Page history
Federation Rules
api/admin/federation_rules
History
api/admin/federation_rules Changed · +203 / -188 lines
### Headers ### Body parameters #### Response (200) ### Path parameters ### Headers #### Response (200) ### Query parameters ### Headers #### Response (200) ### Path parameters ### Headers ### Body parameters #### Response (200) ### Path parameters ### Headers #### Response (200) ## Domain types ## Federation Rules › Workspaces ### List Federation Rule Workspaces #### Path parameters #### Query parameters #### Headers #### Returns #### Example ##### Response (200) ### Add Federation Rule Workspace #### Path parameters #### Headers #### Body parameters #### Returns #### Example ##### Response (200) ### Remove Federation Rule Workspace #### Path parameters #### Headers #### Returns #### Example ##### Response (200) ### Header Parameters ### Body Parameters #### Response ### Path Parameters ### Header Parameters #### Response ### Query Parameters ### Header Parameters #### Response ### Path Parameters ### Header Parameters ### Body Parameters #### Response ### Path Parameters ### Header Parameters #### Response ## Domain Types # Workspaces ## List Federation Rule Workspaces ### Path Parameters ### Query Parameters ### Header Parameters #### Response ## Add Federation Rule Workspace ### Path Parameters ### Header Parameters ### Body Parameters #### Response ## Remove Federation Rule Workspace ### Path Parameters ### Header Parameters #### Response ## Domain Types ### Workspace List Response ### Workspace Create Response ### Workspace Delete Response
from line 1
---- -title: Federation Rules -url: https://platform.claude.com/docs/en/api/admin/federation_rules ---- - # Federation Rules ## Create Federation Rule -**post** `/v1/organizations/federation_rules` +**POST** `/v1/organizations/federation_rules` Create a federation rule owned by your organization.
from line 21
`workspace:inference`; other scopes require a Console session. Admin API keys are not accepted. -### Header Parameters +### Headers - `"anthropic-beta": optional array of string`
from line 29
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta. -### Body Parameters +### Body parameters - `issuer_id: string` Tagged ID of the federation issuer. -- `match: object { audience, claims, condition, subject_prefix }` +- `match: object` Conditions the verified JWT must satisfy for this rule to apply. At least one of `subject_prefix` (other than a wildcard-only value like `*`), `claims`, or `condition` is required; `audience` alone is not sufficient.
from line 43
Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default. + maxLength: 1024 + - `claims: optional map[string] or null` Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 53
CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400. + maxLength: 4096 + - `subject_prefix: optional string or null` Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`. + maxLength: 1024 + - `name: string` Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409. + maxLength: 255, minLength: 1 + - `oauth_scope: string` Space-separated OAuth scopes. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session. -- `target: object { service_account_id, type, service_account_name }` + minLength: 1 +- `target: object` + Identity that tokens minted via this rule act as. Currently always a `service_account` target. - `service_account_id: string`
from line 83
- `type: "service_account"` - - `"service_account"` - - `service_account_name: optional string or null` Service account's display name at read time. Ignored on writes.
from line 99
Optional free-text description. + maxLength: 2000 + - `token_lifetime_seconds: optional number` Lifetime in seconds for access tokens minted via this rule (60-86400). Defaults to 3600 (1h). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds. + maximum: 86400, minimum: 60 + - `workspace_id: optional string or null` Tagged ID of the workspace to enable this rule for. Required unless `applies_to_all_workspaces` is true. Additional workspaces can be added via the `/federation_rules/{federation_rule_id}/workspaces` sub-resource.
from line 113
### Returns -- `FederationRule object { id, applies_to_all_workspaces, archived_at, 17 more }` +- `FederationRule object` Authorization rule binding an external OIDC identity to Anthropic.
from line 138
If set, this rule is archived and rejects token exchange. + format: date-time + - `archived_by_actor_id: string or null` Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
from line 152
When this rule was created. + format: date-time + - `created_by_actor_id: string or null` Tagged ID (`user_`/`svac_`) of the actor that created this rule.
