One read of Claude Developer Platformapi-20260814T043121Z
565 pages moved out of 565 read.
Pages moved
565
significant first
Pages read
565
in this capture
Captured
04:31 UTC
Corpus hash
764ab7e8e96e
full baseline · corpus-hash
What this read moved
101-125 of 565, page 5 of 23This capture is too large to show at once. Changes 101-125 of 565 are below, significant first; the rest are on the following screens.
api/admin/federation_rules/retrieve First recorded · 197 lines, first recorded
## Get Federation Rule ### Path Parameters ### Header Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Get Federation Rule
url: https://platform.claude.com/docs/en/api/admin/federation_rules/retrieve
---
## Get Federation Rule
**get** `/v1/organizations/federation_rules/{federation_rule_id}`
Retrieve a federation rule by its ID (`fdrl_...`).
### Path Parameters
- `federation_rule_id: string`
ID of the federation rule.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Returns
- `FederationRule object { id, applies_to_all_workspaces, archived_at, 17 more }`
Authorization rule binding an external OIDC identity to Anthropic.
Evaluates the match conditions and mints an OAuth access token for the
resolved target, scoped to a single workspace where the rule is enabled
(chosen by the caller at exchange time when the rule is enabled for more
than one). For rules enabled via `workspace_ids` or
`applies_to_all_workspaces`, the target service account must be a member
of that workspace (it is implicitly a member of the default workspace);
rules carrying only the legacy `workspace_id` binding do not enforce
this.
- `id: string`
Tagged ID of the federation rule.
- `applies_to_all_workspaces: boolean`
When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.
- `archived_at: string or null`
If set, this rule is archived and rejects token exchange.
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
- `attributes: map[string] or null`
CEL expressions extracting named values from claims. Not yet supported; always null.
- `created_at: string`
When this rule was created.
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this rule.
- `description: string or null`
Optional free-text description.
- `issuer_id: string`
Tagged ID of the issuer whose tokens this rule accepts.
- `issuer_name: string or null`
Issuer's display name at read time.
- `match: object { audience, claims, condition, subject_prefix }`
Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
- `audience: optional string or null`
Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
- `claims: optional map[string] or null`
Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
- `condition: optional string or null`
CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
- `subject_prefix: optional string or null`
Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
- `name: string`
Admin-chosen slug identifier.
- `oauth_scope: string`
Space-separated OAuth scopes granted on the minted token.
- `target: object { service_account_id, type, service_account_name }`
Identity that tokens minted via this rule act as. Currently always a `service_account` target.
- `service_account_id: string`
Tagged ID of the service account to mint tokens for.
- `type: "service_account"`
- `"service_account"`
- `service_account_name: optional string or null`
Service account's display name at read time. Ignored on writes.
- `token_lifetime_seconds: number`
Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.
- `type: "federation_rule"`
- `"federation_rule"`
- `updated_at: string`
When this rule was last updated.
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
- `workspace_id: string or null`
Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement.
- `workspace_ids: array of string`
Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).
### Example
```http
curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
"applies_to_all_workspaces": true,
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"attributes": {
"foo": "string"
},
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"description": "description",
"issuer_id": "issuer_id",
"issuer_name": "issuer_name",
"match": {
"audience": "audience",
"claims": {
"foo": "string"
},
"condition": "condition",
"subject_prefix": "subject_prefix"
},
"name": "prod-deploy-pipeline",
"oauth_scope": "oauth_scope",
"target": {
"service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
"type": "service_account",
"service_account_name": "service_account_name"
},
"token_lifetime_seconds": 0,
"type": "federation_rule",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id",
"workspace_id": "workspace_id",
"workspace_ids": [
"string"
]
}
```
api/admin/federation_rules/update First recorded · 285 lines, first recorded
## Update Federation Rule ### Path Parameters ### Header Parameters ### Body Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Update Federation Rule
url: https://platform.claude.com/docs/en/api/admin/federation_rules/update
---
## Update Federation Rule
**post** `/v1/organizations/federation_rules/{federation_rule_id}`
Partially update a federation rule.
`issuer_id` is immutable. `match` and `target` are replaced as whole
objects when set. Referenced service accounts and workspaces must exist
in your organization; invalid references are rejected with a 400 error.
Archived rules cannot be updated; this returns 400. Create a new rule
instead. Rules on well-known shared issuers (GitHub Actions, GitLab,
Buildkite, Terraform Cloud, Google) must constrain tenant identity via
an identity-bearing claim, a tenant-pinning subject prefix (such as
`repo:YOUR_ORG/...`), or a CEL condition referencing one of those
identity claims (e.g. `claims.repository_owner`). On these issuers the
requirement is re-checked on every update; if an existing rule's stored
match does not yet constrain tenant identity, any update (even a rename
or description change) must also supply a conforming `match` in the same
request. OAuth callers may only manage rules whose `oauth_scope` is
`workspace:developer` or `workspace:inference`; other scopes require a
Console session. Admin API keys are not accepted.
### Path Parameters
- `federation_rule_id: string`
ID of the federation rule to update.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Body Parameters
- `applies_to_all_workspaces: optional boolean or null`
When true, enables this rule for every workspace in the org (including workspaces created later). Setting `false` is rejected with 400 if no workspace would remain enabled; a rule with only a legacy `workspace_id` binding continues to mint.
- `attributes: optional map[string] or null`
Replaces the CEL expressions `{name: expr}` extracting named values from claims. Send null to clear them. Not yet supported; any non-empty value is rejected with 400.
- `description: optional string or null`
Replaces the description. Omit to leave unchanged; send `null` to clear (the field is stored as an empty string).
- `match: optional object { audience, claims, condition, subject_prefix } or null`
Does the incoming JWT qualify?
All populated fields must pass; omitted fields are skipped. At least one
of `subject_prefix` (other than a wildcard-only value like `*`), `claims`,
or `condition` is required; `audience` alone is not sufficient.
- `audience: optional string or null`
Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
- `claims: optional map[string] or null`
Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
- `condition: optional string or null`
CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
- `subject_prefix: optional string or null`
Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
- `name: optional string or null`
Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
- `oauth_scope: optional string or null`
Replaces the space-separated OAuth scopes granted on minted tokens. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session.
- `target: optional object { service_account_id, type, service_account_name } or null`
Bind to a fixed service account by ID.
- `service_account_id: string`
Tagged ID of the service account to mint tokens for.
- `type: "service_account"`
- `"service_account"`
- `service_account_name: optional string or null`
Service account's display name at read time. Ignored on writes.
- `token_lifetime_seconds: optional number or null`
Replaces the lifetime in seconds for access tokens minted via this rule (60-86400). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.
- `workspace_id: optional string or null`
Replaces the existing single workspace enablement (the previous one is removed). Rejected with 400 if the rule is enabled for more than one workspace; use the `/federation_rules/{federation_rule_id}/workspaces` sub-resource instead.
### Returns
- `FederationRule object { id, applies_to_all_workspaces, archived_at, 17 more }`
Authorization rule binding an external OIDC identity to Anthropic.
Evaluates the match conditions and mints an OAuth access token for the
resolved target, scoped to a single workspace where the rule is enabled
(chosen by the caller at exchange time when the rule is enabled for more
than one). For rules enabled via `workspace_ids` or
`applies_to_all_workspaces`, the target service account must be a member
of that workspace (it is implicitly a member of the default workspace);
rules carrying only the legacy `workspace_id` binding do not enforce
this.
- `id: string`
Tagged ID of the federation rule.
- `applies_to_all_workspaces: boolean`
When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.
- `archived_at: string or null`
If set, this rule is archived and rejects token exchange.
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
- `attributes: map[string] or null`
CEL expressions extracting named values from claims. Not yet supported; always null.
- `created_at: string`
When this rule was created.
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this rule.
- `description: string or null`
Optional free-text description.
- `issuer_id: string`
Tagged ID of the issuer whose tokens this rule accepts.
- `issuer_name: string or null`
Issuer's display name at read time.
- `match: object { audience, claims, condition, subject_prefix }`
Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
- `audience: optional string or null`
Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
- `claims: optional map[string] or null`
Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
- `condition: optional string or null`
CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
- `subject_prefix: optional string or null`
Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
- `name: string`
Admin-chosen slug identifier.
- `oauth_scope: string`
Space-separated OAuth scopes granted on the minted token.
- `target: object { service_account_id, type, service_account_name }`
Identity that tokens minted via this rule act as. Currently always a `service_account` target.
- `service_account_id: string`
Tagged ID of the service account to mint tokens for.
- `type: "service_account"`
- `"service_account"`
- `service_account_name: optional string or null`
Service account's display name at read time. Ignored on writes.
- `token_lifetime_seconds: number`
Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.
- `type: "federation_rule"`
- `"federation_rule"`
- `updated_at: string`
When this rule was last updated.
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
- `workspace_id: string or null`
Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement.
- `workspace_ids: array of string`
Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).
