Setup and Configuration

1. Enable the integration in AIRS. In Prisma AIRS AIRS management UI, navigate to the Anthropic Inference Hooks configuration option. Click AI Security > AI Runtime > API Applications:

   You can configure inference hooks using options for API Applications, AI Sessions, or API Violations.
2. Click Manage in the upper right portion of the AI Applications page:
3. Select Applications:
4. Click Add New Application/API Key:

   Use Edit to configure an existing deployment profile.
5. In the Onboard API Account, select the profile to begin API onboarding, then click Next:
6. In the Add Application (Agent) screen, specify the following:

   1. Include an Application Name.
   2. Use the drop-down to select a Cloud Provider.
   3. Select the Environment.
   4. Select the AI Agent Framework.
   5. Enter a Webhook Secret.
   6. Use the toggle to enable the Security Profile; use the drop-down to link an existing security profile or choose which profile to use in your app code.
   7. Click Next.
7. In the Input API Details page:

   1. Enter a name API Key Name.
   2. Use the drop-down to select the key Rotation.
   3. Click Generate API Key.

      The Implement API Key screen appears, with the generated API key:
8. Click Done.

   Next, you'll configure Anthropic Inference Hooks.
9. In the Anthropic console under Organization settings › Inference hooks:

   1. Set the endpoint URL to the AIRS webhook URL provided in the Prisma AIRS console.
   2. Add a custom header carrying your AIRS API key:

      • Header name: x-pan-token
      • Header value: your AIRS API key

      Header naming rules.Anthropic reserves webhook-*, X-Anthropic-*, and Content-* prefixes, and requires hyphens (not underscores) in header names. `x-pan-token` complies with these rules.
10. Enter the signing secret in AIRS. After saving the Inference Hooks configuration, Anthropic displays a signing secret (prefixed). This secret is shown only once. Call the Prisma AIRS management API to store it:

    ```http
    PUT /v1/mgmt/app/{customer_appId}/anthropic-webhook
    Content-Type: application/json
    X-Tsg-Id: <your TSG ID>
    
    {
      "signing_secret": "whsec_…",
      "enabled": true,
      "profile_name": "your-scan-profile"
    }
    ```
    

    Consider the propagation window. For approximately one minute after a secret is first set, and just after a rotation, Anthropic may send requests that are unsigned or signed with the previous secret. The AIRS edge is configured to tolerate this window to avoid blocking all prompts across the organization during activation.
11. Test and activate:

    1. In the Anthropic console, click Test connection. Anthropic sends a synthetic config-test frame. AIRS returns allow for these frames without logging.
    2. Once the test succeeds, enable Enforce verdicts in the Anthropic console. Enforcement propagates within approximately one minute.