from line 170
Issuer's display name at read time. - - `match: object { audience, claims, condition, subject_prefix }` + - `match: object` Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
from line 178
Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default. + maxLength: 1024 + - `claims: optional map[string] or null` Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 188
CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400. + maxLength: 4096 + - `subject_prefix: optional string or null` Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`. + maxLength: 1024 + - `name: string` Admin-chosen slug identifier.
from line 204
Space-separated OAuth scopes granted on the minted token. - - `target: object { service_account_id, type, service_account_name }` + - `target: object` Identity that tokens minted via this rule act as. Currently always a `service_account` target.
from line 214
- `type: "service_account"` - - `"service_account"` - - `service_account_name: optional string or null` Service account's display name at read time. Ignored on writes.
from line 224
- `type: "federation_rule"` - - `"federation_rule"` + default: federation_rule - `updated_at: string` When this rule was last updated. + format: date-time + - `updated_by_actor_id: string or null` Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
from line 246
### Example -```http +```bash curl https://api.anthropic.com/v1/organizations/federation_rules \ -H 'Content-Type: application/json' \ -H 'anthropic-version: 2023-06-01' \
from line 263
}' ``` -#### Response +#### Response (200) ```json {
from line 307
## Get Federation Rule -**get** `/v1/organizations/federation_rules/{federation_rule_id}` +**GET** `/v1/organizations/federation_rules/{federation_rule_id}` Retrieve a federation rule by its ID (`fdrl_...`). -### Path Parameters +### Path parameters - `federation_rule_id: string` ID of the federation rule. -### Header Parameters +### Headers - `"anthropic-beta": optional array of string`
from line 327
### Returns -- `FederationRule object { id, applies_to_all_workspaces, archived_at, 17 more }` +- `FederationRule object` Authorization rule binding an external OIDC identity to Anthropic.
from line 352
If set, this rule is archived and rejects token exchange. + format: date-time + - `archived_by_actor_id: string or null` Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
from line 366
When this rule was created. + format: date-time + - `created_by_actor_id: string or null` Tagged ID (`user_`/`svac_`) of the actor that created this rule.
from line 384
Issuer's display name at read time. - - `match: object { audience, claims, condition, subject_prefix }` + - `match: object` Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
from line 392
Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default. + maxLength: 1024 + - `claims: optional map[string] or null` Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 402
CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400. + maxLength: 4096 + - `subject_prefix: optional string or null` Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`. + maxLength: 1024 + - `name: string` Admin-chosen slug identifier.
from line 418
Space-separated OAuth scopes granted on the minted token. - - `target: object { service_account_id, type, service_account_name }` + - `target: object` Identity that tokens minted via this rule act as. Currently always a `service_account` target.
from line 428
- `type: "service_account"` - - `"service_account"` - - `service_account_name: optional string or null` Service account's display name at read time. Ignored on writes.
from line 438
- `type: "federation_rule"` - - `"federation_rule"` + default: federation_rule - `updated_at: string` When this rule was last updated. + format: date-time + - `updated_by_actor_id: string or null` Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
from line 460
### Example -```http +```bash curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID \ -H 'anthropic-version: 2023-06-01' \ -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" ``` -#### Response +#### Response (200) ```json {
from line 510
## List Federation Rules -**get** `/v1/organizations/federation_rules` +**GET** `/v1/organizations/federation_rules` List federation rules in your organization.
from line 517
Optionally filter by issuer with `issuer_id`. Archived rules are excluded unless `include_archived=true`. -### Query Parameters +### Query parameters - `include_archived: optional boolean` Include archived resources. Defaults to false. + default: false + - `issuer_id: optional string` Filter to rules referencing this federation issuer.
from line 533
Number of results per page. + default: 20, maximum: 100, minimum: 1 + - `page: optional string` Opaque cursor from a previous response's `next_page`. -### Header Parameters +### Headers - `"anthropic-beta": optional array of string`
from line 563
If set, this rule is archived and rejects token exchange. + format: date-time + - `archived_by_actor_id: string or null` Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
from line 577
When this rule was created. + format: date-time + - `created_by_actor_id: string or null` Tagged ID (`user_`/`svac_`) of the actor that created this rule.
