://platform.claude.com/docs/en/manage-claude/compliance-org-data#list-organizations)).
 
-Rows reflect the enforced state rather than the last-stored configuration: for example, `sso_provisioning_mode` reports a configured SCIM mode only while directory sync is enabled, `ip_allowlist_enabled` is `true` only while the allowlist is on and has at least one active range, and `code_execution_network_egress_enabled` is `false` whenever code execution is off.
+Rows reflect the enforced state rather than the last-stored configuration, as in these examples:
+
+* `sso_provisioning_mode` reports a configured SCIM mode only while directory sync is enabled.
+* `ip_allowlist_enabled` is `true` only while the allowlist is on and has at least one active range.
+* `code_execution_network_egress_enabled` is `false` whenever code execution is off.
 
 The response reflects the state at read time; nothing is snapshotted. Changes to most of these settings surface as events in the [Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed); use this endpoint for the current resolved state and the feed to audit who changed what, and when.
 
diff --git a/content/en/manage-claude/compliance-sessions.md b/content/en/manage-claude/compliance-sessions.md
index f07cb0e895..66db6a594c 100644
--- a/content/en/manage-claude/compliance-sessions.md
+++ b/content/en/manage-claude/compliance-sessions.md
@@ -14,7 +14,7 @@ description: List the sessions your users run in Claude apps and agents, such as
   **Prerequisite:** None for listing sessions organization-wide. To filter the remote session list (sessions in the cloud) to specific users, you need user IDs from [List organization users](https://platform.claude.com/docs/en/manage-claude/compliance-org-data#list-organization-users); the local session list has no user filter.
 </Check>
 
-The endpoints on this page expose transcripts of the sessions your users run in Claude apps and agents (today: Cowork, Claude Code, Claude Science, Claude for Microsoft 365, the Claude add-ins for Google Docs, Google Sheets, and Google Slides, and Claude in Chrome) from your Claude Enterprise organizations to compliance reviewers. Each session is a single conversation with Claude; its transcript is the sequence of user prompts, assistant responses, and tool calls and results in that conversation. The endpoints support eDiscovery (electronic discovery) exports and data loss prevention (DLP) enforcement.
+The endpoints on this page expose session transcripts from your Claude Enterprise organizations to compliance reviewers. The transcripts cover the sessions your users run in Claude apps and agents (today: Cowork, Claude Code, Claude Science, Claude for Microsoft 365, the Claude add-ins for Google Docs, Google Sheets, and Google Slides, and Claude in Chrome). Each session is a single conversation with Claude; its transcript is the sequence of user prompts, assistant responses, and tool calls and results in that conversation. The endpoints support eDiscovery (electronic discovery) exports and data loss prevention (DLP) enforcement.
 
 The Compliance API groups sessions into two endpoint families according to where they run: local session endpoints for sessions on users' machines, and remote session endpoints for sessions that run in the cloud in Anthropic-managed environments. Both families are read-only, and neither is available to Admin API keys (`sk-ant-admin01-...`): calls authenticated with an Admin API key return [403 Forbidden](https://platform.claude.com/docs/en/manage-claude/compliance-errors#403-forbidden).
 
@@ -58,7 +58,14 @@ Anthropic recommends the Compliance API for retrieving session content. The foll
 
 ## Sessions on users' machines (local sessions)
 
-Local sessions run on users' machines while they are signed in with their Claude Enterprise account: today, Cowork in Claude Desktop, Claude Code (in the terminal, in Claude Desktop, or in an IDE extension), the Claude Science desktop app, Claude for Microsoft 365 (in Excel, PowerPoint, Word, and Outlook), the Claude add-ins for Google Docs, Google Sheets, and Google Slides, and the Claude in Chrome browser extension.
+Local sessions run on users' machines while they are signed in with their Claude Enterprise account, today in the following products:
+
+* Cowork in Claude Desktop
+* Claude Code (in the terminal, in Claude Desktop, or in an IDE extension)
+* The Claude Science desktop app
+* Claude for Microsoft 365 (in Excel, PowerPoint, Word, and Outlook)
+* The Claude add-ins for Google Docs, Google Sheets, and Google Slides
+* The Claude in Chrome browser extension
 
 The Compliance API exposes local sessions through three endpoints: `GET /v1/compliance/apps/sessions/local` lists session metadata, `GET /v1/compliance/apps/sessions/local/{session_id}` retrieves one session's metadata, and `GET /v1/compliance/apps/sessions/local/{session_id}/messages` returns one session's transcript. All three require the `read:compliance_user_data` scope and count only against the shared Compliance API rate limit; they are not subject to the second request budget that applies to the remote session endpoints. See [429 Too Many Requests](https://platform.claude.com/docs/en/manage-claude/compliance-errors#429-too-many-requests). If local sessions are not available to your parent organization, all three endpoints return 404 with the message `Local sessions are not available.` (see [Local session not found](https://platform.claude.com/docs/en/manage-claude/compliance-errors#local-session-not-found)); while session listings or captured content are temporarily unavailable, they return 503 (see [Local sessions temporarily unavailable](https://platform.claude.com/docs/en/manage-claude/compliance-errors#local-sessions-temporarily-unavailable)).
 
@@ -77,7 +84,7 @@ curl --fail-with-body -sS -G \
   --data-urlencode "limit=100"
 ```
 
-```text Response wrap
+```json Response
 {
   "data": [
     {
@@ -123,7 +130,12 @@ The list is built from session activity metadata, so it can include sessions who
 
 Captured local session content is stored for 6 years from capture by default. If the organization that ran the session has set a finite custom conversation retention period in [claude.ai > Organization settings > Data and privacy](https://claude.ai/admin-settings/data-privacy-controls), that period applies instead, whether it is shorter or longer than the default; when the organization has more than one custom retention period configured, the shortest applies. A change to that setting takes effect in two different ways: the endpoints stop returning activity older than the organization's current period as soon as the setting changes, whereas each captured message is stored for the period that was in effect when it was captured, so lengthening the period later does not restore content that has already expired. In organizations with [HIPAA readiness](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#hipaa-readiness) enabled, captured local session content is stored for 30 days from capture, or for the organization's custom conversation retention period when that is shorter; the 6-year default does not apply.
 
-To fetch one session's metadata directly, pass its ID to `GET /v1/compliance/apps/sessions/local/{session_id}`. The response is the same session object the list endpoint returns, with no envelope and no transcript content. A malformed session ID returns [400 Bad Request](https://platform.claude.com/docs/en/manage-claude/compliance-errors#400-bad-request). A single [404 Not Found](https://platform.claude.com/docs/en/manage-claude/compliance-errors#404-not-found) covers four cases that the response does not distinguish: the session is not in an organization your key can read (including sessions under another parent organization), it does not exist, zero data retention is in effect for it, or every call in it has aged past retention.
+To fetch one session's metadata directly, pass its ID to `GET /v1/compliance/apps/sessions/local/{session_id}`. The response is the same session object the list endpoint returns, with no envelope and no transcript content. A malformed session ID returns [400 Bad Request](https://platform.claude.com/docs/en/manage-claude/compliance-errors#400-bad-request). A single [404 Not Found](https://platform.claude.com/docs/en/manage-claude/compliance-errors#404-not-found) covers four cases that the response does not distinguish:
+
+* The session is not in an organization your key can read (including sessions under another parent organization).
+* The session does not exist.
+* Zero data retention is in effect for the session.
+* Every call in the session has aged past retention.
 
 `product_surface` (string or `null`) tells you which product the session came from. It is `null` if the product was not recorded. Otherwise, it is one of these values:
 
@@ -164,7 +176,7 @@ curl --fail-with-body -sS \
   -H "anthropic-version: 2023-06-01"
 ```
 
-```text Response
+```json Response
 {
   "session": {
     "type": "compliance_local_session",
@@ -285,7 +297,7 @@ On a very large session, the messages endpoint can return a 400 for a page, with
 
 On a very large session, the messages endpoint might also return a 429 whose `error.details.error_code` is `transcript_read_server_busy`. It does not mean that your organization exceeded a rate limit. Unlike the 400, retry it: wait the number of seconds in the `retry-after` header, then send the same request again, unchanged (with the same `page` value, if it had one). See [Server busy reading large transcripts](https://platform.claude.com/docs/en/manage-claude/compliance-errors#server-busy-reading-large-transcripts).
 
-Each message carries a `role` (`user` or `assistant`) and a `content` array of `text`, `tool_use`, and `tool_result` blocks. It also carries a `model`: on an assistant turn captured from the Claude API this is the model that served the turn, and it is `null` on user messages and on any assistant message whose `provenance` is set, because client-asserted history and synthetic markers were not produced by a model and the serving model is unknown for unavailable content. A `text` block carries `text` and `truncated`. A `tool_use` block carries `id`, `name`, `input`, and `truncated`, where `input` is a JSON-encoded string rather than an object. A `tool_result` block carries `tool_use_id`, `name`, `is_error`, a `content` array of `text` entries, and `truncated`. MCP tool calls and results, and most server tool calls and results, are normalized into these same `tool_use` and `tool_result` shapes; any other block type appears as a `[<block type> content not shown]` placeholder. A message `id` is stable while the turn is retained. Every message reconstructed from the same inference call carries that call's timestamp, so consecutive messages often share a `created_at` value; preserve the returned order rather than re-sorting by timestamp.
+Each message carries a `role` (`user` or `assistant`) and a `content` array of `text`, `tool_use`, and `tool_result` blocks. It also carries a `model`: on an assistant turn captured from the Claude API, this is the model that served the turn. The `model` is `null` on user messages and on any assistant message whose `provenance` is set, because client-asserted history and synthetic markers were not produced by a model and the serving model is unknown for unavailable content. A `text` block carries `text` and `truncated`. A `tool_use` block carries `id`, `name`, `input`, and `truncated`, where `input` is a JSON-encoded string rather than an object. A `tool_result` block carries `tool_use_id`, `name`, `is_error`, a `content` array of `text` entries, and `truncated`. MCP tool calls and results, and most server tool calls and results, are normalized into these same `tool_use` and `tool_result` shapes; any other block type appears as a `[<block type> content not shown]` placeholder. A message `id` is stable while the turn is retained. Every message reconstructed from the same inference call carries that call's timestamp, so consecutive messages often share a `created_at` value; preserve the returned order rather than re-sorting by timestamp.
 
 Each message also carries a `provenance` field describing how its content was captured. `provenance` is `null` for verified content captured by the Claude API, which is the common case. Otherwise it is an object whose `type` marks the exception:
 
@@ -316,14 +328,14 @@ curl --fail-with-body -sS -G \
   --data-urlencode "limit=100"
 ```
 
-```text Response wrap
+```json Response
 {
   "data": [
     {
       "id": "cse_01WpQrStUvXyZaBcDeFgHjK6",
       "organization_uuid": "91012d09-e48b-438e-a489-1bebfd8fa6f9",
       "user": {
-        "id": "user_01XyDMpzjS89pFZXqSFUBDr6",
+        "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
         "email_address": "user@example.com"
       },
       "agent_id": null,
@@ -340,7 +352,7 @@ curl --fail-with-body -sS -G \
       "user": null,
       "agent_id": "cagt_01MnPqRsTuVwXyZaBcDeFgH8",
       "started_by_user": {
-        "id": "user_01XyDMpzjS89pFZXqSFUBDr6",
+        "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
         "email_address": "user@example.com"
       },
       "status": "archived",
@@ -381,13 +393,13 @@ curl --fail-with-body -sS \
   -H "anthropic-version: 2023-06-01"
 ```
 
-```text Response
+```json Response
 {
   "session": {
     "id": "cse_01WpQrStUvXyZaBcDeFgHjK6",
     "organization_uuid": "91012d09-e48b-438e-a489-1bebfd8fa6f9",
     "user": {
-      "id": "user_01XyDMpzjS89pFZXqSFUBDr6",
+      "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
       "email_address": null
     },
     "agent_id": null,
diff --git a/content/en/manage-claude/data-residency.md b/content/en/manage-claude/data-residency.md
index 35bd7c3e9f..fbb84b49fd 100644
--- a/content/en/manage-claude/data-residency.md
+++ b/content/en/manage-claude/data-residency.md
@@ -208,7 +208,7 @@ The `inference_geo` parameter controls where model inference runs for a specific
 
 The response `usage` object includes an `inference_geo` field indicating where inference ran:
 
-```text Output wrap
+```json Output
 {
   "usage": {
     "input_tokens": 25,
diff --git a/content/en/manage-claude/inference-hooks-configuration.md b/content/en/manage-claude/inference-hooks-configuration.md
index 9daf8e55e7..281376ad14 100644
--- a/content/en/manage-claude/inference-hooks-configuration.md
+++ b/content/en/manage-claude/inference-hooks-configuration.md
@@ -19,7 +19,13 @@ You need:
 
 ## Set up Inference hooks
 
-There are three enforcement states: **off** (**Enforce verdicts** is off: your AI security server is never contacted and prompts are not inspected), **shadow** (**Enforce verdicts** is on with **Mode** set to **Shadow mode**: your AI security server receives prompts and returns verdicts, and nothing is blocked), and **enforcing** (**Enforce verdicts** is on with **Mode** set to **Allow the request** or **Block the request**: a deny blocks the request). The following steps take a new configuration from off to enforcing.
+There are three enforcement states:
+
+* **Off:** With **Enforce verdicts** off, your AI security server is never contacted and prompts are not inspected.
+* **Shadow:** With **Enforce verdicts** on and **Mode** set to **Shadow mode**, your AI security server receives prompts and returns verdicts, and nothing is blocked.
+* **Enforcing:** With **Enforce verdicts** on and **Mode** set to **Allow the request** or **Block the request**, a deny blocks the request.
+
+The following steps take a new configuration from off to enforcing.
 
 <Steps>
   <Step title="Allow Inference hooks for your organization">
diff --git a/content/en/manage-claude/inference-hooks-endpoint.md b/content/en/manage-claude/inference-hooks-endpoint.md
index 06f347c4ae..9308aeb2d8 100644
--- a/content/en/manage-claude/inference-hooks-endpoint.md
+++ b/content/en/manage-claude/inference-hooks-endpoint.md
@@ -14,7 +14,7 @@ To turn Inference hooks on and point them at your endpoint, see [Configure Infer
 
 ## Get a first verdict round trip
 
-The smallest working integration is a server that reads each request and allows it. Run one of the following servers, expose it at a public `https://` URL (for example, behind a TLS-terminating reverse proxy on a host you control, not a reverse-tunnel service; see [Receive a request](https://platform.claude.com/docs/en/manage-claude/inference-hooks-endpoint#receive-a-request)), then have your administrator [set it as the endpoint and test the connection](https://platform.claude.com/docs/en/manage-claude/inference-hooks-configuration): the **Test connection** result reports the allow verdict your server returned.
+The smallest working integration is a server that reads each request and allows it. Run one of the following servers and expose it at a public `https://` URL. For example, put it behind a TLS-terminating reverse proxy on a host you control, not a reverse-tunnel service (see [Receive a request](https://platform.claude.com/docs/en/manage-claude/inference-hooks-endpoint#receive-a-request)). Then have your administrator [set it as the endpoint and test the connection](https://platform.claude.com/docs/en/manage-claude/inference-hooks-configuration). The **Test connection** result reports the allow verdict your server returned.
 
 <CodeGroup exclude="shell">
   ```python Python
@@ -148,7 +148,7 @@ The smallest working integration is a server that reads each request and allows
 
 Anthropic sends an HTTPS `POST` to the URL your administrator configures. The whole configured URL is the endpoint: there is no fixed path suffix, so choose any path that suits your server.
 
-Host your AI security server where Anthropic can reach it: an `https://` URL on port 443, on a publicly routable host (private, loopback, and carrier-grade NAT ranges are refused at connect time), with a certificate that validates against the public CA trust store, responding without redirects. The host must have an IPv4 address, which Anthropic uses even when the host also has IPv6 addresses; a URL whose host is `localhost` or an IPv6 address is refused. The configured URL must be the final destination. Reverse-tunnel hosts (ngrok and similar tunnel services) are not supported: Anthropic's network policy blocks them. Host your server on a domain you control. [Configure Inference hooks](https://platform.claude.com/docs/en/manage-claude/inference-hooks-configuration) covers how your administrator sets and tests the URL.
+Host your AI security server where Anthropic can reach it: an `https://` URL on port 443, on a publicly routable host. Private, loopback, and carrier-grade NAT ranges are refused at connect time. The server must have a certificate that validates against the public CA trust store, and it must respond without redirects. The host must have an IPv4 address, which Anthropic uses even when the host also has IPv6 addresses; a URL whose host is `localhost` or an IPv6 address is refused. The configured URL must be the final destination. Reverse-tunnel hosts (ngrok and similar tunnel services) are not supported: Anthropic's network policy blocks them. Host your server on a domain you control. [Configure Inference hooks](https://platform.claude.com/docs/en/manage-claude/inference-hooks-configuration) covers how your administrator sets and tests the URL.
 
 Every request carries these fixed headers, along with any [custom request headers](https://platform.claude.com/docs/en/manage-claude/inference-hooks-configuration) your administrator configured and, once your organization has a signing secret, the `webhook-*` signature headers described in [Verify the signature](https://platform.claude.com/docs/en/manage-claude/inference-hooks-endpoint#verify-the-signature):
 
diff --git a/content/en/manage-claude/inference-hooks.md b/content/en/manage-claude/inference-hooks.md
index 8f79f639e0..33fe1a48b6 100644
--- a/content/en/manage-claude/inference-hooks.md
+++ b/content/en/manage-claude/inference-hooks.md
@@ -81,7 +81,17 @@ One hook governs conversations across all Claude products in your Claude Enterpr
 
 Governed requests are the inference requests behind the user's conversation or session. System prompts and tool definitions are never included in what is sent. In voice mode, prompts and tool calls are sent to your endpoint too, though a small share of tool calls isn't, so don't rely on Inference hooks as your only control for voice. If your endpoint denies a request in voice mode, the voice call usually ends with a general error message, and your deny reason isn't shown.
 
-With **Validate tool calls** on, `tool_call` events may leave out calls to some of claude.ai's own tools, such as tools that list, search for, or suggest connectors, plugins, or skills, suggest starting research or turning on web search, search for other tools, switch to a larger model, end the chat, give Claude the user's local time, or read the user's own past chats and saved memory. These calls and their results stay in the conversation, so the next `prompt` event from that conversation, if there is one, includes them.
+With **Validate tool calls** on, `tool_call` events might leave out calls to some of claude.ai's own tools, such as tools that do the following:
+
+* List, search for, or suggest connectors, plugins, or skills
+* Suggest starting research or turning on web search
+* Search for other tools
+* Switch to a larger model
+* End the chat
+* Give Claude the user's local time
+* Read the user's own past chats and saved memory
+
+These calls and their results stay in the conversation, so the next `prompt` event from that conversation, if there is one, includes them.
 
 Some features that Anthropic runs for your organization make model calls of their own. Your organization sees the results of those calls but not their transcripts. These calls aren't governed requests and aren't sent to your endpoint. They include the following:
 
diff --git a/content/en/manage-claude/opentelemetry.md b/content/en/manage-claude/opentelemetry.md
index 787a6deac4..a9cd4527dd 100644
--- a/content/en/manage-claude/opentelemetry.md
+++ b/content/en/manage-claude/opentelemetry.md
@@ -121,7 +121,7 @@ Send traces to any observability platform that accepts OTLP, including these par
   </Card>
 
   <Card title="Snowflake" image="https://platform.claude.com/docs/images/partner-logos/snowflake.svg" imageHeight={30} imageOffsetLeft={2} href="https://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-ai-gateway/observability#trace-claude-requests">
-    AI Data Cloud.
+    Agentic control plane with built-in observability and governance.
   </Card>
 
   <Card title="Splunk" image="https://platform.claude.com/docs/images/partner-logos/splunk.svg" imageDark="https://platform.claude.com/docs/images/partner-logos/splunk-dark.svg" imageHeight={27} imageOffsetLeft={1} href="https://agent-observability-docs.splunk.com/sdk-api/third-party-integrations/claude">
diff --git a/content/en/manage-claude/organization-webhooks.md b/content/en/manage-claude/organization-webhooks.md
index e7573e6ab1..6ca174913d 100644
--- a/content/en/manage-claude/organization-webhooks.md
+++ b/content/en/manage-claude/organization-webhooks.md
@@ -85,7 +85,7 @@ An organization webhook endpoint has these fields:
 | `updated_at`      | string           | When the endpoint last changed. Set by Anthropic.                                                                                                                                         |
 | `signing_secret`  | string           | A `whsec_`-prefixed secret, created with the endpoint. Only the responses that create the endpoint or replace the secret include it, so store it securely.                                |
 
-```text wrap
+```json
 {
   "id": "wep_011CZkZDf8HnUq2mTxRbVn4s",
   "url": "https://example.com/anthropic-webhooks",
@@ -232,7 +232,7 @@ Send the `anthropic-beta: webhooks-2026-10-07` header with every request. The SD
 
 With no endpoints, the API returns an empty list:
 
-```text wrap
+```json
 {
   "data": [],
   "has_more": false
diff --git a/content/en/manage-claude/plugins-api.md b/content/en/manage-claude/plugins-api.md
index ce78098823..b88fddce4f 100644
--- a/content/en/manage-claude/plugins-api.md
+++ b/content/en/manage-claude/plugins-api.md
@@ -4,7 +4,14 @@ url: https://platform.claude.com/docs/en/manage-claude/plugins-api
 description: "Inventory and manage the plugins in your Claude Enterprise organization: upload plugins and versions, choose the version members are served, control who can use each plugin, download plugin files for review, and validate a marketplace before you connect it."
 ---
 
-The Plugins API lets you inventory every plugin in your Claude Enterprise organization, publish plugins and new versions from your own pipelines, choose which version members are served, control who can use each plugin, download plugin files for review, and check a Git marketplace before you connect it.
+The Plugins API lets you do the following:
+
+* Inventory every plugin in your Claude Enterprise organization
+* Publish plugins and new versions from your own pipelines
+* Choose which version members are served
+* Control who can use each plugin
+* Download plugin files for review
+* Check a Git marketplace before you connect it
 
 For plugin *usage* reporting (which plugins and skills members use, and how often), see [Analytics APIs](https://platform.claude.com/docs/en/manage-claude/analytics-api).
 
@@ -40,7 +47,7 @@ This release does not include standalone skills (skills a member writes in the s
 * Your primary owner creates an Admin API key with the `read:plugins` scope, the `write:plugins` scope, or both in [claude.ai > Organization settings > API](https://claude.ai/admin-settings/api-access). See [Create a key for a Claude Enterprise organization](https://platform.claude.com/docs/en/manage-claude/admin-api-keys#create-a-key-for-a-claude-enterprise-organization).
 * Every request carries three headers: `x-api-key`, `anthropic-version: 2023-06-01`, and `anthropic-beta: ce-plugins-2026-09-01`.
 
-In Python, TypeScript, C#, Go, Java, PHP, and Ruby, the SDK exposes these endpoints under `client.beta.organization` (csharp, go: `client.Beta.Organization`; java: `client.beta().organization()`; php: `$client->beta->organization`), and the [`ant` CLI](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/quickstart) under `ant beta:organization`; they send the `anthropic-version` and `anthropic-beta` headers for you. The examples on this page use the SDK's default client, which, like the CLI, reads the Admin API key from the `ANTHROPIC_API_KEY` environment variable; the curl examples read the key from the same variable and pass it in the `x-api-key` header. Where an SDK or the CLI fetches more pages for you, `limit` sets the page size, not the total (see [Pagination](https://platform.claude.com/docs/en/manage-claude/plugins-api#pagination)).
+In Python, TypeScript, C#, Go, Java, PHP, and Ruby, the SDK exposes these endpoints under `client.beta.organization` (csharp, go: `client.Beta.Organization`; java: `client.beta().organization()`; php: `$client->beta->organization`), and the [`ant` CLI](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/quickstart) under `ant beta:organization`; they send the `anthropic-version` and `anthropic-beta` headers for you. The examples on this page read the Admin API key from the `ANTHROPIC_API_KEY` environment variable. Where an SDK or the CLI fetches more pages for you, `limit` sets the page size, not the total (see [Pagination](https://platform.claude.com/docs/en/manage-claude/plugins-api#pagination)).
 
 API keys belong to the organization and keep working after the person who created them leaves. Do not share them or check them into source control.
 
@@ -161,7 +168,7 @@ List the plugins in your organization's own marketplaces, newest first:
   ```
 </CodeGroup>
 
-```text
+```json
 {
   "data": [
     {
@@ -216,7 +223,7 @@ Each of these read scopes (`read:plugins`, `read:org_audit`, and `read:complianc
 
 ### Reading another organization under the same parent
 
-`read:plugins` and `write:plugins` keys read and write only the organization they were created in. If your company has several Claude organizations linked under one parent organization, a `read:org_audit` or `read:compliance_org_data` key that the parent's primary owner created for all linked organizations (see [Create a key for a Claude Enterprise organization](https://platform.claude.com/docs/en/manage-claude/admin-api-keys#create-a-key-for-a-claude-enterprise-organization)) can also read any of them that has access to this API: pass that organization's ID in the `organization_id` query parameter on any `GET` endpoint on this page. The ID is the organization UUID shown in claude.ai's settings (its `org_`-prefixed form is accepted too). Without the parameter, the key reads the organization it was created in. A `404` means the named organization is not under the key's parent or the API is not available to it; a value that is not a UUID or `org_` ID returns `400`. Any other key that names an organization other than its own gets `404`. Writes do not accept `organization_id`.
+`read:plugins` and `write:plugins` keys read and write only the organization they were created in. If your company has several Claude organizations linked under one parent organization, the parent's primary owner can create a `read:org_audit` or `read:compliance_org_data` key for all linked organizations (see [Create a key for a Claude Enterprise organization](https://platform.claude.com/docs/en/manage-claude/admin-api-keys#create-a-key-for-a-claude-enterprise-organization)). That key can also read any linked organization that has access to this API. To read one, pass its ID in the `organization_id` query parameter on any `GET` endpoint on this page. The ID is the organization UUID shown in claude.ai's settings (its `org_`-prefixed form is accepted too). Without the parameter, the key reads the organization it was created in. A `404` means the named organization is not under the key's parent or the API is not available to it; a value that is not a UUID or `org_` ID returns `400`. Any other key that names an organization other than its own gets `404`. Writes do not accept `organization_id`.
 
 ## Key concepts
 
@@ -264,7 +271,7 @@ By default `served_version_pinned` is `false`: the served version normally follo
 
 Choosing a version with `POST /v1/organizations/plugins/{plugin_id}` **pins** the plugin (`served_version_pinned: true`). So does an administrator choosing a version in claude.ai, or accepting a member's request to publish into the plugin. From then on, new uploads are stored and advance `latest_version_id`, but members keep the pinned version until you point `served_version_id` at another one. A plugin whose two pointers differ has a stored version that is not being served.
 
-This lets a release pipeline upload each build, test it, and then promote it. To have your pipeline determine when each build is served, pin the plugin once by setting `served_version_id` to its current version; from then on, promote each build you want served. With content scanning on, that first pin returns `409 scan_pending` until the current version's scan completes, and `400 scan_failed` if the scan reads `fail` or `unknown`, or errored (`warn` is accepted). A pinned plugin cannot currently be unpinned, here or in claude.ai.
+This lets a release pipeline upload each build, test it, and then promote it. To have your pipeline determine when each build is served, pin the plugin once by setting `served_version_id` to its current version; from then on, promote each build you want served. With content scanning on, that first pin returns `409 scan_pending` while the current version's `content_scan` reads `processing`, and `400 scan_failed` if the scan reads `fail`, `unknown`, or `errored` (`warn` is accepted). A pinned plugin cannot be unpinned, here or in claude.ai.
 
 To roll back, set `served_version_id` to an earlier version. Roll forward the same way.
 
@@ -307,11 +314,11 @@ A version you upload through this API never waits for its content scan. When it
 
 While a version saved in claude.ai waits for its scan, the served version does not change. When your API upload becomes the served version, any wait ends: the waiting version is served only if someone chooses it. To see a waiting version's scan, read the version (see [List a plugin's versions](https://platform.claude.com/docs/en/manage-claude/plugins-api#list-a-plugins-versions)).
 
-After an upload, `content_scan.status` is `processing` and the verdict arrives asynchronously. Read the version to see it; the plugin object shows only its served version's scan. While scanning is on, changing the served version to a version whose scan is still running returns `409 scan_pending`, and changing it to one whose scan reads `fail` or `unknown`, or errored, returns `400 scan_failed`.
+After an upload, `content_scan.status` is `processing` and the verdict arrives asynchronously. Read the version to see it; the plugin object shows only its served version's scan. While scanning is on, changing the served version to a version whose `content_scan` reads `processing` returns `409 scan_pending`, and changing it to one whose scan reads `fail`, `unknown`, or `errored` returns `400 scan_failed`.
 
-#### Failed scans an administrator allowed
+#### Failed scans allowed in claude.ai
 
-In claude.ai, an administrator can allow a version whose scan failed. This API can then report that scan as `completed` with `warn` and the failed scan's `reason`. While it does, the rules for `warn` apply: the version can be served to members, and you can make it the served version. Nothing in the response shows that it was allowed, so a `warn` is either a warning or a failed scan that an administrator allowed. Allowing a version whose scan reads `warn` does not change its `content_scan`. When a version stops being allowed, this API reports the verdict of its newest completed scan, and a served version whose scan reads `fail` or `unknown` is withheld from members.
+In claude.ai, organization owners can allow a version whose scan failed. So can members whose [custom role](https://platform.claude.com/docs/en/manage-claude/user-management#custom-roles) can manage **Libraries**. This API can then report that scan as `completed` with `warn` and the failed scan's `reason`. While it does, the rules for `warn` apply: the version can be served to members, and you can make it the served version. Nothing in the response shows that it was allowed, so a `warn` is either a warning or a failed scan that was allowed. Allowing a version whose scan reads `warn` does not change its `content_scan`. When a version stops being allowed, this API reports the verdict of its newest completed scan. A served version whose scan then reads `fail` or `unknown` is withheld from members.
 
 ### Reach
 
@@ -500,7 +507,7 @@ Upload every tagged build from CI, and let the pipeline determine when a build i
 Run a nightly job that flags plugins that reach outside the member's session or whose content scan reads `warn`, `fail`, or `unknown`.
 
 1. Page through [`GET /v1/organizations/plugins?limit=100`](https://platform.claude.com/docs/en/manage-claude/plugins-api#list-plugins) until `next_page` is `null` (see [Pagination](https://platform.claude.com/docs/en/manage-claude/plugins-api#pagination)). Read each plugin's `reach` and `content_scan` from that list on every run: a change to `content_scan` alone, such as a verdict that arrives later, does not move `updated_at`. `updated_at` normally tells you which plugins have new content or a new served version since the last run (worth a fresh archive download). A waiting version (see [Versions and the served version](https://platform.claude.com/docs/en/manage-claude/plugins-api#versions-and-the-served-version)) moves `updated_at` when it becomes the served version, not necessarily when it is stored. To notice one, compare `latest_version_id` with the value from your last run. The full re-list is also what catches removals, because a plugin removed by a Git synchronization or an account deletion disappears without an event.
-2. Flag each plugin whose `reach` is `remote` (it declares an MCP server or a CLI), or whose `content_scan.assessment` is `warn`, `fail`, or `unknown`. A `warn` can also be a failed scan that an administrator allowed (see [Failed scans an administrator allowed](https://platform.claude.com/docs/en/manage-claude/plugins-api#failed-scans-an-administrator-allowed)); leave `warn` out only if you accept every failed scan that an administrator allows. These fields describe the served version. To also check a newer version that is not served, list the plugin's versions when `latest_version_id` differs from `served_version_id` (see [List a plugin's versions](https://platform.claude.com/docs/en/manage-claude/plugins-api#list-a-plugins-versions)).
+2. Flag each plugin whose `reach` is `remote` (it declares an MCP server or a CLI), or whose `content_scan.assessment` is `warn`, `fail`, or `unknown`. A `warn` can also be a [failed scan that was allowed in claude.ai](https://platform.claude.com/docs/en/manage-claude/plugins-api#failed-scans-allowed-in-claude-ai). Leave `warn` out only if you accept every failed scan that is allowed there. These fields describe the served version. To also check a newer version that is not served, list the plugin's versions when `latest_version_id` differs from `served_version_id` (see [List a plugin's versions](https://platform.claude.com/docs/en/manage-claude/plugins-api#list-a-plugins-versions)).
 3. For each flagged plugin, download the served version's archive for review with `GET /v1/organizations/plugins/{plugin_id}/versions/{served_version_id}/content` (see [Download a version's files](https://platform.claude.com/docs/en/manage-claude/plugins-api#download-a-versions-files)). Also download any unserved version that meets step 2's test, by its ID.
 4. To take a plugin away from members while you review it, see [Delete a plugin](https://platform.claude.com/docs/en/manage-claude/plugins-api#delete-a-plugin) for the reversible (organization-owned) and permanent options.
 
@@ -526,11 +533,11 @@ The plugin object describes a plugin in one of your organization's marketplaces
 
 The `content_scan` object:
 
-| Field        | Description                                                                                                                                                                                                                                                                                                                                                                                          |
-| ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `status`     | `processing` while the scan runs, `completed` when it finished, or `errored` when it could not finish (or, occasionally, when its result could not be read for this response, in which case a later read may report it). Members are not served a version whose scan is `processing` or `errored`; uploading the content again as a new version gets a fresh scan.                                   |
-| `assessment` | Set when `status` is `completed`: `pass` (nothing found), `warn` (something found that does not block use, or a failed scan that an administrator allowed; see [Failed scans an administrator allowed](https://platform.claude.com/docs/en/manage-claude/plugins-api#failed-scans-an-administrator-allowed)), `fail` (something found that blocks use), or `unknown` (no verdict). Otherwise `null`. |
-| `reason`     | For `warn` and `fail`, the main concern, from the following list. Otherwise `null`, and also `null` on an older scan that predates reason recording.                                                                                                                                                                                                                                                 |
+| Field        | Description                                                                                                                                                                                                                                                                                                                                                                                                              |
+| ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `status`     | `processing` while the scan runs, `completed` when it finished, or `errored` when it could not finish (or, occasionally, when its result could not be read for this response, in which case a later read might report it). The newest completed scan, if any, is reported. Members are not served a version whose `status` is `processing` or `errored`; uploading the content again as a new version gets a fresh scan. |
+| `assessment` | Set when `status` is `completed`: `pass` (nothing found), `warn` (something found that does not block use, or a [failed scan that was allowed in claude.ai](https://platform.claude.com/docs/en/manage-claude/plugins-api#failed-scans-allowed-in-claude-ai)), `fail` (something found that blocks use), or `unknown` (no verdict). Otherwise `null`.                                                                    |
+| `reason`     | For `warn` and `fail`, the main concern, from the following list. Otherwise `null`, and also `null` on an older scan that predates reason recording.                                                                                                                                                                                                                                                                     |
 
 <Accordion title="Content scan reason values">
   | `reason`                          | Meaning                                                                                                                       |
@@ -809,7 +816,7 @@ Upload an archive:
   ```
 </CodeGroup>
 
-```text
+```json
 {
   "type": "plugin",
   "id": "plugin_01Hq3vX8kZcN2mB7pR4tY9wL",
@@ -1141,7 +1148,7 @@ Besides a `400` for an upload that breaks the [upload requirements](https://plat
 
 ### Change the served version
 
-`POST /v1/organizations/plugins/{plugin_id}` changes which version of an organization-owned plugin members are served. Pass an earlier version to roll back, or a newer one to promote a build that was stored without being served. This pins the plugin, and a pinned plugin cannot currently be unpinned, here or in claude.ai (see [Versions and the served version](https://platform.claude.com/docs/en/manage-claude/plugins-api#versions-and-the-served-version)). The only updatable field is `served_version_id`, and it is required. The change reaches members before the response returns and does not create a version. When content scanning is on, the version must be one members can be served (see [Content scanning](https://platform.claude.com/docs/en/manage-claude/plugins-api#content-scanning)). Passing the version already served on a pinned plugin changes nothing; passing it on an unpinned plugin pins it there, so later uploads stop being served automatically. Pinning also ends any wait: a version that was waiting for its content scan stays stored, and is served only if someone chooses it. Returns the plugin. Requires the `write:plugins` scope.
+`POST /v1/organizations/plugins/{plugin_id}` changes which version of an organization-owned plugin members are served. Pass an earlier version to roll back, or a newer one to promote a build that was stored without being served. This pins the plugin, and a pinned plugin cannot be unpinned, here or in claude.ai (see [Versions and the served version](https://platform.claude.com/docs/en/manage-claude/plugins-api#versions-and-the-served-version)). The only updatable field is `served_version_id`, and it is required. The change reaches members before the response returns and does not create a version. When content scanning is on, the version must be one members can be served (see [Content scanning](https://platform.claude.com/docs/en/manage-claude/plugins-api#content-scanning)). Passing the version already served on a pinned plugin changes nothing; passing it on an unpinned plugin pins it there, so later uploads stop being served automatically. Pinning also ends any wait: a version that was waiting for its content scan stays stored, and is served only if someone chooses it. Returns the plugin. Requires the `write:plugins` scope.
 
 <CodeGroup>
   ```bash cURL
@@ -1256,7 +1263,7 @@ Besides a `400` for an upload that breaks the [upload requirements](https://plat
   ```
 </CodeGroup>
 
-```text
+```json
 {
   "type": "plugin",
   "id": "plugin_01Hq3vX8kZcN2mB7pR4tY9wL",
@@ -1393,7 +1400,7 @@ Deletion cannot be undone, and there is no per-version delete. To withhold an or
   ```
 </CodeGroup>
 
-```text wrap
+```json
 { "type": "plugin_deleted", "id": "plugin_01Hq3vX8kZcN2mB7pR4tY9wL" }
 ```
 
@@ -1675,7 +1682,7 @@ A `{version}` that lacks the `pluginver_` prefix returns `400` (except the liter
   ```
 </CodeGroup>
 
-```text
+```json
 {
   "type": "plugin_version",
   "id": "pluginver_01Jd5sK2nQ8wE4rT6yU1iO3p",
@@ -2218,7 +2225,7 @@ Send a plugin's installation-setting writes one at a time. If several writes for
   ```
 </CodeGroup>
 
-```text
+```json
 {
   "type": "plugin_installation_setting",
   "plugin_id": "plugin_01Hq3vX8kZcN2mB7pR4tY9wL",
@@ -2338,7 +2345,7 @@ Send a plugin's installation-setting writes one at a time. If several writes for
   ```
 </CodeGroup>
 
-```text
+```json
 {
   "type": "plugin_installation_setting_deleted",
   "plugin_id": "plugin_01Hq3vX8kZcN2mB7pR4tY9wL",
@@ -2454,7 +2461,7 @@ Shares exist only on member-owned plugins and are read-only in this API (see [Sh
   ```
 </CodeGroup>
 
-```text
+```json
 {
   "data": [
     {
@@ -2472,7 +2479,7 @@ Shares exist only on member-owned plugins and are read-only in this API (see [Sh
 
 This API reads [marketplaces](https://platform.claude.com/docs/en/manage-claude/plugins-api#marketplaces) and sets an organization marketplace's default installation setting; marketplaces themselves are created, connected to a repository, and deleted in claude.ai.
 
-```text wrap
+```json
 {
   "type": "plugin_marketplace",
   "id": "marketplace_01VbNcMxZaSdFgHjKlQwErTy",
@@ -2844,9 +2851,17 @@ A `marketplace_id` that lacks the `marketplace_` prefix returns `400`. One that
 
 Two endpoints report what a synchronization of the given marketplace content would do, without connecting or storing anything: `POST /v1/organizations/plugin_marketplaces/validate_repository` reads a public GitHub repository, and `POST /v1/organizations/plugin_marketplaces/validate_archive` reads a `.zip` of the marketplace directory that you upload. Both return the same report: whether `marketplace.json` is well-formed, which plugins would be skipped and why, and which plugins would synchronize with some contents left out. The checks are the ones a real synchronization runs. Problems with the content come back in the report, not as HTTP errors: the request succeeds with `valid: false`, even when the repository or archive cannot be read at all. A validation counts as a read, and the two endpoints together are additionally limited to 10 validations a minute for each organization (see [Rate limiting](https://platform.claude.com/docs/en/manage-claude/plugins-api#rate-limiting)); they record nothing on the Activity Feed. A validation can take up to 120 seconds before it returns, so set your client's timeout above that. Both endpoints require the `read:plugins` or `write:plugins` scope (`read:org_audit` and `read:compliance_org_data` do not grant them).
 
-The repository, and any plugin source outside it on GitHub, are read anonymously, so a private repository or private plugin source is reported as not found. Plugin sources on hosts other than GitHub are not fetched; such a plugin normally gets a `marketplace_validate_source_not_checked` warning and is checked when the marketplace actually synchronizes. If the repository is, or the archive names, a marketplace that Anthropic synchronizes into every organization, stricter rules apply: every plugin source outside the marketplace must be pinned to a full commit SHA, unpinned or unsupported-host sources are reported as plugin errors, and the branch read defaults to the one that marketplace synchronizes from.
+Validation reads the repository anonymously. It does the same for any plugin source that is on GitHub but outside the repository. As a result, validation reports a private repository or a private plugin source as not found or as needing a GitHub sign-in. When validation reports that a GitHub sign-in is needed, the report code is `marketplace_repo_sign_in_required`.
+
+Validation does not fetch plugin sources on hosts other than GitHub. A plugin with such a source normally gets a `marketplace_validate_source_not_checked` warning and is checked when the marketplace actually synchronizes.
+
+Validation applies stricter rules to a marketplace that Anthropic synchronizes into every organization. `validate_repository` applies them when the repository is such a marketplace. `validate_archive` applies them when the archive names such a marketplace. The stricter rules are as follows:
+
+* Every plugin source outside the marketplace must be pinned to a full commit SHA.
+* Validation reports unpinned sources and sources on unsupported hosts as plugin errors.
+* For `validate_repository`, the branch that validation reads defaults to the branch that the marketplace synchronizes from.
 
-`validate_repository` takes a JSON body with two fields: `repository_url`, the `https://` URL of a public repository on github.com (required), and `ref`, a branch name or a full 40-character commit SHA (optional). When `ref` is omitted or `null`, it defaults to the branch a synchronization would read, usually the repository's default branch. `validate_archive` takes `multipart/form-data` with exactly one part, `archive`, sent as a file part with a file name: a `.zip` of the marketplace directory, at most 32 MB, with its contents at the root or wrapped in one folder (as a Git host's download produces), DEFLATE or STORE compression only. No other form field is accepted.
+`validate_repository` takes a JSON body with two fields: `repository_url`, the `https://` URL of a public repository on github.com (required), and `ref`, a branch name or a full 40-character commit SHA (optional). When `ref` is omitted or `null`, it defaults to the branch a synchronization would read, usually the repository's default branch. `validate_archive` takes `multipart/form-data` with exactly one part, `archive`, sent as a file part with a file name. The file is a `.zip` of the marketplace directory, at most 32 MB, that uses DEFLATE or STORE compression only. The archive's contents sit at the root or are wrapped in one folder (as a Git host's download produces). No other form field is accepted.
 
 Validate a public repository at a branch:
 
@@ -2965,7 +2980,7 @@ Validate a public repository at a branch:
   ```
 </CodeGroup>
 
-```text wrap
+```json
 {
   "type": "plugin_marketplace_validation_report",
   "valid": false,
@@ -3139,7 +3154,7 @@ Every string value on this page (component types, `reach`, scan fields, marketpl
 
 ## Rate limiting
 
-Read requests (every `GET` endpoint on this page) share a limit of **300 requests per minute** for each organization, and write requests (creating a plugin or version, changing the served version, deleting, setting or removing an installation setting, and updating a marketplace) share a limit of **60 requests per minute** for each organization. A marketplace validation (either endpoint) counts as a read, and validations are additionally limited to 10 a minute for each organization across both endpoints; both limits are checked before the request body is read. These limits are counted across all of your organization's keys and are separate from your organization's other Admin API limits. Requests over a limit return **429 Too Many Requests** with a `retry-after` header. Responses include `anthropic-ratelimit-requests-*` headers for the limit that applies (on marketplace validation, its 10-per-minute limit; on a `429`, whichever limit refused the request).
+Read requests (every `GET` endpoint on this page) share a limit of **300 requests per minute** for each organization. Write requests (creating a plugin or version, changing the served version, deleting, setting or removing an installation setting, and updating a marketplace) share a limit of **60 requests per minute** for each organization. A marketplace validation (either endpoint) counts as a read, and validations are additionally limited to 10 a minute for each organization across both endpoints; both limits are checked before the request body is read. These limits are counted across all of your organization's keys and are separate from your organization's other Admin API limits. Requests over a limit return **429 Too Many Requests** with a `retry-after` header. Responses include `anthropic-ratelimit-requests-*` headers for the limit that applies (on marketplace validation, its 10-per-minute limit; on a `429`, whichever limit refused the request).
 
 An upload, a served-version change, or a validation can also return `429` with `retry-after` when the service briefly has no capacity for another one, and an upload returns `429` when your organization has exceeded its content-scan rate. Handle all of these the same way: wait for `retry-after`, then retry. Separately from these limits, send installation-setting writes for the same plugin one at a time: when several arrive at the same time, some can be answered with `503` and `x-should-retry: true`, and those are safe to send again after a second or two (see [Set an installation setting](https://platform.claude.com/docs/en/manage-claude/plugins-api#set-an-installation-setting)).
 
