Cloud coding-agent OTLP intake (Claude Cowork)

Some AI coding agents run in the cloud, not on a machine you control, so you cannot put an ampbase supervisor next to them. Claude Cowork is the canonical example: it exports OpenTelemetry directly to a customer-specified endpoint over the public internet.

Ampbase accepts that telemetry on your org's OTLP endpoint, authenticated by a channel-scoped agent key. No supervisor is involved, and there is nothing to install — the agent posts straight to your org.

How it routes

   Claude Cowork (or any OTLP exporter)
        │
        │  POST https://<org>.ampbase.io/v1/logs
        │  Authorization: Bearer agent_<channel>_<random>
        ▼
   your org endpoint
        │   1. the subdomain identifies your org
        │   2. the agent key is validated against that org's channel
        ▼
   stored in your org's partition

Your telemetry body is never inspected on the way in. The endpoint authenticates the request and hands it straight to storage — the same path, and the same agent-key format, as any other OTLP producer you point at Ampbase.

Setup

1. Create a Channel for cloud agents (kind: AI coding agents) — e.g. cloud-agents — and mint a channel-scoped agent key.
2. Configure the cloud agent to export to your org endpoint. For Claude Cowork (Claude Desktop → Organization settings → Cowork, v1.1.4173+, Team / Enterprise):
   • OTLP endpoint: https://<org>.ampbase.io (the OTLP SDK appends /v1/logs and /v1/metrics).
   • Protocol: HTTP/JSON or HTTP/protobuf (both are accepted; gRPC is not offered by Cowork and is not this route).
   • Headers: Authorization: Bearer agent_<channel>_<random>.

That is the whole integration — the route already exists and is authenticated.

Signals

Only POST /v1/logs and POST /v1/metrics are served. Cowork's telemetry is log-shaped events (prompts, tool/MCP invocations, file access, approvals — each carrying a prompt.id) plus per-request metrics (model, token counts, cost, duration). There is deliberately no /v1/traces route.

Redaction caveat — read this

A cloud agent exports straight to ingest. There is no supervisor and therefore no events-pipeline redaction on this path — the workstation tiers (metadata-only / no-content / full) do not apply here. To make that explicit rather than silent, the ingest route stamps every cloud-agent record with ampbase.redaction.location: none — the same provenance attribute a supervisor stamps as source+gateway or gateway (the full scale) — so a downstream SIEM never mistakes a bare record for one where device-side redaction ran. What leaves the cloud agent is governed by:

• the exporting agent's own configuration — e.g. Cowork includes full prompt text by default; redact or filter at the source where the product allows it; and
• any ingest-side policy you apply downstream.

If you need the managed, versioned, canaried redaction tiers, the telemetry must pass through a supervisor — which for cloud agents it cannot. Treat the cloud-agent path as "raw OTLP into your tenant, authenticated" and scope the channel accordingly. For CI, where you do control the runner, prefer the supervisor-sidecar pattern in coding agents in CI, which keeps redaction in the loop.