One read of Claude Developer Platformapi-20260825T033708Z
377 pages moved out of 612 read.
Pages moved
377
significant first
Pages read
612
in this capture
Captured
03:37 UTC
Corpus hash
7d98cae5bb87
corpus-hash
What this read moved
26-50 of 377, page 2 of 16This capture is too large to show at once. Changes 26-50 of 377 are below, significant first; the rest are on the following screens.
api/admin/cost_report Changed · +21 / -20 lines
### Query parameters ### Headers #### Response (200) ## Domain types ### Query Parameters ### Header Parameters #### Response ## Domain Types
from line 1
1---
2title: Cost Report
3url: https://platform.claude.com/docs/en/api/admin/cost_report
4---
5
61# Cost Report
72
83## Get Cost Report
94
10**get** `/v1/organizations/cost_report`
5**GET** `/v1/organizations/cost_report`
116
127Get Cost Report
138
14### Query Parameters
9### Query parameters
1510
1611- `starting_at: string`
1712
from line 13
1813 Time buckets that start on or after this RFC 3339 timestamp will be returned.
1914 Each time bucket will be snapped to the start of the minute/hour/day in UTC.
2015
16 format: date-time
17
2118- `bucket_width: optional "1d"`
2219
2320 Time granularity of the response data.
2421
25 - `"1d"`
22 default: 1d
2623
2724- `ending_at: optional string`
2825
2926 Time buckets that end before this RFC 3339 timestamp will be returned.
3027
28 format: date-time
29
3130- `group_by: optional array of "description" or "workspace_id"`
3231
3332 Group by any subset of the available options.
from line 39
4039
4140 Maximum number of time buckets to return in the response.
4241
42 default: 7, maximum: 31, minimum: 1
43
4344- `page: optional string`
4445
4546 Optionally set to the `next_page` token from the previous response.
4647
47### Header Parameters
48### Headers
4849
4950- `"anthropic-beta": optional array of string`
5051
from line 55
5455
5556### Returns
5657
57- `CostReport object { data, has_more, next_page }`
58- `CostReport object`
5859
59 - `data: array of object { ending_at, results, starting_at }`
60 - `data: array of object`
6061
6162 List of time buckets for this page, oldest first: one per `bucket_width` interval, including intervals with no costs (their `results` list is empty). A page holds at most `limit` buckets.
6263
from line 65
6465
6566 End of the time bucket (exclusive) in RFC 3339 format.
6667
67 - `results: array of object { amount, context_window, cost_type, 7 more }`
68 - `results: array of object`
6869
6970 List of cost items for this time bucket. There may be multiple items if one or more `group_by[]` parameters are specified.
7071
from line 156
155156
156157### Example
157158
158```http
159```bash
159160curl https://api.anthropic.com/v1/organizations/cost_report \
160161 -H 'anthropic-version: 2023-06-01' \
161162 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
162163```
163164
164#### Response
165#### Response (200)
165166
166167```json
167168{
from line 191
190191}
191192```
192193
193## Domain Types
194## Domain types
194195
195196### Cost Report
196197
197- `CostReport object { data, has_more, next_page }`
198- `CostReport object`
198199
199 - `data: array of object { ending_at, results, starting_at }`
200 - `data: array of object`
200201
201202 List of time buckets for this page, oldest first: one per `bucket_width` interval, including intervals with no costs (their `results` list is empty). A page holds at most `limit` buckets.
202203
from line 205
204205
205206 End of the time bucket (exclusive) in RFC 3339 format.
206207
207 - `results: array of object { amount, context_window, cost_type, 7 more }`
208 - `results: array of object`
208209
209210 List of cost items for this time bucket. There may be multiple items if one or more `group_by[]` parameters are specified.
210211
api/admin/cost_report/retrieve Changed · +18 / -17 lines
# Get Cost Report ## Query parameters ## Headers ## Returns ## Example ### Response (200) ## Get Cost Report ### Query Parameters ### Header Parameters ### Returns ### Example #### Response
from line 1
1---
2title: Get Cost Report
3url: https://platform.claude.com/docs/en/api/admin/cost_report/retrieve
4---
1# Get Cost Report
52
6## Get Cost Report
3**GET** `/v1/organizations/cost_report`
74
8**get** `/v1/organizations/cost_report`
9
105Get Cost Report
116
12### Query Parameters
7## Query parameters
138
149- `starting_at: string`
1510
from line 11
1611 Time buckets that start on or after this RFC 3339 timestamp will be returned.
1712 Each time bucket will be snapped to the start of the minute/hour/day in UTC.
1813
14 format: date-time
15
1916- `bucket_width: optional "1d"`
2017
2118 Time granularity of the response data.
2219
23 - `"1d"`
20 default: 1d
2421
2522- `ending_at: optional string`
2623
2724 Time buckets that end before this RFC 3339 timestamp will be returned.
2825
26 format: date-time
27
2928- `group_by: optional array of "description" or "workspace_id"`
3029
3130 Group by any subset of the available options.
from line 37
3837
3938 Maximum number of time buckets to return in the response.
4039
40 default: 7, maximum: 31, minimum: 1
41
4142- `page: optional string`
4243
4344 Optionally set to the `next_page` token from the previous response.
4445
45### Header Parameters
46## Headers
4647
4748- `"anthropic-beta": optional array of string`
4849
from line 51
5051
5152 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
5253
53### Returns
54## Returns
5455
55- `CostReport object { data, has_more, next_page }`
56- `CostReport object`
5657
57 - `data: array of object { ending_at, results, starting_at }`
58 - `data: array of object`
5859
5960 List of time buckets for this page, oldest first: one per `bucket_width` interval, including intervals with no costs (their `results` list is empty). A page holds at most `limit` buckets.
6061
from line 63
6263
6364 End of the time bucket (exclusive) in RFC 3339 format.
6465
65 - `results: array of object { amount, context_window, cost_type, 7 more }`
66 - `results: array of object`
6667
6768 List of cost items for this time bucket. There may be multiple items if one or more `group_by[]` parameters are specified.
6869
from line 152
151152
152153 Opaque cursor for the next page, or `null` when `has_more` is false. Pass it as the `page` parameter in the next request.
153154
154### Example
155## Example
155156
156```http
157```bash
157158curl https://api.anthropic.com/v1/organizations/cost_report \
158159 -H 'anthropic-version: 2023-06-01' \
159160 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
160161```
161162
162#### Response
163### Response (200)
163164
164165```json
165166{
api/admin/external_keys Changed · +220 / -203 lines
### Body parameters #### Response (200) ### Query parameters #### Response (200) ### Path parameters #### Response (200) ### Path parameters ### Body parameters #### Response (200) ### Path parameters #### Response (200) ### Path parameters #### Response (200) ## Domain types ### Body Parameters #### Response ### Query Parameters #### Response ### Path Parameters #### Response ### Path Parameters ### Body Parameters #### Response ### Path Parameters #### Response ### Path Parameters #### Response ## Domain Types
The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.
from line 1
1---
2title: External Keys
3url: https://platform.claude.com/docs/en/api/admin/external_keys
4---
5
61# External Keys
72
83## Create External Key
94
10**post** `/v1/organizations/external_keys`
5**POST** `/v1/organizations/external_keys`
116
127Create an external key config owned by the caller's organization.
138
14### Body Parameters
15
16- `provider_config: object { kms_arn, type, region, role_arn } or object { key_name, type } or object { key_name, tenant_id, type, 2 more }`
9### Body parameters
10
11- `provider_config: object or object or object`
1712
1813 KMS provider identity and auth coordinates.
1914
20 - `Aws object { kms_arn, type, region, role_arn }`
15 - `Aws object`
2116
2217 - `kms_arn: string`
2318
2419 Full ARN of the AWS KMS key.
2520
21 maxLength: 2048
22
2623 - `type: "aws"`
2724
28 - `"aws"`
29
3025 - `region: optional string or null`
3126
3227 AWS region. Derived from kms_arn if omitted.
3328
3429 - `role_arn: optional string or null`
3530
31 **Deprecated**
32
3633 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
3734
38 - `Gcp object { key_name, type }`
35 - `Gcp object`
3936
4037 - `key_name: string`
4138
from line 40
4340
4441 - `type: "gcp"`
4542
46 - `"gcp"`
47
48 - `Azure object { key_name, tenant_id, type, 2 more }`
43 - `Azure object`
4944
5045 Azure Key Vault provider configuration.
5146
from line 54
5954
6055 - `type: "azure"`
6156
62 - `"azure"`
63
6457 - `vault_uri: string`
6558
6659 Key Vault data-plane URI — https://<vault-name>.vault.azure.net or https://<hsm-name>.managedhsm.azure.net.
from line 66
7366
7467 Human-friendly display name.
7568
69 maxLength: 255, minLength: 1
70
7671- `geo: optional "us"`
7772
7873 Data residency geo. Only `us` is supported.
7974
80 - `"us"`
81
8275### Returns
8376
8477- `id: string`
8578
8679 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
8780
88- `attachment: object { type } or object { type }`
81- `attachment: object or object`
8982
9083 Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
9184
92 - `Attached object { type }`
85 - `Attached object`
9386
9487 - `type: "attached"`
9588
96 - `"attached"`
97
98 - `Unattached object { type }`
89 default: attached
90
91 - `Unattached object`
9992
10093 - `type: "unattached"`
10194
102 - `"unattached"`
95 default: unattached
10396
10497- `created_at: string`
10598
99 format: date-time
100
106101- `display_name: string or null`
107102
108103 Human-friendly display name. Null if none was set.
from line 106
111106
112107 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
113108
114- `provider_config: object { kms_arn, type, region, role_arn } or object { key_name, type } or object { key_name, tenant_id, type, 2 more }`
109- `provider_config: object or object or object`
115110
116111 KMS provider identity and auth coordinates.
117112
118 - `Aws object { kms_arn, type, region, role_arn }`
113 - `Aws object`
119114
120115 - `kms_arn: string`
121116
122117 Full ARN of the AWS KMS key.
123118
119 maxLength: 2048
120
124121 - `type: "aws"`
125122
126 - `"aws"`
127
128123 - `region: optional string or null`
129124
130125 AWS region. Derived from kms_arn if omitted.
131126
132127 - `role_arn: optional string or null`
133128
129 **Deprecated**
130
134131 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
135132
136 - `Gcp object { key_name, type }`
133 - `Gcp object`
137134
138135 - `key_name: string`
139136
from line 138
141138
142139 - `type: "gcp"`
143140
144 - `"gcp"`
145
146 - `Azure object { key_name, tenant_id, type, 2 more }`
141 - `Azure object`
147142
148143 - `key_name: string`
149144
from line 150
155150
156151 - `type: "azure"`
157152
158 - `"azure"`
159
160153 - `vault_uri: string`
161154
162155 Key Vault data-plane URI — https://<vault-name>.vault.azure.net or https://<hsm-name>.managedhsm.azure.net.
from line 160
167160
168161- `type: "external_key"`
169162
170 - `"external_key"`
163 default: external_key
171164
172165- `updated_at: string`
173166
167 format: date-time
168
174169### Example
175170
176```http
171```bash
177172curl https://api.anthropic.com/v1/organizations/external_keys \
178173 -H 'Content-Type: application/json' \
179174 -H 'anthropic-version: 2023-06-01' \
from line 181
186181 }'
187182```
188183
189#### Response
184#### Response (200)
190185
191186```json
192187{
from line 205
210205
211206## List External Keys
212207
213**get** `/v1/organizations/external_keys`
208**GET** `/v1/organizations/external_keys`
214209
215210List external key configs in the caller's organization.
216211
217212Results are ordered by creation time (newest first). Use the
218213`next_page` cursor from the response to fetch subsequent pages.
219214
220### Query Parameters
215### Query parameters
221216
222217- `limit: optional number`
223218
224219 Number of results per page.
225220
221 default: 20, maximum: 100, minimum: 1
222
226223- `page: optional string`
227224
228225 Opaque cursor from a previous response's `next_page`.
229226
230227### Returns
231228
232- `data: array of object { id, attachment, created_at, 5 more }`
229- `data: array of object`
233230
234231 - `id: string`
235232
236233 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
237234
238 - `attachment: object { type } or object { type }`
235 - `attachment: object or object`
239236
240237 Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
241238
242 - `Attached object { type }`
239 - `Attached object`
243240
244241 - `type: "attached"`
245242
246 - `"attached"`
247
248 - `Unattached object { type }`
243 default: attached
244
245 - `Unattached object`
249246
250247 - `type: "unattached"`
251248
252 - `"unattached"`
249 default: unattached
253250
254251 - `created_at: string`
255252
253 format: date-time
254
256255 - `display_name: string or null`
257256
258257 Human-friendly display name. Null if none was set.
from line 260
261260
262261 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
263262
264 - `provider_config: object { kms_arn, type, region, role_arn } or object { key_name, type } or object { key_name, tenant_id, type, 2 more }`
263 - `provider_config: object or object or object`
265264
266265 KMS provider identity and auth coordinates.
267266
268 - `Aws object { kms_arn, type, region, role_arn }`
267 - `Aws object`
269268
270269 - `kms_arn: string`
271270
272271 Full ARN of the AWS KMS key.
273272
273 maxLength: 2048
274
274275 - `type: "aws"`
275276
276 - `"aws"`
277
278277 - `region: optional string or null`
279278
280279 AWS region. Derived from kms_arn if omitted.
281280
282281 - `role_arn: optional string or null`
283282
283 **Deprecated**
284
284285 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
285286
286 - `Gcp object { key_name, type }`
287 - `Gcp object`
287288
288289 - `key_name: string`
289290
from line 292
291292
292293 - `type: "gcp"`
293294
294 - `"gcp"`
295
296 - `Azure object { key_name, tenant_id, type, 2 more }`
295 - `Azure object`
297296
298297 - `key_name: string`
299298
from line 304
305304
306305 - `type: "azure"`
307306
308 - `"azure"`
309
310307 - `vault_uri: string`
311308
312309 Key Vault data-plane URI — https://<vault-name>.vault.azure.net or https://<hsm-name>.managedhsm.azure.net.
from line 314
317314
318315 - `type: "external_key"`
319316
320 - `"external_key"`
317 default: external_key
321318
322319 - `updated_at: string`
323320
321 format: date-time
322
324323- `next_page: string or null`
325324
326325 Opaque cursor for the next page, or null if no more results. Pass as `?page=` to fetch the next page.
327326
328327### Example
329328
330```http
329```bash
331330curl https://api.anthropic.com/v1/organizations/external_keys \
332331 -H 'anthropic-version: 2023-06-01' \
333332 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
334333```
335334
336#### Response
335#### Response (200)
337336
338337```json
339338{
from line 361
362361
363362## Get External Key
364363
365**get** `/v1/organizations/external_keys/{external_key_id}`
364**GET** `/v1/organizations/external_keys/{external_key_id}`
366365
367366Retrieve a single external key config in the caller's organization by ID.
368367
369### Path Parameters
368### Path parameters
370369
371370- `external_key_id: string`
372371
373372 ID of the External Key.
374373
374 maxLength: 2048
375
375376### Returns
376377
377378- `id: string`
378379
379380 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
380381
381- `attachment: object { type } or object { type }`
382- `attachment: object or object`
382383
383384 Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
384385
385 - `Attached object { type }`
386 - `Attached object`
386387
387388 - `type: "attached"`
388389
389 - `"attached"`
390
391 - `Unattached object { type }`
390 default: attached
391
392 - `Unattached object`
392393
393394 - `type: "unattached"`
394395
395 - `"unattached"`
396 default: unattached
396397
397398- `created_at: string`
398399
400 format: date-time
401
399402- `display_name: string or null`
400403
401404 Human-friendly display name. Null if none was set.
from line 407
404407
405408 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
406409
407- `provider_config: object { kms_arn, type, region, role_arn } or object { key_name, type } or object { key_name, tenant_id, type, 2 more }`
410- `provider_config: object or object or object`
408411
409412 KMS provider identity and auth coordinates.
410413
411 - `Aws object { kms_arn, type, region, role_arn }`
414 - `Aws object`
412415
413416 - `kms_arn: string`
414417
415418 Full ARN of the AWS KMS key.
416419
420 maxLength: 2048
421
417422 - `type: "aws"`
418423
419 - `"aws"`
420
421424 - `region: optional string or null`
422425
423426 AWS region. Derived from kms_arn if omitted.
424427
425428 - `role_arn: optional string or null`
426429
430 **Deprecated**
431
427432 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
428433
429 - `Gcp object { key_name, type }`
434 - `Gcp object`
430435
431436 - `key_name: string`
432437
from line 439
434439
435440 - `type: "gcp"`
436441
437 - `"gcp"`
438
439 - `Azure object { key_name, tenant_id, type, 2 more }`
442 - `Azure object`
440443
441444 - `key_name: string`
442445
from line 451
448451
449452 - `type: "azure"`
450453
451 - `"azure"`
452
453454 - `vault_uri: string`
454455
455456 Key Vault data-plane URI — https://<vault-name>.vault.azure.net or https://<hsm-name>.managedhsm.azure.net.
from line 461
460461
461462- `type: "external_key"`
462463
463 - `"external_key"`
464 default: external_key
464465
465466- `updated_at: string`
466467
468 format: date-time
469
467470### Example
468471
469```http
472```bash
470473curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \
471474 -H 'anthropic-version: 2023-06-01' \
472475 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
473476```
474477
475#### Response
478#### Response (200)
476479
477480```json
478481{
from line 499
496499
497500## Update External Key
498501
499**post** `/v1/organizations/external_keys/{external_key_id}`
502**POST** `/v1/organizations/external_keys/{external_key_id}`
500503
501504Partially update an external key config. Omitted fields are left unchanged.
502505
from line 507
504507be changed once any workspace references this config, because previously
505508encrypted data requires the original key identity to decrypt.
