Audit logs without file names: what to log for Sume jobs

Claude platform release notes for September 24, 2026 say the Compliance API Activity Feed no longer returns file names, project document names or artifact titles, and those fields are always empty or omitted. The lesson for Sume jobs is the same: build audit logs from ids and statuses, not from content.

What changed upstream

The release notes, read on 2026-10-03, describe the change on the Activity Feed. If you built a report that joined on a file name, it now has nothing to join on. Whatever the vendor's reasoning, an audit trail that depends on content fields is fragile.

What Sume says is safe to log

Sume's safe automation guidance separates safe and unsafe log fields. Follow it as written.

Why request ids are enough

Every error body includes a request id that is safe to share with Sume support, and the same id is exposed in response headers. Support can resolve an issue from that id without your API key, signed URLs or workspace ids, so those never belong in a ticket or a log line.

import json, logging

log = logging.getLogger("sume.audit")

def log_submit(response, intent):
    body = response.json()
    err = body.get("error", {})
    record = {
        "intent": intent,
        "http_status": response.status_code,
        "job_id": body.get("id") or body.get("request_id"),
        "error_code": err.get("code"),
        "request_id": err.get("request_id"),
    }
    log.info(json.dumps(record))

Keep the content elsewhere

If you need to know which file a job produced, store a mapping in your own database from job id to your internal asset key, with access controls of your choosing. The log then holds only ids, and the sensitive content lives in a store you can restrict, expire and delete on your own schedule.

Job webhooks need the same care

Webhook payloads carry artifact URLs. Log the job_id and event, not the body. Sume's docs also say to use job_id as your idempotency key on the receiving side.