@@ -3159,7 +3174,7 @@ Error responses follow the standard shape documented in [Claude API errors](http
 | 401    | Missing `x-api-key` header, or the key is not recognized.                                                                                                                                                                                                                                                            |
 | 403    | The key is missing the required scope, or the request uploads to, changes the served version of, or sets the default for a member's plugin or personal marketplace. (Deleting a member's plugin is allowed.)                                                                                                         |
 | 404    | Resource not found. Also returned when the request omits the `anthropic-beta` value, or the API is not enabled for your organization, so that the endpoints read as nonexistent.                                                                                                                                     |
-| 409    | A name is taken, a content scan is still running, or a conflicting upload is in progress.                                                                                                                                                                                                                            |
+| 409    | A name is taken, a version's `content_scan` reads `processing`, or a conflicting upload is in progress.                                                                                                                                                                                                              |
 | 413    | The request body is over the size limit: 200 MB for an upload, 32 MB for marketplace validation.                                                                                                                                                                                                                     |
 | 429    | Rate limit exceeded. See [Rate limiting](https://platform.claude.com/docs/en/manage-claude/plugins-api#rate-limiting).                                                                                                                                                                                               |
 | 500    | Internal error.                                                                                                                                                                                                                                                                                                      |
@@ -3167,7 +3182,7 @@ Error responses follow the standard shape documented in [Claude API errors](http
 
 When one status has several causes that you would handle differently, the error also carries `error.details.error_code`, and `error.details.plugin_id` or `error.details.plugin_version_id` when the cause involves one:
 
-```text wrap
+```json
 {
   "type": "error",
   "error": {
@@ -3187,8 +3202,8 @@ When one status has several causes that you would handle differently, the error
 | `plugin_name_taken`                             | 409    | A plugin with this name already exists in the marketplace. `details.plugin_id` is that plugin, and someone else might have made it. To see who, [get the plugin](https://platform.claude.com/docs/en/manage-claude/plugins-api#get-a-plugin) and read its `created_by`, which is `null` when no creator is recorded. Upload versions to it only if it is the plugin you meant to update. Otherwise, upload under another name. When `plugin_id` is absent, the name is held by a standalone skill: upload under another name, or delete the skill in claude.ai. |
 | `skill_name_taken`                              | 409    | The plugin is in the library marketplace and one of its skills has the same name as an organization skill (a skill an administrator uploaded for the whole organization in claude.ai). `details.skill_name` names it. Rename or remove one of them.                                                                                                                                                                                                                                                                                                             |
 | `registration_pending`                          | 503    | The files were stored, but the plugin's skills could not yet be made available to members. See [Retrying uploads](https://platform.claude.com/docs/en/manage-claude/plugins-api#retrying-uploads).                                                                                                                                                                                                                                                                                                                                                              |
-| `scan_pending`                                  | 409    | The version's content scan is still running. Retry once it finishes.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| `scan_failed`                                   | 400    | The version's content scan reads `fail` or `unknown`, or errored, so it cannot be served. Choose another version.                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| `scan_pending`                                  | 409    | The version's `content_scan` reads `processing`. Retry once the scan finishes.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `scan_failed`                                   | 400    | The version's `content_scan` reads `fail`, `unknown`, or `errored`, so it cannot be served. Choose another version.                                                                                                                                                                                                                                                                                                                                                                                                                                             |
 | `cmek_key_disabled`, `cmek_key_network_blocked` | 400    | Your organization's customer-managed encryption key is unavailable. See [Customer-managed encryption keys](https://platform.claude.com/docs/en/manage-claude/plugins-api#customer-managed-encryption-keys).                                                                                                                                                                                                                                                                                                                                                     |
 | `unsupported_charset`                           | 400    | On an upload or `validate_archive`, the request's `Content-Type` header names a charset other than UTF-8, ISO-8859-1, or US-ASCII. Send the request with no charset, or with one of these.                                                                                                                                                                                                                                                                                                                                                                      |
 
@@ -3223,7 +3238,7 @@ Every write through this API is recorded on your organization's [Compliance API
 | `claude_plugin_archive_accessed`         | A member-owned plugin's archive is downloaded.                                                                                                                                      |
 | `claude_plugin_security_scan_completed`  | A content scan completes.                                                                                                                                                           |
 
-The plugin, version, and marketplace IDs in these events are the same IDs this API returns. `plugin_installation_preference_updated` identifies the plugin by its `name` and `marketplace_id` rather than its `id`.
+The plugin, version, and marketplace IDs in these events are the same IDs this API returns. `plugin_installation_preference_updated` identifies the plugin by its `name` and `marketplace_id` rather than its `id`. In `claude_plugin_security_scan_completed`, `plugin_version` is not a version ID, and no field of a [plugin version](https://platform.claude.com/docs/en/manage-claude/plugins-api#plugin-versions) corresponds to it.
 
 Changing a marketplace's default records one `marketplace_updated` event and no per-plugin events, even though it changes the value of every plugin that inherits the default. Reads are not recorded, except downloads of a member-owned plugin's archive. A write that changes nothing records nothing.
 
diff --git a/content/en/manage-claude/rate-limits-api.md b/content/en/manage-claude/rate-limits-api.md
index 18f25570a1..4310d03cf4 100644
--- a/content/en/manage-claude/rate-limits-api.md
+++ b/content/en/manage-claude/rate-limits-api.md
@@ -282,7 +282,7 @@ For complete parameter details and response schemas, see the [Organization Rate
   ```
 </CodeGroup>
 
-```text wrap
+```json
 {
   "data": [
     {
@@ -630,7 +630,7 @@ For complete parameter details and response schemas, see the [Workspace Rate Lim
   ```
 </CodeGroup>
 
-```text wrap
+```json
 {
   "data": [
     {
@@ -853,7 +853,7 @@ To read a workspace's applicable limits in one request, add the optional `includ
   ```
 </CodeGroup>
 
-```text wrap
+```json
 {
   "data": [
     {
diff --git a/content/en/manage-claude/spend-limits-api.md b/content/en/manage-claude/spend-limits-api.md
index 6eb1052526..e2286f62cd 100644
--- a/content/en/manage-claude/spend-limits-api.md
+++ b/content/en/manage-claude/spend-limits-api.md
@@ -372,7 +372,7 @@ For complete parameter details and response schemas, see [List effective spend l
   ```
 </CodeGroup>
 
-```text wrap
+```json
 {
   "data": [
     {
@@ -625,7 +625,7 @@ For complete parameter details and response schemas, see [Create a spend limit](
   ```
 </CodeGroup>
 
-```text wrap
+```json
 {
   "type": "spend_limit",
   "id": "spl_01RsTuVwXyZaBcDeFgHiJk",
diff --git a/content/en/manage-claude/user-management.md b/content/en/manage-claude/user-management.md
index 915b71dbe2..cbc34ea72c 100644
--- a/content/en/manage-claude/user-management.md
+++ b/content/en/manage-claude/user-management.md
@@ -4,7 +4,16 @@ url: https://platform.claude.com/docs/en/manage-claude/user-management
 description: "Manage the people in your Claude Enterprise organization with the Admin API: list members and change roles, send and withdraw invites, manage groups, and read custom roles."
 ---
 
-This page covers managing the people in your **Claude Enterprise** (claude.ai) organization programmatically, using the [Admin API](https://platform.claude.com/docs/en/api/beta/organization): list members and look them up by email address, change a member's role, remove members, send and withdraw invites, manage your enterprise's groups and their membership, and read your organization's custom roles. For Claude Console (Claude Platform) organizations, see the [Admin API guide for Claude Console](https://platform.claude.com/docs/en/manage-claude/admin-api).
+This page covers managing the people in your **Claude Enterprise** (claude.ai) organization programmatically, using the [Admin API](https://platform.claude.com/docs/en/api/beta/organization):
+
+* List members and look them up by email address
+* Change a member's role
+* Remove members
+* Send and withdraw invites
+* Manage your enterprise's groups and their membership
+* Read your organization's custom roles
+
+For Claude Console (Claude Platform) organizations, see the [Admin API guide for Claude Console](https://platform.claude.com/docs/en/manage-claude/admin-api).
 
 <Note>
   Group and custom-role requests don't require the `anthropic-beta: ce-user-management-2026-07-13` [beta header](https://platform.claude.com/docs/en/api/beta-headers). Requests that still send it are accepted and behave identically.
@@ -147,7 +156,7 @@ List the organization's members, newest first:
   ```
 </CodeGroup>
 
-```text wrap
+```json
 {
   "data": [
     {
@@ -604,7 +613,7 @@ For complete parameter details and response schemas, see [Remove user](https://p
   ```
 </CodeGroup>
 
-```text wrap
+```json
 {
   "type": "user_deleted",
   "id": "user_01AbCdEfGhIjKlMnOpQrSt"
@@ -764,7 +773,7 @@ For complete parameter details and response schemas, see [Create invite](https:/
   ```
 </CodeGroup>
 
-```text wrap
+```json
 {
   "type": "invite",
   "id": "invite_01QrStUvWxYzAbCdEfGhIj",
@@ -1161,7 +1170,7 @@ For complete parameter details and response schemas, see [List groups](https://p
   ```
 </CodeGroup>
 
-```text wrap
+```json
 {
   "data": [
     {
@@ -1380,7 +1389,7 @@ For complete parameter details and response schemas, see [Create group](https://
   ```
 </CodeGroup>
 
-```text wrap
+```json
 {
   "type": "rbac_group",
   "id": "rbac_group_01UvWxYzAbCdEfGhIjKlMn",
@@ -1595,7 +1604,7 @@ For complete parameter details and response schemas, see [Delete group](https://
   ```
 </CodeGroup>
 
-```text wrap
+```json
 {
   "id": "rbac_group_01UvWxYzAbCdEfGhIjKlMn",
   "type": "rbac_group_deleted"
@@ -1722,7 +1731,7 @@ For complete parameter details and response schemas, see [List group members](ht
   ```
 </CodeGroup>
 
-```text wrap
+```json
 {
   "data": [
     {
@@ -1856,7 +1865,7 @@ For complete parameter details and response schemas, see [Add group member](http
   ```
 </CodeGroup>
 
-```text wrap
+```json
 {
   "type": "rbac_group_member",
   "rbac_group_id": "rbac_group_01UvWxYzAbCdEfGhIjKlMn",
@@ -1975,7 +1984,7 @@ For complete parameter details and response schemas, see [Remove group member](h
   ```
 </CodeGroup>
 
-```text wrap
+```json
 {
   "rbac_group_id": "rbac_group_01UvWxYzAbCdEfGhIjKlMn",
   "group_id": "rbac_group_01UvWxYzAbCdEfGhIjKlMn",
@@ -2091,7 +2100,7 @@ For complete parameter details and response schemas, see [List roles](https://pl
   ```
 </CodeGroup>
 
-```text wrap
+```json
 {
   "data": [
     {
@@ -2321,7 +2330,7 @@ For complete parameter details and response schemas, see [List role permissions]
   ```
 </CodeGroup>
 
-```text wrap
+```json
 {
   "data": [
     {
diff --git a/content/en/manage-claude/user-profiles-verification-portal.md b/content/en/manage-claude/user-profiles-verification-portal.md
index 451867894b..afad964de2 100644
--- a/content/en/manage-claude/user-profiles-verification-portal.md
+++ b/content/en/manage-claude/user-profiles-verification-portal.md
@@ -127,7 +127,7 @@ The call returns a `404` if creating enrollment links isn't enabled for your org
 
 The response contains the link and the time it stops working:
 
-```text wrap
+```json
 {
   "type": "user_profile_action_url",
   "url": "https://portal.anthropic.com/enroll?enrollment_token=...",
diff --git a/content/en/manage-claude/user-profiles.md b/content/en/manage-claude/user-profiles.md
index b69935ce4c..6e00d98f34 100644
--- a/content/en/manage-claude/user-profiles.md
+++ b/content/en/manage-claude/user-profiles.md
@@ -181,7 +181,7 @@ The following example registers a company that buys API access through a gateway
 
 The response is the new profile:
 
-```text wrap
+```json
 {
   "type": "user_profile",
   "id": "uprof_011CZkZCu8hGbp5mYRQgUmz9",
@@ -403,7 +403,7 @@ A `passthrough` profile identifies a company, not the person making the request.
 
 A profile's `enforcement_status` and `enforcement_actions` fields report the enforcement actions that Anthropic has open on the end customer. An enforcement action is a restriction or a ban. Every response that returns a profile includes both fields: create, retrieve, update, and each profile in a list. Send these requests with no `user-profiles-` value in the `anthropic-beta` header, because `user-profiles-2026-09-04` and earlier values leave the fields out. The following example shows the fields on a retrieved profile, with the other fields left out:
 
-```text wrap
+```json
 {
   "type": "user_profile",
   "id": "uprof_011CZkZCu8hGbp5mYRQgUmz9",
diff --git a/content/en/manage-claude/wif-admin-api.md b/content/en/manage-claude/wif-admin-api.md
index 146f6ea3ae..4314a82b54 100644
--- a/content/en/manage-claude/wif-admin-api.md
+++ b/content/en/manage-claude/wif-admin-api.md
@@ -12,7 +12,7 @@ Every request on this page authenticates with an OAuth bearer token that carries
 
 ### Interactive (your terminal)
 
-Log in with the [`ant` CLI](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/quickstart) under a dedicated profile, requesting the `org:admin` scope (see [Admin access](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/authentication#admin-access)), then export the bearer token. Logging in with `--profile admin` stores the `org:admin` credential under its own profile name and also makes it the CLI's active profile, and the exported variable applies to every SDK and CLI call in that shell; so use a shell you reserve for administration, unset the variable when you are done, and switch the CLI back with `ant profile activate default`:
+Log in with the [`ant` CLI](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/quickstart) under a dedicated profile, requesting the `org:admin` scope (see [Admin access](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/authentication#admin-access)), then export the bearer token. Logging in with `--profile admin` stores the `org:admin` credential under its own profile name and also makes it the CLI's active profile. The exported variable applies to every SDK and CLI call in that shell. For these reasons, use a shell you reserve for administration, unset the variable when you are done, and switch the CLI back with `ant profile activate default`:
 
 ```bash CLI
 ant auth login --profile admin --scope "org:admin"
@@ -25,7 +25,7 @@ The SDK and the `ant` CLI read `ANTHROPIC_AUTH_TOKEN` automatically; leave `ANTH
 
 ### Workload (CI and automation)
 
-Create a federation rule with `oauth_scope: org:admin` that targets a service account whose `organization_role` is `admin`. The rule itself must be created in the Claude Console: granting a workload organization-admin access is a deliberate human action, not something automation can bootstrap for itself. The next section walks through this once-per-organization setup.
+Create a federation rule with `oauth_scope: org:admin` that targets a service account whose `organization_role` is `admin`. You must create the rule itself in the Claude Console: granting a workload organization-admin access is a deliberate human action, not something automation can bootstrap for itself. The next section walks through this once-per-organization setup.
 
 ## Bootstrap a workload to manage WIF
 
@@ -471,7 +471,7 @@ Archive a service account:
 
 The create endpoint returns the new service account:
 
-```text wrap
+```json
 {
   "id": "svac_...",
   "name": "inference-worker",
@@ -1242,7 +1242,7 @@ Archive a rule:
 
 The list endpoint returns a page of rules and the cursor for the next page:
 
-```text wrap
+```json
 {
   "data": [{ "id": "fdrl_...", "name": "gha-deploy", "...": "..." }],
   "next_page": "..."
diff --git a/content/en/manage-claude/wif-providers/aws.md b/content/en/manage-claude/wif-providers/aws.md
index 8b85c5c5b9..1bf9f69beb 100644
--- a/content/en/manage-claude/wif-providers/aws.md
+++ b/content/en/manage-claude/wif-providers/aws.md
@@ -480,7 +480,7 @@ curl -sS https://api.anthropic.com/v1/oauth/token \
 JSON
 ```
 
-A successful exchange returns an `access_token` starting with `sk-ant-oat01-` and an `expires_in` value in seconds. If the exchange fails with the opaque `401` `authentication_error` response (message `Authentication failed`), check the [authentication history page](https://platform.claude.com/settings/workload-identity-federation?tab=history) in the Claude Console for the deny reason and see [Troubleshoot a failed exchange](https://platform.claude.com/docs/en/manage-claude/wif-reference#troubleshoot-a-failed-exchange); the most common AWS-side cause is an `iss` mismatch (the per-account STS issuer URL must match the registered `issuer_url` exactly).
+A successful exchange returns an `access_token` starting with `sk-ant-oat01-` and an `expires_in` value in seconds. If the exchange fails with the opaque `401` `authentication_error` response (message `Authentication failed`), check the [authentication history page](https://platform.claude.com/settings/workload-identity-federation?tab=history) in the Claude Console for the deny reason and see [Troubleshoot a failed exchange](https://platform.claude.com/docs/en/manage-claude/wif-reference#troubleshoot-a-failed-exchange). The most common AWS-side cause is an `iss` mismatch: the per-account STS issuer URL must match the registered `issuer_url` exactly.
 
 ## Use EKS projected service-account tokens
 
@@ -835,7 +835,7 @@ curl -sS https://api.anthropic.com/v1/oauth/token \
 JSON
 ```
 
-A successful exchange returns an `access_token` starting with `sk-ant-oat01-` and an `expires_in` value in seconds. If the exchange fails with the opaque `401` `authentication_error` response (message `Authentication failed`), check the [authentication history page](https://platform.claude.com/settings/workload-identity-federation?tab=history) in the Claude Console for the deny reason and see [Troubleshoot a failed exchange](https://platform.claude.com/docs/en/manage-claude/wif-reference#troubleshoot-a-failed-exchange); the most common EKS-side cause is the projected token's `aud` not matching the rule (project a token with `audience: https://api.anthropic.com`, not the IRSA default `sts.amazonaws.com`).
+A successful exchange returns an `access_token` starting with `sk-ant-oat01-` and an `expires_in` value in seconds. If the exchange fails with the opaque `401` `authentication_error` response (message `Authentication failed`), check the [authentication history page](https://platform.claude.com/settings/workload-identity-federation?tab=history) in the Claude Console for the deny reason and see [Troubleshoot a failed exchange](https://platform.claude.com/docs/en/manage-claude/wif-reference#troubleshoot-a-failed-exchange). The most common EKS-side cause is the projected token's `aud` not matching the rule (project a token with `audience: https://api.anthropic.com`, not the IRSA default `sts.amazonaws.com`).
 
 ## Scope your rule
 
diff --git a/content/en/manage-claude/wif-providers/azure.md b/content/en/manage-claude/wif-providers/azure.md
index c60578db57..7850bbf9f1 100644
--- a/content/en/manage-claude/wif-providers/azure.md
+++ b/content/en/manage-claude/wif-providers/azure.md
@@ -623,7 +623,7 @@ From your Azure resource, run the cURL exchange shown in [Acquire and use the to
 
 ## Use Entra Workload Identity on AKS
 
-Use this path when your workload runs in an AKS pod. Entra Workload Identity federates a Kubernetes service account with a user-assigned managed identity: Kubernetes projects a service account token (signed by the AKS cluster's OIDC issuer) into the pod at the path in `AZURE_FEDERATED_TOKEN_FILE`. That projected token is not an Entra-issued token, so to stay on the Entra-mediated path described on this page, the workload performs a two-hop exchange: it first redeems the projected token at `https://login.microsoftonline.com/<TENANT_ID>/oauth2/v2.0/token` (federated `client_credentials` grant) for an Entra-issued access token, then passes that Entra token to the Anthropic SDK as the identity token.
+Use this path when your workload runs in an AKS pod. Entra Workload Identity federates a Kubernetes service account with a user-assigned managed identity: Kubernetes projects a service account token (signed by the AKS cluster's OIDC issuer) into the pod at the path in `AZURE_FEDERATED_TOKEN_FILE`. That projected token is not an Entra-issued token, so to stay on the Entra-mediated path described on this page, the workload performs a two-hop exchange. First, it redeems the projected token at `https://login.microsoftonline.com/<TENANT_ID>/oauth2/v2.0/token` (federated `client_credentials` grant) for an Entra-issued access token. Then it passes that Entra token to the Anthropic SDK as the identity token.
 
 <Tip>
   AKS pods can alternatively skip the Entra exchange and present the Kubernetes-projected service account token to Anthropic directly. That path registers your AKS cluster's OIDC issuer with Anthropic instead of your Entra tenant. See [Use WIF with Kubernetes](https://platform.claude.com/docs/en/manage-claude/wif-providers/kubernetes) for that flow.
@@ -1241,7 +1241,7 @@ Two different client IDs appear in the samples. `<APP_ID>` is the audience app r
 
 ### Verify the setup
 
-From inside a labeled pod, run the cURL exchange shown in [Acquire and use the token on AKS](https://platform.claude.com/docs/en/manage-claude/wif-providers/azure#acquire-and-use-the-token-2) and confirm that `POST /v1/oauth/token` returns a `200` with an `access_token` starting with `sk-ant-oat01-` and an `expires_in` value in seconds. If the exchange fails with the opaque `401` `authentication_error` response (message `Authentication failed`), check the [authentication history page](https://platform.claude.com/settings/workload-identity-federation?tab=history) in the Claude Console for the deny reason, then decode the Entra-issued token from step 1 (see [Troubleshoot a failed exchange](https://platform.claude.com/docs/en/manage-claude/wif-reference#troubleshoot-a-failed-exchange) for the command) and check the most common Azure-side causes:
+From inside a labeled pod, run the cURL exchange shown in [Acquire and use the token on AKS](https://platform.claude.com/docs/en/manage-claude/wif-providers/azure#acquire-and-use-the-token-2) and confirm that `POST /v1/oauth/token` returns a `200` with an `access_token` starting with `sk-ant-oat01-` and an `expires_in` value in seconds. If the exchange fails with the opaque `401` `authentication_error` response (message `Authentication failed`), check the [authentication history page](https://platform.claude.com/settings/workload-identity-federation?tab=history) in the Claude Console for the deny reason. Then decode the Entra-issued token from step 1 (see [Troubleshoot a failed exchange](https://platform.claude.com/docs/en/manage-claude/wif-reference#troubleshoot-a-failed-exchange) for the command) and check the most common Azure-side causes:
 
 * **Issuer mismatch:** The registered `issuer_url` must match the token's `iss` claim exactly. A v2.0 token carries `https://login.microsoftonline.com/<TENANT_ID>/v2.0`; if the decoded `ver` claim is `1.0`, see [If your tokens are v1.0](https://platform.claude.com/docs/en/manage-claude/wif-providers/azure#if-your-tokens-are-v1-0).
 * **Token lifetime:** If a tenant token-lifetime policy or CAE extends the `client_credentials` token past 7,500 seconds, raise the issuer's `max_jwt_lifetime_seconds` as described in [Configure Anthropic for Entra Workload Identity on AKS](https://platform.claude.com/docs/en/manage-claude/wif-providers/azure#configure-anthropic-2).
diff --git a/content/en/manage-claude/wif-providers/gcp.md b/content/en/manage-claude/wif-providers/gcp.md
index 5d563202c4..af52a6c47b 100644
--- a/content/en/manage-claude/wif-providers/gcp.md
+++ b/content/en/manage-claude/wif-providers/gcp.md
@@ -465,7 +465,7 @@ curl -sS -H "Metadata-Flavor: Google" \
   | jq -rR 'split(".")[1] | gsub("-";"+") | gsub("_";"/") | @base64d | fromjson'
 ```
 
-Check that `iss` is `https://accounts.google.com`, `aud` is `https://api.anthropic.com`, and `email` matches the value in your federation rule. Then run the exchange from the previous section. A successful exchange returns an `access_token` starting with `sk-ant-oat01-` and an `expires_in` value in seconds. If the exchange fails with the opaque `401` `authentication_error` response (message `Authentication failed`), check the [authentication history page](https://platform.claude.com/settings/workload-identity-federation?tab=history) in the Claude Console for the deny reason and see [Troubleshoot a failed exchange](https://platform.claude.com/docs/en/manage-claude/wif-reference#troubleshoot-a-failed-exchange); the most common Google Cloud-side cause is the `email` claim missing (request the token with `format=full` so it is included).
+Check that `iss` is `https://accounts.google.com`, `aud` is `https://api.anthropic.com`, and `email` matches the value in your federation rule. Then run the exchange from the previous section. A successful exchange returns an `access_token` starting with `sk-ant-oat01-` and an `expires_in` value in seconds. If the exchange fails with the opaque `401` `authentication_error` response (message `Authentication failed`), check the [authentication history page](https://platform.claude.com/settings/workload-identity-federation?tab=history) in the Claude Console for the deny reason and see [Troubleshoot a failed exchange](https://platform.claude.com/docs/en/manage-claude/wif-reference#troubleshoot-a-failed-exchange). The most common Google Cloud-side cause is the `email` claim missing (request the token with `format=full` so it is included).
 
 ## Scope your rule
 
diff --git a/content/en/manage-claude/wif-providers/kubernetes.md b/content/en/manage-claude/wif-providers/kubernetes.md
index c4ebaa9a72..9b12bca754 100644
--- a/content/en/manage-claude/wif-providers/kubernetes.md
+++ b/content/en/manage-claude/wif-providers/kubernetes.md
@@ -291,7 +291,7 @@ The pod spec in [Configure Kubernetes](https://platform.claude.com/docs/en/manag
 
 ## Verify the setup
 
-A successful exchange returns an `access_token` starting with `sk-ant-oat01-` and an `expires_in` value in seconds. If the exchange fails with the opaque `401` `authentication_error` response (message `Authentication failed`), check the [authentication history page](https://platform.claude.com/settings/workload-identity-federation?tab=history) in the Claude Console for the deny reason and see [Troubleshoot a failed exchange](https://platform.claude.com/docs/en/manage-claude/wif-reference#troubleshoot-a-failed-exchange); the most common Kubernetes-side cause is a JWKS key mismatch (for `inline` mode, re-fetch with `kubectl get --raw /openid/v1/jwks` and update the issuer).
+A successful exchange returns an `access_token` starting with `sk-ant-oat01-` and an `expires_in` value in seconds. If the exchange fails with the opaque `401` `authentication_error` response (message `Authentication failed`), check the [authentication history page](https://platform.claude.com/settings/workload-identity-federation?tab=history) in the Claude Console for the deny reason and see [Troubleshoot a failed exchange](https://platform.claude.com/docs/en/manage-claude/wif-reference#troubleshoot-a-failed-exchange). The most common Kubernetes-side cause is a JWKS key mismatch (for `inline` mode, re-fetch with `kubectl get --raw /openid/v1/jwks` and update the issuer).
 
 ## Scope your rule
 
diff --git a/content/en/manage-claude/wif-providers/okta.md b/content/en/manage-claude/wif-providers/okta.md
index 7b6c49c13c..1f331ce40f 100644
--- a/content/en/manage-claude/wif-providers/okta.md
+++ b/content/en/manage-claude/wif-providers/okta.md
@@ -496,7 +496,7 @@ Except in Java (see the comment in that example), the SDK example passes your Ok
 
 ## Verify the setup
 
-A successful exchange returns an `access_token` starting with `sk-ant-oat01-` and an `expires_in` value in seconds. If the exchange fails with the opaque `401` `authentication_error` response (message `Authentication failed`), check the [authentication history page](https://platform.claude.com/settings/workload-identity-federation?tab=history) in the Claude Console for the deny reason and see [Troubleshoot a failed exchange](https://platform.claude.com/docs/en/manage-claude/wif-reference#troubleshoot-a-failed-exchange); the most common Okta-side cause is an `issuer_url` mismatch (it must include the `/oauth2/<auth-server-id>` path; the Okta org authorization server is not usable).
+A successful exchange returns an `access_token` starting with `sk-ant-oat01-` and an `expires_in` value in seconds. If the exchange fails with the opaque `401` `authentication_error` response (message `Authentication failed`), check the [authentication history page](https://platform.claude.com/settings/workload-identity-federation?tab=history) in the Claude Console for the deny reason and see [Troubleshoot a failed exchange](https://platform.claude.com/docs/en/manage-claude/wif-reference#troubleshoot-a-failed-exchange). The most common Okta-side cause is an `issuer_url` mismatch. The `issuer_url` must include the `/oauth2/<auth-server-id>` path, and the Okta org authorization server is not usable.
 
 ## Scope your rule
 
diff --git a/content/en/manage-claude/wif-providers/spiffe.md b/content/en/manage-claude/wif-providers/spiffe.md
index 3c043d358d..65a23c03b8 100644
--- a/content/en/manage-claude/wif-providers/spiffe.md
+++ b/content/en/manage-claude/wif-providers/spiffe.md
@@ -35,7 +35,13 @@ The audience value to request when fetching a JWT-SVID is always `https://api.an
 
 The instructions in this section are SPIRE-specific. If you use a different SPIFFE issuer, configure its OIDC discovery endpoint and JWT-SVID retrieval according to its own documentation, then continue at [Configure Anthropic](https://platform.claude.com/docs/en/manage-claude/wif-providers/spiffe#configure-anthropic).
 
-If you already run SPIRE with the OIDC Discovery Provider, federating with Anthropic requires three things on the SPIRE side: a `jwt_issuer` that matches the discovery URL, a registration entry for the workload that will call the Claude API, and a way for that workload to fetch a JWT-SVID with the Anthropic audience. The following subsections walk through each. The configuration snippets show only the settings relevant to Anthropic federation, not complete SPIRE deployment configs.
+If you already run SPIRE with the OIDC Discovery Provider, federating with Anthropic requires three things on the SPIRE side:
+
+* A `jwt_issuer` that matches the discovery URL
+* A registration entry for the workload that will call the Claude API
+* A way for that workload to fetch a JWT-SVID with the Anthropic audience
+
+The following subsections walk through each. The configuration snippets show only the settings relevant to Anthropic federation, not complete SPIRE deployment configs.
 
 <Tip>
   Setting up SPIRE for the first time? Deploy SPIRE Server and Agent following the [SPIRE quickstart](https://spiffe.io/docs/latest/try/), then add the [OIDC Discovery Provider](https://github.com/spiffe/spire/blob/main/support/oidc-discovery-provider/README.md) as a separate service alongside SPIRE Server. Discovery-mode federation depends on the provider being deployed and publicly reachable. The provider is not part of a default SPIRE install.
diff --git a/content/en/manage-claude/workload-identity-federation.md b/content/en/manage-claude/workload-identity-federation.md
index 0ee67fd01c..6c4e824da7 100644
--- a/content/en/manage-claude/workload-identity-federation.md
+++ b/content/en/manage-claude/workload-identity-federation.md
@@ -371,7 +371,7 @@ The SDK caches the token and refreshes it on a two-tier schedule modeled on `bot
 
 Because the SDK re-reads `ANTHROPIC_IDENTITY_TOKEN_FILE` on every exchange, it transparently picks up rotated projected tokens (Kubernetes service-account tokens, for example, rotate well before their `exp`).
 
-By default, identity tokens that carry a `jti` claim are single-use: each exchange must present a JWT that has not been exchanged before, and re-presenting one fails with the reason `jti_reused` on the [authentication history page](https://platform.claude.com/settings/workload-identity-federation?tab=history) in the Claude Console. If your workload fetches its own tokens from your identity provider, mint a fresh JWT for each exchange instead of reusing a cached one (retry loops are the usual cause of reuse). The same applies to a token read from `ANTHROPIC_IDENTITY_TOKEN_FILE`: the SDK re-reads the file on every exchange, so the file must hold a new token before each refresh. A refresh that re-reads an unrotated token, or a restarted process that re-presents a token it already exchanged, is rejected the same way. Rotating the token well within the minted token's lifetime keeps the file ahead of the refresh schedule; if your token source cannot rotate that often, you can disable `check_jti` for that issuer as a last resort (this removes replay protection for every rule on the issuer). See [JWT verification](https://platform.claude.com/docs/en/manage-claude/wif-reference#jwt-verification) for details.
+By default, identity tokens that carry a `jti` claim are single-use: each exchange must present a JWT that has not been exchanged before, and re-presenting one fails with the reason `jti_reused` on the [authentication history page](https://platform.claude.com/settings/workload-identity-federation?tab=history) in the Claude Console. If your workload fetches its own tokens from your identity provider, mint a fresh JWT for each exchange instead of reusing a cached one (retry loops are the usual cause of reuse). The same applies to a token read from `ANTHROPIC_IDENTITY_TOKEN_FILE`: the SDK re-reads the file on every exchange, so the file must hold a new token before each refresh. A refresh that re-reads an unrotated token, or a restarted process that re-presents a token it already exchanged, is rejected the same way. Rotating the token well within the minted token's lifetime keeps the file ahead of the refresh schedule. If your token source cannot rotate that often, you can disable `check_jti` for that issuer as a last resort. This removes replay protection for every rule on the issuer. See [JWT verification](https://platform.claude.com/docs/en/manage-claude/wif-reference#jwt-verification) for details.
 
 ## Identity providers
 
diff --git a/content/en/manage-claude/workspaces.md b/content/en/manage-claude/workspaces.md
index 39b6510cb2..0e3d3b49c1 100644
--- a/content/en/manage-claude/workspaces.md
+++ b/content/en/manage-claude/workspaces.md
@@ -454,7 +454,7 @@ Add a member to a workspace:
     -H "anthropic-version: 2023-06-01" \
     -H "content-type: application/json" \
     -d '{
-      "user_id": "user_01XyDMpzjS89pFZXqSFUBDr6",
+      "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
       "workspace_role": "workspace_developer"
     }'
   ```
@@ -462,7 +462,7 @@ Add a member to a workspace:
   ```bash CLI
   ant organization:workspaces:members add \
     --workspace-id wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ \
-    --user-id user_01XyDMpzjS89pFZXqSFUBDr6 \
+    --user-id user_01WxYzAbCdEfGhJkMnPqRsTu \
     --workspace-role workspace_developer
   ```
 
@@ -471,7 +471,7 @@ Add a member to a workspace:
 
   member = client.organization.workspaces.members.add(
       "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
-      user_id="user_01XyDMpzjS89pFZXqSFUBDr6",
+      user_id="user_01WxYzAbCdEfGhJkMnPqRsTu",
       workspace_role="workspace_developer",
   )
 
@@ -485,7 +485,7 @@ Add a member to a workspace:
   const member = await client.organization.workspaces.members.add(
     "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
     {
-      user_id: "user_01XyDMpzjS89pFZXqSFUBDr6",
+      user_id: "user_01WxYzAbCdEfGhJkMnPqRsTu",
       workspace_role: "workspace_developer"
     }
   );
@@ -503,7 +503,7 @@ Add a member to a workspace:
       "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
       new()
       {
-          UserID = "user_01XyDMpzjS89pFZXqSFUBDr6",
+          UserID = "user_01WxYzAbCdEfGhJkMnPqRsTu",
           WorkspaceRole = NoBillingWorkspaceRole.WorkspaceDeveloper
       }
   );
@@ -519,7 +519,7 @@ Add a member to a workspace:
   	context.Background(),
   	"wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
   	anthropic.OrganizationWorkspaceMemberAddParams{
-  		UserID:        "user_01XyDMpzjS89pFZXqSFUBDr6",
+  		UserID:        "user_01WxYzAbCdEfGhJkMnPqRsTu",
   		WorkspaceRole: anthropic.NoBillingWorkspaceRoleWorkspaceDeveloper,
   	},
   )
@@ -539,7 +539,7 @@ Add a member to a workspace:
       AnthropicClient client = AnthropicOkHttpClient.fromEnv();
 
       var params = MemberAddParams.builder()
-          .userId("user_01XyDMpzjS89pFZXqSFUBDr6")
+          .userId("user_01WxYzAbCdEfGhJkMnPqRsTu")
           .workspaceRole(NoBillingWorkspaceRole.WORKSPACE_DEVELOPER)
           .build();
       var member = client.organization().workspaces().members()
@@ -558,7 +558,7 @@ Add a member to a workspace:
 
   $member = $client->organization->workspaces->members->add(
       workspaceID: 'wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ',
-      userID: 'user_01XyDMpzjS89pFZXqSFUBDr6',
+      userID: 'user_01WxYzAbCdEfGhJkMnPqRsTu',
       workspaceRole: NoBillingWorkspaceRole::WORKSPACE_DEVELOPER,
   );
 
@@ -572,7 +572,7 @@ Add a member to a workspace:
   workspace_id = "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
   member = client.organization.workspaces.members.add(
     workspace_id,
-    user_id: "user_01XyDMpzjS89pFZXqSFUBDr6",
+    user_id: "user_01WxYzAbCdEfGhJkMnPqRsTu",
     workspace_role: :workspace_developer
   )
 
@@ -585,7 +585,7 @@ Update a member's role:
 
 <CodeGroup>
   ```bash cURL
-  curl -X POST "https://api.anthropic.com/v1/organizations/workspaces/wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ/members/user_01XyDMpzjS89pFZXqSFUBDr6" \
+  curl -X POST "https://api.anthropic.com/v1/organizations/workspaces/wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ/members/user_01WxYzAbCdEfGhJkMnPqRsTu" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01" \
     -H "content-type: application/json" \
@@ -594,7 +594,7 @@ Update a member's role:
 
   ```bash CLI
   ant organization:workspaces:members update \
-    --user-id user_01XyDMpzjS89pFZXqSFUBDr6 \
+    --user-id user_01WxYzAbCdEfGhJkMnPqRsTu \
     --workspace-id wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ \
     --workspace-role workspace_admin
   ```
@@ -603,7 +603,7 @@ Update a member's role:
   client = anthropic.Anthropic()
 
   member = client.organization.workspaces.members.update(
-      "user_01XyDMpzjS89pFZXqSFUBDr6",
+      "user_01WxYzAbCdEfGhJkMnPqRsTu",
       workspace_id="wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
       workspace_role="workspace_admin",
   )
@@ -616,7 +616,7 @@ Update a member's role:
   const client = new Anthropic();
 
   const member = await client.organization.workspaces.members.update(
-    "user_01XyDMpzjS89pFZXqSFUBDr6",
+    "user_01WxYzAbCdEfGhJkMnPqRsTu",
     {
       workspace_id: "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
       workspace_role: "workspace_admin"
@@ -633,7 +633,7 @@ Update a member's role:
   AnthropicClient client = new();
 
   var member = await client.Organization.Workspaces.Members.Update(
-      "user_01XyDMpzjS89pFZXqSFUBDr6",
+      "user_01WxYzAbCdEfGhJkMnPqRsTu",
       new()
       {
           WorkspaceID = "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
@@ -650,7 +650,7 @@ Update a member's role:
 
   member, err := client.Organization.Workspaces.Members.Update(
   	context.Background(),
-  	"user_01XyDMpzjS89pFZXqSFUBDr6",
+  	"user_01WxYzAbCdEfGhJkMnPqRsTu",
   	anthropic.OrganizationWorkspaceMemberUpdateParams{
   		WorkspaceID:   "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
   		WorkspaceRole: anthropic.WorkspaceRoleWorkspaceAdmin,
@@ -676,7 +676,7 @@ Update a member's role:
           .workspaceRole(WorkspaceRole.WORKSPACE_ADMIN)
           .build();
       var member = client.organization().workspaces().members()
-          .update("user_01XyDMpzjS89pFZXqSFUBDr6", params);
+          .update("user_01WxYzAbCdEfGhJkMnPqRsTu", params);
 
       IO.println("user_id: " + member.userId());
       IO.println("workspace_role: " + member.workspaceRole().asString());
@@ -690,7 +690,7 @@ Update a member's role:
   $client = new Client();
 
   $member = $client->organization->workspaces->members->update(
-      userID: 'user_01XyDMpzjS89pFZXqSFUBDr6',
+      userID: 'user_01WxYzAbCdEfGhJkMnPqRsTu',
       workspaceID: 'wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ',
       workspaceRole: WorkspaceRole::WORKSPACE_ADMIN,
   );
@@ -702,7 +702,7 @@ Update a member's role:
   ```ruby Ruby
   client = Anthropic::Client.new
 
-  user_id = "user_01XyDMpzjS89pFZXqSFUBDr6"
+  user_id = "user_01WxYzAbCdEfGhJkMnPqRsTu"
   member = client.organization.workspaces.members.update(
     user_id,
     workspace_id: "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
@@ -718,14 +718,14 @@ Remove a member from a workspace:
 
 <CodeGroup>
   ```bash cURL
-  curl -X DELETE "https://api.anthropic.com/v1/organizations/workspaces/wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ/members/user_01XyDMpzjS89pFZXqSFUBDr6" \
+  curl -X DELETE "https://api.anthropic.com/v1/organizations/workspaces/wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ/members/user_01WxYzAbCdEfGhJkMnPqRsTu" \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01"
   ```
 
   ```bash CLI
   ant organization:workspaces:members remove \
-    --user-id user_01XyDMpzjS89pFZXqSFUBDr6 \
+    --user-id user_01WxYzAbCdEfGhJkMnPqRsTu \
     --workspace-id wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ
   ```
 
@@ -733,7 +733,7 @@ Remove a member from a workspace:
   client = anthropic.Anthropic()
 
   removed_member = client.organization.workspaces.members.remove(
-      "user_01XyDMpzjS89pFZXqSFUBDr6",
+      "user_01WxYzAbCdEfGhJkMnPqRsTu",
       workspace_id="wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
   )
 
@@ -744,7 +744,7 @@ Remove a member from a workspace:
   const client = new Anthropic();
 
   const removedMember = await client.organization.workspaces.members.remove(
-    "user_01XyDMpzjS89pFZXqSFUBDr6",
+    "user_01WxYzAbCdEfGhJkMnPqRsTu",
     { workspace_id: "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" }
   );
 
@@ -755,7 +755,7 @@ Remove a member from a workspace:
   AnthropicClient client = new();
 
   var removedMember = await client.Organization.Workspaces.Members.Remove(
-      "user_01XyDMpzjS89pFZXqSFUBDr6",
+      "user_01WxYzAbCdEfGhJkMnPqRsTu",
       new() { WorkspaceID = "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" }
   );
 
@@ -767,7 +767,7 @@ Remove a member from a workspace:
 
   removedMember, err := client.Organization.Workspaces.Members.Remove(
   	context.Background(),
-  	"user_01XyDMpzjS89pFZXqSFUBDr6",
+  	"user_01WxYzAbCdEfGhJkMnPqRsTu",
   	anthropic.OrganizationWorkspaceMemberRemoveParams{
   		WorkspaceID: "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
   	},
@@ -789,7 +789,7 @@ Remove a member from a workspace:
           .workspaceId("wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ")
           .build();
       var removedMember = client.organization().workspaces().members()
-          .remove("user_01XyDMpzjS89pFZXqSFUBDr6", params);
+          .remove("user_01WxYzAbCdEfGhJkMnPqRsTu", params);
 
       IO.println("user_id: " + removedMember.userId());
   }
@@ -799,7 +799,7 @@ Remove a member from a workspace:
   $client = new Client();
 
   $removedMember = $client->organization->workspaces->members->remove(
-      userID: 'user_01XyDMpzjS89pFZXqSFUBDr6',
+      userID: 'user_01WxYzAbCdEfGhJkMnPqRsTu',
       workspaceID: 'wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ',
   );
 
@@ -809,7 +809,7 @@ Remove a member from a workspace:
   ```ruby Ruby
   client = Anthropic::Client.new
 
-  user_id = "user_01XyDMpzjS89pFZXqSFUBDr6"
+  user_id = "user_01WxYzAbCdEfGhJkMnPqRsTu"
   removed_member = client.organization.workspaces.members.remove(
     user_id,
     workspace_id: "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
@@ -849,7 +849,7 @@ To look up your organization's workspace IDs, call the [List Workspaces](https:/
 
 Claude API responses include an `anthropic-workspace-id` header alongside the `request-id` and `anthropic-organization-id` [response headers](https://platform.claude.com/docs/en/api/overview#response-headers). Its value is the `wrkspc_`-prefixed ID of the workspace that the request's API key or access token resolved to, including when that workspace is the Default Workspace. For example, a successful response includes headers like these:
 
-```text wrap
+```http
 HTTP/1.1 200 OK
 request-id: req_018EeWyXxfu5pfWkrYcMdjWG
 anthropic-organization-id: 0d0e7a3b-52f1-4c7e-9a51-3f6f2f7c1b9e
diff --git a/content/en/managed-agents/agent-setup.md b/content/en/managed-agents/agent-setup.md
index 334217c5da..c37354e608 100644
--- a/content/en/managed-agents/agent-setup.md
+++ b/content/en/managed-agents/agent-setup.md
@@ -152,7 +152,7 @@ The examples use curl, the `ant` CLI, or the SDK. If you haven't set one up, the
 
 The response echoes your configuration and adds `id`, `type`, `version`, `created_at`, `updated_at`, and `archived_at` fields, and fills in `model` fields you omit, such as `effort`, with their defaults. The `version` starts at 1 and increments each time an update changes the agent.
 
-```text wrap
+```json
 {
   "id": "agent_01HqR2k7vXbZ9mNpL3wYcT8f",
   "type": "agent",
diff --git a/content/en/managed-agents/budgets.md b/content/en/managed-agents/budgets.md
index 7f3f125234..03dc83d3cf 100644
--- a/content/en/managed-agents/budgets.md
+++ b/content/en/managed-agents/budgets.md
@@ -157,7 +157,7 @@ Enforcement uses the exact, unrounded list cost. The `list_cost` (java, php: `li
 
 ## When a session reaches its budget
 
-The cap is enforced between model requests, not mid-request. Before each model request, the platform checks the session's consumed list cost, and once that total reaches the cap every thread pauses before its next request. The request that carried the total past the cap was admitted while the session was still under it and runs to completion, so a paused session's recorded `list_cost` (java, php: `listCost`; csharp, go: `ListCost`) reads at or a fraction past `max_list_cost` (java, php: `maxListCost`; csharp, go: `MaxListCost`): a session capped at `"50"` (50 cents) can pause with a `list_cost` (java, php: `listCost`; csharp, go: `ListCost`) of `"53"`. This is expected, not a billing error. Model spend past the cap is at most the cost of one model request for each thread. The tool calls in that request's response still run, and their web searches and running time also count toward list cost. Treat the budget as a bound on new work rather than an exact stopping point, and size the cap with that margin in mind.
+The cap is enforced between model requests, not mid-request. Before each model request, the platform checks the session's consumed list cost, and once that total reaches the cap every thread pauses before its next request. The request that carried the total past the cap was admitted while the session was still under it and runs to completion. As a result, a paused session's recorded `list_cost` (java, php: `listCost`; csharp, go: `ListCost`) reads at or a fraction past `max_list_cost` (java, php: `maxListCost`; csharp, go: `MaxListCost`). For example, a session capped at `"50"` (50 cents) can pause with a `list_cost` (java, php: `listCost`; csharp, go: `ListCost`) of `"53"`. This is expected, not a billing error. Model spend past the cap is at most the cost of one model request for each thread. The tool calls in that request's response still run, and their web searches and running time also count toward list cost. Treat the budget as a bound on new work rather than an exact stopping point, and size the cap with that margin in mind.
 