### Example
```http
curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
-d '{}'
```
#### Response
```json
{
"id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
"applies_to_all_workspaces": true,
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"attributes": {
"foo": "string"
},
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"description": "description",
"issuer_id": "issuer_id",
"issuer_name": "issuer_name",
"match": {
"audience": "audience",
"claims": {
"foo": "string"
},
"condition": "condition",
"subject_prefix": "subject_prefix"
},
"name": "prod-deploy-pipeline",
"oauth_scope": "oauth_scope",
"target": {
"service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
"type": "service_account",
"service_account_name": "service_account_name"
},
"token_lifetime_seconds": 0,
"type": "federation_rule",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id",
"workspace_id": "workspace_id",
"workspace_ids": [
"string"
]
}
```
api/admin/federation_rules/workspaces First recorded · 322 lines, first recorded
# Workspaces ## List Federation Rule Workspaces ### Path Parameters ### Query Parameters ### Header Parameters ### Returns ### Example #### Response ## Add Federation Rule Workspace ### Path Parameters ### Header Parameters ### Body Parameters ### Returns ### Example #### Response ## Remove Federation Rule Workspace ### Path Parameters ### Header Parameters ### Returns ### Example #### Response ## Domain Types ### Workspace List Response ### Workspace Create Response ### Workspace Delete Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Workspaces
url: https://platform.claude.com/docs/en/api/admin/federation_rules/workspaces
---
# Workspaces
## List Federation Rule Workspaces
**get** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
List workspaces where this federation rule is enabled.
Returns all workspace enablements in a single response; the `limit` and
`page` parameters are accepted but have no effect, and `next_page` is
always `null`. Returns explicit per-workspace enablements only; for
rules with `applies_to_all_workspaces` or a legacy single
`workspace_id`, check those fields on the rule itself.
### Path Parameters
- `federation_rule_id: string`
ID of the federation rule.
### Query Parameters
- `limit: optional number`
Number of results per page.
- `page: optional string`
Opaque cursor from a previous response's `next_page`.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Returns
- `data: array of object { created_at, created_by_actor_id, federation_rule_id, 3 more }`
- `created_at: string`
When this workspace was enabled for the rule.
- `created_by_actor_id: string or null`
Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.
- `federation_rule_id: string`
Tagged ID of the federation rule.
- `type: "federation_rule_workspace"`
- `"federation_rule_workspace"`
- `workspace_id: string`
Tagged ID of the workspace this rule is enabled for.
- `workspace_name: string or null`
Workspace display name. Populated when listing; null in the enable response.
- `next_page: string or null`
Opaque cursor for the next page; null when there are no more results.
### Example
```http
curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"data": [
{
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"federation_rule_id": "federation_rule_id",
"type": "federation_rule_workspace",
"workspace_id": "workspace_id",
"workspace_name": "workspace_name"
}
],
"next_page": "next_page"
}
```
## Add Federation Rule Workspace
**post** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
Enable a federation rule for a workspace.
Idempotent; re-enabling returns the existing enablement. The rule and
workspace must both belong to your organization. Membership of the
rule's target service account in this workspace is not checked at
enablement: token exchange into this workspace is rejected unless the
target is a member (it is implicitly a member of the default workspace).
Archived rules are rejected with 400. OAuth callers may only manage rules whose
`oauth_scope` is `workspace:developer` or `workspace:inference`; other
scopes require a Console session. Admin API keys are not accepted.
### Path Parameters
- `federation_rule_id: string`
ID of the federation rule.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Body Parameters
- `workspace_id: string`
Tagged ID of the workspace to enable this rule for.
### Returns
- `created_at: string`
When this workspace was enabled for the rule.
- `created_by_actor_id: string or null`
Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.
- `federation_rule_id: string`
Tagged ID of the federation rule.
- `type: "federation_rule_workspace"`
- `"federation_rule_workspace"`
- `workspace_id: string`
Tagged ID of the workspace this rule is enabled for.
- `workspace_name: string or null`
Workspace display name. Populated when listing; null in the enable response.
### Example
```http
curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
-d '{
"workspace_id": "workspace_id"
}'
```
#### Response
```json
{
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"federation_rule_id": "federation_rule_id",
"type": "federation_rule_workspace",
"workspace_id": "workspace_id",
"workspace_name": "workspace_name"
}
```
## Remove Federation Rule Workspace
**delete** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}`
Disable a federation rule for a workspace.
Idempotent; succeeds even if the enablement was already removed. OAuth
callers may only manage rules whose `oauth_scope` is
`workspace:developer` or `workspace:inference`; other scopes require a
Console session. Admin API keys are not accepted.
### Path Parameters
- `federation_rule_id: string`
ID of the federation rule.
- `workspace_id: string`
ID of the workspace to disable for.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Returns
- `federation_rule_id: string`
Tagged ID of the federation rule.
- `type: "federation_rule_workspace_deleted"`
- `"federation_rule_workspace_deleted"`
- `workspace_id: string`
Tagged ID of the workspace named in the delete request. Removal is idempotent.
### Example
```http
curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces/$WORKSPACE_ID \
-X DELETE \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"federation_rule_id": "federation_rule_id",
"type": "federation_rule_workspace_deleted",
"workspace_id": "workspace_id"
}
```
## Domain Types
### Workspace List Response
- `WorkspaceListResponse object { created_at, created_by_actor_id, federation_rule_id, 3 more }`
- `created_at: string`
When this workspace was enabled for the rule.
- `created_by_actor_id: string or null`
Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.
- `federation_rule_id: string`
Tagged ID of the federation rule.
- `type: "federation_rule_workspace"`
- `"federation_rule_workspace"`
- `workspace_id: string`
Tagged ID of the workspace this rule is enabled for.
- `workspace_name: string or null`
Workspace display name. Populated when listing; null in the enable response.
### Workspace Create Response
- `WorkspaceCreateResponse object { created_at, created_by_actor_id, federation_rule_id, 3 more }`
- `created_at: string`
When this workspace was enabled for the rule.
- `created_by_actor_id: string or null`
Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.
- `federation_rule_id: string`
Tagged ID of the federation rule.
- `type: "federation_rule_workspace"`
- `"federation_rule_workspace"`
- `workspace_id: string`
Cut at 300 lines. The page has the rest.
api/admin/federation_rules/workspaces/create First recorded · 90 lines, first recorded
## Add Federation Rule Workspace ### Path Parameters ### Header Parameters ### Body Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Add Federation Rule Workspace
url: https://platform.claude.com/docs/en/api/admin/federation_rules/workspaces/create
---
## Add Federation Rule Workspace
**post** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
Enable a federation rule for a workspace.
Idempotent; re-enabling returns the existing enablement. The rule and
workspace must both belong to your organization. Membership of the
rule's target service account in this workspace is not checked at
enablement: token exchange into this workspace is rejected unless the
target is a member (it is implicitly a member of the default workspace).
Archived rules are rejected with 400. OAuth callers may only manage rules whose
`oauth_scope` is `workspace:developer` or `workspace:inference`; other
scopes require a Console session. Admin API keys are not accepted.
### Path Parameters
- `federation_rule_id: string`
ID of the federation rule.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Body Parameters
- `workspace_id: string`
Tagged ID of the workspace to enable this rule for.
### Returns
- `created_at: string`
When this workspace was enabled for the rule.
- `created_by_actor_id: string or null`
Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.
- `federation_rule_id: string`
Tagged ID of the federation rule.
- `type: "federation_rule_workspace"`
- `"federation_rule_workspace"`
- `workspace_id: string`
Tagged ID of the workspace this rule is enabled for.
- `workspace_name: string or null`
Workspace display name. Populated when listing; null in the enable response.
### Example
```http
curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
-d '{
"workspace_id": "workspace_id"
}'
```
#### Response
```json
{
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"federation_rule_id": "federation_rule_id",
"type": "federation_rule_workspace",
"workspace_id": "workspace_id",
"workspace_name": "workspace_name"
}
```
api/admin/federation_rules/workspaces/delete First recorded · 66 lines, first recorded
## Remove Federation Rule Workspace ### Path Parameters ### Header Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Remove Federation Rule Workspace
url: https://platform.claude.com/docs/en/api/admin/federation_rules/workspaces/delete
---
## Remove Federation Rule Workspace
**delete** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}`
Disable a federation rule for a workspace.
Idempotent; succeeds even if the enablement was already removed. OAuth
callers may only manage rules whose `oauth_scope` is
`workspace:developer` or `workspace:inference`; other scopes require a
Console session. Admin API keys are not accepted.
### Path Parameters
- `federation_rule_id: string`
ID of the federation rule.
- `workspace_id: string`
ID of the workspace to disable for.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Returns
- `federation_rule_id: string`
Tagged ID of the federation rule.
- `type: "federation_rule_workspace_deleted"`
- `"federation_rule_workspace_deleted"`
- `workspace_id: string`
Tagged ID of the workspace named in the delete request. Removal is idempotent.
### Example
```http
curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces/$WORKSPACE_ID \
-X DELETE \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"federation_rule_id": "federation_rule_id",
"type": "federation_rule_workspace_deleted",
"workspace_id": "workspace_id"
}
```
api/admin/federation_rules/workspaces/list First recorded · 98 lines, first recorded
## List Federation Rule Workspaces ### Path Parameters ### Query Parameters ### Header Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: List Federation Rule Workspaces
url: https://platform.claude.com/docs/en/api/admin/federation_rules/workspaces/list
---
## List Federation Rule Workspaces
**get** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
List workspaces where this federation rule is enabled.
