One read of Claude Developer Platformapi-20260814T043121Z
565 pages moved out of 565 read.
What this read moved
126-150 of 565, page 6 of 23This capture is too large to show at once. Changes 126-150 of 565 are below, significant first; the rest are on the following screens.
api/admin/rate_limits/list First recorded · 124 lines, first recorded
## List Organization Rate Limits ### Query Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: List Organization Rate Limits
url: https://platform.claude.com/docs/en/api/admin/rate_limits/list
---
## List Organization Rate Limits
**get** `/v1/organizations/rate_limits`
List Messages API rate limits for your organization.
Each entry corresponds to one rate-limit group (either a model family
or an API-surface category such as the Files API or Message Batches)
and contains the set of limiter values that apply to it.
### Query Parameters
- `group_type: optional "batch" or "files" or "model_group" or 3 more`
Filter by group type.
- `"batch"`
- `"files"`
- `"model_group"`
- `"skills"`
- `"token_count"`
- `"web_search"`
- `model: optional string`
Filter to the single entry containing this model. Accepts full model names and aliases. Returns 404 if the model is not found or has no rate limits for this organization.
- `page: optional string`
Opaque cursor from a previous response's `next_page`.
### Returns
- `data: array of object { id, group_type, limits, 2 more }`
Rate-limit entries for the organization, one per group.
- `id: string`
Stable identifier for this rate-limit group within the organization.
- `group_type: "batch" or "files" or "model_group" or 3 more`
The kind of rate-limit group this entry represents. `model_group` entries apply to a family of models (listed in `models`); other values apply to an API-surface category and have `models` set to `null`.
- `"batch"`
- `"files"`
- `"model_group"`
- `"skills"`
- `"token_count"`
- `"web_search"`
- `limits: array of object { type, value }`
The limiter values that apply to this group.
- `type: string`
The limiter type (for example, `requests_per_minute` or `input_tokens_per_minute`).
- `value: number`
The configured limit value for this limiter type.
- `models: array of string or null`
Model names this entry's limits apply to, including aliases. `null` when `group_type` is not `"model_group"`.
- `type: "rate_limit"`
Object type. Always `rate_limit` for organization rate-limit entries.
- `"rate_limit"`
- `next_page: string or null`
Token to provide in as `page` in the subsequent request to retrieve the next page of data.
### Example
```http
curl https://api.anthropic.com/v1/organizations/rate_limits \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"data": [
{
"id": "id",
"group_type": "batch",
"limits": [
{
"type": "type",
"value": 0
}
],
"models": [
"string"
],
"type": "rate_limit"
}
],
"next_page": "next_page"
}
```
api/admin/rbac_groups First recorded · 787 lines, first recorded
# RBAC Groups ## List RBAC Groups ### Query Parameters ### Header Parameters ### Returns ### Example #### Response ## Get RBAC Group ### Path Parameters ### Header Parameters ### Returns ### Example #### Response ## Create RBAC Group ### Header Parameters ### Body Parameters ### Returns ### Example #### Response ## Update RBAC Group ### Path Parameters ### Header Parameters ### Body Parameters ### Returns ### Example #### Response ## Delete RBAC Group ### Path Parameters ### Header Parameters ### Returns ### Example #### Response ## Domain Types ### Rbac Group ### Rbac Group Deleted # Members ## List RBAC Group Members ### Path Parameters ### Query Parameters ### Header Parameters ### Returns ### Example #### Response ## Add RBAC Group Member ### Path Parameters ### Header Parameters ### Body Parameters ### Returns ### Example #### Response ## Remove RBAC Group Member ### Path Parameters ### Header Parameters ### Returns ### Example #### Response ## Domain Types ### Rbac Group Member ### Rbac Group Member Deleted
The first capture of this source. The page was already there, and this is what it said.
---
title: RBAC Groups
url: https://platform.claude.com/docs/en/api/admin/rbac_groups
---
# RBAC Groups
## List RBAC Groups
**get** `/v1/organizations/rbac_groups`
List RBAC Groups in the Claude Enterprise tenant.
The RBAC Groups API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.
### Query Parameters
- `limit: optional number`
Number of items to return per page.
Defaults to `20`. Ranges from `1` to `1000`.
- `page: optional string`
Optionally set to the `next_page` token from the previous response.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Returns
- `data: array of RbacGroup`
- `id: string`
ID of the RBAC Group.
- `created_at: string`
RFC 3339 timestamp of when the RBAC Group was created.
- `name: string`
Name of the RBAC Group. Not uniqueness-enforced.
- `roles: array of string or null`
RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list.
- `source_type: "direct" or "scim"`
How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider.
- `"direct"`
- `"scim"`
- `type: "rbac_group"`
Object type.
For RBAC Groups, this is always `"rbac_group"`.
- `"rbac_group"`
- `updated_at: string`
RFC 3339 timestamp of when the RBAC Group was last updated.
- `has_more: boolean`
Indicates if there are more results in the requested page direction.
- `next_page: string or null`
Token to provide in as `page` in the subsequent request to retrieve the next page of data.
### Example
```http
curl https://api.anthropic.com/v1/organizations/rbac_groups \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"data": [
{
"id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
"created_at": "2024-10-30T23:58:27.427722Z",
"name": "Engineering",
"roles": [
"rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s"
],
"source_type": "direct",
"type": "rbac_group",
"updated_at": "2024-10-30T23:58:27.427722Z"
}
],
"has_more": false,
"next_page": "eyJjdXJzb3IiOiAicmJhY19ncm91cF8wMSJ9"
}
```
## Get RBAC Group
**get** `/v1/organizations/rbac_groups/{group_id}`
Retrieve an RBAC Group by ID.
The RBAC Groups API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.
### Path Parameters
- `group_id: string`
ID of the RBAC Group.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Returns
- `RbacGroup object { id, created_at, name, 4 more }`
- `id: string`
ID of the RBAC Group.
- `created_at: string`
RFC 3339 timestamp of when the RBAC Group was created.
- `name: string`
Name of the RBAC Group. Not uniqueness-enforced.
- `roles: array of string or null`
RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list.
- `source_type: "direct" or "scim"`
How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider.
- `"direct"`
- `"scim"`
- `type: "rbac_group"`
Object type.
For RBAC Groups, this is always `"rbac_group"`.
- `"rbac_group"`
- `updated_at: string`
RFC 3339 timestamp of when the RBAC Group was last updated.
### Example
```http
curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
"created_at": "2024-10-30T23:58:27.427722Z",
"name": "Engineering",
"roles": [
"rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s"
],
"source_type": "direct",
"type": "rbac_group",
"updated_at": "2024-10-30T23:58:27.427722Z"
}
```
## Create RBAC Group
**post** `/v1/organizations/rbac_groups`
Create an RBAC Group in the Claude Enterprise tenant. Groups created via the API have source type `"direct"`.
The RBAC Groups API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Body Parameters
- `name: string`
Name of the RBAC Group. Not uniqueness-enforced.
### Returns
- `RbacGroup object { id, created_at, name, 4 more }`
- `id: string`
ID of the RBAC Group.
- `created_at: string`
RFC 3339 timestamp of when the RBAC Group was created.
- `name: string`
Name of the RBAC Group. Not uniqueness-enforced.
- `roles: array of string or null`
RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list.
- `source_type: "direct" or "scim"`
How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider.
- `"direct"`
- `"scim"`
- `type: "rbac_group"`
Object type.
For RBAC Groups, this is always `"rbac_group"`.
- `"rbac_group"`
- `updated_at: string`
RFC 3339 timestamp of when the RBAC Group was last updated.
### Example
```http
curl https://api.anthropic.com/v1/organizations/rbac_groups \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
-d '{
"name": "Engineering"
}'
```
#### Response
```json
{
"id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
"created_at": "2024-10-30T23:58:27.427722Z",
"name": "Engineering",
"roles": [
"rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s"
],
"source_type": "direct",
"type": "rbac_group",
"updated_at": "2024-10-30T23:58:27.427722Z"
}
```
## Update RBAC Group
**post** `/v1/organizations/rbac_groups/{group_id}`
Update an RBAC Group's name. Groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API.
The RBAC Groups API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.
### Path Parameters
- `group_id: string`
Cut at 300 lines. The page has the rest.
api/admin/rbac_groups/create First recorded · 94 lines, first recorded
## Create RBAC Group ### Header Parameters ### Body Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Create RBAC Group
url: https://platform.claude.com/docs/en/api/admin/rbac_groups/create
---
## Create RBAC Group
**post** `/v1/organizations/rbac_groups`
Create an RBAC Group in the Claude Enterprise tenant. Groups created via the API have source type `"direct"`.
