Docs

What each connector actually sees, what it doesn't, how the data reaches Sentry, and which one to pick. Several of these look similar on the surface and are not the same thing underneath – that distinction is the whole point of this page.

All connectors share the same security posture: outbound HTTPS only, nothing installed on your infrastructure, read-scoped credentials, revocable in Settings at any time. Conversation content is never captured unless payload capture is explicitly enabled per agent.

Written to be forwarded: print or save this page as a PDF and hand it to your security team before the connection dry run. It answers what we touch, how, and what we structurally cannot see.

AI Platforms

Claude

One question decides everything else: whose account is it. An individual account is a person's own seat and can only be connected machine by machine. An organisation account – Team or Enterprise – has an administrator, and that administrator can turn telemetry on for everybody at once, in about five minutes, without touching a single machine or issuing a single API key.

This is not a difference of degree. On an individual plan there is no account-level setting to reach, because there is no account above the person. On an organisation plan there is, and it is the single most valuable thing we connect.

	Individual account	Organisation account
Plans	Free, Pro, Max	Team, Enterprise
Who owns it	A person. The seat is billed to them and nobody administers it but them.	A company. Seats are provisioned by an administrator, who has an Organisation settings area the individual plans do not have.
How it connects	Per machine. The developer sets three environment variables on their own machine, or you set them for them.	Once, by the administrator. They paste an endpoint, a protocol and a header into the Monitoring box on each product's settings page.
What that covers	Claude Code, on that one machine.	Every seat on the account, from that moment on, with nothing installed on anyone's machine and no API key in existence.
What it still misses	Everyone else, including other people at the same company. There is no account-level setting to reach, because there is no account above the person.	Chat, on every plan. Anything that happened before the box was filled in – telemetry only accrues from the moment it is saved.

Both paths land in the same place: Anthropic's own OpenTelemetry exporter pushing to our collector in real time, Tier 2, with per-session detail including the accept or reject a person gave a proposed edit. The organisation path simply gets there without asking anyone to configure anything.

Claude Organization

Team or Enterprise · one admin, once

T2 · Native telemetry

One admin pastes three values per product. Everyone on the organisation reports from then on – no per-machine setup, no API key, nothing installed.

Where the values go

CoworkPaste here
Organisation settings → Products → Cowork → Monitoring
Verified in production. Claude Code activity across the organisation arrives through this box.
Office AgentsPaste here
Organisation settings → Products → Office Agents → Monitoring
Claude working across Excel, PowerPoint and Word.
Claude CodeNo setting
No Monitoring section on this page. Claude Code activity still arrives through Cowork's box; a per-developer connector also exists if you want it independently.
ChatNo setting
Anthropic exposes no telemetry export for chat. It is visible in their own Usage dashboard and nowhere else, so we do not claim it.

Sees

·Every seat on the organisation, without touching anyone's machine
·Tokens and model per session, in real time
·Tool calls, including the accept/reject decision on code edits

Can't see

·Chat – no export path exists on any plan
·Conversation content, unless payload capture is explicitly enabled per agent
·Anyone using a personal account rather than an organisation seat

Three values, pasted by your own administrator. Revocable at any time.claude.ai → Organisation settings

Claude Code

One developer, one machine · no API key exists

T2 · Native telemetry

How the data reaches Sentry: Push. Claude Code's built-in OpenTelemetry exporter posts metrics and logs straight to Sentry's OTLP collector, authenticated with the ingest key the wizard mints. Nothing is installed and no Anthropic API key is involved.
Freshness: Real time – each export interval, 30 to 60 seconds.

Sees

·Every session from this machine: input, output and cache tokens, per model
·Cost per session – list-equivalent on a Max/Pro seat, never counted as spend
·Every tool execution, including the accept/reject decision on code edits
·Time the agent spent blocked waiting on a human

Can't see

·Prompt and conversation content – never captured
·Any machine that has not set these variables, including other people on the same organisation
·claude.ai chat on the same account – Anthropic exposes no export for chat on any plan

Three environment variables. No code change, no API key.