Returns all workspace enablements in a single response; the `limit` and
`page` parameters are accepted but have no effect, and `next_page` is
always `null`. Returns explicit per-workspace enablements only; for
rules with `applies_to_all_workspaces` or a legacy single
`workspace_id`, check those fields on the rule itself.
### Path Parameters
- `federation_rule_id: string`
ID of the federation rule.
### Query Parameters
- `limit: optional number`
Number of results per page.
- `page: optional string`
Opaque cursor from a previous response's `next_page`.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Returns
- `data: array of object { created_at, created_by_actor_id, federation_rule_id, 3 more }`
- `created_at: string`
When this workspace was enabled for the rule.
- `created_by_actor_id: string or null`
Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.
- `federation_rule_id: string`
Tagged ID of the federation rule.
- `type: "federation_rule_workspace"`
- `"federation_rule_workspace"`
- `workspace_id: string`
Tagged ID of the workspace this rule is enabled for.
- `workspace_name: string or null`
Workspace display name. Populated when listing; null in the enable response.
- `next_page: string or null`
Opaque cursor for the next page; null when there are no more results.
### Example
```http
curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"data": [
{
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"federation_rule_id": "federation_rule_id",
"type": "federation_rule_workspace",
"workspace_id": "workspace_id",
"workspace_name": "workspace_name"
}
],
"next_page": "next_page"
}
```
api/admin/invites First recorded · 538 lines, first recorded
# Invites ## Create Invite ### Body Parameters ### Returns ### Example #### Response ## Get Invite ### Path Parameters ### Returns ### Example #### Response ## List Invites ### Query Parameters ### Returns ### Example #### Response ## Delete Invite ### Path Parameters ### Returns ### Example #### Response ## Domain Types ### Invite ### Invite Delete Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Invites
url: https://platform.claude.com/docs/en/api/admin/invites
---
# Invites
## Create Invite
**post** `/v1/organizations/invites`
For Claude Enterprise organizations, this endpoint's availability is in beta.
On plans that draw members from a finite pool of purchased seats, the invite automatically consumes a seat from the lowest tier with availability; there is no seat-tier parameter. When no seat is free the request fails with a 400 error rather than purchasing a seat.
### Body Parameters
- `email: string`
Email of the User.
- `role: "billing" or "claude_code_user" or "developer" or 2 more`
Role for the invited User.
The accepted values depend on the organization type. Console and API organizations accept `user`, `developer`, `billing`, and `claude_code_user`; `admin` cannot be assigned through the API. Claude Enterprise organizations (beta) accept `user` and `managed`.
- `"billing"`
- `"claude_code_user"`
- `"developer"`
- `"managed"`
- `"user"`
- `rbac_group_ids: optional array of string`
RBAC group IDs to assign to the User when the Invite is accepted. A non-empty array is accepted only for a Claude Enterprise organization with RBAC groups (beta), and requires the key to carry the `write:rbac_groups` scope.
### Returns
- `Invite object { id, accepted_at, email, 6 more }`
- `id: string`
ID of the Invite.
- `accepted_at: string or null`
RFC 3339 datetime string indicating when the Invite was accepted, or null.
- `email: string`
Email of the User being invited.
- `expires_at: string`
RFC 3339 datetime string indicating when the Invite expires.
- `invited_at: string`
RFC 3339 datetime string indicating when the Invite was created.
- `rbac_group_ids: array of string`
RBAC group IDs recorded on the Invite (beta, Claude Enterprise organizations), to be assigned to the User when the Invite is accepted. `[]` when none.
- `role: "admin" or "billing" or "claude_code_user" or 6 more`
Organization role of the User.
- `"admin"`
- `"billing"`
- `"claude_code_user"`
- `"developer"`
- `"managed"`
- `"membership_admin"`
- `"owner"`
- `"primary_owner"`
- `"user"`
- `status: "accepted" or "deleted" or "expired" or "pending"`
Status of the Invite.
- `"accepted"`
- `"deleted"`
- `"expired"`
- `"pending"`
- `type: "invite"`
Object type.
For Invites, this is always `"invite"`.
- `"invite"`
### Example
```http
curl https://api.anthropic.com/v1/organizations/invites \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
-d '{
"email": "[email protected]",
"role": "user"
}'
```
#### Response
```json
{
"id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu",
"accepted_at": "2019-12-27T18:11:19.117Z",
"email": "[email protected]",
"expires_at": "2024-11-20T23:58:27.427722Z",
"invited_at": "2024-10-30T23:58:27.427722Z",
"rbac_group_ids": [
"string"
],
"role": "user",
"status": "pending",
"type": "invite"
}
```
## Get Invite
**get** `/v1/organizations/invites/{invite_id}`
For Claude Enterprise organizations, this endpoint's availability is in beta.
### Path Parameters
- `invite_id: string`
ID of the Invite.
### Returns
- `Invite object { id, accepted_at, email, 6 more }`
- `id: string`
ID of the Invite.
- `accepted_at: string or null`
RFC 3339 datetime string indicating when the Invite was accepted, or null.
- `email: string`
Email of the User being invited.
- `expires_at: string`
RFC 3339 datetime string indicating when the Invite expires.
- `invited_at: string`
RFC 3339 datetime string indicating when the Invite was created.
- `rbac_group_ids: array of string`
RBAC group IDs recorded on the Invite (beta, Claude Enterprise organizations), to be assigned to the User when the Invite is accepted. `[]` when none.
- `role: "admin" or "billing" or "claude_code_user" or 6 more`
Organization role of the User.
- `"admin"`
- `"billing"`
- `"claude_code_user"`
- `"developer"`
- `"managed"`
- `"membership_admin"`
- `"owner"`
- `"primary_owner"`
- `"user"`
- `status: "accepted" or "deleted" or "expired" or "pending"`
Status of the Invite.
- `"accepted"`
- `"deleted"`
- `"expired"`
- `"pending"`
- `type: "invite"`
Object type.
For Invites, this is always `"invite"`.
- `"invite"`
### Example
```http
curl https://api.anthropic.com/v1/organizations/invites/$INVITE_ID \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu",
"accepted_at": "2019-12-27T18:11:19.117Z",
"email": "[email protected]",
"expires_at": "2024-11-20T23:58:27.427722Z",
"invited_at": "2024-10-30T23:58:27.427722Z",
"rbac_group_ids": [
"string"
],
"role": "user",
"status": "pending",
"type": "invite"
}
```
## List Invites
**get** `/v1/organizations/invites`
For Claude Enterprise organizations, this endpoint's availability is in beta.
### Query Parameters
- `after_id: optional string`
ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object.
- `before_id: optional string`
ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object.
- `email: optional string`
Filter by the email address the Invite was sent to. Matches the same way as the Users list's `email` filter (normalized, case-insensitive).
- `limit: optional number`
Number of items to return per page.
Defaults to `20`. Ranges from `1` to `1000`.
- `roles: optional array of string`
Filter to items whose `role` equals one of the supplied values. Repeatable; values are OR'ed together.
Accepted values depend on the organization type: Console and API organizations accept `user`, `developer`, `billing`, `admin`, and `claude_code_user`; Claude Enterprise organizations (beta) accept `user`, `owner`, `primary_owner`, `membership_admin`, and `managed`.
- `statuses: optional array of "accepted" or "expired" or "pending"`
Filter by Invite status. Repeatable; values are OR'ed together. Omit to return `pending`, `accepted`, and `expired` Invites alike.
- `"accepted"`
- `"expired"`
- `"pending"`
### Returns
- `data: array of Invite`
- `id: string`
ID of the Invite.
Cut at 300 lines. The page has the rest.
api/admin/invites/create First recorded · 139 lines, first recorded
## Create Invite ### Body Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Create Invite
url: https://platform.claude.com/docs/en/api/admin/invites/create
---
## Create Invite
**post** `/v1/organizations/invites`
For Claude Enterprise organizations, this endpoint's availability is in beta.
On plans that draw members from a finite pool of purchased seats, the invite automatically consumes a seat from the lowest tier with availability; there is no seat-tier parameter. When no seat is free the request fails with a 400 error rather than purchasing a seat.
### Body Parameters
- `email: string`
Email of the User.
- `role: "billing" or "claude_code_user" or "developer" or 2 more`
Role for the invited User.
The accepted values depend on the organization type. Console and API organizations accept `user`, `developer`, `billing`, and `claude_code_user`; `admin` cannot be assigned through the API. Claude Enterprise organizations (beta) accept `user` and `managed`.
- `"billing"`
- `"claude_code_user"`
- `"developer"`
- `"managed"`
- `"user"`
- `rbac_group_ids: optional array of string`
RBAC group IDs to assign to the User when the Invite is accepted. A non-empty array is accepted only for a Claude Enterprise organization with RBAC groups (beta), and requires the key to carry the `write:rbac_groups` scope.
### Returns
- `Invite object { id, accepted_at, email, 6 more }`
- `id: string`
ID of the Invite.
- `accepted_at: string or null`
RFC 3339 datetime string indicating when the Invite was accepted, or null.
- `email: string`
Email of the User being invited.
- `expires_at: string`
RFC 3339 datetime string indicating when the Invite expires.