The RBAC Groups API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Body Parameters
- `name: string`
Name of the RBAC Group. Not uniqueness-enforced.
### Returns
- `RbacGroup object { id, created_at, name, 4 more }`
- `id: string`
ID of the RBAC Group.
- `created_at: string`
RFC 3339 timestamp of when the RBAC Group was created.
- `name: string`
Name of the RBAC Group. Not uniqueness-enforced.
- `roles: array of string or null`
RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list.
- `source_type: "direct" or "scim"`
How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider.
- `"direct"`
- `"scim"`
- `type: "rbac_group"`
Object type.
For RBAC Groups, this is always `"rbac_group"`.
- `"rbac_group"`
- `updated_at: string`
RFC 3339 timestamp of when the RBAC Group was last updated.
### Example
```http
curl https://api.anthropic.com/v1/organizations/rbac_groups \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
-d '{
"name": "Engineering"
}'
```
#### Response
```json
{
"id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
"created_at": "2024-10-30T23:58:27.427722Z",
"name": "Engineering",
"roles": [
"rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s"
],
"source_type": "direct",
"type": "rbac_group",
"updated_at": "2024-10-30T23:58:27.427722Z"
}
```
api/admin/rbac_groups/delete First recorded · 60 lines, first recorded
## Delete RBAC Group ### Path Parameters ### Header Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Delete RBAC Group
url: https://platform.claude.com/docs/en/api/admin/rbac_groups/delete
---
## Delete RBAC Group
**delete** `/v1/organizations/rbac_groups/{group_id}`
Delete an RBAC Group. Groups provisioned by an identity provider (source type `"scim"`) cannot be deleted via the API.
The RBAC Groups API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.
### Path Parameters
- `group_id: string`
ID of the RBAC Group.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Returns
- `RbacGroupDeleted object { id, type }`
- `id: string`
ID of the RBAC Group.
- `type: "rbac_group_deleted"`
Deleted object type.
For RBAC Groups, this is always `"rbac_group_deleted"`.
- `"rbac_group_deleted"`
### Example
```http
curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID \
-X DELETE \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
"type": "rbac_group_deleted"
}
```
api/admin/rbac_groups/list First recorded · 110 lines, first recorded
## List RBAC Groups ### Query Parameters ### Header Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: List RBAC Groups
url: https://platform.claude.com/docs/en/api/admin/rbac_groups/list
---
## List RBAC Groups
**get** `/v1/organizations/rbac_groups`
List RBAC Groups in the Claude Enterprise tenant.
The RBAC Groups API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.
### Query Parameters
- `limit: optional number`
Number of items to return per page.
Defaults to `20`. Ranges from `1` to `1000`.
- `page: optional string`
Optionally set to the `next_page` token from the previous response.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Returns
- `data: array of RbacGroup`
- `id: string`
ID of the RBAC Group.
- `created_at: string`
RFC 3339 timestamp of when the RBAC Group was created.
- `name: string`
Name of the RBAC Group. Not uniqueness-enforced.
- `roles: array of string or null`
RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list.
- `source_type: "direct" or "scim"`
How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider.
- `"direct"`
- `"scim"`
- `type: "rbac_group"`
Object type.
For RBAC Groups, this is always `"rbac_group"`.
- `"rbac_group"`
- `updated_at: string`
RFC 3339 timestamp of when the RBAC Group was last updated.
- `has_more: boolean`
Indicates if there are more results in the requested page direction.
- `next_page: string or null`
Token to provide in as `page` in the subsequent request to retrieve the next page of data.
### Example
```http
curl https://api.anthropic.com/v1/organizations/rbac_groups \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"data": [
{
"id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
"created_at": "2024-10-30T23:58:27.427722Z",
"name": "Engineering",
"roles": [
"rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s"
],
"source_type": "direct",
"type": "rbac_group",
"updated_at": "2024-10-30T23:58:27.427722Z"
}
],
"has_more": false,
"next_page": "eyJjdXJzb3IiOiAicmJhY19ncm91cF8wMSJ9"
}
```
api/admin/rbac_groups/members First recorded · 293 lines, first recorded
# Members ## List RBAC Group Members ### Path Parameters ### Query Parameters ### Header Parameters ### Returns ### Example #### Response ## Add RBAC Group Member ### Path Parameters ### Header Parameters ### Body Parameters ### Returns ### Example #### Response ## Remove RBAC Group Member ### Path Parameters ### Header Parameters ### Returns ### Example #### Response ## Domain Types ### Rbac Group Member ### Rbac Group Member Deleted
The first capture of this source. The page was already there, and this is what it said.
---
title: Members
url: https://platform.claude.com/docs/en/api/admin/rbac_groups/members
---
# Members
## List RBAC Group Members
**get** `/v1/organizations/rbac_groups/{group_id}/members`
List members of an RBAC Group.
The RBAC Groups API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.
### Path Parameters
- `group_id: string`
ID of the RBAC Group.
### Query Parameters
- `limit: optional number`
Number of items to return per page.
Defaults to `20`. Ranges from `1` to `1000`.
- `page: optional string`
Optionally set to the `next_page` token from the previous response.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Returns
- `data: array of RbacGroupMember`
- `created_at: string`
RFC 3339 timestamp of when the User was added to the RBAC Group.
- `email: string`
Email of the User.
- `group_id: string`
ID of the RBAC Group.
- `type: "rbac_group_member"`
Object type.
For RBAC Group Members, this is always `"rbac_group_member"`.
- `"rbac_group_member"`
- `user_id: string`
ID of the User.
- `has_more: boolean`
Indicates if there are more results in the requested page direction.
- `next_page: string or null`
Token to provide in as `page` in the subsequent request to retrieve the next page of data.
### Example
```http
curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"data": [
{
"created_at": "2024-10-30T23:58:27.427722Z",
"email": "[email protected]",
"group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
"type": "rbac_group_member",
"user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
}
],
"has_more": false,
"next_page": "eyJjdXJzb3IiOiAicmJhY19ncm91cF8wMSJ9"
}
```
## Add RBAC Group Member
**post** `/v1/organizations/rbac_groups/{group_id}/members`
Add a User to an RBAC Group. Membership of groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API.
The RBAC Groups API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.
### Path Parameters
- `group_id: string`
ID of the RBAC Group.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Body Parameters
- `user_id: string`
ID of the User.
### Returns
- `RbacGroupMember object { created_at, email, group_id, 2 more }`
- `created_at: string`
RFC 3339 timestamp of when the User was added to the RBAC Group.
- `email: string`
Email of the User.
- `group_id: string`
ID of the RBAC Group.
- `type: "rbac_group_member"`
Object type.
For RBAC Group Members, this is always `"rbac_group_member"`.
- `"rbac_group_member"`
- `user_id: string`
ID of the User.
### Example
```http
curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
-d '{
"user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
}'
```
#### Response
```json
{
"created_at": "2024-10-30T23:58:27.427722Z",
"email": "[email protected]",
"group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
"type": "rbac_group_member",
"user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
}
```
## Remove RBAC Group Member
**delete** `/v1/organizations/rbac_groups/{group_id}/members/{user_id}`
Remove a User from an RBAC Group. Membership of groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API.
The RBAC Groups API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.
### Path Parameters
- `group_id: string`
ID of the RBAC Group.
- `user_id: string`
ID of the User.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Returns
- `RbacGroupMemberDeleted object { group_id, type, user_id }`
- `group_id: string`
ID of the RBAC Group.
- `type: "rbac_group_member_deleted"`
Deleted object type. For RBAC Group Members, this is always `"rbac_group_member_deleted"`.
- `"rbac_group_member_deleted"`
- `user_id: string`
ID of the User.
### Example
```http
curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members/$USER_ID \
-X DELETE \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
"type": "rbac_group_member_deleted",
"user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
}
```
## Domain Types
### Rbac Group Member
- `RbacGroupMember object { created_at, email, group_id, 2 more }`
- `created_at: string`
RFC 3339 timestamp of when the User was added to the RBAC Group.
- `email: string`
Email of the User.
- `group_id: string`
ID of the RBAC Group.
- `type: "rbac_group_member"`
Object type.
For RBAC Group Members, this is always `"rbac_group_member"`.
- `"rbac_group_member"`
- `user_id: string`
ID of the User.
### Rbac Group Member Deleted
- `RbacGroupMemberDeleted object { group_id, type, user_id }`
- `group_id: string`
ID of the RBAC Group.
- `type: "rbac_group_member_deleted"`
Deleted object type. For RBAC Group Members, this is always `"rbac_group_member_deleted"`.