506509
507### Path Parameters
510### Path parameters
508511
509512- `external_key_id: string`
510513
511514 ID of the External Key.
512515
513### Body Parameters
516 maxLength: 2048
517
518### Body parameters
514519
515520- `display_name: optional string or null`
516521
517522 Human-friendly display name.
518523
524 maxLength: 255, minLength: 1
525
519526- `geo: optional "us" or null`
520527
521528 Data residency geo. Only `us` is supported.
522529
523 - `"us"`
524
525- `provider_config: optional object { kms_arn, type, region, role_arn } or object { key_name, type } or object { key_name, tenant_id, type, 2 more } or null`
530- `provider_config: optional object or object or object or null`
526531
527532 KMS provider identity and auth coordinates.
528533
529 - `Aws object { kms_arn, type, region, role_arn }`
534 - `Aws object`
530535
531536 - `kms_arn: string`
532537
533538 Full ARN of the AWS KMS key.
534539
540 maxLength: 2048
541
535542 - `type: "aws"`
536543
537 - `"aws"`
538
539544 - `region: optional string or null`
540545
541546 AWS region. Derived from kms_arn if omitted.
542547
543548 - `role_arn: optional string or null`
544549
550 **Deprecated**
551
545552 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
546553
547 - `Gcp object { key_name, type }`
554 - `Gcp object`
548555
549556 - `key_name: string`
550557
from line 559
552559
553560 - `type: "gcp"`
554561
555 - `"gcp"`
556
557 - `Azure object { key_name, tenant_id, type, 2 more }`
562 - `Azure object`
558563
559564 Azure Key Vault provider configuration.
560565
from line 573
568573
569574 - `type: "azure"`
570575
571 - `"azure"`
572
573576 - `vault_uri: string`
574577
575578 Key Vault data-plane URI — https://<vault-name>.vault.azure.net or https://<hsm-name>.managedhsm.azure.net.
from line 587
584587
585588 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
586589
587- `attachment: object { type } or object { type }`
590- `attachment: object or object`
588591
589592 Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
590593
591 - `Attached object { type }`
594 - `Attached object`
592595
593596 - `type: "attached"`
594597
595 - `"attached"`
596
597 - `Unattached object { type }`
598 default: attached
599
600 - `Unattached object`
598601
599602 - `type: "unattached"`
600603
601 - `"unattached"`
604 default: unattached
602605
603606- `created_at: string`
604607
608 format: date-time
609
605610- `display_name: string or null`
606611
607612 Human-friendly display name. Null if none was set.
from line 615
610615
611616 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
612617
613- `provider_config: object { kms_arn, type, region, role_arn } or object { key_name, type } or object { key_name, tenant_id, type, 2 more }`
618- `provider_config: object or object or object`
614619
615620 KMS provider identity and auth coordinates.
616621
617 - `Aws object { kms_arn, type, region, role_arn }`
622 - `Aws object`
618623
619624 - `kms_arn: string`
620625
621626 Full ARN of the AWS KMS key.
622627
628 maxLength: 2048
629
623630 - `type: "aws"`
624631
625 - `"aws"`
626
627632 - `region: optional string or null`
628633
629634 AWS region. Derived from kms_arn if omitted.
630635
631636 - `role_arn: optional string or null`
632637
638 **Deprecated**
639
633640 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
634641
635 - `Gcp object { key_name, type }`
642 - `Gcp object`
636643
637644 - `key_name: string`
638645
from line 647
640647
641648 - `type: "gcp"`
642649
643 - `"gcp"`
644
645 - `Azure object { key_name, tenant_id, type, 2 more }`
650 - `Azure object`
646651
647652 - `key_name: string`
648653
from line 659
654659
655660 - `type: "azure"`
656661
657 - `"azure"`
658
659662 - `vault_uri: string`
660663
661664 Key Vault data-plane URI — https://<vault-name>.vault.azure.net or https://<hsm-name>.managedhsm.azure.net.
from line 669
666669
667670- `type: "external_key"`
668671
669 - `"external_key"`
672 default: external_key
670673
671674- `updated_at: string`
672675
676 format: date-time
677
673678### Example
674679
675```http
680```bash
676681curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \
677682 -H 'Content-Type: application/json' \
678683 -H 'anthropic-version: 2023-06-01' \
from line 685
680685 -d '{}'
681686```
682687
683#### Response
688#### Response (200)
684689
685690```json
686691{
from line 709
704709
705710## Delete External Key
706711
707**delete** `/v1/organizations/external_keys/{external_key_id}`
712**DELETE** `/v1/organizations/external_keys/{external_key_id}`
708713
709714Delete an external key config.
710715
711716The request is rejected if any workspace still references this config.
712717
713### Path Parameters
718### Path parameters
714719
715720- `external_key_id: string`
716721
717722 ID of the External Key.
718723
724 maxLength: 2048
725
719726### Returns
720727
721728- `id: string`
from line 731
724731
725732- `type: "external_key_deleted"`
726733
727 - `"external_key_deleted"`
734 default: external_key_deleted
728735
729736### Example
730737
731```http
738```bash
732739curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \
733740 -X DELETE \
734741 -H 'anthropic-version: 2023-06-01' \
735742 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
736743```
737744
738#### Response
745#### Response (200)
739746
740747```json
741748{
from line 753
746753
747754## Validate External Key
748755
749**post** `/v1/organizations/external_keys/{external_key_id}/validate`
756**POST** `/v1/organizations/external_keys/{external_key_id}/validate`
750757
751758Validate an external key config against the customer's KMS.
752759
from line 762
755762`success` if the roundtrip succeeded, or `failure` with an error
756763message if it failed or timed out.
757764
758### Path Parameters
765### Path parameters
759766
760767- `external_key_id: string`
761768
762769 ID of the External Key.
763770
771 maxLength: 2048
772
764773### Returns
765774
766775- `error: string or null`
from line 786
777786
778787- `type: "external_key_validation"`
779788
780 - `"external_key_validation"`
789 default: external_key_validation
781790
782791### Example
783792
784```http
793```bash
785794curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID/validate \
786795 -X POST \
787796 -H 'anthropic-version: 2023-06-01' \
788797 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
789798```
790799
791#### Response
800#### Response (200)
792801
793802```json
794803{
from line 807
798807}
799808```
800809
801## Domain Types
810## Domain types
802811
803812### External Key Create Response
804813
805- `ExternalKeyCreateResponse object { id, attachment, created_at, 5 more }`
814- `ExternalKeyCreateResponse object`
806815
807816 CMEK external key config belonging to the caller's organization.
808817
from line 823
814823
815824 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
816825
817 - `attachment: object { type } or object { type }`
826 - `attachment: object or object`
818827
819828 Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
820829
821 - `Attached object { type }`
830 - `Attached object`
822831
823832 - `type: "attached"`
824833
825 - `"attached"`
826
827 - `Unattached object { type }`
834 default: attached
835
836 - `Unattached object`
828837
829838 - `type: "unattached"`
830839
831 - `"unattached"`
840 default: unattached
832841
833842 - `created_at: string`
834843
844 format: date-time
845
835846 - `display_name: string or null`
836847
837848 Human-friendly display name. Null if none was set.
from line 851
840851
841852 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
842853
843 - `provider_config: object { kms_arn, type, region, role_arn } or object { key_name, type } or object { key_name, tenant_id, type, 2 more }`
854 - `provider_config: object or object or object`
844855
845856 KMS provider identity and auth coordinates.
846857
847 - `Aws object { kms_arn, type, region, role_arn }`
858 - `Aws object`
848859
849860 - `kms_arn: string`
850861
851862 Full ARN of the AWS KMS key.
852863
864 maxLength: 2048
865
853866 - `type: "aws"`
854867
855 - `"aws"`
856
857868 - `region: optional string or null`
858869
859870 AWS region. Derived from kms_arn if omitted.
860871
861872 - `role_arn: optional string or null`
862873
874 **Deprecated**
875
863876 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
864877
865 - `Gcp object { key_name, type }`
878 - `Gcp object`
866879
867880 - `key_name: string`
868881
from line 883
870883
871884 - `type: "gcp"`
872885
873 - `"gcp"`
874
875 - `Azure object { key_name, tenant_id, type, 2 more }`
886 - `Azure object`
876887
877888 - `key_name: string`
878889
from line 895
884895
885896 - `type: "azure"`
886897
887 - `"azure"`
888
889898 - `vault_uri: string`
890899
891900 Key Vault data-plane URI — https://<vault-name>.vault.azure.net or https://<hsm-name>.managedhsm.azure.net.
from line 905
896905
897906 - `type: "external_key"`
898907
899 - `"external_key"`
908 default: external_key
900909
901910 - `updated_at: string`
902911
912 format: date-time
913
903914### External Key List Response
904915
905- `ExternalKeyListResponse object { id, attachment, created_at, 5 more }`
916- `ExternalKeyListResponse object`
906917
907918 CMEK external key config belonging to the caller's organization.
908919
from line 925
914925
915926 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
916927
917 - `attachment: object { type } or object { type }`
928 - `attachment: object or object`
918929
919930 Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
920931
921 - `Attached object { type }`
932 - `Attached object`
922933
923934 - `type: "attached"`
924935
925 - `"attached"`
926
927 - `Unattached object { type }`
936 default: attached
937
938 - `Unattached object`
928939
929940 - `type: "unattached"`
930941
931 - `"unattached"`
942 default: unattached
932943
933944 - `created_at: string`
934945
946 format: date-time
947
935948 - `display_name: string or null`
936949
937950 Human-friendly display name. Null if none was set.
from line 953
940953
941954 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
942955
943 - `provider_config: object { kms_arn, type, region, role_arn } or object { key_name, type } or object { key_name, tenant_id, type, 2 more }`
956 - `provider_config: object or object or object`
944957
945958 KMS provider identity and auth coordinates.
946959
947 - `Aws object { kms_arn, type, region, role_arn }`
960 - `Aws object`
948961
949962 - `kms_arn: string`
950963
951964 Full ARN of the AWS KMS key.
952965
966 maxLength: 2048
967
953968 - `type: "aws"`
954969
955 - `"aws"`
956
957970 - `region: optional string or null`
958971
959972 AWS region. Derived from kms_arn if omitted.
960973
961974 - `role_arn: optional string or null`
962975
976 **Deprecated**
977
963978 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
964979
965 - `Gcp object { key_name, type }`
980 - `Gcp object`
966981
967982 - `key_name: string`
968983
from line 985
970985
971986 - `type: "gcp"`
972987
973 - `"gcp"`
974
975 - `Azure object { key_name, tenant_id, type, 2 more }`
988 - `Azure object`
976989
977990 - `key_name: string`
978991
from line 997
984997
985998 - `type: "azure"`
986999
987 - `"azure"`
988
9891000 - `vault_uri: string`
9901001
9911002 Key Vault data-plane URI — https://<vault-name>.vault.azure.net or https://<hsm-name>.managedhsm.azure.net.
from line 1007
9961007
9971008 - `type: "external_key"`
9981009
999 - `"external_key"`
1010 default: external_key
10001011
10011012 - `updated_at: string`
10021013
1014 format: date-time
1015
10031016### External Key Retrieve Response
10041017
1005- `ExternalKeyRetrieveResponse object { id, attachment, created_at, 5 more }`
1018- `ExternalKeyRetrieveResponse object`
10061019
10071020 CMEK external key config belonging to the caller's organization.
10081021
from line 1027
10141027
10151028 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
10161029
1017 - `attachment: object { type } or object { type }`
1030 - `attachment: object or object`
10181031
10191032 Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
10201033
1021 - `Attached object { type }`
1034 - `Attached object`
10221035
10231036 - `type: "attached"`
10241037
1025 - `"attached"`
1026
1027 - `Unattached object { type }`
1038 default: attached
1039
1040 - `Unattached object`
10281041
10291042 - `type: "unattached"`
10301043
1031 - `"unattached"`
1044 default: unattached
10321045
10331046 - `created_at: string`
10341047
1048 format: date-time
1049
10351050 - `display_name: string or null`
10361051
10371052 Human-friendly display name. Null if none was set.
from line 1055
10401055
10411056 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
10421057
1043 - `provider_config: object { kms_arn, type, region, role_arn } or object { key_name, type } or object { key_name, tenant_id, type, 2 more }`
1058 - `provider_config: object or object or object`
10441059
10451060 KMS provider identity and auth coordinates.
10461061
1047 - `Aws object { kms_arn, type, region, role_arn }`
1062 - `Aws object`
10481063
10491064 - `kms_arn: string`
10501065
10511066 Full ARN of the AWS KMS key.
10521067
1068 maxLength: 2048
1069
10531070 - `type: "aws"`
10541071
1055 - `"aws"`
1056
10571072 - `region: optional string or null`
10581073
10591074 AWS region. Derived from kms_arn if omitted.
10601075
10611076 - `role_arn: optional string or null`
10621077
1078 **Deprecated**
1079
10631080 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
10641081
1065 - `Gcp object { key_name, type }`
1082 - `Gcp object`
10661083
10671084 - `key_name: string`
10681085
from line 1087
10701087
10711088 - `type: "gcp"`
10721089
1073 - `"gcp"`
1074
1075 - `Azure object { key_name, tenant_id, type, 2 more }`
1090 - `Azure object`
10761091
10771092 - `key_name: string`
10781093
from line 1099
10841099
10851100 - `type: "azure"`
10861101
1087 - `"azure"`
1088
10891102 - `vault_uri: string`
10901103
10911104 Key Vault data-plane URI — https://<vault-name>.vault.azure.net or https://<hsm-name>.managedhsm.azure.net.
from line 1109
10961109
10971110 - `type: "external_key"`
10981111
1099 - `"external_key"`
1112 default: external_key
11001113
11011114 - `updated_at: string`
11021115
1116 format: date-time
1117
11031118### External Key Update Response
11041119
1105- `ExternalKeyUpdateResponse object { id, attachment, created_at, 5 more }`
1120- `ExternalKeyUpdateResponse object`
11061121
11071122 CMEK external key config belonging to the caller's organization.
11081123
from line 1129
11141129
11151130 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
11161131
1117 - `attachment: object { type } or object { type }`
1132 - `attachment: object or object`
11181133
11191134 Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
11201135
1121 - `Attached object { type }`
1136 - `Attached object`
11221137
11231138 - `type: "attached"`
11241139
1125 - `"attached"`
1126
1127 - `Unattached object { type }`
1140 default: attached
1141
1142 - `Unattached object`
11281143
11291144 - `type: "unattached"`
11301145
1131 - `"unattached"`
1146 default: unattached
11321147
11331148 - `created_at: string`
11341149
1150 format: date-time
1151
11351152 - `display_name: string or null`
11361153
11371154 Human-friendly display name. Null if none was set.
from line 1157
11401157
11411158 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
11421159
1143 - `provider_config: object { kms_arn, type, region, role_arn } or object { key_name, type } or object { key_name, tenant_id, type, 2 more }`
1160 - `provider_config: object or object or object`
11441161
11451162 KMS provider identity and auth coordinates.
11461163
1147 - `Aws object { kms_arn, type, region, role_arn }`
1164 - `Aws object`
11481165
11491166 - `kms_arn: string`
11501167
11511168 Full ARN of the AWS KMS key.
11521169
1170 maxLength: 2048
1171
11531172 - `type: "aws"`
11541173
1155 - `"aws"`
1156
11571174 - `region: optional string or null`
11581175
11591176 AWS region. Derived from kms_arn if omitted.
11601177
11611178 - `role_arn: optional string or null`
11621179
1180 **Deprecated**
1181
11631182 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
11641183
1165 - `Gcp object { key_name, type }`
1184 - `Gcp object`
11661185
11671186 - `key_name: string`
11681187
from line 1189
11701189
11711190 - `type: "gcp"`
11721191
1173 - `"gcp"`
1174
1175 - `Azure object { key_name, tenant_id, type, 2 more }`
1192 - `Azure object`
11761193
11771194 - `key_name: string`
11781195
from line 1201
11841201
11851202 - `type: "azure"`
11861203
1187 - `"azure"`
1188
11891204 - `vault_uri: string`
11901205
11911206 Key Vault data-plane URI — https://<vault-name>.vault.azure.net or https://<hsm-name>.managedhsm.azure.net.
from line 1211
11961211
11971212 - `type: "external_key"`
11981213
1199 - `"external_key"`
1214 default: external_key
12001215
12011216 - `updated_at: string`
12021217
1218 format: date-time
1219
12031220### External Key Delete Response
12041221
1205- `ExternalKeyDeleteResponse object { id, type }`
1222- `ExternalKeyDeleteResponse object`
12061223
12071224 - `id: string`
12081225
from line 1227
12101227
12111228 - `type: "external_key_deleted"`
12121229
1213 - `"external_key_deleted"`
1230 default: external_key_deleted
12141231
12151232### External Key Validate Response
12161233
1217- `ExternalKeyValidateResponse object { error, status, type }`
1234- `ExternalKeyValidateResponse object`
12181235
12191236 Result of a validation roundtrip against the customer's KMS.
12201237
from line 1252
12351252
12361253 - `type: "external_key_validation"`
12371254
1238 - `"external_key_validation"`
1255 default: external_key_validation
12391256
api/admin/external_keys/create Changed · +39 / -44 lines
# Create External Key ## Body parameters ## Returns ## Example ### Response (200) ## Create External Key ### Body Parameters ### Returns ### Example #### Response
from line 1
1---
2title: Create External Key
3url: https://platform.claude.com/docs/en/api/admin/external_keys/create
4---
1# Create External Key
52
6## Create External Key
3**POST** `/v1/organizations/external_keys`
74
8**post** `/v1/organizations/external_keys`
9
105Create an external key config owned by the caller's organization.
116
12### Body Parameters
7## Body parameters
138
14- `provider_config: object { kms_arn, type, region, role_arn } or object { key_name, type } or object { key_name, tenant_id, type, 2 more }`
9- `provider_config: object or object or object`
1510
1611 KMS provider identity and auth coordinates.
1712
18 - `Aws object { kms_arn, type, region, role_arn }`
13 - `Aws object`
1914
2015 - `kms_arn: string`
2116
2217 Full ARN of the AWS KMS key.
2318
19 maxLength: 2048
20
2421 - `type: "aws"`
2522
26 - `"aws"`
27
2823 - `region: optional string or null`
2924
3025 AWS region. Derived from kms_arn if omitted.
from line 26
3126
3227 - `role_arn: optional string or null`
3328
29 **Deprecated**
30
3431 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
3532
36 - `Gcp object { key_name, type }`
33 - `Gcp object`
3734
3835 - `key_name: string`
3936
from line 38
4138
4239 - `type: "gcp"`
4340
44 - `"gcp"`
41 - `Azure object`
4542
46 - `Azure object { key_name, tenant_id, type, 2 more }`
47
4843 Azure Key Vault provider configuration.
4944
5045 - `key_name: string`
from line 52
5752
5853 - `type: "azure"`
5954
60 - `"azure"`
61
6255 - `vault_uri: string`
6356
6457 Key Vault data-plane URI — https://<vault-name>.vault.azure.net or https://<hsm-name>.managedhsm.azure.net.
from line 64
7164
7265 Human-friendly display name.
7366
67 maxLength: 255, minLength: 1
68
7469- `geo: optional "us"`
7570
7671 Data residency geo. Only `us` is supported.
7772
78 - `"us"`
73## Returns
7974
80### Returns
81
8275- `id: string`
8376
8477 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
8578
86- `attachment: object { type } or object { type }`
79- `attachment: object or object`
8780
8881 Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
8982
90 - `Attached object { type }`
83 - `Attached object`
9184
9285 - `type: "attached"`
9386
94 - `"attached"`
87 default: attached
9588
96 - `Unattached object { type }`
89 - `Unattached object`
9790
9891 - `type: "unattached"`
9992
100 - `"unattached"`
93 default: unattached
10194
10295- `created_at: string`
10396
97 format: date-time
98
10499- `display_name: string or null`
105100
106101 Human-friendly display name. Null if none was set.
from line 104
109104
110105 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
111106
112- `provider_config: object { kms_arn, type, region, role_arn } or object { key_name, type } or object { key_name, tenant_id, type, 2 more }`
107- `provider_config: object or object or object`
113108
114109 KMS provider identity and auth coordinates.
115110
116 - `Aws object { kms_arn, type, region, role_arn }`
111 - `Aws object`
117112
118113 - `kms_arn: string`
119114
120115 Full ARN of the AWS KMS key.
121116
117 maxLength: 2048
118
122119 - `type: "aws"`
123120
124 - `"aws"`
125
126121 - `region: optional string or null`
127122
128123 AWS region. Derived from kms_arn if omitted.
from line 124
129124
130125 - `role_arn: optional string or null`
131126
127 **Deprecated**
128
132129 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
133130
134 - `Gcp object { key_name, type }`
131 - `Gcp object`
135132
136133 - `key_name: string`
137134
from line 136
139136
140137 - `type: "gcp"`
141138
142 - `"gcp"`
139 - `Azure object`
143140
144 - `Azure object { key_name, tenant_id, type, 2 more }`
145
146141 - `key_name: string`
147142
148143 Name of the key within the vault.
from line 148
153148
154149 - `type: "azure"`
155150
156 - `"azure"`
157
158151 - `vault_uri: string`
159152
160153 Key Vault data-plane URI — https://<vault-name>.vault.azure.net or https://<hsm-name>.managedhsm.azure.net.
from line 158
165158
166159- `type: "external_key"`
167160
168 - `"external_key"`
161 default: external_key
169162
170163- `updated_at: string`
171164
172### Example
165 format: date-time
173166
174```http
167## Example
168
169```bash
175170curl https://api.anthropic.com/v1/organizations/external_keys \
176171 -H 'Content-Type: application/json' \
177172 -H 'anthropic-version: 2023-06-01' \
from line 179
184179 }'
185180```
186181
187#### Response
182### Response (200)
188183
189184```json
190185{
api/admin/external_keys/delete Changed · +10 / -13 lines
# Delete External Key ## Path parameters ## Returns ## Example ### Response (200) ## Delete External Key ### Path Parameters ### Returns ### Example #### Response
from line 1
1---
2title: Delete External Key
3url: https://platform.claude.com/docs/en/api/admin/external_keys/delete
4---
1# Delete External Key
52
6## Delete External Key
3**DELETE** `/v1/organizations/external_keys/{external_key_id}`
74
8**delete** `/v1/organizations/external_keys/{external_key_id}`
9
105Delete an external key config.