 A session that reaches its budget goes idle with a `stop_reason` (java, php: `stopReason`; csharp, go: `StopReason`) of `budget_reached`; it is not terminated, and its history and sandbox are preserved like any other idle session's. On the [event stream](https://platform.claude.com/docs/en/managed-agents/events-and-streaming) you'll see, in order:
 
@@ -401,7 +401,13 @@ The cap is copied onto each session the deployment starts, so it bounds each run
 
 ## Models without a list price
 
-A budget can only track consumption the platform can price. Creating a budgeted session whose agent, or any agent listed in the `predefined_agents` (java, php: `predefinedAgents`; csharp, go: `PredefinedAgents`) list of `subagents` (csharp, go: `Subagents`) or `workflows` (csharp, go: `Workflows`), or the advisor set in its [multiagent configuration](https://platform.claude.com/docs/en/managed-agents/multiagent-orchestration), uses a model with no public list price is rejected with a 400 error stating that no list price is available for the model.
+A budget can only track consumption the platform can price. Creating a budgeted session is rejected with a 400 error if any of the following uses a model with no public list price:
+
+* The session's agent
+* Any agent listed in the `predefined_agents` (java, php: `predefinedAgents`; csharp, go: `PredefinedAgents`) list of `subagents` (csharp, go: `Subagents`) or `workflows` (csharp, go: `Workflows`)
+* The advisor set in the agent's [multiagent configuration](https://platform.claude.com/docs/en/managed-agents/multiagent-orchestration)
+
+The error states that no list price is available for the model.
 
 If a budgeted session's usage comes to include a model with no list price, the budget can no longer measure the session's spend: the session can pause with a `stop_reason` (java, php: `stopReason`; csharp, go: `StopReason`) of `budget_reached`, and changing the budget is rejected. Remove the budget to resume the session.
 
diff --git a/content/en/managed-agents/define-outcomes.md b/content/en/managed-agents/define-outcomes.md
index d142f9d60e..ea9ebc4f38 100644
--- a/content/en/managed-agents/define-outcomes.md
+++ b/content/en/managed-agents/define-outcomes.md
@@ -548,7 +548,7 @@ This is the event you send to initiate an outcome. It is echoed back on receipt,
 
 Emitted once the grader starts an evaluation over one iteration loop. The `iteration` field is a 0-indexed revision counter: `0` is the first evaluation, `1` is the re-evaluation after the first revision, and so on.
 
-```text wrap
+```json
 {
   "type": "span.outcome_evaluation_start",
   "id": "sevt_01def...",
@@ -562,7 +562,7 @@ Emitted once the grader starts an evaluation over one iteration loop. The `itera
 
 Heartbeat emitted while the grader runs. The grader's internal reasoning is opaque: the event shows only that the grader is working.
 
-```text wrap
+```json
 {
   "type": "span.outcome_evaluation_ongoing",
   "id": "sevt_01ghi...",
@@ -584,7 +584,7 @@ Emitted when an outcome evaluation cycle ends: after the grader finishes evaluat
 | `failed`                 | Session transitions to `idle`. Returned when the rubric does not apply to the deliverables, for example if the description and rubric contradict each other.                                                              |
 | `interrupted`            | Emitted when the session is interrupted while an outcome is active, even if evaluation hadn't started yet. If no `outcome_evaluation_start` fired before the interrupt, `outcome_evaluation_start_id` is an empty string. |
 
-```text
+```json
 {
   "type": "span.outcome_evaluation_end",
   "id": "sevt_01jkl...",
diff --git a/content/en/managed-agents/dreams.md b/content/en/managed-agents/dreams.md
index a8aee37f2d..6109214f9d 100644
--- a/content/en/managed-agents/dreams.md
+++ b/content/en/managed-agents/dreams.md
@@ -154,7 +154,7 @@ Dreaming inputs include the pre-existing memory store and an array of sessions.
 
 The response is the full `dream` resource with `status: "pending"`:
 
-```text
+```json
 {
   "type": "dream",
   "id": "drm_01AbCDefGhIjKlMnOpQrStUv",
@@ -215,7 +215,7 @@ Dreams run asynchronously and typically take minutes to a few hours, driven by t
 
   ```typescript TypeScript
   while (dream.status === "pending" || dream.status === "running") {
-    await sleep(10_000);
+    await new Promise((resolve) => setTimeout(resolve, 10_000));
     dream = await client.beta.dreams.retrieve(dream.id);
     console.log(`status=${dream.status} input_tokens=${dream.usage.input_tokens}`);
   }
diff --git a/content/en/managed-agents/environments.md b/content/en/managed-agents/environments.md
index ba91c1f7fe..ded52458f7 100644
--- a/content/en/managed-agents/environments.md
+++ b/content/en/managed-agents/environments.md
@@ -347,7 +347,6 @@ The `packages` (csharp, go: `Packages`) field pre-installs packages into the san
   if err != nil {
   	panic(err)
   }
-  _ = environment
   ```
 
   ```java Java
@@ -533,7 +532,6 @@ The following example creates an environment with `limited` networking:
   if err != nil {
   	panic(err)
   }
-  _ = environment
   ```
 
   ```java Java
@@ -613,7 +611,7 @@ When `allow_package_managers` (java, php: `allowPackageManagers`; csharp, go: `A
 | Containers   | `registry-1.docker.io`, `auth.docker.io`, `production.cloudflare.docker.com`, `download.docker.com`, `ghcr.io`                                                                             |
 
 <Warning>
-  Network access is granted for each host, not for each operation. The sandbox can send any request to an allowed host, including uploads such as `git push` and package publishing, with any credential the command supplies. If the agent processes untrusted input (repository files, fetched web content, or third-party tool output), a successful prompt injection could use an allowed host to copy files out of the sandbox. To reduce this risk, set the `bash` tool's [permission policy](https://platform.claude.com/docs/en/managed-agents/permission-policies) to `always_ask` or `auto`. If the environment does not specify `packages` (csharp, go: `Packages`), you can instead leave `allow_package_managers` (java, php: `allowPackageManagers`; csharp, go: `AllowPackageManagers`) set to `false` and list only the hosts your agent needs in `allowed_hosts` (java, php: `allowedHosts`; csharp, go: `AllowedHosts`).
+  Network access is granted by host, not by operation. The sandbox can send any request to an allowed host, including uploads such as `git push` and package publishing, with any credential the command supplies. If the agent processes untrusted input (repository files, fetched web content, or third-party tool output), a successful prompt injection could use an allowed host to copy files out of the sandbox. To reduce this risk, set the `bash` tool's [permission policy](https://platform.claude.com/docs/en/managed-agents/permission-policies) to `always_ask` or `auto`. If the environment does not specify `packages` (csharp, go: `Packages`), you can instead leave `allow_package_managers` (java, php: `allowPackageManagers`; csharp, go: `AllowPackageManagers`) set to `false` and list only the hosts your agent needs in `allowed_hosts` (java, php: `allowedHosts`; csharp, go: `AllowedHosts`).
 </Warning>
 
 #### Risks of unrestricted networking
diff --git a/content/en/managed-agents/event-deltas.md b/content/en/managed-agents/event-deltas.md
index d911e1b114..213890417c 100644
--- a/content/en/managed-agents/event-deltas.md
+++ b/content/en/managed-agents/event-deltas.md
@@ -31,7 +31,7 @@ A subagent's previews appear on [that subagent's own thread stream](https://plat
 
 When a previewed event starts, the stream emits an `event_start` carrying the upcoming event's type and `id`:
 
-```text wrap
+```json
 {
   "type": "event_start",
   "event": {
@@ -43,7 +43,7 @@ When a previewed event starts, the stream emits an `event_start` carrying the up
 
 For `agent.message`, the start is followed by `event_delta` events carrying incremental text. Each delta names the event it extends in `event_id` and the content block it extends in `delta.index`:
 
-```text wrap
+```json
 {
   "type": "event_delta",
   "event_id": "sevt_01abc...",
diff --git a/content/en/managed-agents/events-and-streaming.md b/content/en/managed-agents/events-and-streaming.md
index b9deb143c5..34d245d132 100644
--- a/content/en/managed-agents/events-and-streaming.md
+++ b/content/en/managed-agents/events-and-streaming.md
@@ -692,10 +692,8 @@ The following example answers each call as it arrives:
       for event in stream:
           match event.type:
               case "agent.custom_tool_use":
-                  # Run the tool
                   result = call_tool(event.name, event.input)
 
-                  # Send the result back
                   client.beta.sessions.events.send(
                       session.id,
                       events=[
@@ -717,10 +715,8 @@ The following example answers each call as it arrives:
   loop: for await (const event of stream) {
     switch (event.type) {
       case "agent.custom_tool_use": {
-        // Run the tool
         const result = await callTool(event.name, event.input);
 
-        // Send the result back
         await client.beta.sessions.events.send(session.id, {
           events: [
             {
@@ -746,10 +742,8 @@ The following example answers each call as it arrives:
   {
       if (streamEvent.Value is BetaManagedAgentsAgentCustomToolUseEvent toolUse)
       {
-          // Run the tool
           var result = await CallTool(toolUse.Name, toolUse.Input);
 
-          // Send the result back
           await client.Beta.Sessions.Events.Send(session.ID, new()
           {
               Events =
@@ -778,9 +772,7 @@ The following example answers each call as it arrives:
   	for stream.Next() {
   		switch event := stream.Current().AsAny().(type) {
   		case anthropic.BetaManagedAgentsAgentCustomToolUseEvent:
-  			// Run the tool
   			result := callTool(event.Name, event.Input)
-  			// Send the result back
   			if _, err := client.Beta.Sessions.Events.Send(ctx, session.ID, anthropic.BetaSessionEventSendParams{
   				Events: []anthropic.BetaManagedAgentsEventParamsUnion{{
   					OfUserCustomToolResult: &anthropic.BetaManagedAgentsUserCustomToolResultEventParams{
@@ -812,11 +804,9 @@ The following example answers each call as it arrives:
       for (var event : (Iterable<BetaManagedAgentsStreamSessionEvents>) stream.stream()::iterator) {
           switch (event.type().value()) {
               case AGENT_CUSTOM_TOOL_USE -> {
-                  // Run the tool
                   var toolUse = event.asAgentCustomToolUse();
                   var result = callTool(toolUse.name(), toolUse.input());
 
-                  // Send the result back
                   client.beta().sessions().events().send(
                       session.id(),
                       EventSendParams.builder()
@@ -842,10 +832,8 @@ The following example answers each call as it arrives:
   foreach ($stream as $event) {
       switch (true) {
           case $event instanceof \Anthropic\Beta\Sessions\Events\ManagedAgentsAgentCustomToolUseEvent:
-              // Run the tool
               $result = callTool($event->name, $event->input);
 
-              // Send the result back
               $client->beta->sessions->events->send(
                   $session->id,
                   events: [
@@ -870,9 +858,7 @@ The following example answers each call as it arrives:
   client.beta.sessions.events.stream_events(session.id).each do |event|
     case event
     when Anthropic::Beta::Sessions::BetaManagedAgentsAgentCustomToolUseEvent
-      # Run the tool
       result = call_tool.call(event.name, event.input)
-      # Send the result back
       client.beta.sessions.events.send_(
         session.id,
         events: [
@@ -914,7 +900,6 @@ The following example approves every pending call:
               match stop_reason.type:
                   case "requires_action":
                       for event_id in stop_reason.event_ids:
-                          # Approve the pending tool call
                           client.beta.sessions.events.send(
                               session.id,
                               events=[
@@ -944,7 +929,6 @@ The following example approves every pending call:
     }
 
     for (const eventId of event.stop_reason.event_ids) {
-      // Approve the pending tool call
       await client.beta.sessions.events.send(session.id, {
         events: [
           {
@@ -967,7 +951,6 @@ The following example approves every pending call:
       {
           foreach (var eventId in requiresAction.EventIds)
           {
-              // Approve the pending tool call
               await client.Beta.Sessions.Events.Send(session.ID, new()
               {
                   Events =
@@ -1001,7 +984,6 @@ The following example approves every pending call:
   		switch stopReason := event.StopReason.AsAny().(type) {
   		case anthropic.BetaManagedAgentsSessionRequiresAction:
   			for _, eventID := range stopReason.EventIDs {
-  				// Approve the pending tool call
   				if _, err := client.Beta.Sessions.Events.Send(ctx, session.ID, anthropic.BetaSessionEventSendParams{
   					Events: []anthropic.BetaManagedAgentsEventParamsUnion{{
   						OfUserToolConfirmation: &anthropic.BetaManagedAgentsUserToolConfirmationEventParams{
@@ -1030,7 +1012,6 @@ The following example approves every pending call:
           .takeWhile(stopReason -> !stopReason.isEndTurn())
           .filter(stopReason -> stopReason.isRequiresAction())
           .flatMap(stopReason -> stopReason.asRequiresAction().eventIds().stream())
-          // Approve each pending tool call
           .forEach(toolUseId -> client.beta().sessions().events().send(
               session.id(),
               EventSendParams.builder()
@@ -1050,7 +1031,6 @@ The following example approves every pending call:
           switch (true) {
               case $event->stopReason instanceof \Anthropic\Beta\Sessions\Events\ManagedAgentsSessionRequiresAction:
                   foreach ($event->stopReason->eventIDs as $eventId) {
-                      // Approve the pending tool call
                       $client->beta->sessions->events->send(
                           $session->id,
                           events: [
@@ -1078,7 +1058,6 @@ The following example approves every pending call:
       case stop_reason
       when Anthropic::Beta::Sessions::BetaManagedAgentsSessionRequiresAction
         stop_reason.event_ids.each do |event_id|
-          # Approve the pending tool call
           client.beta.sessions.events.send_(
             session.id,
             events: [
diff --git a/content/en/managed-agents/permission-policies.md b/content/en/managed-agents/permission-policies.md
index 619746b938..bb673d6d68 100644
--- a/content/en/managed-agents/permission-policies.md
+++ b/content/en/managed-agents/permission-policies.md
@@ -142,7 +142,6 @@ When creating an agent, you can apply a policy to every tool in `agent_toolset_2
   if err != nil {
   	panic(err)
   }
-  _ = agent
   ```
 
   ```java Java
@@ -358,7 +357,6 @@ This example connects a GitHub MCP server and allows its tools to run without co
   if err != nil {
   	panic(err)
   }
-  _ = agent
   ```
 
   ```java Java
@@ -567,7 +565,6 @@ Use the `configs` (csharp, go: `Configs`) array to override the default for indi
   		}},
   	},
   }}
-  _ = tools
   ```
 
   ```java Java
@@ -849,7 +846,6 @@ The following example sets `auto` as the default for the agent toolset and for t
   if err != nil {
   	panic(err)
   }
-  _ = agent
   ```
 
   ```java Java
@@ -974,7 +970,7 @@ Under any permission policy, each `agent.tool_use` and `agent.mcp_tool_use` even
 
 For example, when `bash` is under `auto` and the server evaluates a call as high-risk, the denied call appears on the event stream as follows:
 
-```text wrap
+```json
 {
   "type": "agent.tool_use",
   "id": "sevt_01pqr...",
@@ -1021,7 +1017,7 @@ A tool call evaluates to `ask` under an `always_ask` policy, or under `auto` whe
 
 For example, a `bash` call paused under an `always_ask` policy appears on the stream as follows:
 
-```text wrap
+```json
 {
   "type": "agent.tool_use",
   "id": "sevt_01def...",
diff --git a/content/en/managed-agents/scheduled-deployments.md b/content/en/managed-agents/scheduled-deployments.md
index 310bd3f1fa..dfead8ac64 100644
--- a/content/en/managed-agents/scheduled-deployments.md
+++ b/content/en/managed-agents/scheduled-deployments.md
@@ -221,7 +221,7 @@ When creating a deployment, you pass the [session configurations](https://platfo
 
 The response includes a deployment object with a populated `schedule.upcoming_runs_at` with the next upcoming fire times, to confirm your schedule was set correctly.
 
-```text wrap
+```json
 {
   "id": "depl_01xyz",
   "status": "active",
@@ -574,7 +574,7 @@ You can additionally filter on deployment runs with errors:
 
 A failed run includes an `error` with a `type` describing why session creation was rejected (for example, `environment_archived_error`, `agent_archived_error`, or `session_rate_limited_error`). See the [List Deployment Runs](https://platform.claude.com/docs/en/api/beta/deployment_runs/list) reference for all filter parameters and the response schema.
 
-```text
+```json
 {
   "type": "deployment_run",
   "id": "drun_01abc124",
diff --git a/content/en/managed-agents/secure-deployment.md b/content/en/managed-agents/secure-deployment.md
index cb0d81ae01..ccddbde526 100644
--- a/content/en/managed-agents/secure-deployment.md
+++ b/content/en/managed-agents/secure-deployment.md
@@ -155,7 +155,6 @@ The examples on this page use a support agent. It reads a customer's ticket, loo
   if err != nil {
   	panic(err)
   }
-  _ = environment
   ```
 
   ```java Java
@@ -212,7 +211,7 @@ The `allow_package_managers` (java, php: `allowPackageManagers`; csharp, go: `Al
 Leave `allow_mcp_servers` (java: `allowMcpServers`; php: `allowMCPServers`; csharp: `AllowMcpServers`; go: `AllowMCPServers`) off, which is the default, and list the host of each MCP server you operate or trust in `allowed_hosts` (java, php: `allowedHosts`; csharp, go: `AllowedHosts`). Each host you list is also open to code in the sandbox. With `allow_mcp_servers` (java: `allowMcpServers`; php: `allowMCPServers`; csharp: `AllowMcpServers`; go: `AllowMCPServers`) off, a check at session creation rejects the request if an MCP server's host is not listed. See [Provide authentication at session creation](https://platform.claude.com/docs/en/managed-agents/mcp-connector#provide-authentication-at-session-creation). The same check runs when a session update changes `mcp_servers` (java, php: `mcpServers`; csharp: `McpServers`; go: `MCPServers`).
 
 <Warning>
-  Network access is granted for each host, not for each operation. The sandbox can send any request to an allowed host, including uploads such as `git push` and package publishing. It can also use any credential the command supplies, even one that someone hid in text the agent reads.
+  Network access is granted by host, not by operation. The sandbox can send any request to an allowed host, including uploads such as `git push` and package publishing. It can also use any credential the command supplies, even one that someone hid in text the agent reads.
 </Warning>
 
 When you choose hosts for `allowed_hosts` (java, php: `allowedHosts`; csharp, go: `AllowedHosts`), follow these two rules:
@@ -613,7 +612,6 @@ The following sample limits `web_fetch` to `help.example.com` with `allowed_doma
   		},
   	},
   }}
-  _ = tools
   ```
 
   ```java Java
diff --git a/content/en/managed-agents/self-hosted-sandboxes-operations.md b/content/en/managed-agents/self-hosted-sandboxes-operations.md
index b236cd0449..209299c16e 100644
--- a/content/en/managed-agents/self-hosted-sandboxes-operations.md
+++ b/content/en/managed-agents/self-hosted-sandboxes-operations.md
@@ -140,7 +140,7 @@ The monitoring calls on this page run from your monitoring or operations tooling
   ```
 </CodeGroup>
 
-```text wrap
+```json
 {
   "type": "work_queue_stats",
   "depth": 0,
diff --git a/content/en/managed-agents/session-observability.md b/content/en/managed-agents/session-observability.md
index cc83a6635f..55d3181413 100644
--- a/content/en/managed-agents/session-observability.md
+++ b/content/en/managed-agents/session-observability.md
@@ -38,7 +38,7 @@ With `ant beta:sessions connect`, you can open the same viewer from the `ant` CL
 
 The session object includes a `usage` field with the session's cumulative usage: token counts, server tool use, active time, and the tracked list cost. Fetch the session after it goes idle to read the latest totals.
 
-```text wrap
+```json
 {
   "id": "sesn_01...",
   "status": "idle",
diff --git a/content/en/managed-agents/session-operations.md b/content/en/managed-agents/session-operations.md
index 12bc043c26..12ce124fd2 100644
--- a/content/en/managed-agents/session-operations.md
+++ b/content/en/managed-agents/session-operations.md
@@ -196,7 +196,7 @@ The session must be `idle` to update the agent. To update the agent while the se
 
 ## Updating the session budget
 
-A session [created with a budget](https://platform.claude.com/docs/en/managed-agents/sessions#set-a-session-budget) accepts two kinds of budget update: replacing the cap with a new `max_list_cost` (java, php: `maxListCost`; csharp, go: `MaxListCost`), and removing it by passing `"budget": null` (python: `budget=None`; typescript: `budget: null`; ruby: `budget: nil`; go: `Budget: param.NullStruct[anthropic.BetaManagedAgentsBudgetLimitParam]()`; java: `.budget(Optional.empty())`; csharp: `Budget = null`; php: `requestOptions: ['extraBodyParams' => ['budget' => null]]`; cli: `--budget null`). Both automatically resume work that paused when the session reached its cap. A replacement cap can be higher or lower than the current one, but it must be strictly greater than the session's consumed list cost, and removal is one-way: a non-null `budget` (csharp, go: `Budget`) is accepted only on a session that currently has one, so you can't re-add a removed budget or add one to a session created without it. See [Session budgets](https://platform.claude.com/docs/en/managed-agents/budgets#resume-a-session-at-its-budget) for request examples, the error behaviors, and what counts toward list cost.
+A session [created with a budget](https://platform.claude.com/docs/en/managed-agents/sessions#set-a-session-budget) accepts two kinds of budget update: replacing the cap with a new `max_list_cost` (java, php: `maxListCost`; csharp, go: `MaxListCost`), and removing it by passing `"budget": null` (python: `budget=None`; typescript: `budget: null`; ruby: `budget: nil`; go: `Budget: param.NullStruct[anthropic.BetaManagedAgentsBudgetLimitParam]()`; java: `.budget(Optional.empty())`; csharp: `Budget = null`; php: `requestOptions: ['extraBodyParams' => ['budget' => null]]`; cli: `--budget null`). Both automatically resume work that paused when the session reached its cap. A replacement cap can be higher or lower than the current one, but it must be strictly greater than the session's consumed list cost. Removal is one-way: a non-null `budget` (csharp, go: `Budget`) is accepted only on a session that currently has one. You therefore can't re-add a removed budget or add one to a session created without it. See [Session budgets](https://platform.claude.com/docs/en/managed-agents/budgets#resume-a-session-at-its-budget) for request examples, the error behaviors, and what counts toward list cost.
 
 ## Retrieving a session
 
diff --git a/content/en/managed-agents/session-threads.md b/content/en/managed-agents/session-threads.md
index cf41f590ff..a7b2dae4a9 100644
--- a/content/en/managed-agents/session-threads.md
+++ b/content/en/managed-agents/session-threads.md
@@ -256,7 +256,7 @@ Optionally archive a session thread when it has completed its work. Archiving a
   ```
 </CodeGroup>
 
-Archive only succeeds if the thread is `idle`. A thread parked on `requires_action` counts as idle and can be archived directly; only a running thread must be interrupted first:
+Archive only succeeds if the thread is `idle`. A thread parked on `requires_action` counts as idle, so you can archive it directly. To archive a running thread, interrupt it first:
 
 <CodeGroup>
   ```bash cURL
@@ -655,7 +655,7 @@ A thread's stream doesn't replay earlier events. Right after `session.thread_cre
 
 If a subagent needs something from your client, such as [permission](https://platform.claude.com/docs/en/managed-agents/events-and-streaming#tool-confirmation) to run a tool call or the [result of a custom tool](https://platform.claude.com/docs/en/managed-agents/events-and-streaming#handling-custom-tool-calls), the event is cross-posted to the **primary thread** with `session_thread_id` identifying the originating session thread. A tool call needs your permission under `always_ask`, or under [`auto`](https://platform.claude.com/docs/en/managed-agents/permission-policies#let-the-server-evaluate-each-call-with-auto) when the server reaches no determination.
 
-```text wrap
+```json
 {
   "type": "session.thread_status_idle",
   "id": "sevt_01ABC...",
diff --git a/content/en/managed-agents/sessions.md b/content/en/managed-agents/sessions.md
index e878b2f850..c2100eeea5 100644
--- a/content/en/managed-agents/sessions.md
+++ b/content/en/managed-agents/sessions.md
@@ -600,7 +600,7 @@ The following example starts a session that overrides the model and clears the s
 
 #### Pin the inference geo for a session
 
-Because a `model` (csharp, go: `Model`) override replaces the agent's `model` (csharp, go: `Model`) object in full, it also sets or clears the model's [inference geo](https://platform.claude.com/docs/en/manage-claude/data-residency) pin for the session: an override that includes `inference_geo` (java, php: `inferenceGeo`; csharp, go: `InferenceGeo`) pins the geography that serves the session's model requests, and one that omits it clears the agent's pin so the session follows the workspace's `default_inference_geo`. The overridden value is validated against the workspace's `allowed_inference_geos` when the session is created.
+Because a `model` (csharp, go: `Model`) override replaces the agent's `model` (csharp, go: `Model`) object in full, it also sets or clears the model's [inference geo](https://platform.claude.com/docs/en/manage-claude/data-residency) pin for the session. An override that includes `inference_geo` (java, php: `inferenceGeo`; csharp, go: `InferenceGeo`) pins the geography that serves the session's model requests. An override that omits it clears the agent's pin, so the session follows the workspace's `default_inference_geo`. The overridden value is validated against the workspace's `allowed_inference_geos` when the session is created.
 
 The following example starts a session from an agent whose model has no geo pin, and pins the session's model requests to US inference by including `inference_geo` (java, php: `inferenceGeo`; csharp, go: `InferenceGeo`) in the `model` (csharp, go: `Model`) override. The response echoes the value in `agent.model` (csharp, go: `Agent.Model`):
 
@@ -967,7 +967,7 @@ If your agent uses MCP tools that require authentication, pass `vault_ids` (java
 
 ## Starting the session
 
-Creating a session without `initial_events` (java, php: `initialEvents`; csharp, go: `InitialEvents`) registers the session but does not start any work; the environment's sandbox starts provisioning as soon as the session is created, so the first tool call does not wait on it. To delegate a task, send events to the session using a [user event](https://platform.claude.com/docs/en/managed-agents/reference#event-types). To supply the first event in the create request instead, see [Seed the session with initial events](https://platform.claude.com/docs/en/managed-agents/sessions#seed-the-session-with-initial-events). The session acts as a state machine that tracks progress while events drive the actual execution.
+Creating a session without `initial_events` (java, php: `initialEvents`; csharp, go: `InitialEvents`) registers the session but does not start any work; the environment's sandbox starts provisioning as soon as the session is created, so the first tool call does not wait on it. To delegate a task, send events to the session using a [user event](https://platform.claude.com/docs/en/managed-agents/reference#event-types). To supply the first event in the create request instead, see [Seed the session with initial events](https://platform.claude.com/docs/en/managed-agents/sessions#seed-the-session-with-initial-events). The session acts as a state machine that tracks progress, and events drive the actual execution.
 
 <CodeGroup>
   ```bash cURL
diff --git a/content/en/managed-agents/skills.md b/content/en/managed-agents/skills.md
index 4c6d448e70..3a9fcab6dc 100644
--- a/content/en/managed-agents/skills.md
+++ b/content/en/managed-agents/skills.md
@@ -330,7 +330,6 @@ Each entry in the `skills` (csharp, go: `Skills`) array uses the following field
   if err != nil {
   	panic(err)
   }
-  _ = agent
   ```
 
   ```java Java
@@ -386,7 +385,7 @@ Each entry in the `skills` (csharp, go: `Skills`) array uses the following field
 Skills can also live in your code base. When a session mounts a repository through the [`github_repository` resource](https://platform.claude.com/docs/en/managed-agents/github), the repository's root `.claude/skills` directory is scanned at session start, and each skill found there becomes available to the agent. No upload and no entry in the agent's `skills` (csharp, go: `Skills`) array are required. The agent receives each discovered skill's name, description, and path in the sandbox, and reads the skill's `SKILL.md` when a task matches, including any scripts and resources the skill ships. Discovery relies on the agent's `read` tool from the [agent toolset](https://platform.claude.com/docs/en/managed-agents/tools), which is enabled by default; an agent with `read` disabled doesn't load repository skills.
 
 <Warning>
-  Repository skills are agent instructions, so a mounted repository is part of your agent's trust boundary. Anyone who can commit to the repository (a merged external pull request, a compromised dependency, a contributor) can add or change a skill, the platform loads it at session start without a review step, and session tools such as `bash` and `web_fetch` give those instructions real reach. Mount only repositories you trust, and review `.claude/skills` before mounting a repository that accepts outside contributions.
+  Repository skills are agent instructions, so a mounted repository is part of your agent's trust boundary. Anyone who can commit to the repository (a merged external pull request, a compromised dependency, a contributor) can add or change a skill. The platform loads that skill at session start without a review step, and session tools such as `bash` and `web_fetch` give its instructions real reach. Mount only repositories you trust, and review `.claude/skills` before mounting a repository that accepts outside contributions.
 </Warning>
 
 <Note>
diff --git a/content/en/managed-agents/tools.md b/content/en/managed-agents/tools.md
index 974981d047..3914f6621f 100644
--- a/content/en/managed-agents/tools.md
+++ b/content/en/managed-agents/tools.md
@@ -147,7 +147,6 @@ The following example enables the toolset and disables `web_fetch`:
   if err != nil {
   	panic(err)
   }
-  _ = agent
   ```
 
   ```java Java
@@ -406,7 +405,6 @@ The following example creates an agent with the built-in toolset and one custom
   if err != nil {
   	panic(err)
   }
-  _ = agent
   ```
 