- `invited_at: string`
RFC 3339 datetime string indicating when the Invite was created.
- `rbac_group_ids: array of string`
RBAC group IDs recorded on the Invite (beta, Claude Enterprise organizations), to be assigned to the User when the Invite is accepted. `[]` when none.
- `role: "admin" or "billing" or "claude_code_user" or 6 more`
Organization role of the User.
- `"admin"`
- `"billing"`
- `"claude_code_user"`
- `"developer"`
- `"managed"`
- `"membership_admin"`
- `"owner"`
- `"primary_owner"`
- `"user"`
- `status: "accepted" or "deleted" or "expired" or "pending"`
Status of the Invite.
- `"accepted"`
- `"deleted"`
- `"expired"`
- `"pending"`
- `type: "invite"`
Object type.
For Invites, this is always `"invite"`.
- `"invite"`
### Example
```http
curl https://api.anthropic.com/v1/organizations/invites \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
-d '{
"email": "[email protected]",
"role": "user"
}'
```
#### Response
```json
{
"id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu",
"accepted_at": "2019-12-27T18:11:19.117Z",
"email": "[email protected]",
"expires_at": "2024-11-20T23:58:27.427722Z",
"invited_at": "2024-10-30T23:58:27.427722Z",
"rbac_group_ids": [
"string"
],
"role": "user",
"status": "pending",
"type": "invite"
}
```
api/admin/invites/delete First recorded · 48 lines, first recorded
## Delete Invite ### Path Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Delete Invite
url: https://platform.claude.com/docs/en/api/admin/invites/delete
---
## Delete Invite
**delete** `/v1/organizations/invites/{invite_id}`
For Claude Enterprise organizations, this endpoint's availability is in beta.
### Path Parameters
- `invite_id: string`
ID of the Invite.
### Returns
- `id: string`
ID of the Invite.
- `type: "invite_deleted"`
Deleted object type.
For Invites, this is always `"invite_deleted"`.
- `"invite_deleted"`
### Example
```http
curl https://api.anthropic.com/v1/organizations/invites/$INVITE_ID \
-X DELETE \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu",
"type": "invite_deleted"
}
```
api/admin/invites/list First recorded · 161 lines, first recorded
## List Invites ### Query Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: List Invites
url: https://platform.claude.com/docs/en/api/admin/invites/list
---
## List Invites
**get** `/v1/organizations/invites`
For Claude Enterprise organizations, this endpoint's availability is in beta.
### Query Parameters
- `after_id: optional string`
ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object.
- `before_id: optional string`
ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object.
- `email: optional string`
Filter by the email address the Invite was sent to. Matches the same way as the Users list's `email` filter (normalized, case-insensitive).
- `limit: optional number`
Number of items to return per page.
Defaults to `20`. Ranges from `1` to `1000`.
- `roles: optional array of string`
Filter to items whose `role` equals one of the supplied values. Repeatable; values are OR'ed together.
Accepted values depend on the organization type: Console and API organizations accept `user`, `developer`, `billing`, `admin`, and `claude_code_user`; Claude Enterprise organizations (beta) accept `user`, `owner`, `primary_owner`, `membership_admin`, and `managed`.
- `statuses: optional array of "accepted" or "expired" or "pending"`
Filter by Invite status. Repeatable; values are OR'ed together. Omit to return `pending`, `accepted`, and `expired` Invites alike.
- `"accepted"`
- `"expired"`
- `"pending"`
### Returns
- `data: array of Invite`
- `id: string`
ID of the Invite.
- `accepted_at: string or null`
RFC 3339 datetime string indicating when the Invite was accepted, or null.
- `email: string`
Email of the User being invited.
- `expires_at: string`
RFC 3339 datetime string indicating when the Invite expires.
- `invited_at: string`
RFC 3339 datetime string indicating when the Invite was created.
- `rbac_group_ids: array of string`
RBAC group IDs recorded on the Invite (beta, Claude Enterprise organizations), to be assigned to the User when the Invite is accepted. `[]` when none.
- `role: "admin" or "billing" or "claude_code_user" or 6 more`
Organization role of the User.
- `"admin"`
- `"billing"`
- `"claude_code_user"`
- `"developer"`
- `"managed"`
- `"membership_admin"`
- `"owner"`
- `"primary_owner"`
- `"user"`
- `status: "accepted" or "deleted" or "expired" or "pending"`
Status of the Invite.
- `"accepted"`
- `"deleted"`
- `"expired"`
- `"pending"`
- `type: "invite"`
Object type.
For Invites, this is always `"invite"`.
- `"invite"`
- `first_id: string or null`
First ID in the `data` list. Can be used as the `before_id` for the previous page.
- `has_more: boolean`
Indicates if there are more results in the requested page direction.
- `last_id: string or null`
Last ID in the `data` list. Can be used as the `after_id` for the next page.
### Example
```http
curl https://api.anthropic.com/v1/organizations/invites \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"data": [
{
"id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu",
"accepted_at": "2019-12-27T18:11:19.117Z",
"email": "[email protected]",
"expires_at": "2024-11-20T23:58:27.427722Z",
"invited_at": "2024-10-30T23:58:27.427722Z",
"rbac_group_ids": [
"string"
],
"role": "user",
"status": "pending",
"type": "invite"
}
],
"first_id": "first_id",
"has_more": true,
"last_id": "last_id"
}
```
api/admin/invites/retrieve First recorded · 112 lines, first recorded
## Get Invite ### Path Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Get Invite
url: https://platform.claude.com/docs/en/api/admin/invites/retrieve
---
## Get Invite
**get** `/v1/organizations/invites/{invite_id}`
For Claude Enterprise organizations, this endpoint's availability is in beta.
### Path Parameters
- `invite_id: string`
ID of the Invite.
### Returns
- `Invite object { id, accepted_at, email, 6 more }`
- `id: string`
ID of the Invite.
- `accepted_at: string or null`
RFC 3339 datetime string indicating when the Invite was accepted, or null.
- `email: string`
Email of the User being invited.
- `expires_at: string`
RFC 3339 datetime string indicating when the Invite expires.
- `invited_at: string`
RFC 3339 datetime string indicating when the Invite was created.
- `rbac_group_ids: array of string`
RBAC group IDs recorded on the Invite (beta, Claude Enterprise organizations), to be assigned to the User when the Invite is accepted. `[]` when none.
- `role: "admin" or "billing" or "claude_code_user" or 6 more`
Organization role of the User.
- `"admin"`
- `"billing"`
- `"claude_code_user"`
- `"developer"`
- `"managed"`
- `"membership_admin"`
- `"owner"`
- `"primary_owner"`
- `"user"`
- `status: "accepted" or "deleted" or "expired" or "pending"`
Status of the Invite.
- `"accepted"`
- `"deleted"`
- `"expired"`
- `"pending"`
- `type: "invite"`
Object type.
For Invites, this is always `"invite"`.
- `"invite"`
### Example
```http
curl https://api.anthropic.com/v1/organizations/invites/$INVITE_ID \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu",
"accepted_at": "2019-12-27T18:11:19.117Z",
"email": "[email protected]",
"expires_at": "2024-11-20T23:58:27.427722Z",
"invited_at": "2024-10-30T23:58:27.427722Z",
"rbac_group_ids": [
"string"
],
"role": "user",
"status": "pending",
"type": "invite"
}
```
api/admin/mcp_tunnels First recorded · 1085 lines, first recorded
# MCP Tunnels ## Get Tunnel ### Path Parameters ### Header Parameters ### Returns ### Example #### Response ## List Tunnels ### Query Parameters ### Header Parameters ### Returns ### Example #### Response ## Reveal Tunnel Token ### Path Parameters ### Header Parameters ### Returns ### Example #### Response ## Rotate Tunnel Token ### Path Parameters ### Header Parameters ### Body Parameters ### Returns ### Example #### Response ## Archive Tunnel ### Path Parameters ### Header Parameters ### Returns ### Example #### Response ## Domain Types ### MCP Tunnel Retrieve Response ### MCP Tunnel List Response ### MCP Tunnel Reveal Token Response ### MCP Tunnel Rotate Token Response ### MCP Tunnel Archive Response # Tunnel Certificates ## Create Tunnel Certificate ### Path Parameters ### Header Parameters ### Body Parameters ### Returns ### Example #### Response ## Get Tunnel Certificate ### Path Parameters ### Header Parameters ### Returns ### Example #### Response ## List Tunnel Certificates ### Path Parameters ### Query Parameters ### Header Parameters ### Returns ### Example #### Response ## Archive Tunnel Certificate ### Path Parameters ### Header Parameters ### Returns ### Example #### Response ## Domain Types ### Tunnel Certificate Create Response ### Tunnel Certificate Retrieve Response ### Tunnel Certificate List Response ### Tunnel Certificate Archive Response
The first capture of this source. The page was already there, and this is what it said.
---
title: MCP Tunnels
url: https://platform.claude.com/docs/en/api/admin/mcp_tunnels
---
# MCP Tunnels
## Get Tunnel
**get** `/v1/organizations/tunnels/{tunnel_id}`
**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.
Retrieve a single tunnel in the caller's organization by ID.
### Path Parameters
- `tunnel_id: string`
ID of the Tunnel.