- `"rbac_group_member_deleted"`
- `user_id: string`
ID of the User.
api/admin/rbac_groups/members/create First recorded · 84 lines, first recorded
## Add RBAC Group Member ### Path Parameters ### Header Parameters ### Body Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Add RBAC Group Member
url: https://platform.claude.com/docs/en/api/admin/rbac_groups/members/create
---
## Add RBAC Group Member
**post** `/v1/organizations/rbac_groups/{group_id}/members`
Add a User to an RBAC Group. Membership of groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API.
The RBAC Groups API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.
### Path Parameters
- `group_id: string`
ID of the RBAC Group.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Body Parameters
- `user_id: string`
ID of the User.
### Returns
- `RbacGroupMember object { created_at, email, group_id, 2 more }`
- `created_at: string`
RFC 3339 timestamp of when the User was added to the RBAC Group.
- `email: string`
Email of the User.
- `group_id: string`
ID of the RBAC Group.
- `type: "rbac_group_member"`
Object type.
For RBAC Group Members, this is always `"rbac_group_member"`.
- `"rbac_group_member"`
- `user_id: string`
ID of the User.
### Example
```http
curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
-d '{
"user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
}'
```
#### Response
```json
{
"created_at": "2024-10-30T23:58:27.427722Z",
"email": "[email protected]",
"group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
"type": "rbac_group_member",
"user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
}
```
api/admin/rbac_groups/members/delete First recorded · 67 lines, first recorded
## Remove RBAC Group Member ### Path Parameters ### Header Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Remove RBAC Group Member
url: https://platform.claude.com/docs/en/api/admin/rbac_groups/members/delete
---
## Remove RBAC Group Member
**delete** `/v1/organizations/rbac_groups/{group_id}/members/{user_id}`
Remove a User from an RBAC Group. Membership of groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API.
The RBAC Groups API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.
### Path Parameters
- `group_id: string`
ID of the RBAC Group.
- `user_id: string`
ID of the User.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Returns
- `RbacGroupMemberDeleted object { group_id, type, user_id }`
- `group_id: string`
ID of the RBAC Group.
- `type: "rbac_group_member_deleted"`
Deleted object type. For RBAC Group Members, this is always `"rbac_group_member_deleted"`.
- `"rbac_group_member_deleted"`
- `user_id: string`
ID of the User.
### Example
```http
curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members/$USER_ID \
-X DELETE \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
"type": "rbac_group_member_deleted",
"user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
}
```
api/admin/rbac_groups/members/list First recorded · 100 lines, first recorded
## List RBAC Group Members ### Path Parameters ### Query Parameters ### Header Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: List RBAC Group Members
url: https://platform.claude.com/docs/en/api/admin/rbac_groups/members/list
---
## List RBAC Group Members
**get** `/v1/organizations/rbac_groups/{group_id}/members`
List members of an RBAC Group.
The RBAC Groups API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.
### Path Parameters
- `group_id: string`
ID of the RBAC Group.
### Query Parameters
- `limit: optional number`
Number of items to return per page.
Defaults to `20`. Ranges from `1` to `1000`.
- `page: optional string`
Optionally set to the `next_page` token from the previous response.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Returns
- `data: array of RbacGroupMember`
- `created_at: string`
RFC 3339 timestamp of when the User was added to the RBAC Group.
- `email: string`
Email of the User.
- `group_id: string`
ID of the RBAC Group.
- `type: "rbac_group_member"`
Object type.
For RBAC Group Members, this is always `"rbac_group_member"`.
- `"rbac_group_member"`
- `user_id: string`
ID of the User.
- `has_more: boolean`
Indicates if there are more results in the requested page direction.
- `next_page: string or null`
Token to provide in as `page` in the subsequent request to retrieve the next page of data.
### Example
```http
curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"data": [
{
"created_at": "2024-10-30T23:58:27.427722Z",
"email": "[email protected]",
"group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
"type": "rbac_group_member",
"user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
}
],
"has_more": false,
"next_page": "eyJjdXJzb3IiOiAicmJhY19ncm91cF8wMSJ9"
}
```
api/admin/rbac_groups/retrieve First recorded · 90 lines, first recorded
## Get RBAC Group ### Path Parameters ### Header Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Get RBAC Group
url: https://platform.claude.com/docs/en/api/admin/rbac_groups/retrieve
---
## Get RBAC Group
**get** `/v1/organizations/rbac_groups/{group_id}`
Retrieve an RBAC Group by ID.
The RBAC Groups API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.
### Path Parameters
- `group_id: string`
ID of the RBAC Group.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Returns
- `RbacGroup object { id, created_at, name, 4 more }`
- `id: string`
ID of the RBAC Group.
- `created_at: string`
RFC 3339 timestamp of when the RBAC Group was created.
- `name: string`
Name of the RBAC Group. Not uniqueness-enforced.
- `roles: array of string or null`
RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list.
- `source_type: "direct" or "scim"`
How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider.
- `"direct"`
- `"scim"`
- `type: "rbac_group"`
Object type.
For RBAC Groups, this is always `"rbac_group"`.
- `"rbac_group"`
- `updated_at: string`
RFC 3339 timestamp of when the RBAC Group was last updated.
### Example
```http
curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
"created_at": "2024-10-30T23:58:27.427722Z",
"name": "Engineering",
"roles": [
"rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s"
],
"source_type": "direct",
"type": "rbac_group",
"updated_at": "2024-10-30T23:58:27.427722Z"
}
```
api/admin/rbac_groups/update First recorded · 100 lines, first recorded
## Update RBAC Group ### Path Parameters ### Header Parameters ### Body Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Update RBAC Group
url: https://platform.claude.com/docs/en/api/admin/rbac_groups/update
---
## Update RBAC Group
**post** `/v1/organizations/rbac_groups/{group_id}`
Update an RBAC Group's name. Groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API.
The RBAC Groups API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.
### Path Parameters
- `group_id: string`
ID of the RBAC Group.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Body Parameters
- `name: optional string or null`
Name of the RBAC Group. Not uniqueness-enforced.
### Returns
- `RbacGroup object { id, created_at, name, 4 more }`
- `id: string`
ID of the RBAC Group.
- `created_at: string`
RFC 3339 timestamp of when the RBAC Group was created.
- `name: string`
Name of the RBAC Group. Not uniqueness-enforced.
- `roles: array of string or null`
RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list.
- `source_type: "direct" or "scim"`
How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider.
- `"direct"`
- `"scim"`
- `type: "rbac_group"`
Object type.
For RBAC Groups, this is always `"rbac_group"`.
- `"rbac_group"`
- `updated_at: string`
RFC 3339 timestamp of when the RBAC Group was last updated.
### Example
```http
curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
-d '{
"name": "Engineering"
}'
```
#### Response
```json
{
"id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
"created_at": "2024-10-30T23:58:27.427722Z",
"name": "Engineering",
"roles": [
"rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s"
],
"source_type": "direct",
"type": "rbac_group",
"updated_at": "2024-10-30T23:58:27.427722Z"
}
```
api/admin/rbac_roles First recorded · 497 lines, first recorded
# RBAC Roles ## List RBAC Roles ### Query Parameters ### Header Parameters ### Returns ### Example #### Response ## Get RBAC Role ### Path Parameters ### Header Parameters ### Returns ### Example #### Response ## Domain Types ### Rbac Role # Permissions ## List RBAC Role Permissions ### Path Parameters ### Query Parameters ### Header Parameters ### Returns ### Example #### Response ## Domain Types ### Rbac Role Permission
The first capture of this source. The page was already there, and this is what it said.
---
title: RBAC Roles
url: https://platform.claude.com/docs/en/api/admin/rbac_roles
---
# RBAC Roles
## List RBAC Roles
**get** `/v1/organizations/rbac_roles`
List RBAC Roles in the organization.
The RBAC Roles API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.
### Query Parameters
- `limit: optional number`
Number of items to return per page.
Defaults to `20`. Ranges from `1` to `1000`.
- `page: optional string`
Optionally set to the `next_page` token from the previous response.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Returns
- `data: array of RbacRole`
- `id: string`
ID of the RBAC Role.
- `created_at: string`
RFC 3339 datetime string indicating when the RBAC Role was created.
- `name: string`
Name of the RBAC Role.
- `type: "rbac_role"`
Object type.
For RBAC Roles, this is always `"rbac_role"`.
- `"rbac_role"`
- `updated_at: string`
RFC 3339 datetime string indicating when the RBAC Role was last updated.
- `has_more: boolean`
Indicates whether there are more results beyond this page.
- `next_page: string or null`
Opaque cursor for the next page. Pass as the `page` parameter on the next
request.
