Claude Code OpenTelemetry for admins: what you can and cannot see

the short answer

With CLAUDE_CODE_ENABLE_TELEMETRY=1 set in managed settings, every developer’s Claude Code exports metrics (sessions, tokens, cost, lines changed, commits, PRs) and events (prompts, tool decisions, tool results, API requests, hook runs) to your collector, tagged with user email, account and session. Command text and prompt content are opt-in. OTel shows what happened; it does not stop anything, and it covers only Claude Code.

Enable: CLAUDE_CODE_ENABLE_TELEMETRY=1 in managed env
Metrics: claude_code.session.count, .token.usage, .cost.usage, .lines_of_code.count, .commit.count, .pull_request.count
Events: user_prompt, tool_decision, tool_result, api_request, permission_mode_changed, hook_execution_start, managed_settings_resolved
Opt-in content: OTEL_LOG_USER_PROMPTS, OTEL_LOG_TOOL_DETAILS, OTEL_LOG_ASSISTANT_RESPONSES
Identity: user.email, user.account_uuid, organization.id, session.id

Turn It on for Everyone

Because this block sets the exporter selectors in managed settings, project and local settings cannot change or turn them off, and setting the endpoint removes developer-set per-signal endpoints. OTEL_EXPORTER_OTLP_PROTOCOL has no default. Use otelHeadersHelper for collector credentials rather than a static token in OTEL_EXPORTER_OTLP_HEADERS, which sits in plain text on every machine. OTEL_METRICS_INCLUDE_REPOSITORY (2.1.269+) adds repository identity; OTEL_LOG_MANAGED_SETTINGS (2.1.274+) adds the redacted managed settings and a digest to managed_settings_resolved, so you can verify which policy each machine runs.

{
  "env": {
    "CLAUDE_CODE_ENABLE_TELEMETRY": "1",
    "OTEL_METRICS_EXPORTER": "otlp",
    "OTEL_LOGS_EXPORTER": "otlp",
    "OTEL_EXPORTER_OTLP_PROTOCOL": "http/protobuf",
    "OTEL_EXPORTER_OTLP_ENDPOINT": "https://otel-collector.example.com",
    "OTEL_METRICS_INCLUDE_REPOSITORY": "true",
    "OTEL_LOG_MANAGED_SETTINGS": "1"
  },
  "otelHeadersHelper": "/usr/local/bin/otel-headers.sh"
}

What You Can See

Question	Signal
Who is using Claude Code, and how much?	`session.count`, `active_time.total` by `user.email`
What does it cost per developer, team or repository?	`cost.usage`, `token.usage`, with repository attributes
How much code does it produce?	`lines_of_code.count`, `commit.count`, `pull_request.count`
Which tools did it use, and who decided?	`tool_decision` events; `source` distinguishes a hook decision from a config rule
Which commands did it run?	`tool_result` with `OTEL_LOG_TOOL_DETAILS=1` (`bash_command`, `full_command`)
What did developers ask?	`user_prompt` with `OTEL_LOG_USER_PROMPTS=1`
Which hooks ran, and is the policy deployed?	`hook_execution_start` and `hook_execution_complete`; `managed_settings_resolved`
Did anyone switch permission modes?	`permission_mode_changed`

Cloud Sessions Are Configured Separately

Anthropic-hosted cloud sessions do not read the device’s managed file; set the telemetry variables in server-managed settings env, or in the cloud environment’s variables.
Claude Tag channel sessions use organization-level environments; set variables there.
Cowork does not receive server-managed settings and has its own OpenTelemetry form in the admin console.

Sending It to FailproofAI Cloud

failproofai otel enable claude sends Claude Code’s telemetry to FailproofAI Cloud, where supported agent logs become sessions; it turns text capture on unless you add --no-content. FailproofAI Cloud accepts OTLP over HTTP (protobuf or JSON), not gRPC, and acknowledges metrics without storing them. If managed settings set the OTLP endpoint, Claude Code removes developer-set endpoints, so to use FailproofAI Cloud fleet-wide put its endpoint in managed env rather than relying on per-machine setup.

What OpenTelemetry Cannot Do

Stop anything. It reports after the fact. Blocking needs a hook or managed rule.
See other agents. Codex, Cursor and Copilot have separate telemetry with different event names and identity fields.
Explain your organization’s rule. A tool decision shows whether a hook or config decided, not which of your policies matched and why.

FAQ

Does it send prompts by default?

No. Prompt text, tool details and assistant responses are each opt-in. OTEL_LOG_ASSISTANT_RESPONSES falls back to OTEL_LOG_USER_PROMPTS when unset.

Which backends work?

Any OTLP-compatible collector or vendor. FailproofAI Cloud accepts OTLP over HTTP only.

Can I get the same for Codex?

Codex has an [otel] block in config.toml with its own event names (codex.tool_decision, codex.tool_result).

Sources

Checked against the sources below on October 21, 2026. Harness settings, hook capabilities and cloud features change between versions.