### Header Parameters
- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`
Required for all Tunnel endpoints.
- `"mcp-tunnels-2026-05-19"`
### Returns
- `id: string`
ID of the Tunnel.
- `archived_at: string or null`
RFC 3339 datetime string indicating when the Tunnel was archived, or
`null` if it is not archived.
- `created_at: string`
RFC 3339 datetime string indicating when the Tunnel was created.
- `display_name: string or null`
Human-readable name for the Tunnel (1–255 characters), or `null` if unset.
- `domain: string`
Anthropic-assigned hostname for the Tunnel. MCP server URLs whose host is a
subdomain of this value are routed through the Tunnel. Globally unique and
never reused, even after the Tunnel is archived.
- `type: "tunnel"`
Object type. Always `tunnel` for Tunnels.
- `"tunnel"`
- `workspace_id: string or null`
ID of the Workspace this Tunnel belongs to, or `null` for the default
Workspace. Immutable after creation.
### Example
```http
curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"id": "tnl_01Hx9Kp2RtQvMn3sWbYdLcF8",
"archived_at": "2024-11-01T23:59:27.427722Z",
"created_at": "2024-10-30T23:58:27.427722Z",
"display_name": "Production",
"domain": "a1b2c3d4.tunnel.anthropic.com",
"type": "tunnel",
"workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
}
```
## List Tunnels
**get** `/v1/organizations/tunnels`
**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.
List the organization's tunnels.
Results span the caller's organization, ordered by creation time
(newest first). Use `workspace_id` to filter to a single workspace;
archived tunnels are excluded unless `include_archived` is set.
### Query Parameters
- `include_archived: optional boolean`
Include archived tunnels in the results. Archived tunnels are excluded by
default.
- `limit: optional number`
Maximum number of tunnels to return in a single page.
- `page: optional string`
Opaque pagination cursor from a previous response's `next_page`. Omit to
fetch the first page.
- `workspace_id: optional string`
Return only tunnels in this Workspace. Accepts a `wrkspc_`-prefixed
Workspace ID; omit to list tunnels across all Workspaces.
### Header Parameters
- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`
Required for all Tunnel endpoints.
- `"mcp-tunnels-2026-05-19"`
### Returns
- `data: array of object { id, archived_at, created_at, 4 more }`
- `id: string`
ID of the Tunnel.
- `archived_at: string or null`
RFC 3339 datetime string indicating when the Tunnel was archived, or
`null` if it is not archived.
- `created_at: string`
RFC 3339 datetime string indicating when the Tunnel was created.
- `display_name: string or null`
Human-readable name for the Tunnel (1–255 characters), or `null` if unset.
- `domain: string`
Anthropic-assigned hostname for the Tunnel. MCP server URLs whose host is a
subdomain of this value are routed through the Tunnel. Globally unique and
never reused, even after the Tunnel is archived.
- `type: "tunnel"`
Object type. Always `tunnel` for Tunnels.
- `"tunnel"`
- `workspace_id: string or null`
ID of the Workspace this Tunnel belongs to, or `null` for the default
Workspace. Immutable after creation.
- `next_page: string or null`
Opaque cursor for the next page, or `null` if there are no more results.
### Example
```http
curl https://api.anthropic.com/v1/organizations/tunnels \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"data": [
{
"id": "tnl_01Hx9Kp2RtQvMn3sWbYdLcF8",
"archived_at": "2024-11-01T23:59:27.427722Z",
"created_at": "2024-10-30T23:58:27.427722Z",
"display_name": "Production",
"domain": "a1b2c3d4.tunnel.anthropic.com",
"type": "tunnel",
"workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
}
],
"next_page": "page_MjAyNS0wNS0xNFQwMDowMDowMFo="
}
```
## Reveal Tunnel Token
**post** `/v1/organizations/tunnels/{tunnel_id}/reveal_token`
**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.
Return the tunnel's current connection token.
The value is fetched live on each call; Anthropic does not store it.
Repeated calls return the same value until the token is rotated.
Exposed as `POST` so the token does not appear in intermediary
access logs.
### Path Parameters
- `tunnel_id: string`
ID of the Tunnel.
### Header Parameters
- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`
Required for all Tunnel endpoints.
- `"mcp-tunnels-2026-05-19"`
### Returns
- `id: string`
Stable identifier for the current token value. Changes when the token is
rotated.
- `tunnel_token: string`
The tunnel's connection token.
- `type: "tunnel_token"`
Object type. Always `tunnel_token` for Tunnel Tokens.
- `"tunnel_token"`
### Example
```http
curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/reveal_token \
-X POST \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"id": "ttkn_bb97000eaec162831399ca9b6684a4fdf5be49ace5683057b017aab5c87e19e0",
"tunnel_token": "eyJhIjoiRVhBTVBMRSIsInQiOiJFWEFNUExFIiwicyI6IkVYQU1QTEUifQ==",
"type": "tunnel_token"
}
```
## Rotate Tunnel Token
**post** `/v1/organizations/tunnels/{tunnel_id}/rotate_token`
**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.
Invalidate the tunnel's current token for new connections and return a fresh value.
Established connections are not severed by rotation; a connector
restarted after rotation must use the new value. An optional
`reason` is captured for operational context.
### Path Parameters
- `tunnel_id: string`
ID of the Tunnel.
### Header Parameters
- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`
Required for all Tunnel endpoints.
- `"mcp-tunnels-2026-05-19"`
### Body Parameters
- `reason: optional string or null`
Optional free-text reason for the rotation, recorded for audit.
### Returns
- `id: string`
Stable identifier for the current token value. Changes when the token is
rotated.
- `tunnel_token: string`
Cut at 300 lines. The page has the rest.
api/admin/mcp_tunnels/archive First recorded · 90 lines, first recorded
## Archive Tunnel ### Path Parameters ### Header Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Archive Tunnel
url: https://platform.claude.com/docs/en/api/admin/mcp_tunnels/archive
---
## Archive Tunnel
**post** `/v1/organizations/tunnels/{tunnel_id}/archive`
**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.
Archive a tunnel. Archival is irreversible.
Every non-archived certificate on the tunnel is archived in the same
operation, the hostname is retired and never re-allocated, and the
tunnel token is invalidated. Retrying against an already-archived
tunnel returns the existing record unchanged.
### Path Parameters
- `tunnel_id: string`
ID of the Tunnel.
### Header Parameters
- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`
Required for all Tunnel endpoints.
- `"mcp-tunnels-2026-05-19"`
### Returns
- `id: string`
ID of the Tunnel.
- `archived_at: string or null`
RFC 3339 datetime string indicating when the Tunnel was archived, or
`null` if it is not archived.
- `created_at: string`
RFC 3339 datetime string indicating when the Tunnel was created.
- `display_name: string or null`
Human-readable name for the Tunnel (1–255 characters), or `null` if unset.
- `domain: string`
Anthropic-assigned hostname for the Tunnel. MCP server URLs whose host is a
subdomain of this value are routed through the Tunnel. Globally unique and
never reused, even after the Tunnel is archived.
- `type: "tunnel"`
Object type. Always `tunnel` for Tunnels.
- `"tunnel"`
- `workspace_id: string or null`
ID of the Workspace this Tunnel belongs to, or `null` for the default
Workspace. Immutable after creation.
### Example
```http
curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/archive \
-X POST \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"id": "tnl_01Hx9Kp2RtQvMn3sWbYdLcF8",
"archived_at": "2024-11-01T23:59:27.427722Z",
"created_at": "2024-10-30T23:58:27.427722Z",
"display_name": "Production",
"domain": "a1b2c3d4.tunnel.anthropic.com",
"type": "tunnel",
"workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
}
```
api/admin/mcp_tunnels/list First recorded · 114 lines, first recorded
## List Tunnels ### Query Parameters ### Header Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: List Tunnels
url: https://platform.claude.com/docs/en/api/admin/mcp_tunnels/list
---
## List Tunnels
**get** `/v1/organizations/tunnels`
**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.
List the organization's tunnels.
Results span the caller's organization, ordered by creation time
(newest first). Use `workspace_id` to filter to a single workspace;
archived tunnels are excluded unless `include_archived` is set.
### Query Parameters
- `include_archived: optional boolean`
Include archived tunnels in the results. Archived tunnels are excluded by
default.
- `limit: optional number`
Maximum number of tunnels to return in a single page.
- `page: optional string`
Opaque pagination cursor from a previous response's `next_page`. Omit to
fetch the first page.
- `workspace_id: optional string`
Return only tunnels in this Workspace. Accepts a `wrkspc_`-prefixed
Workspace ID; omit to list tunnels across all Workspaces.
### Header Parameters
- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`
Required for all Tunnel endpoints.
- `"mcp-tunnels-2026-05-19"`
### Returns
- `data: array of object { id, archived_at, created_at, 4 more }`
- `id: string`
ID of the Tunnel.
- `archived_at: string or null`
RFC 3339 datetime string indicating when the Tunnel was archived, or
`null` if it is not archived.
- `created_at: string`
RFC 3339 datetime string indicating when the Tunnel was created.
- `display_name: string or null`
Human-readable name for the Tunnel (1–255 characters), or `null` if unset.