   ```java Java
diff --git a/content/en/managed-agents/vaults.md b/content/en/managed-agents/vaults.md
index ab82530bde..42306b796e 100644
--- a/content/en/managed-agents/vaults.md
+++ b/content/en/managed-agents/vaults.md
@@ -115,7 +115,7 @@ A vault is the collection of `credentials` associated with an end user. Give it
 
 The response is the full vault record:
 
-```text wrap
+```json
 {
   "type": "vault",
   "id": "vlt_01ABC...",
@@ -442,7 +442,6 @@ To get the same behavior with a self-hosted sandbox, you can run your own proxy
       if err != nil {
       	panic(err)
       }
-      _ = bearerCredential
       ```
 
       ```java Java
@@ -1064,7 +1063,7 @@ The top-level `status` (csharp, go: `Status`) tells you what to do next:
 
 The response is a `vault_credential_validation` object. `mcp_probe` includes the failed MCP handshake step; `refresh` includes the outcome of the attempted refresh.
 
-```text wrap
+```json
 {
   "type": "vault_credential_validation",
   "credential_id": "vcrd_01ABC...",
diff --git a/content/en/managed-agents/workflow-runs.md b/content/en/managed-agents/workflow-runs.md
index 4276e2292b..77afbaafae 100644
--- a/content/en/managed-agents/workflow-runs.md
+++ b/content/en/managed-agents/workflow-runs.md
@@ -85,7 +85,7 @@ For example, you ask the [contract-review agent](https://platform.claude.com/doc
 
 The run's first event lists its phases:
 
-```text
+```json
 {
   "type": "workflow_run.created",
   "id": "sevt_01abc...",
@@ -106,7 +106,7 @@ The run's first event lists its phases:
 
 Each phase event names its phase by `workflow_run_phase_id`. That is an `id` in `phases`, but the API doesn't guarantee it:
 
-```text wrap
+```json
 {
   "type": "workflow_run.phase_started",
   "id": "sevt_01def...",
@@ -118,7 +118,7 @@ Each phase event names its phase by `workflow_run_phase_id`. That is an `id` in
 
 The run's last event reports how it ended:
 
-```text wrap
+```json
 {
   "type": "workflow_run.status_ended",
   "id": "sevt_01ghi...",
diff --git a/content/en/models/fable-5-1/migration-guide.md b/content/en/models/fable-5-1/migration-guide.md
index a06f62a3a1..fa044e7ba3 100644
--- a/content/en/models/fable-5-1/migration-guide.md
+++ b/content/en/models/fable-5-1/migration-guide.md
@@ -40,7 +40,15 @@ Where the two models diverge:
 
 ## Migrating to Claude Fable 5.1 from Claude Fable 5
 
-Migration is mostly drop-in. The API surface, limits, per-token pricing, tokenizer, always-on adaptive thinking, refusal handling, and `stop_details` categories all match Claude Fable 5. What changes: forced tool choice returns a 400 error; only Claude Fable 5.1 and Claude Mythos 5.1 read Claude Fable 5.1's thinking blocks, and only in the conversation that produced them; cache reads cost less; the advisor tool (beta) accepts fewer advisors; and agent-loop behavior differs in three ways. The same changes apply to the [Claude Mythos 5.1 migration](https://platform.claude.com/docs/en/models/fable-5-1/migration-guide#migrating-from-claude-mythos-5-to-claude-mythos-5-1), except the conversation check on thinking blocks, which Claude Mythos 5.1 doesn't run.
+Migration is mostly drop-in. The API surface, limits, per-token pricing, tokenizer, always-on adaptive thinking, refusal handling, and `stop_details` categories all match Claude Fable 5. The following changes apply:
+
+* Forced tool choice returns a 400 error.
+* Only Claude Fable 5.1 and Claude Mythos 5.1 read Claude Fable 5.1's thinking blocks, and only in the conversation that produced them.
+* Cache reads cost less.
+* The advisor tool (beta) accepts fewer advisors.
+* Agent-loop behavior differs in three ways.
+
+The same changes apply to the [Claude Mythos 5.1 migration](https://platform.claude.com/docs/en/models/fable-5-1/migration-guide#migrating-from-claude-mythos-5-to-claude-mythos-5-1), except the conversation check on thinking blocks, which Claude Mythos 5.1 doesn't run.
 
 ### Update your model name
 
@@ -1512,7 +1520,7 @@ These changes aren't required, but each one lowers cost or latency or removes a
 * If you use the [advisor tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/advisor-tool) (beta), update the advisor `model` as well. An advisor less capable than Claude Fable 5.1, such as `claude-fable-5` or `claude-opus-5-5`, returns a 400 error.
 * Keep passing `thinking` blocks back unchanged on every turn, including empty ones. Claude Fable 5.1 reads blocks from Claude Opus 5, Claude Fable 5, Claude Mythos 5, and earlier models. Moving a conversation from Claude Fable 5.1 to any model other than Claude Mythos 5.1 drops its blocks.
 * If your code builds the `messages` array itself, check whether it [edits earlier turns](https://platform.claude.com/docs/en/models/fable-5-1/migration-guide#fable-5-1-preserved-thinking): run a session with the `thinking-binding-controls-2026-08-01` beta header and `prefix_mismatch_behavior: "drop_block"`, log `input_transformations`, and fix every `prefix_binding_mismatch`. `model_binding_mismatch` entries after a model switch are expected.
-* Keep conversation history append-only: freeze `system` and `tools` at session start and move mid-session changes to `role: "system"` messages and `tool_addition` / `tool_removal` blocks, send per-turn reminders as turn-scoped system messages you never remove, trim context server-side or strip thinking blocks from any turns you carry across a client-side summary, and reference cross-turn files by `file_id`.
+* Keep conversation history append-only. Freeze `system` and `tools` at session start, and move mid-session changes to `role: "system"` messages and `tool_addition` / `tool_removal` blocks. Send per-turn reminders as turn-scoped system messages you never remove. Trim context server-side, or strip thinking blocks from any turns you carry across a client-side summary. Reference cross-turn files by `file_id`.
 * Pick a production `prefix_mismatch_behavior` (`"error"` by default, or `"drop_block"`) and monitor it. If you maintain a tool that others run with their own API key, test with the field set: new accounts are enforced by default even if yours isn't.
 * Review agent loops for one-tool-call-per-turn behavior and add the batching instruction.
 * If your interface renders progress text between tool calls, set `thinking.display` to `"updates"` (beta) or `"summarized"` and prompt for updates.
@@ -1593,7 +1601,13 @@ model = "claude-mythos-5-1"  # After
 
 [Claude Mythos 5.1](https://platform.claude.com/docs/en/models/mythos-5-1/overview) is the counterpart to Claude Fable 5.1 for organizations verified through Anthropic's verification programs, such as the [Cyber Verification Program](https://support.claude.com/en/articles/14604842). Confirm that your organization has access to Claude Mythos 5.1 before you switch model IDs.
 
-The API-level delta matches [Migrating to Claude Fable 5.1 from Claude Fable 5](https://platform.claude.com/docs/en/models/fable-5-1/migration-guide#migrating-from-claude-fable-5-to-claude-fable-5-1): forced tool choice returns a 400 error, the advisor tool accepts fewer advisors, and only Claude Mythos 5.1 and Claude Fable 5.1 read Claude Mythos 5.1's thinking blocks (Claude Mythos 5.1 reads Claude Mythos 5's blocks, not the reverse). Unlike Claude Fable 5.1, Claude Mythos 5.1 doesn't run the conversation check, so editing earlier turns doesn't [invalidate thinking blocks](https://platform.claude.com/docs/en/models/fable-5-1/migration-guide#fable-5-1-preserved-thinking), though it still restarts the prompt cache.
+The API-level delta matches [Migrating to Claude Fable 5.1 from Claude Fable 5](https://platform.claude.com/docs/en/models/fable-5-1/migration-guide#migrating-from-claude-fable-5-to-claude-fable-5-1):
+
+* Forced tool choice returns a 400 error.
+* The advisor tool accepts fewer advisors.
+* Only Claude Mythos 5.1 and Claude Fable 5.1 read Claude Mythos 5.1's thinking blocks (Claude Mythos 5.1 reads Claude Mythos 5's blocks, not the reverse).
+
+Unlike Claude Fable 5.1, Claude Mythos 5.1 doesn't run the conversation check, so editing earlier turns doesn't [invalidate thinking blocks](https://platform.claude.com/docs/en/models/fable-5-1/migration-guide#fable-5-1-preserved-thinking), though it still restarts the prompt cache.
 
 ### Update your model name
 
diff --git a/content/en/models/fable-5-1/overview.md b/content/en/models/fable-5-1/overview.md
index 5f84b107e5..65af9512b6 100644
--- a/content/en/models/fable-5-1/overview.md
+++ b/content/en/models/fable-5-1/overview.md
@@ -18,7 +18,20 @@ Context window: 1M tokens · Max output: 128K tokens · Input pricing: $10 / MTo
 
 Claude Fable 5.1 extends Claude Fable 5 at the same input and output prices, with cache reads at a quarter of the cost, and brings stronger long-running agentic coding, multistep research, and document, spreadsheet, and slide work. For most workloads, start with Claude Opus 5.5 (see [Choosing a model](https://platform.claude.com/docs/en/about-claude/models/choosing-a-model)). Use Claude Fable 5.1 for demanding reasoning and long-horizon agentic work, or when your evals on Claude Opus 5.5 at higher effort still don't meet your requirements. Claude Mythos 5.1 offers the same capabilities only to organizations verified through Anthropic's verification programs, such as the [Cyber Verification Program](https://support.claude.com/en/articles/14604842).
 
-If you already call Claude Fable 5, four changes are breaking: [forced tool use returns an error](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#forced-tool-use-is-not-supported), only Claude Fable 5.1 and Claude Mythos 5.1 can [read Claude Fable 5.1's thinking blocks](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#thinking-blocks-are-tied-to-the-model-that-produced-them), [editing earlier turns invalidates thinking blocks](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#editing-earlier-turns-invalidates-thinking-blocks), and [some advisor tool pairings are not supported](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#advisor-tool-pairings). Five are additive: [mid-conversation effort changes](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#change-effort-mid-conversation-beta) (beta), [turn-scoped system messages](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#turn-scoped-system-messages-beta) (beta), [readable progress updates between tool calls](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#progress-updates-between-tool-calls-beta) (`display: "updates"`, beta), a [lower cache read price](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#pricing), and [content provenance](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#content-provenance).
+If you already call Claude Fable 5, four changes are breaking:
+
+* [Forced tool use returns an error](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#forced-tool-use-is-not-supported).
+* Only Claude Fable 5.1 and Claude Mythos 5.1 can [read Claude Fable 5.1's thinking blocks](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#thinking-blocks-are-tied-to-the-model-that-produced-them).
+* [Editing earlier turns invalidates thinking blocks](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#editing-earlier-turns-invalidates-thinking-blocks).
+* [Some advisor tool pairings are not supported](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#advisor-tool-pairings).
+
+Five changes are additive:
+
+* [Mid-conversation effort changes](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#change-effort-mid-conversation-beta) (beta)
+* [Turn-scoped system messages](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#turn-scoped-system-messages-beta) (beta)
+* [Readable progress updates between tool calls](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#progress-updates-between-tool-calls-beta) (`display: "updates"`, beta)
+* A [lower cache read price](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#pricing)
+* [Content provenance](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#content-provenance)
 
 [What's new in Claude Fable 5.1](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1)
 
diff --git a/content/en/models/fable-5-1/whats-new-fable-5-1.md b/content/en/models/fable-5-1/whats-new-fable-5-1.md
index 4a524d0b41..a572d63b84 100644
--- a/content/en/models/fable-5-1/whats-new-fable-5-1.md
+++ b/content/en/models/fable-5-1/whats-new-fable-5-1.md
@@ -6,7 +6,20 @@ description: Overview of new features, breaking changes, and capability improvem
 
 Claude Fable 5.1 extends Claude Fable 5 at the same input and output prices, with cache reads at a quarter of the cost, and brings stronger long-running agentic coding, multistep research, and document, spreadsheet, and slide work. For most workloads, start with Claude Opus 5.5 (see [Choosing a model](https://platform.claude.com/docs/en/about-claude/models/choosing-a-model)). Use Claude Fable 5.1 for demanding reasoning and long-horizon agentic work, or when your evals on Claude Opus 5.5 at higher effort still don't meet your requirements. Claude Mythos 5.1 offers the same capabilities only to organizations verified through Anthropic's verification programs, such as the [Cyber Verification Program](https://support.claude.com/en/articles/14604842).
 
-If you already call Claude Fable 5, four changes are breaking: [forced tool use returns an error](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#forced-tool-use-is-not-supported), only Claude Fable 5.1 and Claude Mythos 5.1 can [read Claude Fable 5.1's thinking blocks](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#thinking-blocks-are-tied-to-the-model-that-produced-them), [editing earlier turns invalidates thinking blocks](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#editing-earlier-turns-invalidates-thinking-blocks), and [some advisor tool pairings are not supported](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#advisor-tool-pairings). Five are additive: [mid-conversation effort changes](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#change-effort-mid-conversation-beta) (beta), [turn-scoped system messages](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#turn-scoped-system-messages-beta) (beta), [readable progress updates between tool calls](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#progress-updates-between-tool-calls-beta) (`display: "updates"`, beta), a [lower cache read price](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#pricing), and [content provenance](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#content-provenance).
+If you already call Claude Fable 5, four changes are breaking:
+
+* [Forced tool use returns an error](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#forced-tool-use-is-not-supported).
+* Only Claude Fable 5.1 and Claude Mythos 5.1 can [read Claude Fable 5.1's thinking blocks](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#thinking-blocks-are-tied-to-the-model-that-produced-them).
+* [Editing earlier turns invalidates thinking blocks](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#editing-earlier-turns-invalidates-thinking-blocks).
+* [Some advisor tool pairings are not supported](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#advisor-tool-pairings).
+
+Five changes are additive:
+
+* [Mid-conversation effort changes](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#change-effort-mid-conversation-beta) (beta)
+* [Turn-scoped system messages](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#turn-scoped-system-messages-beta) (beta)
+* [Readable progress updates between tool calls](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#progress-updates-between-tool-calls-beta) (`display: "updates"`, beta)
+* A [lower cache read price](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#pricing)
+* [Content provenance](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1#content-provenance)
 
 ## Models
 
diff --git a/content/en/models/opus-5-5/whats-new-opus-5-5.md b/content/en/models/opus-5-5/whats-new-opus-5-5.md
index b069f56167..8fd0aecb9f 100644
--- a/content/en/models/opus-5-5/whats-new-opus-5-5.md
+++ b/content/en/models/opus-5-5/whats-new-opus-5-5.md
@@ -72,7 +72,7 @@ With the `inline-tools-2026-09-15` beta header, a `tool_addition` block in a mid
 
 ### Compact on demand (beta)
 
-With the `compact-2026-09-04` beta header, a request that sends the top-level `compaction` parameter returns a signed `compaction` block summarizing the whole conversation, which you then send first in place of the summarized messages. It is available on the models that support compaction, Claude Opus 5.5 included. You choose when to compact, the request can run in the background, and the thinking blocks in the turns you keep can stay valid after the swap (under the conditions in [Compaction and preserved thinking](https://platform.claude.com/docs/en/build-with-claude/compaction-thinking-blocks#conditions-for-kept-thinking-to-stay-valid)), which matters on Claude Opus 5.5 because its [thinking blocks are tied to the conversation](https://platform.claude.com/docs/en/models/opus-5-5/whats-new-opus-5-5#thinking-blocks-are-tied-to-the-model-that-produced-them). See [Compaction on demand](https://platform.claude.com/docs/en/build-with-claude/compaction-on-demand) for platform availability and the full request flow.
+With the `compact-2026-09-04` beta header, a request that sends the top-level `compaction` parameter returns a signed `compaction` block summarizing the whole conversation, which you then send first in place of the summarized messages. It is available on the models that support compaction, Claude Opus 5.5 included. You choose when to compact, and the request can run in the background. Under the conditions in [Compaction and preserved thinking](https://platform.claude.com/docs/en/build-with-claude/compaction-thinking-blocks#conditions-for-kept-thinking-to-stay-valid), the thinking blocks in the turns you keep can stay valid after the swap. This matters on Claude Opus 5.5 because its [thinking blocks are tied to the conversation](https://platform.claude.com/docs/en/models/opus-5-5/whats-new-opus-5-5#thinking-blocks-are-tied-to-the-model-that-produced-them). See [Compaction on demand](https://platform.claude.com/docs/en/build-with-claude/compaction-on-demand) for platform availability and the full request flow.
 
 ## Behavior differences
 
diff --git a/content/en/models/sonnet-5-5/migration-guide.md b/content/en/models/sonnet-5-5/migration-guide.md
index 8c238fbe76..c36717517f 100644
--- a/content/en/models/sonnet-5-5/migration-guide.md
+++ b/content/en/models/sonnet-5-5/migration-guide.md
@@ -1200,7 +1200,7 @@ After (Claude Sonnet 5.5):
 
 * **About 30 percent more tokens:** Claude Sonnet 5.5 uses Claude Sonnet 5's tokenizer. Against Claude Sonnet 4.6, Claude Sonnet 4.5, and Claude Haiku 4.5, the same text produces about 30 percent more tokens, depending on the content. Recount with [token counting](https://platform.claude.com/docs/en/build-with-claude/token-counting), and revisit `max_tokens` and cost.
 * **Effort:** `xhigh` is new, and the levels are recalibrated. See [Recommended changes](https://platform.claude.com/docs/en/models/sonnet-5-5/migration-guide#recommended-changes).
-* **Images:** Claude Sonnet 5.5 uses the high-resolution image tier, up to 2,576 pixels on the long edge and 4,784 visual tokens per image. Claude Sonnet 4.6, Claude Sonnet 4.5, and Claude Haiku 4.5 stop at 1,568 pixels and 1,568 tokens. A 2000×1500 image costs about 2.5 times as many tokens on Claude Sonnet 5.5. See [Resolution and token cost](https://platform.claude.com/docs/en/build-with-claude/vision#evaluate-image-size).
+* **Images:** Claude Sonnet 5.5 uses the high-resolution image tier, up to 2,576 pixels on the long edge and up to 4,784 visual tokens for an image. Claude Sonnet 4.6, Claude Sonnet 4.5, and Claude Haiku 4.5 stop at 1,568 pixels and 1,568 tokens. A 2000×1500 image costs about 2.5 times as many tokens on Claude Sonnet 5.5. See [Resolution and token cost](https://platform.claude.com/docs/en/build-with-claude/vision#evaluate-image-size).
 
 ### Migrating from Claude Sonnet 4.5 or earlier
 
diff --git a/content/en/release-notes/overview.md b/content/en/release-notes/overview.md
index db08ad01ad..b343342ce5 100644
--- a/content/en/release-notes/overview.md
+++ b/content/en/release-notes/overview.md
@@ -15,8 +15,7 @@ The Claude Platform release notes list changes to the Claude API, the client SDK
 ### October 22, 2026
 
 * We've launched [Claude Models on Google Cloud (Anthropic managed)](https://platform.claude.com/docs/en/build-with-claude/claude-models-on-google-cloud/anthropic-managed), the Claude API operated by Anthropic and reached through your Google Cloud project. Google Cloud IAM controls access. Google Cloud Marketplace handles billing.
-
-- [Fast mode](https://platform.claude.com/docs/en/build-with-claude/fast-mode) is available for Claude Opus 5.5 on Claude Models on Google Cloud (Anthropic managed).
+* [Fast mode](https://platform.claude.com/docs/en/build-with-claude/fast-mode) is available for Claude Opus 5.5 on Claude Models on Google Cloud (Anthropic managed).
 
 ### October 21, 2026
 
@@ -30,7 +29,7 @@ The Claude Platform release notes list changes to the Claude API, the client SDK
 * [Inference hooks](https://platform.claude.com/docs/en/manage-claude/inference-hooks) are out of beta for Claude Enterprise organizations.
 * We've launched [user profiles](https://platform.claude.com/docs/en/manage-claude/user-profiles), so you can tell Anthropic which of your end customers each API request is for. If you operate a platform or gateway, or resell API access, a safety enforcement action can then apply to one end customer instead of your whole organization. The SDK and the `ant` CLI support the new [`/v1/user_profiles` endpoints](https://platform.claude.com/docs/en/api/user_profiles).
 * We've added [organization webhooks](https://platform.claude.com/docs/en/manage-claude/organization-webhooks) to the [Admin API](https://platform.claude.com/docs/en/manage-claude/admin-api), in beta with the `webhooks-2026-10-07` beta header. Its [`/v1/organizations/webhooks` endpoints](https://platform.claude.com/docs/en/api/beta/organization/webhooks) register webhook endpoints for two event types: one for when Anthropic restricts or bans one of your organization's user profiles, and one for when the restriction or ban ends. To request access, contact your Anthropic account team.
-* Organization admins can now turn off web fetch for their organization on the [**Capabilities**](https://platform.claude.com/settings/capabilities) page of the Claude Console. With web fetch off, a Messages API request that includes the web fetch tool fails with a 400 error. In a Claude Managed Agents session, `web_fetch` calls return an error result to the agent instead. With web fetch on, admins can also set allowed or blocked domains for web fetch on the same page. See [Web fetch tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-fetch-tool#how-to-use-web-fetch) and [Domain filtering](https://platform.claude.com/docs/en/agents-and-tools/tool-use/server-tools#domain-filtering).
+* Organization admins can now turn off web fetch for their organization on the [**Capabilities**](https://platform.claude.com/settings/capabilities) page of the Claude Console. With web fetch off, a Messages API request that includes the web fetch tool fails with a 400 error. In a Claude Managed Agents session, `web_fetch` calls return an error result to the agent instead. With web fetch on, admins can also set allowed or blocked domains for web fetch on the same page. See [How to use web fetch](https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-fetch-tool#how-to-use-web-fetch) and [Domain filtering](https://platform.claude.com/docs/en/agents-and-tools/tool-use/server-tools#domain-filtering).
 * In Claude Managed Agents, the [`web_fetch` tool](https://platform.claude.com/docs/en/managed-agents/tools#available-tools) now follows your organization's web fetch domain restrictions set on the [**Capabilities**](https://platform.claude.com/settings/capabilities) page of the Claude Console. A URL, including one reached by a redirect, must pass both the organization's list and the `allowed_domains` or `blocked_domains` list on the agent's `web_fetch` tool. See [Restrict web search and web fetch domains](https://platform.claude.com/docs/en/managed-agents/tools-web-restrictions).
 * In Claude Managed Agents, sessions follow your organization's web search settings on the [**Capabilities**](https://platform.claude.com/settings/capabilities) page of the Claude Console: the **Allow web search** setting since October 6, and its web search domain restrictions since October 14. The agent receives only the search results that both the organization's domain restrictions and the `allowed_domains` or `blocked_domains` list on the agent's [`web_search` tool](https://platform.claude.com/docs/en/managed-agents/tools#available-tools) allow. See [Restrict web search and web fetch domains](https://platform.claude.com/docs/en/managed-agents/tools-web-restrictions).
 
@@ -87,7 +86,7 @@ The Claude Platform release notes list changes to the Claude API, the client SDK
 ### September 28, 2026
 
 * We've launched **Claude Sonnet 5.5** (`claude-sonnet-5-5`). It's available on the Claude API, [Claude in Amazon Bedrock](https://platform.claude.com/docs/en/build-with-claude/claude-in-amazon-bedrock), [Claude Platform on AWS](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws), [Claude on Google Cloud](https://platform.claude.com/docs/en/build-with-claude/claude-models-on-google-cloud/google-managed), and [Claude in Microsoft Foundry](https://platform.claude.com/docs/en/build-with-claude/claude-in-microsoft-foundry). For its context window, output limits, and prices, see the [Claude Sonnet 5.5 model page](https://platform.claude.com/docs/en/models/sonnet-5-5/overview).
-* Code written for Claude Sonnet 5 can break on Claude Sonnet 5.5 in five ways. To turn off up-front thinking, send `thinking: {"type": "between_tools"}` instead of `"disabled"`, at `high` effort or below. Forced tool use (`tool_choice` types `any` and `tool`) returns a 400 error. Thinking blocks are tied to the model and the conversation. On the Claude API and Google Cloud, the earlier `computer_20251124` computer use tool isn't accepted. The advisor tool rejects Claude Opus 4.8, Claude Opus 4.7, and Claude Sonnet 5 as advisors. See [What's new in Claude Sonnet 5.5](https://platform.claude.com/docs/en/models/sonnet-5-5/whats-new-sonnet-5-5) for each change and the [migration guide](https://platform.claude.com/docs/en/models/sonnet-5-5/migration-guide) for before-and-after requests. For model-specific prompting patterns, see [Prompting Claude Sonnet 5.5](https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/prompting-claude-sonnet-5-5).
+* Code written for Claude Sonnet 5 can break on Claude Sonnet 5.5 in five ways. To turn off up-front thinking, send `thinking: {"type": "between_tools"}` instead of `"disabled"`, at `high` effort or below. Forced tool use (`tool_choice` types `any` and `tool`) returns a 400 error. Thinking blocks are tied to the model and the conversation. On the Claude API and Google Cloud, the earlier `computer_20251124` computer use tool isn't accepted. The advisor tool rejects Claude Opus 4.8, Claude Opus 4.7, and Claude Sonnet 5 as advisors. See [What's new in Claude Sonnet 5.5](https://platform.claude.com/docs/en/models/sonnet-5-5/whats-new-sonnet-5-5) for each change and the [Claude Sonnet 5.5 migration guide](https://platform.claude.com/docs/en/models/sonnet-5-5/migration-guide) for before-and-after requests. For model-specific prompting patterns, see [Prompting Claude Sonnet 5.5](https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/prompting-claude-sonnet-5-5).
 * Thinking blocks that Claude Sonnet 5.5 produces work only in the account that produced them, or in an account linked to it. When another account sends one of these blocks, the API drops the block before the model sees it, and the request succeeds. Blocks from earlier models aren't affected. See [Preserved thinking](https://platform.claude.com/docs/en/build-with-claude/preserved-thinking#account-bound-thinking).
 
 ### September 24, 2026
@@ -102,8 +101,8 @@ The Claude Platform release notes list changes to the Claude API, the client SDK
 
 ### September 22, 2026
 
-* We've launched **Claude Opus 5.5** (`claude-opus-5-5`), a model for long-running agentic coding and knowledge work. It has a [1M token context window](https://platform.claude.com/docs/en/build-with-claude/context-windows) by default, 128k max output tokens, and always-on [adaptive thinking](https://platform.claude.com/docs/en/build-with-claude/thinking), at $4 / $20 USD per MTok (Claude Opus 5 is $5 / $25). Claude Opus 5.5 is available on the Claude API, [Claude in Amazon Bedrock](https://platform.claude.com/docs/en/build-with-claude/claude-in-amazon-bedrock), [Claude Platform on AWS](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws), [Claude on Google Cloud](https://platform.claude.com/docs/en/build-with-claude/claude-models-on-google-cloud/google-managed), and [Claude in Microsoft Foundry](https://platform.claude.com/docs/en/build-with-claude/claude-in-microsoft-foundry). See [What's new in Claude Opus 5.5](https://platform.claude.com/docs/en/models/opus-5-5/whats-new-opus-5-5) for capabilities, API changes, and migration guidance.
-* On Claude Opus 5.5, thinking can't be disabled: `thinking: {"type": "disabled"}` and `thinking: {"type": "enabled", ...}` return a 400 error. Omit the `thinking` field and control thinking depth with the [effort parameter](https://platform.claude.com/docs/en/build-with-claude/effort). `tool_choice` types `any` and `tool` also return a 400 error, as on Claude Fable 5.1; use `auto` with [strict tool use](https://platform.claude.com/docs/en/agents-and-tools/tool-use/strict-tool-use). On the Claude API and Google Cloud, [computer use](https://platform.claude.com/docs/en/agents-and-tools/tool-use/computer-use-tool) on this model requires the `computer_toolset_20260801` toolset and the earlier `computer_20251124` tool returns a 400 error; on Amazon Bedrock, `computer_20251124` keeps working. See the [migration guide](https://platform.claude.com/docs/en/models/opus-5-5/migration-guide#migrating-from-claude-opus-5).
+* We've launched **Claude Opus 5.5** (`claude-opus-5-5`), a model for long-running agentic coding and knowledge work. It has a [1M token context window](https://platform.claude.com/docs/en/build-with-claude/context-windows) by default, 128k max output tokens, and always-on [adaptive thinking](https://platform.claude.com/docs/en/build-with-claude/thinking), at $4 / $20 USD per MTok (Claude Opus 5 is $5 / $25 USD). Claude Opus 5.5 is available on the Claude API, [Claude in Amazon Bedrock](https://platform.claude.com/docs/en/build-with-claude/claude-in-amazon-bedrock), [Claude Platform on AWS](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws), [Claude on Google Cloud](https://platform.claude.com/docs/en/build-with-claude/claude-models-on-google-cloud/google-managed), and [Claude in Microsoft Foundry](https://platform.claude.com/docs/en/build-with-claude/claude-in-microsoft-foundry). See [What's new in Claude Opus 5.5](https://platform.claude.com/docs/en/models/opus-5-5/whats-new-opus-5-5) for capabilities, API changes, and migration guidance.
+* On Claude Opus 5.5, thinking can't be disabled: `thinking: {"type": "disabled"}` and `thinking: {"type": "enabled", ...}` return a 400 error. Omit the `thinking` field and control thinking depth with the [effort parameter](https://platform.claude.com/docs/en/build-with-claude/effort). `tool_choice` types `any` and `tool` also return a 400 error, as on Claude Fable 5.1; use `auto` with [strict tool use](https://platform.claude.com/docs/en/agents-and-tools/tool-use/strict-tool-use). On the Claude API and Google Cloud, [computer use](https://platform.claude.com/docs/en/agents-and-tools/tool-use/computer-use-tool) on this model requires the `computer_toolset_20260801` toolset and the earlier `computer_20251124` tool returns a 400 error; on Amazon Bedrock, `computer_20251124` keeps working. See the [Claude Opus 5.5 migration guide](https://platform.claude.com/docs/en/models/opus-5-5/migration-guide#migrating-from-claude-opus-5).
 * [Fast mode](https://platform.claude.com/docs/en/build-with-claude/fast-mode) (research preview) is available for Claude Opus 5.5 on the Claude API.
 * Tools can now be defined inside a [mid-conversation system message](https://platform.claude.com/docs/en/build-with-claude/mid-conversation-system-messages#define-tools-in-a-message-beta), in beta on the Claude API with the `inline-tools-2026-09-15` beta header. A `tool_addition` block can carry the tool's full definition (`tool: {"type": "tool_definition", "definition": {...}}`), so you can add a tool, change its schema, or move a server tool to a newer version without editing `tools` or invalidating the prompt cache. The same header covers adding and removing tools by reference. With the MCP connector's `mcp-client-2026-09-15` beta header as well, the definition can be an MCP toolset, and a response records each server's fetched tool list in an `mcp_tool_listing` block, which pins that list when you send it back.
 
@@ -133,7 +132,7 @@ The Claude Platform release notes list changes to the Claude API, the client SDK
 
 ### September 1, 2026
 
-* We've launched **Claude Fable 5.1** (`claude-fable-5-1`), the successor to Claude Fable 5 for long-running agentic coding, knowledge work, and research, alongside **Claude Mythos 5.1** (`claude-mythos-5-1`) for Project Glasswing participants. Both models support a [1M token context window](https://platform.claude.com/docs/en/build-with-claude/context-windows) by default, 128k max output tokens, and always-on [adaptive thinking](https://platform.claude.com/docs/en/build-with-claude/thinking), at $10 / $50 USD per MTok, the same as Claude Fable 5, with cache reads cut to $0.25 per MTok. Claude Fable 5.1 is available on the Claude API, [Claude in Amazon Bedrock](https://platform.claude.com/docs/en/build-with-claude/claude-in-amazon-bedrock), [Claude Platform on AWS](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws), [Claude on Google Cloud](https://platform.claude.com/docs/en/build-with-claude/claude-models-on-google-cloud/google-managed), and [Claude in Microsoft Foundry](https://platform.claude.com/docs/en/build-with-claude/claude-in-microsoft-foundry). See [What's new in Claude Fable 5.1](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1) for capabilities, API changes, and migration guidance.
+* We've launched **Claude Fable 5.1** (`claude-fable-5-1`), the successor to Claude Fable 5 for long-running agentic coding, knowledge work, and research, alongside **Claude Mythos 5.1** (`claude-mythos-5-1`) for Project Glasswing participants. Both models support a [1M token context window](https://platform.claude.com/docs/en/build-with-claude/context-windows) by default, 128k max output tokens, and always-on [adaptive thinking](https://platform.claude.com/docs/en/build-with-claude/thinking), at $10 / $50 USD per MTok, the same as Claude Fable 5, with cache reads cut to $0.25 USD per MTok. Claude Fable 5.1 is available on the Claude API, [Claude in Amazon Bedrock](https://platform.claude.com/docs/en/build-with-claude/claude-in-amazon-bedrock), [Claude Platform on AWS](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws), [Claude on Google Cloud](https://platform.claude.com/docs/en/build-with-claude/claude-models-on-google-cloud/google-managed), and [Claude in Microsoft Foundry](https://platform.claude.com/docs/en/build-with-claude/claude-in-microsoft-foundry). See [What's new in Claude Fable 5.1](https://platform.claude.com/docs/en/models/fable-5-1/whats-new-fable-5-1) for capabilities, API changes, and migration guidance.
 * Prompt cache reads on Claude Fable 5.1 and Claude Mythos 5.1 cost $0.25 USD per million tokens: 0.025x the base input price, compared with 0.1x on other models. Cache writes are unchanged. See [Prompt caching pricing](https://platform.claude.com/docs/en/about-claude/pricing#prompt-caching).
 * On Claude Fable 5.1 and Claude Mythos 5.1, `tool_choice` types `any` and `tool` aren't supported and return a 400 error. `auto` and `none` are unchanged. To guarantee schema-conformant tool inputs, use [strict tool use](https://platform.claude.com/docs/en/agents-and-tools/tool-use/strict-tool-use) or [structured outputs](https://platform.claude.com/docs/en/build-with-claude/structured-outputs).
 * Thinking blocks produced by Claude Fable 5.1 and Claude Mythos 5.1 are preserved only for the model that produced them or a newer one: earlier models can't read them, and the API drops one replayed to an earlier model. Claude Fable 5.1 accepts thinking blocks from Claude Opus 5, Claude Fable 5, Claude Mythos 5, and earlier Claude models. On Claude Fable 5.1, the API also [checks that nothing before a block has changed](https://platform.claude.com/docs/en/build-with-claude/thinking#preserved-in-conversation): for new accounts created on or after August 31, 2026, replaying one after the `system` prompt, `tools`, or an earlier message changed returns a 400 error. With the `thinking-binding-controls-2026-08-01` beta header, dropped blocks are reported in an `input_transformations` response field, and `thinking.block_binding.prefix_mismatch_behavior` chooses between rejecting and dropping blocks whose history changed. See [Preserved thinking](https://platform.claude.com/docs/en/build-with-claude/thinking#preserved-thinking).
@@ -148,7 +147,7 @@ The Claude Platform release notes list changes to the Claude API, the client SDK
 
 * In Python SDK 1.2.0, TypeScript SDK 0.122.0, Go SDK 1.68.0, Java SDK 2.59.0, Ruby SDK 1.67.0, and C# SDK 12.44.0, `client.beta.files` and `client.beta.skills` no longer send the `files-api-2025-04-14` and `skills-2025-10-02` beta headers and return the same shapes as `client.files` and `client.skills`. With this change, `client.beta.skills.delete()` deletes a Skill together with all of its versions, and the beta Messages type `BetaSkill` (the container Skill reference) is renamed `BetaContainerSkill`. Requests that still send the beta headers keep receiving the beta shapes. See [Migrate from `files-api-2025-04-14`](https://platform.claude.com/docs/en/build-with-claude/files#migrate-from-files-api-2025-04-14) and [Migrate from `skills-2025-10-02`](https://platform.claude.com/docs/en/build-with-claude/skills-guide#migrate-from-skills-2025-10-02).
 
-- You can now create **personal keys** and **service account keys** in the Claude Console. They act as you or as a [service account](https://platform.claude.com/docs/en/manage-claude/workload-identity-federation#service-accounts), with the same permissions, and stop working when the linked account is removed from an organization. This lets organization admins more easily track usage for each account, and ensure key usage is legitimate. These API keys can be scoped to a specific workspace or [work on admin endpoints and across any workspace](https://platform.claude.com/docs/en/manage-claude/authentication#select-a-workspace) the account has access to. Workspace API keys remain supported as a legacy option. See [API keys](https://platform.claude.com/docs/en/manage-claude/authentication#api-keys) for more information.
+- You can now create **personal keys** and **service account keys** in the Claude Console. They act as you or as a [service account](https://platform.claude.com/docs/en/manage-claude/workload-identity-federation#service-accounts), with the same permissions, and stop working when the linked account is removed from an organization. This lets organization admins more easily track usage for each account, and ensure key usage is legitimate. These API keys can be scoped to a specific workspace or [work on admin endpoints and across any workspace](https://platform.claude.com/docs/en/manage-claude/authentication#select-a-workspace) the account has access to. Workspace API keys remain supported as a legacy option. See [API keys in Authentication](https://platform.claude.com/docs/en/manage-claude/authentication#api-keys) for more information.
 
 ### August 26, 2026
 
@@ -184,7 +183,7 @@ The Claude Platform release notes list changes to the Claude API, the client SDK
 
 ### August 10, 2026
 
-* The introductory pricing for **Claude Sonnet 5** ($2 / $10 per MTok) is now the standard price: the previously scheduled increase to $3 / $15 per MTok on September 1, 2026 will not occur. See [Pricing](https://platform.claude.com/docs/en/about-claude/pricing).
+* The introductory pricing for **Claude Sonnet 5** ($2 / $10 USD per MTok) is now the standard price: the previously scheduled increase to $3 / $15 USD per MTok on September 1, 2026, will not occur. See [Pricing](https://platform.claude.com/docs/en/about-claude/pricing).
 
 ### August 7, 2026
 
@@ -213,12 +212,12 @@ The Claude Platform release notes list changes to the Claude API, the client SDK
 * [Effort](https://platform.claude.com/docs/en/build-with-claude/effort) is the primary control for steering Claude Opus 5: the model supports the full ladder (`low`, `medium`, `high`, `xhigh`, `max`), with `max` for capability-critical work.
 * Mid-conversation tool changes are now in beta on Claude Fable 5, Claude Mythos 5, Claude Opus 4.8, and Claude Opus 5: add or remove tools between turns of a conversation while preserving the prompt cache. Include the `mid-conversation-tool-changes-2026-07-01` beta header in your requests.
 * The `fallbacks` parameter now supports a `"default"` mode, which applies Anthropic's recommended fallback models by refusal category. Server-side fallback is in beta, and the `"default"` mode requires the `server-side-fallback-2026-07-01` beta header. See [Refusals and fallback](https://platform.claude.com/docs/en/build-with-claude/refusals-and-fallback).
-* We've removed [fast mode](https://platform.claude.com/docs/en/build-with-claude/fast-mode) for Claude Opus 4.7. Requests to `claude-opus-4-7` with `speed: "fast"` now return an error; unlike Claude Opus 4.6, they do not fall back to standard speed. Claude Opus 4.7 itself remains available at standard speed. To continue using fast mode, migrate to [Claude Opus 5](https://platform.claude.com/docs/en/models/opus-5/overview) or Claude Opus 4.8. Read more in [Fast mode](https://platform.claude.com/docs/en/build-with-claude/fast-mode#supported-models).
+* We've removed [fast mode](https://platform.claude.com/docs/en/build-with-claude/fast-mode) for Claude Opus 4.7. Requests to `claude-opus-4-7` with `speed: "fast"` now return an error; unlike Claude Opus 4.6, they do not fall back to standard speed. Claude Opus 4.7 itself remains available at standard speed. To continue using fast mode, migrate to [Claude Opus 5](https://platform.claude.com/docs/en/models/opus-5/overview) or Claude Opus 4.8. Read more in [Fast mode model availability](https://platform.claude.com/docs/en/build-with-claude/fast-mode#supported-models).
 
 ### July 22, 2026
 
 * You can now set an `effort` level on a Claude Managed Agents agent's model configuration. Pass `effort` inside the `model` object when you [create the agent](https://platform.claude.com/docs/en/managed-agents/agent-setup#create-an-agent). See [Effort levels](https://platform.claude.com/docs/en/build-with-claude/effort#effort-levels) for what each level does.
-* Webhooks for Claude Managed Agents now cover the environment and memory store lifecycle: four `environment.*` event types and three `memory_store.*` event types. You can react to environment and memory store lifecycle changes without polling. See the Environment events and Memory store events tabs in [Subscribe to webhooks](https://platform.claude.com/docs/en/managed-agents/webhooks#supported-event-types).