Worth knowing before you ask for it

Chat cannot be exported on any plan
Not on Team, not on Enterprise. Anthropic shows chat usage in its own Usage dashboard and exposes no telemetry export for it, so we do not claim it and no connector will ever produce it.
The Analytics API is not on every organisation
Some claude.ai organisations can issue a read:analytics key and some have no API section in their admin navigation at all. We have confirmed both cases on real accounts. It also lags around three days and reports daily aggregates, so even where it exists it is a weaker signal than the Monitoring box.
platform.claude.com is a different organisation
The Console is where API keys live and where developers building on the Messages API are billed. It is a separate account from your claude.ai organisation, with separate keys, and usage in one is invisible to the other. If nobody at the company writes code against the API, it does not apply to you.

OpenAI

One connector today: API usage, polled with a read-scoped admin key. The individual-versus-organisation split that decides everything on the Claude side barely applies here, because both go through the same door – a personal developer account has its own default organisation, so the same connector reads an org of one. What OpenAI has no equivalent of is Anthropic's organisation-wide Monitoring box, so there is no five-minute path that covers every seat at once. It also does not expose ChatGPT usage – consumer, Plus, Team or Enterprise chat – through this API at all, so that traffic is invisible to Sentry regardless of what gets connected. Where that boundary matters, the honest move is to register ChatGPT seats as a bounded entry rather than pretend a number exists.

OpenAI account

Personal or team API account · Admin API

T3 · Admin API

Reports usage across every API key in whichever OpenAI organisation the key was issued in. That works the same whether you are a company with a team or one person with a personal account: a personal developer account still has its own default organisation, so this connects an org of one. It covers anything calling the Chat Completions or Responses API through those keys. OpenAI's admin API reports tokens only, no cost, so spend is computed from those tokens against Sentry's own price book, the same way AWS AgentCore's is. It does not see ChatGPT usage – consumer, Plus, Team or Enterprise chat – at all, because OpenAI exposes no export for it.

How the data reaches Sentry: Poll. Sentry calls OpenAI's admin usage API (usage/completions) on a schedule with your read-scoped admin key. OpenAI reports tokens only – no dollars – so Sentry computes spend itself from those tokens against its own price book.
Freshness: Daily rollup, refreshed on a schedule plus on-demand sync.

Sees

·Tokens across every API key in the organisation the key belongs to, per day per model – one person's account or a whole company's, same mechanism
·Spend computed by Sentry from those tokens – the cost engine fills the number OpenAI's own API leaves blank

Can't see

·ChatGPT usage – consumer, Plus, Team or Enterprise chat is not exposed through this API at all, and Sentry says so rather than pretending
·Individual agents, sessions or real-time activity – daily aggregates only
·Conversation content of any kind

An Admin API key (sk-admin-…) from platform.openai.com. A standard project key will not work.Create an Admin key

Microsoft Copilot

Two Microsoft surfaces, and they are not the same thing. Azure AI Foundry is a runtime you build agents in – it emits OpenTelemetry, so it connects today on Tier 2 like any other runtime. Microsoft 365 Copilot is a closed product your people use – it exposes nothing but a Graph audit trail, needs its own adapter, and that adapter is not built yet.

Azure AI Foundry

OpenTelemetry GenAI

T2 · Native telemetry

Three environment variables on the runtime.

Microsoft 365 Copilot

Graph audit API · closed platform

T3 · Admin API

Read-only Graph audit access, set up with you during onboarding.

Not self-serve yet

Terminologies

Tier 1 · Inline

T1 · Inline

The agent's model and tool calls route through Sentry's gateway. Point the agent's model base URL (and MCP tool calls) at the Sentry gateway. We issue a virtual key; nothing about the agent's logic changes.