- `domain: string`
Anthropic-assigned hostname for the Tunnel. MCP server URLs whose host is a
subdomain of this value are routed through the Tunnel. Globally unique and
never reused, even after the Tunnel is archived.
- `type: "tunnel"`
Object type. Always `tunnel` for Tunnels.
- `"tunnel"`
- `workspace_id: string or null`
ID of the Workspace this Tunnel belongs to, or `null` for the default
Workspace. Immutable after creation.
- `next_page: string or null`
Opaque cursor for the next page, or `null` if there are no more results.
### Example
```http
curl https://api.anthropic.com/v1/organizations/tunnels \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"data": [
{
"id": "tnl_01Hx9Kp2RtQvMn3sWbYdLcF8",
"archived_at": "2024-11-01T23:59:27.427722Z",
"created_at": "2024-10-30T23:58:27.427722Z",
"display_name": "Production",
"domain": "a1b2c3d4.tunnel.anthropic.com",
"type": "tunnel",
"workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
}
],
"next_page": "page_MjAyNS0wNS0xNFQwMDowMDowMFo="
}
```
api/admin/mcp_tunnels/retrieve First recorded · 84 lines, first recorded
## Get Tunnel ### Path Parameters ### Header Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Get Tunnel
url: https://platform.claude.com/docs/en/api/admin/mcp_tunnels/retrieve
---
## Get Tunnel
**get** `/v1/organizations/tunnels/{tunnel_id}`
**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.
Retrieve a single tunnel in the caller's organization by ID.
### Path Parameters
- `tunnel_id: string`
ID of the Tunnel.
### Header Parameters
- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`
Required for all Tunnel endpoints.
- `"mcp-tunnels-2026-05-19"`
### Returns
- `id: string`
ID of the Tunnel.
- `archived_at: string or null`
RFC 3339 datetime string indicating when the Tunnel was archived, or
`null` if it is not archived.
- `created_at: string`
RFC 3339 datetime string indicating when the Tunnel was created.
- `display_name: string or null`
Human-readable name for the Tunnel (1–255 characters), or `null` if unset.
- `domain: string`
Anthropic-assigned hostname for the Tunnel. MCP server URLs whose host is a
subdomain of this value are routed through the Tunnel. Globally unique and
never reused, even after the Tunnel is archived.
- `type: "tunnel"`
Object type. Always `tunnel` for Tunnels.
- `"tunnel"`
- `workspace_id: string or null`
ID of the Workspace this Tunnel belongs to, or `null` for the default
Workspace. Immutable after creation.
### Example
```http
curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"id": "tnl_01Hx9Kp2RtQvMn3sWbYdLcF8",
"archived_at": "2024-11-01T23:59:27.427722Z",
"created_at": "2024-10-30T23:58:27.427722Z",
"display_name": "Production",
"domain": "a1b2c3d4.tunnel.anthropic.com",
"type": "tunnel",
"workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
}
```
api/admin/mcp_tunnels/reveal_token First recorded · 67 lines, first recorded
## Reveal Tunnel Token ### Path Parameters ### Header Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Reveal Tunnel Token
url: https://platform.claude.com/docs/en/api/admin/mcp_tunnels/reveal_token
---
## Reveal Tunnel Token
**post** `/v1/organizations/tunnels/{tunnel_id}/reveal_token`
**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.
Return the tunnel's current connection token.
The value is fetched live on each call; Anthropic does not store it.
Repeated calls return the same value until the token is rotated.
Exposed as `POST` so the token does not appear in intermediary
access logs.
### Path Parameters
- `tunnel_id: string`
ID of the Tunnel.
### Header Parameters
- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`
Required for all Tunnel endpoints.
- `"mcp-tunnels-2026-05-19"`
### Returns
- `id: string`
Stable identifier for the current token value. Changes when the token is
rotated.
- `tunnel_token: string`
The tunnel's connection token.
- `type: "tunnel_token"`
Object type. Always `tunnel_token` for Tunnel Tokens.
- `"tunnel_token"`
### Example
```http
curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/reveal_token \
-X POST \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"id": "ttkn_bb97000eaec162831399ca9b6684a4fdf5be49ace5683057b017aab5c87e19e0",
"tunnel_token": "eyJhIjoiRVhBTVBMRSIsInQiOiJFWEFNUExFIiwicyI6IkVYQU1QTEUifQ==",
"type": "tunnel_token"
}
```
api/admin/mcp_tunnels/rotate_token First recorded · 72 lines, first recorded
## Rotate Tunnel Token ### Path Parameters ### Header Parameters ### Body Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Rotate Tunnel Token
url: https://platform.claude.com/docs/en/api/admin/mcp_tunnels/rotate_token
---
## Rotate Tunnel Token
**post** `/v1/organizations/tunnels/{tunnel_id}/rotate_token`
**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.
Invalidate the tunnel's current token for new connections and return a fresh value.
Established connections are not severed by rotation; a connector
restarted after rotation must use the new value. An optional
`reason` is captured for operational context.
### Path Parameters
- `tunnel_id: string`
ID of the Tunnel.
### Header Parameters
- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`
Required for all Tunnel endpoints.
- `"mcp-tunnels-2026-05-19"`
### Body Parameters
- `reason: optional string or null`
Optional free-text reason for the rotation, recorded for audit.
### Returns
- `id: string`
Stable identifier for the current token value. Changes when the token is
rotated.
- `tunnel_token: string`
The tunnel's connection token.
- `type: "tunnel_token"`
Object type. Always `tunnel_token` for Tunnel Tokens.
- `"tunnel_token"`
### Example
```http
curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/rotate_token \
-X POST \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"id": "ttkn_bb97000eaec162831399ca9b6684a4fdf5be49ace5683057b017aab5c87e19e0",
"tunnel_token": "eyJhIjoiRVhBTVBMRSIsInQiOiJFWEFNUExFIiwicyI6IkVYQU1QTEUifQ==",
"type": "tunnel_token"
}
```
api/admin/mcp_tunnels/tunnel_certificates First recorded · 522 lines, first recorded
# Tunnel Certificates ## Create Tunnel Certificate ### Path Parameters ### Header Parameters ### Body Parameters ### Returns ### Example #### Response ## Get Tunnel Certificate ### Path Parameters ### Header Parameters ### Returns ### Example #### Response ## List Tunnel Certificates ### Path Parameters ### Query Parameters ### Header Parameters ### Returns ### Example #### Response ## Archive Tunnel Certificate ### Path Parameters ### Header Parameters ### Returns ### Example #### Response ## Domain Types ### Tunnel Certificate Create Response ### Tunnel Certificate Retrieve Response ### Tunnel Certificate List Response ### Tunnel Certificate Archive Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Tunnel Certificates
url: https://platform.claude.com/docs/en/api/admin/mcp_tunnels/tunnel_certificates
---
# Tunnel Certificates
## Create Tunnel Certificate
**post** `/v1/organizations/tunnels/{tunnel_id}/certificates`
**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.
Register a public CA certificate for the tunnel.
Anthropic verifies the gateway's server certificate against this CA
when it terminates the inner TLS session. The PEM body must contain
exactly one X.509 certificate and no private-key material. A tunnel
holds at most two non-archived certificates.
### Path Parameters
- `tunnel_id: string`
ID of the Tunnel.
### Header Parameters
- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`
Required for all Tunnel endpoints.
- `"mcp-tunnels-2026-05-19"`
### Body Parameters
- `ca_certificate_pem: string`
PEM-encoded X.509 CA certificate. Must contain exactly one certificate and
no private-key material.
### Returns
- `id: string`
ID of the Tunnel Certificate.
- `archived_at: string or null`
RFC 3339 datetime string indicating when the certificate was archived, or
`null` if it is not archived.
- `created_at: string`
RFC 3339 datetime string indicating when the certificate was registered.
- `expires_at: string or null`
RFC 3339 datetime string indicating when the certificate expires, or
`null` if it does not expire.
- `fingerprint: string`
The certificate's SHA-256 fingerprint, as a lowercase hex string.
- `tunnel_id: string`
ID of the Tunnel this certificate is registered against.
- `type: "tunnel_certificate"`
Object type. Always `tunnel_certificate` for Tunnel Certificates.
- `"tunnel_certificate"`
### Example
```http
curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
-d '{
"ca_certificate_pem": "-----BEGIN CERTIFICATE-----\nMIIBexampleEXAMPLEexampleEXAMPLEexampleEXAMPLEexampleEXAMPLEexa\n...illustrative placeholder, not a real certificate...\n-----END CERTIFICATE-----\n"
}'
```
#### Response
```json
{
"id": "tcrt_01JmWq4ZxnBvR7tKpY2sLdH9",
"archived_at": "2024-11-01T23:59:27.427722Z",
"created_at": "2024-10-30T23:58:27.427722Z",
"expires_at": "2024-10-30T23:58:27.427722Z",
"fingerprint": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
"tunnel_id": "tnl_01Hx9Kp2RtQvMn3sWbYdLcF8",
"type": "tunnel_certificate"
}
```
## Get Tunnel Certificate
**get** `/v1/organizations/tunnels/{tunnel_id}/certificates/{certificate_id}`
**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.
Retrieve a single certificate registered on a tunnel by ID.