+* Webhooks for Claude Managed Agents now cover the environment and memory store lifecycle: four `environment.*` event types and three `memory_store.*` event types. You can react to environment and memory store lifecycle changes without polling. See the Environment events and Memory store events tabs in [Supported event types](https://platform.claude.com/docs/en/managed-agents/webhooks#supported-event-types).
 * When creating a Claude Managed Agents session, you can now [seed it with initial events](https://platform.claude.com/docs/en/managed-agents/sessions#seed-the-session-with-initial-events). Pass `initial_events` on `POST /v1/sessions` with up to 50 `user.message` and `user.define_outcome` events. A non-empty list starts the agent loop in the same call, so you don't need a separate send-events request to start work.
 * The `version` field is now optional when [updating a Claude Managed Agents agent](https://platform.claude.com/docs/en/managed-agents/agent-setup#update-an-agent). Supply it for optimistic concurrency (a mismatch returns a 409 error), or omit it to apply the update unconditionally. See [Update semantics](https://platform.claude.com/docs/en/managed-agents/agent-setup#update-semantics).
 * Claude Managed Agents session thread event streams now support [event deltas](https://platform.claude.com/docs/en/managed-agents/event-deltas). `GET /v1/sessions/{session_id}/threads/{thread_id}/stream` accepts the same `event_deltas[]` query parameter as the session-level stream, so you can preview a subagent's text as the model generates it. A connection previews only the thread it's reading. See [Preview session thread events](https://platform.claude.com/docs/en/managed-agents/event-deltas#preview-session-thread-events).
@@ -243,7 +242,7 @@ The Claude Platform release notes list changes to the Claude API, the client SDK
 
 ### July 8, 2026
 
-* You can now set an expiration when you create an API key or an Admin API key in the [Claude Console](https://platform.claude.com/settings/keys). Choose a preset, a custom duration, or **Never**. For keys with a lifetime of at least 7 days, Anthropic emails the creator before expiration. Existing keys are unaffected. The Admin API reports each key's expiration in the [`expires_at`](https://platform.claude.com/docs/en/api/beta/organization/api_keys/list) field. See [Authentication](https://platform.claude.com/docs/en/manage-claude/authentication#key-expiration).
+* You can now set an expiration when you create an API key or an Admin API key in the [Claude Console](https://platform.claude.com/settings/keys). Choose a preset, a custom duration, or **Never**. For keys with a lifetime of at least 7 days, Anthropic emails the creator before expiration. Existing keys are unaffected. The Admin API reports each key's expiration in the [`expires_at`](https://platform.claude.com/docs/en/api/beta/organization/api_keys/list) field. See [Key expiration in Authentication](https://platform.claude.com/docs/en/manage-claude/authentication#key-expiration).
 
 ### July 2, 2026
 
@@ -256,16 +255,16 @@ The Claude Platform release notes list changes to the Claude API, the client SDK
 
 ### June 30, 2026
 
-* We've launched **Claude Sonnet 5** (`claude-sonnet-5`), the next generation of our Sonnet model family, at introductory pricing of $2 / $10 per MTok (made the standard price on August 10, 2026). Claude Sonnet 5 supports a [1M token context window](https://platform.claude.com/docs/en/build-with-claude/context-windows), 128k max output tokens, and the same set of tools and platform features as Claude Sonnet 4.6, except [Priority Tier](https://platform.claude.com/docs/en/api/service-tiers#supported-models), which is not available on Claude Sonnet 5. Three behavior changes apply when migrating: [adaptive thinking](https://platform.claude.com/docs/en/build-with-claude/thinking) is now on by default; manual extended thinking (`thinking: {type: "enabled", budget_tokens: N}`) is removed and returns a 400 error (it was deprecated on Sonnet 4.6); and setting sampling parameters (`temperature`, `top_p`, `top_k`) to non-default values returns a 400 error. Claude Sonnet 5 also uses a new tokenizer that produces approximately 30% more tokens for the same text. The exact increase depends on the content and workload shape. See [What's new in Claude Sonnet 5](https://platform.claude.com/docs/en/models/sonnet-5/overview) for details and migration guidance. For behavioral differences and model-specific prompting patterns, see [Prompting Claude Sonnet 5](https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/prompting-claude-sonnet-5).
+* We've launched **Claude Sonnet 5** (`claude-sonnet-5`), the next generation of our Sonnet model family, at introductory pricing of $2 / $10 USD per MTok (made the standard price on August 10, 2026). Claude Sonnet 5 supports a [1M token context window](https://platform.claude.com/docs/en/build-with-claude/context-windows), 128k max output tokens, and the same set of tools and platform features as Claude Sonnet 4.6, except [Priority Tier](https://platform.claude.com/docs/en/api/service-tiers#supported-models), which is not available on Claude Sonnet 5. Three behavior changes apply when migrating: [adaptive thinking](https://platform.claude.com/docs/en/build-with-claude/thinking) is now on by default; manual extended thinking (`thinking: {type: "enabled", budget_tokens: N}`) is removed and returns a 400 error (it was deprecated on Sonnet 4.6); and setting sampling parameters (`temperature`, `top_p`, `top_k`) to non-default values returns a 400 error. Claude Sonnet 5 also uses a new tokenizer that produces approximately 30% more tokens for the same text. The exact increase depends on the content and workload shape. See [What's new in Claude Sonnet 5](https://platform.claude.com/docs/en/models/sonnet-5/overview) for details and migration guidance. For behavioral differences and model-specific prompting patterns, see [Prompting Claude Sonnet 5](https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/prompting-claude-sonnet-5).
 * Claude Managed Agents session event streams now support [event deltas](https://platform.claude.com/docs/en/managed-agents/event-deltas). Opt in with the `event_deltas[]` query parameter on `GET /v1/sessions/{session_id}/events/stream`. The `event_start` and `event_delta` events preview an agent message's text as it's generated, before the complete `agent.message` event arrives.
 * [Listing sessions](https://platform.claude.com/docs/en/managed-agents/session-operations#listing-sessions) for Claude Managed Agents now supports backward pagination. `GET /v1/sessions` returns a `prev_page` cursor alongside `next_page`; pass it as the `page` parameter to return to the previous page. See [Pagination](https://platform.claude.com/docs/en/api/overview#pagination).
 * When creating a Claude Managed Agents session, you can now [override the agent's configuration for that session](https://platform.claude.com/docs/en/managed-agents/sessions#override-agent-configuration-for-a-session). Pass `agent` with `type: "agent_with_overrides"` to replace the model, system prompt, tools, MCP servers, or skills for a single session. The agent itself is unchanged.
 * Claude Managed Agents vaults now support an `injection_location` setting on [environment variable credentials](https://platform.claude.com/docs/en/managed-agents/vaults#add-a-credential) (the Environment variable tab). It controls whether the credential's value is substituted, at egress, into the agent's outbound request headers, the request body, or both.
-* Webhooks for Claude Managed Agents now cover the agent, deployment, and deployment run lifecycle. You can react to a newly published agent version, a paused deployment, or a failed scheduled run without polling. See the Agent events, Deployment events, and Deployment run events tabs in [Subscribe to webhooks](https://platform.claude.com/docs/en/managed-agents/webhooks#supported-event-types).
+* Webhooks for Claude Managed Agents now cover the agent, deployment, and deployment run lifecycle. You can react to a newly published agent version, a paused deployment, or a failed scheduled run without polling. See the Agent events, Deployment events, and Deployment run events tabs in [Supported event types](https://platform.claude.com/docs/en/managed-agents/webhooks#supported-event-types).
 
 ### June 29, 2026
 
-* We've removed [fast mode](https://platform.claude.com/docs/en/build-with-claude/fast-mode) for Claude Opus 4.6. Requests to `claude-opus-4-6` with `speed: "fast"` no longer run at fast speed or premium pricing: they run at standard speed, are billed at standard rates, and do not return an error. The response's `usage.speed` field reports the speed used. To continue using fast mode, migrate to [Claude Opus 4.8](https://platform.claude.com/docs/en/about-claude/models/migration-guide). Read more in [Fast mode](https://platform.claude.com/docs/en/build-with-claude/fast-mode#supported-models).
+* We've removed [fast mode](https://platform.claude.com/docs/en/build-with-claude/fast-mode) for Claude Opus 4.6. Requests to `claude-opus-4-6` with `speed: "fast"` no longer run at fast speed or premium pricing: they run at standard speed, are billed at standard rates, and do not return an error. The response's `usage.speed` field reports the speed used. To continue using fast mode, migrate to [Claude Opus 4.8](https://platform.claude.com/docs/en/about-claude/models/migration-guide). Read more in [Fast mode model availability](https://platform.claude.com/docs/en/build-with-claude/fast-mode#supported-models).
 
 ### June 26, 2026
 
@@ -273,7 +272,7 @@ The Claude Platform release notes list changes to the Claude API, the client SDK
 
 ### June 25, 2026
 
-* We've deprecated [fast mode](https://platform.claude.com/docs/en/build-with-claude/fast-mode) for Claude Opus 4.7, with removal on July 24, 2026. After removal, requests to `claude-opus-4-7` with `speed: "fast"` will return an error. Migrate to fast mode for Claude Opus 4.8. Read more in [Fast mode](https://platform.claude.com/docs/en/build-with-claude/fast-mode#supported-models).
+* We've deprecated [fast mode](https://platform.claude.com/docs/en/build-with-claude/fast-mode) for Claude Opus 4.7, with removal on July 24, 2026. After removal, requests to `claude-opus-4-7` with `speed: "fast"` will return an error. Migrate to fast mode for Claude Opus 4.8. Read more in [Fast mode model availability](https://platform.claude.com/docs/en/build-with-claude/fast-mode#supported-models).
 
 ### June 22, 2026
 
@@ -307,7 +306,7 @@ The Claude Platform release notes list changes to the Claude API, the client SDK
 * Claude Fable 5 requires 30-day data retention and is not available under zero data retention. See [Model-specific data retention requirements](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#model-specific-data-retention-requirements).
 * Claude Managed Agents now supports [scheduled deployments](https://platform.claude.com/docs/en/managed-agents/scheduled-deployments), letting you run sessions on a cron schedule without managing your own scheduler.
 * Claude Managed Agents vaults now support [environment variable credentials](https://platform.claude.com/docs/en/managed-agents/vaults#add-a-credential), so you can securely inject secrets into the agent's sandbox for CLIs, SDKs, and other services that authenticate through environment variables.
-* The [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api) [Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed) (`GET /v1/compliance/activities`) is now available on [Claude Platform on AWS](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws). See [IAM actions for Claude Platform on AWS](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#compliance) for the `ListComplianceActivities` action that authorizes it.
+* The [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api) [Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed) (`GET /v1/compliance/activities`) is now available on [Claude Platform on AWS](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws). See [Compliance IAM actions for Claude Platform on AWS](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#compliance) for the `ListComplianceActivities` action that authorizes it.
 * The `session.thread_*` webhook events now include a `session_thread_id` field identifying the multiagent thread that triggered the event.
 * We've released a [Swift package](https://platform.claude.com/docs/en/cli-sdks-libraries/libraries/apple-foundation-models) in beta that adds Claude as a server-side `LanguageModel` in Apple's Foundation Models framework. Call Claude through the same `LanguageModelSession` API as Apple's on-device model on iOS 27, macOS 27, visionOS 27, and watchOS 27 (beta).
 
@@ -317,7 +316,7 @@ The Claude Platform release notes list changes to the Claude API, the client SDK
 
 ### June 2, 2026
 
-* The [advisor tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/advisor-tool) now supports a `max_tokens` parameter to cap the advisor model's output per call, reducing latency and output token cost for workloads that don't need full-length advisor responses. Set `tools[].max_tokens` on the advisor tool definition; see [Capping advisor output](https://platform.claude.com/docs/en/agents-and-tools/tool-use/advisor-tool#capping-advisor-output).
+* The [advisor tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/advisor-tool) now supports a `max_tokens` parameter to cap the advisor model's output for each call, reducing latency and output token cost for workloads that don't need full-length advisor responses. Set `tools[].max_tokens` on the advisor tool definition; see [Capping advisor output](https://platform.claude.com/docs/en/agents-and-tools/tool-use/advisor-tool#capping-advisor-output).
 * On the Claude API, you are no longer billed for a request when it returns `stop_reason: "refusal"` without Claude having generated any output. See [Streaming refusals](https://platform.claude.com/docs/en/test-and-evaluate/strengthen-guardrails/handle-streaming-refusals) for detecting and handling refusals.
 
 ### May 29, 2026
@@ -341,7 +340,7 @@ The Claude Platform release notes list changes to the Claude API, the client SDK
 * In Claude Code, we've expanded Auto mode to more users for long-running tasks. See the [Claude Code documentation](https://code.claude.com/docs).
 * In Claude Code, Max plan users now default to [fast mode](https://platform.claude.com/docs/en/build-with-claude/fast-mode) on Claude Opus 4.8. See the [Claude Code documentation](https://code.claude.com/docs).
 * In Claude Code, Workflows are available as a research preview, letting you define and run multistep agentic plans. See the [Claude Code documentation](https://code.claude.com/docs).
-* We've deprecated [fast mode](https://platform.claude.com/docs/en/build-with-claude/fast-mode) for Claude Opus 4.6, with removal approximately 30 days after launch. Migrate to fast mode for Claude Opus 4.8 or Claude Opus 4.7. Read more in [Fast mode](https://platform.claude.com/docs/en/build-with-claude/fast-mode#supported-models).
+* We've deprecated [fast mode](https://platform.claude.com/docs/en/build-with-claude/fast-mode) for Claude Opus 4.6, with removal approximately 30 days after launch. Migrate to fast mode for Claude Opus 4.8 or Claude Opus 4.7. Read more in [Fast mode model availability](https://platform.claude.com/docs/en/build-with-claude/fast-mode#supported-models).
 * For updates to claude.ai, Cowork, Claude for Microsoft 365, and other Claude apps in this release, see the [release notes for Claude Apps](https://support.claude.com/en/articles/12138966-release-notes).
 
 ### May 27, 2026
@@ -361,7 +360,7 @@ The Claude Platform release notes list changes to the Claude API, the client SDK
 
 ### May 13, 2026
 
-* We've launched [cache diagnostics](https://platform.claude.com/docs/en/build-with-claude/cache-diagnostics) in public beta. Pass `diagnostics.previous_message_id` on a Messages request and the API reports a `cache_miss_reason` explaining where the prompt cache prefix diverged from the previous turn. Include the `cache-diagnosis-2026-04-07` beta header in your requests.
+* We've launched [cache diagnostics](https://platform.claude.com/docs/en/build-with-claude/cache-diagnostics) in beta. Pass `diagnostics.previous_message_id` on a Messages request and the API reports a `cache_miss_reason` explaining where the prompt cache prefix diverged from the previous turn. Include the `cache-diagnosis-2026-04-07` beta header in your requests.
 
 ### May 12, 2026
 
@@ -373,7 +372,7 @@ The Claude Platform release notes list changes to the Claude API, the client SDK
 
 ### May 6, 2026
 
-* [Multiagent orchestration](https://platform.claude.com/docs/en/managed-agents/multiagent-orchestration) and [Outcomes](https://platform.claude.com/docs/en/managed-agents/define-outcomes) are now in public beta under the standard `managed-agents-2026-04-01` beta header.
+* [Multiagent orchestration](https://platform.claude.com/docs/en/managed-agents/multiagent-orchestration) and [Outcomes](https://platform.claude.com/docs/en/managed-agents/define-outcomes) are now in beta under the standard `managed-agents-2026-04-01` beta header.
 * Claude Managed Agents vault credential background refresh is now supported for `mcp_oauth` credentials. See [Authenticate with vaults](https://platform.claude.com/docs/en/managed-agents/vaults).
 * Webhooks for Claude Managed Agents are now supported. Webhook event types include session and vault lifecycle events. See [Subscribe to webhooks](https://platform.claude.com/docs/en/managed-agents/webhooks).
 * Additional filtering and sorting options are now supported for Claude Managed Agents. Sessions can be filtered by status, and events can be filtered by type. Events can now be filtered by creation time.
@@ -397,7 +396,7 @@ The Claude Platform release notes list changes to the Claude API, the client SDK
 
 ### April 23, 2026
 
-* Memory for Claude Managed Agents is now in public beta under the standard `managed-agents-2026-04-01` header. See [Using agent memory](https://platform.claude.com/docs/en/managed-agents/memory) for the full integration guide.
+* Memory for Claude Managed Agents is now in beta under the standard `managed-agents-2026-04-01` header. See [Using agent memory](https://platform.claude.com/docs/en/managed-agents/memory) for the full integration guide.
 
 ### April 20, 2026
 
@@ -405,7 +404,7 @@ The Claude Platform release notes list changes to the Claude API, the client SDK
 
 ### April 16, 2026
 
-* We've launched [Claude Opus 4.7](https://www.anthropic.com/news/claude-opus-4-7), our most capable model for complex reasoning and agentic coding, at the same $5 / $25 per MTok pricing as Opus 4.6. See [What's new in Claude Opus 4.7](https://platform.claude.com/docs/en/about-claude/models/whats-new-claude-4-7) for capability improvements, new features, and the updated tokenizer. Opus 4.7 includes API breaking changes versus Opus 4.6; see the [migration guide](https://platform.claude.com/docs/en/about-claude/models/migration-guide) before upgrading.
+* We've launched [Claude Opus 4.7](https://www.anthropic.com/news/claude-opus-4-7), our most capable model for complex reasoning and agentic coding, at the same $5 / $25 USD per MTok pricing as Opus 4.6. See [What's new in Claude Opus 4.7](https://platform.claude.com/docs/en/about-claude/models/whats-new-claude-4-7) for capability improvements, new features, and the updated tokenizer. Opus 4.7 includes API breaking changes versus Opus 4.6; see the [migration guide](https://platform.claude.com/docs/en/about-claude/models/migration-guide) before upgrading.
 * [Claude in Amazon Bedrock](https://platform.claude.com/docs/en/build-with-claude/claude-in-amazon-bedrock) is now open to all Amazon Bedrock customers. Claude Opus 4.7 and Claude Haiku 4.5 are available self-serve from the Bedrock console through the Messages API endpoint at `/anthropic/v1/messages`, in 27 AWS regions with global and regional endpoints.
 * We've launched [task budgets](https://platform.claude.com/docs/en/build-with-claude/task-budgets) in beta on Claude Opus 4.7. Give Claude an advisory token budget for a full agentic loop (thinking, tool calls, tool results, and output) and the model sees a running countdown, using it to prioritize work and finish gracefully as the budget is consumed. Include the `task-budgets-2026-03-13` beta header in your requests.
 * Claude Opus 4.7 supports [high-resolution image input](https://platform.claude.com/docs/en/build-with-claude/vision#high-resolution-image-support-on-claude-opus-4-7), raising the maximum image resolution from 1568 to 2576 pixels on the long edge for improved performance on computer use, screenshot understanding, and document analysis. High-resolution support is automatic and requires no beta header; images may use up to approximately 3x more image tokens than on prior models.
@@ -417,11 +416,11 @@ The Claude Platform release notes list changes to the Claude API, the client SDK
 
 ### April 9, 2026
 
-* We've launched the [advisor tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/advisor-tool) in public beta. Pair a faster executor model with a higher-intelligence advisor model that provides strategic guidance mid-generation, so long-horizon agentic workloads get close to advisor-solo quality while the bulk of token generation happens at executor-model rates. Include the beta header `advisor-tool-2026-03-01` in your requests.
+* We've launched the [advisor tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/advisor-tool) in beta. Pair a faster executor model with a higher-intelligence advisor model that provides strategic guidance mid-generation, so long-horizon agentic workloads get close to advisor-solo quality while the bulk of token generation happens at executor-model rates. Include the beta header `advisor-tool-2026-03-01` in your requests.
 
 ### April 8, 2026
 
-* We've launched **Claude Managed Agents** in public beta, a fully managed agent harness for running Claude as an autonomous agent with secure sandboxing, built-in tools, and server-sent event streaming. Create agents, configure containers, and run sessions through the API. All endpoints require the `managed-agents-2026-04-01` beta header. Learn more in [Claude Managed Agents overview](https://platform.claude.com/docs/en/managed-agents/overview).
+* We've launched **Claude Managed Agents** in beta, a fully managed agent harness for running Claude as an autonomous agent with secure sandboxing, built-in tools, and server-sent event streaming. Create agents, configure containers, and run sessions through the API. All endpoints require the `managed-agents-2026-04-01` beta header. Learn more in [Claude Managed Agents overview](https://platform.claude.com/docs/en/managed-agents/overview).
 * We've launched the **`ant` CLI**, a command-line client for the Claude API that enables faster interaction with the Claude API, native integration with Claude Code, and versioning of API resources in YAML files. Learn more in the [CLI quickstart](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/quickstart).
 
 ### April 7, 2026
@@ -446,17 +445,17 @@ The Claude Platform release notes list changes to the Claude API, the client SDK
 
 * The [1M token context window](https://platform.claude.com/docs/en/build-with-claude/context-windows) is out of beta for Claude Opus 4.6 and Sonnet 4.6, at standard pricing. Requests over 200k tokens work automatically for these models with no beta header required. The 1M token context window remains in beta for Claude Sonnet 4.5 and Sonnet 4.
 * We've removed the dedicated 1M rate limits for all supported models. Your standard account limits now apply across every context length.
-* We've raised the media limit from 100 to 600 images or PDF pages per request when using the 1M token context window.
+* We've raised the media limit from 100 to 600 images or PDF pages for each request when using the 1M token context window.
 
 ### February 19, 2026
 
-* We've launched **automatic caching** for the Messages API. Add a single `cache_control` field to your request body and the system automatically caches the last cacheable block, moving the cache point forward as conversations grow. No manual breakpoint management required. Works alongside existing block-level cache control for fine-grained optimization. Available on the Claude API and Microsoft Foundry (preview). Learn more in [Prompt caching](https://platform.claude.com/docs/en/build-with-claude/prompt-caching#automatic-caching).
+* We've launched **automatic caching** for the Messages API. Add a single `cache_control` field to your request body and the system automatically caches the last cacheable block, moving the cache point forward as conversations grow. No manual breakpoint management required. Works alongside existing block-level cache control for fine-grained optimization. Available on the Claude API and Microsoft Foundry (preview). Learn more in [Automatic caching](https://platform.claude.com/docs/en/build-with-claude/prompt-caching#automatic-caching).
 * We've retired the Claude Sonnet 3.7 model (`claude-3-7-sonnet-20250219`) and the Claude Haiku 3.5 model (`claude-3-5-haiku-20241022`). All requests to Claude Sonnet 3.7 will now return an error. Requests to Claude Haiku 3.5 on the Claude API will now return an error; it remains available on Amazon Bedrock and Google Cloud. We recommend upgrading to [Claude Sonnet 4.6](https://platform.claude.com/docs/en/models/overview#latest-models-comparison) and [Claude Haiku 4.5](https://platform.claude.com/docs/en/models/overview#latest-models-comparison) respectively. Researchers can request ongoing access through the [External Researcher Access Program](https://support.claude.com/en/articles/9125743-what-is-the-external-researcher-access-program).
 * We announced the deprecation of the Claude Haiku 3 model (`claude-3-haiku-20240307`), with retirement scheduled for April 20, 2026. We recommend migrating to [Claude Haiku 4.5](https://platform.claude.com/docs/en/models/overview#latest-models-comparison). Read more in [Model deprecations](https://platform.claude.com/docs/en/about-claude/model-deprecations).
 
 ### February 17, 2026
 
-* We've launched [Claude Sonnet 4.6](https://www.anthropic.com/news/claude-sonnet-4-6), our latest balanced model combining speed and intelligence for everyday tasks. Sonnet 4.6 delivers improved agentic search performance while consuming fewer tokens. Sonnet 4.6 supports [extended thinking](https://platform.claude.com/docs/en/build-with-claude/extended-thinking) and a [1M token context window](https://platform.claude.com/docs/en/build-with-claude/context-windows) (beta). See [Models & Pricing](https://platform.claude.com/docs/en/models/overview) for details.
+* We've [launched Claude Sonnet 4.6](https://www.anthropic.com/news/claude-sonnet-4-6), our latest balanced model combining speed and intelligence for everyday tasks. Sonnet 4.6 delivers improved agentic search performance while consuming fewer tokens. Sonnet 4.6 supports [extended thinking](https://platform.claude.com/docs/en/build-with-claude/extended-thinking) and a [1M token context window](https://platform.claude.com/docs/en/build-with-claude/context-windows) (beta). See [Models & Pricing](https://platform.claude.com/docs/en/models/overview) for details.
 * API [code execution](https://platform.claude.com/docs/en/agents-and-tools/tool-use/code-execution-tool) is now **free when used with web search or web fetch**. Sandboxed code execution improves model capability and token efficiency. See the [pricing details](https://platform.claude.com/docs/en/agents-and-tools/tool-use/code-execution-tool#usage-and-pricing) for standalone usage.
 * The [web search tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-search-tool) and [programmatic tool calling](https://platform.claude.com/docs/en/agents-and-tools/tool-use/programmatic-tool-calling) are available with no beta header required. Web search and web fetch now support [dynamic filtering](https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-search-tool#dynamic-filtering), which uses code execution to filter results before they reach the context window for better performance and reduced token cost.
 * The [code execution tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/code-execution-tool), [web fetch tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-fetch-tool), [tool search tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/tool-search-tool), [tool use examples](https://platform.claude.com/docs/en/agents-and-tools/tool-use/define-tools#providing-tool-use-examples), and [memory tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/memory-tool) no longer require a beta header.
@@ -467,7 +466,7 @@ The Claude Platform release notes list changes to the Claude API, the client SDK
 
 ### February 5, 2026
 
-* We've launched [Claude Opus 4.6](https://www.anthropic.com/news/claude-opus-4-6), our most intelligent model for complex agentic tasks and long-horizon work. Opus 4.6 recommends [adaptive thinking](https://platform.claude.com/docs/en/build-with-claude/thinking) (`thinking: {type: "adaptive"}`); manual thinking (`type: "enabled"` with `budget_tokens`) is deprecated. Opus 4.6 does not support prefilling assistant messages. Learn more in [What's new in Claude 4.6](https://platform.claude.com/docs/en/about-claude/models/whats-new-claude-4-6).
+* We've [launched Claude Opus 4.6](https://www.anthropic.com/news/claude-opus-4-6), our most intelligent model for complex agentic tasks and long-horizon work. Opus 4.6 recommends [adaptive thinking](https://platform.claude.com/docs/en/build-with-claude/thinking) (`thinking: {type: "adaptive"}`); manual thinking (`type: "enabled"` with `budget_tokens`) is deprecated. Opus 4.6 does not support prefilling assistant messages. Learn more in [What's new in Claude 4.6](https://platform.claude.com/docs/en/about-claude/models/whats-new-claude-4-6).
 * The [effort parameter](https://platform.claude.com/docs/en/build-with-claude/effort) no longer requires a beta header and now supports Claude Opus 4.6. Effort replaces `budget_tokens` for controlling thinking depth on new models.
 * We've launched the [compaction API](https://platform.claude.com/docs/en/build-with-claude/compaction-threshold) in beta, providing server-side context summarization for effectively infinite conversations. Available on Opus 4.6.
 * We've introduced [data residency controls](https://platform.claude.com/docs/en/manage-claude/data-residency), allowing you to specify where model inference runs with the `inference_geo` parameter. US-only inference is available at 1.1x pricing for models released after February 1, 2026.
@@ -476,7 +475,7 @@ The Claude Platform release notes list changes to the Claude API, the client SDK
 
 ### January 29, 2026
 
-* [Structured outputs](https://platform.claude.com/docs/en/build-with-claude/structured-outputs) are out of beta on the Claude API for Claude Sonnet 4.5, Claude Opus 4.5, and Claude Haiku 4.5. This release includes expanded schema support, improved grammar compilation latency, and a simplified integration path with no beta header required. The `output_format` parameter has moved to `output_config.format`. Existing beta users can continue using the beta header during the transition period. Structured outputs remain in public beta on Amazon Bedrock and Microsoft Foundry.
+* [Structured outputs](https://platform.claude.com/docs/en/build-with-claude/structured-outputs) are out of beta on the Claude API for Claude Sonnet 4.5, Claude Opus 4.5, and Claude Haiku 4.5. This release includes expanded schema support, improved grammar compilation latency, and a simplified integration path with no beta header required. The `output_format` parameter has moved to `output_config.format`. Existing beta users can continue using the beta header during the transition period. Structured outputs remain in beta on Amazon Bedrock and Microsoft Foundry.
 
 ### January 12, 2026
 
@@ -492,14 +491,14 @@ The Claude Platform release notes list changes to the Claude API, the client SDK
 
 ### December 4, 2025
 
-* [Structured outputs](https://platform.claude.com/docs/en/build-with-claude/structured-outputs) now supports Claude Haiku 4.5.
+* [Structured outputs](https://platform.claude.com/docs/en/build-with-claude/structured-outputs) now support Claude Haiku 4.5.
 
 ### November 24, 2025
 
-* We've launched [Claude Opus 4.5](https://www.anthropic.com/news/claude-opus-4-5), our most intelligent model combining maximum capability with practical performance. Ideal for complex specialized tasks, professional software engineering, and advanced agents. Features step-change improvements in vision, coding, and computer use at a more accessible price point than previous Opus models. Learn more in [Models overview](https://platform.claude.com/docs/en/models/overview).
-* We've launched [programmatic tool calling](https://platform.claude.com/docs/en/agents-and-tools/tool-use/programmatic-tool-calling) in public beta, allowing Claude to call tools from within code execution to reduce latency and token usage in multi-tool workflows.
-* We've launched the [tool search tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/tool-search-tool) in public beta, enabling Claude to dynamically discover and load tools on-demand from large tool catalogs.
-* We've launched the [effort parameter](https://platform.claude.com/docs/en/build-with-claude/effort) in public beta for Claude Opus 4.5, allowing you to control token usage by trading off between response thoroughness and efficiency.
+* We've [launched Claude Opus 4.5](https://www.anthropic.com/news/claude-opus-4-5), our most intelligent model combining maximum capability with practical performance. Ideal for complex specialized tasks, professional software engineering, and advanced agents. Features step-change improvements in vision, coding, and computer use at a more accessible price point than previous Opus models. Learn more in [Models overview](https://platform.claude.com/docs/en/models/overview).
+* We've launched [programmatic tool calling](https://platform.claude.com/docs/en/agents-and-tools/tool-use/programmatic-tool-calling) in beta, allowing Claude to call tools from within code execution to reduce latency and token usage in multi-tool workflows.
+* We've launched the [tool search tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/tool-search-tool) in beta, enabling Claude to dynamically discover and load tools on-demand from large tool catalogs.
+* We've launched the [effort parameter](https://platform.claude.com/docs/en/build-with-claude/effort) in beta for Claude Opus 4.5, allowing you to control token usage by trading off between response thoroughness and efficiency.
 * We've added [client-side compaction](https://platform.claude.com/docs/en/build-with-claude/context-editing#client-side-compaction-sdk) to our Python and TypeScript SDKs, automatically managing conversation context through summarization when using `tool_runner`.
 
 ### November 21, 2025
@@ -516,7 +515,7 @@ The Claude Platform release notes list changes to the Claude API, the client SDK
 
 ### November 14, 2025
 
-* We've launched [structured outputs](https://platform.claude.com/docs/en/build-with-claude/structured-outputs) in public beta, providing guaranteed schema conformance for Claude's responses. Use JSON outputs for structured data responses or strict tool use for validated tool inputs. Available for Claude Sonnet 4.5 and Claude Opus 4.1. To enable, use the beta header `structured-outputs-2025-11-13`.
+* We've launched [structured outputs](https://platform.claude.com/docs/en/build-with-claude/structured-outputs) in beta, providing guaranteed schema conformance for Claude's responses. Use JSON outputs for structured data responses or strict tool use for validated tool inputs. Available for Claude Sonnet 4.5 and Claude Opus 4.1. To enable, use the beta header `structured-outputs-2025-11-13`.
 
 ### October 28, 2025
 
@@ -526,7 +525,7 @@ The Claude Platform release notes list changes to the Claude API, the client SDK
 
 ### October 16, 2025
 
-* We've launched [Agent Skills](https://www.anthropic.com/engineering/equipping-agents-for-the-real-world-with-agent-skills) (`skills-2025-10-02` beta), a new way to extend Claude's capabilities. Skills are organized folders of instructions, scripts, and resources that Claude loads dynamically to perform specialized tasks. The initial release includes:
+* We've [launched Agent Skills](https://www.anthropic.com/engineering/equipping-agents-for-the-real-world-with-agent-skills) (`skills-2025-10-02` beta), a new way to extend Claude's capabilities. Skills are organized folders of instructions, scripts, and resources that Claude loads dynamically to perform specialized tasks. The initial release includes:
 
   * **Anthropic-managed Skills**: Pre-built Skills for working with PowerPoint (.pptx), Excel (.xlsx), Word (.docx), and PDF files
   * **Custom Skills**: Upload your own Skills through the Skills API (`/v1/skills` endpoints) to package domain expertise and organizational workflows
@@ -535,7 +534,7 @@ The Claude Platform release notes list changes to the Claude API, the client SDK
 
 ### October 15, 2025
 
-* We've launched [Claude Haiku 4.5](https://www.anthropic.com/news/claude-haiku-4-5), our fastest and most intelligent Haiku model with near-frontier performance. Ideal for real-time applications, high-volume processing, and cost-sensitive deployments requiring strong reasoning. Learn more in [Models overview](https://platform.claude.com/docs/en/models/overview).
+* We've [launched Claude Haiku 4.5](https://www.anthropic.com/news/claude-haiku-4-5), our fastest and most intelligent Haiku model with near-frontier performance. Ideal for real-time applications, high-volume processing, and cost-sensitive deployments requiring strong reasoning. Learn more in [Models overview](https://platform.claude.com/docs/en/models/overview).
 
 ### September 29, 2025
 
@@ -577,7 +576,7 @@ The Claude Platform release notes list changes to the Claude API, the client SDK
 
 ### September 2, 2025
 
-* We've launched v2 of the [Code Execution Tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/code-execution-tool) in public beta, replacing the original Python-only tool with Bash command execution and direct file manipulation capabilities, including writing code in other languages.
+* We've launched v2 of the [Code Execution Tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/code-execution-tool) in beta, replacing the original Python-only tool with Bash command execution and direct file manipulation capabilities, including writing code in other languages.
 
 ### August 27, 2025
 
@@ -590,7 +589,7 @@ The Claude Platform release notes list changes to the Claude API, the client SDK
 
 ### August 19, 2025
 
-* Request IDs are now included directly in error response bodies alongside the existing `request-id` header. Learn more in [Errors](https://platform.claude.com/docs/en/api/errors#error-shapes).
+* Request IDs are now included directly in error response bodies alongside the existing `request-id` header. Learn more in [Error shapes](https://platform.claude.com/docs/en/api/errors#error-shapes).
 
 ### August 18, 2025
 
@@ -600,7 +599,7 @@ The Claude Platform release notes list changes to the Claude API, the client SDK
 ### August 13, 2025
 
 * We announced the deprecation of the Claude Sonnet 3.5 models (`claude-3-5-sonnet-20240620` and `claude-3-5-sonnet-20241022`). These models will be retired on October 28, 2025. We recommend migrating to Claude Sonnet 4.5 (`claude-sonnet-4-5-20250929`) for improved performance and capabilities. Read more in [Model deprecations](https://platform.claude.com/docs/en/about-claude/model-deprecations).
-* The 1-hour cache duration for prompt caching no longer requires a beta header. Learn more in [Prompt caching](https://platform.claude.com/docs/en/build-with-claude/prompt-caching#1-hour-cache-duration).
+* The 1-hour cache duration for prompt caching no longer requires a beta header. Learn more in [1-hour cache duration](https://platform.claude.com/docs/en/build-with-claude/prompt-caching#1-hour-cache-duration).
 
 ### August 12, 2025
 
@@ -650,19 +649,19 @@ The Claude Platform release notes list changes to the Claude API, the client SDK
 
 ### June 11, 2025
 
-* We've launched [fine-grained tool streaming](https://platform.claude.com/docs/en/agents-and-tools/tool-use/fine-grained-tool-streaming) in public beta, a feature that enables Claude to stream tool use parameters without buffering / JSON validation. To enable fine-grained tool streaming, use the [beta header](https://platform.claude.com/docs/en/api/beta-headers) `fine-grained-tool-streaming-2025-05-14`.
+* We've launched [fine-grained tool streaming](https://platform.claude.com/docs/en/agents-and-tools/tool-use/fine-grained-tool-streaming) in beta, a feature that enables Claude to stream tool use parameters without buffering / JSON validation. To enable fine-grained tool streaming, use the [beta header](https://platform.claude.com/docs/en/api/beta-headers) `fine-grained-tool-streaming-2025-05-14`.
 
 ### May 22, 2025
 
 * We've launched [Claude Opus 4 and Claude Sonnet 4](https://www.anthropic.com/news/claude-4), our latest models with extended thinking capabilities. Learn more in [Models overview](https://platform.claude.com/docs/en/models/overview).
 * The default behavior of [extended thinking](https://platform.claude.com/docs/en/build-with-claude/extended-thinking) in Claude 4 models returns a summary of Claude's full thinking process, with the full thinking encrypted and returned in the `signature` field of `thinking` block output.
-* We've launched [interleaved thinking](https://platform.claude.com/docs/en/build-with-claude/thinking#interleaved-thinking) in public beta, a feature that enables Claude to think in between tool calls. To enable interleaved thinking, use the [beta header](https://platform.claude.com/docs/en/api/beta-headers) `interleaved-thinking-2025-05-14`.
-* We've launched the [Files API](https://platform.claude.com/docs/en/build-with-claude/files) in public beta, enabling you to upload files and reference them in the Messages API and code execution tool.
-* We've launched the [Code execution tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/code-execution-tool) in public beta, a tool that enables Claude to execute Python code in a secure, sandboxed environment.
-* We've launched the [MCP connector](https://platform.claude.com/docs/en/agents-and-tools/mcp-connector) in public beta, a feature that allows you to connect to remote MCP servers directly from the Messages API.
+* We've launched [interleaved thinking](https://platform.claude.com/docs/en/build-with-claude/thinking#interleaved-thinking) in beta, a feature that enables Claude to think in between tool calls. To enable interleaved thinking, use the [beta header](https://platform.claude.com/docs/en/api/beta-headers) `interleaved-thinking-2025-05-14`.
+* We've launched the [Files API](https://platform.claude.com/docs/en/build-with-claude/files) in beta, enabling you to upload files and reference them in the Messages API and code execution tool.
+* We've launched the [Code execution tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/code-execution-tool) in beta, a tool that enables Claude to execute Python code in a secure, sandboxed environment.
+* We've launched the [MCP connector](https://platform.claude.com/docs/en/agents-and-tools/mcp-connector) in beta, a feature that allows you to connect to remote MCP servers directly from the Messages API.