### Example
```http
curl https://api.anthropic.com/v1/organizations/rbac_roles \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"data": [
{
"id": "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s",
"created_at": "2024-10-30T23:58:27.427722Z",
"name": "Project Editor",
"type": "rbac_role",
"updated_at": "2024-10-30T23:58:27.427722Z"
}
],
"has_more": true,
"next_page": "eyJjdXJzb3IiOiAicmJhY19yb2xlXzAxIn0"
}
```
## Get RBAC Role
**get** `/v1/organizations/rbac_roles/{role_id}`
Retrieve an RBAC Role by ID.
The RBAC Roles API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.
### Path Parameters
- `role_id: string`
ID of the RBAC Role.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Returns
- `RbacRole object { id, created_at, name, 2 more }`
- `id: string`
ID of the RBAC Role.
- `created_at: string`
RFC 3339 datetime string indicating when the RBAC Role was created.
- `name: string`
Name of the RBAC Role.
- `type: "rbac_role"`
Object type.
For RBAC Roles, this is always `"rbac_role"`.
- `"rbac_role"`
- `updated_at: string`
RFC 3339 datetime string indicating when the RBAC Role was last updated.
### Example
```http
curl https://api.anthropic.com/v1/organizations/rbac_roles/$ROLE_ID \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"id": "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s",
"created_at": "2024-10-30T23:58:27.427722Z",
"name": "Project Editor",
"type": "rbac_role",
"updated_at": "2024-10-30T23:58:27.427722Z"
}
```
## Domain Types
### Rbac Role
- `RbacRole object { id, created_at, name, 2 more }`
- `id: string`
ID of the RBAC Role.
- `created_at: string`
RFC 3339 datetime string indicating when the RBAC Role was created.
- `name: string`
Name of the RBAC Role.
- `type: "rbac_role"`
Object type.
For RBAC Roles, this is always `"rbac_role"`.
- `"rbac_role"`
- `updated_at: string`
RFC 3339 datetime string indicating when the RBAC Role was last updated.
# Permissions
## List RBAC Role Permissions
**get** `/v1/organizations/rbac_roles/{role_id}/permissions`
List the permissions an RBAC Role grants.
The RBAC Roles API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.
### Path Parameters
- `role_id: string`
ID of the RBAC Role.
### Query Parameters
- `limit: optional number`
Number of items to return per page.
Defaults to `20`. Ranges from `1` to `1000`.
- `page: optional string`
Optionally set to the `next_page` token from the previous response.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Returns
- `data: array of RbacRolePermission`
- `action: string`
Action the permission grants on the resource.
The vocabulary follows the resource: an `organization` grant carries a
product-feature entitlement (for example `chat`), an admin-panel
permission entitlement (`permission_*`), or a blanket capability-access
mode — `capability_access_all` grants every product-feature entitlement,
and `capability_access_all_ga` grants the generally-available subset as
it stands at permission-check time; neither mode grants model-access
entitlements. A consumer enumerating a role's per-feature grants should
treat a blanket row as granting every product-feature entitlement it
covers, or it will under-report the role's effective access. A `connector_tool` grant carries
a tool-access action (`use` or `always_allow`); a `connector_scope` grant
carries the scope action `grant` (the role may receive the named OAuth
scope when tokens are minted for the connector); `connector` and
`all_connectors` grants carry a tool-access action, the scope action, or
an authentication-method action (`interactive` or `managed`).
- `resource: object { organization_id, type } or object { connector_id, tool_name, type } or object { connector_id, scope, type } or 2 more`
What the permission applies to.
A tagged union: `type` names the kind of resource and determines which
identifier fields are present.
- `Organization object { organization_id, type }`
- `organization_id: string`
UUID of the organization the permission applies to.
- `type: "organization"`
Kind of resource the permission applies to.
- `"organization"`
- `ConnectorTool object { connector_id, tool_name, type }`
- `connector_id: string`
ID of the connector the permission applies to.
- `tool_name: string`
Published name of the connector tool the permission applies to.
When the published name contains characters outside `[a-zA-Z0-9_-]` (or
collides with a reserved form), it is server-encoded into a stable
`{prefix}_{32-hex}` form — a shortened readable prefix of the name plus
a hash — from which the published name is not recoverable.
- `type: "connector_tool"`
Kind of resource the permission applies to.
- `"connector_tool"`
- `ConnectorScope object { connector_id, scope, type }`
- `connector_id: string`
Cut at 300 lines. The page has the rest.
api/admin/rbac_roles/list First recorded · 95 lines, first recorded
## List RBAC Roles ### Query Parameters ### Header Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: List RBAC Roles
url: https://platform.claude.com/docs/en/api/admin/rbac_roles/list
---
## List RBAC Roles
**get** `/v1/organizations/rbac_roles`
List RBAC Roles in the organization.
The RBAC Roles API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.
### Query Parameters
- `limit: optional number`
Number of items to return per page.
Defaults to `20`. Ranges from `1` to `1000`.
- `page: optional string`
Optionally set to the `next_page` token from the previous response.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Returns
- `data: array of RbacRole`
- `id: string`
ID of the RBAC Role.
- `created_at: string`
RFC 3339 datetime string indicating when the RBAC Role was created.
- `name: string`
Name of the RBAC Role.
- `type: "rbac_role"`
Object type.
For RBAC Roles, this is always `"rbac_role"`.
- `"rbac_role"`
- `updated_at: string`
RFC 3339 datetime string indicating when the RBAC Role was last updated.
- `has_more: boolean`
Indicates whether there are more results beyond this page.
- `next_page: string or null`
Opaque cursor for the next page. Pass as the `page` parameter on the next
request.
### Example
```http
curl https://api.anthropic.com/v1/organizations/rbac_roles \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"data": [
{
"id": "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s",
"created_at": "2024-10-30T23:58:27.427722Z",
"name": "Project Editor",
"type": "rbac_role",
"updated_at": "2024-10-30T23:58:27.427722Z"
}
],
"has_more": true,
"next_page": "eyJjdXJzb3IiOiAicmJhY19yb2xlXzAxIn0"
}
```
api/admin/rbac_roles/permissions First recorded · 304 lines, first recorded
# Permissions ## List RBAC Role Permissions ### Path Parameters ### Query Parameters ### Header Parameters ### Returns ### Example #### Response ## Domain Types ### Rbac Role Permission
The first capture of this source. The page was already there, and this is what it said.
---
title: Permissions
url: https://platform.claude.com/docs/en/api/admin/rbac_roles/permissions
---
# Permissions
## List RBAC Role Permissions
**get** `/v1/organizations/rbac_roles/{role_id}/permissions`
List the permissions an RBAC Role grants.
The RBAC Roles API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.
### Path Parameters
- `role_id: string`
ID of the RBAC Role.
### Query Parameters
- `limit: optional number`
Number of items to return per page.
Defaults to `20`. Ranges from `1` to `1000`.
- `page: optional string`
Optionally set to the `next_page` token from the previous response.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Returns
- `data: array of RbacRolePermission`
- `action: string`
Action the permission grants on the resource.
The vocabulary follows the resource: an `organization` grant carries a
product-feature entitlement (for example `chat`), an admin-panel
permission entitlement (`permission_*`), or a blanket capability-access
mode — `capability_access_all` grants every product-feature entitlement,
and `capability_access_all_ga` grants the generally-available subset as
it stands at permission-check time; neither mode grants model-access
entitlements. A consumer enumerating a role's per-feature grants should
treat a blanket row as granting every product-feature entitlement it
covers, or it will under-report the role's effective access. A `connector_tool` grant carries
a tool-access action (`use` or `always_allow`); a `connector_scope` grant
carries the scope action `grant` (the role may receive the named OAuth
scope when tokens are minted for the connector); `connector` and
`all_connectors` grants carry a tool-access action, the scope action, or
an authentication-method action (`interactive` or `managed`).
- `resource: object { organization_id, type } or object { connector_id, tool_name, type } or object { connector_id, scope, type } or 2 more`
What the permission applies to.
A tagged union: `type` names the kind of resource and determines which
identifier fields are present.
- `Organization object { organization_id, type }`
- `organization_id: string`
UUID of the organization the permission applies to.
- `type: "organization"`
Kind of resource the permission applies to.
- `"organization"`
- `ConnectorTool object { connector_id, tool_name, type }`
- `connector_id: string`
ID of the connector the permission applies to.
- `tool_name: string`
Published name of the connector tool the permission applies to.
When the published name contains characters outside `[a-zA-Z0-9_-]` (or
collides with a reserved form), it is server-encoded into a stable
`{prefix}_{32-hex}` form — a shortened readable prefix of the name plus
a hash — from which the published name is not recoverable.
- `type: "connector_tool"`
Kind of resource the permission applies to.
- `"connector_tool"`
- `ConnectorScope object { connector_id, scope, type }`
- `connector_id: string`
ID of the connector the permission applies to.