### Path Parameters
- `tunnel_id: string`
ID of the Tunnel.
- `certificate_id: string`
ID of the Tunnel Certificate.
### Header Parameters
- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`
Required for all Tunnel endpoints.
- `"mcp-tunnels-2026-05-19"`
### Returns
- `id: string`
ID of the Tunnel Certificate.
- `archived_at: string or null`
RFC 3339 datetime string indicating when the certificate was archived, or
`null` if it is not archived.
- `created_at: string`
RFC 3339 datetime string indicating when the certificate was registered.
- `expires_at: string or null`
RFC 3339 datetime string indicating when the certificate expires, or
`null` if it does not expire.
- `fingerprint: string`
The certificate's SHA-256 fingerprint, as a lowercase hex string.
- `tunnel_id: string`
ID of the Tunnel this certificate is registered against.
- `type: "tunnel_certificate"`
Object type. Always `tunnel_certificate` for Tunnel Certificates.
- `"tunnel_certificate"`
### Example
```http
curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"id": "tcrt_01JmWq4ZxnBvR7tKpY2sLdH9",
"archived_at": "2024-11-01T23:59:27.427722Z",
"created_at": "2024-10-30T23:58:27.427722Z",
"expires_at": "2024-10-30T23:58:27.427722Z",
"fingerprint": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
"tunnel_id": "tnl_01Hx9Kp2RtQvMn3sWbYdLcF8",
"type": "tunnel_certificate"
}
```
## List Tunnel Certificates
**get** `/v1/organizations/tunnels/{tunnel_id}/certificates`
**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.
List the certificates registered on a tunnel.
Archived certificates are excluded unless `include_archived` is set.
### Path Parameters
- `tunnel_id: string`
ID of the Tunnel.
### Query Parameters
- `include_archived: optional boolean`
Include archived certificates in the results. Archived certificates are
excluded by default.
- `limit: optional number`
Maximum number of certificates to return.
- `page: optional string`
A tunnel has at most two active certificates, so this list is not
paginated.
### Header Parameters
- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`
Required for all Tunnel endpoints.
- `"mcp-tunnels-2026-05-19"`
### Returns
- `data: array of object { id, archived_at, created_at, 4 more }`
- `id: string`
ID of the Tunnel Certificate.
- `archived_at: string or null`
RFC 3339 datetime string indicating when the certificate was archived, or
`null` if it is not archived.
- `created_at: string`
RFC 3339 datetime string indicating when the certificate was registered.
- `expires_at: string or null`
RFC 3339 datetime string indicating when the certificate expires, or
`null` if it does not expire.
- `fingerprint: string`
The certificate's SHA-256 fingerprint, as a lowercase hex string.
- `tunnel_id: string`
ID of the Tunnel this certificate is registered against.
- `type: "tunnel_certificate"`
Object type. Always `tunnel_certificate` for Tunnel Certificates.
- `"tunnel_certificate"`
- `next_page: string or null`
Opaque cursor for the next page, or `null` if there are no more results.
### Example
```http
curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"data": [
{
"id": "tcrt_01JmWq4ZxnBvR7tKpY2sLdH9",
"archived_at": "2024-11-01T23:59:27.427722Z",
"created_at": "2024-10-30T23:58:27.427722Z",
"expires_at": "2024-10-30T23:58:27.427722Z",
"fingerprint": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
"tunnel_id": "tnl_01Hx9Kp2RtQvMn3sWbYdLcF8",
"type": "tunnel_certificate"
}
],
"next_page": "page_MjAyNS0wNS0xNFQwMDowMDowMFo="
}
```
## Archive Tunnel Certificate
**post** `/v1/organizations/tunnels/{tunnel_id}/certificates/{certificate_id}/archive`
**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.
Archive a certificate, removing it from the set Anthropic trusts for this tunnel.
The certificate record is retained. Archiving the last non-archived
certificate is permitted; the tunnel rejects MCP traffic until a new
Cut at 300 lines. The page has the rest.
api/admin/mcp_tunnels/tunnel_certificates/archive First recorded · 91 lines, first recorded
## Archive Tunnel Certificate ### Path Parameters ### Header Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Archive Tunnel Certificate
url: https://platform.claude.com/docs/en/api/admin/mcp_tunnels/tunnel_certificates/archive
---
## Archive Tunnel Certificate
**post** `/v1/organizations/tunnels/{tunnel_id}/certificates/{certificate_id}/archive`
**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.
Archive a certificate, removing it from the set Anthropic trusts for this tunnel.
The certificate record is retained. Archiving the last non-archived
certificate is permitted; the tunnel rejects MCP traffic until a new
certificate is added.
### Path Parameters
- `tunnel_id: string`
ID of the Tunnel.
- `certificate_id: string`
ID of the Tunnel Certificate.
### Header Parameters
- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`
Required for all Tunnel endpoints.
- `"mcp-tunnels-2026-05-19"`
### Returns
- `id: string`
ID of the Tunnel Certificate.
- `archived_at: string or null`
RFC 3339 datetime string indicating when the certificate was archived, or
`null` if it is not archived.
- `created_at: string`
RFC 3339 datetime string indicating when the certificate was registered.
- `expires_at: string or null`
RFC 3339 datetime string indicating when the certificate expires, or
`null` if it does not expire.
- `fingerprint: string`
The certificate's SHA-256 fingerprint, as a lowercase hex string.
- `tunnel_id: string`
ID of the Tunnel this certificate is registered against.
- `type: "tunnel_certificate"`
Object type. Always `tunnel_certificate` for Tunnel Certificates.
- `"tunnel_certificate"`
### Example
```http
curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID/archive \
-X POST \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"id": "tcrt_01JmWq4ZxnBvR7tKpY2sLdH9",
"archived_at": "2024-11-01T23:59:27.427722Z",
"created_at": "2024-10-30T23:58:27.427722Z",
"expires_at": "2024-10-30T23:58:27.427722Z",
"fingerprint": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
"tunnel_id": "tnl_01Hx9Kp2RtQvMn3sWbYdLcF8",
"type": "tunnel_certificate"
}
```
api/admin/mcp_tunnels/tunnel_certificates/create First recorded · 98 lines, first recorded
## Create Tunnel Certificate ### Path Parameters ### Header Parameters ### Body Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Create Tunnel Certificate
url: https://platform.claude.com/docs/en/api/admin/mcp_tunnels/tunnel_certificates/create
---
## Create Tunnel Certificate
**post** `/v1/organizations/tunnels/{tunnel_id}/certificates`
**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.
Register a public CA certificate for the tunnel.
Anthropic verifies the gateway's server certificate against this CA
when it terminates the inner TLS session. The PEM body must contain
exactly one X.509 certificate and no private-key material. A tunnel
holds at most two non-archived certificates.
### Path Parameters
- `tunnel_id: string`
ID of the Tunnel.
### Header Parameters
- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`
Required for all Tunnel endpoints.
- `"mcp-tunnels-2026-05-19"`
### Body Parameters
- `ca_certificate_pem: string`
PEM-encoded X.509 CA certificate. Must contain exactly one certificate and
no private-key material.
### Returns
- `id: string`
ID of the Tunnel Certificate.
- `archived_at: string or null`
RFC 3339 datetime string indicating when the certificate was archived, or
`null` if it is not archived.
- `created_at: string`
RFC 3339 datetime string indicating when the certificate was registered.
- `expires_at: string or null`
RFC 3339 datetime string indicating when the certificate expires, or
`null` if it does not expire.
- `fingerprint: string`
The certificate's SHA-256 fingerprint, as a lowercase hex string.
- `tunnel_id: string`
ID of the Tunnel this certificate is registered against.
- `type: "tunnel_certificate"`
Object type. Always `tunnel_certificate` for Tunnel Certificates.
- `"tunnel_certificate"`
### Example
```http
curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
-d '{
"ca_certificate_pem": "-----BEGIN CERTIFICATE-----\nMIIBexampleEXAMPLEexampleEXAMPLEexampleEXAMPLEexampleEXAMPLEexa\n...illustrative placeholder, not a real certificate...\n-----END CERTIFICATE-----\n"
}'
```
#### Response
```json
{
"id": "tcrt_01JmWq4ZxnBvR7tKpY2sLdH9",
"archived_at": "2024-11-01T23:59:27.427722Z",
"created_at": "2024-10-30T23:58:27.427722Z",
"expires_at": "2024-10-30T23:58:27.427722Z",
"fingerprint": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
"tunnel_id": "tnl_01Hx9Kp2RtQvMn3sWbYdLcF8",
"type": "tunnel_certificate"
}
```
api/admin/mcp_tunnels/tunnel_certificates/list First recorded · 111 lines, first recorded
## List Tunnel Certificates ### Path Parameters ### Query Parameters ### Header Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: List Tunnel Certificates
url: https://platform.claude.com/docs/en/api/admin/mcp_tunnels/tunnel_certificates/list
---
## List Tunnel Certificates
**get** `/v1/organizations/tunnels/{tunnel_id}/certificates`
**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.
List the certificates registered on a tunnel.
Archived certificates are excluded unless `include_archived` is set.
### Path Parameters
- `tunnel_id: string`
ID of the Tunnel.