 * To increase answer quality and decrease tool errors, we've changed the default value for the `top_p` [nucleus sampling](https://en.wikipedia.org/wiki/Top-p_sampling) parameter in the Messages API from 0.999 to 0.99 for all models. To revert this change, set `top_p` to 0.999. Additionally, when extended thinking is enabled, you can now set `top_p` to values between 0.95 and 1.
 * Our [Go SDK](https://github.com/anthropics/anthropic-sdk-go) has moved from beta to its first stable release.
-* We've included minute and hour level granularity to the [Usage](https://console.anthropic.com/settings/usage) page of Console alongside 429 error rates on the Usage page.
+* We've added minute and hour level granularity to the [Usage](https://console.anthropic.com/settings/usage) page of Console alongside 429 error rates on the Usage page.
 
 ### May 21, 2025
 
@@ -800,7 +799,7 @@ We also released new official SDKs:
 
 ### September 10th, 2024
 
-* We've added Workspaces to the [Developer Console](https://console.anthropic.com). Workspaces allow you to set custom spend or rate limits, group API keys, track usage by project, and control access with user roles. Read more in our [blog post](https://www.anthropic.com/news/workspaces).
+* We've added Workspaces to the [Developer Console](https://console.anthropic.com). Workspaces allow you to set custom spend or rate limits, group API keys, track usage by project, and control access with user roles. Read more in our [Workspaces blog post](https://www.anthropic.com/news/workspaces).
 
 ### September 4th, 2024
 
@@ -830,7 +829,7 @@ We also released new official SDKs:
 ### June 27th, 2024
 
 * View API usage and billing broken down by dollar amount, token count, and API keys in the new [Usage](https://console.anthropic.com/settings/usage) and [Cost](https://console.anthropic.com/settings/cost) tabs in the [Developer Console](https://console.anthropic.com).
-* View your current API rate limits in the new [Rate Limits](https://console.anthropic.com/settings/limits) tab in the [Developer Console](https://console.anthropic.com).
+* View your current API rate limits in the new [Rate Limits tab](https://console.anthropic.com/settings/limits) in the [Developer Console](https://console.anthropic.com).
 
 ### June 20th, 2024
 
@@ -842,4 +841,4 @@ We also released new official SDKs:
 
 ### May 10th, 2024
 
-* Our prompt generator tool is now available in the [Developer Console](https://console.anthropic.com). Prompt Generator makes it easy to guide Claude to generate a high-quality prompts tailored to your specific tasks. Read more in our [blog post](https://www.anthropic.com/news/prompt-generator).
+* Our prompt generator tool is now available in the [Developer Console](https://console.anthropic.com). Prompt Generator makes it easy to guide Claude to generate high-quality prompts tailored to your specific tasks. Read more in our [blog post](https://www.anthropic.com/news/prompt-generator).
diff --git a/content/en/test-and-evaluate/strengthen-guardrails/handle-streaming-refusals.md b/content/en/test-and-evaluate/strengthen-guardrails/handle-streaming-refusals.md
index e61105234c..379f333001 100644
--- a/content/en/test-and-evaluate/strengthen-guardrails/handle-streaming-refusals.md
+++ b/content/en/test-and-evaluate/strengthen-guardrails/handle-streaming-refusals.md
@@ -14,7 +14,7 @@ Starting with Claude 4 models, streaming responses from Claude's API return **`s
 
 When streaming classifiers detect content that violates Anthropic's policies, the API returns this response:
 
-```text
+```json
 {
   "role": "assistant",
   "content": [
diff --git a/content/en/test-and-evaluate/strengthen-guardrails/mitigate-jailbreaks.md b/content/en/test-and-evaluate/strengthen-guardrails/mitigate-jailbreaks.md
index c455b16f57..43ecfdce0b 100644
--- a/content/en/test-and-evaluate/strengthen-guardrails/mitigate-jailbreaks.md
+++ b/content/en/test-and-evaluate/strengthen-guardrails/mitigate-jailbreaks.md
@@ -163,7 +163,7 @@ Structure your application so that Claude can reliably distinguish untrusted con
 
   [browser use tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/browser-use-tool)
 
-  , Anthropic runs additional classifiers that scan what the tools return, such as screenshots or page text, for potential prompt injections and steer Claude to check whether the instruction really came from you before acting. See those pages for details and opt-out information.
+  , Anthropic runs additional classifiers on what the tools return, such as screenshots or page text. The classifiers scan this content for potential prompt injections and steer Claude to check whether the instruction really came from you before acting. See those pages for details and opt-out information.
 </Note>
 
 ## Continuous monitoring
diff --git a/content/support/10310342-how-do-i-log-out-of-all-active-sessions.md b/content/support/10310342-how-do-i-log-out-of-all-active-sessions.md
index dee965426d..6b83ee2c28 100644
--- a/content/support/10310342-how-do-i-log-out-of-all-active-sessions.md
+++ b/content/support/10310342-how-do-i-log-out-of-all-active-sessions.md
@@ -38,7 +38,7 @@ To regain access to your account on any device, you'll need to authenticate agai
 
 If you used your Claude account to authenticate into Claude Code, you can manage your authorization tokens by navigating to **[Settings > Claude Code](https://claude.ai/settings/claude-code)**. To remove a token and log out of Claude Code, click the trash can icon.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1608263923/b4fa7d6f6f08f2adffb4ea63bc58/image+%287%29.png?expires=1792735200&amp;signature=fdb92a361f776cb57ff94c44d15c9bca7f07b015063a13efa3cafcca8e6f05e6&amp;req=dSYnHst4nohdWvMW1HO4zVuHix761WK5AQofdwM8qVesiR9mqjNWje5LvOtB%0AUuv%2BiLbybKBfDFDTpZw%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1608263923/b4fa7d6f6f08f2adffb4ea63bc58/image+%287%29.png?expires=1792754100&amp;signature=ddb9284d4f923571e5885a0dc7c107c9a3e3f8f0a1f002ec5399eee0f8c67275&amp;req=dSYnHst4nohdWvMW1HO4zVuHix7602O6AQofdwM8qVcjQxaroIH6WzWxyo1X%0ALqYzRnp7QtBFn9OkBOs%3D%0A)
 
 ## Unable to access your account?
 
diff --git a/content/support/10504844-manage-user-feedback-settings-on-team-and-enterprise-plans.md b/content/support/10504844-manage-user-feedback-settings-on-team-and-enterprise-plans.md
index 1f59508d56..6ed6e78dbf 100644
--- a/content/support/10504844-manage-user-feedback-settings-on-team-and-enterprise-plans.md
+++ b/content/support/10504844-manage-user-feedback-settings-on-team-and-enterprise-plans.md
@@ -6,6 +6,6 @@ As a Primary Owner or Owner of a Team or Enterprise plan, you can manage the abi
 
 2. Use the toggle to change the **Rate chats** setting for your organization:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2058292603/75752add0bed6a9f3ab217f01708/CleanShot%2B2026-02-12%2Bat%2B08_55_14-402x.png?expires=1792735200&amp;signature=7d036c0df7a62f6fa03a55bfea35d0145be931acbf8a1405388ef970858a3f44&amp;req=diAiHst3n4dfWvMW1HO4zYGm8yUbE63O085gFtEpvcQEC4xRDuJ1pbNCSj8Z%0A9ZllyoJS1s5%2FPbJ%2BQxA%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2058292603/75752add0bed6a9f3ab217f01708/CleanShot%2B2026-02-12%2Bat%2B08_55_14-402x.png?expires=1792754100&amp;signature=b29d5110116e1c6ee28e8ada0a0734e45b9d411c17b4e55699d797d0176c282c&amp;req=diAiHst3n4dfWvMW1HO4zYGm8yUbFazN085gFtEpvcRGu5PyuM9KmLHKeOMx%0AStBN3dsqJgvmmqs6sV8%3D%0A)
 
 More information on how Anthropic collects, uses, and stores feedback data can be found in our Privacy Center: **[How long do you store my organization’s data?](https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data)**
\ No newline at end of file
diff --git a/content/support/10593882-share-and-unshare-chats.md b/content/support/10593882-share-and-unshare-chats.md
index 2fb07e951a..85d69fe585 100644
--- a/content/support/10593882-share-and-unshare-chats.md
+++ b/content/support/10593882-share-and-unshare-chats.md
@@ -38,12 +38,12 @@ To unshare a chat:
 
 Users on free, Pro, or Max plans can review a log of shared chats by navigating to **[Settings > Privacy](https://claude.ai/settings/data-privacy-controls)**. Find the **Privacy settings** section and click “Manage” next to **Shared chats:**
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1921669913/7cc7be48cfc7a18f9f469d6cd83c/CleanShot+2026-01-08+at+10_20_43%402x.png?expires=1792735200&amp;signature=dafd5158e7969afcfc03df5f94286014b56f94db9a9026cae89b9c17f5d026a2&amp;req=dSklF894lIheWvMW1HO4zWn5HjEaYUBpc9cNIYuX0GEb7fpQoUm5bNwd5Nm%2F%0ArC5jBFImTp6HgtPjVxc%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1921669913/7cc7be48cfc7a18f9f469d6cd83c/CleanShot+2026-01-08+at+10_20_43%402x.png?expires=1792754100&amp;signature=2a63d9a03e766af13e413177d82a8521d7e457f1d9e4bfa16ae1295fc1f6e4da&amp;req=dSklF894lIheWvMW1HO4zWn5HjEaZ0Fqc9cNIYuX0GFd%2FwqMoAC3ugFUQ2mL%0AwaYTwhTAdYuVksaUqyY%3D%0A)
 
 This will open a **Shared chats** modal listing the title, date shared, and link to each chat, allowing you to easily review and access all your previously-shared content. From here, you also have the option to click “Unshare” next to each listed chat to revoke access to the last snapshot you shared:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1624243810/e6fe1d262597446c7fe21dff9f10/AD_4nXdW-GhByF8uKV7fCq9lTbkVB91FglSL6TSyXAOUk_MLcTV9YsEMBMkm9rgm1oXqv0k3sJh1JhlzZP6tHVkKbDJJ71pDRRtM3aVNG64MDuKDIzgmknh-XDZdNa7biTsTdwGoPr5GRg?expires=1792735200&amp;signature=b0713e386e1b98d94f1f7c1ce91f844b2a46ff86f6cc6842a4873b6150f378f3&amp;req=dSYlEst6noleWfMW1HO4ze44eSVmlxc8guvTv9woD7bFMShCgqLX1emDRxAw%0AhbmWRWYUCcBbvcRc8iA%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1624243810/e6fe1d262597446c7fe21dff9f10/AD_4nXdW-GhByF8uKV7fCq9lTbkVB91FglSL6TSyXAOUk_MLcTV9YsEMBMkm9rgm1oXqv0k3sJh1JhlzZP6tHVkKbDJJ71pDRRtM3aVNG64MDuKDIzgmknh-XDZdNa7biTsTdwGoPr5GRg?expires=1792754100&amp;signature=34deda482bfcf1b8f7e3a69c72b02994cab5b5660d93e8e4e4315ef520363adb&amp;req=dSYlEst6noleWfMW1HO4ze44eSVmkRY%2FguvTv9woD7YYl%2Fux8pn%2F6nmPjpy2%0AO0GWdTY7x3HbgJ2OPaY%3D%0A)
 
 If you don’t have any shared chat snapshots, the **Shared chats** modal will show “No shared content found”:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1624243808/b025db8e598f0c88fb16d83d48d5/AD_4nXeUwCKnmFzzrjMHhfr5By4zk5pJlkEn3wbJ8-aNfu13Yl99IjBywpqPx9G07QRzpH1EwRY7uG7Q9m9fib98Gql1cIV7XwUCTzEgBNu79Ey8tCOS5CEVmwveIcEOxJ4fonBhe3g9MA?expires=1792735200&amp;signature=eb2bfedc02b372fc71a0d0d16b05869ae86f579e2d22c6713863918deec68fee&amp;req=dSYlEst6nolfUfMW1HO4zdaFnMdzgoyzDeZsm0Gz1HsH4ETHTvqkY50VIXpS%0AvLNzdVpMf1kpybFk%2BTo%3D%0A)
\ No newline at end of file
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1624243808/b025db8e598f0c88fb16d83d48d5/AD_4nXeUwCKnmFzzrjMHhfr5By4zk5pJlkEn3wbJ8-aNfu13Yl99IjBywpqPx9G07QRzpH1EwRY7uG7Q9m9fib98Gql1cIV7XwUCTzEgBNu79Ey8tCOS5CEVmwveIcEOxJ4fonBhe3g9MA?expires=1792754100&amp;signature=2a376c5097d74cec9b70fe158fd578578d93dc24a17e46f4462c1814b942f7ab&amp;req=dSYlEst6nolfUfMW1HO4zdaFnMdzhI2wDeZsm0Gz1HtPFgd7cESlXawuTWJP%0A6%2FHpynayhvAsFSFqVZM%3D%0A)
\ No newline at end of file
diff --git a/content/support/10949351-getting-started-with-local-mcp-servers-on-claude-desktop.md b/content/support/10949351-getting-started-with-local-mcp-servers-on-claude-desktop.md
index 639c11346f..0f0b494a61 100644
--- a/content/support/10949351-getting-started-with-local-mcp-servers-on-claude-desktop.md
+++ b/content/support/10949351-getting-started-with-local-mcp-servers-on-claude-desktop.md
@@ -48,7 +48,7 @@ for specific instructions.
 
 Custom desktop extensions uploads allow Team and Enterprise plans to leverage organization-specific workflows that aren’t available in the public directory. After creating a custom desktop extension, Owners and Primary Owners can navigate to Settings > Extensions within Claude Desktop and click “Advanced settings” to access the **Extension Developer** section:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1681607607/ba6e379d2769d190f0970a0adaed/AD_4nXd4aZkqjJFpiXMPF28Pih7HmSJ9pPsnoWAfVgiLdFRFiTkO92YtXteIjvDHaPl7T0tjfpRTBOlyrMbQ_aciCNDgfIuEvV3szmKvt72x5O51DMSClXOYWk1JIRIzylwkj3joXqZcLw?expires=1792735200&amp;signature=bd3cf766e115e4e8682177a3e7b45e022947fa0337a016d248901a9c9221dbb4&amp;req=dSYvF89%2BmodfXvMW1HO4zWbPxUJ4NDgwHn9K2IaIG2IbOvgW%2BgOsZscxTNhk%0AofAZcCquX984c7daiao%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1681607607/ba6e379d2769d190f0970a0adaed/AD_4nXd4aZkqjJFpiXMPF28Pih7HmSJ9pPsnoWAfVgiLdFRFiTkO92YtXteIjvDHaPl7T0tjfpRTBOlyrMbQ_aciCNDgfIuEvV3szmKvt72x5O51DMSClXOYWk1JIRIzylwkj3joXqZcLw?expires=1792754100&amp;signature=83e3642da939e981fc076a45c99a88475da06554eca8d8d82eed4649d0bc47fc&amp;req=dSYvF89%2BmodfXvMW1HO4zWbPxUJ4MjkzHn9K2IaIG2IwKoNQlpkOK%2FiyRPPO%0AfgZiMCRUrS4MJMsYjaM%3D%0A)
 
 Click “Install Extension…” and select the .mcpb file. Follow the prompts to install and configure your custom desktop extension. For more in-depth information, please refer to our [desktop extension developer documentation](https://github.com/anthropics/mcpb).
 
diff --git a/content/support/11101966-use-voice-mode.md b/content/support/11101966-use-voice-mode.md
index 43ce1b23a6..c982ae980a 100644
--- a/content/support/11101966-use-voice-mode.md
+++ b/content/support/11101966-use-voice-mode.md
@@ -24,7 +24,7 @@ Voice mode transforms how you interact with Claude by:
 
 2. Tap the sound wave symbol in the lower right corner of the chat window to activate voice mode:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2042358620/1bf2311353615c1c494da1312a17/124b93a8-0a9b-4c84-9d1f-ede6ca3498dd?expires=1792735200&amp;signature=6956dfec0778fd3ab7294596cb042d67ccaaca26ab419335390466968c8658c2&amp;req=diAjFMp7lYddWfMW1HO4zZyGr8x1uFISF6uXnTLMvvC6DQ7zxgKpHxbeJwjn%0ApxRv%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2042358620/1bf2311353615c1c494da1312a17/124b93a8-0a9b-4c84-9d1f-ede6ca3498dd?expires=1792754100&amp;signature=c5ae08ef515e39ac977fbd1898ec20b709e31dfda12ea8e410d8d4c3f63bae2f&amp;req=diAjFMp7lYddWfMW1HO4zZyGr8x1vlMRF6uXnTLMvvDKJHL9GE55OuZQqzq6%0AZLGB%0A)
 
 3. Start talking and see your prompt automatically populate in the chat input.
 
@@ -32,7 +32,7 @@ Voice mode transforms how you interact with Claude by:
 
 5. Claude will remain in voice mode until you click the “Stop” button in the lower right corner of the chat window:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2042352060/162f9e61f7fbeb689201dfc1cac1/6a7fafb2-31df-43be-a43f-0059d735e3c4?expires=1792735200&amp;signature=df295ffb16a983459438ed20bb6f5d879ba45f1c8c090a812e6c15882e7e5773&amp;req=diAjFMp7n4FZWfMW1HO4zU6VRP%2FNS7lrxNdRzYWrfF4ndfBY0nMcL8RgLIzO%0AYR3r2IjKo2XsV26V8Ok%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2042352060/162f9e61f7fbeb689201dfc1cac1/6a7fafb2-31df-43be-a43f-0059d735e3c4?expires=1792754100&amp;signature=d74b96bf310661ed3a76e5bbea00597016cc365d76b56c188e920a5cb9da2ce1&amp;req=diAjFMp7n4FZWfMW1HO4zU6VRP%2FNTbhoxNdRzYWrfF6PDprx1h8%2FIAlY5pZr%0AtQDs35C%2B3%2BDUcvwMuro%3D%0A)
 
 ### On mobile (iOS and Android)
 
@@ -40,7 +40,7 @@ Voice mode transforms how you interact with Claude by:
 
 2. Tap the voice mode icon (sound wave symbol next to the microphone icon) in the text input field:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2042359690/68879db64559ecf87991f73ce058/671ff972-9e08-4686-bc04-955dab4b2de3?expires=1792735200&amp;signature=97fde2a16c4283b9313e55a85695332fda7da4d6b491906ea9b8ded59873b473&amp;req=diAjFMp7lIdWWfMW1HO4zQTUIPZ9k91MD%2FRXAPlQ7La5ylvCI1YHj9PWqspe%0AGwCE%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2042359690/68879db64559ecf87991f73ce058/671ff972-9e08-4686-bc04-955dab4b2de3?expires=1792754100&amp;signature=99a6f0afde0c0dcd66e9ddee47dd70579a9d4117e932542c8cf70c801614fdd7&amp;req=diAjFMp7lIdWWfMW1HO4zQTUIPZ9ldxPD%2FRXAPlQ7LagoVnm09BnUikkOSZb%0ANPWH%0A)
 
 3. Choose a voice to personalize your experience.
 
@@ -78,7 +78,7 @@ To change the voice later:
 
 - **On mobile:** Click the settings button in the bottom left corner while chatting with Claude in voice mode, then tap your preferred voice and pace:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2042352063/25eca25bcfd573ecab30dd53158c/074454a6-fa5a-4c49-8b19-02d434b4ca50?expires=1792735200&amp;signature=2b85eab29802146d232a2392e21bf08bca8e6ddd4d99d99d1faacfbd18849a48&amp;req=diAjFMp7n4FZWvMW1HO4zZ3%2FGWiSY1UIy8OQfYsvK3zLyZ4ygoXpEDypbBGT%0A8rQMXGVsXVBby9zcGn8%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2042352063/25eca25bcfd573ecab30dd53158c/074454a6-fa5a-4c49-8b19-02d434b4ca50?expires=1792754100&amp;signature=3a099dc8f09319fb3d16892548c882b98acde97c067a05030400d5b1c6701722&amp;req=diAjFMp7n4FZWvMW1HO4zZ3%2FGWiSZVQLy8OQfYsvK3wyacMNmbbCV8lHlNpo%0ARHvlMA3yiND1wFbYnuc%3D%0A)
 
 ## Choose a model
 
diff --git a/content/support/11725453-set-up-the-claude-lti-in-canvas-by-instructure.md b/content/support/11725453-set-up-the-claude-lti-in-canvas-by-instructure.md
index 7e5171ecca..a9432aef0b 100644
--- a/content/support/11725453-set-up-the-claude-lti-in-canvas-by-instructure.md
+++ b/content/support/11725453-set-up-the-claude-lti-in-canvas-by-instructure.md
@@ -44,7 +44,7 @@ This article provides information on how to enable the Claude LTI integration in
 
 5. Click "Install" and refresh the course page.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1611422430/c8e0875feac1f2c7cb033be74fc9/AD_4nXfLU_bui3EXcCjQ0qm70HD97neqjGayKeDer_t76utlci8gZSUjYRhw6ZSOlDdqSEcwXBzd_shAh7pQEJ-8OoE0O21DM5coOgxmO_WD5hlwiuwtS2iYXcTavhIRyQT5zKFWvfn3NA?expires=1792735200&amp;signature=b25435c4cfe3702efb209b60fe58216d657fbe462e1ad5e596b4e8b7c77af2b4&amp;req=dSYmF818n4VcWfMW1HO4zTEDa%2BkZmPaDEv2ojHLMylbCtHxvVmZc2HXEAP6r%0A0EngmZQrrMbfDHk1ZeQ%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1611422430/c8e0875feac1f2c7cb033be74fc9/AD_4nXfLU_bui3EXcCjQ0qm70HD97neqjGayKeDer_t76utlci8gZSUjYRhw6ZSOlDdqSEcwXBzd_shAh7pQEJ-8OoE0O21DM5coOgxmO_WD5hlwiuwtS2iYXcTavhIRyQT5zKFWvfn3NA?expires=1792754100&amp;signature=bf13299db0ecde3fd1984a00b06b37e962783ff1936c952705e4e05ce387ee3f&amp;req=dSYmF818n4VcWfMW1HO4zTEDa%2BkZnveAEv2ojHLMylYO7xVqVd4encbwZS%2BE%0AZdOy734r1IgOkjKSzDo%3D%0A)
 
 ## Turn on the Claude LTI Integration in Claude for Education organization settings
 
diff --git a/content/support/11818288-why-am-i-being-asked-to-verify-my-payment-method.md b/content/support/11818288-why-am-i-being-asked-to-verify-my-payment-method.md
index 3008598aec..d66f85094a 100644
--- a/content/support/11818288-why-am-i-being-asked-to-verify-my-payment-method.md
+++ b/content/support/11818288-why-am-i-being-asked-to-verify-my-payment-method.md
@@ -2,7 +2,7 @@
 
 If you see the following pop-up when you log in to your Claude account, you’ll need to click the “Verify now” button to verify your payment method:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1631413861/42c3b13d7fc44a11a88ec2b9cd03/AD_4nXeMx8QXpeZZCkfAnVSwx8KZ9n4Vr2rvPdQddyE6ZNxch__F6ZqFs1G4ZmU52Wvb7gRlwRqquTLdw8IQv-gICDyP-MXqiQK_Oe7gX3SKsCKKt2IEpMx4qDeMeeZufMaJfv16XgOH5g?expires=1792735200&amp;signature=e3ae9014a860be6ea127087721976d92bfc37c3d4efb8b36fd928ef0cda2018f&amp;req=dSYkF81%2FnolZWPMW1HO4zf7%2BjUbp64Xwn6MrEicvimAlivTHrVJUQVDUX2L4%0AksgPZ%2FbfvBL9ROLyk70%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1631413861/42c3b13d7fc44a11a88ec2b9cd03/AD_4nXeMx8QXpeZZCkfAnVSwx8KZ9n4Vr2rvPdQddyE6ZNxch__F6ZqFs1G4ZmU52Wvb7gRlwRqquTLdw8IQv-gICDyP-MXqiQK_Oe7gX3SKsCKKt2IEpMx4qDeMeeZufMaJfv16XgOH5g?expires=1792754100&amp;signature=37ceaaf9daa1564ca1d59e8e739826522a0a41f94528020cc092a14b175fc1f6&amp;req=dSYkF81%2FnolZWPMW1HO4zf7%2BjUbp7YTzn6MrEicvimD9ICMYIIcWrBbKLJ2R%0ADqUPQ4BGzy8%2BIpL9kk4%3D%0A)
 
 ## What happens if I click “Remind me later?”
 
diff --git a/content/support/11869629-use-claude-with-android-apps.md b/content/support/11869629-use-claude-with-android-apps.md
index b451d26949..abbefa06a2 100644
--- a/content/support/11869629-use-claude-with-android-apps.md
+++ b/content/support/11869629-use-claude-with-android-apps.md
@@ -222,7 +222,7 @@ Permission requirements vary by feature:
 
 For features requiring permissions (like location or calendar access), Claude will request permission contextually with clear explanations of why the access is needed. You’ll be prompted to approve the action with three options: Allow once, Always allow, or Don't allow.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1707351614/ccb910e4b87b1e96ad9a11bbd835/b57b2130-d8d6-4499-89f6-6c12de236fd4?expires=1792735200&amp;signature=2f629beeda850fb9440e40efa69414e88e0986645faa1bd30599f14a9f7ab34f&amp;req=dScnEcp7nIdeXfMW1HO4zQe5G12I2CD2S5x65TIld%2FCIXuy35wxLate%2BE0B%2B%0ASz9YReALVYyH99eOx0M%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1707351614/ccb910e4b87b1e96ad9a11bbd835/b57b2130-d8d6-4499-89f6-6c12de236fd4?expires=1792754100&amp;signature=ebfac9832c8e06c2d134cd2d945dc44d2a529fbbe36ae181180153be84f469f2&amp;req=dScnEcp7nIdeXfMW1HO4zQe5G12I3iH1S5x65TIld%2FAywLQOlXtESMkb0QxM%0AblvkhoBFOKbyysxiQzA%3D%0A)
 
 These permissions can be managed at any time in your device settings by going to Settings > Apps > Claude > Permissions. Click into each permission listed under **Allowed** and **Not allowed** to make changes. You can toggle between “Allow only while using the app” or “Ask every time” to change Claude’s access, or remove permissions by choosing “Don’t allow.” Claude will only request permissions if needed for specific features, and you can always choose to decline while still using other capabilities.
 
diff --git a/content/support/12005970-manage-usage-credits-for-team-and-seat-based-enterprise-plans.md b/content/support/12005970-manage-usage-credits-for-team-and-seat-based-enterprise-plans.md
index 3275c2c709..afb02d3b6e 100644
--- a/content/support/12005970-manage-usage-credits-for-team-and-seat-based-enterprise-plans.md
+++ b/content/support/12005970-manage-usage-credits-for-team-and-seat-based-enterprise-plans.md
@@ -70,7 +70,7 @@ After navigating to **[Organization settings > Usage](https://claude.ai/admin-se
 
 The **Usage and spend limits** section will show the current limit (if any) or **Unlimited**. Clicking on "Adjust limit" opens a modal where you can either input an amount and click "Set spend limit," or click "Set to unlimited" to remove the organization-wide monthly spend limit.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2149347604/936ac4eb025d3ef1f00c3b8a26b0/image.png?expires=1792735200&amp;signature=061599cdbc20834be2eaa7dab9b551c1d8a93d2aa60c71814ca5801b6456fb43&amp;req=diEjH8p6modfXfMW1HO4zQHwgqPQlSuk6DwhVVpk1mB7%2Bpq2B3quXNPUr2pO%0Az%2Fg7%2BzuNnO43xIW1IWE%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2149347604/936ac4eb025d3ef1f00c3b8a26b0/image.png?expires=1792754100&amp;signature=1a6290a0b0b14da45721e9acefc8b2f04729553124fb611579a47a82b78e81e1&amp;req=diEjH8p6modfXfMW1HO4zQHwgqPQkyqn6DwhVVpk1mA47MRNUcSBQlwtydGj%0A3%2B8vRJ%2BfLANfbdd%2FPhU%3D%0A)
 
 Changes to your organization’s overall spend limit go into effect immediately.
 
@@ -78,11 +78,11 @@ Changes to your organization’s overall spend limit go into effect immediately.
 
 Owners and Primary Owners on **seat-based Enterprise plans only** can set spend limits that apply to all users within a specific seat tier.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2149351600/c5b979c366ac2738f60ea84e85b3/CleanShot+2026-03-10+at+15_37_41%402x.png?expires=1792735200&amp;signature=4ae2859d0e0edc56b2b07e741060a8aaccb01f1acbccede5adab0e3543f585b1&amp;req=diEjH8p7nIdfWfMW1HO4zYnqMYeTIHWL0wfO62ivdG84II6C5FQtZchCzfr4%0A%2B1b46ZyXOCPUHSFtZjM%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2149351600/c5b979c366ac2738f60ea84e85b3/CleanShot+2026-03-10+at+15_37_41%402x.png?expires=1792754100&amp;signature=2f9185e89212e2d85e40cef5a89592af6215ed6a1e41a9281f2c19c51eda0892&amp;req=diEjH8p7nIdfWfMW1HO4zYnqMYeTJnSI0wfO62ivdG9fIusz1%2FcjV3sPZ9fc%0APOL663GbzULJC8SLUHc%3D%0A)
 
 Select the "By group" tab to see **Standard seats** and **Premium seats** groups. Click the "..." icon next to the current limit, then "Edit limit." This opens a modal where you can either select "Set dollar amount" and input an amount, or click "Unlimited" to remove the limit for that seat type. Click "Set limit" to save your changes.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2149362056/44993661ca2db771fe924d0346f6/image.png?expires=1792735200&amp;signature=9f93212e070dc6355e077eef2aaabfc4b58b52ba4d7eea94e96b5060313faa4b&amp;req=diEjH8p4n4FaX%2FMW1HO4zRzvvYcMc0hEq7nEDCGq9G7g8e5MrPDxADy%2FA9NA%0AUGRkgs9DG%2BSHv6gFM00%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2149362056/44993661ca2db771fe924d0346f6/image.png?expires=1792754100&amp;signature=7e51207a4206349cbe2439f54865c7d3e3b6e2598950c741be8c7c79bd876820&amp;req=diEjH8p4n4FaX%2FMW1HO4zRzvvYcMdUlHq7nEDCGq9G5pa44LJn%2B8lhY0XDIZ%0Aj%2BPxxwi055eGGy63r4Q%3D%0A)
 
 ---
 
@@ -90,11 +90,11 @@ Select the "By group" tab to see **Standard seats** and **Premium seats** groups
 
 Owners and Primary Owners can also set individual monthly spend limits for each member by finding **Spend limits by user** and clicking the "..." button next to the user, then "Edit limit."
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2149370853/db66f5cd03683b9cc119d0dcd6b8/image.png?expires=1792735200&amp;signature=917e20405d2a379b17ada1c4611d39f03924a9c28120ac62c9d085b3d1289af7&amp;req=diEjH8p5nYlaWvMW1HO4zaPdGAVQVipEe9HwvwG7ubi4JmlTAB1EN4nvmpo3%0AGzPGKyYZ2rEfH5C1tBs%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2149370853/db66f5cd03683b9cc119d0dcd6b8/image.png?expires=1792754100&amp;signature=24beda140a6391fb8ed090527b3570e23a1b2c65a6bca012adbcc0ad1bddf549&amp;req=diEjH8p5nYlaWvMW1HO4zaPdGAVQUCtHe9HwvwG7ubgIkqmDYxD3zbijwUZs%0AY70c4RO5vI4mygI4qtI%3D%0A)
 
 Enter the amount and click "Set limit." Alternatively, selecting "Set to unlimited" will remove that member's monthly spend limit (they will still be subject to any organization or seat-level spend limits).
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2149374028/97813fe3b515c2e839d8d92abd79/image.png?expires=1792735200&amp;signature=7b49924704feac20a741c75858a4d6720f4e1f5a9e72eb4dcd62df903ce22b8d&amp;req=diEjH8p5mYFdUfMW1HO4zevsA%2FWNMO6Iw6z2wGSwkbuOBfVPWKlP5Az4Ec1l%0ARBO1yUDQnGL5bnuys8w%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2149374028/97813fe3b515c2e839d8d92abd79/image.png?expires=1792754100&amp;signature=6747d851d7e40f67f6c1ccfc90017591471c21eb47064bf6794db8d0ba901be6&amp;req=diEjH8p5mYFdUfMW1HO4zevsA%2FWNNu%2BLw6z2wGSwkbu5RT7jekoRxyv24puh%0Aey7HJFhu0C2f1Lx%2Brw0%3D%0A)
 
 This allows owners fine control over usage credits, so you can set limits for different members based on their roles or individual needs. Once a user reaches their defined spend limit, this will automatically pause their usage credits until the end of the month. They will need to wait for their usage limits to reset before using Claude again.
 
diff --git a/content/support/12012173-get-started-with-claude-in-chrome.md b/content/support/12012173-get-started-with-claude-in-chrome.md
index 302ca990b8..28afea8f7d 100644
--- a/content/support/12012173-get-started-with-claude-in-chrome.md
+++ b/content/support/12012173-get-started-with-claude-in-chrome.md
@@ -38,7 +38,7 @@ Follow these steps to connect Claude in Chrome in your desktop app:
 
 4. Toggle the connector on, then download and install the extension if you haven’t already.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2604933811/ae37c41fc808dbdf48d135338334/6cc9ba4b-9d31-43a2-ab80-8048b5f9d791?expires=1792735200&amp;signature=dccbd94dbf00b1957045d5b3c5854f0cf32d7e42aa537a11285aec103d7e00c2&amp;req=diYnEsB9noleWPMW1HO4zUOPbf7BleePnt%2F2nPMwUPhwcPRofe7VaeL7okIf%0AYIZZyWmcjw%2BifF5La80%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2604933811/ae37c41fc808dbdf48d135338334/6cc9ba4b-9d31-43a2-ab80-8048b5f9d791?expires=1792753200&amp;signature=798522f76541e364b9c5ffde240d970dd58bad37b7de71bbe3170464e76bda08&amp;req=diYnEsB9noleWPMW1HO4zUOPbf7Bk%2BGPnt%2F2nPMwUPhP0XvYQgB33jvGpGX8%0A8LEcebLqPVDI4%2B%2Brp1M%3D%0A)
 
 Completing these steps will add Claude in Chrome to the “Connectors” drop-down on your chats with Claude. This is disabled by default, so you’ll need to enable it manually for each conversation.
 
diff --git a/content/support/12111783-create-and-edit-files-with-claude.md b/content/support/12111783-create-and-edit-files-with-claude.md
index 3b632ec405..bab542c7b7 100644
--- a/content/support/12111783-create-and-edit-files-with-claude.md
+++ b/content/support/12111783-create-and-edit-files-with-claude.md
@@ -48,7 +48,7 @@ These capabilities make it easy to produce professional documents by simply chat
 
 To give Claude access to external data sources, toggle **Allow network egress** on:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2054774005/25bcfffba6c249cd128d6c3f6d52/CleanShot+2026-02-11+at+16_34_47%402x.png?expires=1792735200&amp;signature=538e2b5ad8000726d769b971eb76dede96eb8b57e96ed22d6cda6d980cc83795&amp;req=diAiEs55mYFfXPMW1HO4zYFJyg9CD5zMPQVowIiib2mFU0b3GWoWTvCb1%2BYZ%0AnJjWUgV5bff8Zu7rGXA%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2054774005/25bcfffba6c249cd128d6c3f6d52/CleanShot+2026-02-11+at+16_34_47%402x.png?expires=1792753200&amp;signature=ce0f373995c4c65a1053be241cf3449a6273762c7c80f85677c3745f002bff1c&amp;req=diAiEs55mYFfXPMW1HO4zYFJyg9CCZrMPQVowIiib2kPAcgbxdGWiC0OgJ4U%0AK7KExlP1lPjLB8Ni5Rk%3D%0A)
 
 ### Enabling on Claude Mobile
 
@@ -66,11 +66,11 @@ Team and Enterprise organization owners can control network access settings in *
 
 - **Allow network egress to package managers and specific domains:** Claude can access package managers plus additional domains you specify. Add domains individually to whitelist specific resources your organization needs:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1789945362/ad72504d5429960f369b8b91b43c/86f06c0e-6eaa-4574-a4cb-2c38b273613a?expires=1792735200&amp;signature=32885b613df12044c3cbfc1cf146cdbcc3d16d9dcc3fe80c2dba96f53cb63395&amp;req=dScvH8B6mIJZW%2FMW1HO4zXJcB29ElixJpMW6Iph6YZeLergLlApTDrRR9R6h%0ARyjTeq%2BvGRFP%2BIXfbkE%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1789945362/ad72504d5429960f369b8b91b43c/86f06c0e-6eaa-4574-a4cb-2c38b273613a?expires=1792753200&amp;signature=d2bb11d8313c6e0aa17ce0e7ec056b81cb4e1495deb2aba71a1f8039e44d9c6d&amp;req=dScvH8B6mIJZW%2FMW1HO4zXJcB29EkCpJpMW6Iph6YZfEdFS1JMhsF4f%2BDz30%0ARD9ToUo%2FSYWU5sC9JYc%3D%0A)
 
 **All domains:** Claude has full internet access except for domains on Anthropic's legal blocklist. While this provides maximum flexibility for file creation and analysis tasks, it’s also the riskiest option. Please review the **[security considerations below](#h_0ee9d698a1)** before enabling “All domains”:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1789945361/e3188cb8edb9ca7c303615da6378/f1c99a7d-5956-48d5-9ec7-b7ae6c8c3d28?expires=1792735200&amp;signature=e5cc9aadd586d21e1aeae00c481b4fc9099a0fe1b861c39d070f887bcf8c6b6b&amp;req=dScvH8B6mIJZWPMW1HO4zdnseRaV7TqgqgKIA6CM1tpO%2BndhY9IWQyItwCdH%0AfRLWyZM7Gh7WUrgy0%2Fg%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1789945361/e3188cb8edb9ca7c303615da6378/f1c99a7d-5956-48d5-9ec7-b7ae6c8c3d28?expires=1792753200&amp;signature=e6ae74385b75bf8769f46c2422c341ac44c9496c6a11abe0d97bcf30ac0d52c7&amp;req=dScvH8B6mIJZWPMW1HO4zdnseRaV6zygqgKIA6CM1tqWRaBejTSEOj%2FqlymE%0AVy9kVXkE40S52kXOJfw%3D%0A)
 
 ---
 
diff --git a/content/support/12157520-claude-code-usage-analytics.md b/content/support/12157520-claude-code-usage-analytics.md
index 36f823ee43..abf6ad79e1 100644
--- a/content/support/12157520-claude-code-usage-analytics.md
+++ b/content/support/12157520-claude-code-usage-analytics.md
@@ -46,7 +46,7 @@ The **Usage** tab displays the following metrics for your organization. Data on
 
 - **Top commands**: The Claude Code commands used most often across your organization.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1717579277/46c512f4b3ed05c359cecd78ed5c/e0ce2c19-39e2-411f-9a1f-cb1d46439a42?expires=1792735200&amp;signature=e0bf3874b121c7d78aeba7db75df292ce5743f754fc650a06851f971b0dbd61a&amp;req=dScmEcx5lINYXvMW1HO4zfiEPqRXjHzMCX9h5MbdDjOtwCmEYtnw1DDWe2J0%0AQa1gtRzmTGaM3YN8o0s%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1717579277/46c512f4b3ed05c359cecd78ed5c/e0ce2c19-39e2-411f-9a1f-cb1d46439a42?expires=1792754100&amp;signature=2174947966ce6209e2f3a1630da6a2f4d4be31e162e0dd60b686d7f0726d9b05&amp;req=dScmEcx5lINYXvMW1HO4zfiEPqRXin3PCX9h5MbdDjOYLbcNtVYuEMg3h6OK%0AvgvnLoIqms1EySa4dmI%3D%0A)
 
 ### User-level metrics
 
diff --git a/content/support/12260368-use-incognito-chats.md b/content/support/12260368-use-incognito-chats.md
index 5fbce7f0b4..5fd56a633d 100644
--- a/content/support/12260368-use-incognito-chats.md
+++ b/content/support/12260368-use-incognito-chats.md
@@ -34,7 +34,7 @@ These differ from regular chats in several ways:
 
 When starting a new chat with Claude outside of a project, you'll see a ghost icon in the upper right corner of your screen:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1719768744/c7a2fa56cf284e48472f3b9c4dbf/030563f8-9f97-4891-a749-9ae95968a063?expires=1792735200&amp;signature=8a33a4764942ba4b81a45cb43c76d9cdbccd07a6835e894d34787184eb5d8e20&amp;req=dScmH854lYZbXfMW1HO4zeUcugC6beCJDCAt3Cx%2FSO2DZ6OTh31uawXaj6ng%0A8tw0T4OW%2FCF66aGrXmA%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1719768744/c7a2fa56cf284e48472f3b9c4dbf/030563f8-9f97-4891-a749-9ae95968a063?expires=1792754100&amp;signature=bfb9588f287878ad4fabdb066dffb9682fe22394b07c2e9067a3ac92f8da593f&amp;req=dScmH854lYZbXfMW1HO4zeUcugC6a%2BGKDCAt3Cx%2FSO2nE1ZicdhewzebeJyI%0AdQbFbQVmaSE3xe%2Btix8%3D%0A)
 
 1. Click the ghost icon to enable incognito mode.
 
diff --git a/content/support/12293051-use-claude-in-xcode.md b/content/support/12293051-use-claude-in-xcode.md
index 23b6683f19..7809031274 100644
--- a/content/support/12293051-use-claude-in-xcode.md
+++ b/content/support/12293051-use-claude-in-xcode.md
@@ -34,7 +34,7 @@ To start using Claude in Xcode:
 
 3. Log in with your Claude account.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1727371585/b18ca03a6357c52d12d10386f28e/dab2dcb2-f670-4173-b77d-38767a34cec1?expires=1792735200&amp;signature=c7e52585f1c045af00037ba71e7a08d31bbf8a12ee9efc60341a9ae427b0f688&amp;req=dSclEcp5nIRXXPMW1HO4zUAXIs4FUa3WFalhp3bugHLKAInFAfgM79zQW8a8%0Af1ij3NlxgsUci5xwkLw%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1727371585/b18ca03a6357c52d12d10386f28e/dab2dcb2-f670-4173-b77d-38767a34cec1?expires=1792754100&amp;signature=66163365a5578db54ac65817560ab7916682b47403238280f7d3513105e1b066&amp;req=dSclEcp5nIRXXPMW1HO4zUAXIs4FV6zVFalhp3bugHJoirfhqMu6txfPBxSC%0AZ5%2F2vYS2HzQQG9CpEwU%3D%0A)
 
 ## Usage limits
 
diff --git a/content/support/12429409-manage-usage-credits-for-paid-claude-plans.md b/content/support/12429409-manage-usage-credits-for-paid-claude-plans.md
index c0dcbcbffa..17a680622d 100644
--- a/content/support/12429409-manage-usage-credits-for-paid-claude-plans.md
+++ b/content/support/12429409-manage-usage-credits-for-paid-claude-plans.md
@@ -50,7 +50,7 @@ To enable usage credits on your paid Claude plan:
 
 8. You can also enable auto-reload to automatically make a purchase when your balance falls below a threshold you set:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1805819785/5e203c38e6ba3f76bfd1dab0d5ce/fe062e7c-18cb-48cc-a7e2-754ac6e6c4be?expires=1792735200&amp;signature=85c4a11f57ecfc8cb469687a37616688e84263224028085357be8f8df8811ddd&amp;req=dSgnE8F%2FlIZXXPMW1HO4zYj2ABCepvU6opE7m38Ydfep9vCcJ%2F5X9SKwFz3X%0ASvC1cLz3420iD6r%2FTpY%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1805819785/5e203c38e6ba3f76bfd1dab0d5ce/fe062e7c-18cb-48cc-a7e2-754ac6e6c4be?expires=1792754100&amp;signature=be026f2cf1659991b3d864e3bba9233f312345a88d5902f0d9b73e81fda3f96b&amp;req=dSgnE8F%2FlIZXXPMW1HO4zYj2ABCeoPQ5opE7m38YdfdRvAQ%2FziUONdPZj66D%0AsPLqPqWkceOvxmco36k%3D%0A)
 
 ---
 
diff --git a/content/support/12466728-troubleshoot-claude-error-messages.md b/content/support/12466728-troubleshoot-claude-error-messages.md
index 5ac953ad6d..924c209cc7 100644
--- a/content/support/12466728-troubleshoot-claude-error-messages.md
+++ b/content/support/12466728-troubleshoot-claude-error-messages.md
@@ -60,4 +60,4 @@ Capacity issues will not appear on our status page because they represent normal
 
 Service incidents are disruptions where Claude is unavailable or significantly degraded for all or most users. These represent actual technical problems with our systems. To check for confirmed incidents, visit status.claude.com, where you'll find real-time updates on scope, impact, and resolution progress for any active incidents.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1753796247/e6a8c6ef8653b229c5758e881242/c2fc6fc0-d163-4119-93e0-394104d86bc9?expires=1792735200&amp;signature=847ec47e2785b099e2fa61bacac8dae7f8fadde396ba3ade638e374df9cb1585&amp;req=dSciFc53m4NbXvMW1HO4za4BX60k0bfG7y68oYp%2BYg8itt2g0mL7WfWwD%2B7Q%0AfRhQHMZCLXnH%2Fa7JZbE%3D%0A)
\ No newline at end of file
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1753796247/e6a8c6ef8653b229c5758e881242/c2fc6fc0-d163-4119-93e0-394104d86bc9?expires=1792754100&amp;signature=82417840e0ee86215eddde26c8e6e3779be3a6bf343ce60cd402db3b990ba095&amp;req=dSciFc53m4NbXvMW1HO4za4BX60k17bF7y68oYp%2BYg%2BwEjmH0dTwos7kK46E%0ATwBtFAP7Q5j7R8Z5gwk%3D%0A)
\ No newline at end of file
diff --git a/content/support/12512180-use-skills-in-claude.md b/content/support/12512180-use-skills-in-claude.md
index 380e968a1d..2598901c0b 100644
--- a/content/support/12512180-use-skills-in-claude.md
+++ b/content/support/12512180-use-skills-in-claude.md
@@ -202,7 +202,7 @@ To remove a custom skill you've uploaded:
 
 4. To delete the custom skill entirely, click the "..." button next to the toggle, then select "Delete":
 
-  ![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2105391273/8359cbf8be20dce0f1cd3fd40e6f/CleanShot-2B2026-02-25-2Bat-2B15_50_16.png?expires=1792735200&amp;signature=24a09a84c052494ff3ecdfcfef5c3f994ce9564805cc35ab3ac4fac1d5593be5&amp;req=diEnE8p3nINYWvMW1HO4zSOgDikvweOvH%2BdCnFXB0ui%2BxcgN0XJtcsKPfBoB%0AHdlS%0A)
+  ![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2105391273/8359cbf8be20dce0f1cd3fd40e6f/CleanShot-2B2026-02-25-2Bat-2B15_50_16.png?expires=1792754100&amp;signature=9c4aed5413434fd438e7026096cf385e75f09170bda76a73edcbc36ddfc16ea8&amp;req=diEnE8p3nINYWvMW1HO4zSOgDikvx%2BKsH%2BdCnFXB0ugyHlEgamSfYpN2QUMp%0As9KF%0A)
 
 5. Click "Delete" in the confirmation prompt.
 
diff --git a/content/support/12592343-enabling-and-using-the-desktop-extension-allowlist.md b/content/support/12592343-enabling-and-using-the-desktop-extension-allowlist.md
index ad582e477c..854ed67beb 100644
--- a/content/support/12592343-enabling-and-using-the-desktop-extension-allowlist.md
+++ b/content/support/12592343-enabling-and-using-the-desktop-extension-allowlist.md
@@ -20,11 +20,11 @@ The desktop extension allowlist is disabled by default, so an organization Owner
 
 4. Switch to the "Desktop" tab:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1781755172/63c92550571842577ad435860ec5/6f5cc4e1-ff7d-48de-863a-c4e6184d4605?expires=1792735200&amp;signature=efab3971ae86d9362ed16ffdc0da106a4d280f78413bfdeebf66c43ed906c330&amp;req=dScvF857mIBYW%2FMW1HO4zQ9pXEgN%2FHXZ0ugSQm1MFW9GjHNQ9vhst75fxxil%0ANn6X%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1781755172/63c92550571842577ad435860ec5/6f5cc4e1-ff7d-48de-863a-c4e6184d4605?expires=1792754100&amp;signature=72bd7745092339985ed050f490be9c75a2ffbca40639e865edc76b76790f8059&amp;req=dScvF857mIBYW%2FMW1HO4zQ9pXEgN%2BnTa0ugSQm1MFW%2BDo%2FC5bo9rZyQSEdPZ%0ATwSh%0A)
 
 5. Toggle **Allowlist** on:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1781755578/a6bafff5f084dc86ae463703fd3d/6cf0ee18-4e71-4129-98e8-cc08174e3c3a?expires=1792735200&amp;signature=82325e05efccff0507e117a908ba073fb42fab9de6141d2c4eab19a576eef281&amp;req=dScvF857mIRYUfMW1HO4zaj0BXMsSqIGTAorLxpdoc%2BphSHQ%2BGY8np88G9FA%0Amy9I%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1781755578/a6bafff5f084dc86ae463703fd3d/6cf0ee18-4e71-4129-98e8-cc08174e3c3a?expires=1792754100&amp;signature=834570cdc239ad92edd0ebf20aef05e6ec2766c170c8ea29f766ec7f98379894&amp;req=dScvF857mIRYUfMW1HO4zaj0BXMsTKMFTAorLxpdoc8T8Y2c9lj4yBUwBYhV%0ARhrc%0A)
 
 ## What happens after enabling the allowlist?
 
@@ -42,7 +42,7 @@ Consider completing the allowlist setup during off-hours to minimize disruption
 
 **Important:** The allowlist requires Claude Desktop version 0.13.91 or higher, so users should update the desktop app by clicking “Claude”, then either “Check for updates” or “Restart to update to Claude 0.13.91”:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1781756960/ad18af50c83d35f2673656c23e00/a7ee450f-0c7d-42d6-a75f-fb1bc088cb52?expires=1792735200&amp;signature=c79d5a45eb792aea77feac184f77b7f051e680e511d586228bc01d8915f1e803&amp;req=dScvF857m4hZWfMW1HO4zYUJqIGtCTfpCEDZ5AdBjIaiOmbyPE4AD7ipMLMG%0Ad3lrgH9dClIV0y3cLSs%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1781756960/ad18af50c83d35f2673656c23e00/a7ee450f-0c7d-42d6-a75f-fb1bc088cb52?expires=1792754100&amp;signature=ea6c039b2334a6d56ea89c88f68452ae30205177a476a22aef163b376b205871&amp;req=dScvF857m4hZWfMW1HO4zYUJqIGtDzbqCEDZ5AdBjIbwZf0Xca9E0UTGgVMp%0AyX%2BT2a3TX1c%2FoXCstxM%3D%0A)
 
 ## Managing allowed extensions
 
@@ -60,7 +60,7 @@ After enabling the allowlist, you can choose which extensions to allow:
 
 If you want to remove an extension from the allowlist, click the “...” button and “Remove from allowlist.”
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1781751250/6558c0f59aea7976bd44b0213d76/e750f02b-cd0d-437e-a83f-9ac362cdf456?expires=1792735200&amp;signature=e6727dcc8ad6b495f6525fa1bdc674352b500d1e48a44253898ea13fc7fae9fe&amp;req=dScvF857nINaWfMW1HO4zTrxBKou%2FFKXqXridZhfx1L0V1%2FhLmgGkLpiDrgz%0A5cLExxhZgmgZhTD8w7Y%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1781751250/6558c0f59aea7976bd44b0213d76/e750f02b-cd0d-437e-a83f-9ac362cdf456?expires=1792754100&amp;signature=3fb185ebe8176d6c30dd9080a3f8b3c2119826845294d7ee267b6e922dea816c&amp;req=dScvF857nINaWfMW1HO4zTrxBKou%2BlOUqXridZhfx1I7LO7uUNUrfZAdqEso%0AXtN4i%2FRf2CMhAZvd3YA%3D%0A)
 
 ## Uploading custom extensions
 
diff --git a/content/support/12618689-use-claude-code-in-the-cloud.md b/content/support/12618689-use-claude-code-in-the-cloud.md
index 7345e4e705..e9abef507b 100644
--- a/content/support/12618689-use-claude-code-in-the-cloud.md
+++ b/content/support/12618689-use-claude-code-in-the-cloud.md
@@ -10,7 +10,7 @@ This feature works with repositories you may not have on your local machine. You
 
 Cloud sessions enable asynchronous development workflows. In a local session in your terminal or editor, you typically work synchronously: you make a request, wait for Claude to respond, review the changes, then make another request. Synchronous work like this gives you fine-grained control but requires your attention throughout the process. A cloud session handles this differently: you can assign a larger task, let Claude work independently, and return later to review the completed work.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1786446157/07ec74cd46317f8278083a317841/6448f3ee-c6df-4417-8a13-90d8c2ca3d55?expires=1792735200&amp;signature=8ea9a8eafd9baa2d523e20d8ccbe44f86b619a02cc350388ec4cd8413ea890c1&amp;req=dScvEM16m4BaXvMW1HO4zR8%2BAVGHQZh07XrRA1YwWGs38PgFq0HAo3CxW9sv%0AvO2Q8M2sgfDIbg4HFwk%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1786446157/07ec74cd46317f8278083a317841/6448f3ee-c6df-4417-8a13-90d8c2ca3d55?expires=1792754100&amp;signature=f661472039bd95485ed863552c7bd1496d69053209f69fdd176c3db192efd869&amp;req=dScvEM16m4BaXvMW1HO4zR8%2BAVGHR5l37XrRA1YwWGturq1xrWkT%2FSnv20E8%0A5uIThCTDvV5q2jFx%2BM8%3D%0A)
 
 You can also run multiple tasks in parallel. Since each task runs in its own isolated environment, you can have Claude working on several different issues or repositories simultaneously. Each task proceeds independently and creates its own pull request when complete. More than one task can work on the same repository at the same time.
 
@@ -20,13 +20,13 @@ You can also run multiple tasks in parallel. Since each task runs in its own iso
 