from line 595
Issuer's display name at read time. - - `match: object { audience, claims, condition, subject_prefix }` + - `match: object` Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
from line 603
Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default. + maxLength: 1024 + - `claims: optional map[string] or null` Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 613
CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400. + maxLength: 4096 + - `subject_prefix: optional string or null` Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`. + maxLength: 1024 + - `name: string` Admin-chosen slug identifier.
from line 629
Space-separated OAuth scopes granted on the minted token. - - `target: object { service_account_id, type, service_account_name }` + - `target: object` Identity that tokens minted via this rule act as. Currently always a `service_account` target.
from line 639
- `type: "service_account"` - - `"service_account"` - - `service_account_name: optional string or null` Service account's display name at read time. Ignored on writes.
from line 649
- `type: "federation_rule"` - - `"federation_rule"` + default: federation_rule - `updated_at: string` When this rule was last updated. + format: date-time + - `updated_by_actor_id: string or null` Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
from line 675
### Example -```http +```bash curl https://api.anthropic.com/v1/organizations/federation_rules \ -H 'anthropic-version: 2023-06-01' \ -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" ``` -#### Response +#### Response (200) ```json {
from line 730
## Update Federation Rule -**post** `/v1/organizations/federation_rules/{federation_rule_id}` +**POST** `/v1/organizations/federation_rules/{federation_rule_id}` Partially update a federation rule.
from line 750
`workspace:developer` or `workspace:inference`; other scopes require a Console session. Admin API keys are not accepted. -### Path Parameters +### Path parameters - `federation_rule_id: string` ID of the federation rule to update. -### Header Parameters +### Headers - `"anthropic-beta": optional array of string`
from line 764
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta. -### Body Parameters +### Body parameters - `applies_to_all_workspaces: optional boolean or null`
from line 778
Replaces the description. Omit to leave unchanged; send `null` to clear (the field is stored as an empty string). -- `match: optional object { audience, claims, condition, subject_prefix } or null` + maxLength: 2000 +- `match: optional object or null` + Does the incoming JWT qualify? All populated fields must pass; omitted fields are skipped. At least one
from line 792
Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default. + maxLength: 1024 + - `claims: optional map[string] or null` Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 802
CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400. + maxLength: 4096 + - `subject_prefix: optional string or null` Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`. + maxLength: 1024 + - `name: optional string or null` Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409. + maxLength: 255, minLength: 1 + - `oauth_scope: optional string or null` Replaces the space-separated OAuth scopes granted on minted tokens. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session. -- `target: optional object { service_account_id, type, service_account_name } or null` + minLength: 1 +- `target: optional object or null` + Bind to a fixed service account by ID. - `service_account_id: string`
from line 832
- `type: "service_account"` - - `"service_account"` - - `service_account_name: optional string or null` Service account's display name at read time. Ignored on writes.
from line 840
Replaces the lifetime in seconds for access tokens minted via this rule (60-86400). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds. + maximum: 86400, minimum: 60 + - `workspace_id: optional string or null` Replaces the existing single workspace enablement (the previous one is removed). Rejected with 400 if the rule is enabled for more than one workspace; use the `/federation_rules/{federation_rule_id}/workspaces` sub-resource instead.
from line 848
### Returns -- `FederationRule object { id, applies_to_all_workspaces, archived_at, 17 more }` +- `FederationRule object` Authorization rule binding an external OIDC identity to Anthropic.
from line 873
If set, this rule is archived and rejects token exchange. + format: date-time + - `archived_by_actor_id: string or null` Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
from line 887
When this rule was created. + format: date-time + - `created_by_actor_id: string or null` Tagged ID (`user_`/`svac_`) of the actor that created this rule.
from line 905
Issuer's display name at read time. - - `match: object { audience, claims, condition, subject_prefix }` + - `match: object` Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
from line 913
Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default. + maxLength: 1024 + - `claims: optional map[string] or null` Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 923
CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400. + maxLength: 4096 + - `subject_prefix: optional string or null` Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`. + maxLength: 1024 + - `name: string` Admin-chosen slug identifier.
from line 939
Space-separated OAuth scopes granted on the minted token. - - `target: object { service_account_id, type, service_account_name }` + - `target: object` Identity that tokens minted via this rule act as. Currently always a `service_account` target.