### Query Parameters
- `include_archived: optional boolean`
Include archived certificates in the results. Archived certificates are
excluded by default.
- `limit: optional number`
Maximum number of certificates to return.
- `page: optional string`
A tunnel has at most two active certificates, so this list is not
paginated.
### Header Parameters
- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`
Required for all Tunnel endpoints.
- `"mcp-tunnels-2026-05-19"`
### Returns
- `data: array of object { id, archived_at, created_at, 4 more }`
- `id: string`
ID of the Tunnel Certificate.
- `archived_at: string or null`
RFC 3339 datetime string indicating when the certificate was archived, or
`null` if it is not archived.
- `created_at: string`
RFC 3339 datetime string indicating when the certificate was registered.
- `expires_at: string or null`
RFC 3339 datetime string indicating when the certificate expires, or
`null` if it does not expire.
- `fingerprint: string`
The certificate's SHA-256 fingerprint, as a lowercase hex string.
- `tunnel_id: string`
ID of the Tunnel this certificate is registered against.
- `type: "tunnel_certificate"`
Object type. Always `tunnel_certificate` for Tunnel Certificates.
- `"tunnel_certificate"`
- `next_page: string or null`
Opaque cursor for the next page, or `null` if there are no more results.
### Example
```http
curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"data": [
{
"id": "tcrt_01JmWq4ZxnBvR7tKpY2sLdH9",
"archived_at": "2024-11-01T23:59:27.427722Z",
"created_at": "2024-10-30T23:58:27.427722Z",
"expires_at": "2024-10-30T23:58:27.427722Z",
"fingerprint": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
"tunnel_id": "tnl_01Hx9Kp2RtQvMn3sWbYdLcF8",
"type": "tunnel_certificate"
}
],
"next_page": "page_MjAyNS0wNS0xNFQwMDowMDowMFo="
}
```
api/admin/mcp_tunnels/tunnel_certificates/retrieve First recorded · 86 lines, first recorded
## Get Tunnel Certificate ### Path Parameters ### Header Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Get Tunnel Certificate
url: https://platform.claude.com/docs/en/api/admin/mcp_tunnels/tunnel_certificates/retrieve
---
## Get Tunnel Certificate
**get** `/v1/organizations/tunnels/{tunnel_id}/certificates/{certificate_id}`
**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.
Retrieve a single certificate registered on a tunnel by ID.
### Path Parameters
- `tunnel_id: string`
ID of the Tunnel.
- `certificate_id: string`
ID of the Tunnel Certificate.
### Header Parameters
- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`
Required for all Tunnel endpoints.
- `"mcp-tunnels-2026-05-19"`
### Returns
- `id: string`
ID of the Tunnel Certificate.
- `archived_at: string or null`
RFC 3339 datetime string indicating when the certificate was archived, or
`null` if it is not archived.
- `created_at: string`
RFC 3339 datetime string indicating when the certificate was registered.
- `expires_at: string or null`
RFC 3339 datetime string indicating when the certificate expires, or
`null` if it does not expire.
- `fingerprint: string`
The certificate's SHA-256 fingerprint, as a lowercase hex string.
- `tunnel_id: string`
ID of the Tunnel this certificate is registered against.
- `type: "tunnel_certificate"`
Object type. Always `tunnel_certificate` for Tunnel Certificates.
- `"tunnel_certificate"`
### Example
```http
curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"id": "tcrt_01JmWq4ZxnBvR7tKpY2sLdH9",
"archived_at": "2024-11-01T23:59:27.427722Z",
"created_at": "2024-10-30T23:58:27.427722Z",
"expires_at": "2024-10-30T23:58:27.427722Z",
"fingerprint": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
"tunnel_id": "tnl_01Hx9Kp2RtQvMn3sWbYdLcF8",
"type": "tunnel_certificate"
}
```
api/admin/organizations First recorded · 72 lines, first recorded
# Organizations ## Get Current Organization ### Returns ### Example #### Response ## Domain Types ### Organization
The first capture of this source. The page was already there, and this is what it said.
---
title: Organizations
url: https://platform.claude.com/docs/en/api/admin/organizations
---
# Organizations
## Get Current Organization
**get** `/v1/organizations/me`
Retrieve information about the organization associated with the authenticated API key.
### Returns
- `Organization object { id, name, type }`
- `id: string`
ID of the Organization.
- `name: string`
Name of the Organization.
- `type: "organization"`
Object type.
For Organizations, this is always `"organization"`.
- `"organization"`
### Example
```http
curl https://api.anthropic.com/v1/organizations/me \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"id": "12345678-1234-5678-1234-567812345678",
"name": "Organization Name",
"type": "organization"
}
```
## Domain Types
### Organization
- `Organization object { id, name, type }`
- `id: string`
ID of the Organization.
- `name: string`
Name of the Organization.
- `type: "organization"`
Object type.
For Organizations, this is always `"organization"`.
- `"organization"`
api/admin/organizations/me First recorded · 48 lines, first recorded
## Get Current Organization ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Get Current Organization
url: https://platform.claude.com/docs/en/api/admin/organizations/me
---
## Get Current Organization
**get** `/v1/organizations/me`
Retrieve information about the organization associated with the authenticated API key.
### Returns
- `Organization object { id, name, type }`
- `id: string`
ID of the Organization.
- `name: string`
Name of the Organization.
- `type: "organization"`
Object type.
For Organizations, this is always `"organization"`.
- `"organization"`
### Example
```http
curl https://api.anthropic.com/v1/organizations/me \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"id": "12345678-1234-5678-1234-567812345678",
"name": "Organization Name",
"type": "organization"
}
```
api/admin/rate_limits First recorded · 182 lines, first recorded
# Rate Limits ## List Organization Rate Limits ### Query Parameters ### Returns ### Example #### Response ## Domain Types ### Rate Limit List Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Rate Limits
url: https://platform.claude.com/docs/en/api/admin/rate_limits
---
# Rate Limits
## List Organization Rate Limits
**get** `/v1/organizations/rate_limits`
List Messages API rate limits for your organization.
Each entry corresponds to one rate-limit group (either a model family
or an API-surface category such as the Files API or Message Batches)
and contains the set of limiter values that apply to it.
### Query Parameters
- `group_type: optional "batch" or "files" or "model_group" or 3 more`
Filter by group type.
- `"batch"`
- `"files"`
- `"model_group"`
- `"skills"`
- `"token_count"`
- `"web_search"`
- `model: optional string`
Filter to the single entry containing this model. Accepts full model names and aliases. Returns 404 if the model is not found or has no rate limits for this organization.
- `page: optional string`
Opaque cursor from a previous response's `next_page`.
### Returns
- `data: array of object { id, group_type, limits, 2 more }`
Rate-limit entries for the organization, one per group.
- `id: string`
Stable identifier for this rate-limit group within the organization.
- `group_type: "batch" or "files" or "model_group" or 3 more`
The kind of rate-limit group this entry represents. `model_group` entries apply to a family of models (listed in `models`); other values apply to an API-surface category and have `models` set to `null`.
- `"batch"`
- `"files"`
- `"model_group"`
- `"skills"`
- `"token_count"`
- `"web_search"`
- `limits: array of object { type, value }`
The limiter values that apply to this group.
- `type: string`
The limiter type (for example, `requests_per_minute` or `input_tokens_per_minute`).
- `value: number`
The configured limit value for this limiter type.
- `models: array of string or null`
Model names this entry's limits apply to, including aliases. `null` when `group_type` is not `"model_group"`.
- `type: "rate_limit"`
Object type. Always `rate_limit` for organization rate-limit entries.
- `"rate_limit"`
- `next_page: string or null`
Token to provide in as `page` in the subsequent request to retrieve the next page of data.
### Example
```http
curl https://api.anthropic.com/v1/organizations/rate_limits \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"data": [
{
"id": "id",
"group_type": "batch",
"limits": [
{
"type": "type",
"value": 0
}
],
"models": [
"string"
],
"type": "rate_limit"
}
],
"next_page": "next_page"
}
```
## Domain Types
### Rate Limit List Response
- `RateLimitListResponse object { data, next_page }`
- `data: array of object { id, group_type, limits, 2 more }`
Rate-limit entries for the organization, one per group.
- `id: string`
Stable identifier for this rate-limit group within the organization.
- `group_type: "batch" or "files" or "model_group" or 3 more`
The kind of rate-limit group this entry represents. `model_group` entries apply to a family of models (listed in `models`); other values apply to an API-surface category and have `models` set to `null`.
- `"batch"`
- `"files"`
- `"model_group"`
- `"skills"`
- `"token_count"`
- `"web_search"`
- `limits: array of object { type, value }`
The limiter values that apply to this group.
- `type: string`
The limiter type (for example, `requests_per_minute` or `input_tokens_per_minute`).
- `value: number`
The configured limit value for this limiter type.
- `models: array of string or null`
Model names this entry's limits apply to, including aliases. `null` when `group_type` is not `"model_group"`.
- `type: "rate_limit"`
Object type. Always `rate_limit` for organization rate-limit entries.
- `"rate_limit"`
- `next_page: string or null`
Token to provide in as `page` in the subsequent request to retrieve the next page of data.