 When you start a cloud session, Claude Code creates an isolated virtual machine for your work. Your GitHub repository is cloned into this environment, which comes pre-configured with common development tools and language ecosystems.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1786446158/c092f1383826cb871493f74169d4/97b7cb98-5da2-438e-a920-e170b8b9790e?expires=1792735200&amp;signature=8b159b92286e7a6ee1aa6758d760e2966e9b6abefd1a726cc9c5c6b6a8d2f606&amp;req=dScvEM16m4BaUfMW1HO4zcR0rJQzjOzC7DtpMiX%2FBYlviX34eAI53y5XPOlI%0AM5%2BGr75ndmeRhfd0Mis%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1786446158/c092f1383826cb871493f74169d4/97b7cb98-5da2-438e-a920-e170b8b9790e?expires=1792754100&amp;signature=11e1d1a221dcb125b7299af96252cb92e9d2831315e6a0637ae5679234e26cbf&amp;req=dScvEM16m4BaUfMW1HO4zcR0rJQziu3B7DtpMiX%2FBYn6qa1RD1dFpj7oGd%2Bz%0AVz%2FGmKXPQuI4EOV68eQ%3D%0A)
 
 Claude prepares the environment by running any setup commands you've defined in your repository's configuration. This includes installing dependencies, setting up databases, or running other initialization steps your project needs. If your task requires network access, maybe to install packages or fetch data, you can configure the level of internet access the environment has.
 
 Once the environment is ready, Claude begins working on your task. Claude reads your code, makes changes, writes tests, and runs commands to verify the work. You can monitor progress and provide guidance through the web interface if needed.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1786446156/83ecf0a5b98eddc9ffc9694c50f7/353589ce-b678-441d-8909-71b45fa2d065?expires=1792735200&amp;signature=202add79f0ccf7200e839b6f6fd86f6195b3384408403880363437a8c2fd8481&amp;req=dScvEM16m4BaX%2FMW1HO4zVbcTWGE4MHMUQl3YqgIJda1VcjB6L7OYwVQb2m2%0AHyhcOcO62xt3snyneMw%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1786446156/83ecf0a5b98eddc9ffc9694c50f7/353589ce-b678-441d-8909-71b45fa2d065?expires=1792754100&amp;signature=c5175425f71dc01e6205310198edbf4c3880218bfcaaeea4f7b87bf7b7f59849&amp;req=dScvEM16m4BaX%2FMW1HO4zVbcTWGE5sDPUQl3YqgIJdaLZWSnjaRWafWsySGi%0AsUy2OwP9DuOfwWJeHgg%3D%0A)
 
 When Claude completes the task, it pushes the changes to a new branch in your GitHub repository. You receive a notification and can review the changes, then create a pull request directly from the interface. The pull request includes all of Claude's work, ready for your review and any additional changes you want to make.
 
diff --git a/content/support/12626668-use-quick-entry-with-claude-desktop-on-mac.md b/content/support/12626668-use-quick-entry-with-claude-desktop-on-mac.md
index 891ed6efda..08f0186e98 100644
--- a/content/support/12626668-use-quick-entry-with-claude-desktop-on-mac.md
+++ b/content/support/12626668-use-quick-entry-with-claude-desktop-on-mac.md
@@ -40,7 +40,7 @@ When you first open the updated version of Claude Desktop, you'll see a prompt t
 
 Once enabled, double-tapping Option will open a text box where you can type your message and start a new chat. You can also click "New chat" to see your five most recent conversations.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1893088365/2ca4b782dda90abea1fe5f4150af/CleanShot+2025-12-18+at+13_14_30%402x.png?expires=1792735200&amp;signature=1d9544ccefc8da59739475d77b75e2520cce36994af9f824ba43f599dd755a78&amp;req=dSguFcl2lYJZXPMW1HO4zWggDtxWpZmYRC8c%2FcM5c2KkutsnkxpVglX%2FLyWY%0A%2BePbRykUY9cPWJh9DoY%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1893088365/2ca4b782dda90abea1fe5f4150af/CleanShot+2025-12-18+at+13_14_30%402x.png?expires=1792754100&amp;signature=a932bc04d4ade315a223119bf0371249ac5a74fa06a04db985628c2064ea5aa7&amp;req=dSguFcl2lYJZXPMW1HO4zWggDtxWo5ibRC8c%2FcM5c2KFWeKIObRSl71cOccX%0Aoh90r30OSZsr7EoR0PU%3D%0A)
 
 ### Enable the voice shortcut (optional)
 
diff --git a/content/support/12883420-view-usage-analytics-for-team-and-enterprise-plans.md b/content/support/12883420-view-usage-analytics-for-team-and-enterprise-plans.md
index 2dfe9258ac..bd0d9e6ffe 100644
--- a/content/support/12883420-view-usage-analytics-for-team-and-enterprise-plans.md
+++ b/content/support/12883420-view-usage-analytics-for-team-and-enterprise-plans.md
@@ -22,7 +22,7 @@ This page includes the following analytics:
 
 - Sessions in Cowork
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515895966/9f231a620f47d49e0ee648152189/848c1787-4eaa-4809-8fd2-1dbe2722560f?expires=1792735200&amp;signature=6752927aa088116b208d1a53ec431429004390cd460fc4ce907fb3918cac37bb&amp;req=diUmE8F3mIhZX%2FMW1HO4zZL6wKR1mIBzExEG4dCAGDY3UUUjCr6MY71hMOWi%0A1RwADj0yiuU9Wa9TItE%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515895966/9f231a620f47d49e0ee648152189/848c1787-4eaa-4809-8fd2-1dbe2722560f?expires=1792754100&amp;signature=39d5397f777d4184c77f563458ff93f3c6123d16fc2b0473e2f56d06932619b2&amp;req=diUmE8F3mIhZX%2FMW1HO4zZL6wKR1noFwExEG4dCAGDbnGLrKmuL5pk7x%2Fv5g%0AXFSZYk%2FIBy2dwQpcUF8%3D%0A)
 
 ### Who’s using Claude?
 
@@ -34,7 +34,7 @@ This page includes the following analytics:
 
 Use the dropdown on the **Active members and assigned seats** chart to filter by product, including Claude Design.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515896351/4d955858e6662c37489cc1470871/457cf159-8c2a-4403-ba22-cb92cb47e459?expires=1792735200&amp;signature=a399460fc330a7eee6ef3f549999d3e5ecd8e9d0a67204ae0e61c71ad176f198&amp;req=diUmE8F3m4JaWPMW1HO4zYEqezWuQZWtYqPRsgaNdTwzgGi5d70AC0gIfaVJ%0AoHtwP5cYi1humRBuCtM%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515896351/4d955858e6662c37489cc1470871/457cf159-8c2a-4403-ba22-cb92cb47e459?expires=1792754100&amp;signature=43aafc6934987eb7d1efaf110a1b2c1390cbf42477bd011698c7bb861ff43464&amp;req=diUmE8F3m4JaWPMW1HO4zYEqezWuR5SuYqPRsgaNdTzXjv7YDZ1DXxJUdLKd%0Aj0aGf4XMPE%2Braiow2qE%3D%0A)
 
 ### How are they using Claude?
 
@@ -48,9 +48,9 @@ Use the dropdown on the **Active members and assigned seats** chart to filter by
 
 - How agentic is their work? (beta)
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2583875713/e3cb3c329f3b643cb9a3809876b3/image.png?expires=1792735200&amp;signature=7bfc3fabf83f8445160954af24aef08356265018348d9970e2925fef7dec53b6&amp;req=diUvFcF5mIZeWvMW1HO4zciS3KrumbtpDFD6TO7tG4ho2CJjg5jOzBrghNuc%0Ah0E7vEcy8btWVO%2BUH%2Bg%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2583875713/e3cb3c329f3b643cb9a3809876b3/image.png?expires=1792754100&amp;signature=41d4ac8cd8a8e1d91d9df17029600d3ac9c9daad32f6d04b42fd00b0c229056b&amp;req=diUvFcF5mIZeWvMW1HO4zciS3Krun7pqDFD6TO7tG4ij1WCmBM7YqcMst%2FOU%0A3R4XcOe5akP%2BxEnm8qM%3D%0A)
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515896563/abf008596ce5501297a609696362/fce5423c-4769-4b73-9a0a-c50f6407ebea?expires=1792735200&amp;signature=c56dfd1367fcdb79a932191dc5981d5531b4cd842c1640aab2fa9365fc8d4da4&amp;req=diUmE8F3m4RZWvMW1HO4zR%2BID4VpvvL1LS3kobW3ZgRi8AlwZiA%2Bdg9hFL%2Fj%0AoRPjNNOXgNIiPaidqPw%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515896563/abf008596ce5501297a609696362/fce5423c-4769-4b73-9a0a-c50f6407ebea?expires=1792754100&amp;signature=b71637d41e796333c866209be4b7ea53cba8b12d3df0eef13a8bdec17e951053&amp;req=diUmE8F3m4RZWvMW1HO4zR%2BID4VpuPP2LS3kobW3ZgTu0650VJGFzIPoxRza%0AFkMkBkmiuGtg51CZFB0%3D%0A)
 
 ### What are the results?
 
@@ -66,7 +66,7 @@ Use the dropdown on the **Active members and assigned seats** chart to filter by
 
 - Estimated time saved
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515896943/dd415f03afe56ca38308ef987f86/189e8ebc-5594-4f4b-bd84-e3c11c824d5b?expires=1792735200&amp;signature=d204fcc58e0575b3b4a079d07f20423e0eeefd910803dc405c16ea3755ff6bac&amp;req=diUmE8F3m4hbWvMW1HO4zfJThSY4qtlEiovaLYNN7Rmx7OsBEYszpm8ZguVe%0AhR%2BnIzop7bEH%2FYcmWl4%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515896943/dd415f03afe56ca38308ef987f86/189e8ebc-5594-4f4b-bd84-e3c11c824d5b?expires=1792754100&amp;signature=8ea697b7caf9daa7fab6f1fb165760aa15a6131b6cf87dbff09fc96794266a1e&amp;req=diUmE8F3m4hbWvMW1HO4zfJThSY4rNhHiovaLYNN7RlP%2BgdqHLW%2B3hXPgfq4%0AHVFy0qLpYe61PJg3M6Y%3D%0A)
 
 ### How much is Claude costing?
 
@@ -82,9 +82,9 @@ This section includes the following analytics:
 
 - Spend by model (month-to-date, quarter-to-date, year-to-date, 1 year)
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515896942/b403f2d216fc40b5195911020b8e/446b99f1-3187-4b79-b2be-9f17b1632ff8?expires=1792735200&amp;signature=e96a65f8b56e00e464b6e84ad83135331a02f85412be74539f8e1a1ab8ffc622&amp;req=diUmE8F3m4hbW%2FMW1HO4zYE%2BQtwF7zTfWbBLGZ4vBJWORS%2FlrGrke%2BI%2B%2BDt0%0AwAT%2BWeio4m3LEZvwCMA%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515896942/b403f2d216fc40b5195911020b8e/446b99f1-3187-4b79-b2be-9f17b1632ff8?expires=1792754100&amp;signature=4a63e6f7498e440ba8a54bc80c21874a84768d965b40152cf4b5b653edaee8c9&amp;req=diUmE8F3m4hbW%2FMW1HO4zYE%2BQtwF6TXcWbBLGZ4vBJU1%2FRgGtZGFD5DQMd25%0A9RVQ1tcNeY0gd4oHpYE%3D%0A)
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515896941/2239ce38639df339b24d5af1cb50/f829bc2a-ee52-4135-9b13-09ef1b7d66d6?expires=1792735200&amp;signature=f30b8beaa8e777d6e0b3418eaf1790da4136e28696c42a0f77d3daa24e17ce75&amp;req=diUmE8F3m4hbWPMW1HO4zTz0N%2BgFJMxSC%2BtvTPa1I7FJnS1wpNyGqjw9XBs%2B%0A%2FrrsaND%2BKnsjMvVj%2B3o%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515896941/2239ce38639df339b24d5af1cb50/f829bc2a-ee52-4135-9b13-09ef1b7d66d6?expires=1792754100&amp;signature=23d354b72d57738096949441b41a5ab0a2c6cbe77699d0ad68ad5252470cc95c&amp;req=diUmE8F3m4hbWPMW1HO4zTz0N%2BgFIs1RC%2BtvTPa1I7EmuGRoNkTOZXtA7wGO%0A%2BCeZJ753S0rmEVAIOxE%3D%0A)
 
 **Note:** For a view of how spend limits are affecting your organization, you can also check the **Blocked by a spend limit** section at the top of **[Organization settings > Usage](https://claude.ai/admin-settings/usage)**. **Blocked by a spend limit** is built for usage-based Enterprise plans. Orgs without usage-based seats only see how many members are blocked or near their limit right now. Learn more about **[monitoring usage and spend on Enterprise plans](https://support.claude.com/en/articles/11526368-how-am-i-billed-for-my-enterprise-plan#h_ae17ec8236)**.
 
@@ -162,7 +162,7 @@ Navigate to **[Analytics > Claude Chat](https://claude.ai/analytics/usage)** to
 
 - Top members by chats
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515898793/405db0c492da11886c28a2b82731/71a55afc-1cef-4c50-b7e1-86775cb9a168?expires=1792735200&amp;signature=a92b5968a19fc3aecf44de4d5b354a784edc0d755edd371c84de1a5f2225bee0&amp;req=diUmE8F3lYZWWvMW1HO4zbhc8P%2BbYuEjTcfMEUwBBiXCnZLvwK4HClKPGZ5Y%0AXKJT6yDgABi%2FEBn5XRg%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515898793/405db0c492da11886c28a2b82731/71a55afc-1cef-4c50-b7e1-86775cb9a168?expires=1792754100&amp;signature=bf97e4caa1751e655bf36d712a3e9529bcf77653fd7f939b05dce56813d21bfc&amp;req=diUmE8F3lYZWWvMW1HO4zbhc8P%2BbZOAgTcfMEUwBBiVlj37zgwnjwtLRHc4W%0AA4Uvou5cQnFfWlCx7hg%3D%0A)
 
 ### Projects
 
@@ -174,7 +174,7 @@ Navigate to **[Analytics > Claude Chat](https://claude.ai/analytics/usage)** to
 
 - Top members by project usage
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515899610/91d93108f0767e795fb9e488e882/71607d6d-dff1-4a13-a445-aa1d79850eed?expires=1792735200&amp;signature=7075c2bade6eda28dc0963f523905ef8c00f08368122cdb52d0dca2fbbbeedd0&amp;req=diUmE8F3lIdeWfMW1HO4zWhGoD6emCagExu5cYiHHN8e5loFlAZfpVmtSRUU%0AQvPn9gcXzGrz8%2Bgp5gc%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515899610/91d93108f0767e795fb9e488e882/71607d6d-dff1-4a13-a445-aa1d79850eed?expires=1792754100&amp;signature=389bea4d809491cf75ff7533e6ec329a1e624cee04635afeb4e61f20282e6f5e&amp;req=diUmE8F3lIdeWfMW1HO4zWhGoD6eniejExu5cYiHHN%2FyR9L46m4exq8YFbrZ%0APt2aRrzGWZkaa%2BWFH60%3D%0A)
 
 ### Artifacts
 
@@ -184,7 +184,7 @@ Navigate to **[Analytics > Claude Chat](https://claude.ai/analytics/usage)** to
 
 - Top 10 users by artifacts generated (month-to-date, quarter-to-date, year-to-date, 1 year)
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515899838/33d737f2357d6e485704669962ae/43faadc3-47da-4a93-bbb7-47a7983e7441?expires=1792735200&amp;signature=b178a352247915aa895cde334da4f49b2673dc455e792747cdd406226baf154b&amp;req=diUmE8F3lIlcUfMW1HO4zcSk47jVfevCjHDogqK0V%2Byl%2FPCLDPD3h%2B1Ybhi0%0Akvmr3yAYWvj8ks%2FGZOk%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515899838/33d737f2357d6e485704669962ae/43faadc3-47da-4a93-bbb7-47a7983e7441?expires=1792754100&amp;signature=7dde4341e82f1da7e2eb9a8d506f6fccfbe31dd4c5cf1b470c432dde29ecf40b&amp;req=diUmE8F3lIlcUfMW1HO4zcSk47jVe%2BrBjHDogqK0V%2ByF18PxiNnnjJGeOnkW%0AVnhwgOnH%2BVowkpcUNlo%3D%0A)
 
 ---
 
@@ -280,7 +280,7 @@ Navigate to **[Analytics > Cowork](https://claude.ai/analytics/cowork)** to view
 
 - Daily, weekly, and monthly active Cowork users
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515901489/8005693d55b7fefbfe9233258d39/106c22a0-3f47-47a6-abbd-4788dd70f218?expires=1792735200&amp;signature=ace43498790ead7a8d5c11b31837827225669100e1ab7bec9492a17859363d3c&amp;req=diUmE8B%2BnIVXUPMW1HO4zX7WE4q2XkSqFSi1Z3SzLLuLwgy1t5QavHGl4dDf%0A1SxzQKWDAnoYJLiKDr0%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2515901489/8005693d55b7fefbfe9233258d39/106c22a0-3f47-47a6-abbd-4788dd70f218?expires=1792754100&amp;signature=1856909684589546821b9957849c0c9abdb2feb0feaf48e22c5356de76628200&amp;req=diUmE8B%2BnIVXUPMW1HO4zX7WE4q2WEWpFSi1Z3SzLLvx32moSEh3Ow4BNniG%0AcUL4XJstghDv0TIctz4%3D%0A)
 
 **Note:** Cowork analytics are available alongside Chat and Claude Code data in the **[Analytics API](https://platform.claude.com/docs/en/manage-claude/analytics-api)**.
 
@@ -296,7 +296,7 @@ Navigate to **[Analytics > Surveys](https://claude.ai/analytics/surveys)** to as
 
 On Enterprise plans with usage-based billing, when your admin turns on individual usage analytics, any member of the organization can see their own usage broken down by product, model, and skill, along with where they stand against any spend limits set for them. Individual usage analytics are available in **[Settings > Usage](https://claude.ai/settings/usage)**.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2533906328/1f5cd0a57def40676410f8f379b4/member-usage-30d-model.png?expires=1792735200&amp;signature=88fd2414ccfb86b74c349543fa2ea6264c75e266b424b7cd542e9c4d31248326&amp;req=diUkFcB%2Bm4JdUfMW1HO4zfveBq3Cf%2B7YWGUKUw6QS49R9q0eJZq%2BB5jd%2FCOW%0A3%2Fmc8c4fTB947D8y2f0%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2533906328/1f5cd0a57def40676410f8f379b4/member-usage-30d-model.png?expires=1792754100&amp;signature=738aee6caee6f3fcf79cc1c516350780add15dc7ef3c0af5b3d7c300a4d7336b&amp;req=diUkFcB%2Bm4JdUfMW1HO4zfveBq3Cee%2FbWGUKUw6QS48FOB1PMdhz9%2F3pxZtj%0A074%2Ffvf2nWa2oOhsGL8%3D%0A)
 
 ---
 
diff --git a/content/support/12997503-team-plan-billing-faqs.md b/content/support/12997503-team-plan-billing-faqs.md
index 167ad0a3e9..daff6527ce 100644
--- a/content/support/12997503-team-plan-billing-faqs.md
+++ b/content/support/12997503-team-plan-billing-faqs.md
@@ -18,7 +18,7 @@ Your organization's billing address determines where your invoices are sent. You
 
 If you want to use a name other than the one tied to your payment method, an organization Owner should check the "Use a different name on invoices" box when adding or updating your payment method in **[Organization settings > Billing](https://claude.ai/admin-settings/billing)**:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1922145253/f2e3d4e0fe43a2ea07e89244764c/image.png?expires=1792735200&amp;signature=6f4bbc2f4ea7883bd11f45fc1adfae2547b80972bd7546e628c57105155c1831&amp;req=dSklFMh6mINaWvMW1HO4zRZTxVjGuM7RKAqLF4ERnlV47LutzBkEM8SnmNWw%0A%2BGZzDpM2xMOPAJPTdq4%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1922145253/f2e3d4e0fe43a2ea07e89244764c/image.png?expires=1792754100&amp;signature=1da5721e7091833021dfc3f4bdd84b978ec7e199ffb2a8dc6486eecb2ee1a34a&amp;req=dSklFMh6mINaWvMW1HO4zRZTxVjGvs%2FSKAqLF4ERnlXtKo8PW3hRgwIl7v%2Fp%0AwO8QOU0PNFCwFuPd%2Fr4%3D%0A)
 
 ## When will I be billed?
 
diff --git a/content/support/13132885-set-up-single-sign-on-sso.md b/content/support/13132885-set-up-single-sign-on-sso.md
index c889c9ff75..6e3ae26783 100644
--- a/content/support/13132885-set-up-single-sign-on-sso.md
+++ b/content/support/13132885-set-up-single-sign-on-sso.md
@@ -42,7 +42,7 @@ You can verify multiple domains for a single organization, but all domains must
 
 3. Enter the domain(s) you want to verify in the **Update organization email domains** modal and click the “+” button:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2498843282/561d5ceb1c3a5df75bdfee8bfc3f/d2491145-362d-490b-bdcf-66a0a7656ddc?expires=1792735200&amp;signature=961579f85f439b1316086814a978326bb4633f278f054e40c003f79589d67fa0&amp;req=diQuHsF6noNXW%2FMW1HO4zSdmH34%2B%2BcGOe3H0OpmIzWGdB9LgVuuh9Hfb2Ig3%0AU04U%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2498843282/561d5ceb1c3a5df75bdfee8bfc3f/d2491145-362d-490b-bdcf-66a0a7656ddc?expires=1792754100&amp;signature=ad423c79ae3c7e6adff5897743bfa2d095abb3edd588a7144df591d4eceef126&amp;req=diQuHsF6noNXW%2FMW1HO4zSdmH34%2B%2F8CNe3H0OpmIzWGscUjYuKahMlP4hKuy%0ACRk9%0A)
 
 4. Click “Save” when you’re finished adding domains.
 
@@ -50,7 +50,7 @@ You can verify multiple domains for a single organization, but all domains must
 
 6. Enter your domain in the text box and click “Continue”:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2047042630/0617a562cd28a7ff0e607d66a30b/6bd08e1d-2b65-40ab-bc79-a257153854c1?expires=1792735200&amp;signature=8d9434ad37d4316f2ee23ef40ab1b045c681f35a9c59944965830d1e0f4df91d&amp;req=diAjEcl6n4dcWfMW1HO4zWHctB%2BQlNSoyoyXAW0OlXqDzmutuEVRbzxK6GwI%0AGBMF%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2047042630/0617a562cd28a7ff0e607d66a30b/6bd08e1d-2b65-40ab-bc79-a257153854c1?expires=1792754100&amp;signature=506bce44134a9da7b96b3d89b8d475eda67bd94b0ee5dbd7b5ce11afa1035fab&amp;req=diAjEcl6n4dcWfMW1HO4zWHctB%2BQktWryoyXAW0OlXoV9J1Zob5mnL6k5lIS%0A5RV%2F%0A)
 
 7. The setup screen displays a TXT record. **Copy the full Value using the copy button**—it begins with `anthropic-domain-verification-` and is longer than what's visible in the box. In your DNS provider, add a TXT record to your domain and **Value** set to the copied string. The domain must match exactly what you entered in the previous step, including any subdomains. Add it alongside any existing TXT records; don't replace them. The value is case-sensitive, so paste it exactly. Please refer to your DNS provider's documentation on this topic.
 
@@ -76,7 +76,7 @@ Clicking "Refresh" re-checks your DNS; it won't show Verified until the publishe
 
 If the record is correct and propagated but the status still shows Pending, contact Support.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2047044496/b8df54a0331784cc9ae8f00112aa/bf9609c1-dc93-4665-a066-4cae2fe4b002?expires=1792735200&amp;signature=5ae2a552523b30d3d5c318b2694421ff78f7805ab5d674fac3cc00c058abe48e&amp;req=diAjEcl6mYVWX%2FMW1HO4zVjmWCsHbHG7PM2D8ZcdgrhbCPkGg9wXeo%2Be2xic%0ACgyqINF9pl6GuFy5Vfk%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2047044496/b8df54a0331784cc9ae8f00112aa/bf9609c1-dc93-4665-a066-4cae2fe4b002?expires=1792754100&amp;signature=dc042128ee42e3f1c97532c8f874a67e2f2d05eb909c3442c8835f9b9a7b751d&amp;req=diAjEcl6mYVWX%2FMW1HO4zVjmWCsHanC4PM2D8Zcdgri8frmFgmqxpbz3Hyrr%0AInCtYIai7MXDyRNsV2M%3D%0A)
 
 **Note:** Once your domain is verified, you'll see a **Restrict organization creation** toggle under **Security** on the Organization and access organization settings page. Enable this if you want to prevent users from creating new Claude or Console organizations—including personal accounts—using your verified domains.
 
@@ -116,7 +116,7 @@ For IdP-specific setup instructions, see:
 
 You can now choose to toggle on **Require SSO for Console** and/or **Require SSO for Claude,** on the **Organization and access** page, under the **Authentication** section:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2312690200/bd2403586d4f6651ccd79e2a45af/b9f8d7ce-0def-49d9-bfb2-3a14352d7214?expires=1792735200&amp;signature=fdd8ad842a90282fc9a270631bcb5c08273842e64b2e9693b15171fff5d78049&amp;req=diMmFM93nYNfWfMW1HO4zdAICg2mAXkIItXtKivx6ZEj8nI3ckDoDQNya%2FBE%0ACJBMntUv%2BLNG%2F9GEzvA%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2312690200/bd2403586d4f6651ccd79e2a45af/b9f8d7ce-0def-49d9-bfb2-3a14352d7214?expires=1792754100&amp;signature=c238d96fc3a83990b40e9b5b16275cd4257818a0f57f2da015dd4304c12db42f&amp;req=diMmFM93nYNfWfMW1HO4zdAICg2mB3gLItXtKivx6ZF09ptjIVoGkQTJOtQi%0AMryihK1CbrSM61VCKZI%3D%0A)
 
 When SSO is required, users must use the “Continue with SSO” option to log in to their Claude/Console accounts. When SSO is not required, they will have the option to choose “Continue with SSO” or “Continue with email.”
 
diff --git a/content/support/13133195-set-up-jit-or-scim-provisioning.md b/content/support/13133195-set-up-jit-or-scim-provisioning.md
index 66a7adf205..5165c17598 100644
--- a/content/support/13133195-set-up-jit-or-scim-provisioning.md
+++ b/content/support/13133195-set-up-jit-or-scim-provisioning.md
@@ -40,7 +40,7 @@ Use this table to help decide which provisioning mode is right for your organiza
 
 Both JIT and SCIM can be combined with **Enable group mappings** to control role or seat tier assignment based on IdP group membership. If you select either of these options for your provisioning mode, **Enable group mappings** will appear within the **User provisioning** section:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2312706099/35d5d3ec149880a96bb7acec59f6/a4cfce55-86bf-40b0-b455-c8f412d48e9e?expires=1792735200&amp;signature=51202e4a785fe78c59a67560786a4bf49e06556feacdfa9c0e3403d3fb1b1b5f&amp;req=diMmFM5%2Bm4FWUPMW1HO4zXBDQqlTDl90xFMG%2BIEvQSfzxQHjkTsIw%2BM7qu6O%0AdV0Cpd07UrzzuI163z8%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2312706099/35d5d3ec149880a96bb7acec59f6/a4cfce55-86bf-40b0-b455-c8f412d48e9e?expires=1792754100&amp;signature=1ad65fab3d91146a81c299c44b5b6b600885a2e7af05d5175189f80869085ad5&amp;req=diMmFM5%2Bm4FWUPMW1HO4zXBDQqlTCF53xFMG%2BIEvQSdHakR9RcDKnB4rLN%2FS%0AwKtwUwSWjC4ujpWQQZI%3D%0A)
 
 **Important:** Group mappings set a user’s role type and seat tier only. Users with the Custom role get their permissions from groups in Claude, and those groups sync from your IdP only when your provisioning mode is SCIM directory sync. With JIT, you need to create groups and add users to them manually in **[Organization settings > Groups](https://claude.ai/admin-settings/groups)**. If you map an IdP group to the Custom role under JIT without doing this, those users have no permissions when they log in. Learn more about **[managing groups on Enterprise plans](https://support.claude.com/en/articles/13799932)**.
 
@@ -136,7 +136,7 @@ Learn more about **[setting up role-based permissions on Enterprise plans](https
 
 4. Toggle **Enable group mappings** on (if it’s not already):
 
-  ![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2312714635/b57870b51e6511c8293637bceee2/da1ceabc-b6bc-451b-9cda-24ff6aa90d02?expires=1792735200&amp;signature=1df1f2ad55f863bdf3e5e764ca50a0c71c219d27b89df5c42d0da2b6cd2104b9&amp;req=diMmFM5%2FmYdcXPMW1HO4zeBEb8fflP9Kyb72rapuHpOzvtIjMRRHeWmtrwEb%0ADPkw%0A)
+  ![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2312714635/b57870b51e6511c8293637bceee2/da1ceabc-b6bc-451b-9cda-24ff6aa90d02?expires=1792754100&amp;signature=a21a90930a2d38c85a1e2001fad053ce44f5473babedff15bfe5934a0591f453&amp;req=diMmFM5%2FmYdcXPMW1HO4zeBEb8ffkv5Jyb72rapuHpMRh%2B35TjlddVWQgH2z%0AtD7Y%0A)
 
 5. In the **Enable group mappings** section, click “Add” next to each role and select the corresponding group from your IdP in the dropdown.
 
@@ -188,7 +188,7 @@ Verify you have enough seats purchased and available to add members to your org.
 
 4. **For SCIM:** Click "Sync" to prompt an immediate sync, or wait for the automatic sync cycle:
 
-  ![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2312717421/c97fce49ad17d4660880a05fbaaf/59fbfa2a-1072-4662-8ca5-102970d5a795?expires=1792735200&amp;signature=8ff28122bd4a564a3b860134c8a6baf265a980817c0c24d74e49795928ff128b&amp;req=diMmFM5%2FmoVdWPMW1HO4zZ9Lal%2BqGs%2FA5hujYvMis4fC19VkX3VWbZLaGWOM%0AQi1F%0A)
+  ![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2312717421/c97fce49ad17d4660880a05fbaaf/59fbfa2a-1072-4662-8ca5-102970d5a795?expires=1792754100&amp;signature=21fbf911ebcca29de920b8af26426fd290bd3750c685f66b3c2f80fdba58a2ef&amp;req=diMmFM5%2FmoVdWPMW1HO4zZ9Lal%2BqHM7D5hujYvMis4crgvL2aWZq5CpWkZ%2Bs%0ATDt1%0A)
 
 ### Users mapped to the Custom role can't access anything after logging in
 
diff --git a/content/support/13163631-configuring-session-security-settings.md b/content/support/13163631-configuring-session-security-settings.md
index e3173dc252..c2595c449c 100644
--- a/content/support/13163631-configuring-session-security-settings.md
+++ b/content/support/13163631-configuring-session-security-settings.md
@@ -18,7 +18,7 @@ Session duration controls allow Enterprise and Console Admins to set a maximum s
 
 5. Confirm your selection by clicking “Enable.”
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1888469436/1725e63ea1a2615948faecf4ec73/9bd276a1-7329-414d-87a1-d04dac93fff7?expires=1792735200&amp;signature=e39587c2aa922943f9f88d65b8ffce4f45dcc21d42d141183c0cc4760beb3f76&amp;req=dSgvHs14lIVcX%2FMW1HO4zQNx6uAgQF9Sg%2F6XaftFnjyhi4vYJSMkD5nPMTzS%0AWOUM0NDqb53gEfJa5UY%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1888469436/1725e63ea1a2615948faecf4ec73/9bd276a1-7329-414d-87a1-d04dac93fff7?expires=1792754100&amp;signature=a1367483dd5399bc7c63bf76d4e226046fdbb9f71b4579f3e49a39bcbcf3fa80&amp;req=dSgvHs14lIVcX%2FMW1HO4zQNx6uAgRl5Rg%2F6XaftFnjz6UzElgrO7lrzJ%2BW7l%0AJn4edAuv26trOJ7%2FVVc%3D%0A)
 
 ### For Console Admins
 
@@ -32,7 +32,7 @@ Session duration controls allow Enterprise and Console Admins to set a maximum s
 
 5. Confirm your selection by clicking “Enable.”
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1888469435/7a766bbe02e61c7d8f05deb5b8f0/b0bda400-47c6-43dd-9907-131ebe180b36?expires=1792735200&amp;signature=f355f7e8e3082b8dda10f3a868f90c862adff82bece3ab9e99bc79056567ed03&amp;req=dSgvHs14lIVcXPMW1HO4zWzx2bsxJHojXZ5D7eVpMteBDeaWDwg%2FjKBE6uUa%0ApwdrwTBHZCBDYmoDn%2BU%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1888469435/7a766bbe02e61c7d8f05deb5b8f0/b0bda400-47c6-43dd-9907-131ebe180b36?expires=1792754100&amp;signature=ec94fc37722fe06aa8d90e999d682d02a0c615767c85c8046d2aaf349632694e&amp;req=dSgvHs14lIVcXPMW1HO4zWzx2bsxInsgXZ5D7eVpMte4oxsnLoaLAfMywl0N%0AuTW6mFgtO%2FDaC6a3KUU%3D%0A)
 
 ### What happens after enabling shortened session length?
 
@@ -50,7 +50,7 @@ You can change the session duration at any time by selecting a new value from th
 
 - Sessions scheduled to expire beyond the new duration will have their expiration shortened accordingly.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1888469437/46ac5bc55484ca01556d87a5ade7/b01a7651-ad65-4b32-93ff-16dbc9ca97c0?expires=1792735200&amp;signature=4f7dbcc2ec811cb136914f54d8713e7923323a0fb1e7be70f59aecd54176597e&amp;req=dSgvHs14lIVcXvMW1HO4zZ7mW8qc5DyhA00cbyPOLDUE9SgzhjS0lyyJvqP5%0AO58RZD7Ip7DAh3vjNHQ%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1888469437/46ac5bc55484ca01556d87a5ade7/b01a7651-ad65-4b32-93ff-16dbc9ca97c0?expires=1792754100&amp;signature=511ff0356c84cd8481f9bbe1cbb511ff8733e8042458fbc77dbadba7756b41b6&amp;req=dSgvHs14lIVcXvMW1HO4zZ7mW8qc4j2iA00cbyPOLDWkl69p5yviHmsI%2F2up%0A%2Fahxf9Lcm9D2TtcG5lQ%3D%0A)
 
 ## Disabling session length settings
 
diff --git a/content/support/13189465-log-in-to-your-claude-account.md b/content/support/13189465-log-in-to-your-claude-account.md
index 842a5d942f..8cee89fbf5 100644
--- a/content/support/13189465-log-in-to-your-claude-account.md
+++ b/content/support/13189465-log-in-to-your-claude-account.md
@@ -2,7 +2,7 @@
 
 When you open Claude on a web browser ([claude.ai](https://claude.ai)), the desktop app, or a mobile app, you will see two different options for logging in to your Claude account.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1893216804/f2209c3ec6cf4fc2e803d13bbc9d/40520c9e-ff82-4a7c-adca-5a064fe18d8c?expires=1792735200&amp;signature=4aeccae087e3b358d600a6634ddb4f157e78e305d424c737e272d6addcc81384&amp;req=dSguFct%2Fm4lfXfMW1HO4zXg5B4CL4Be2zWhrqpWiTMnbeHL0Jz4ECse%2Bae4%2F%0AsC%2FYaGK4lkKy4HcPJpA%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1893216804/f2209c3ec6cf4fc2e803d13bbc9d/40520c9e-ff82-4a7c-adca-5a064fe18d8c?expires=1792753200&amp;signature=e293967333f2168b4b6c3888a9ef1421d5c7a78cc4648fc2ff5f199e99e70a50&amp;req=dSguFct%2Fm4lfXfMW1HO4zXg5B4CL5hG2zWhrqpWiTMkdtag7A1FQXfhKUw2H%0ADr3wXm5tOW3JaGUaBk4%3D%0A)
 
 ## Continue with Google
 
diff --git a/content/support/13325567-account-management-faqs.md b/content/support/13325567-account-management-faqs.md
index 71ae6ce2da..c6608203df 100644
--- a/content/support/13325567-account-management-faqs.md
+++ b/content/support/13325567-account-management-faqs.md
@@ -44,6 +44,6 @@ The email domain that was used to create your Team or Enterprise plan organizati
 
 Owners can remove domains by opening up the same modal and clicking the trash can icon to the right of the domain:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2053873852/1cbccea3b7067e03205f2ff8546b/CleanShot+2026-02-11+at+11_16_07%402x.png?expires=1792735200&amp;signature=50e3be2b3f5dcbdb69fa43575d94be93759038bebcf644b8cd51cd66e5f0ecd1&amp;req=diAiFcF5nolaW%2FMW1HO4zUrhF%2Bmfag0YkeFUnrkrQZhZQ5c4ua9yks%2FMTulL%0A3Ih%2FZj3JPnIekTbuqEw%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2053873852/1cbccea3b7067e03205f2ff8546b/CleanShot+2026-02-11+at+11_16_07%402x.png?expires=1792754100&amp;signature=65f09a5e302ed26f102b139be6f751cf6204fe39a61ba3e597b4fcd96d486f6b&amp;req=diAiFcF5nolaW%2FMW1HO4zUrhF%2BmfbAwbkeFUnrkrQZi3vG%2BZRzmX2eXD72Bo%0AmVdY7LfH9GK1Bb0RQQY%3D%0A)
 
 While the account creator must use a business email address, you can add public domains like @gmail.com, @yahoo.com, and @hotmail.com as allowed domains for other members of your organization.
\ No newline at end of file
diff --git a/content/support/13371040-log-in-to-your-console-account.md b/content/support/13371040-log-in-to-your-console-account.md
index c5043b3a3e..9b6cba950a 100644
--- a/content/support/13371040-log-in-to-your-console-account.md
+++ b/content/support/13371040-log-in-to-your-console-account.md
@@ -2,7 +2,7 @@
 
 When you navigate to the **[Claude Console](https://platform.claude.com)**, you will see two different options for logging in to your Console account.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1935026646/d90d1613a3dbe763fef5abb96e3c/image.png?expires=1792735200&amp;signature=4436ae6e2a8ab5796adbd214db2f9eb4a9bef364dd2754a83f12702a8af6772f&amp;req=dSkkE8l8m4dbX%2FMW1HO4zcrI5ovro4UP8vUNcPt4%2B72U5rZcJuU8cg%2BCIsov%0AslUlPbVDwdkHaxGxxhY%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1935026646/d90d1613a3dbe763fef5abb96e3c/image.png?expires=1792754100&amp;signature=ed24363becf54f1bae7f0e2838fac1398dc1ebcc56832c5e8effdccaf5de1b4a&amp;req=dSkkE8l8m4dbX%2FMW1HO4zcrI5ovrpYQM8vUNcPt4%2B73%2BB2Rq9veMMurDGd0%2B%0AZdssG302Lk%2BqxnzfC6E%3D%0A)
 
 ## Continue with Google
 
diff --git a/content/support/13641943-visual-and-interactive-content.md b/content/support/13641943-visual-and-interactive-content.md
index 056fe93f34..a1c42a42be 100644
--- a/content/support/13641943-visual-and-interactive-content.md
+++ b/content/support/13641943-visual-and-interactive-content.md
@@ -18,7 +18,7 @@ Claude can show current weather conditions and forecasts when you ask about the
 
 Claude automatically displays temperatures in Fahrenheit for US locations and Celsius for everywhere else.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2040544927/3a9c695b24df387ecdd766ad308c/8be9f393-dcb0-4ff8-89e8-5fa47bedaa38?expires=1792735200&amp;signature=36fc070d42dd496e596bd4343d39cfccd187bf098b9907c105aa8e4322a2ee9b&amp;req=diAjFsx6mYhdXvMW1HO4zXlB7Dy91h2KdgndksVD5R3%2FSdlQ8ulhz%2FhK1689%0AZHHDWTUGfOIu3ukNV7w%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2040544927/3a9c695b24df387ecdd766ad308c/8be9f393-dcb0-4ff8-89e8-5fa47bedaa38?expires=1792754100&amp;signature=f3ac9cb1e2565b93f6c9287b7182b2f890ef01d96e0cceb96409fd993e157aa0&amp;req=diAjFsx6mYhdXvMW1HO4zXlB7Dy90ByJdgndksVD5R2iJOU68hf%2FbTBcp9RH%0AwJhgT95Xubtx2RMU%2B5w%3D%0A)
 
 Weather is powered by Google Maps (<https://policies.google.com/privacy>).
 
@@ -28,7 +28,7 @@ When you ask about recipes, Claude can display formatted recipe cards that are e
 
 **Note:** Visual recipe cards are available on web and desktop only. On mobile, Claude provides recipe information as text in the conversation.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2040544929/12f4c51eda7779d65d3ea2c7ab16/d0f4a314-cff8-421a-b401-10c2bf50374e?expires=1792735200&amp;signature=b6962055a9a2bf41bea42f06aa7c53ad5509d79199a09a264358d9e9b83eacce&amp;req=diAjFsx6mYhdUPMW1HO4zUQperIS0VGVrIPm%2FImZVg3hobI9THlnsaVzck3d%0Ankjigw4piZjkeqSX9tU%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2040544929/12f4c51eda7779d65d3ea2c7ab16/d0f4a314-cff8-421a-b401-10c2bf50374e?expires=1792754100&amp;signature=c5c4e351532b66aa7205e2eeaf9f16dc775404caee185ffa18369a9b0d57ee98&amp;req=diAjFsx6mYhdUPMW1HO4zUQperIS11CWrIPm%2FImZVg1GBOTg2uLgtCKnQByR%0AABbP6NxRyS6ClUnotOU%3D%0A)
 
 ### Custom visuals
 
@@ -76,7 +76,7 @@ For example, if you ask Claude to help you plan a trip, it might ask you to:
 
 This content appears at the bottom of the chat. You can still type a response if you prefer.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2040544930/9ad066e137d11e4b559b0217e12d/9bf30d2d-1715-42b3-9da5-2a9298f41f08?expires=1792735200&amp;signature=b3a055273f784c6ef6271760da11918c3eabcddcaaa2eff0250e89ba5f99ac9a&amp;req=diAjFsx6mYhcWfMW1HO4zWmF5ve5ahugx4wz0C7CTAIGLQLVMCDmXKWIgbkB%0AeZSzXxdRIQKnsKS%2BTBw%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2040544930/9ad066e137d11e4b559b0217e12d/9bf30d2d-1715-42b3-9da5-2a9298f41f08?expires=1792754100&amp;signature=6e29b7cb36e0d0772b6ababa8e943cfb33a14c808423f5db73bdc760259c5876&amp;req=diAjFsx6mYhcWfMW1HO4zWmF5ve5bBqjx4wz0C7CTAL8B51eYm6DF%2BUuSyo8%0AillohFkrJ3vkQ2lROEI%3D%0A)
 
 ---
 
diff --git a/content/support/13837440-use-plugins-in-claude.md b/content/support/13837440-use-plugins-in-claude.md
index e0dd4cc419..a318ff28e3 100644
--- a/content/support/13837440-use-plugins-in-claude.md
+++ b/content/support/13837440-use-plugins-in-claude.md
@@ -58,7 +58,7 @@ In Cowork, open the "Cowork" tab first, then open **Customize**.
 
 You can also upload a custom plugin file if you built one yourself. On Team and Enterprise plans, a colleague can share a plugin with you directly instead of sending you the file. See **[Use a plugin shared with you](#h_ef985546b4)** below. Plugins you add in Claude on the web or in Claude Desktop are saved to your account, not to your computer, so they follow you to chat, Cowork, and Claude Code.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2100409211/fc01614dde1a616fa31ffaa9cb04/47bacf5b-a810-45b5-a468-9769f1a58ef8?expires=1792735200&amp;signature=0424e5fca92449300857d928bf506f2b81ad98ceea75b0fc80528ae66c9fe095&amp;req=diEnFs1%2BlINeWPMW1HO4zZF3IxfaMPBXxakFVfq5WwyOHT8E5aX3JiBkMPB4%0A8xY4n2knPKSdMb2%2FruA%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2100409211/fc01614dde1a616fa31ffaa9cb04/47bacf5b-a810-45b5-a468-9769f1a58ef8?expires=1792753200&amp;signature=05df4679ba1e35a29307d6a741df51bc0302ae4d5b4ccba3ff3e39d8a8e7e302&amp;req=diEnFs1%2BlINeWPMW1HO4zZF3IxfaNvZXxakFVfq5WwxgTYlkiO9l9ooawlkn%0A6qtv%2FpVkU6I%2FPF4rPzk%3D%0A)
 
 If you're on the Enterprise plan and your organization has skill scanning turned on, plugins are checked for malicious content when they're installed or updated. A plugin with malicious content is blocked, and one that may carry risk shows a caution banner. Learn more about **[skill and plugin scanning](https://support.claude.com/en/articles/15927065)**.
 
@@ -68,7 +68,7 @@ If you're on the Enterprise plan and your organization has skill scanning turned
 
 Each plugin you add brings skills and commands you can use while working with Claude. Type "/" or click the "+" button to see the available skills from your plugins, in chat and in Cowork. In Cowork, you can also run a plugin's command by typing `/plugin-name:command`. Click any skill to see its details.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2157396844/4a790e10f5b88df770783df1d7e9/image.png?expires=1792735200&amp;signature=491dc187024afab31e2d555885e853b2d95f5076d89e4daa2427d03fc7e86d19&amp;req=diEiEcp3m4lbXfMW1HO4zf4NBfT7gEWWmKUxugP2BQs%2FvFRd%2BNlc%2FkX6syhN%0AvfxtbzIS1jFnnRlVntU%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2157396844/4a790e10f5b88df770783df1d7e9/image.png?expires=1792753200&amp;signature=89461b32f1340b7a0f35612fbe056160ecb35088b0289a71943a255b99060b9d&amp;req=diEiEcp3m4lbXfMW1HO4zf4NBfT7hkOWmKUxugP2BQv0mT0R%2BjXdYXhvnYLI%0ARzUknpiI7K3dwUo4qnY%3D%0A)
 
 ---
 
diff --git a/content/support/13947068-assign-tasks-from-anywhere-in-claude-cowork.md b/content/support/13947068-assign-tasks-from-anywhere-in-claude-cowork.md
index a63b407a2d..453652d2f2 100644
--- a/content/support/13947068-assign-tasks-from-anywhere-in-claude-cowork.md
+++ b/content/support/13947068-assign-tasks-from-anywhere-in-claude-cowork.md
@@ -52,11 +52,11 @@ Follow these steps to get started:
 
 5. You’ll land on a page describing the functionality. Click “Get started”:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2169954086/419674f781edb2977b93cce062b4/93b1893c-d79a-4eb6-b2f1-2fe3e043bd90?expires=1792735200&amp;signature=a893d700b9ac816875008dc34071f0da2be68cc6b64382034c8ab69daf26976c&amp;req=diEhH8B7mYFXX%2FMW1HO4zSZP05CMFgv9B32drIe5EDm6dMvIU%2FV2cYay8NGc%0AjUGs%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2169954086/419674f781edb2977b93cce062b4/93b1893c-d79a-4eb6-b2f1-2fe3e043bd90?expires=1792753200&amp;signature=8fe5d379392a3e2862a1de7a98cf8b75ffb9f3a5c80b8a46760aa121ed62019d&amp;req=diEhH8B7mYFXX%2FMW1HO4zSZP05CMEA39B32drIe5EDmQFN5Gj0xPhrrftGgV%0AlaxP%0A)
 
 6. On the next screen, you can give Claude access to your files and keep your computer awake by toggling those on:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2169955082/de4053ee0eab8fcb9263584bb171/d39b77da-1a69-4682-9fdb-7ed488f236b0?expires=1792735200&amp;signature=201956c0e257729295aafebdadc2ee1e2f3299af28ba7d945c032cdee26b45fa&amp;req=diEhH8B7mIFXW%2FMW1HO4zaZWstifXgQcepuGRb1rD3IZlg9psZnYMM0xF7rr%0AfR1d%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2169955082/de4053ee0eab8fcb9263584bb171/d39b77da-1a69-4682-9fdb-7ed488f236b0?expires=1792753200&amp;signature=0161eb6481df249f89ac8dba68dbc3b89327d24e885fdd16d9baf0bd063ba258&amp;req=diEhH8B7mIFXW%2FMW1HO4zaZWstifWAIcepuGRb1rD3L%2F%2FlCRiK2LLqT%2FSW%2By%0A2Ph2%0A)
 
 7. Click “Finish setup.”
 
diff --git a/content/support/14116274-organize-your-tasks-with-projects-in-claude-cowork.md b/content/support/14116274-organize-your-tasks-with-projects-in-claude-cowork.md
index 4db7237f0d..6a3e1ba49b 100644
--- a/content/support/14116274-organize-your-tasks-with-projects-in-claude-cowork.md
+++ b/content/support/14116274-organize-your-tasks-with-projects-in-claude-cowork.md
@@ -24,23 +24,23 @@ Cowork is available for paid plans (Pro, Max, Team, Enterprise) on:
 
 Find **Projects** in the left navigation panel and click the “+” button to see the three different ways to create a project:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2183720240/6f6ef438913391703598d86d606c/CleanShot+2026-03-20+at+09_11_43.png?expires=1792735200&amp;signature=c8f5963c23518eedd21b4729d8497b19b1155fe19fbdbc14fc0fdc7e131303e6&amp;req=diEvFc58nYNbWfMW1HO4zcOgige90i13ZwSvwegvtgzMJTRjmgbNV7PFlq0e%0AM%2FNTLJWzs9AKg3xmius%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2183720240/6f6ef438913391703598d86d606c/CleanShot+2026-03-20+at+09_11_43.png?expires=1792753200&amp;signature=646b0ac78c9847021e3123677a6e657e2e3aa6c341e978aec0bbb99d26872956&amp;req=diEvFc58nYNbWfMW1HO4zcOgige91Ct3ZwSvwegvtgzDQs5qIem5hMaiDIra%0AwKODPJTjnliNjEnmaKI%3D%0A)
 
 ### Start from scratch
 
 Selecting “Start from scratch” allows you to set up a new folder with instructions and files:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2177090014/07832b50003cf7fd3b4e9c7c448b/3385d9b8-c3e7-42b9-ae3f-4d213baa53a7?expires=1792735200&amp;signature=846777bbef0e5e903a4960f9e564fb1c03fc78f44a392bc2fb6f6f960fa5ad33&amp;req=diEgEcl3nYFeXfMW1HO4zZCoQo9CTXCUvb0suCMAnj09E7IT6eFVWX5CH6jB%0AwOruil6gOHpWfPEpaWY%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2177090014/07832b50003cf7fd3b4e9c7c448b/3385d9b8-c3e7-42b9-ae3f-4d213baa53a7?expires=1792753200&amp;signature=2b053d48ce18eb0ddd1009b0b33944a872f924f0af7a232cc4acee8ea6f35e3c&amp;req=diEgEcl3nYFeXfMW1HO4zZCoQo9CS3aUvb0suCMAnj3EV6gq6v%2BdFCyjMm9i%0AjYxxMMRBSMrZSr5USWs%3D%0A)
 
 ### Import from a Claude project
 
 After selecting “Import from project,” you’ll see a “Search projects in Chat…” field:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2183717962/acdc11bcc825ae76a13f508365bc/CleanShot+2026-03-20+at+09_12_08.png?expires=1792735200&amp;signature=6d1e36b82e49d4eb2ae4efdea8bd77c60b2329d53554fcb92189112a347d00c0&amp;req=diEvFc5%2FmohZW%2FMW1HO4zQQ7UWFayZ0djggUT7FIJz%2FMxSPJXrMpjYg0%2FvJb%0Acg2IoSXaYyiQIQTzxI4%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2183717962/acdc11bcc825ae76a13f508365bc/CleanShot+2026-03-20+at+09_12_08.png?expires=1792753200&amp;signature=778b2f42d42a3c6caa7c184984aa0e67e013132dda02bc461265aafe37c067d9&amp;req=diEvFc5%2FmohZW%2FMW1HO4zQQ7UWFaz5sdjggUT7FIJz%2Bv8SRRfaNwcefRT%2B6t%0A%2BwiZuGxwuoHgqIOSLDo%3D%0A)
 
 Clicking into the field will display a drop-down showing your recent projects, but you can also use it to search all your projects. After you select a chat project (bulk upload is not supported), you can name the new Cowork project and choose where to save it on your computer:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2183727973/7a25430123d9e13e7c3cdd411f70/CleanShot+2026-03-20+at+09_13_41.png?expires=1792735200&amp;signature=31251074f31d93f4e99bc760120ea52d75fb240419ef4f647fb9f2556c3ce5bc&amp;req=diEvFc58mohYWvMW1HO4zU%2FKAyFB%2FybOI7f%2FdY0VL6gG11Y6uXo3C6QDUneK%0AmlkEm8HyL2pnPO5Ni4Y%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2183727973/7a25430123d9e13e7c3cdd411f70/CleanShot+2026-03-20+at+09_13_41.png?expires=1792753200&amp;signature=dee39718d599b4be896fb28083c93a42dd8a68a792070fd2c091bfea7bb597c1&amp;req=diEvFc58mohYWvMW1HO4zU%2FKAyFB%2BSDOI7f%2FdY0VL6gyB%2Fouxr%2FEKAZr5b7m%0A1ZvdGJY9e5use%2F9xJfQ%3D%0A)
 
 Clicking “Create” will transfer the files and instructions from your existing Claude project and create a new Cowork project.
 
@@ -48,11 +48,11 @@ Clicking “Create” will transfer the files and instructions from your existin
 
 If you select “Use an existing folder,” you’ll be prompted to pick a file to use as context for the new Cowork project:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2177087935/2f0052dae601d0b7fecdc029e1c3/2e3ca9e7-23b1-436e-bbdb-edcd31c41f15?expires=1792735200&amp;signature=f5355487a53fea81d0ac9b02d302e415bc8193de3dca16f22a858e144e6b7c1a&amp;req=diEgEcl2mohcXPMW1HO4zejrnjTRFiZduv8e2Xj2xOW4aR0lNKiGidc4q3mR%0ALtzdeepSQ1KH13zreWA%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2177087935/2f0052dae601d0b7fecdc029e1c3/2e3ca9e7-23b1-436e-bbdb-edcd31c41f15?expires=1792753200&amp;signature=8c0b6fce2f848c254435d2581c61cc9f33413fddbb1e3e095bc2e9df454c43a0&amp;req=diEgEcl2mohcXPMW1HO4zejrnjTRECBduv8e2Xj2xOU84Ln55CErp%2Bpcu8jm%0A%2FU%2F%2B18s93k7SmbCVxCQ%3D%0A)
 
 After selecting a folder, you can name the new Cowork project, choose where to save it on your computer, add instructions, and attach any additional files. Click “Create” to start using your new project:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2177087937/f59dbe3fc28448a9597ea097cb4d/96a59acb-4054-4b4b-a208-751f9711f535?expires=1792735200&amp;signature=f3d8fc7b27317189fef3c0392119079f22b3937052340af99d111636e49d6913&amp;req=diEgEcl2mohcXvMW1HO4zUq4VuGzgKc4MfnqHouW6MJSQcPwKFWWIZTf07RC%0A%2FeZ2i4EkmDxrmj0Zr4o%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2177087937/f59dbe3fc28448a9597ea097cb4d/96a59acb-4054-4b4b-a208-751f9711f535?expires=1792753200&amp;signature=cdfb8284e0116cb76861fa87646a9d9fe0954ef4af416799ccd6e9fb04fa7fdc&amp;req=diEgEcl2mohcXvMW1HO4zUq4VuGzhqE4MfnqHouW6MI3d8g5%2BOa7H%2BhQs3Au%0A%2FdSugkktLycJVC%2Fh%2BFc%3D%0A)
 
