Providers

Anthropic

Point any Anthropic-shaped client at Sentisec. Claude Code, the Anthropic SDKs, custom clients — all work with one base-URL change.

Sentisec speaks the Anthropic Messages API natively. Any client that sends POST /v1/messages — Claude Code, the Anthropic Python and TypeScript SDKs, your own client — points at Sentisec with a base-URL change and no code change.

Model ids beginning claude- route to Anthropic automatically, so there is nothing else to configure.

Setup

Get an Anthropic key from console.anthropic.com.

Add it to your workspace. In the dashboard, open Settings → Providers. Under Provider keys, choose Add Anthropic key, paste the key, and click Save credential.

Mint a Sentisec API key. Settings → API keys → Issue key. Format: sk_sentisec_<8>_<32>. This is the key your client sends; your Anthropic key stays in the workspace.

Point your client at Sentisec. Two environment variables:

export ANTHROPIC_BASE_URL=https://api.sentisec.ch/ws/<your-workspace-id>
export ANTHROPIC_API_KEY=$SENTISEC_API_KEY

Running Sentisec yourself? Substitute your own base URL — see enterprise access.

Warning
The workspace id in the URL is load-bearing

Use the workspace-scoped base URL. It is the form that guarantees your workspace's own policy travels with every request, on every transport. Your workspace id is on the dashboard next to your API key.

Note there is no /v1 on the Anthropic-shaped base URL — the SDKs append it themselves.

First call

curl -X POST https://api.sentisec.ch/ws/<your-workspace-id>/v1/messages \
  -H "Authorization: Bearer $SENTISEC_API_KEY" \
  -H "anthropic-version: 2023-06-01" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "claude-sonnet-4",
    "max_tokens": 256,
    "messages": [{"role": "user", "content": "hi"}]
  }'

You get back the standard Anthropic Messages body. The session appears under Sessions in the dashboard.

Claude Code

export ANTHROPIC_BASE_URL=https://api.sentisec.ch/ws/<your-workspace-id>
export ANTHROPIC_API_KEY=$SENTISEC_API_KEY
claude  # the CLI now runs through Sentisec — no other changes

Using Claude Code on a subscription rather than an API key? You do not need an Anthropic key at all — see subscription mode.

Anthropic SDKs

import os
from anthropic import Anthropic

client = Anthropic(
    base_url="https://api.sentisec.ch/ws/<your-workspace-id>",
    api_key=os.environ["SENTISEC_API_KEY"],
)

resp = client.messages.create(
    model="claude-sonnet-4",
    max_tokens=256,
    messages=[{"role": "user", "content": "hi"}],
)
import Anthropic from "@anthropic-ai/sdk";

const client = new Anthropic({
  baseURL: "https://api.sentisec.ch/ws/<your-workspace-id>",
  apiKey: process.env.SENTISEC_API_KEY!,
});

const resp = await client.messages.create({
  model: "claude-sonnet-4",
  max_tokens: 256,
  messages: [{ role: "user", content: "hi" }],
});

Streaming ("stream": true) works on the same route, and tool calls are gated on both the streaming and non-streaming paths.

Model ids

Model idNotes
claude-opus-4-7Highest capability. claude-opus-4-7[1m] for the long-context variant.
claude-sonnet-4The everyday default.
claude-haiku-4Fastest, cheapest.
claude-3-5-sonnet, claude-3-5-haikuPrevious generation.

These are the ids surfaced in model discovery (GET .../v1/models). Any id starting with claude- is forwarded to Anthropic, which is the source of truth for what your key can call — so a newer model works the day Anthropic ships it.

What you get

Every call runs through the integrity engine before it reaches Anthropic, and every tool call the model asks for is evaluated before your tools run it. Verdicts and forensic evidence land in the dashboard. Vision, tool use, and long context are all forwarded untouched.

If something goes wrong

ResponseWhat it means
401 / 402 no_upstream_credentialNo Anthropic key is stored on this workspace. Add it under Settings → Providers, in Provider keys — the request's row under Requests offers Add Anthropic key, which opens that page with Anthropic selected.
A 401 from AnthropicYour Anthropic key was revoked or is out of quota at the vendor.
400 upstream_provider_header_invalidYou sent an X-Sentisec-Upstream-Provider value that is not a known provider name.

More: Provider unavailable.

More

Protected docs