- `scope: string`
OAuth scope the permission names — the role may receive this scope when
tokens are minted for the connector.
Subject to the same encoding rule as `tool_name`: a scope containing
characters outside `[a-zA-Z0-9_-]` (or colliding with a reserved form)
appears server-encoded in a stable `{prefix}_{32-hex}` form. OAuth
scopes routinely contain `:` and `/`, so most appear encoded.
- `type: "connector_scope"`
Kind of resource the permission applies to.
- `"connector_scope"`
- `Connector object { connector_id, type }`
- `connector_id: string`
ID of the connector the permission applies to.
- `type: "connector"`
Kind of resource the permission applies to.
- `"connector"`
- `AllConnectors object { type }`
- `type: "all_connectors"`
Kind of resource the permission applies to.
- `"all_connectors"`
- `type: "rbac_role_permission"`
Object type.
For RBAC Role Permissions, this is always `"rbac_role_permission"`.
- `"rbac_role_permission"`
- `has_more: boolean`
Indicates whether there are more results beyond this page.
- `next_page: string or null`
Opaque cursor for the next page. Pass as the `page` parameter on the next
request.
### Example
```http
curl https://api.anthropic.com/v1/organizations/rbac_roles/$ROLE_ID/permissions \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"data": [
{
"action": "use",
"resource": {
"organization_id": "3c4f5e6d-7a8b-49c0-9d1e-2f3a4b5c6d7e",
"type": "organization"
},
"type": "rbac_role_permission"
}
],
"has_more": true,
"next_page": "eyJjdXJzb3IiOiAicmJhY19yb2xlXzAxIn0"
}
```
## Domain Types
### Rbac Role Permission
- `RbacRolePermission object { action, resource, type }`
- `action: string`
Action the permission grants on the resource.
The vocabulary follows the resource: an `organization` grant carries a
product-feature entitlement (for example `chat`), an admin-panel
permission entitlement (`permission_*`), or a blanket capability-access
mode — `capability_access_all` grants every product-feature entitlement,
and `capability_access_all_ga` grants the generally-available subset as
it stands at permission-check time; neither mode grants model-access
entitlements. A consumer enumerating a role's per-feature grants should
treat a blanket row as granting every product-feature entitlement it
covers, or it will under-report the role's effective access. A `connector_tool` grant carries
a tool-access action (`use` or `always_allow`); a `connector_scope` grant
carries the scope action `grant` (the role may receive the named OAuth
scope when tokens are minted for the connector); `connector` and
`all_connectors` grants carry a tool-access action, the scope action, or
an authentication-method action (`interactive` or `managed`).
- `resource: object { organization_id, type } or object { connector_id, tool_name, type } or object { connector_id, scope, type } or 2 more`
What the permission applies to.
A tagged union: `type` names the kind of resource and determines which
identifier fields are present.
- `Organization object { organization_id, type }`
- `organization_id: string`
UUID of the organization the permission applies to.
- `type: "organization"`
Kind of resource the permission applies to.
- `"organization"`
- `ConnectorTool object { connector_id, tool_name, type }`
- `connector_id: string`
ID of the connector the permission applies to.
- `tool_name: string`
Published name of the connector tool the permission applies to.
When the published name contains characters outside `[a-zA-Z0-9_-]` (or
collides with a reserved form), it is server-encoded into a stable
`{prefix}_{32-hex}` form — a shortened readable prefix of the name plus
a hash — from which the published name is not recoverable.
- `type: "connector_tool"`
Kind of resource the permission applies to.
- `"connector_tool"`
- `ConnectorScope object { connector_id, scope, type }`
- `connector_id: string`
ID of the connector the permission applies to.
- `scope: string`
OAuth scope the permission names — the role may receive this scope when
tokens are minted for the connector.
Subject to the same encoding rule as `tool_name`: a scope containing
characters outside `[a-zA-Z0-9_-]` (or colliding with a reserved form)
appears server-encoded in a stable `{prefix}_{32-hex}` form. OAuth
scopes routinely contain `:` and `/`, so most appear encoded.
- `type: "connector_scope"`
Kind of resource the permission applies to.
- `"connector_scope"`
- `Connector object { connector_id, type }`
- `connector_id: string`
ID of the connector the permission applies to.
- `type: "connector"`
Kind of resource the permission applies to.
- `"connector"`
- `AllConnectors object { type }`
- `type: "all_connectors"`
Kind of resource the permission applies to.
- `"all_connectors"`
- `type: "rbac_role_permission"`
Object type.
Cut at 300 lines. The page has the rest.
api/admin/rbac_roles/permissions/list First recorded · 187 lines, first recorded
## List RBAC Role Permissions ### Path Parameters ### Query Parameters ### Header Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: List RBAC Role Permissions
url: https://platform.claude.com/docs/en/api/admin/rbac_roles/permissions/list
---
## List RBAC Role Permissions
**get** `/v1/organizations/rbac_roles/{role_id}/permissions`
List the permissions an RBAC Role grants.
The RBAC Roles API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.
### Path Parameters
- `role_id: string`
ID of the RBAC Role.
### Query Parameters
- `limit: optional number`
Number of items to return per page.
Defaults to `20`. Ranges from `1` to `1000`.
- `page: optional string`
Optionally set to the `next_page` token from the previous response.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Returns
- `data: array of RbacRolePermission`
- `action: string`
Action the permission grants on the resource.
The vocabulary follows the resource: an `organization` grant carries a
product-feature entitlement (for example `chat`), an admin-panel
permission entitlement (`permission_*`), or a blanket capability-access
mode — `capability_access_all` grants every product-feature entitlement,
and `capability_access_all_ga` grants the generally-available subset as
it stands at permission-check time; neither mode grants model-access
entitlements. A consumer enumerating a role's per-feature grants should
treat a blanket row as granting every product-feature entitlement it
covers, or it will under-report the role's effective access. A `connector_tool` grant carries
a tool-access action (`use` or `always_allow`); a `connector_scope` grant
carries the scope action `grant` (the role may receive the named OAuth
scope when tokens are minted for the connector); `connector` and
`all_connectors` grants carry a tool-access action, the scope action, or
an authentication-method action (`interactive` or `managed`).
- `resource: object { organization_id, type } or object { connector_id, tool_name, type } or object { connector_id, scope, type } or 2 more`
What the permission applies to.
A tagged union: `type` names the kind of resource and determines which
identifier fields are present.
- `Organization object { organization_id, type }`
- `organization_id: string`
UUID of the organization the permission applies to.
- `type: "organization"`
Kind of resource the permission applies to.
- `"organization"`
- `ConnectorTool object { connector_id, tool_name, type }`
- `connector_id: string`
ID of the connector the permission applies to.
- `tool_name: string`
Published name of the connector tool the permission applies to.
When the published name contains characters outside `[a-zA-Z0-9_-]` (or
collides with a reserved form), it is server-encoded into a stable
`{prefix}_{32-hex}` form — a shortened readable prefix of the name plus
a hash — from which the published name is not recoverable.
- `type: "connector_tool"`
Kind of resource the permission applies to.
- `"connector_tool"`
- `ConnectorScope object { connector_id, scope, type }`
- `connector_id: string`
ID of the connector the permission applies to.
- `scope: string`
OAuth scope the permission names — the role may receive this scope when
tokens are minted for the connector.
Subject to the same encoding rule as `tool_name`: a scope containing
characters outside `[a-zA-Z0-9_-]` (or colliding with a reserved form)
appears server-encoded in a stable `{prefix}_{32-hex}` form. OAuth
scopes routinely contain `:` and `/`, so most appear encoded.
- `type: "connector_scope"`
Kind of resource the permission applies to.
- `"connector_scope"`
- `Connector object { connector_id, type }`
- `connector_id: string`
ID of the connector the permission applies to.
- `type: "connector"`
Kind of resource the permission applies to.
- `"connector"`
- `AllConnectors object { type }`
- `type: "all_connectors"`
Kind of resource the permission applies to.
- `"all_connectors"`
- `type: "rbac_role_permission"`
Object type.
For RBAC Role Permissions, this is always `"rbac_role_permission"`.
- `"rbac_role_permission"`
- `has_more: boolean`
Indicates whether there are more results beyond this page.
- `next_page: string or null`
Opaque cursor for the next page. Pass as the `page` parameter on the next
request.