116
127The request is rejected if any workspace still references this config.
138
14### Path Parameters
9## Path parameters
1510
1611- `external_key_id: string`
1712
1813 ID of the External Key.
1914
20### Returns
15 maxLength: 2048
2116
17## Returns
18
2219- `id: string`
2320
2421 ID of the deleted External Key.
from line 22
2522
2623- `type: "external_key_deleted"`
2724
28 - `"external_key_deleted"`
25 default: external_key_deleted
2926
30### Example
27## Example
3128
32```http
29```bash
3330curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \
3431 -X DELETE \
3532 -H 'anthropic-version: 2023-06-01' \
from line 33
3633 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
3734```
3835
39#### Response
36### Response (200)
4037
4138```json
4239{
api/admin/external_keys/list Changed · +28 / -29 lines
# List External Keys ## Query parameters ## Returns ## Example ### Response (200) ## List External Keys ### Query Parameters ### Returns ### Example #### Response
from line 1
1---
2title: List External Keys
3url: https://platform.claude.com/docs/en/api/admin/external_keys/list
4---
1# List External Keys
52
6## List External Keys
3**GET** `/v1/organizations/external_keys`
74
8**get** `/v1/organizations/external_keys`
9
105List external key configs in the caller's organization.
116
127Results are ordered by creation time (newest first). Use the
138`next_page` cursor from the response to fetch subsequent pages.
149
15### Query Parameters
10## Query parameters
1611
1712- `limit: optional number`
1813
1914 Number of results per page.
2015
16 default: 20, maximum: 100, minimum: 1
17
2118- `page: optional string`
2219
2320 Opaque cursor from a previous response's `next_page`.
2421
25### Returns
22## Returns
2623
27- `data: array of object { id, attachment, created_at, 5 more }`
24- `data: array of object`
2825
2926 - `id: string`
3027
3128 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
3229
33 - `attachment: object { type } or object { type }`
30 - `attachment: object or object`
3431
3532 Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
3633
37 - `Attached object { type }`
34 - `Attached object`
3835
3936 - `type: "attached"`
4037
41 - `"attached"`
38 default: attached
4239
43 - `Unattached object { type }`
40 - `Unattached object`
4441
4542 - `type: "unattached"`
4643
47 - `"unattached"`
44 default: unattached
4845
4946 - `created_at: string`
5047
48 format: date-time
49
5150 - `display_name: string or null`
5251
5352 Human-friendly display name. Null if none was set.
from line 55
5655
5756 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
5857
59 - `provider_config: object { kms_arn, type, region, role_arn } or object { key_name, type } or object { key_name, tenant_id, type, 2 more }`
58 - `provider_config: object or object or object`
6059
6160 KMS provider identity and auth coordinates.
6261
63 - `Aws object { kms_arn, type, region, role_arn }`
62 - `Aws object`
6463
6564 - `kms_arn: string`
6665
6766 Full ARN of the AWS KMS key.
6867
68 maxLength: 2048
69
6970 - `type: "aws"`
7071
71 - `"aws"`
72
7372 - `region: optional string or null`
7473
7574 AWS region. Derived from kms_arn if omitted.
from line 75
7675
7776 - `role_arn: optional string or null`
7877
78 **Deprecated**
79
7980 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
8081
81 - `Gcp object { key_name, type }`
82 - `Gcp object`
8283
8384 - `key_name: string`
8485
from line 87
8687
8788 - `type: "gcp"`
8889
89 - `"gcp"`
90 - `Azure object`
9091
91 - `Azure object { key_name, tenant_id, type, 2 more }`
92
9392 - `key_name: string`
9493
9594 Name of the key within the vault.
from line 99
10099
101100 - `type: "azure"`
102101
103 - `"azure"`
104
105102 - `vault_uri: string`
106103
107104 Key Vault data-plane URI — https://<vault-name>.vault.azure.net or https://<hsm-name>.managedhsm.azure.net.
from line 109
112109
113110 - `type: "external_key"`
114111
115 - `"external_key"`
112 default: external_key
116113
117114 - `updated_at: string`
118115
116 format: date-time
117
119118- `next_page: string or null`
120119
121120 Opaque cursor for the next page, or null if no more results. Pass as `?page=` to fetch the next page.
122121
123### Example
122## Example
124123
125```http
124```bash
126125curl https://api.anthropic.com/v1/organizations/external_keys \
127126 -H 'anthropic-version: 2023-06-01' \
128127 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
129128```
130129
131#### Response
130### Response (200)
132131
133132```json
134133{
api/admin/external_keys/retrieve Changed · +27 / -28 lines
# Get External Key ## Path parameters ## Returns ## Example ### Response (200) ## Get External Key ### Path Parameters ### Returns ### Example #### Response
from line 1
1---
2title: Get External Key
3url: https://platform.claude.com/docs/en/api/admin/external_keys/retrieve
4---
1# Get External Key
52
6## Get External Key
3**GET** `/v1/organizations/external_keys/{external_key_id}`
74
8**get** `/v1/organizations/external_keys/{external_key_id}`
9
105Retrieve a single external key config in the caller's organization by ID.
116
12### Path Parameters
7## Path parameters
138
149- `external_key_id: string`
1510
1611 ID of the External Key.
1712
18### Returns
13 maxLength: 2048
1914
15## Returns
16
2017- `id: string`
2118
2219 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
2320
24- `attachment: object { type } or object { type }`
21- `attachment: object or object`
2522
2623 Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
2724
28 - `Attached object { type }`
25 - `Attached object`
2926
3027 - `type: "attached"`
3128
32 - `"attached"`
29 default: attached
3330
34 - `Unattached object { type }`
31 - `Unattached object`
3532
3633 - `type: "unattached"`
3734
38 - `"unattached"`
35 default: unattached
3936
4037- `created_at: string`
4138
39 format: date-time
40
4241- `display_name: string or null`
4342
4443 Human-friendly display name. Null if none was set.
from line 46
4746
4847 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
4948
50- `provider_config: object { kms_arn, type, region, role_arn } or object { key_name, type } or object { key_name, tenant_id, type, 2 more }`
49- `provider_config: object or object or object`
5150
5251 KMS provider identity and auth coordinates.
5352
54 - `Aws object { kms_arn, type, region, role_arn }`
53 - `Aws object`
5554
5655 - `kms_arn: string`
5756
5857 Full ARN of the AWS KMS key.
5958
59 maxLength: 2048
60
6061 - `type: "aws"`
6162
62 - `"aws"`
63
6463 - `region: optional string or null`
6564
6665 AWS region. Derived from kms_arn if omitted.
from line 66
6766
6867 - `role_arn: optional string or null`
6968
69 **Deprecated**
70
7071 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
7172
72 - `Gcp object { key_name, type }`
73 - `Gcp object`
7374
7475 - `key_name: string`
7576
from line 78
7778
7879 - `type: "gcp"`
7980
80 - `"gcp"`
81 - `Azure object`
8182
82 - `Azure object { key_name, tenant_id, type, 2 more }`
83
8483 - `key_name: string`
8584
8685 Name of the key within the vault.
from line 90
9190
9291 - `type: "azure"`
9392
94 - `"azure"`
95
9693 - `vault_uri: string`
9794
9895 Key Vault data-plane URI — https://<vault-name>.vault.azure.net or https://<hsm-name>.managedhsm.azure.net.
from line 100
103100
104101- `type: "external_key"`
105102
106 - `"external_key"`
103 default: external_key
107104
108105- `updated_at: string`
109106
110### Example
107 format: date-time
111108
112```http
109## Example
110
111```bash
113112curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \
114113 -H 'anthropic-version: 2023-06-01' \
115114 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
116115```
117116
118#### Response
117### Response (200)
119118
120119```json
121120{
api/admin/external_keys/update Changed · +41 / -44 lines
# Update External Key ## Path parameters ## Body parameters ## Returns ## Example ### Response (200) ## Update External Key ### Path Parameters ### Body Parameters ### Returns ### Example #### Response
from line 1
1---
2title: Update External Key
3url: https://platform.claude.com/docs/en/api/admin/external_keys/update
4---
1# Update External Key
52
6## Update External Key
3**POST** `/v1/organizations/external_keys/{external_key_id}`
74
8**post** `/v1/organizations/external_keys/{external_key_id}`
9
105Partially update an external key config. Omitted fields are left unchanged.
116
127`display_name` is always editable. `geo` and `provider_config` cannot
from line 8
138be changed once any workspace references this config, because previously
149encrypted data requires the original key identity to decrypt.
1510
16### Path Parameters
11## Path parameters
1712
1813- `external_key_id: string`
1914
2015 ID of the External Key.
2116
22### Body Parameters
17 maxLength: 2048
2318
19## Body parameters
20
2421- `display_name: optional string or null`
2522
2623 Human-friendly display name.
2724
25 maxLength: 255, minLength: 1
26
2827- `geo: optional "us" or null`
2928
3029 Data residency geo. Only `us` is supported.
3130
32 - `"us"`
31- `provider_config: optional object or object or object or null`
3332
34- `provider_config: optional object { kms_arn, type, region, role_arn } or object { key_name, type } or object { key_name, tenant_id, type, 2 more } or null`
35
3633 KMS provider identity and auth coordinates.
3734
38 - `Aws object { kms_arn, type, region, role_arn }`
35 - `Aws object`
3936
4037 - `kms_arn: string`
4138
4239 Full ARN of the AWS KMS key.
4340
41 maxLength: 2048
42
4443 - `type: "aws"`
4544
46 - `"aws"`
47
4845 - `region: optional string or null`
4946
5047 AWS region. Derived from kms_arn if omitted.
from line 48
5148
5249 - `role_arn: optional string or null`
5350
51 **Deprecated**
52
5453 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
5554
56 - `Gcp object { key_name, type }`
55 - `Gcp object`
5756
5857 - `key_name: string`
5958
from line 60
6160
6261 - `type: "gcp"`
6362
64 - `"gcp"`
63 - `Azure object`
6564
66 - `Azure object { key_name, tenant_id, type, 2 more }`
67
6865 Azure Key Vault provider configuration.
6966
7067 - `key_name: string`
from line 74
7774
7875 - `type: "azure"`
7976
80 - `"azure"`
81
8277 - `vault_uri: string`
8378
8479 Key Vault data-plane URI — https://<vault-name>.vault.azure.net or https://<hsm-name>.managedhsm.azure.net.
from line 82
8782
8883 Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
8984
90### Returns
85## Returns
9186
9287- `id: string`
9388
9489 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
9590
96- `attachment: object { type } or object { type }`
91- `attachment: object or object`
9792
9893 Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
9994
100 - `Attached object { type }`
95 - `Attached object`
10196
10297 - `type: "attached"`
10398
104 - `"attached"`
99 default: attached
105100
106 - `Unattached object { type }`
101 - `Unattached object`
107102
108103 - `type: "unattached"`
109104
110 - `"unattached"`
105 default: unattached
111106
112107- `created_at: string`
113108
109 format: date-time
110
114111- `display_name: string or null`
115112
116113 Human-friendly display name. Null if none was set.
from line 116
119116
120117 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
121118
122- `provider_config: object { kms_arn, type, region, role_arn } or object { key_name, type } or object { key_name, tenant_id, type, 2 more }`
119- `provider_config: object or object or object`
123120
124121 KMS provider identity and auth coordinates.
125122
126 - `Aws object { kms_arn, type, region, role_arn }`
123 - `Aws object`
127124
128125 - `kms_arn: string`
129126
130127 Full ARN of the AWS KMS key.
131128
129 maxLength: 2048
130
132131 - `type: "aws"`
133132
134 - `"aws"`
135
136133 - `region: optional string or null`
137134
138135 AWS region. Derived from kms_arn if omitted.
from line 136
139136
140137 - `role_arn: optional string or null`
141138
139 **Deprecated**
140
142141 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
143142
144 - `Gcp object { key_name, type }`
143 - `Gcp object`
145144
146145 - `key_name: string`
147146
from line 148
149148
150149 - `type: "gcp"`
151150
152 - `"gcp"`
151 - `Azure object`
153152
154 - `Azure object { key_name, tenant_id, type, 2 more }`
155
156153 - `key_name: string`
157154
158155 Name of the key within the vault.
from line 160
163160
164161 - `type: "azure"`
165162
166 - `"azure"`
167
168163 - `vault_uri: string`
169164
170165 Key Vault data-plane URI — https://<vault-name>.vault.azure.net or https://<hsm-name>.managedhsm.azure.net.
from line 170
175170
176171- `type: "external_key"`
177172
178 - `"external_key"`
173 default: external_key
179174
180175- `updated_at: string`
181176
182### Example
177 format: date-time
183178
184```http
179## Example
180
181```bash
185182curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \
186183 -H 'Content-Type: application/json' \
187184 -H 'anthropic-version: 2023-06-01' \
from line 186
189186 -d '{}'
190187```
191188
192#### Response
189### Response (200)
193190
194191```json
195192{
api/admin/external_keys/validate Changed · +10 / -13 lines
# Validate External Key ## Path parameters ## Returns ## Example ### Response (200) ## Validate External Key ### Path Parameters ### Returns ### Example #### Response
from line 1
1---
2title: Validate External Key
3url: https://platform.claude.com/docs/en/api/admin/external_keys/validate
4---
1# Validate External Key
52
6## Validate External Key
3**POST** `/v1/organizations/external_keys/{external_key_id}/validate`
74
8**post** `/v1/organizations/external_keys/{external_key_id}/validate`
9
105Validate an external key config against the customer's KMS.
116
127Anthropic performs an encrypt/decrypt roundtrip against the configured
from line 9
149`success` if the roundtrip succeeded, or `failure` with an error
1510message if it failed or timed out.
1611
17### Path Parameters
12## Path parameters
1813
1914- `external_key_id: string`
2015
2116 ID of the External Key.
2217
23### Returns
18 maxLength: 2048
2419
20## Returns
21
2522- `error: string or null`
2623
2724 Error message when status is `failure`. Null otherwise.
from line 33
3633
3734- `type: "external_key_validation"`
3835
39 - `"external_key_validation"`
36 default: external_key_validation
4037
41### Example
38## Example
4239
43```http
40```bash
4441curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID/validate \
4542 -X POST \
4643 -H 'anthropic-version: 2023-06-01' \
from line 44
4744 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
4845```
4946
50#### Response
47### Response (200)
5148
5249```json
5350{
api/admin/federation_issuers Changed · +228 / -129 lines
### Headers ### Body parameters #### Response (200) ### Path parameters ### Headers #### Response (200) ### Query parameters ### Headers #### Response (200) ### Path parameters ### Headers ### Body parameters #### Response (200) ### Path parameters ### Headers #### Response (200) ## Domain types ### Header Parameters ### Body Parameters #### Response ### Path Parameters ### Header Parameters #### Response ### Query Parameters ### Header Parameters #### Response ### Path Parameters ### Header Parameters ### Body Parameters #### Response ### Path Parameters ### Header Parameters #### Response ## Domain Types
from line 1
1---
2title: Federation Issuers
3url: https://platform.claude.com/docs/en/api/admin/federation_issuers
4---
5
61# Federation Issuers
72
83## Create Federation Issuer
94
10**post** `/v1/organizations/federation_issuers`
5**POST** `/v1/organizations/federation_issuers`
116
127Register an OIDC issuer that Anthropic will trust for workload identity
138federation in your organization.
from line 19
2419Requires an OAuth bearer or Console session; Admin API keys are not
2520accepted.
2621
27### Header Parameters
22### Headers
2823
2924- `"anthropic-beta": optional array of string`
3025
from line 27
3227
3328 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
3429
35### Body Parameters
30### Body parameters
3631
3732- `issuer_url: string`
3833
3934 The `iss` claim value to match against.
4035
36 minLength: 1
37
4138- `name: string`
4239
4340 Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
4441
42 maxLength: 255, minLength: 1
43
4544- `check_jti: optional boolean or null`
4645
4746 Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Defaults to true. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.