 ---
 
diff --git a/content/support/14499648-how-scim-sync-works-for-enterprise-organizations.md b/content/support/14499648-how-scim-sync-works-for-enterprise-organizations.md
index bc71163a5e..670a53bd3d 100644
--- a/content/support/14499648-how-scim-sync-works-for-enterprise-organizations.md
+++ b/content/support/14499648-how-scim-sync-works-for-enterprise-organizations.md
@@ -50,7 +50,7 @@ You can trigger a manual sync from two places in your admin settings.
 
 2. Click "Check for updates" under **SCIM sync**:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2312613548/44cd5970ee3c3b2c7f8dcd592d71/image+%2824%29.png?expires=1792735200&amp;signature=ed1683c544891658f2b284c1fdacf31d437649bf1d746940dfe93ee74d34a9cf&amp;req=diMmFM9%2FnoRbUfMW1HO4zW4gbTeqNsi2rgfl7PnOiulZP%2B%2BhPKEgZzbfTVlw%0APdpk%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2312613548/44cd5970ee3c3b2c7f8dcd592d71/image+%2824%29.png?expires=1792753200&amp;signature=47b7be70d8e64e0ff8ae3f0060d6785869da8d36de3e7c7b39663d7415796dd7&amp;req=diMmFM9%2FnoRbUfMW1HO4zW4gbTeqMM62rgfl7PnOiunvpiRJlTvMvrQ7I95u%0AZGbF%0A)
 
 3. Select whether to sync members, groups, or both.
 
@@ -62,7 +62,7 @@ You can trigger a manual sync from two places in your admin settings.
 
 3. Select whether to sync members, groups, or both:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2312608119/e4b0ef4f309f3c4eac8311a6ef47/image.png?expires=1792735200&amp;signature=d0fed932ebddfa900b17fc086dc12284b549837a4dca8bbe2deb6c9181d7203e&amp;req=diMmFM9%2BlYBeUPMW1HO4zX%2F4f7j3yD4d43OpyTHzM9QxWHRJP6jn5ioiwpqC%0A6i7o%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2312608119/e4b0ef4f309f3c4eac8311a6ef47/image.png?expires=1792753200&amp;signature=d2d004726434ad45077a3d74e2651754d9a9cc5583b1a8958890deef00590894&amp;req=diMmFM9%2BlYBeUPMW1HO4zX%2F4f7j3zjgd43OpyTHzM9QULfyNgr3yFJqIbDVV%0AxmMf%0A)
 
 **Note:** If you trigger a manual sync while background changes are processing, your organization takes the most recent change for each member or group. If multiple changes are queued for the same member or group, you may need to resync again to make sure everything applies correctly.
 
diff --git a/content/support/15330088-set-a-default-model-for-your-organization.md b/content/support/15330088-set-a-default-model-for-your-organization.md
index 577206aa56..4f861d1d29 100644
--- a/content/support/15330088-set-a-default-model-for-your-organization.md
+++ b/content/support/15330088-set-a-default-model-for-your-organization.md
@@ -50,7 +50,7 @@ The organization default applies to every member. To set it:
 
 4. Click “Save changes.”
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2514722139/d05c94072a41ea9090ecf386c53e/c32ee31d-954a-4551-a2da-91677fbd0b6f?expires=1792735200&amp;signature=65f4d6bb29959b276591c9b2df0596637bea27e963c93429b6ef5400bc23436b&amp;req=diUmEs58n4BcUPMW1HO4zelOdjBHLk1FfdGVZ664dGGzy1ZRXblJxiTsu7G0%0AnuuzTdUt7Jfl21cS0bU%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2514722139/d05c94072a41ea9090ecf386c53e/c32ee31d-954a-4551-a2da-91677fbd0b6f?expires=1792754100&amp;signature=8e9e8bdbb7cf7e18ebb788b17aa489270cd998eb5affe40a08df9f3a06d4eefd&amp;req=diUmEs58n4BcUPMW1HO4zelOdjBHKExGfdGVZ664dGHxhQE%2BNS3l%2FcF4hDj6%0AXhiP1ODcxOwgFH0k5tw%3D%0A)
 
 ---
 
diff --git a/content/support/15694740-manage-model-access-for-your-organization.md b/content/support/15694740-manage-model-access-for-your-organization.md
index 1e41462d56..72a3cfa8f4 100644
--- a/content/support/15694740-manage-model-access-for-your-organization.md
+++ b/content/support/15694740-manage-model-access-for-your-organization.md
@@ -42,9 +42,9 @@ The organization setting is the ceiling. A role can't grant access to a model th
 
 If any custom role uses the model you’re disabling as its default, you’ll be prompted to change that role’s default before the change can be saved.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2514693921/02ea72756f5163f14e5d158516dc/69102088-cd86-498e-97aa-c8a6e0004419?expires=1792735200&amp;signature=1a16d187c8d2b8c484e8d4371265c29ea9f4a6ad28ecf7f6fab7ba339fd4338d&amp;req=diUmEs93nohdWPMW1HO4zXlxE%2BW%2BVNRVQf5Pb7M2Q0uQtFyIt8dPLBo9sxCi%0AqCpTCsejDfoug%2BEf%2BkY%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2514693921/02ea72756f5163f14e5d158516dc/69102088-cd86-498e-97aa-c8a6e0004419?expires=1792754100&amp;signature=827d1bd82988990d8183ade7f4e2d5a56d133490c4dbe4ea58d3b91d7a6098fb&amp;req=diUmEs93nohdWPMW1HO4zXlxE%2BW%2BUtVWQf5Pb7M2Q0vHh%2FwRMFFMRE0vG89q%0AbDGI5lj3KlXZBH3afhg%3D%0A)
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2514693922/bfc5de6626eb19dca1d7caf818ca/c3cd8bb6-f86c-4d01-92da-6ae4ca966662?expires=1792735200&amp;signature=4623adddc988550e424f3523e1ea0456f993e89935d2fea5873046737154b6bc&amp;req=diUmEs93nohdW%2FMW1HO4zTqNsIvCRV1VAod9uc510ly%2B6c7AZxEmHgzDMK0W%0A%2FsEjgx8CUiMcpHQWPpU%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2514693922/bfc5de6626eb19dca1d7caf818ca/c3cd8bb6-f86c-4d01-92da-6ae4ca966662?expires=1792754100&amp;signature=fd4347eac327a226815e7b63366a73941158d7bf119d4b321fe28dac7634cb7a&amp;req=diUmEs93nohdW%2FMW1HO4zTqNsIvCQ1xWAod9uc510lwJtycdyLZqPXlmi7uj%0ACe7BuCN2wI79YOnI%2B7I%3D%0A)
 
 ---
 
@@ -78,7 +78,7 @@ If any custom role has an effort cap higher than the new organization cap for th
 
 Only models the role grants access to can be selected as that role’s default model.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2514693923/880665a87dbd4776cf19d6063a37/29d30c6d-f9fc-408c-8c72-4320c6d88d14?expires=1792735200&amp;signature=6e04c2076484dc035b6a200972c98cdf3ab5f98fe7959072fc02c389350ad738&amp;req=diUmEs93nohdWvMW1HO4zYj9SPcE7oS%2FXsqpNqvyFRIhC02bCqeJbtA1MQyx%0A4Xxw2u7jAiW6015MEIk%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2514693923/880665a87dbd4776cf19d6063a37/29d30c6d-f9fc-408c-8c72-4320c6d88d14?expires=1792754100&amp;signature=e231ba819845fb47127e955c27b1c669e873595c70d63a088773eb40a042f191&amp;req=diUmEs93nohdWvMW1HO4zYj9SPcE6IW8XsqpNqvyFRJVD6sr0XjJXSwd3cfs%0AcjKmMTpZ78PSptVyGTA%3D%0A)
 
 ---
 
@@ -96,7 +96,7 @@ Effort limits determine how much computation members on a role can apply per res
 
 5. Click "Save" to save your changes.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2514693927/7a25673b3b075d72adb3cdc371e3/d2d7cd8d-a713-4e91-a706-f589ac46a9fe?expires=1792735200&amp;signature=7654ddab6a0e4d2f6be5bdcc6adc1e749dd42437a311f98de7af644111f0da0c&amp;req=diUmEs93nohdXvMW1HO4ze1xBzG7cLwbDeA1RkowXUH6gGqgGavNw9YlBttI%0A0HsN%2BniygwYb%2BADnlIM%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2514693927/7a25673b3b075d72adb3cdc371e3/d2d7cd8d-a713-4e91-a706-f589ac46a9fe?expires=1792754100&amp;signature=9d17fa1c5cba7ea2cbd11a00ab2452ca61682a3b78a08a99673460ff4319f85a&amp;req=diUmEs93nohdXvMW1HO4ze1xBzG7dr0YDeA1RkowXUGwtOd2%2FtdwhEXi2Tpw%0AOuoTquLchYn5ncwR3Lk%3D%0A)
 
 Members on the role see only effort levels at or below the cap in their model menu. Note that available effort levels differ depending on the model, and some models don’t support effort level settings at all. For an explanation of each level, see **[Change the model, effort, and thinking settings](https://support.claude.com/en/articles/8664678)**.
 
diff --git a/content/support/15936181-get-started-with-1password-for-claude.md b/content/support/15936181-get-started-with-1password-for-claude.md
index 22b8d20d62..a388c2d73f 100644
--- a/content/support/15936181-get-started-with-1password-for-claude.md
+++ b/content/support/15936181-get-started-with-1password-for-claude.md
@@ -52,7 +52,7 @@ Once the requirements are in place, you can set up 1Password from a few places i
 
 4. Toggle on **Password managers**:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2546126596/ba71ca47e2df21cec62c243831f8/5b1c67e1-607d-4c73-8f61-d1ceb081082a?expires=1792735200&amp;signature=2b8c72f486166d95c83da3f70dfadb00057c605c0a30a8c8af424890acb9ea22&amp;req=diUjEMh8m4RWX%2FMW1HO4zU5ln2lprsBhGkiu4hEpcPU6Ipq5NuL9kiFe95Ba%0AtfiUmIRJtdPDfW%2BxvYo%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2546126596/ba71ca47e2df21cec62c243831f8/5b1c67e1-607d-4c73-8f61-d1ceb081082a?expires=1792754100&amp;signature=cfebd7f169a5f445361a07afa0920d92078cee9e00ab89e7cd3a04e376352bfc&amp;req=diUjEMh8m4RWX%2FMW1HO4zU5ln2lpqMFiGkiu4hEpcPUHduNu5DWUB%2FqSgeO5%0AtRKz5D9YgrFOr7u7tOY%3D%0A)
 
 Once enabled, eligible users will see the discovery options above. Users still need to install and set up the required apps and extensions themselves.
 
diff --git a/content/support/16607638-understanding-your-pro-or-max-plan-invoices.md b/content/support/16607638-understanding-your-pro-or-max-plan-invoices.md
index 2ba57e76d1..e18f06c71a 100644
--- a/content/support/16607638-understanding-your-pro-or-max-plan-invoices.md
+++ b/content/support/16607638-understanding-your-pro-or-max-plan-invoices.md
@@ -40,7 +40,7 @@ You can also open any invoice from your account:
 
 **Amount due.** The invoice total minus any applied balance. This is what your payment method was charged.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2629072970/c514f489b65072ccad08e803864f/e8c7a7de-905f-4a40-815f-c9c66edcdbf6?expires=1792735200&amp;signature=77b9cdd9dad6cf8069fe36d2571c3fe03077237376602ff14aec57c037a797ac&amp;req=diYlH8l5n4hYWfMW1HO4zdWraRM47VEcPZYKVlMiWEWqwkIl1jqOxXaSm1u1%0AhHh5QF9SnZSCBYM85qA%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2629072970/c514f489b65072ccad08e803864f/e8c7a7de-905f-4a40-815f-c9c66edcdbf6?expires=1792754100&amp;signature=5393aa787517a05d40451189fea757fe790d61491c9407ab9c9d7d05a31702f8&amp;req=diYlH8l5n4hYWfMW1HO4zdWraRM461AfPZYKVlMiWEVikOuSJPwOw4Z%2BLOFe%0AZSDEzdRRcPvDtC%2FMnoA%3D%0A)
 
 ## Billing details on your invoice
 
diff --git a/content/support/16893491-get-started-with-smart-reports.md b/content/support/16893491-get-started-with-smart-reports.md
index dea6dc3d2d..6046412887 100644
--- a/content/support/16893491-get-started-with-smart-reports.md
+++ b/content/support/16893491-get-started-with-smart-reports.md
@@ -28,13 +28,13 @@ Each report includes the following sections:
 
 Workstreams shows what the group used Claude for most, by sessions and by spend, side by side.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2671030907/7b62b605189fe8e9474a20c1eaf2/image.png?expires=1792735200&amp;signature=d3f3bad58789acc5e6e1067a85ea9caf04e3cce2ef10644b54b29be22a167a86&amp;req=diYgF8l9nYhfXvMW1HO4zZse%2BmCbSA0OVa%2FWhnGS4GkHwJs%2FHrmNiw98eOUS%0AfkSB99E%2BfOV64rzgdxg%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2671030907/7b62b605189fe8e9474a20c1eaf2/image.png?expires=1792754100&amp;signature=a704c8ef953d1a9c3bbf4b7be5f5b33b6353ae277346652de91fe4c11973b92f&amp;req=diYgF8l9nYhfXvMW1HO4zZse%2BmCbTgwNVa%2FWhnGS4GkosNtILyPvF9M%2B14aQ%0Ao550VYqAX16XzdfKIvM%3D%0A)
 
 ### Deliverables produced
 
 Deliverables produced groups sessions by the type of output that was produced. For example, analysis, documentation, content drafts, and code.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2671035220/2a582bc047a6ba46e7dbd6f05d9f/e17881ac-874c-4747-94ca-8679e0301455?expires=1792735200&amp;signature=2bc2d723df03b2738bbbc6f8f68ae2abcbb7aa38bd95b059035df4d8d6ecaf2a&amp;req=diYgF8l9mINdWfMW1HO4zelj06VckNjwYDEFlKbF9Y9WsLT5NQp3k%2FBukhbo%0AMtRKOK0onaRt9oT4wg8%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2671035220/2a582bc047a6ba46e7dbd6f05d9f/e17881ac-874c-4747-94ca-8679e0301455?expires=1792754100&amp;signature=19c42b00e392e8a15d567cc14dee933beefa433e78185547eac3732cca5fc016&amp;req=diYgF8l9mINdWfMW1HO4zelj06VcltnzYDEFlKbF9Y8aqIR2pjZdhrD1UZp0%0AM5vIHlrzfx%2BkDsXcRLo%3D%0A)
 
 ### Cost per session by type of output
 
@@ -48,17 +48,17 @@ Task outcomes  shows what each session produced.
 
 Most common frictions shows what got in the way, by category. For example, a connector that wasn’t set up, output that didn’t match the ask, approval or sign-in gating, tool failures, or rework loops.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2671052365/b69f22b75729e5587563e7ab6830/b1647659-a7ea-403b-89fc-0b150ee97675?expires=1792735200&amp;signature=01642906867601f254da8f45924ce34394a742abb020e7b8a765eeb0b13b5bc8&amp;req=diYgF8l7n4JZXPMW1HO4zdDitrgyV9hTjFK5P3Uf7RiX1QDemg5%2BFsTCtzEA%0AZ0zgdiz6VyIIQUH8H3Q%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2671052365/b69f22b75729e5587563e7ab6830/b1647659-a7ea-403b-89fc-0b150ee97675?expires=1792754100&amp;signature=af7dbcd8e6a583b703b66c8cdce006c7cdf264d19f8ada5c6e1eb91653a36d2c&amp;req=diYgF8l7n4JZXPMW1HO4zdDitrgyUdlQjFK5P3Uf7Rj7i7pqbFcgi8OQjUt8%0Ao6OBIO2fyPp4KMYa0Xc%3D%0A)
 
 Click into a category to see more information:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2671053199/b68936dd5d590c5fbcbbc092b332/5ec247b2-cd67-4f3f-97b5-23479b87a5c6?expires=1792735200&amp;signature=8459217febc3ac52ed247ec7659ccba97ad6a3d16230faeb2a128ba54d552dcc&amp;req=diYgF8l7noBWUPMW1HO4zbuGO4kvJbweodOVMLl17PX4ZyKaTkbrZtWScrW8%0Ac4QNyWLobcHYg2otWP8%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2671053199/b68936dd5d590c5fbcbbc092b332/5ec247b2-cd67-4f3f-97b5-23479b87a5c6?expires=1792754100&amp;signature=94f9d8a7d09ffc43f7dbb0e9167260b88e41c57cdbeac3b202309e03504e9982&amp;req=diYgF8l7noBWUPMW1HO4zbuGO4kvI70dodOVMLl17PX7rakkkGjOWBTJrVR%2B%0A3Yy%2FwVieDUjWcoeoQR0%3D%0A)
 
 ### Inefficiencies
 
 Inefficiencies counts sessions that produced nothing usable and sessions that were personal or off-topic, with their cost (shown only as an aggregate count and cost, with no summaries or drilldown).
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2671036122/90dc848a7adf371a872bd89a2f5e/de86945b-ccfe-4e0f-892d-abacc475c5c4?expires=1792735200&amp;signature=0f3b58381d6147a693c5fcedbcd127b6cf5c35975cd75a8fac6a365edd937d38&amp;req=diYgF8l9m4BdW%2FMW1HO4zcYfhg2RDvEYBas8rgXn%2Fb2zOrR11QFMLgf8zITu%0AnNrWAgqQDZjdZvZ3DKA%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2671036122/90dc848a7adf371a872bd89a2f5e/de86945b-ccfe-4e0f-892d-abacc475c5c4?expires=1792754100&amp;signature=2ff5d7615fc35748270d4392239fd84008d38cc76949ea92801a8cff8c838c57&amp;req=diYgF8l9m4BdW%2FMW1HO4zcYfhg2RCPAbBas8rgXn%2Fb3bDYUmmGtQ9v47Snmv%0Acqm3iHz2TcBf98gsH3s%3D%0A)
 
 ### Reusable skills and workflows to build
 
@@ -68,13 +68,13 @@ Reusable skills and workflows to build identifies repeated patterns that could b
 
 Most expensive sessions lists where spend concentrates.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2671032083/2b075387a4a3473f884a8ba26436/image.png?expires=1792735200&amp;signature=cbc332d7347d2eb1341d55b3ad82f3b3b4a879e7651a6ec92c1869bc6b94ae92&amp;req=diYgF8l9n4FXWvMW1HO4zdLkIm2i6UMrnUoxuhUXEhh0rciEGdP3JTlI7%2BlV%0AnVlmsu%2BUGxgLVeYuNRw%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2671032083/2b075387a4a3473f884a8ba26436/image.png?expires=1792754100&amp;signature=6249fd78736f7d5aa645523339104aebf8744e7f71f573abb9d64811ce3812bb&amp;req=diYgF8l9n4FXWvMW1HO4zdLkIm2i70IonUoxuhUXEhh4DtM5EYU32F6Tiulg%0A605OHqZLf2%2B6hk4bWV8%3D%0A)
 
 ### Complex, autonomous work
 
 Complex, autonomous work shows  sessions scoring highest on task complexity, time saved, how long Claude worked on its own, and the expertise required.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2671031695/3781b98c5cb9cdc069439aa3d9ab/image.png?expires=1792735200&amp;signature=445e97efd26d565a284cb44bc5b88ff75310d5213c881f2a89c9a80c4227a14a&amp;req=diYgF8l9nIdWXPMW1HO4zcPtgjD2CNrGtjDEKfEvx0NgvJoRgPAv8mKWEpYB%0AAyXamEsIcK70BN2FLyg%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2671031695/3781b98c5cb9cdc069439aa3d9ab/image.png?expires=1792754100&amp;signature=689669154e2ea41a083b470959cc1bab8f8aed1f4a81a52bd125bbad2daa2953&amp;req=diYgF8l9nIdWXPMW1HO4zcPtgjD2DtvFtjDEKfEvx0Ma7mhdKbq899vs%2B9JW%0AhDSidz62mUU2W5iimSI%3D%0A)
 
 ### Answers to custom questions
 
diff --git a/content/support/16951679-use-claude-in-google-docs-sheets-and-slides.md b/content/support/16951679-use-claude-in-google-docs-sheets-and-slides.md
index ed5f503ef4..914a59a8de 100644
--- a/content/support/16951679-use-claude-in-google-docs-sheets-and-slides.md
+++ b/content/support/16951679-use-claude-in-google-docs-sheets-and-slides.md
@@ -28,11 +28,11 @@ If your organization already allows Marketplace apps, this takes about two minut
 
 2. Open a Google Docs, Sheets, or Slides file and go to Extensions > Claude > “Open Claude":
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2707281468/abc0497defca04936c9a4b97d147/8b17d05f-3fb1-4e49-8d1f-65364ac3f496?expires=1792735200&amp;signature=ad01ac50ecfb7ad78802121f547a4b3488b47baff5f33827af894fc055e699c3&amp;req=dicnEct2nIVZUfMW1HO4zRwmJT5rV%2BFNaAKM49NdBLNXCFYKnyrduN7%2Bawle%0AdB9i%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2707281468/abc0497defca04936c9a4b97d147/8b17d05f-3fb1-4e49-8d1f-65364ac3f496?expires=1792753200&amp;signature=7fe842a9337ac525f47fedaaec45dc78e1ff70cf84103bbce32bbfe4301e8fc5&amp;req=dicnEct2nIVZUfMW1HO4zRwmJT5rUedNaAKM49NdBLN05L0JCFYOl3QMtHpo%0AjALB%0A)
 
 3. The first time, Google asks you to allow two permissions. Review them and click "Allow":
 
-  ![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2707282342/f583a396098ff16e3cbd156d4a2a/112c6459-79c6-4fbb-9bc0-748fda6f592f?expires=1792735200&amp;signature=0b0f29fb71332d4266851036f45e53c94a8a5fbf8e0ef0369093ad707fad6e81&amp;req=dicnEct2n4JbW%2FMW1HO4zeKY3p4BgwvyeBfHlrCfDWcuz2FcMcf4tmK6iCQN%0AmTDv%0A)
+  ![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2707282342/f583a396098ff16e3cbd156d4a2a/112c6459-79c6-4fbb-9bc0-748fda6f592f?expires=1792753200&amp;signature=6f131df90afe2f3a6b9c6b92380c9ecae025baf48efc1c44638ea0e0e9900c3d&amp;req=dicnEct2n4JbW%2FMW1HO4zeKY3p4BhQ3yeBfHlrCfDWfoPCwleUvveIUERIK%2F%0AFk17%0A)
 
 4. Sign in with your Claude account in the sidebar, and optionally enable your connectors.
 
diff --git a/content/support/17005973-manage-pooled-group-budgets-on-enterprise-plans.md b/content/support/17005973-manage-pooled-group-budgets-on-enterprise-plans.md
index 6bad9ed2dc..9ab0670bb4 100644
--- a/content/support/17005973-manage-pooled-group-budgets-on-enterprise-plans.md
+++ b/content/support/17005973-manage-pooled-group-budgets-on-enterprise-plans.md
@@ -76,7 +76,7 @@ If a user belongs to more than one group with a pooled budget, the largest poole
 
 With a custom order, the first pooled budget in your list with budget remaining pays.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2719736736/a4ec8e92af4975a87891357e5dbd/6f58b496-432d-4069-ba18-72a6390ab2ea?expires=1792735200&amp;signature=f21b2c1d06e08f1e5c416a68031db57c55ce1ea6ed05d9af6f4f987d85b55847&amp;req=dicmH859m4ZcX%2FMW1HO4zU9wBwYfUo0xTLR6JppsyjRwaI181h6TWK6lJgAK%0AAks3dcpJwZRCkJTWzxk%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2719736736/a4ec8e92af4975a87891357e5dbd/6f58b496-432d-4069-ba18-72a6390ab2ea?expires=1792754100&amp;signature=8ea34cce0cc05b42d5b00448ac8ad5c6c1cebb01897725146c68c19044c72d9f&amp;req=dicmH859m4ZcX%2FMW1HO4zU9wBwYfVIwyTLR6JppsyjRU8fwFl9TuWdWr1Yaj%0A9a2JKZYxU210gNUqOPE%3D%0A)
 
 **Note:** Budget priority only decides the order in which pooled budgets pay. To choose which group's member monthly limit applies to a user in more than one group, use the **Member limit from groups** setting under **Spending defaults**.
 
diff --git a/content/support/17203415-set-up-claude-for-intune.md b/content/support/17203415-set-up-claude-for-intune.md
index 34755716f4..abd21c1982 100644
--- a/content/support/17203415-set-up-claude-for-intune.md
+++ b/content/support/17203415-set-up-claude-for-intune.md
@@ -70,25 +70,25 @@ To add Claude for Intune for enrolled company-owned devices:
 
 1. In the Microsoft Intune admin center, select "Apps" from the left side navigation panel:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2700192269/ce2bf95a18aba11042da50f4c1ad/dda0f9a2-d585-4b09-ae4f-a1ff70b1e010?expires=1792735200&amp;signature=23701d82fd4fe1f0db5f98e19d27ebfbe9363576ff00159c3b972d76b0eb0233&amp;req=dicnFsh3n4NZUPMW1HO4ze7khjPW4W5iAMLV2Uu0R4Uf5gTe4%2BLgn0nTa7vJ%0ASB0m%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2700192269/ce2bf95a18aba11042da50f4c1ad/dda0f9a2-d585-4b09-ae4f-a1ff70b1e010?expires=1792754100&amp;signature=f46ffe357be4999ecb6ea36f3570fdba05cb69f3eac07b7b36c090ba5af5426b&amp;req=dicnFsh3n4NZUPMW1HO4ze7khjPW529hAMLV2Uu0R4VdpbvlIt%2BRJNqJLdHm%0A8QYy%0A)
 
 2. Under Platforms, select "iOS/iPadOS":
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2700195036/b70c6c0bdeff5f2b72568ef4943b/67cc834c-5e91-42da-9d3b-1f32c8dd8c05?expires=1792735200&amp;signature=64ca543df46cd2c536da5384e0f986ecf43ee75f7e55a83591fd52fdf99f79b8&amp;req=dicnFsh3mIFcX%2FMW1HO4zeH1oU%2FgsnaWQ7hR7Wh%2Bi7062TiYhALmRovlJpTJ%0AgTBX%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2700195036/b70c6c0bdeff5f2b72568ef4943b/67cc834c-5e91-42da-9d3b-1f32c8dd8c05?expires=1792754100&amp;signature=00a35e33a03c3aeb9545473469dc7d6e4e4b87cc89b9413d166a2d1f51fd15d7&amp;req=dicnFsh3mIFcX%2FMW1HO4zeH1oU%2FgtHeVQ7hR7Wh%2Bi72diViYANajwYxLjgUw%0AsLBX%0A)
 
 3. Click "+ Create." For the App type, select the "iOS store app," and click the "Select" button on the bottom:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2700195791/9a01290b4189e6a39c473af0a448/cfed06da-f35a-4b22-b687-286ea48864c1?expires=1792735200&amp;signature=450a1fe926e017e20a2d7b7d48207953dbe9a9eafd18efa54973c432bdd4ce37&amp;req=dicnFsh3mIZWWPMW1HO4zTni3cQuYZsu2SRx6amjj9FhyOqAbDWvMunLk6TM%0AF2fY%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2700195791/9a01290b4189e6a39c473af0a448/cfed06da-f35a-4b22-b687-286ea48864c1?expires=1792754100&amp;signature=4522f566c198bc9df85dbf69b14b3ccb3bc4f34670e33ba66844475f6bd8ea1f&amp;req=dicnFsh3mIZWWPMW1HO4zTni3cQuZ5ot2SRx6amjj9GFjqbzXQfS%2FQSr3dLk%0AiOGN%0A)
 
 4. Search "Claude for Intune" and click the "Select" button on the bottom.
 
 5. In **App Information**, set **Minimum operating system** to iOS 18, then click the "Next" button:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2700196458/588327ab209e9524c45111a244a1/258697c2-2f82-471b-9104-2bccb1b01614?expires=1792735200&amp;signature=30ac8dc38282dd77922d8238ca94d6829c6348b823ec6cc45dbc4f59466c78cf&amp;req=dicnFsh3m4VaUfMW1HO4zbxl5YpQdDcsDNNSLAHCCFq8%2F4xa298PQveDHyE3%0AZulW%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2700196458/588327ab209e9524c45111a244a1/258697c2-2f82-471b-9104-2bccb1b01614?expires=1792754100&amp;signature=942da2163d9d556af2136ee9b897c37b42936a31e4baa1ce61b7502b3a082f6f&amp;req=dicnFsh3m4VaUfMW1HO4zbxl5YpQcjYvDNNSLAHCCFrs19LSJUtlfOGoNYCY%0AsbAU%0A)
 
 6. For **Assignments**, add the groups that should get the app: under Required to install it automatically, or under Available for enrolled devices so employees can install it from Company Portal. You can use user groups or device groups.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2741107114/8f15b0d179a54c2ca4effaad8577/55bed25a-4b20-47b0-9e89-7f8adc86c04f?expires=1792735200&amp;signature=327d92fb42d0f6362e6383df8a389f96e4acc20d17c64bd97eaba49ab27e1847&amp;req=dicjF8h%2BmoBeXfMW1HO4zYaZMeq7evacmN%2B6UXepdg%2BgqReM33tfmsC2yA7O%0AQuVA%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2741107114/8f15b0d179a54c2ca4effaad8577/55bed25a-4b20-47b0-9e89-7f8adc86c04f?expires=1792754100&amp;signature=54835e7cf55328650a064da464eee95099d8b517077d125d592ebde079cf104a&amp;req=dicjF8h%2BmoBeXfMW1HO4zYaZMeq7fPefmN%2B6UXepdg%2BOEdmmZueVZaq2iG4R%0AebJ5%0A)
 
 7. Click "Next," review and create.
 
@@ -98,27 +98,27 @@ To add Claude for Intune for enrolled company-owned devices:
 
 1. In the Microsoft Intune admin center, select "Apps" from the left side navigation panel:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2700190760/9f6412fe68632cffee29826f7d30/42fdeb30-64af-4089-a976-5094bb6b8292?expires=1792735200&amp;signature=e1b1ba0b1b924aeb37954a35049063ef32812a3bfd0651cedca02f68460ea769&amp;req=dicnFsh3nYZZWfMW1HO4zQwrZIgFUNc%2BLtTCoSp4D6oyiyhUWrbwElDdS62N%0AGdya%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2700190760/9f6412fe68632cffee29826f7d30/42fdeb30-64af-4089-a976-5094bb6b8292?expires=1792754100&amp;signature=1521095f47cb9acf2e5e8b893c2bbec14694026ce2587012012b33125cc2e1e8&amp;req=dicnFsh3nYZZWfMW1HO4zQwrZIgFVtY9LtTCoSp4D6qinR4KFukokE2wDi7y%0AvzNy%0A)
 
 2. Under **Manage apps**, select "Protection":
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2700200858/a7ddd4265aeb6d61a7a096297cd5/fc9a1fe2-3d0e-4038-9b2c-f96bd19e4020?expires=1792735200&amp;signature=79dc8b3d1e2d714bdd4c1e38841200f3f28f7289d1f57e4b3b839fa588ae6e88&amp;req=dicnFst%2BnYlaUfMW1HO4zeBHXB069vjvnJWY0xu8hzJrvTX7F%2FtBvNfdb%2Bai%0AtCfX%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2700200858/a7ddd4265aeb6d61a7a096297cd5/fc9a1fe2-3d0e-4038-9b2c-f96bd19e4020?expires=1792754100&amp;signature=0b81f00cad7773d8b5ec16b84b8faa72e37e75ef25e74d9a473c5b06eae60e2a&amp;req=dicnFst%2BnYlaUfMW1HO4zeBHXB068PnsnJWY0xu8hzIUATyugG4djoWx7lLA%0A4OGr%0A)
 
 3. Click "+ Create" and then select "iOS/iPadOS":
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2700201382/6240e257b2b498b5fa5ac1111561/11ef4f59-aba1-4d2b-ac58-9aec1dd60a4d?expires=1792735200&amp;signature=114f4e19992f11a8f96438ba6aaad8e720af44ab4873ff0bea2036b88ce5152d&amp;req=dicnFst%2BnIJXW%2FMW1HO4zc89y0lRAX9MV2VWh%2B9zzEqOaSWiHffErdwY4lX7%0AYOc6%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2700201382/6240e257b2b498b5fa5ac1111561/11ef4f59-aba1-4d2b-ac58-9aec1dd60a4d?expires=1792754100&amp;signature=aebc45ad7ab6b1ae11d8c743e537d9257a2bedc75e0044f31c7b427b75493420&amp;req=dicnFst%2BnIJXW%2FMW1HO4zc89y0lRB35PV2VWh%2B9zzEp99UEACGWnRju5IqDL%0AnDUY%0A)
 
 4. Enter Name in the **Basics** tab, then click "Next" to **Apps**. Set **Target policy to** "Selected apps." Click "+ Select custom apps":
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2700201929/2edf45cedc0bc03204f86d01a49e/4d96c12d-962b-43f6-8b3f-668e3247d4c1?expires=1792735200&amp;signature=21ca33bcb59204a4c877d3e53c62fd20a370c826032b6daa3f9f1575d6733d49&amp;req=dicnFst%2BnIhdUPMW1HO4zVmMRJMTUDgKKETwku7gMsvqX%2FsOOQI2%2Bem6RMga%0Ad7qz%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2700201929/2edf45cedc0bc03204f86d01a49e/4d96c12d-962b-43f6-8b3f-668e3247d4c1?expires=1792754100&amp;signature=d96716fea5005cbcdd2c5ed2856b654cdecfe39e52d3653f36241742b3b95711&amp;req=dicnFst%2BnIhdUPMW1HO4zVmMRJMTVjkJKETwku7gMsuMsim5pH0oI7UMBYOK%0AVKC5%0A)
 
 5. Type in the bundle ID `com.anthropic.claudeforintune`. Select it so it appears under **Selected Apps** before clicking "Select":
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2700202816/3565aea2d1b9c22a5f8d105825c5/3de6d241-6259-463e-a503-a6ca9f2095e0?expires=1792735200&amp;signature=26978b8d91f7e1e94287e8b725b7b5829f350a28e5c8bcc85be1e20b0462b3b1&amp;req=dicnFst%2Bn4leX%2FMW1HO4zf6tYiEvy69112LT9vQL0W6pJUineE3%2BeHeEjBjA%0AB0ZJ%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2700202816/3565aea2d1b9c22a5f8d105825c5/3de6d241-6259-463e-a503-a6ca9f2095e0?expires=1792754100&amp;signature=5ea03c859ee239a296df490f8e0e31daf5683cf4b8586a6653e30ff127ecaf9f&amp;req=dicnFst%2Bn4leX%2FMW1HO4zf6tYiEvza5212LT9vQL0W739WMdw8ciVle%2BZsya%0AcjA%2F%0A)
 
 6. In Apps, confirm the bundle ID now appears under **Custom apps** before clicking "Next":
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2700203780/24ed354ef0de87bf0a0c1bc129a1/46eed662-f488-48ee-a4d1-8a9a76079884?expires=1792735200&amp;signature=b7a5b5bf9ddd8674ca9fa4d40efe67b09946efd29d4067d7177c2a76d8adab3a&amp;req=dicnFst%2BnoZXWfMW1HO4zQd95NeN2M3d8F6Cfy2R7u%2F%2FbNBG0czsrGc5zy5J%0A4rwg%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2700203780/24ed354ef0de87bf0a0c1bc129a1/46eed662-f488-48ee-a4d1-8a9a76079884?expires=1792754100&amp;signature=a2b3c50920074b6737fdeda784ba4e446ecfb3cc826215a69ffa4188edfdb76c&amp;req=dicnFst%2BnoZXWfMW1HO4zQd95NeN3sze8F6Cfy2R7u%2FVnnriKxbSbdWYtmie%0A%2Bkbj%0A)
 
 7. Configure the Data protection, Access requirements, and Conditional launch settings as needed.
 
diff --git a/content/support/8114491-get-started-with-claude.md b/content/support/8114491-get-started-with-claude.md
index ba9e4564d5..ae7616d50a 100644
--- a/content/support/8114491-get-started-with-claude.md
+++ b/content/support/8114491-get-started-with-claude.md
@@ -36,7 +36,7 @@ You use **prompts** to communicate with Claude. The best approach is to speak to
 
 Type your prompt into the chat interface and click the submit button to start a conversation with Claude. You can click the "+" button in the lower left or type "/" to view additional options and commands:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1916208578/2cf2ea52f1f884084b57983a8805/image.png?expires=1792735200&amp;signature=0dc0de8f15669cb22d5f51602bfe21ade10883e5582b04d0ea793feaafa610c4&amp;req=dSkmEMt%2BlYRYUfMW1HO4zV2J7C3Nt4KD9crMELaMZPzwfmbLd4w3WRnBxFtF%0AKotATBmiQ6TSwo2YyCg%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1916208578/2cf2ea52f1f884084b57983a8805/image.png?expires=1792754100&amp;signature=a53636cead055b1509d3ec4a4fd79bf08413a0e0800b61cfd9e07919f9694ede&amp;req=dSkmEMt%2BlYRYUfMW1HO4zV2J7C3NsYOA9crMELaMZPwUVZCdKu98QbdgUndH%0A2MuvFE%2ByX3pvxK2KSsg%3D%0A)
 
 ---
 
diff --git a/content/support/8230524-delete-or-rename-a-conversation.md b/content/support/8230524-delete-or-rename-a-conversation.md
index 667d54f48a..adc66fa4f1 100644
--- a/content/support/8230524-delete-or-rename-a-conversation.md
+++ b/content/support/8230524-delete-or-rename-a-conversation.md
@@ -44,15 +44,15 @@ These steps apply to Claude for iOS, listed on the App Store as Claude by Anthro
 
 4. If deleting, tap "Delete" again in the confirmation prompt.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2599501318/75c28edc693efbe8befd21e4da64/d18a921a-df4b-4788-833c-12c966a32527?expires=1792735200&amp;signature=06cd7833e6295d2f26c39c1205a499f0870899d56c152750f59132f66bb16ef4&amp;req=diUuH8x%2BnIJeUfMW1HO4zSc12Kxdi2Wp1DBI29QsIlHQ0tRg%2FiEsbHv75Tnk%0ARJMaKPerKlW7LBezfUk%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2599501318/75c28edc693efbe8befd21e4da64/d18a921a-df4b-4788-833c-12c966a32527?expires=1792754100&amp;signature=29a7a6c539eaba25e844ca918679b614b089aa874640dd027653e4ba2866ed91&amp;req=diUuH8x%2BnIJeUfMW1HO4zSc12KxdjWSq1DBI29QsIlHIDFLXajeJsBCk%2FMkU%0AhC7WCtANEekfvCOfoUE%3D%0A)
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2599493852/2e58b92d18f307bb79ae30650f26/1bbe52f3-202b-4d5d-9f9a-eeda4d6952c3?expires=1792735200&amp;signature=4e6244765cbde32c0a56466c418c1f4194ab64828d9192c0e9a8ecdf50e834d6&amp;req=diUuH813nolaW%2FMW1HO4zTjXM%2BWLLcXnj7blKEDtUI2UF6JIa5ZcFGPM7DuF%0ACnPP42GLRpsGTt2kuTM%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2599493852/2e58b92d18f307bb79ae30650f26/1bbe52f3-202b-4d5d-9f9a-eeda4d6952c3?expires=1792754100&amp;signature=ad83eb840365a3e814e8770b85d1b73c8343a69b56fbc1b43dfa5a03cbdf24df&amp;req=diUuH813nolaW%2FMW1HO4zTjXM%2BWLK8Tkj7blKEDtUI0yIqL05m2%2F26wx3sHz%0AThq8ExgDknUh77muvFw%3D%0A)
 
 You can also delete the conversation you have open: tap the "⋯" button in the top right corner, tap "Delete," then confirm.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2599493848/997184c386d0e6fb0bd2d7c1f2b6/5d2bc394-25fc-4814-8c2a-2f54d004f83f?expires=1792735200&amp;signature=b2f04fc5acd938e8a8d392c208622301a06ea0062bc173b44835838d76a074a4&amp;req=diUuH813nolbUfMW1HO4zVCIq5jIyNlEzQl%2BKgU984ykmtbq0nd%2B9%2FZ6CYtb%0A8WHVU20NH6tc0ulrkBQ%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2599493848/997184c386d0e6fb0bd2d7c1f2b6/5d2bc394-25fc-4814-8c2a-2f54d004f83f?expires=1792754100&amp;signature=9e19aca76e925d0b29a2c99f743fdc210bf32127dd7f51a5ada66f80bc320de2&amp;req=diUuH813nolbUfMW1HO4zVCIq5jIzthHzQl%2BKgU984zWFJws1GmmViMosf8g%0AiHMoYPOXpEndar%2Bc1Qc%3D%0A)
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2599493856/799041da9fa918e90068c5ebf5bd/2e8d5cee-c45a-41d7-a14b-486e50a37f88?expires=1792735200&amp;signature=f2644c4141e79b00c87109da95413d5f1d95fd5a43b84b3d984de1d93e5f188e&amp;req=diUuH813nolaX%2FMW1HO4zVCl4Qr10mBPEDIU8RT6jk2rPynDtOaCoY5EI7s%2F%0Av%2FxEWCcAUciDF4FfZG8%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2599493856/799041da9fa918e90068c5ebf5bd/2e8d5cee-c45a-41d7-a14b-486e50a37f88?expires=1792754100&amp;signature=4729c771b29efb2cf7de7c18cf62a32e5f879fb4898904f89be19900d2c302e4&amp;req=diUuH813nolaX%2FMW1HO4zVCl4Qr11GFMEDIU8RT6jk24kfd%2Bpg%2BmAaO2zDBs%0AXnN0nfRZN%2Bsq1oR1VOg%3D%0A)
 
 ## Delete or rename a conversation on Claude for Android
 
@@ -66,9 +66,9 @@ These steps apply to the Claude for Android, listed on Google Play as Claude by
 
 3. If deleting, tap "Delete" again in the confirmation prompt.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2599493850/a64e6561222d535f2f5bd03e71f0/5de429c2-d8ed-4e8a-89e8-a13ccaa49767?expires=1792735200&amp;signature=72bfb697c3e7b9a0c498ac933f9937f417ba20fa4157d922c3bc9b1026ebf7f6&amp;req=diUuH813nolaWfMW1HO4zVTddtArwVV3rqtc0YNNUtJgxUgjX1UVBPQ9mxNB%0A%2Fh%2FP3VCrCXD7ttepcmE%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2599493850/a64e6561222d535f2f5bd03e71f0/5de429c2-d8ed-4e8a-89e8-a13ccaa49767?expires=1792754100&amp;signature=76ad6596f08d4ab07689544c1043cde747f275ab3e2b2221d258b2ce20a56e3a&amp;req=diUuH813nolaWfMW1HO4zVTddtArx1R0rqtc0YNNUtJqkXhevURkKkVplWmm%0AGM2X70IJu76KemIjO7w%3D%0A)
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2599493851/f21b39c60e88050d4b0745325f0d/0a8c0d08-dc53-4ef1-8d9f-2b995242c1f9?expires=1792735200&amp;signature=8ac4c2a62ace4228ea26e990615d29746165e7a1fc92aff632ac503a20656332&amp;req=diUuH813nolaWPMW1HO4zUYvwlcMoTte%2FjekULCQNzVyyDVLYcjvV7l6ih1n%0AS3LfGV3PmJnL%2BFssq98%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2599493851/f21b39c60e88050d4b0745325f0d/0a8c0d08-dc53-4ef1-8d9f-2b995242c1f9?expires=1792754100&amp;signature=d7b842dab274863ee88dc3d8fe67403cabb1a51d76a0ef107cabe7e5d2810aa4&amp;req=diUuH813nolaWPMW1HO4zUYvwlcMpzpd%2FjekULCQNzXwu2pjAtVW8ofnRXSU%0AYNMBtv6FC66OQh06Ojs%3D%0A)
 
 **To delete multiple conversations at once:**
 
@@ -78,9 +78,9 @@ These steps apply to the Claude for Android, listed on Google Play as Claude by
 
 3. Tap the trash icon, then tap "Delete" in the confirmation prompt.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2599493849/3013a0ab921337b4544f7ffeffa6/e828ec14-fb52-4205-a840-707b6f2a848d?expires=1792735200&amp;signature=170dda4cd6794df466ef97b9da11f5aeda54270724719801df5a39565c91863d&amp;req=diUuH813nolbUPMW1HO4zWGamcVzeYjd4AqhTnZa84W3UlUPoOKhFhp0nZ5E%0AKb0XpCxZsCeeDkOkOiA%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2599493849/3013a0ab921337b4544f7ffeffa6/e828ec14-fb52-4205-a840-707b6f2a848d?expires=1792754100&amp;signature=a9a07dcbede05d3fb54e5a49a9a709f4ae1b4ee64b4810238f395986d56f86a2&amp;req=diUuH813nolbUPMW1HO4zWGamcVzf4ne4AqhTnZa84WZk5P0BCNQAeQEtjrO%0Am5YPBP4UgC%2BgZZbYMHE%3D%0A)
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2599493853/e2507f53cce8a26776a22a457b1a/bd79bb8a-b078-420f-a4e1-75590367aa80?expires=1792735200&amp;signature=b14db1880824feeb98a7b0e46dcd139373c71b161a7b0bf5d7315bb862b1c9af&amp;req=diUuH813nolaWvMW1HO4zQTtEhf2x0U6SBGfF3I2bRhaIWPB6RPkl%2Bhl3m0Z%0AxWZCb2udyjRgjnkG4UA%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2599493853/e2507f53cce8a26776a22a457b1a/bd79bb8a-b078-420f-a4e1-75590367aa80?expires=1792754100&amp;signature=13aba806c39b9b2d2ca6eaf8489c467d08af50d832e8970cce76a68d6f10afac&amp;req=diUuH813nolaWvMW1HO4zQTtEhf2wUQ5SBGfF3I2bRjuT6i%2BKOvTwQSeg1Kd%0AOCWUCTnKQTUyFjwoNM0%3D%0A)
 
 ## What happens when you delete a conversation
 
diff --git a/content/support/8325618-paid-plan-billing-faqs.md b/content/support/8325618-paid-plan-billing-faqs.md
index de6405cec5..3516b4a27a 100644
--- a/content/support/8325618-paid-plan-billing-faqs.md
+++ b/content/support/8325618-paid-plan-billing-faqs.md
@@ -50,7 +50,7 @@ There's no separate option to remove a card, and updating to a new card replaces
 
 If you want to use a name other than the one tied to your payment method, check the "Use a different name on invoices" box when adding or updating your payment method in **[Settings > Billing](https://claude.ai/settings/billing)**.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1922141785/666191101c11030b05f03a668a74/image.png?expires=1792735200&amp;signature=cbefcdde096f3c6fb1833186601f1611b629407adc2672244a0d093707066a05&amp;req=dSklFMh6nIZXXPMW1HO4zVXW8W%2BsaDbOQoNvNFTb5cf9DKTeICDkFYJdTIBo%0AkVQtbkY6Ji%2FSWPVAtuc%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1922141785/666191101c11030b05f03a668a74/image.png?expires=1792754100&amp;signature=fdaf8ed2f4841bcc964ef51f42bd5099aab1d8b16787d81c6a8b04079e6ae85b&amp;req=dSklFMh6nIZXXPMW1HO4zVXW8W%2BsbjfNQoNvNFTb5cc2niUhSifNinKV2j6u%0AAWt8zbhUCeFoetOEhNw%3D%0A)
 
 ## How can I edit a paid invoice?
 
diff --git a/content/support/8887527-customizing-your-appearance-settings.md b/content/support/8887527-customizing-your-appearance-settings.md
index a426edc5f5..519c8eed31 100644
--- a/content/support/8887527-customizing-your-appearance-settings.md
+++ b/content/support/8887527-customizing-your-appearance-settings.md
@@ -8,7 +8,7 @@
 
 3. Select from Light, Match System, and Dark under **Color mode**.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1648260417/d478c757c7115ad58a12026d4caf/AD_4nXc__Qop4X9hknWGfGj_y_DCpLutLruhxIclJIfir0ilsgNMg7X8ksIVnqk1Oce5FKlGIOYu9CKbVsu8DqD7iIY2aC0ZfXMyFTeAdNq-Cao2mXcj_WUpNF0kM2HoYR_dEx6N_cuJow?expires=1792735200&amp;signature=de7ae9257b168c74e5b27ee405c6a7ddf500a4612556d6106ed051f97d93b6d4&amp;req=dSYjHst4nYVeXvMW1HO4zc2jJqA6g47mSBkgeTglJro1f6hdhCLMrhXPtYbN%0A2%2Fjhgm1Q1vNjpT%2FoIqo%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1648260417/d478c757c7115ad58a12026d4caf/AD_4nXc__Qop4X9hknWGfGj_y_DCpLutLruhxIclJIfir0ilsgNMg7X8ksIVnqk1Oce5FKlGIOYu9CKbVsu8DqD7iIY2aC0ZfXMyFTeAdNq-Cao2mXcj_WUpNF0kM2HoYR_dEx6N_cuJow?expires=1792754100&amp;signature=96f5e0fb35ec27609950a67dc194824b1994a4d2ee551427643a41401d661491&amp;req=dSYjHst4nYVeXvMW1HO4zc2jJqA6hY%2FlSBkgeTglJrqMaRT%2BhWdMie10u6iK%0AF%2FObCms%2FytkdvGr9iKc%3D%0A)
 
 ## How to change your font
 
@@ -16,10 +16,10 @@
 
 2. Select from Default, Match System, and Dyslexic Friendly.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1648260416/7fc0803d44d8de40f8e6636b2eb6/AD_4nXf0UEDa1i2QmqlQtoB5BgpQ-FfZVzss_7wMVQdvkmEDSfoTxixnG0GSxC6qrOs21HdkXH-I2Yn_GHDAf8yjd6FJtoh9FadALozvIErFp9r8LychDGLPb7OpN1CN4PRcgVAYNCre?expires=1792735200&amp;signature=adb3db895c35be03682abac8c81aa8f42b03e6371cb9eaf77a01e43408acdeaa&amp;req=dSYjHst4nYVeX%2FMW1HO4zc896mLiXnQ%2BQtNFlF5%2FHEdx69n7jnX1UHF59SIG%0AgtN2O7VLFvuIu84AE%2BU%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1648260416/7fc0803d44d8de40f8e6636b2eb6/AD_4nXf0UEDa1i2QmqlQtoB5BgpQ-FfZVzss_7wMVQdvkmEDSfoTxixnG0GSxC6qrOs21HdkXH-I2Yn_GHDAf8yjd6FJtoh9FadALozvIErFp9r8LychDGLPb7OpN1CN4PRcgVAYNCre?expires=1792754100&amp;signature=f670ea7a782ee4461eaf8e6bfdd72082ac3115d6f4aceba7733187fd1b28eb0c&amp;req=dSYjHst4nYVeX%2FMW1HO4zc896mLiWHU9QtNFlF5%2FHEcamiK3uC%2Fon%2BjQNuNl%0ALE5nx0WTbEXJV8z7C9M%3D%0A)
 
 ## Can I disable the sidebar?
 
 It's not currently possible to completely disable the sidebar. You can click the button on the top right of the sidebar to open or close it.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1941108004/5217903737ddd9bb62fe5d7a904c/CleanShot+2026-01-14+at+09_12_58.png?expires=1792735200&amp;signature=23f3ec10b3dbd55624df80f2b4c7c45580ce7ccf71f9a0050006dae2437c82a9&amp;req=dSkjF8h%2BlYFfXfMW1HO4zUS%2BBl3xWn7tylfYa7uDb9lQk%2F6dQGkZc9%2BJCBxD%0Az3K4z8dWcW7OvH19yfA%3D%0A)
\ No newline at end of file
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1941108004/5217903737ddd9bb62fe5d7a904c/CleanShot+2026-01-14+at+09_12_58.png?expires=1792754100&amp;signature=14218418713d1e745cf15e778e21fe0562f24c49329b3e90bc619c462c36a46b&amp;req=dSkjF8h%2BlYFfXfMW1HO4zUS%2BBl3xXH%2FuylfYa7uDb9khuFQgwN%2Fz5DRv0sWQ%0AAvlJ4bhvXY3adQRbmuo%3D%0A)
\ No newline at end of file
diff --git a/content/support/9267400-move-your-personal-claude-account-to-a-team-or-enterprise-organization.md b/content/support/9267400-move-your-personal-claude-account-to-a-team-or-enterprise-organization.md
index a3de2c647f..e05d6ab06e 100644
--- a/content/support/9267400-move-your-personal-claude-account-to-a-team-or-enterprise-organization.md
+++ b/content/support/9267400-move-your-personal-claude-account-to-a-team-or-enterprise-organization.md
@@ -132,7 +132,7 @@ For the full walkthrough of your options, deadlines, and what happens to your su
 
 You may have both a personal account and an organization account tied to the same email address. You can switch between them by clicking your initials or name in the lower left corner of the screen.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2312193347/712f763fc290b2488c103849f20c/0c135a6f-3442-4ee1-9ab7-98673f03ef6e?expires=1792735200&amp;signature=96fe56bf38a22653fa2be30bb13b1303de99f99999bc3877fecaaf544a868e74&amp;req=diMmFMh3noJbXvMW1HO4zXhPnNIxyxpjufhmlOXMdYYTex%2FjHblwKi8up7Ns%0A9i3MLy2txqW5CXAfvCY%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2312193347/712f763fc290b2488c103849f20c/0c135a6f-3442-4ee1-9ab7-98673f03ef6e?expires=1792754100&amp;signature=19ab4e625308d9e4dc6a930af410575d8a94f021c981271c1fd98b3a0fed5da6&amp;req=diMmFMh3noJbXvMW1HO4zXhPnNIxzRtgufhmlOXMdYZ0eIGOm%2BhFF31CT%2BvT%0AM%2Bp6T9K75h0teACX30A%3D%0A)
 
 A blue checkmark shows which account you're currently using. Click the other account to switch to it and access its separate conversations and projects.
 
diff --git a/content/support/9519177-how-can-i-create-and-manage-projects.md b/content/support/9519177-how-can-i-create-and-manage-projects.md
index 4fa18150a6..a91166e3a9 100644
--- a/content/support/9519177-how-can-i-create-and-manage-projects.md
+++ b/content/support/9519177-how-can-i-create-and-manage-projects.md
@@ -104,15 +104,15 @@ Starring a project allows for quick access from your projects and chats list, vi
 
 You can move a standalone chat into a project by clicking on the dropdown arrow next to the chat name, then “Add to project”:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1784190248/0f19c8de18b494a27be252fdfaff/d4e7a5c5-25f5-4623-862b-c593d2dc0b39?expires=1792735200&amp;signature=feebc9387e022be0564698037092ffce6206050d70c9a1ecd1f425e03e221766&amp;req=dScvEsh3nYNbUfMW1HO4zQABaGNrSaUXBSXNVFXQ%2FVHkslKU2irRz35Vp4SY%0AvyeOZlumy2VIcNZD1w8%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1784190248/0f19c8de18b494a27be252fdfaff/d4e7a5c5-25f5-4623-862b-c593d2dc0b39?expires=1792754100&amp;signature=9d051cfc43a062bd252a41abc5933fa076adf7172fabb33f55f7bd5576e0f548&amp;req=dScvEsh3nYNbUfMW1HO4zQABaGNrT6QUBSXNVFXQ%2FVFtPNYhdoB%2Fl%2BQyk8Y4%0A43XkdbzprGzNFNBtdHM%3D%0A)
 
 Browse or search for the correct project in the **Move chat** modal that appears, then click on it to move the chat.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1784190951/34dc256ccd4c0cf74976f31062e6/55365cf2-059d-41b2-ac95-4b00c4389a76?expires=1792735200&amp;signature=c16fdd6fd09dc2fd305a3de02d650bd4f2e5dbf2bc6c76d11ea9e72168b57059&amp;req=dScvEsh3nYhaWPMW1HO4zSMECyK3yAwDgYbpTjViBxCROiZAXCy478XHHQGY%0AbRyMeO8YGiMTXLGUyY8%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1784190951/34dc256ccd4c0cf74976f31062e6/55365cf2-059d-41b2-ac95-4b00c4389a76?expires=1792754100&amp;signature=9afcbca3cab1add63e1161262c090d63e290affec7ca185674dd3ba09ef15b15&amp;req=dScvEsh3nYhaWPMW1HO4zSMECyK3zg0AgYbpTjViBxAY27T6y90%2FkAid%2F1DN%0ASw03%2FOoCcKnihzMc29s%3D%0A)
 
 You can also remove chats from projects, or move them between projects, using the same dropdown menu within the chat:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1784185682/8625eac15b9fa452f148a6c47250/c53a1bc4-a991-4684-a789-5447ed789d35?expires=1792735200&amp;signature=2c7dff6900a055c33d964848eaadd2e7511f4e30c28ae507f2033ee2ab8035db&amp;req=dScvEsh2mIdXW%2FMW1HO4zb6DufUrDUAIS2r1%2FGRlqORlpZ9693zWBIQ9%2FEFY%0AKvcfTSySuLShG%2FyGDGQ%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1784185682/8625eac15b9fa452f148a6c47250/c53a1bc4-a991-4684-a789-5447ed789d35?expires=1792754100&amp;signature=72a456c1c70d035904be4034e8e887bb7055db9b159660d775e65a8b7dce910d&amp;req=dScvEsh2mIdXW%2FMW1HO4zb6DufUrC0ELS2r1%2FGRlqOS3TO6tIfoCX%2BbPpu8W%0AzjVaPioekEpjSac6IWg%3D%0A)
 
 ---