What Sentry gets · Full fidelity

·Every prompt, completion, tool call and token, in real time
·Live cost per conversation and per resolution
·Policy enforced at the tool call – writes can be gated before they run

Governance ceiling

Full – approve, block or pause any action before it executes.

Tier 2 · Native telemetry

T2 · Native telemetry

The agent's own telemetry exporter points at Sentry. The harness already emits OpenTelemetry. Set its OTLP endpoint to Sentry (one env var for AWS AgentCore, Azure AI Foundry, the Claude Agent SDK). No rebuild.

What Sentry gets · High fidelity

·Traces, spans, tokens, latency and tool calls via native telemetry
·Near-complete cost and quality signal without touching the agent's code
·Regressions caught the moment a trace shifts

Governance ceiling

Strong – pause the agent and enforce boundaries; enforcement is out-of-band, not inline.

Tier 3 · Admin API

T3 · Admin API

Sentry pulls usage and audit records from the vendor's admin API. Paste a read-scoped admin or audit key (OpenAI usage, Salesforce SOQL, Microsoft Graph, Anthropic usage). Sentry pulls usage, cost and audit records on a schedule.

What Sentry gets · Aggregate

·Usage, spend and audit records pulled on a schedule
·Cost rolled into the same cross-vendor per-agent view
·Transcripts where the vendor exposes them

Governance ceiling

Accounting-grade – cost and audit trail; enforcement stays in the vendor's console.

Tier 4 · Registered

T4 · Registered

The agent is registered and bounded, with no live telemetry. For black-box or embedded agents that expose no telemetry (a vendor SaaS assistant, an embedded copilot). Register it, declare its owner, systems and blast radius, and set the boundaries it must stay inside.

What Sentry gets · Governance only

·The agent is on the books – nothing in the estate is invisible
·Declared owner, purpose, systems and blast radius
·Estimated cost accounted alongside instrumented agents

Governance ceiling

Boundary-level – the agent is on the register and inside a declared blast radius.

Push and poll

Every V1 connector is one of two mechanisms, and the mechanism decides what you get. Push (Tier 2): the agent's own OpenTelemetry exporter posts to Sentry's collector in real time – rich, per-session, but only from machines that set the variables. Poll (Tier 3): Sentry calls the vendor's admin API on a schedule with a read-scoped key – one key covers the whole org, but the data is a delayed daily aggregate with no session detail. Neither mechanism ever gives the vendor a way into your systems: push is your agent talking out, poll is Sentry reading a vendor API.

Cost basis

Not every number a vendor calls "cost" is money anyone was billed. A subscription seat has no marginal token cost, so reporting its tokens as spend would overstate the bill. Every call Sentry prices carries a basis, and only one of them counts as spend.

Basis	What it means	Counts as spend
Metered	Billed per token against an API key. Real money.	Yes
List-equivalent	A subscription seat. The tokens are real but carry no marginal cost, so the figure is what they would have cost at API list price.	No – reported, never summed
Unmetered	Tier 4. No telemetry exists to price. We say so rather than estimate.	No

This is also why Sentry computes cost itself rather than trusting an invoice. AWS AgentCore, for instance, reports tokens and no dollars at all – the figure you see is priced from the tokens we watched go past, against our own price book.

Planned for V2

Catalogued and greyed in the wizard, not hidden – "we can't connect it yet" is a fact, not a secret. Each of these needs its own adapter or is registration-only by design.

Platform	How it will connect
AWS AgentCoreBedrock · OpenTelemetry GenAI	Redirect the runtime's existing OTLP firehose. The agent stays in its region.
Custom or self-hosted agentYour own code, LangChain, LlamaIndex, vLLM	Point the standard OpenTelemetry exporter at Sentry. Nothing else changes.
Salesforce AgentforceAdmin API · closed platform	Agentforce exposes usage through Salesforce's admin API. It needs a per-vendor adapter, which is not built yet.
Anything elseShadow AI, embedded and black-box agents	Give it a name and an owner. We register and bound it, and we say plainly that we cannot see inside it.