### Example
```http
curl https://api.anthropic.com/v1/organizations/rbac_roles/$ROLE_ID/permissions \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"data": [
{
"action": "use",
"resource": {
"organization_id": "3c4f5e6d-7a8b-49c0-9d1e-2f3a4b5c6d7e",
"type": "organization"
},
"type": "rbac_role_permission"
}
],
"has_more": true,
"next_page": "eyJjdXJzb3IiOiAicmJhY19yb2xlXzAxIn0"
}
```
api/admin/rbac_roles/retrieve First recorded · 74 lines, first recorded
## Get RBAC Role ### Path Parameters ### Header Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Get RBAC Role
url: https://platform.claude.com/docs/en/api/admin/rbac_roles/retrieve
---
## Get RBAC Role
**get** `/v1/organizations/rbac_roles/{role_id}`
Retrieve an RBAC Role by ID.
The RBAC Roles API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.
### Path Parameters
- `role_id: string`
ID of the RBAC Role.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Returns
- `RbacRole object { id, created_at, name, 2 more }`
- `id: string`
ID of the RBAC Role.
- `created_at: string`
RFC 3339 datetime string indicating when the RBAC Role was created.
- `name: string`
Name of the RBAC Role.
- `type: "rbac_role"`
Object type.
For RBAC Roles, this is always `"rbac_role"`.
- `"rbac_role"`
- `updated_at: string`
RFC 3339 datetime string indicating when the RBAC Role was last updated.
### Example
```http
curl https://api.anthropic.com/v1/organizations/rbac_roles/$ROLE_ID \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"id": "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s",
"created_at": "2024-10-30T23:58:27.427722Z",
"name": "Project Editor",
"type": "rbac_role",
"updated_at": "2024-10-30T23:58:27.427722Z"
}
```
api/admin/service_accounts First recorded · 1030 lines, first recorded
# Service Accounts ## Create Service Account ### Header Parameters ### Body Parameters ### Returns ### Example #### Response ## Get Service Account ### Path Parameters ### Header Parameters ### Returns ### Example #### Response ## List Service Accounts ### Query Parameters ### Header Parameters ### Returns ### Example #### Response ## Update Service Account ### Path Parameters ### Header Parameters ### Body Parameters ### Returns ### Example #### Response ## Archive Service Account ### Path Parameters ### Header Parameters ### Returns ### Example #### Response ## Domain Types ### Service Account # Workspaces ## Add Workspace To Service Account ### Path Parameters ### Header Parameters ### Body Parameters ### Returns ### Example #### Response ## List Workspaces For Service Account ### Path Parameters ### Query Parameters ### Header Parameters ### Returns ### Example #### Response ## Remove Workspace From Service Account ### Path Parameters ### Header Parameters ### Returns ### Example #### Response ## Domain Types ### Workspace Create Response ### Workspace List Response ### Workspace Delete Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Service Accounts
url: https://platform.claude.com/docs/en/api/admin/service_accounts
---
# Service Accounts
## Create Service Account
**post** `/v1/organizations/service_accounts`
Create a service account.
A service account is a named workload identity that federation rules
target. `organization_role` is `developer` (default) or `admin`; a rule
may only be created or retargeted to grant `org:admin` scope when the
target's `organization_role` is `admin`. Requires an OAuth bearer (user
or WIF-minted service account token) or a Console session; Admin API
keys are not accepted. Creating an `admin`-role service account requires
an interactive credential (a user OAuth token or a Console session) — a
workload may only create `developer`-role service accounts.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Body Parameters
- `name: string`
Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
- `description: optional string or null`
Optional free-text description.
- `organization_role: optional "admin" or "developer"`
Org-level role. Defaults to `developer`.
- `"admin"`
- `"developer"`
### Returns
- `ServiceAccount object { id, archived_at, archived_by_actor_id, 8 more }`
Named non-human identity within the caller's organization.
A service account is a pure identity: name + org. Authorization lives on
whatever references it (federation rules).
- `id: string`
Tagged ID of the service account.
- `archived_at: string or null`
If set, this service account is archived.
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this service account.
- `created_at: string`
When this service account was created.
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this service account.
- `description: string or null`
Optional free-text description.
- `name: string`
Admin-chosen slug identifier.
- `organization_role: "admin" or "developer"`
Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console.
- `"admin"`
- `"developer"`
- `type: "service_account"`
- `"service_account"`
- `updated_at: string`
When this service account was last updated.
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this service account.
### Example
```http
curl https://api.anthropic.com/v1/organizations/service_accounts \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
-d '{
"name": "ci-deploy-bot"
}'
```
#### Response
```json
{
"id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"description": "description",
"name": "ci-deploy-bot",
"organization_role": "admin",
"type": "service_account",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id"
}
```
## Get Service Account
**get** `/v1/organizations/service_accounts/{service_account_id}`
Retrieve a service account by its ID (`svac_...`).
### Path Parameters
- `service_account_id: string`
ID of the service account.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Returns
- `ServiceAccount object { id, archived_at, archived_by_actor_id, 8 more }`
Named non-human identity within the caller's organization.
A service account is a pure identity: name + org. Authorization lives on
whatever references it (federation rules).
- `id: string`
Tagged ID of the service account.
- `archived_at: string or null`
If set, this service account is archived.
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this service account.
- `created_at: string`
When this service account was created.
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this service account.
- `description: string or null`
Optional free-text description.
- `name: string`
Admin-chosen slug identifier.
- `organization_role: "admin" or "developer"`
Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console.
- `"admin"`
- `"developer"`
- `type: "service_account"`
- `"service_account"`
- `updated_at: string`
When this service account was last updated.
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this service account.
### Example
```http
curl https://api.anthropic.com/v1/organizations/service_accounts/$SERVICE_ACCOUNT_ID \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"description": "description",
"name": "ci-deploy-bot",
"organization_role": "admin",
"type": "service_account",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id"
}
```
## List Service Accounts
**get** `/v1/organizations/service_accounts`
List service accounts in the caller's organization.
Results are ordered by creation time, newest first. Use `limit` and the
`next_page` cursor to paginate; set `include_archived=true` to include
archived service accounts.
### Query Parameters
- `include_archived: optional boolean`
Include archived resources. Defaults to false.
- `limit: optional number`
Number of results per page.
- `page: optional string`
Opaque cursor from a previous response's `next_page`.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Returns
- `data: array of ServiceAccount`
- `id: string`
Tagged ID of the service account.
- `archived_at: string or null`
If set, this service account is archived.
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this service account.
- `created_at: string`
When this service account was created.
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this service account.
- `description: string or null`
Optional free-text description.
- `name: string`
Cut at 300 lines. The page has the rest.
api/admin/service_accounts/archive First recorded · 116 lines, first recorded
## Archive Service Account ### Path Parameters ### Header Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Archive Service Account
url: https://platform.claude.com/docs/en/api/admin/service_accounts/archive
---
## Archive Service Account
**post** `/v1/organizations/service_accounts/{service_account_id}/archive`
Archive a service account.
Idempotent; re-archiving returns the service account with its original
`archived_at`. Rejected with 400 if any live (non-archived) federation
rule still targets this service account, same as issuer archival; archive
those rules first or change their target to another service account.
Requires an OAuth bearer or Console session; Admin API keys are not
accepted.
### Path Parameters
- `service_account_id: string`
ID of the service account to archive.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Returns
- `ServiceAccount object { id, archived_at, archived_by_actor_id, 8 more }`
Named non-human identity within the caller's organization.
A service account is a pure identity: name + org. Authorization lives on
whatever references it (federation rules).
- `id: string`
Tagged ID of the service account.
- `archived_at: string or null`
If set, this service account is archived.
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this service account.
- `created_at: string`
When this service account was created.
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this service account.
- `description: string or null`
Optional free-text description.
- `name: string`
Admin-chosen slug identifier.
- `organization_role: "admin" or "developer"`
Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console.
- `"admin"`
- `"developer"`
- `type: "service_account"`
- `"service_account"`
- `updated_at: string`
When this service account was last updated.
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this service account.
### Example
```http
curl https://api.anthropic.com/v1/organizations/service_accounts/$SERVICE_ACCOUNT_ID/archive \
-X POST \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"description": "description",
"name": "ci-deploy-bot",
"organization_role": "admin",
"type": "service_account",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id"
}
```
api/admin/service_accounts/create First recorded · 132 lines, first recorded
## Create Service Account ### Header Parameters ### Body Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Create Service Account
url: https://platform.claude.com/docs/en/api/admin/service_accounts/create
---
## Create Service Account
**post** `/v1/organizations/service_accounts`
Create a service account.
A service account is a named workload identity that federation rules
target. `organization_role` is `developer` (default) or `admin`; a rule
may only be created or retargeted to grant `org:admin` scope when the
target's `organization_role` is `admin`. Requires an OAuth bearer (user
or WIF-minted service account token) or a Console session; Admin API
keys are not accepted. Creating an `admin`-role service account requires
an interactive credential (a user OAuth token or a Console session) — a
workload may only create `developer`-role service accounts.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Body Parameters
- `name: string`
Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
- `description: optional string or null`
Optional free-text description.