4847
49- `jwks: optional object { type, ca_cert_pem, discovery_base } or object { type, url, ca_cert_pem } or object { keys, type }`
48- `jwks: optional object or object or object`
5049
5150 How signing keys are obtained. Defaults to OIDC discovery.
5251
53 - `Discovery object { type, ca_cert_pem, discovery_base }`
52 - `Discovery object`
5453
5554 JWKS via the issuer's OIDC discovery document.
5655
5756 - `type: "discovery"`
5857
59 - `"discovery"`
60
6158 - `ca_cert_pem: optional string or null`
6259
6360 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
6461
62 maxLength: 8192
63
6564 - `discovery_base: optional string or null`
6665
6766 Set when the discovery URL differs from `issuer_url`.
6867
69 - `ExplicitURL object { type, url, ca_cert_pem }`
68 - `ExplicitURL object`
7069
7170 JWKS fetched from a fixed endpoint.
7271
7372 - `type: "explicit_url"`
7473
75 - `"explicit_url"`
76
7774 - `url: string`
7875
7976 JWKS endpoint.
8077
78 minLength: 1
79
8180 - `ca_cert_pem: optional string or null`
8281
8382 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
8483
85 - `Inline object { keys, type }`
84 maxLength: 8192
8685
86 - `Inline object`
87
8788 JWKS supplied directly; no network fetch.
8889
8990 - `keys: array of map[unknown]`
from line 91
9091
9192 Inline JWK objects.
9293
94 minItems: 1
95
9396 - `type: "inline"`
9497
95 - `"inline"`
96
9798- `max_jwt_lifetime_seconds: optional number or null`
9899
99100 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Defaults to 3600 (1h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
100101
102 maximum: 176400, exclusiveMinimum: 0
103
101104### Returns
102105
103- `FederationIssuer object { id, archived_at, archived_by_actor_id, 12 more }`
106- `FederationIssuer object`
104107
105108 Registered external OIDC identity provider.
106109
from line 118
115118
116119 If set, all rules referencing this issuer reject token exchange.
117120
121 format: date-time
122
118123 - `archived_by_actor_id: string or null`
119124
120125 Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
from line 132
127132
128133 When this issuer was created.
129134
135 format: date-time
136
130137 - `created_by_actor_id: string or null`
131138
132139 Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
from line 142
135142
136143 The `iss` claim value. Incoming JWTs must match exactly.
137144
138 - `jwks: object { type, ca_cert_pem, discovery_base } or object { type, url, ca_cert_pem } or object { keys, type }`
145 - `jwks: object or object or object`
139146
140147 How signing keys are obtained for signature verification.
141148
142 - `Discovery object { type, ca_cert_pem, discovery_base }`
149 - `Discovery object`
143150
144151 JWKS via the issuer's OIDC discovery document.
145152
146153 - `type: "discovery"`
147154
148 - `"discovery"`
149
150155 - `ca_cert_pem: optional string or null`
151156
152157 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
153158
159 maxLength: 8192
160
154161 - `discovery_base: optional string or null`
155162
156163 Set when the discovery URL differs from `issuer_url`.
157164
158 - `ExplicitURL object { type, url, ca_cert_pem }`
165 - `ExplicitURL object`
159166
160167 JWKS fetched from a fixed endpoint.
161168
162169 - `type: "explicit_url"`
163170
164 - `"explicit_url"`
165
166171 - `url: string`
167172
168173 JWKS endpoint.
169174
175 minLength: 1
176
170177 - `ca_cert_pem: optional string or null`
171178
172179 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
173180
174 - `Inline object { keys, type }`
181 maxLength: 8192
175182
183 - `Inline object`
184
176185 JWKS supplied directly; no network fetch.
177186
178187 - `keys: array of map[unknown]`
from line 188
179188
180189 Inline JWK objects.
181190
191 minItems: 1
192
182193 - `type: "inline"`
183194
184 - `"inline"`
185
186195 - `jwks_polling_disabled_at: string or null`
187196
188197 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
189198
199 format: date-time
200
190201 - `max_jwt_lifetime_seconds: number`
191202
192203 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
from line 206
195206
196207 Admin-chosen slug identifier.
197208
198 - `poll_status: object { consecutive_failures, last_fetched_at, next_poll_at } or null`
209 - `poll_status: object or null`
199210
200211 Status of automatic JWKS polling for a federation issuer.
201212
from line 222
211222
212223 When the last successful fetch completed.
213224
225 format: date-time
226
214227 - `next_poll_at: string or null`
215228
216229 When the next fetch is scheduled. Null if paused.
217230
231 format: date-time
232
218233 - `type: "federation_issuer"`
219234
220 - `"federation_issuer"`
235 default: federation_issuer
221236
222237 - `updated_at: string`
223238
224239 When this issuer was last updated.
225240
241 format: date-time
242
226243 - `updated_by_actor_id: string or null`
227244
228245 Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.
from line 246
229246
230247### Example
231248
232```http
249```bash
233250curl https://api.anthropic.com/v1/organizations/federation_issuers \
234251 -H 'Content-Type: application/json' \
235252 -H 'anthropic-version: 2023-06-01' \
from line 257
240257 }'
241258```
242259
243#### Response
260#### Response (200)
244261
245262```json
246263{
from line 289
272289
273290## Get Federation Issuer
274291
275**get** `/v1/organizations/federation_issuers/{federation_issuer_id}`
292**GET** `/v1/organizations/federation_issuers/{federation_issuer_id}`
276293
277294Retrieve a federation issuer by its ID (`fdis_...`).
278295
279### Path Parameters
296### Path parameters
280297
281298- `federation_issuer_id: string`
282299
283300 ID of the federation issuer.
284301
285### Header Parameters
302### Headers
286303
287304- `"anthropic-beta": optional array of string`
288305
from line 309
292309
293310### Returns
294311
295- `FederationIssuer object { id, archived_at, archived_by_actor_id, 12 more }`
312- `FederationIssuer object`
296313
297314 Registered external OIDC identity provider.
298315
from line 324
307324
308325 If set, all rules referencing this issuer reject token exchange.
309326
327 format: date-time
328
310329 - `archived_by_actor_id: string or null`
311330
312331 Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
from line 338
319338
320339 When this issuer was created.
321340
341 format: date-time
342
322343 - `created_by_actor_id: string or null`
323344
324345 Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
from line 348
327348
328349 The `iss` claim value. Incoming JWTs must match exactly.
329350
330 - `jwks: object { type, ca_cert_pem, discovery_base } or object { type, url, ca_cert_pem } or object { keys, type }`
351 - `jwks: object or object or object`
331352
332353 How signing keys are obtained for signature verification.
333354
334 - `Discovery object { type, ca_cert_pem, discovery_base }`
355 - `Discovery object`
335356
336357 JWKS via the issuer's OIDC discovery document.
337358
338359 - `type: "discovery"`
339360
340 - `"discovery"`
341
342361 - `ca_cert_pem: optional string or null`
343362
344363 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
345364
365 maxLength: 8192
366
346367 - `discovery_base: optional string or null`
347368
348369 Set when the discovery URL differs from `issuer_url`.
349370
350 - `ExplicitURL object { type, url, ca_cert_pem }`
371 - `ExplicitURL object`
351372
352373 JWKS fetched from a fixed endpoint.
353374
354375 - `type: "explicit_url"`
355376
356 - `"explicit_url"`
357
358377 - `url: string`
359378
360379 JWKS endpoint.
361380
381 minLength: 1
382
362383 - `ca_cert_pem: optional string or null`
363384
364385 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
365386
366 - `Inline object { keys, type }`
387 maxLength: 8192
367388
389 - `Inline object`
390
368391 JWKS supplied directly; no network fetch.
369392
370393 - `keys: array of map[unknown]`
from line 394
371394
372395 Inline JWK objects.
373396
397 minItems: 1
398
374399 - `type: "inline"`
375400
376 - `"inline"`
377
378401 - `jwks_polling_disabled_at: string or null`
379402
380403 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
381404
405 format: date-time
406
382407 - `max_jwt_lifetime_seconds: number`
383408
384409 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
from line 412
387412
388413 Admin-chosen slug identifier.
389414
390 - `poll_status: object { consecutive_failures, last_fetched_at, next_poll_at } or null`
415 - `poll_status: object or null`
391416
392417 Status of automatic JWKS polling for a federation issuer.
393418
from line 428
403428
404429 When the last successful fetch completed.
405430
431 format: date-time
432
406433 - `next_poll_at: string or null`
407434
408435 When the next fetch is scheduled. Null if paused.
409436
437 format: date-time
438
410439 - `type: "federation_issuer"`
411440
412 - `"federation_issuer"`
441 default: federation_issuer
413442
414443 - `updated_at: string`
415444
416445 When this issuer was last updated.
417446
447 format: date-time
448
418449 - `updated_by_actor_id: string or null`
419450
420451 Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.
from line 452
421452
422453### Example
423454
424```http
455```bash
425456curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID \
426457 -H 'anthropic-version: 2023-06-01' \
427458 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
428459```
429460
430#### Response
461#### Response (200)
431462
432463```json
433464{
from line 490
459490
460491## List Federation Issuers
461492
462**get** `/v1/organizations/federation_issuers`
493**GET** `/v1/organizations/federation_issuers`
463494
464495List federation issuers in your organization.
465496
466497Archived issuers are excluded unless `include_archived=true`.
467498
468### Query Parameters
499### Query parameters
469500
470501- `include_archived: optional boolean`
471502
472503 Include archived resources. Defaults to false.
473504
505 default: false
506
474507- `limit: optional number`
475508
476509 Number of results per page.
477510
511 default: 20, maximum: 100, minimum: 1
512
478513- `page: optional string`
479514
480515 Opaque cursor from a previous response's `next_page`.
481516
482### Header Parameters
517### Headers
483518
484519- `"anthropic-beta": optional array of string`
485520
from line 534
499534
500535 If set, all rules referencing this issuer reject token exchange.
501536
537 format: date-time
538
502539 - `archived_by_actor_id: string or null`
503540
504541 Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
from line 548
511548
512549 When this issuer was created.
513550
551 format: date-time
552
514553 - `created_by_actor_id: string or null`
515554
516555 Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
from line 558
519558
520559 The `iss` claim value. Incoming JWTs must match exactly.
521560
522 - `jwks: object { type, ca_cert_pem, discovery_base } or object { type, url, ca_cert_pem } or object { keys, type }`
561 - `jwks: object or object or object`
523562
524563 How signing keys are obtained for signature verification.
525564
526 - `Discovery object { type, ca_cert_pem, discovery_base }`
565 - `Discovery object`
527566
528567 JWKS via the issuer's OIDC discovery document.
529568
530569 - `type: "discovery"`
531570
532 - `"discovery"`
533
534571 - `ca_cert_pem: optional string or null`
535572
536573 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
537574
575 maxLength: 8192
576
538577 - `discovery_base: optional string or null`
539578
540579 Set when the discovery URL differs from `issuer_url`.
541580
542 - `ExplicitURL object { type, url, ca_cert_pem }`
581 - `ExplicitURL object`
543582
544583 JWKS fetched from a fixed endpoint.
545584
546585 - `type: "explicit_url"`
547586
548 - `"explicit_url"`
549
550587 - `url: string`
551588
552589 JWKS endpoint.
553590
591 minLength: 1
592
554593 - `ca_cert_pem: optional string or null`
555594
556595 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
557596
558 - `Inline object { keys, type }`
597 maxLength: 8192
559598
599 - `Inline object`
600
560601 JWKS supplied directly; no network fetch.
561602
562603 - `keys: array of map[unknown]`
from line 604
563604
564605 Inline JWK objects.
565606
607 minItems: 1
608
566609 - `type: "inline"`
567610
568 - `"inline"`
569
570611 - `jwks_polling_disabled_at: string or null`
571612
572613 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
573614
615 format: date-time
616
574617 - `max_jwt_lifetime_seconds: number`
575618
576619 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
from line 622
579622
580623 Admin-chosen slug identifier.
581624
582 - `poll_status: object { consecutive_failures, last_fetched_at, next_poll_at } or null`
625 - `poll_status: object or null`
583626
584627 Status of automatic JWKS polling for a federation issuer.
585628
from line 638
595638
596639 When the last successful fetch completed.
597640
641 format: date-time
642
598643 - `next_poll_at: string or null`
599644
600645 When the next fetch is scheduled. Null if paused.
601646
647 format: date-time
648
602649 - `type: "federation_issuer"`
603650
604 - `"federation_issuer"`
651 default: federation_issuer
605652
606653 - `updated_at: string`
607654
608655 When this issuer was last updated.
609656
657 format: date-time
658
610659 - `updated_by_actor_id: string or null`
611660
612661 Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.
from line 666
617666
618667### Example
619668
620```http
669```bash
621670curl https://api.anthropic.com/v1/organizations/federation_issuers \
622671 -H 'anthropic-version: 2023-06-01' \
623672 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
624673```
625674
626#### Response
675#### Response (200)
627676
628677```json
629678{
from line 709
660709
661710## Update Federation Issuer
662711
663**post** `/v1/organizations/federation_issuers/{federation_issuer_id}`
712**POST** `/v1/organizations/federation_issuers/{federation_issuer_id}`
664713
665714Partially update a federation issuer.
666715
from line 721
672721session. Requires an OAuth bearer or Console session; Admin API keys
673722are not accepted.
674723
675### Path Parameters
724### Path parameters
676725
677726- `federation_issuer_id: string`
678727
679728 ID of the federation issuer to update.
680729
681### Header Parameters
730### Headers
682731
683732- `"anthropic-beta": optional array of string`
684733
from line 735
686735
687736 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
688737
689### Body Parameters
738### Body parameters
690739
691740- `check_jti: optional boolean or null`
692741
from line 745
696745
697746 Replaces the `iss` claim value to match against. For discovery-mode issuers without a `discovery_base`, this is also the URL Anthropic fetches the OIDC discovery document and signing keys from, so changing it repoints the JWKS source. Changing the issuer URL to a well-known shared platform is rejected while any live rule under this issuer would not constrain tenant identity.
698747
699- `jwks: optional object { type, ca_cert_pem, discovery_base } or object { type, url, ca_cert_pem } or object { keys, type } or null`
748 minLength: 1
700749
750- `jwks: optional object or object or object or null`
751
701752 Replaces the entire JWKS configuration.
702753
703 - `Discovery object { type, ca_cert_pem, discovery_base }`
754 - `Discovery object`
704755
705756 JWKS via the issuer's OIDC discovery document.
706757
707758 - `type: "discovery"`
708759
709 - `"discovery"`
710
711760 - `ca_cert_pem: optional string or null`
712761
713762 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
714763
764 maxLength: 8192
765
715766 - `discovery_base: optional string or null`
716767
717768 Set when the discovery URL differs from `issuer_url`.
718769
719 - `ExplicitURL object { type, url, ca_cert_pem }`
770 - `ExplicitURL object`
720771
721772 JWKS fetched from a fixed endpoint.
722773
723774 - `type: "explicit_url"`
724775
725 - `"explicit_url"`
726
727776 - `url: string`
728777
729778 JWKS endpoint.
730779
780 minLength: 1
781
731782 - `ca_cert_pem: optional string or null`
732783
733784 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
734785
735 - `Inline object { keys, type }`
786 maxLength: 8192
736787
788 - `Inline object`
789
737790 JWKS supplied directly; no network fetch.
738791
739792 - `keys: array of map[unknown]`
from line 793
740793
741794 Inline JWK objects.
742795
796 minItems: 1
797
743798 - `type: "inline"`
744799
745 - `"inline"`
746
747800- `jwks_polling_disabled: optional boolean or null`
748801
749802 Only `false` is accepted, to re-enable polling after the system pauses it. Polling is paused automatically; sending `true` is rejected.
from line 805
752805
753806 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
754807
808 maximum: 176400, exclusiveMinimum: 0
809
755810- `name: optional string or null`
756811
757812 Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
758813
814 maxLength: 255, minLength: 1
815
759816### Returns
760817
761- `FederationIssuer object { id, archived_at, archived_by_actor_id, 12 more }`
818- `FederationIssuer object`
762819
763820 Registered external OIDC identity provider.
764821
from line 830
773830
774831 If set, all rules referencing this issuer reject token exchange.
775832
833 format: date-time
834
776835 - `archived_by_actor_id: string or null`
777836
778837 Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
from line 844
785844
786845 When this issuer was created.
787846
847 format: date-time
848
788849 - `created_by_actor_id: string or null`
789850
790851 Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
from line 854
793854
794855 The `iss` claim value. Incoming JWTs must match exactly.
795856
796 - `jwks: object { type, ca_cert_pem, discovery_base } or object { type, url, ca_cert_pem } or object { keys, type }`
857 - `jwks: object or object or object`
797858
798859 How signing keys are obtained for signature verification.
799860
800 - `Discovery object { type, ca_cert_pem, discovery_base }`
861 - `Discovery object`
801862
802863 JWKS via the issuer's OIDC discovery document.
803864
804865 - `type: "discovery"`
805866
806 - `"discovery"`
807
808867 - `ca_cert_pem: optional string or null`
809868
810869 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
811870
871 maxLength: 8192
872
812873 - `discovery_base: optional string or null`
813874
814875 Set when the discovery URL differs from `issuer_url`.
815876
816 - `ExplicitURL object { type, url, ca_cert_pem }`
877 - `ExplicitURL object`
817878
818879 JWKS fetched from a fixed endpoint.
819880
820881 - `type: "explicit_url"`
821882
822 - `"explicit_url"`
823
824883 - `url: string`
825884
826885 JWKS endpoint.
827886
887 minLength: 1
888
828889 - `ca_cert_pem: optional string or null`
829890
830891 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
831892
832 - `Inline object { keys, type }`
893 maxLength: 8192
833894
895 - `Inline object`
896
834897 JWKS supplied directly; no network fetch.
835898
836899 - `keys: array of map[unknown]`
from line 900
837900
838901 Inline JWK objects.
839902
903 minItems: 1
904
840905 - `type: "inline"`
841906
842 - `"inline"`
843
844907 - `jwks_polling_disabled_at: string or null`
845908
846909 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
847910
911 format: date-time
912
848913 - `max_jwt_lifetime_seconds: number`
849914
850915 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
from line 918
853918
854919 Admin-chosen slug identifier.
855920
856 - `poll_status: object { consecutive_failures, last_fetched_at, next_poll_at } or null`
921 - `poll_status: object or null`
857922
858923 Status of automatic JWKS polling for a federation issuer.
859924
from line 934
869934
870935 When the last successful fetch completed.
871936
937 format: date-time
938
872939 - `next_poll_at: string or null`
873940
874941 When the next fetch is scheduled. Null if paused.
875942
943 format: date-time
944
876945 - `type: "federation_issuer"`
877946
878 - `"federation_issuer"`
947 default: federation_issuer
879948
880949 - `updated_at: string`
881950
882951 When this issuer was last updated.
883952
953 format: date-time
954
884955 - `updated_by_actor_id: string or null`
885956
886957 Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.
from line 958
887958
888959### Example
889960
890```http
961```bash
891962curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID \
892963 -H 'Content-Type: application/json' \
893964 -H 'anthropic-version: 2023-06-01' \
from line 966
895966 -d '{}'
896967```
897968
898#### Response
969#### Response (200)
899970
900971```json
901972{
from line 998
927998
928999## Archive Federation Issuer
9291000
930**post** `/v1/organizations/federation_issuers/{federation_issuer_id}/archive`
1001**POST** `/v1/organizations/federation_issuers/{federation_issuer_id}/archive`
9311002
9321003Archive a federation issuer.