from line 949
- `type: "service_account"` - - `"service_account"` - - `service_account_name: optional string or null` Service account's display name at read time. Ignored on writes.
from line 959
- `type: "federation_rule"` - - `"federation_rule"` + default: federation_rule - `updated_at: string` When this rule was last updated. + format: date-time + - `updated_by_actor_id: string or null` Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
from line 981
### Example -```http +```bash curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID \ -H 'Content-Type: application/json' \ -H 'anthropic-version: 2023-06-01' \
from line 989
-d '{}' ``` -#### Response +#### Response (200) ```json {
from line 1033
## Archive Federation Rule -**post** `/v1/organizations/federation_rules/{federation_rule_id}/archive` +**POST** `/v1/organizations/federation_rules/{federation_rule_id}/archive` Archive a federation rule.
from line 1045
whose `oauth_scope` is `workspace:developer` or `workspace:inference`; other scopes require a Console session. Admin API keys are not accepted. -### Path Parameters +### Path parameters - `federation_rule_id: string` ID of the federation rule to archive. -### Header Parameters +### Headers - `"anthropic-beta": optional array of string`
from line 1061
### Returns -- `FederationRule object { id, applies_to_all_workspaces, archived_at, 17 more }` +- `FederationRule object` Authorization rule binding an external OIDC identity to Anthropic.
from line 1086
If set, this rule is archived and rejects token exchange. + format: date-time + - `archived_by_actor_id: string or null` Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
from line 1100
When this rule was created. + format: date-time + - `created_by_actor_id: string or null` Tagged ID (`user_`/`svac_`) of the actor that created this rule.
from line 1118
Issuer's display name at read time. - - `match: object { audience, claims, condition, subject_prefix }` + - `match: object` Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
from line 1126
Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default. + maxLength: 1024 + - `claims: optional map[string] or null` Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 1136
CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400. + maxLength: 4096 + - `subject_prefix: optional string or null` Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`. + maxLength: 1024 + - `name: string` Admin-chosen slug identifier.
from line 1152
Space-separated OAuth scopes granted on the minted token. - - `target: object { service_account_id, type, service_account_name }` + - `target: object` Identity that tokens minted via this rule act as. Currently always a `service_account` target.
from line 1162
- `type: "service_account"` - - `"service_account"` - - `service_account_name: optional string or null` Service account's display name at read time. Ignored on writes.
from line 1172
- `type: "federation_rule"` - - `"federation_rule"` + default: federation_rule - `updated_at: string` When this rule was last updated. + format: date-time + - `updated_by_actor_id: string or null` Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
from line 1194
### Example -```http +```bash curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/archive \ -X POST \ -H 'anthropic-version: 2023-06-01' \
from line 1201
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" ``` -#### Response +#### Response (200) ```json {
from line 1243
} ``` -## Domain Types +## Domain types ### Federation Rule -- `FederationRule object { id, applies_to_all_workspaces, archived_at, 17 more }` +- `FederationRule object` Authorization rule binding an external OIDC identity to Anthropic.
from line 1272
If set, this rule is archived and rejects token exchange. + format: date-time + - `archived_by_actor_id: string or null` Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
from line 1286
When this rule was created. + format: date-time + - `created_by_actor_id: string or null` Tagged ID (`user_`/`svac_`) of the actor that created this rule.
from line 1304
Issuer's display name at read time. - - `match: object { audience, claims, condition, subject_prefix }` + - `match: object` Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
from line 1312
Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default. + maxLength: 1024 + - `claims: optional map[string] or null` Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 1322
CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400. + maxLength: 4096 + - `subject_prefix: optional string or null` Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`. + maxLength: 1024 + - `name: string` Admin-chosen slug identifier.
from line 1338
Space-separated OAuth scopes granted on the minted token. - - `target: object { service_account_id, type, service_account_name }` + - `target: object` Identity that tokens minted via this rule act as. Currently always a `service_account` target.
from line 1348
- `type: "service_account"` - - `"service_account"` - - `service_account_name: optional string or null` Service account's display name at read time. Ignored on writes.