- `organization_role: optional "admin" or "developer"`
Org-level role. Defaults to `developer`.
- `"admin"`
- `"developer"`
### Returns
- `ServiceAccount object { id, archived_at, archived_by_actor_id, 8 more }`
Named non-human identity within the caller's organization.
A service account is a pure identity: name + org. Authorization lives on
whatever references it (federation rules).
- `id: string`
Tagged ID of the service account.
- `archived_at: string or null`
If set, this service account is archived.
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this service account.
- `created_at: string`
When this service account was created.
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this service account.
- `description: string or null`
Optional free-text description.
- `name: string`
Admin-chosen slug identifier.
- `organization_role: "admin" or "developer"`
Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console.
- `"admin"`
- `"developer"`
- `type: "service_account"`
- `"service_account"`
- `updated_at: string`
When this service account was last updated.
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this service account.
### Example
```http
curl https://api.anthropic.com/v1/organizations/service_accounts \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
-d '{
"name": "ci-deploy-bot"
}'
```
#### Response
```json
{
"id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"description": "description",
"name": "ci-deploy-bot",
"organization_role": "admin",
"type": "service_account",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id"
}
```
api/admin/service_accounts/list First recorded · 123 lines, first recorded
## List Service Accounts ### Query Parameters ### Header Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: List Service Accounts
url: https://platform.claude.com/docs/en/api/admin/service_accounts/list
---
## List Service Accounts
**get** `/v1/organizations/service_accounts`
List service accounts in the caller's organization.
Results are ordered by creation time, newest first. Use `limit` and the
`next_page` cursor to paginate; set `include_archived=true` to include
archived service accounts.
### Query Parameters
- `include_archived: optional boolean`
Include archived resources. Defaults to false.
- `limit: optional number`
Number of results per page.
- `page: optional string`
Opaque cursor from a previous response's `next_page`.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Returns
- `data: array of ServiceAccount`
- `id: string`
Tagged ID of the service account.
- `archived_at: string or null`
If set, this service account is archived.
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this service account.
- `created_at: string`
When this service account was created.
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this service account.
- `description: string or null`
Optional free-text description.
- `name: string`
Admin-chosen slug identifier.
- `organization_role: "admin" or "developer"`
Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console.
- `"admin"`
- `"developer"`
- `type: "service_account"`
- `"service_account"`
- `updated_at: string`
When this service account was last updated.
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this service account.
- `next_page: string or null`
Opaque cursor for the next page, or null if no more results.
### Example
```http
curl https://api.anthropic.com/v1/organizations/service_accounts \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"data": [
{
"id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"description": "description",
"name": "ci-deploy-bot",
"organization_role": "admin",
"type": "service_account",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id"
}
],
"next_page": "next_page"
}
```
api/admin/service_accounts/retrieve First recorded · 107 lines, first recorded
## Get Service Account ### Path Parameters ### Header Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Get Service Account
url: https://platform.claude.com/docs/en/api/admin/service_accounts/retrieve
---
## Get Service Account
**get** `/v1/organizations/service_accounts/{service_account_id}`
Retrieve a service account by its ID (`svac_...`).
### Path Parameters
- `service_account_id: string`
ID of the service account.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Returns
- `ServiceAccount object { id, archived_at, archived_by_actor_id, 8 more }`
Named non-human identity within the caller's organization.
A service account is a pure identity: name + org. Authorization lives on
whatever references it (federation rules).
- `id: string`
Tagged ID of the service account.
- `archived_at: string or null`
If set, this service account is archived.
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this service account.
- `created_at: string`
When this service account was created.
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this service account.
- `description: string or null`
Optional free-text description.
- `name: string`
Admin-chosen slug identifier.
- `organization_role: "admin" or "developer"`
Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console.
- `"admin"`
- `"developer"`
- `type: "service_account"`
- `"service_account"`
- `updated_at: string`
When this service account was last updated.
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this service account.
### Example
```http
curl https://api.anthropic.com/v1/organizations/service_accounts/$SERVICE_ACCOUNT_ID \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"description": "description",
"name": "ci-deploy-bot",
"organization_role": "admin",
"type": "service_account",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id"
}
```
api/admin/service_accounts/update First recorded · 129 lines, first recorded
## Update Service Account ### Path Parameters ### Header Parameters ### Body Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Update Service Account
url: https://platform.claude.com/docs/en/api/admin/service_accounts/update
---
## Update Service Account
**post** `/v1/organizations/service_accounts/{service_account_id}`
Update a service account.
Only `description` and `organization_role` are mutable; `name` cannot be
changed. Archived service accounts cannot be updated; this returns 400.
Setting `organization_role` to `admin` (even when unchanged) requires an
interactive credential (a user OAuth token or a Console session). Admin
API keys are not accepted.
### Path Parameters
- `service_account_id: string`
ID of the service account to update.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Body Parameters
- `description: optional string or null`
Replaces the description. Omit to leave unchanged; send `null` to clear (the field is stored as an empty string).
- `organization_role: optional "admin" or "developer" or null`
Replaces the org-level role. Omit or send `null` to leave unchanged.
- `"admin"`
- `"developer"`
### Returns
- `ServiceAccount object { id, archived_at, archived_by_actor_id, 8 more }`
Named non-human identity within the caller's organization.
A service account is a pure identity: name + org. Authorization lives on
whatever references it (federation rules).
- `id: string`
Tagged ID of the service account.
- `archived_at: string or null`
If set, this service account is archived.
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this service account.
- `created_at: string`
When this service account was created.
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this service account.
- `description: string or null`
Optional free-text description.
- `name: string`
Admin-chosen slug identifier.
- `organization_role: "admin" or "developer"`
Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console.
- `"admin"`
- `"developer"`
- `type: "service_account"`
- `"service_account"`
- `updated_at: string`
When this service account was last updated.
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this service account.
### Example
```http
curl https://api.anthropic.com/v1/organizations/service_accounts/$SERVICE_ACCOUNT_ID \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
-d '{}'
```
#### Response
```json
{
"id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"description": "description",
"name": "ci-deploy-bot",
"organization_role": "admin",
"type": "service_account",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id"
}
```
api/admin/service_accounts/workspaces First recorded · 382 lines, first recorded
# Workspaces ## Add Workspace To Service Account ### Path Parameters ### Header Parameters ### Body Parameters ### Returns ### Example #### Response ## List Workspaces For Service Account ### Path Parameters ### Query Parameters ### Header Parameters ### Returns ### Example #### Response ## Remove Workspace From Service Account ### Path Parameters ### Header Parameters ### Returns ### Example #### Response ## Domain Types ### Workspace Create Response ### Workspace List Response ### Workspace Delete Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Workspaces
url: https://platform.claude.com/docs/en/api/admin/service_accounts/workspaces
---
# Workspaces
## Add Workspace To Service Account
**post** `/v1/organizations/service_accounts/{service_account_id}/workspaces`
Add a service account to a workspace with the given `workspace_role`.
Mirror of `POST /workspaces/{workspace_id}/service_accounts`, addressed
from the service-account side; both create the same membership. If the
service account is already an explicit member of the workspace, its
`workspace_role` is replaced with the value supplied here. Archived
workspaces return 400. Archived service accounts cannot be added and are
rejected. Requires an OAuth bearer or Console session; Admin API keys
are not accepted.
### Path Parameters
- `service_account_id: string`
ID of the service account.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Body Parameters
- `workspace_id: string`
Tagged workspace ID to add the service account to.
- `workspace_role: "workspace_admin" or "workspace_developer" or "workspace_restricted_developer" or "workspace_user"`
Role to assign to the service account in this workspace.
- `"workspace_admin"`
- `"workspace_developer"`
- `"workspace_restricted_developer"`
- `"workspace_user"`
### Returns
- `created_by_actor_id: string or null`
Tagged ID (`user_...`/`svac_...`) of the actor who created this membership.
- `implicit: boolean or null`
True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role workspace_user and cannot be removed.
- `service_account_id: string`
Tagged service account ID (`svac_...`).
- `type: "service_account_workspace_member"`
- `"service_account_workspace_member"`
- `workspace_id: string`
Tagged workspace ID (`wrkspc_...`).
- `workspace_role: "workspace_admin" or "workspace_billing" or "workspace_developer" or 2 more`
Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role.