9331004
from line 1010
9391010Requires an OAuth bearer or Console session; Admin API keys are not
9401011accepted.
9411012
942### Path Parameters
1013### Path parameters
9431014
9441015- `federation_issuer_id: string`
9451016
9461017 ID of the federation issuer to archive.
9471018
948### Header Parameters
1019### Headers
9491020
9501021- `"anthropic-beta": optional array of string`
9511022
from line 1026
9551026
9561027### Returns
9571028
958- `FederationIssuer object { id, archived_at, archived_by_actor_id, 12 more }`
1029- `FederationIssuer object`
9591030
9601031 Registered external OIDC identity provider.
9611032
from line 1041
9701041
9711042 If set, all rules referencing this issuer reject token exchange.
9721043
1044 format: date-time
1045
9731046 - `archived_by_actor_id: string or null`
9741047
9751048 Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
from line 1055
9821055
9831056 When this issuer was created.
9841057
1058 format: date-time
1059
9851060 - `created_by_actor_id: string or null`
9861061
9871062 Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
from line 1065
9901065
9911066 The `iss` claim value. Incoming JWTs must match exactly.
9921067
993 - `jwks: object { type, ca_cert_pem, discovery_base } or object { type, url, ca_cert_pem } or object { keys, type }`
1068 - `jwks: object or object or object`
9941069
9951070 How signing keys are obtained for signature verification.
9961071
997 - `Discovery object { type, ca_cert_pem, discovery_base }`
1072 - `Discovery object`
9981073
9991074 JWKS via the issuer's OIDC discovery document.
10001075
10011076 - `type: "discovery"`
10021077
1003 - `"discovery"`
1004
10051078 - `ca_cert_pem: optional string or null`
10061079
10071080 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
10081081
1082 maxLength: 8192
1083
10091084 - `discovery_base: optional string or null`
10101085
10111086 Set when the discovery URL differs from `issuer_url`.
10121087
1013 - `ExplicitURL object { type, url, ca_cert_pem }`
1088 - `ExplicitURL object`
10141089
10151090 JWKS fetched from a fixed endpoint.
10161091
10171092 - `type: "explicit_url"`
10181093
1019 - `"explicit_url"`
1020
10211094 - `url: string`
10221095
10231096 JWKS endpoint.
10241097
1098 minLength: 1
1099
10251100 - `ca_cert_pem: optional string or null`
10261101
10271102 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
10281103
1029 - `Inline object { keys, type }`
1104 maxLength: 8192
10301105
1106 - `Inline object`
1107
10311108 JWKS supplied directly; no network fetch.
10321109
10331110 - `keys: array of map[unknown]`
from line 1111
10341111
10351112 Inline JWK objects.
10361113
1114 minItems: 1
1115
10371116 - `type: "inline"`
10381117
1039 - `"inline"`
1040
10411118 - `jwks_polling_disabled_at: string or null`
10421119
10431120 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
10441121
1122 format: date-time
1123
10451124 - `max_jwt_lifetime_seconds: number`
10461125
10471126 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
from line 1129
10501129
10511130 Admin-chosen slug identifier.
10521131
1053 - `poll_status: object { consecutive_failures, last_fetched_at, next_poll_at } or null`
1132 - `poll_status: object or null`
10541133
10551134 Status of automatic JWKS polling for a federation issuer.
10561135
from line 1145
10661145
10671146 When the last successful fetch completed.
10681147
1148 format: date-time
1149
10691150 - `next_poll_at: string or null`
10701151
10711152 When the next fetch is scheduled. Null if paused.
10721153
1154 format: date-time
1155
10731156 - `type: "federation_issuer"`
10741157
1075 - `"federation_issuer"`
1158 default: federation_issuer
10761159
10771160 - `updated_at: string`
10781161
10791162 When this issuer was last updated.
10801163
1164 format: date-time
1165
10811166 - `updated_by_actor_id: string or null`
10821167
10831168 Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.
from line 1169
10841169
10851170### Example
10861171
1087```http
1172```bash
10881173curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID/archive \
10891174 -X POST \
10901175 -H 'anthropic-version: 2023-06-01' \
from line 1176
10911176 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
10921177```
10931178
1094#### Response
1179#### Response (200)
10951180
10961181```json
10971182{
from line 1206
11211206}
11221207```
11231208
1124## Domain Types
1209## Domain types
11251210
11261211### Federation Issuer
11271212
1128- `FederationIssuer object { id, archived_at, archived_by_actor_id, 12 more }`
1213- `FederationIssuer object`
11291214
11301215 Registered external OIDC identity provider.
11311216
from line 1225
11401225
11411226 If set, all rules referencing this issuer reject token exchange.
11421227
1228 format: date-time
1229
11431230 - `archived_by_actor_id: string or null`
11441231
11451232 Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
from line 1239
11521239
11531240 When this issuer was created.
11541241
1242 format: date-time
1243
11551244 - `created_by_actor_id: string or null`
11561245
11571246 Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
from line 1249
11601249
11611250 The `iss` claim value. Incoming JWTs must match exactly.
11621251
1163 - `jwks: object { type, ca_cert_pem, discovery_base } or object { type, url, ca_cert_pem } or object { keys, type }`
1252 - `jwks: object or object or object`
11641253
11651254 How signing keys are obtained for signature verification.
11661255
1167 - `Discovery object { type, ca_cert_pem, discovery_base }`
1256 - `Discovery object`
11681257
11691258 JWKS via the issuer's OIDC discovery document.
11701259
11711260 - `type: "discovery"`
11721261
1173 - `"discovery"`
1174
11751262 - `ca_cert_pem: optional string or null`
11761263
11771264 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
11781265
1266 maxLength: 8192
1267
11791268 - `discovery_base: optional string or null`
11801269
11811270 Set when the discovery URL differs from `issuer_url`.
11821271
1183 - `ExplicitURL object { type, url, ca_cert_pem }`
1272 - `ExplicitURL object`
11841273
11851274 JWKS fetched from a fixed endpoint.
11861275
11871276 - `type: "explicit_url"`
11881277
1189 - `"explicit_url"`
1190
11911278 - `url: string`
11921279
11931280 JWKS endpoint.
11941281
1282 minLength: 1
1283
11951284 - `ca_cert_pem: optional string or null`
11961285
11971286 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
11981287
1199 - `Inline object { keys, type }`
1288 maxLength: 8192
12001289
1290 - `Inline object`
1291
12011292 JWKS supplied directly; no network fetch.
12021293
12031294 - `keys: array of map[unknown]`
from line 1295
12041295
12051296 Inline JWK objects.
12061297
1298 minItems: 1
1299
12071300 - `type: "inline"`
12081301
1209 - `"inline"`
1210
12111302 - `jwks_polling_disabled_at: string or null`
12121303
12131304 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
12141305
1306 format: date-time
1307
12151308 - `max_jwt_lifetime_seconds: number`
12161309
12171310 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
from line 1313
12201313
12211314 Admin-chosen slug identifier.
12221315
1223 - `poll_status: object { consecutive_failures, last_fetched_at, next_poll_at } or null`
1316 - `poll_status: object or null`
12241317
12251318 Status of automatic JWKS polling for a federation issuer.
12261319
from line 1329
12361329
12371330 When the last successful fetch completed.
12381331
1332 format: date-time
1333
12391334 - `next_poll_at: string or null`
12401335
12411336 When the next fetch is scheduled. Null if paused.
12421337
1338 format: date-time
1339
12431340 - `type: "federation_issuer"`
12441341
1245 - `"federation_issuer"`
1342 default: federation_issuer
12461343
12471344 - `updated_at: string`
12481345
12491346 When this issuer was last updated.
1347
1348 format: date-time
12501349
12511350 - `updated_by_actor_id: string or null`
12521351
api/admin/federation_issuers/archive Changed · +38 / -29 lines
# Archive Federation Issuer ## Path parameters ## Headers ## Returns ## Example ### Response (200) ## Archive Federation Issuer ### Path Parameters ### Header Parameters ### Returns ### Example #### Response
from line 1
1---
2title: Archive Federation Issuer
3url: https://platform.claude.com/docs/en/api/admin/federation_issuers/archive
4---
1# Archive Federation Issuer
52
6## Archive Federation Issuer
3**POST** `/v1/organizations/federation_issuers/{federation_issuer_id}/archive`
74
8**post** `/v1/organizations/federation_issuers/{federation_issuer_id}/archive`
9
105Archive a federation issuer.
116
127Idempotent; re-archiving returns the issuer with its original
from line 12
1712Requires an OAuth bearer or Console session; Admin API keys are not
1813accepted.
1914
20### Path Parameters
15## Path parameters
2116
2217- `federation_issuer_id: string`
2318
2419 ID of the federation issuer to archive.
2520
26### Header Parameters
21## Headers
2722
2823- `"anthropic-beta": optional array of string`
2924
from line 26
3126
3227 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
3328
34### Returns
29## Returns
3530
36- `FederationIssuer object { id, archived_at, archived_by_actor_id, 12 more }`
31- `FederationIssuer object`
3732
3833 Registered external OIDC identity provider.
3934
from line 43
4843
4944 If set, all rules referencing this issuer reject token exchange.
5045
46 format: date-time
47
5148 - `archived_by_actor_id: string or null`
5249
5350 Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
from line 57
6057
6158 When this issuer was created.
6259
60 format: date-time
61
6362 - `created_by_actor_id: string or null`
6463
6564 Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
from line 67
6867
6968 The `iss` claim value. Incoming JWTs must match exactly.
7069
71 - `jwks: object { type, ca_cert_pem, discovery_base } or object { type, url, ca_cert_pem } or object { keys, type }`
70 - `jwks: object or object or object`
7271
7372 How signing keys are obtained for signature verification.
7473
75 - `Discovery object { type, ca_cert_pem, discovery_base }`
74 - `Discovery object`
7675
7776 JWKS via the issuer's OIDC discovery document.
7877
7978 - `type: "discovery"`
8079
81 - `"discovery"`
82
8380 - `ca_cert_pem: optional string or null`
8481
8582 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
8683
84 maxLength: 8192
85
8786 - `discovery_base: optional string or null`
8887
8988 Set when the discovery URL differs from `issuer_url`.
9089
91 - `ExplicitURL object { type, url, ca_cert_pem }`
90 - `ExplicitURL object`
9291
9392 JWKS fetched from a fixed endpoint.
9493
9594 - `type: "explicit_url"`
9695
97 - `"explicit_url"`
98
9996 - `url: string`
10097
10198 JWKS endpoint.
10299
100 minLength: 1
101
103102 - `ca_cert_pem: optional string or null`
104103
105104 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
106105
107 - `Inline object { keys, type }`
106 maxLength: 8192
108107
108 - `Inline object`
109
109110 JWKS supplied directly; no network fetch.
110111
111112 - `keys: array of map[unknown]`
from line 113
112113
113114 Inline JWK objects.
114115
116 minItems: 1
117
115118 - `type: "inline"`
116119
117 - `"inline"`
118
119120 - `jwks_polling_disabled_at: string or null`
120121
121122 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
122123
124 format: date-time
125
123126 - `max_jwt_lifetime_seconds: number`
124127
125128 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
from line 131
128131
129132 Admin-chosen slug identifier.
130133
131 - `poll_status: object { consecutive_failures, last_fetched_at, next_poll_at } or null`
134 - `poll_status: object or null`
132135
133136 Status of automatic JWKS polling for a federation issuer.
134137
from line 147
144147
145148 When the last successful fetch completed.
146149
150 format: date-time
151
147152 - `next_poll_at: string or null`
148153
149154 When the next fetch is scheduled. Null if paused.
150155
156 format: date-time
157
151158 - `type: "federation_issuer"`
152159
153 - `"federation_issuer"`
160 default: federation_issuer
154161
155162 - `updated_at: string`
156163
157164 When this issuer was last updated.
158165
166 format: date-time
167
159168 - `updated_by_actor_id: string or null`
160169
161170 Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.
162171
163### Example
172## Example
164173
165```http
174```bash
166175curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID/archive \
167176 -X POST \
168177 -H 'anthropic-version: 2023-06-01' \
from line 178
169178 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
170179```
171180
172#### Response
181### Response (200)
173182
174183```json
175184{
api/admin/federation_issuers/create Changed · +56 / -39 lines
# Create Federation Issuer ## Headers ## Body parameters ## Returns ## Example ### Response (200) ## Create Federation Issuer ### Header Parameters ### Body Parameters ### Returns ### Example #### Response
from line 1
1---
2title: Create Federation Issuer
3url: https://platform.claude.com/docs/en/api/admin/federation_issuers/create
4---
1# Create Federation Issuer
52
6## Create Federation Issuer
3**POST** `/v1/organizations/federation_issuers`
74
8**post** `/v1/organizations/federation_issuers`
9
105Register an OIDC issuer that Anthropic will trust for workload identity
116federation in your organization.
127
from line 17
2217Requires an OAuth bearer or Console session; Admin API keys are not
2318accepted.
2419
25### Header Parameters
20## Headers
2621
2722- `"anthropic-beta": optional array of string`
2823
from line 25
3025
3126 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
3227
33### Body Parameters
28## Body parameters
3429
3530- `issuer_url: string`
3631
3732 The `iss` claim value to match against.
3833
34 minLength: 1
35
3936- `name: string`
4037
4138 Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
4239
40 maxLength: 255, minLength: 1
41
4342- `check_jti: optional boolean or null`
4443
4544 Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Defaults to true. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.
4645
47- `jwks: optional object { type, ca_cert_pem, discovery_base } or object { type, url, ca_cert_pem } or object { keys, type }`
46- `jwks: optional object or object or object`
4847
4948 How signing keys are obtained. Defaults to OIDC discovery.
5049
51 - `Discovery object { type, ca_cert_pem, discovery_base }`
50 - `Discovery object`
5251
5352 JWKS via the issuer's OIDC discovery document.
5453
5554 - `type: "discovery"`
5655
57 - `"discovery"`
58
5956 - `ca_cert_pem: optional string or null`
6057
6158 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
6259
60 maxLength: 8192
61
6362 - `discovery_base: optional string or null`
6463
6564 Set when the discovery URL differs from `issuer_url`.
6665
67 - `ExplicitURL object { type, url, ca_cert_pem }`
66 - `ExplicitURL object`
6867
6968 JWKS fetched from a fixed endpoint.
7069
7170 - `type: "explicit_url"`
7271
73 - `"explicit_url"`
74
7572 - `url: string`
7673
7774 JWKS endpoint.
7875
76 minLength: 1
77
7978 - `ca_cert_pem: optional string or null`
8079
8180 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
8281
83 - `Inline object { keys, type }`
82 maxLength: 8192
8483
84 - `Inline object`
85
8586 JWKS supplied directly; no network fetch.
8687
8788 - `keys: array of map[unknown]`
from line 89
8889
8990 Inline JWK objects.
9091
92 minItems: 1
93
9194 - `type: "inline"`
9295
93 - `"inline"`
94
9596- `max_jwt_lifetime_seconds: optional number or null`
9697
9798 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Defaults to 3600 (1h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
9899
99### Returns
100 maximum: 176400, exclusiveMinimum: 0
100101
101- `FederationIssuer object { id, archived_at, archived_by_actor_id, 12 more }`
102## Returns
102103
104- `FederationIssuer object`
105
103106 Registered external OIDC identity provider.
104107
105108 Records an external IdP the organization trusts for the RFC 7523
from line 116
113116
114117 If set, all rules referencing this issuer reject token exchange.
115118
119 format: date-time
120
116121 - `archived_by_actor_id: string or null`
117122
118123 Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
from line 130
125130
126131 When this issuer was created.
127132
133 format: date-time
134
128135 - `created_by_actor_id: string or null`
129136
130137 Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
from line 140
133140
134141 The `iss` claim value. Incoming JWTs must match exactly.
135142
136 - `jwks: object { type, ca_cert_pem, discovery_base } or object { type, url, ca_cert_pem } or object { keys, type }`
143 - `jwks: object or object or object`
137144
138145 How signing keys are obtained for signature verification.
139146
140 - `Discovery object { type, ca_cert_pem, discovery_base }`
147 - `Discovery object`
141148
142149 JWKS via the issuer's OIDC discovery document.
143150
144151 - `type: "discovery"`
145152
146 - `"discovery"`
147
148153 - `ca_cert_pem: optional string or null`
149154
150155 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
151156
157 maxLength: 8192
158
152159 - `discovery_base: optional string or null`
153160
154161 Set when the discovery URL differs from `issuer_url`.
155162
156 - `ExplicitURL object { type, url, ca_cert_pem }`
163 - `ExplicitURL object`
157164
158165 JWKS fetched from a fixed endpoint.
159166
160167 - `type: "explicit_url"`
161168
162 - `"explicit_url"`
163
164169 - `url: string`
165170
166171 JWKS endpoint.
167172
173 minLength: 1
174
168175 - `ca_cert_pem: optional string or null`
169176
170177 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
171178
172 - `Inline object { keys, type }`
179 maxLength: 8192
173180
181 - `Inline object`
182
174183 JWKS supplied directly; no network fetch.
175184
176185 - `keys: array of map[unknown]`
from line 186
177186
178187 Inline JWK objects.
179188
189 minItems: 1
190
180191 - `type: "inline"`
181192
182 - `"inline"`
183
184193 - `jwks_polling_disabled_at: string or null`
185194
186195 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
187196
197 format: date-time
198
188199 - `max_jwt_lifetime_seconds: number`
189200
190201 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
from line 204
193204
194205 Admin-chosen slug identifier.
195206
196 - `poll_status: object { consecutive_failures, last_fetched_at, next_poll_at } or null`
207 - `poll_status: object or null`
197208
198209 Status of automatic JWKS polling for a federation issuer.
199210
from line 220
209220
210221 When the last successful fetch completed.
211222
223 format: date-time
224
212225 - `next_poll_at: string or null`
213226
214227 When the next fetch is scheduled. Null if paused.
215228
229 format: date-time
230
216231 - `type: "federation_issuer"`
217232
218 - `"federation_issuer"`
233 default: federation_issuer
219234
220235 - `updated_at: string`
221236
222237 When this issuer was last updated.
223238
239 format: date-time
240
224241 - `updated_by_actor_id: string or null`
225242
226243 Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.
227244
228### Example
245## Example
229246
230```http
247```bash
231248curl https://api.anthropic.com/v1/organizations/federation_issuers \
232249 -H 'Content-Type: application/json' \
233250 -H 'anthropic-version: 2023-06-01' \
from line 255
238255 }'
239256```
240257
241#### Response
258### Response (200)
242259
243260```json
244261{
api/admin/federation_issuers/list Changed · +40 / -27 lines
# List Federation Issuers ## Query parameters ## Headers ## Returns ## Example ### Response (200) ## List Federation Issuers ### Query Parameters ### Header Parameters ### Returns ### Example #### Response
from line 1
1---
2title: List Federation Issuers
3url: https://platform.claude.com/docs/en/api/admin/federation_issuers/list
4---
1# List Federation Issuers
52
6## List Federation Issuers
3**GET** `/v1/organizations/federation_issuers`
74
8**get** `/v1/organizations/federation_issuers`
9
105List federation issuers in your organization.