from line 1358
- `type: "federation_rule"` - - `"federation_rule"` + default: federation_rule - `updated_at: string` When this rule was last updated. + format: date-time + - `updated_by_actor_id: string or null` Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
from line 1378
Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty). -# Workspaces +## Federation Rules › Workspaces -## List Federation Rule Workspaces +### List Federation Rule Workspaces -**get** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces` +**GET** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces` List workspaces where this federation rule is enabled.
from line 1392
rules with `applies_to_all_workspaces` or a legacy single `workspace_id`, check those fields on the rule itself. -### Path Parameters +#### Path parameters - `federation_rule_id: string` ID of the federation rule. -### Query Parameters +#### Query parameters - `limit: optional number` Number of results per page. + default: 20, maximum: 100, minimum: 1 + - `page: optional string` Opaque cursor from a previous response's `next_page`. -### Header Parameters +#### Headers - `"anthropic-beta": optional array of string`
from line 1418
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta. -### Returns +#### Returns -- `data: array of object { created_at, created_by_actor_id, federation_rule_id, 3 more }` +- `data: array of object` - `created_at: string` When this workspace was enabled for the rule. + format: date-time + - `created_by_actor_id: string or null` Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.
from line 1438
- `type: "federation_rule_workspace"` - - `"federation_rule_workspace"` + default: federation_rule_workspace - `workspace_id: string`
from line 1452
Opaque cursor for the next page; null when there are no more results. -### Example +#### Example -```http +```bash curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \ -H 'anthropic-version: 2023-06-01' \ -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" ``` -#### Response +##### Response (200) ```json {
from line 1478
} ``` -## Add Federation Rule Workspace +### Add Federation Rule Workspace -**post** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces` +**POST** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces` Enable a federation rule for a workspace.
from line 1493
`oauth_scope` is `workspace:developer` or `workspace:inference`; other scopes require a Console session. Admin API keys are not accepted. -### Path Parameters +#### Path parameters - `federation_rule_id: string` ID of the federation rule. -### Header Parameters +#### Headers - `"anthropic-beta": optional array of string`
from line 1507
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta. -### Body Parameters +#### Body parameters - `workspace_id: string` Tagged ID of the workspace to enable this rule for. -### Returns +#### Returns - `created_at: string` When this workspace was enabled for the rule. + format: date-time + - `created_by_actor_id: string or null` Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.
from line 1531
- `type: "federation_rule_workspace"` - - `"federation_rule_workspace"` + default: federation_rule_workspace - `workspace_id: string`
from line 1541
Workspace display name. Populated when listing; null in the enable response. -### Example +#### Example -```http +```bash curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \ -H 'Content-Type: application/json' \ -H 'anthropic-version: 2023-06-01' \
from line 1553
}' ``` -#### Response +##### Response (200) ```json {
from line 1566
} ``` -## Remove Federation Rule Workspace +### Remove Federation Rule Workspace -**delete** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}` +**DELETE** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}` Disable a federation rule for a workspace.
from line 1577
`workspace:developer` or `workspace:inference`; other scopes require a Console session. Admin API keys are not accepted. -### Path Parameters +#### Path parameters - `federation_rule_id: string`
from line 1587
ID of the workspace to disable for. -### Header Parameters +#### Headers - `"anthropic-beta": optional array of string`
from line 1595
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta. -### Returns +#### Returns - `federation_rule_id: string`
from line 1603
- `type: "federation_rule_workspace_deleted"` - - `"federation_rule_workspace_deleted"` + default: federation_rule_workspace_deleted - `workspace_id: string` Tagged ID of the workspace named in the delete request. Removal is idempotent. -### Example +#### Example -```http +```bash curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces/$WORKSPACE_ID \ -X DELETE \ -H 'anthropic-version: 2023-06-01' \
from line 1618
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" ``` -#### Response +##### Response (200) ```json {
from line 1627
"workspace_id": "workspace_id" } ``` - -## Domain Types - -### Workspace List Response - -- `WorkspaceListResponse object { created_at, created_by_actor_id, federation_rule_id, 3 more }` - - - `created_at: string` - - When this workspace was enabled for the rule. - - - `created_by_actor_id: string or null` - - Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known. - - - `federation_rule_id: string` - - Tagged ID of the federation rule. - - - `type: "federation_rule_workspace"` - - - `"federation_rule_workspace"` - - - `workspace_id: string` - - Tagged ID of the workspace this rule is enabled for. - - - `workspace_name: string or null` - - Workspace display name. Populated when listing; null in the enable response. - -### Workspace Create Response - -- `WorkspaceCreateResponse object { created_at, created_by_actor_id, federation_rule_id, 3 more }` - - - `created_at: string` - - When this workspace was enabled for the rule. - - - `created_by_actor_id: string or null` - - Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known. - - - `federation_rule_id: string` - - Tagged ID of the federation rule. - - - `type: "federation_rule_workspace"` - - - `"federation_rule_workspace"` - - - `workspace_id: string` - - Tagged ID of the workspace this rule is enabled for. - - - `workspace_name: string or null` - - Workspace display name. Populated when listing; null in the enable response. - -### Workspace Delete Response - -- `WorkspaceDeleteResponse object { federation_rule_id, type, workspace_id }` - - - `federation_rule_id: string` - - Tagged ID of the federation rule. - - - `type: "federation_rule_workspace_deleted"` - - - `"federation_rule_workspace_deleted"` - - - `workspace_id: string` - - Tagged ID of the workspace named in the delete request. Removal is idempotent.