- `"workspace_admin"`
- `"workspace_billing"`
- `"workspace_developer"`
- `"workspace_restricted_developer"`
- `"workspace_user"`
### Example
```http
curl https://api.anthropic.com/v1/organizations/service_accounts/$SERVICE_ACCOUNT_ID/workspaces \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
-d '{
"workspace_id": "workspace_id",
"workspace_role": "workspace_admin"
}'
```
#### Response
```json
{
"created_by_actor_id": "created_by_actor_id",
"implicit": true,
"service_account_id": "service_account_id",
"type": "service_account_workspace_member",
"workspace_id": "workspace_id",
"workspace_role": "workspace_admin"
}
```
## List Workspaces For Service Account
**get** `/v1/organizations/service_accounts/{service_account_id}/workspaces`
List the workspaces a service account is a member of.
Each entry includes the service account's `workspace_role` in that
workspace. Use `limit` and the `next_page` cursor to paginate. When the
service account has no explicit default-workspace membership, the
implicit (`implicit: true`) membership is returned as the first entry on
the first page; with `limit=1` the first page may return up to 2 entries
(the implicit entry plus one explicit membership) so a pagination cursor
can be derived. Memberships are returned only while
the service account is active; an archived service account returns an
empty list.
### Path Parameters
- `service_account_id: string`
ID of the service account.
### Query Parameters
- `limit: optional number`
Number of results per page.
- `page: optional string`
Opaque cursor from a previous response's `next_page`.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Returns
- `data: array of object { created_by_actor_id, implicit, service_account_id, 3 more }`
- `created_by_actor_id: string or null`
Tagged ID (`user_...`/`svac_...`) of the actor who created this membership.
- `implicit: boolean or null`
True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role workspace_user and cannot be removed.
- `service_account_id: string`
Tagged service account ID (`svac_...`).
- `type: "service_account_workspace_member"`
- `"service_account_workspace_member"`
- `workspace_id: string`
Tagged workspace ID (`wrkspc_...`).
- `workspace_role: "workspace_admin" or "workspace_billing" or "workspace_developer" or 2 more`
Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role.
- `"workspace_admin"`
- `"workspace_billing"`
- `"workspace_developer"`
- `"workspace_restricted_developer"`
- `"workspace_user"`
- `next_page: string or null`
Opaque cursor for the next page, or null if no more results.
### Example
```http
curl https://api.anthropic.com/v1/organizations/service_accounts/$SERVICE_ACCOUNT_ID/workspaces \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"data": [
{
"created_by_actor_id": "created_by_actor_id",
"implicit": true,
"service_account_id": "service_account_id",
"type": "service_account_workspace_member",
"workspace_id": "workspace_id",
"workspace_role": "workspace_admin"
}
],
"next_page": "next_page"
}
```
## Remove Workspace From Service Account
**delete** `/v1/organizations/service_accounts/{service_account_id}/workspaces/{workspace_id}`
Remove a service account from a workspace.
Mirror of `DELETE /workspaces/{workspace_id}/service_accounts/{service_account_id}`,
addressed from the service-account side. Removal is idempotent (returns
200 even if the membership was already removed). A DELETE against the
implicit default-workspace membership returns 200 but is a no-op and the
membership persists; deleting an explicit default-workspace row reverts
to the implicit `workspace_user` membership. Archived workspaces return
400. Requires an OAuth bearer or Console session; Admin API keys are not
accepted.
### Path Parameters
- `service_account_id: string`
ID of the service account.
- `workspace_id: string`
ID of the workspace.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Returns
- `service_account_id: string`
Tagged service account ID (`svac_...`) named in the delete request. Removal is idempotent; see the endpoint description for the implicit-membership no-op.
- `type: "service_account_workspace_member_deleted"`
- `"service_account_workspace_member_deleted"`
- `workspace_id: string`
Tagged workspace ID (`wrkspc_...`) named in the delete request.
### Example
```http
curl https://api.anthropic.com/v1/organizations/service_accounts/$SERVICE_ACCOUNT_ID/workspaces/$WORKSPACE_ID \
-X DELETE \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"service_account_id": "service_account_id",
"type": "service_account_workspace_member_deleted",
"workspace_id": "workspace_id"
}
```
## Domain Types
### Workspace Create Response
- `WorkspaceCreateResponse object { created_by_actor_id, implicit, service_account_id, 3 more }`
- `created_by_actor_id: string or null`
Tagged ID (`user_...`/`svac_...`) of the actor who created this membership.
- `implicit: boolean or null`
Cut at 300 lines. The page has the rest.
api/admin/service_accounts/workspaces/create First recorded · 112 lines, first recorded
## Add Workspace To Service Account ### Path Parameters ### Header Parameters ### Body Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Add Workspace To Service Account
url: https://platform.claude.com/docs/en/api/admin/service_accounts/workspaces/create
---
## Add Workspace To Service Account
**post** `/v1/organizations/service_accounts/{service_account_id}/workspaces`
Add a service account to a workspace with the given `workspace_role`.
Mirror of `POST /workspaces/{workspace_id}/service_accounts`, addressed
from the service-account side; both create the same membership. If the
service account is already an explicit member of the workspace, its
`workspace_role` is replaced with the value supplied here. Archived
workspaces return 400. Archived service accounts cannot be added and are
rejected. Requires an OAuth bearer or Console session; Admin API keys
are not accepted.
### Path Parameters
- `service_account_id: string`
ID of the service account.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Body Parameters
- `workspace_id: string`
Tagged workspace ID to add the service account to.
- `workspace_role: "workspace_admin" or "workspace_developer" or "workspace_restricted_developer" or "workspace_user"`
Role to assign to the service account in this workspace.
- `"workspace_admin"`
- `"workspace_developer"`
- `"workspace_restricted_developer"`
- `"workspace_user"`
### Returns
- `created_by_actor_id: string or null`
Tagged ID (`user_...`/`svac_...`) of the actor who created this membership.
- `implicit: boolean or null`
True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role workspace_user and cannot be removed.
- `service_account_id: string`
Tagged service account ID (`svac_...`).
- `type: "service_account_workspace_member"`
- `"service_account_workspace_member"`
- `workspace_id: string`
Tagged workspace ID (`wrkspc_...`).
- `workspace_role: "workspace_admin" or "workspace_billing" or "workspace_developer" or 2 more`
Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role.
- `"workspace_admin"`
- `"workspace_billing"`
- `"workspace_developer"`
- `"workspace_restricted_developer"`
- `"workspace_user"`
### Example
```http
curl https://api.anthropic.com/v1/organizations/service_accounts/$SERVICE_ACCOUNT_ID/workspaces \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
-d '{
"workspace_id": "workspace_id",
"workspace_role": "workspace_admin"
}'
```
#### Response
```json
{
"created_by_actor_id": "created_by_actor_id",
"implicit": true,
"service_account_id": "service_account_id",
"type": "service_account_workspace_member",
"workspace_id": "workspace_id",
"workspace_role": "workspace_admin"
}
```
api/admin/service_accounts/workspaces/delete First recorded · 70 lines, first recorded
## Remove Workspace From Service Account ### Path Parameters ### Header Parameters ### Returns ### Example #### Response
The first capture of this source. The page was already there, and this is what it said.
---
title: Remove Workspace From Service Account
url: https://platform.claude.com/docs/en/api/admin/service_accounts/workspaces/delete
---
## Remove Workspace From Service Account
**delete** `/v1/organizations/service_accounts/{service_account_id}/workspaces/{workspace_id}`
Remove a service account from a workspace.
Mirror of `DELETE /workspaces/{workspace_id}/service_accounts/{service_account_id}`,
addressed from the service-account side. Removal is idempotent (returns
200 even if the membership was already removed). A DELETE against the
implicit default-workspace membership returns 200 but is a no-op and the
membership persists; deleting an explicit default-workspace row reverts
to the implicit `workspace_user` membership. Archived workspaces return
400. Requires an OAuth bearer or Console session; Admin API keys are not
accepted.
### Path Parameters
- `service_account_id: string`
ID of the service account.
- `workspace_id: string`
ID of the workspace.
### Header Parameters
- `"anthropic-beta": optional array of string`
Optional header to specify the beta version(s) you want to use.
To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
### Returns
- `service_account_id: string`
Tagged service account ID (`svac_...`) named in the delete request. Removal is idempotent; see the endpoint description for the implicit-membership no-op.
- `type: "service_account_workspace_member_deleted"`
- `"service_account_workspace_member_deleted"`
- `workspace_id: string`
Tagged workspace ID (`wrkspc_...`) named in the delete request.
### Example
```http
curl https://api.anthropic.com/v1/organizations/service_accounts/$SERVICE_ACCOUNT_ID/workspaces/$WORKSPACE_ID \
-X DELETE \
-H 'anthropic-version: 2023-06-01' \
-H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
```
#### Response
```json
{
"service_account_id": "service_account_id",
"type": "service_account_workspace_member_deleted",
"workspace_id": "workspace_id"
}
```