116
127Archived issuers are excluded unless `include_archived=true`.
138
14### Query Parameters
9## Query parameters
1510
1611- `include_archived: optional boolean`
1712
1813 Include archived resources. Defaults to false.
1914
15 default: false
16
2017- `limit: optional number`
2118
2219 Number of results per page.
2320
21 default: 20, maximum: 100, minimum: 1
22
2423- `page: optional string`
2524
2625 Opaque cursor from a previous response's `next_page`.
2726
28### Header Parameters
27## Headers
2928
3029- `"anthropic-beta": optional array of string`
3130
from line 32
3332
3433 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
3534
36### Returns
35## Returns
3736
3837- `data: array of FederationIssuer`
3938
from line 44
4544
4645 If set, all rules referencing this issuer reject token exchange.
4746
47 format: date-time
48
4849 - `archived_by_actor_id: string or null`
4950
5051 Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
from line 58
5758
5859 When this issuer was created.
5960
61 format: date-time
62
6063 - `created_by_actor_id: string or null`
6164
6265 Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
from line 68
6568
6669 The `iss` claim value. Incoming JWTs must match exactly.
6770
68 - `jwks: object { type, ca_cert_pem, discovery_base } or object { type, url, ca_cert_pem } or object { keys, type }`
71 - `jwks: object or object or object`
6972
7073 How signing keys are obtained for signature verification.
7174
72 - `Discovery object { type, ca_cert_pem, discovery_base }`
75 - `Discovery object`
7376
7477 JWKS via the issuer's OIDC discovery document.
7578
7679 - `type: "discovery"`
7780
78 - `"discovery"`
79
8081 - `ca_cert_pem: optional string or null`
8182
8283 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
8384
85 maxLength: 8192
86
8487 - `discovery_base: optional string or null`
8588
8689 Set when the discovery URL differs from `issuer_url`.
8790
88 - `ExplicitURL object { type, url, ca_cert_pem }`
91 - `ExplicitURL object`
8992
9093 JWKS fetched from a fixed endpoint.
9194
9295 - `type: "explicit_url"`
9396
94 - `"explicit_url"`
95
9697 - `url: string`
9798
9899 JWKS endpoint.
99100
101 minLength: 1
102
100103 - `ca_cert_pem: optional string or null`
101104
102105 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
103106
104 - `Inline object { keys, type }`
107 maxLength: 8192
105108
109 - `Inline object`
110
106111 JWKS supplied directly; no network fetch.
107112
108113 - `keys: array of map[unknown]`
from line 114
109114
110115 Inline JWK objects.
111116
117 minItems: 1
118
112119 - `type: "inline"`
113120
114 - `"inline"`
115
116121 - `jwks_polling_disabled_at: string or null`
117122
118123 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
119124
125 format: date-time
126
120127 - `max_jwt_lifetime_seconds: number`
121128
122129 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
from line 132
125132
126133 Admin-chosen slug identifier.
127134
128 - `poll_status: object { consecutive_failures, last_fetched_at, next_poll_at } or null`
135 - `poll_status: object or null`
129136
130137 Status of automatic JWKS polling for a federation issuer.
131138
from line 148
141148
142149 When the last successful fetch completed.
143150
151 format: date-time
152
144153 - `next_poll_at: string or null`
145154
146155 When the next fetch is scheduled. Null if paused.
147156
157 format: date-time
158
148159 - `type: "federation_issuer"`
149160
150 - `"federation_issuer"`
161 default: federation_issuer
151162
152163 - `updated_at: string`
153164
154165 When this issuer was last updated.
155166
167 format: date-time
168
156169 - `updated_by_actor_id: string or null`
157170
158171 Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.
from line 174
161174
162175 Opaque cursor for the next page, or null if no more results.
163176
164### Example
177## Example
165178
166```http
179```bash
167180curl https://api.anthropic.com/v1/organizations/federation_issuers \
168181 -H 'anthropic-version: 2023-06-01' \
169182 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
170183```
171184
172#### Response
185### Response (200)
173186
174187```json
175188{
api/admin/federation_issuers/retrieve Changed · +38 / -29 lines
# Get Federation Issuer ## Path parameters ## Headers ## Returns ## Example ### Response (200) ## Get Federation Issuer ### Path Parameters ### Header Parameters ### Returns ### Example #### Response
from line 1
1---
2title: Get Federation Issuer
3url: https://platform.claude.com/docs/en/api/admin/federation_issuers/retrieve
4---
1# Get Federation Issuer
52
6## Get Federation Issuer
3**GET** `/v1/organizations/federation_issuers/{federation_issuer_id}`
74
8**get** `/v1/organizations/federation_issuers/{federation_issuer_id}`
9
105Retrieve a federation issuer by its ID (`fdis_...`).
116
12### Path Parameters
7## Path parameters
138
149- `federation_issuer_id: string`
1510
1611 ID of the federation issuer.
1712
18### Header Parameters
13## Headers
1914
2015- `"anthropic-beta": optional array of string`
2116
from line 18
2318
2419 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
2520
26### Returns
21## Returns
2722
28- `FederationIssuer object { id, archived_at, archived_by_actor_id, 12 more }`
23- `FederationIssuer object`
2924
3025 Registered external OIDC identity provider.
3126
from line 35
4035
4136 If set, all rules referencing this issuer reject token exchange.
4237
38 format: date-time
39
4340 - `archived_by_actor_id: string or null`
4441
4542 Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
from line 49
5249
5350 When this issuer was created.
5451
52 format: date-time
53
5554 - `created_by_actor_id: string or null`
5655
5756 Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
from line 59
6059
6160 The `iss` claim value. Incoming JWTs must match exactly.
6261
63 - `jwks: object { type, ca_cert_pem, discovery_base } or object { type, url, ca_cert_pem } or object { keys, type }`
62 - `jwks: object or object or object`
6463
6564 How signing keys are obtained for signature verification.
6665
67 - `Discovery object { type, ca_cert_pem, discovery_base }`
66 - `Discovery object`
6867
6968 JWKS via the issuer's OIDC discovery document.
7069
7170 - `type: "discovery"`
7271
73 - `"discovery"`
74
7572 - `ca_cert_pem: optional string or null`
7673
7774 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
7875
76 maxLength: 8192
77
7978 - `discovery_base: optional string or null`
8079
8180 Set when the discovery URL differs from `issuer_url`.
8281
83 - `ExplicitURL object { type, url, ca_cert_pem }`
82 - `ExplicitURL object`
8483
8584 JWKS fetched from a fixed endpoint.
8685
8786 - `type: "explicit_url"`
8887
89 - `"explicit_url"`
90
9188 - `url: string`
9289
9390 JWKS endpoint.
9491
92 minLength: 1
93
9594 - `ca_cert_pem: optional string or null`
9695
9796 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
9897
99 - `Inline object { keys, type }`
98 maxLength: 8192
10099
100 - `Inline object`
101
101102 JWKS supplied directly; no network fetch.
102103
103104 - `keys: array of map[unknown]`
from line 105
104105
105106 Inline JWK objects.
106107
108 minItems: 1
109
107110 - `type: "inline"`
108111
109 - `"inline"`
110
111112 - `jwks_polling_disabled_at: string or null`
112113
113114 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
114115
116 format: date-time
117
115118 - `max_jwt_lifetime_seconds: number`
116119
117120 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
from line 123
120123
121124 Admin-chosen slug identifier.
122125
123 - `poll_status: object { consecutive_failures, last_fetched_at, next_poll_at } or null`
126 - `poll_status: object or null`
124127
125128 Status of automatic JWKS polling for a federation issuer.
126129
from line 139
136139
137140 When the last successful fetch completed.
138141
142 format: date-time
143
139144 - `next_poll_at: string or null`
140145
141146 When the next fetch is scheduled. Null if paused.
142147
148 format: date-time
149
143150 - `type: "federation_issuer"`
144151
145 - `"federation_issuer"`
152 default: federation_issuer
146153
147154 - `updated_at: string`
148155
149156 When this issuer was last updated.
150157
158 format: date-time
159
151160 - `updated_by_actor_id: string or null`
152161
153162 Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.
154163
155### Example
164## Example
156165
157```http
166```bash
158167curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID \
159168 -H 'anthropic-version: 2023-06-01' \
160169 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
161170```
162171
163#### Response
172### Response (200)
164173
165174```json
166175{
api/admin/federation_issuers/update Changed · +57 / -40 lines
# Update Federation Issuer ## Path parameters ## Headers ## Body parameters ## Returns ## Example ### Response (200) ## Update Federation Issuer ### Path Parameters ### Header Parameters ### Body Parameters ### Returns ### Example #### Response
from line 1
1---
2title: Update Federation Issuer
3url: https://platform.claude.com/docs/en/api/admin/federation_issuers/update
4---
1# Update Federation Issuer
52
6## Update Federation Issuer
3**POST** `/v1/organizations/federation_issuers/{federation_issuer_id}`
74
8**post** `/v1/organizations/federation_issuers/{federation_issuer_id}`
9
105Partially update a federation issuer.
116
127Setting `jwks` replaces the full JWKS shape at once. Archived issuers
from line 12
1712session. Requires an OAuth bearer or Console session; Admin API keys
1813are not accepted.
1914
20### Path Parameters
15## Path parameters
2116
2217- `federation_issuer_id: string`
2318
2419 ID of the federation issuer to update.
2520
26### Header Parameters
21## Headers
2722
2823- `"anthropic-beta": optional array of string`
2924
from line 26
3126
3227 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
3328
34### Body Parameters
29## Body parameters
3530
3631- `check_jti: optional boolean or null`
3732
from line 36
4136
4237 Replaces the `iss` claim value to match against. For discovery-mode issuers without a `discovery_base`, this is also the URL Anthropic fetches the OIDC discovery document and signing keys from, so changing it repoints the JWKS source. Changing the issuer URL to a well-known shared platform is rejected while any live rule under this issuer would not constrain tenant identity.
4338
44- `jwks: optional object { type, ca_cert_pem, discovery_base } or object { type, url, ca_cert_pem } or object { keys, type } or null`
39 minLength: 1
4540
41- `jwks: optional object or object or object or null`
42
4643 Replaces the entire JWKS configuration.
4744
48 - `Discovery object { type, ca_cert_pem, discovery_base }`
45 - `Discovery object`
4946
5047 JWKS via the issuer's OIDC discovery document.
5148
5249 - `type: "discovery"`
5350
54 - `"discovery"`
55
5651 - `ca_cert_pem: optional string or null`
5752
5853 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
5954
55 maxLength: 8192
56
6057 - `discovery_base: optional string or null`
6158
6259 Set when the discovery URL differs from `issuer_url`.
6360
64 - `ExplicitURL object { type, url, ca_cert_pem }`
61 - `ExplicitURL object`
6562
6663 JWKS fetched from a fixed endpoint.
6764
6865 - `type: "explicit_url"`
6966
70 - `"explicit_url"`
71
7267 - `url: string`
7368
7469 JWKS endpoint.
7570
71 minLength: 1
72
7673 - `ca_cert_pem: optional string or null`
7774
7875 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
7976
80 - `Inline object { keys, type }`
77 maxLength: 8192
8178
79 - `Inline object`
80
8281 JWKS supplied directly; no network fetch.
8382
8483 - `keys: array of map[unknown]`
from line 84
8584
8685 Inline JWK objects.
8786
87 minItems: 1
88
8889 - `type: "inline"`
8990
90 - `"inline"`
91
9291- `jwks_polling_disabled: optional boolean or null`
9392
9493 Only `false` is accepted, to re-enable polling after the system pauses it. Polling is paused automatically; sending `true` is rejected.
from line 96
9796
9897 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
9998
99 maximum: 176400, exclusiveMinimum: 0
100
100101- `name: optional string or null`
101102
102103 Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
103104
104### Returns
105 maxLength: 255, minLength: 1
105106
106- `FederationIssuer object { id, archived_at, archived_by_actor_id, 12 more }`
107## Returns
107108
109- `FederationIssuer object`
110
108111 Registered external OIDC identity provider.
109112
110113 Records an external IdP the organization trusts for the RFC 7523
from line 121
118121
119122 If set, all rules referencing this issuer reject token exchange.
120123
124 format: date-time
125
121126 - `archived_by_actor_id: string or null`
122127
123128 Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
from line 135
130135
131136 When this issuer was created.
132137
138 format: date-time
139
133140 - `created_by_actor_id: string or null`
134141
135142 Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
from line 145
138145
139146 The `iss` claim value. Incoming JWTs must match exactly.
140147
141 - `jwks: object { type, ca_cert_pem, discovery_base } or object { type, url, ca_cert_pem } or object { keys, type }`
148 - `jwks: object or object or object`
142149
143150 How signing keys are obtained for signature verification.
144151
145 - `Discovery object { type, ca_cert_pem, discovery_base }`
152 - `Discovery object`
146153
147154 JWKS via the issuer's OIDC discovery document.
148155
149156 - `type: "discovery"`
150157
151 - `"discovery"`
152
153158 - `ca_cert_pem: optional string or null`
154159
155160 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
156161
162 maxLength: 8192
163
157164 - `discovery_base: optional string or null`
158165
159166 Set when the discovery URL differs from `issuer_url`.
160167
161 - `ExplicitURL object { type, url, ca_cert_pem }`
168 - `ExplicitURL object`
162169
163170 JWKS fetched from a fixed endpoint.
164171
165172 - `type: "explicit_url"`
166173
167 - `"explicit_url"`
168
169174 - `url: string`
170175
171176 JWKS endpoint.
172177
178 minLength: 1
179
173180 - `ca_cert_pem: optional string or null`
174181
175182 Optional custom CA (PEM) for TLS verification of the JWKS fetch.
176183
177 - `Inline object { keys, type }`
184 maxLength: 8192
178185
186 - `Inline object`
187
179188 JWKS supplied directly; no network fetch.
180189
181190 - `keys: array of map[unknown]`
from line 191
182191
183192 Inline JWK objects.
184193
194 minItems: 1
195
185196 - `type: "inline"`
186197
187 - `"inline"`
188
189198 - `jwks_polling_disabled_at: string or null`
190199
191200 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
192201
202 format: date-time
203
193204 - `max_jwt_lifetime_seconds: number`
194205
195206 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
from line 209
198209
199210 Admin-chosen slug identifier.
200211
201 - `poll_status: object { consecutive_failures, last_fetched_at, next_poll_at } or null`
212 - `poll_status: object or null`
202213
203214 Status of automatic JWKS polling for a federation issuer.
204215
from line 225
214225
215226 When the last successful fetch completed.
216227
228 format: date-time
229
217230 - `next_poll_at: string or null`
218231
219232 When the next fetch is scheduled. Null if paused.
220233
234 format: date-time
235
221236 - `type: "federation_issuer"`
222237
223 - `"federation_issuer"`
238 default: federation_issuer
224239
225240 - `updated_at: string`
226241
227242 When this issuer was last updated.
228243
244 format: date-time
245
229246 - `updated_by_actor_id: string or null`
230247
231248 Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.
232249
233### Example
250## Example
234251
235```http
252```bash
236253curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID \
237254 -H 'Content-Type: application/json' \
238255 -H 'anthropic-version: 2023-06-01' \
from line 257
240257 -d '{}'
241258```
242259
243#### Response
260### Response (200)
244261
245262```json
246263{
api/admin/federation_rules Changed · +203 / -188 lines
### Headers ### Body parameters #### Response (200) ### Path parameters ### Headers #### Response (200) ### Query parameters ### Headers #### Response (200) ### Path parameters ### Headers ### Body parameters #### Response (200) ### Path parameters ### Headers #### Response (200) ## Domain types ## Federation Rules › Workspaces ### List Federation Rule Workspaces #### Path parameters #### Query parameters #### Headers #### Returns #### Example ##### Response (200) ### Add Federation Rule Workspace #### Path parameters #### Headers #### Body parameters #### Returns #### Example ##### Response (200) ### Remove Federation Rule Workspace #### Path parameters #### Headers #### Returns #### Example ##### Response (200) ### Header Parameters ### Body Parameters #### Response ### Path Parameters ### Header Parameters #### Response ### Query Parameters ### Header Parameters #### Response ### Path Parameters ### Header Parameters ### Body Parameters #### Response ### Path Parameters ### Header Parameters #### Response ## Domain Types # Workspaces ## List Federation Rule Workspaces ### Path Parameters ### Query Parameters ### Header Parameters #### Response ## Add Federation Rule Workspace ### Path Parameters ### Header Parameters ### Body Parameters #### Response ## Remove Federation Rule Workspace ### Path Parameters ### Header Parameters #### Response ## Domain Types ### Workspace List Response ### Workspace Create Response ### Workspace Delete Response
from line 1
1---
2title: Federation Rules
3url: https://platform.claude.com/docs/en/api/admin/federation_rules
4---
5
61# Federation Rules
72
83## Create Federation Rule
94
10**post** `/v1/organizations/federation_rules`
5**POST** `/v1/organizations/federation_rules`
116
127Create a federation rule owned by your organization.
138
from line 21
2621`workspace:inference`; other scopes require a Console session. Admin API
2722keys are not accepted.
2823
29### Header Parameters
24### Headers
3025
3126- `"anthropic-beta": optional array of string`
3227
from line 29
3429
3530 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
3631
37### Body Parameters
32### Body parameters
3833
3934- `issuer_id: string`
4035
4136 Tagged ID of the federation issuer.
4237
43- `match: object { audience, claims, condition, subject_prefix }`
38- `match: object`
4439
4540 Conditions the verified JWT must satisfy for this rule to apply. At least one of `subject_prefix` (other than a wildcard-only value like `*`), `claims`, or `condition` is required; `audience` alone is not sufficient.
4641
from line 43
4843
4944 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
5045
46 maxLength: 1024
47
5148 - `claims: optional map[string] or null`
5249
5350 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 53
5653
5754 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
5855
56 maxLength: 4096
57
5958 - `subject_prefix: optional string or null`
6059
6160 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
6261
62 maxLength: 1024
63
6364- `name: string`
6465
6566 Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
6667
68 maxLength: 255, minLength: 1
69
6770- `oauth_scope: string`
6871
6972 Space-separated OAuth scopes. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session.
7073
71- `target: object { service_account_id, type, service_account_name }`
74 minLength: 1
7275
76- `target: object`
77
7378 Identity that tokens minted via this rule act as. Currently always a `service_account` target.
7479
7580 - `service_account_id: string`
from line 83
7883
7984 - `type: "service_account"`
8085
81 - `"service_account"`
82
8386 - `service_account_name: optional string or null`
8487
8588 Service account's display name at read time. Ignored on writes.
from line 99
9699
97100 Optional free-text description.
98101
102 maxLength: 2000
103
99104- `token_lifetime_seconds: optional number`
100105
101106 Lifetime in seconds for access tokens minted via this rule (60-86400). Defaults to 3600 (1h). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.