api/admin/federation_rules First recorded · 1614 lines, first recorded
# Federation Rules ## Create Federation Rule ### Header Parameters ### Body Parameters ### Returns ### Example #### Response ## Get Federation Rule ### Path Parameters ### Header Parameters ### Returns ### Example #### Response ## List Federation Rules ### Query Parameters ### Header Parameters ### Returns ### Example #### Response ## Update Federation Rule ### Path Parameters ### Header Parameters ### Body Parameters ### Returns ### Example #### Response ## Archive Federation Rule ### Path Parameters ### Header Parameters ### Returns ### Example #### Response ## Domain Types ### Federation Rule # Workspaces ## List Federation Rule Workspaces ### Path Parameters ### Query Parameters ### Header Parameters ### Returns ### Example #### Response ## Add Federation Rule Workspace ### Path Parameters ### Header Parameters ### Body Parameters ### Returns ### Example #### Response ## Remove Federation Rule Workspace ### Path Parameters ### Header Parameters ### Returns ### Example #### Response ## Domain Types ### Workspace List Response ### Workspace Create Response ### Workspace Delete Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Federation Rules
url: https://platform.claude.com/docs/en/api/admin/federation_rules
---
# Federation Rules
## Create Federation Rule
**post** `/v1/organizations/federation_rules`
Create a federation rule owned by your organization.
The referenced issuer and the target service account must already exist
in the same organization; invalid references are rejected with a 400
error. The workspace reference is validated. Membership is not checked
at rule creation: token exchange resolves a single enabled workspace per
call and is rejected unless the target service account is a member of
that workspace (it is implicitly a member of the default workspace).
Rules on well-known shared issuers (GitHub Actions, GitLab, Buildkite,
Terraform Cloud, Google) must constrain tenant identity via an
identity-bearing claim, a tenant-pinning subject prefix (such as
`repo:YOUR_ORG/...`), or a CEL condition referencing one of those
identity claims (e.g. `claims.repository_owner`). OAuth callers may only
manage rules whose `oauth_scope` is `workspace:developer` or
`workspace:inference`; other scopes require a Console session. Admin API
keys are not accepted.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Body Parameters
- `issuer_id: string`
Tagged ID of the federation issuer.
- `match: object { audience, claims, condition, subject_prefix }`
Conditions the verified JWT must satisfy for this rule to apply. At least one of `subject_prefix` (other than a wildcard-only value like `*`), `claims`, or `condition` is required; `audience` alone is not sufficient.
- `audience: optional string or null`
Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
- `claims: optional map[string] or null`
Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
- `condition: optional string or null`
CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
- `subject_prefix: optional string or null`
Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
- `name: string`
Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
- `oauth_scope: string`
Space-separated OAuth scopes. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session.
- `target: object { service_account_id, type, service_account_name }`
Identity that tokens minted via this rule act as. Currently always a `service_account` target.
- `service_account_id: string`
Tagged ID of the service account to mint tokens for.