102107
108 maximum: 86400, minimum: 60
109
103110- `workspace_id: optional string or null`
104111
105112 Tagged ID of the workspace to enable this rule for. Required unless `applies_to_all_workspaces` is true. Additional workspaces can be added via the `/federation_rules/{federation_rule_id}/workspaces` sub-resource.
from line 113
106113
107114### Returns
108115
109- `FederationRule object { id, applies_to_all_workspaces, archived_at, 17 more }`
116- `FederationRule object`
110117
111118 Authorization rule binding an external OIDC identity to Anthropic.
112119
from line 138
131138
132139 If set, this rule is archived and rejects token exchange.
133140
141 format: date-time
142
134143 - `archived_by_actor_id: string or null`
135144
136145 Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
from line 152
143152
144153 When this rule was created.
145154
155 format: date-time
156
146157 - `created_by_actor_id: string or null`
147158
148159 Tagged ID (`user_`/`svac_`) of the actor that created this rule.
from line 170
159170
160171 Issuer's display name at read time.
161172
162 - `match: object { audience, claims, condition, subject_prefix }`
173 - `match: object`
163174
164175 Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
165176
from line 178
167178
168179 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
169180
181 maxLength: 1024
182
170183 - `claims: optional map[string] or null`
171184
172185 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 188
175188
176189 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
177190
191 maxLength: 4096
192
178193 - `subject_prefix: optional string or null`
179194
180195 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
181196
197 maxLength: 1024
198
182199 - `name: string`
183200
184201 Admin-chosen slug identifier.
from line 204
187204
188205 Space-separated OAuth scopes granted on the minted token.
189206
190 - `target: object { service_account_id, type, service_account_name }`
207 - `target: object`
191208
192209 Identity that tokens minted via this rule act as. Currently always a `service_account` target.
193210
from line 214
197214
198215 - `type: "service_account"`
199216
200 - `"service_account"`
201
202217 - `service_account_name: optional string or null`
203218
204219 Service account's display name at read time. Ignored on writes.
from line 224
209224
210225 - `type: "federation_rule"`
211226
212 - `"federation_rule"`
227 default: federation_rule
213228
214229 - `updated_at: string`
215230
216231 When this rule was last updated.
217232
233 format: date-time
234
218235 - `updated_by_actor_id: string or null`
219236
220237 Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
from line 246
229246
230247### Example
231248
232```http
249```bash
233250curl https://api.anthropic.com/v1/organizations/federation_rules \
234251 -H 'Content-Type: application/json' \
235252 -H 'anthropic-version: 2023-06-01' \
from line 263
246263 }'
247264```
248265
249#### Response
266#### Response (200)
250267
251268```json
252269{
from line 307
290307
291308## Get Federation Rule
292309
293**get** `/v1/organizations/federation_rules/{federation_rule_id}`
310**GET** `/v1/organizations/federation_rules/{federation_rule_id}`
294311
295312Retrieve a federation rule by its ID (`fdrl_...`).
296313
297### Path Parameters
314### Path parameters
298315
299316- `federation_rule_id: string`
300317
301318 ID of the federation rule.
302319
303### Header Parameters
320### Headers
304321
305322- `"anthropic-beta": optional array of string`
306323
from line 327
310327
311328### Returns
312329
313- `FederationRule object { id, applies_to_all_workspaces, archived_at, 17 more }`
330- `FederationRule object`
314331
315332 Authorization rule binding an external OIDC identity to Anthropic.
316333
from line 352
335352
336353 If set, this rule is archived and rejects token exchange.
337354
355 format: date-time
356
338357 - `archived_by_actor_id: string or null`
339358
340359 Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
from line 366
347366
348367 When this rule was created.
349368
369 format: date-time
370
350371 - `created_by_actor_id: string or null`
351372
352373 Tagged ID (`user_`/`svac_`) of the actor that created this rule.
from line 384
363384
364385 Issuer's display name at read time.
365386
366 - `match: object { audience, claims, condition, subject_prefix }`
387 - `match: object`
367388
368389 Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
369390
from line 392
371392
372393 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
373394
395 maxLength: 1024
396
374397 - `claims: optional map[string] or null`
375398
376399 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 402
379402
380403 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
381404
405 maxLength: 4096
406
382407 - `subject_prefix: optional string or null`
383408
384409 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
385410
411 maxLength: 1024
412
386413 - `name: string`
387414
388415 Admin-chosen slug identifier.
from line 418
391418
392419 Space-separated OAuth scopes granted on the minted token.
393420
394 - `target: object { service_account_id, type, service_account_name }`
421 - `target: object`
395422
396423 Identity that tokens minted via this rule act as. Currently always a `service_account` target.
397424
from line 428
401428
402429 - `type: "service_account"`
403430
404 - `"service_account"`
405
406431 - `service_account_name: optional string or null`
407432
408433 Service account's display name at read time. Ignored on writes.
from line 438
413438
414439 - `type: "federation_rule"`
415440
416 - `"federation_rule"`
441 default: federation_rule
417442
418443 - `updated_at: string`
419444
420445 When this rule was last updated.
421446
447 format: date-time
448
422449 - `updated_by_actor_id: string or null`
423450
424451 Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
from line 460
433460
434461### Example
435462
436```http
463```bash
437464curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID \
438465 -H 'anthropic-version: 2023-06-01' \
439466 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
440467```
441468
442#### Response
469#### Response (200)
443470
444471```json
445472{
from line 510
483510
484511## List Federation Rules
485512
486**get** `/v1/organizations/federation_rules`
513**GET** `/v1/organizations/federation_rules`
487514
488515List federation rules in your organization.
489516
from line 517
490517Optionally filter by issuer with `issuer_id`. Archived rules are excluded
491518unless `include_archived=true`.
492519
493### Query Parameters
520### Query parameters
494521
495522- `include_archived: optional boolean`
496523
497524 Include archived resources. Defaults to false.
498525
526 default: false
527
499528- `issuer_id: optional string`
500529
501530 Filter to rules referencing this federation issuer.
from line 533
504533
505534 Number of results per page.
506535
536 default: 20, maximum: 100, minimum: 1
537
507538- `page: optional string`
508539
509540 Opaque cursor from a previous response's `next_page`.
510541
511### Header Parameters
542### Headers
512543
513544- `"anthropic-beta": optional array of string`
514545
from line 563
532563
533564 If set, this rule is archived and rejects token exchange.
534565
566 format: date-time
567
535568 - `archived_by_actor_id: string or null`
536569
537570 Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
from line 577
544577
545578 When this rule was created.
546579
580 format: date-time
581
547582 - `created_by_actor_id: string or null`
548583
549584 Tagged ID (`user_`/`svac_`) of the actor that created this rule.
from line 595
560595
561596 Issuer's display name at read time.
562597
563 - `match: object { audience, claims, condition, subject_prefix }`
598 - `match: object`
564599
565600 Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
566601
from line 603
568603
569604 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
570605
606 maxLength: 1024
607
571608 - `claims: optional map[string] or null`
572609
573610 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 613
576613
577614 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
578615
616 maxLength: 4096
617
579618 - `subject_prefix: optional string or null`
580619
581620 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
582621
622 maxLength: 1024
623
583624 - `name: string`
584625
585626 Admin-chosen slug identifier.
from line 629
588629
589630 Space-separated OAuth scopes granted on the minted token.
590631
591 - `target: object { service_account_id, type, service_account_name }`
632 - `target: object`
592633
593634 Identity that tokens minted via this rule act as. Currently always a `service_account` target.
594635
from line 639
598639
599640 - `type: "service_account"`
600641
601 - `"service_account"`
602
603642 - `service_account_name: optional string or null`
604643
605644 Service account's display name at read time. Ignored on writes.
from line 649
610649
611650 - `type: "federation_rule"`
612651
613 - `"federation_rule"`
652 default: federation_rule
614653
615654 - `updated_at: string`
616655
617656 When this rule was last updated.
618657
658 format: date-time
659
619660 - `updated_by_actor_id: string or null`
620661
621662 Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
from line 675
634675
635676### Example
636677
637```http
678```bash
638679curl https://api.anthropic.com/v1/organizations/federation_rules \
639680 -H 'anthropic-version: 2023-06-01' \
640681 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
641682```
642683
643#### Response
684#### Response (200)
644685
645686```json
646687{
from line 730
689730
690731## Update Federation Rule
691732
692**post** `/v1/organizations/federation_rules/{federation_rule_id}`
733**POST** `/v1/organizations/federation_rules/{federation_rule_id}`
693734
694735Partially update a federation rule.
695736
from line 750
709750`workspace:developer` or `workspace:inference`; other scopes require a
710751Console session. Admin API keys are not accepted.
711752
712### Path Parameters
753### Path parameters
713754
714755- `federation_rule_id: string`
715756
716757 ID of the federation rule to update.
717758
718### Header Parameters
759### Headers
719760
720761- `"anthropic-beta": optional array of string`
721762
from line 764
723764
724765 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
725766
726### Body Parameters
767### Body parameters
727768
728769- `applies_to_all_workspaces: optional boolean or null`
729770
from line 778
737778
738779 Replaces the description. Omit to leave unchanged; send `null` to clear (the field is stored as an empty string).
739780
740- `match: optional object { audience, claims, condition, subject_prefix } or null`
781 maxLength: 2000
741782
783- `match: optional object or null`
784
742785 Does the incoming JWT qualify?
743786
744787 All populated fields must pass; omitted fields are skipped. At least one
from line 792
749792
750793 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
751794
795 maxLength: 1024
796
752797 - `claims: optional map[string] or null`
753798
754799 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 802
757802
758803 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
759804
805 maxLength: 4096
806
760807 - `subject_prefix: optional string or null`
761808
762809 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
763810
811 maxLength: 1024
812
764813- `name: optional string or null`
765814
766815 Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
767816
817 maxLength: 255, minLength: 1
818
768819- `oauth_scope: optional string or null`
769820
770821 Replaces the space-separated OAuth scopes granted on minted tokens. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session.
771822
772- `target: optional object { service_account_id, type, service_account_name } or null`
823 minLength: 1
773824
825- `target: optional object or null`
826
774827 Bind to a fixed service account by ID.
775828
776829 - `service_account_id: string`
from line 832
779832
780833 - `type: "service_account"`
781834
782 - `"service_account"`
783
784835 - `service_account_name: optional string or null`
785836
786837 Service account's display name at read time. Ignored on writes.
from line 840
789840
790841 Replaces the lifetime in seconds for access tokens minted via this rule (60-86400). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.
791842
843 maximum: 86400, minimum: 60
844
792845- `workspace_id: optional string or null`
793846
794847 Replaces the existing single workspace enablement (the previous one is removed). Rejected with 400 if the rule is enabled for more than one workspace; use the `/federation_rules/{federation_rule_id}/workspaces` sub-resource instead.
from line 848
795848
796849### Returns
797850
798- `FederationRule object { id, applies_to_all_workspaces, archived_at, 17 more }`
851- `FederationRule object`
799852
800853 Authorization rule binding an external OIDC identity to Anthropic.
801854
from line 873
820873
821874 If set, this rule is archived and rejects token exchange.
822875
876 format: date-time
877
823878 - `archived_by_actor_id: string or null`
824879
825880 Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
from line 887
832887
833888 When this rule was created.
834889
890 format: date-time
891
835892 - `created_by_actor_id: string or null`
836893
837894 Tagged ID (`user_`/`svac_`) of the actor that created this rule.
from line 905
848905
849906 Issuer's display name at read time.
850907
851 - `match: object { audience, claims, condition, subject_prefix }`
908 - `match: object`
852909
853910 Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
854911
from line 913
856913
857914 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
858915
916 maxLength: 1024
917
859918 - `claims: optional map[string] or null`
860919
861920 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 923
864923
865924 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
866925
926 maxLength: 4096
927
867928 - `subject_prefix: optional string or null`
868929
869930 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
870931
932 maxLength: 1024
933
871934 - `name: string`
872935
873936 Admin-chosen slug identifier.
from line 939
876939
877940 Space-separated OAuth scopes granted on the minted token.
878941
879 - `target: object { service_account_id, type, service_account_name }`
942 - `target: object`
880943
881944 Identity that tokens minted via this rule act as. Currently always a `service_account` target.
882945
from line 949
886949
887950 - `type: "service_account"`
888951
889 - `"service_account"`
890
891952 - `service_account_name: optional string or null`
892953
893954 Service account's display name at read time. Ignored on writes.
from line 959
898959
899960 - `type: "federation_rule"`
900961
901 - `"federation_rule"`
962 default: federation_rule
902963
903964 - `updated_at: string`
904965
905966 When this rule was last updated.
906967
968 format: date-time
969
907970 - `updated_by_actor_id: string or null`
908971
909972 Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
from line 981
918981
919982### Example
920983
921```http
984```bash
922985curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID \
923986 -H 'Content-Type: application/json' \
924987 -H 'anthropic-version: 2023-06-01' \
from line 989
926989 -d '{}'
927990```
928991
929#### Response
992#### Response (200)
930993
931994```json
932995{
from line 1033
9701033
9711034## Archive Federation Rule
9721035
973**post** `/v1/organizations/federation_rules/{federation_rule_id}/archive`
1036**POST** `/v1/organizations/federation_rules/{federation_rule_id}/archive`
9741037
9751038Archive a federation rule.
9761039
from line 1045
9821045whose `oauth_scope` is `workspace:developer` or `workspace:inference`;
9831046other scopes require a Console session. Admin API keys are not accepted.
9841047
985### Path Parameters
1048### Path parameters
9861049
9871050- `federation_rule_id: string`
9881051
9891052 ID of the federation rule to archive.
9901053
991### Header Parameters
1054### Headers
9921055
9931056- `"anthropic-beta": optional array of string`
9941057
from line 1061
9981061
9991062### Returns
10001063
1001- `FederationRule object { id, applies_to_all_workspaces, archived_at, 17 more }`
1064- `FederationRule object`
10021065
10031066 Authorization rule binding an external OIDC identity to Anthropic.
10041067
from line 1086
10231086
10241087 If set, this rule is archived and rejects token exchange.
10251088
1089 format: date-time
1090
10261091 - `archived_by_actor_id: string or null`
10271092
10281093 Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
from line 1100
10351100
10361101 When this rule was created.
10371102
1103 format: date-time
1104
10381105 - `created_by_actor_id: string or null`
10391106
10401107 Tagged ID (`user_`/`svac_`) of the actor that created this rule.
from line 1118
10511118
10521119 Issuer's display name at read time.
10531120
1054 - `match: object { audience, claims, condition, subject_prefix }`
1121 - `match: object`
10551122
10561123 Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
10571124
from line 1126
10591126
10601127 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
10611128
1129 maxLength: 1024
1130
10621131 - `claims: optional map[string] or null`
10631132
10641133 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 1136
10671136
10681137 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
10691138
1139 maxLength: 4096
1140
10701141 - `subject_prefix: optional string or null`
10711142
10721143 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
10731144
1145 maxLength: 1024
1146
10741147 - `name: string`
10751148
10761149 Admin-chosen slug identifier.
from line 1152
10791152
10801153 Space-separated OAuth scopes granted on the minted token.
10811154
1082 - `target: object { service_account_id, type, service_account_name }`
1155 - `target: object`
10831156
10841157 Identity that tokens minted via this rule act as. Currently always a `service_account` target.
10851158
from line 1162
10891162
10901163 - `type: "service_account"`
10911164
1092 - `"service_account"`
1093
10941165 - `service_account_name: optional string or null`
10951166
10961167 Service account's display name at read time. Ignored on writes.
from line 1172
11011172
11021173 - `type: "federation_rule"`
11031174
1104 - `"federation_rule"`
1175 default: federation_rule
11051176
11061177 - `updated_at: string`
11071178
11081179 When this rule was last updated.
11091180
1181 format: date-time
1182
11101183 - `updated_by_actor_id: string or null`
11111184
11121185 Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
from line 1194
11211194
11221195### Example
11231196
1124```http
1197```bash
11251198curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/archive \
11261199 -X POST \
11271200 -H 'anthropic-version: 2023-06-01' \
from line 1201
11281201 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
11291202```
11301203
1131#### Response
1204#### Response (200)
11321205
11331206```json
11341207{
from line 1243
11701243}
11711244```
11721245
1173## Domain Types
1246## Domain types
11741247
11751248### Federation Rule
11761249
1177- `FederationRule object { id, applies_to_all_workspaces, archived_at, 17 more }`
1250- `FederationRule object`
11781251
11791252 Authorization rule binding an external OIDC identity to Anthropic.
11801253
from line 1272
11991272
12001273 If set, this rule is archived and rejects token exchange.
12011274
1275 format: date-time
1276
12021277 - `archived_by_actor_id: string or null`
12031278
12041279 Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
from line 1286
12111286
12121287 When this rule was created.
12131288
1289 format: date-time
1290
12141291 - `created_by_actor_id: string or null`
12151292
12161293 Tagged ID (`user_`/`svac_`) of the actor that created this rule.
from line 1304
12271304
12281305 Issuer's display name at read time.
12291306
1230 - `match: object { audience, claims, condition, subject_prefix }`
1307 - `match: object`
12311308
12321309 Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
12331310
from line 1312
12351312
12361313 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
12371314
1315 maxLength: 1024
1316
12381317 - `claims: optional map[string] or null`
12391318
12401319 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 1322
12431322
12441323 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
12451324
1325 maxLength: 4096
1326
12461327 - `subject_prefix: optional string or null`
12471328
12481329 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
12491330
1331 maxLength: 1024
1332
12501333 - `name: string`
12511334
12521335 Admin-chosen slug identifier.
from line 1338
12551338
12561339 Space-separated OAuth scopes granted on the minted token.
12571340
1258 - `target: object { service_account_id, type, service_account_name }`
1341 - `target: object`
12591342
12601343 Identity that tokens minted via this rule act as. Currently always a `service_account` target.
12611344
from line 1348
12651348
12661349 - `type: "service_account"`
12671350
1268 - `"service_account"`
1269
12701351 - `service_account_name: optional string or null`
12711352
12721353 Service account's display name at read time. Ignored on writes.
from line 1358
12771358
12781359 - `type: "federation_rule"`
12791360
1280 - `"federation_rule"`
1361 default: federation_rule
12811362
12821363 - `updated_at: string`
12831364
12841365 When this rule was last updated.
12851366
1367 format: date-time
1368
12861369 - `updated_by_actor_id: string or null`
12871370
12881371 Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
from line 1378
12951378
12961379 Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).
12971380
1298# Workspaces
1381## Federation Rules › Workspaces
12991382
1300## List Federation Rule Workspaces
1383### List Federation Rule Workspaces
13011384
1302**get** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
1385**GET** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
13031386
13041387List workspaces where this federation rule is enabled.
13051388
from line 1392
13091392rules with `applies_to_all_workspaces` or a legacy single
13101393`workspace_id`, check those fields on the rule itself.