- `type: "service_account"`
- `"service_account"`
- `service_account_name: optional string or null`
Service account's display name at read time. Ignored on writes.
- `applies_to_all_workspaces: optional boolean`
When true, enable this rule for every workspace in the org (including workspaces created later).
- `attributes: optional map[string] or null`
CEL expressions `{name: expr}` extracting named values from claims. Not yet supported; any non-empty value is rejected with 400.
- `description: optional string or null`
Optional free-text description.
- `token_lifetime_seconds: optional number`
Lifetime in seconds for access tokens minted via this rule (60-86400). Defaults to 3600 (1h). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.
- `workspace_id: optional string or null`
Tagged ID of the workspace to enable this rule for. Required unless `applies_to_all_workspaces` is true. Additional workspaces can be added via the `/federation_rules/{federation_rule_id}/workspaces` sub-resource.
### Returns
- `FederationRule object { id, applies_to_all_workspaces, archived_at, 17 more }`
Authorization rule binding an external OIDC identity to Anthropic.
Evaluates the match conditions and mints an OAuth access token for the
resolved target, scoped to a single workspace where the rule is enabled
(chosen by the caller at exchange time when the rule is enabled for more
than one). For rules enabled via `workspace_ids` or
`applies_to_all_workspaces`, the target service account must be a member
of that workspace (it is implicitly a member of the default workspace);
rules carrying only the legacy `workspace_id` binding do not enforce
this.
- `id: string`
Tagged ID of the federation rule.
- `applies_to_all_workspaces: boolean`
When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.
- `archived_at: string or null`
If set, this rule is archived and rejects token exchange.
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
- `attributes: map[string] or null`
CEL expressions extracting named values from claims. Not yet supported; always null.
- `created_at: string`
When this rule was created.
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this rule.
- `description: string or null`
Optional free-text description.
- `issuer_id: string`
Tagged ID of the issuer whose tokens this rule accepts.
- `issuer_name: string or null`
Issuer's display name at read time.
- `match: object { audience, claims, condition, subject_prefix }`
Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
- `audience: optional string or null`
Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
- `claims: optional map[string] or null`
Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
- `condition: optional string or null`
CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
- `subject_prefix: optional string or null`
Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
- `name: string`
Admin-chosen slug identifier.
- `oauth_scope: string`
Space-separated OAuth scopes granted on the minted token.
- `target: object { service_account_id, type, service_account_name }`
Identity that tokens minted via this rule act as. Currently always a `service_account` target.
- `service_account_id: string`
Tagged ID of the service account to mint tokens for.
- `type: "service_account"`
- `"service_account"`
- `service_account_name: optional string or null`
Service account's display name at read time. Ignored on writes.
- `token_lifetime_seconds: number`
Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.
- `type: "federation_rule"`
- `"federation_rule"`
- `updated_at: string`
When this rule was last updated.
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
- `workspace_id: string or null`
Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement.
- `workspace_ids: array of string`
Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).
### Example
```http
curl https://api.anthropic.com/v1/organizations/federation_rules \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
-d '{
"issuer_id": "issuer_id",
"match": {},
"name": "x",
"oauth_scope": "x",
"target": {
"service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
"type": "service_account"
}
}'
```
#### Response
```json
{
"id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
"applies_to_all_workspaces": true,
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"attributes": {
"foo": "string"
},
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"description": "description",
"issuer_id": "issuer_id",
"issuer_name": "issuer_name",
"match": {
"audience": "audience",
"claims": {
"foo": "string"
},
"condition": "condition",
"subject_prefix": "subject_prefix"
},
"name": "prod-deploy-pipeline",
"oauth_scope": "oauth_scope",
"target": {
"service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
"type": "service_account",
"service_account_name": "service_account_name"
},
"token_lifetime_seconds": 0,
"type": "federation_rule",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id",
"workspace_id": "workspace_id",
"workspace_ids": [
"string"
]
}
```
## Get Federation Rule
**get** `/v1/organizations/federation_rules/{federation_rule_id}`
Retrieve a federation rule by its ID (`fdrl_...`).
### Path Parameters
- `federation_rule_id: string`
Cut at 300 lines.