13111394
1312### Path Parameters
1395#### Path parameters
13131396
13141397- `federation_rule_id: string`
13151398
13161399 ID of the federation rule.
13171400
1318### Query Parameters
1401#### Query parameters
13191402
13201403- `limit: optional number`
13211404
13221405 Number of results per page.
13231406
1407 default: 20, maximum: 100, minimum: 1
1408
13241409- `page: optional string`
13251410
13261411 Opaque cursor from a previous response's `next_page`.
13271412
1328### Header Parameters
1413#### Headers
13291414
13301415- `"anthropic-beta": optional array of string`
13311416
from line 1418
13331418
13341419 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
13351420
1336### Returns
1421#### Returns
13371422
1338- `data: array of object { created_at, created_by_actor_id, federation_rule_id, 3 more }`
1423- `data: array of object`
13391424
13401425 - `created_at: string`
13411426
13421427 When this workspace was enabled for the rule.
13431428
1429 format: date-time
1430
13441431 - `created_by_actor_id: string or null`
13451432
13461433 Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.
from line 1438
13511438
13521439 - `type: "federation_rule_workspace"`
13531440
1354 - `"federation_rule_workspace"`
1441 default: federation_rule_workspace
13551442
13561443 - `workspace_id: string`
13571444
from line 1452
13651452
13661453 Opaque cursor for the next page; null when there are no more results.
13671454
1368### Example
1455#### Example
13691456
1370```http
1457```bash
13711458curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \
13721459 -H 'anthropic-version: 2023-06-01' \
13731460 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
13741461```
13751462
1376#### Response
1463##### Response (200)
13771464
13781465```json
13791466{
from line 1478
13911478}
13921479```
13931480
1394## Add Federation Rule Workspace
1481### Add Federation Rule Workspace
13951482
1396**post** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
1483**POST** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
13971484
13981485Enable a federation rule for a workspace.
13991486
from line 1493
14061493`oauth_scope` is `workspace:developer` or `workspace:inference`; other
14071494scopes require a Console session. Admin API keys are not accepted.
14081495
1409### Path Parameters
1496#### Path parameters
14101497
14111498- `federation_rule_id: string`
14121499
14131500 ID of the federation rule.
14141501
1415### Header Parameters
1502#### Headers
14161503
14171504- `"anthropic-beta": optional array of string`
14181505
from line 1507
14201507
14211508 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
14221509
1423### Body Parameters
1510#### Body parameters
14241511
14251512- `workspace_id: string`
14261513
14271514 Tagged ID of the workspace to enable this rule for.
14281515
1429### Returns
1516#### Returns
14301517
14311518- `created_at: string`
14321519
14331520 When this workspace was enabled for the rule.
14341521
1522 format: date-time
1523
14351524- `created_by_actor_id: string or null`
14361525
14371526 Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.
from line 1531
14421531
14431532- `type: "federation_rule_workspace"`
14441533
1445 - `"federation_rule_workspace"`
1534 default: federation_rule_workspace
14461535
14471536- `workspace_id: string`
14481537
from line 1541
14521541
14531542 Workspace display name. Populated when listing; null in the enable response.
14541543
1455### Example
1544#### Example
14561545
1457```http
1546```bash
14581547curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \
14591548 -H 'Content-Type: application/json' \
14601549 -H 'anthropic-version: 2023-06-01' \
from line 1553
14641553 }'
14651554```
14661555
1467#### Response
1556##### Response (200)
14681557
14691558```json
14701559{
from line 1566
14771566}
14781567```
14791568
1480## Remove Federation Rule Workspace
1569### Remove Federation Rule Workspace
14811570
1482**delete** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}`
1571**DELETE** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}`
14831572
14841573Disable a federation rule for a workspace.
14851574
from line 1577
14881577`workspace:developer` or `workspace:inference`; other scopes require a
14891578Console session. Admin API keys are not accepted.
14901579
1491### Path Parameters
1580#### Path parameters
14921581
14931582- `federation_rule_id: string`
14941583
from line 1587
14981587
14991588 ID of the workspace to disable for.
15001589
1501### Header Parameters
1590#### Headers
15021591
15031592- `"anthropic-beta": optional array of string`
15041593
from line 1595
15061595
15071596 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
15081597
1509### Returns
1598#### Returns
15101599
15111600- `federation_rule_id: string`
15121601
from line 1603
15141603
15151604- `type: "federation_rule_workspace_deleted"`
15161605
1517 - `"federation_rule_workspace_deleted"`
1606 default: federation_rule_workspace_deleted
15181607
15191608- `workspace_id: string`
15201609
15211610 Tagged ID of the workspace named in the delete request. Removal is idempotent.
15221611
1523### Example
1612#### Example
15241613
1525```http
1614```bash
15261615curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces/$WORKSPACE_ID \
15271616 -X DELETE \
15281617 -H 'anthropic-version: 2023-06-01' \
from line 1618
15291618 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
15301619```
15311620
1532#### Response
1621##### Response (200)
15331622
15341623```json
15351624{
from line 1627
15381627 "workspace_id": "workspace_id"
15391628}
15401629```
1541
1542## Domain Types
1543
1544### Workspace List Response
1545
1546- `WorkspaceListResponse object { created_at, created_by_actor_id, federation_rule_id, 3 more }`
1547
1548 - `created_at: string`
1549
1550 When this workspace was enabled for the rule.
1551
1552 - `created_by_actor_id: string or null`
1553
1554 Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.
1555
1556 - `federation_rule_id: string`
1557
1558 Tagged ID of the federation rule.
1559
1560 - `type: "federation_rule_workspace"`
1561
1562 - `"federation_rule_workspace"`
1563
1564 - `workspace_id: string`
1565
1566 Tagged ID of the workspace this rule is enabled for.
1567
1568 - `workspace_name: string or null`
1569
1570 Workspace display name. Populated when listing; null in the enable response.
1571
1572### Workspace Create Response
1573
1574- `WorkspaceCreateResponse object { created_at, created_by_actor_id, federation_rule_id, 3 more }`
1575
1576 - `created_at: string`
1577
1578 When this workspace was enabled for the rule.
1579
1580 - `created_by_actor_id: string or null`
1581
1582 Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.
1583
1584 - `federation_rule_id: string`
1585
1586 Tagged ID of the federation rule.
1587
1588 - `type: "federation_rule_workspace"`
1589
1590 - `"federation_rule_workspace"`
1591
1592 - `workspace_id: string`
1593
1594 Tagged ID of the workspace this rule is enabled for.
1595
1596 - `workspace_name: string or null`
1597
1598 Workspace display name. Populated when listing; null in the enable response.
1599
1600### Workspace Delete Response
1601
1602- `WorkspaceDeleteResponse object { federation_rule_id, type, workspace_id }`
1603
1604 - `federation_rule_id: string`
1605
1606 Tagged ID of the federation rule.
1607
1608 - `type: "federation_rule_workspace_deleted"`
1609
1610 - `"federation_rule_workspace_deleted"`
1611
1612 - `workspace_id: string`
1613
1614 Tagged ID of the workspace named in the delete request. Removal is idempotent.
16151630
api/admin/federation_rules/archive Changed · +27 / -22 lines
# Archive Federation Rule ## Path parameters ## Headers ## Returns ## Example ### Response (200) ## Archive Federation Rule ### Path Parameters ### Header Parameters ### Returns ### Example #### Response
from line 1
1---
2title: Archive Federation Rule
3url: https://platform.claude.com/docs/en/api/admin/federation_rules/archive
4---
1# Archive Federation Rule
52
6## Archive Federation Rule
3**POST** `/v1/organizations/federation_rules/{federation_rule_id}/archive`
74
8**post** `/v1/organizations/federation_rules/{federation_rule_id}/archive`
9
105Archive a federation rule.
116
127Token exchange through this rule stops immediately. Idempotent;
from line 12
1712whose `oauth_scope` is `workspace:developer` or `workspace:inference`;
1813other scopes require a Console session. Admin API keys are not accepted.
1914
20### Path Parameters
15## Path parameters
2116
2217- `federation_rule_id: string`
2318
2419 ID of the federation rule to archive.
2520
26### Header Parameters
21## Headers
2722
2823- `"anthropic-beta": optional array of string`
2924
from line 26
3126
3227 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
3328
34### Returns
29## Returns
3530
36- `FederationRule object { id, applies_to_all_workspaces, archived_at, 17 more }`
31- `FederationRule object`
3732
3833 Authorization rule binding an external OIDC identity to Anthropic.
3934
from line 53
5853
5954 If set, this rule is archived and rejects token exchange.
6055
56 format: date-time
57
6158 - `archived_by_actor_id: string or null`
6259
6360 Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
from line 67
7067
7168 When this rule was created.
7269
70 format: date-time
71
7372 - `created_by_actor_id: string or null`
7473
7574 Tagged ID (`user_`/`svac_`) of the actor that created this rule.
from line 85
8685
8786 Issuer's display name at read time.
8887
89 - `match: object { audience, claims, condition, subject_prefix }`
88 - `match: object`
9089
9190 Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
9291
from line 93
9493
9594 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
9695
96 maxLength: 1024
97
9798 - `claims: optional map[string] or null`
9899
99100 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 103
102103
103104 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
104105
106 maxLength: 4096
107
105108 - `subject_prefix: optional string or null`
106109
107110 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
108111
112 maxLength: 1024
113
109114 - `name: string`
110115
111116 Admin-chosen slug identifier.
from line 119
114119
115120 Space-separated OAuth scopes granted on the minted token.
116121
117 - `target: object { service_account_id, type, service_account_name }`
122 - `target: object`
118123
119124 Identity that tokens minted via this rule act as. Currently always a `service_account` target.
120125
from line 129
124129
125130 - `type: "service_account"`
126131
127 - `"service_account"`
128
129132 - `service_account_name: optional string or null`
130133
131134 Service account's display name at read time. Ignored on writes.
from line 139
136139
137140 - `type: "federation_rule"`
138141
139 - `"federation_rule"`
142 default: federation_rule
140143
141144 - `updated_at: string`
142145
143146 When this rule was last updated.
144147
148 format: date-time
149
145150 - `updated_by_actor_id: string or null`
146151
147152 Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
from line 159
154159
155160 Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).
156161
157### Example
162## Example
158163
159```http
164```bash
160165curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/archive \
161166 -X POST \
162167 -H 'anthropic-version: 2023-06-01' \
from line 168
163168 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
164169```
165170
166#### Response
171### Response (200)
167172
168173```json
169174{
api/admin/federation_rules/create Changed · +43 / -26 lines
# Create Federation Rule ## Headers ## Body parameters ## Returns ## Example ### Response (200) ## Create Federation Rule ### Header Parameters ### Body Parameters ### Returns ### Example #### Response
from line 1
1---
2title: Create Federation Rule
3url: https://platform.claude.com/docs/en/api/admin/federation_rules/create
4---
1# Create Federation Rule
52
6## Create Federation Rule
3**POST** `/v1/organizations/federation_rules`
74
8**post** `/v1/organizations/federation_rules`
9
105Create a federation rule owned by your organization.
116
127The referenced issuer and the target service account must already exist
from line 19
2419`workspace:inference`; other scopes require a Console session. Admin API
2520keys are not accepted.
2621
27### Header Parameters
22## Headers
2823
2924- `"anthropic-beta": optional array of string`
3025
from line 27
3227
3328 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
3429
35### Body Parameters
30## Body parameters
3631
3732- `issuer_id: string`
3833
3934 Tagged ID of the federation issuer.
4035
41- `match: object { audience, claims, condition, subject_prefix }`
36- `match: object`
4237
4338 Conditions the verified JWT must satisfy for this rule to apply. At least one of `subject_prefix` (other than a wildcard-only value like `*`), `claims`, or `condition` is required; `audience` alone is not sufficient.
4439
from line 41
4641
4742 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
4843
44 maxLength: 1024
45
4946 - `claims: optional map[string] or null`
5047
5148 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 51
5451
5552 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
5653
54 maxLength: 4096
55
5756 - `subject_prefix: optional string or null`
5857
5958 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
6059
60 maxLength: 1024
61
6162- `name: string`
6263
6364 Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
6465
66 maxLength: 255, minLength: 1
67
6568- `oauth_scope: string`
6669
6770 Space-separated OAuth scopes. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session.
6871
69- `target: object { service_account_id, type, service_account_name }`
72 minLength: 1
7073
74- `target: object`
75
7176 Identity that tokens minted via this rule act as. Currently always a `service_account` target.
7277
7378 - `service_account_id: string`
from line 81
7681
7782 - `type: "service_account"`
7883
79 - `"service_account"`
80
8184 - `service_account_name: optional string or null`
8285
8386 Service account's display name at read time. Ignored on writes.
from line 97
9497
9598 Optional free-text description.
9699
100 maxLength: 2000
101
97102- `token_lifetime_seconds: optional number`
98103
99104 Lifetime in seconds for access tokens minted via this rule (60-86400). Defaults to 3600 (1h). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.
100105
106 maximum: 86400, minimum: 60
107
101108- `workspace_id: optional string or null`
102109
103110 Tagged ID of the workspace to enable this rule for. Required unless `applies_to_all_workspaces` is true. Additional workspaces can be added via the `/federation_rules/{federation_rule_id}/workspaces` sub-resource.
104111
105### Returns
112## Returns
106113
107- `FederationRule object { id, applies_to_all_workspaces, archived_at, 17 more }`
114- `FederationRule object`
108115
109116 Authorization rule binding an external OIDC identity to Anthropic.
110117
from line 136
129136
130137 If set, this rule is archived and rejects token exchange.
131138
139 format: date-time
140
132141 - `archived_by_actor_id: string or null`
133142
134143 Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
from line 150
141150
142151 When this rule was created.
143152
153 format: date-time
154
144155 - `created_by_actor_id: string or null`
145156
146157 Tagged ID (`user_`/`svac_`) of the actor that created this rule.
from line 168
157168
158169 Issuer's display name at read time.
159170
160 - `match: object { audience, claims, condition, subject_prefix }`
171 - `match: object`
161172
162173 Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
163174
from line 176
165176
166177 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
167178
179 maxLength: 1024
180
168181 - `claims: optional map[string] or null`
169182
170183 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 186
173186
174187 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
175188
189 maxLength: 4096
190
176191 - `subject_prefix: optional string or null`
177192
178193 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
179194
195 maxLength: 1024
196
180197 - `name: string`
181198
182199 Admin-chosen slug identifier.
from line 202
185202
186203 Space-separated OAuth scopes granted on the minted token.
187204
188 - `target: object { service_account_id, type, service_account_name }`
205 - `target: object`
189206
190207 Identity that tokens minted via this rule act as. Currently always a `service_account` target.
191208
from line 212
195212
196213 - `type: "service_account"`
197214
198 - `"service_account"`
199
200215 - `service_account_name: optional string or null`
201216
202217 Service account's display name at read time. Ignored on writes.
from line 222
207222
208223 - `type: "federation_rule"`
209224
210 - `"federation_rule"`
225 default: federation_rule
211226
212227 - `updated_at: string`
213228
214229 When this rule was last updated.
215230
231 format: date-time
232
216233 - `updated_by_actor_id: string or null`
217234
218235 Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
from line 242
225242
226243 Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).
227244
228### Example
245## Example
229246
230```http
247```bash
231248curl https://api.anthropic.com/v1/organizations/federation_rules \
232249 -H 'Content-Type: application/json' \
233250 -H 'anthropic-version: 2023-06-01' \
from line 261
244261 }'
245262```
246263
247#### Response
264### Response (200)
248265
249266```json
250267{
api/admin/federation_rules/list Changed · +29 / -20 lines
# List Federation Rules ## Query parameters ## Headers ## Returns ## Example ### Response (200) ## List Federation Rules ### Query Parameters ### Header Parameters ### Returns ### Example #### Response
from line 1
1---
2title: List Federation Rules
3url: https://platform.claude.com/docs/en/api/admin/federation_rules/list
4---
1# List Federation Rules
52
6## List Federation Rules
3**GET** `/v1/organizations/federation_rules`
74
8**get** `/v1/organizations/federation_rules`
9
105List federation rules in your organization.
116
127Optionally filter by issuer with `issuer_id`. Archived rules are excluded
138unless `include_archived=true`.
149
15### Query Parameters
10## Query parameters
1611
1712- `include_archived: optional boolean`
1813
1914 Include archived resources. Defaults to false.
2015
16 default: false
17
2118- `issuer_id: optional string`
2219
2320 Filter to rules referencing this federation issuer.
from line 23
2623
2724 Number of results per page.
2825
26 default: 20, maximum: 100, minimum: 1
27
2928- `page: optional string`
3029
3130 Opaque cursor from a previous response's `next_page`.
3231
33### Header Parameters
32## Headers
3433
3534- `"anthropic-beta": optional array of string`
3635
from line 37
3837
3938 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
4039
41### Returns
40## Returns
4241
4342- `data: array of FederationRule`
4443
from line 53
5453
5554 If set, this rule is archived and rejects token exchange.
5655
56 format: date-time
57
5758 - `archived_by_actor_id: string or null`
5859
5960 Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
from line 67
6667
6768 When this rule was created.
6869
70 format: date-time
71
6972 - `created_by_actor_id: string or null`
7073
7174 Tagged ID (`user_`/`svac_`) of the actor that created this rule.
from line 85
8285
8386 Issuer's display name at read time.
8487
85 - `match: object { audience, claims, condition, subject_prefix }`
88 - `match: object`
8689
8790 Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
8891
from line 93
9093
9194 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
9295
96 maxLength: 1024
97
9398 - `claims: optional map[string] or null`
9499
95100 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 103
98103
99104 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
100105
106 maxLength: 4096
107
101108 - `subject_prefix: optional string or null`
102109
103110 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
104111
112 maxLength: 1024
113
105114 - `name: string`
106115
107116 Admin-chosen slug identifier.
from line 119
110119
111120 Space-separated OAuth scopes granted on the minted token.
112121
113 - `target: object { service_account_id, type, service_account_name }`
122 - `target: object`
114123
115124 Identity that tokens minted via this rule act as. Currently always a `service_account` target.
116125
from line 129
120129
121130 - `type: "service_account"`
122131
123 - `"service_account"`
124
125132 - `service_account_name: optional string or null`
126133
127134 Service account's display name at read time. Ignored on writes.
from line 139
132139
133140 - `type: "federation_rule"`
134141
135 - `"federation_rule"`
142 default: federation_rule
136143
137144 - `updated_at: string`
138145
139146 When this rule was last updated.
140147
148 format: date-time
149
141150 - `updated_by_actor_id: string or null`
142151
143152 Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
from line 163
154163
155164 Opaque cursor for the next page, or null if no more results.
156165
157### Example
166## Example
158167
159```http
168```bash
160169curl https://api.anthropic.com/v1/organizations/federation_rules \
161170 -H 'anthropic-version: 2023-06-01' \
162171 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
163172```
164173
165#### Response
174### Response (200)
166175
167176```json
168177{
api/admin/federation_rules/retrieve Changed · +27 / -22 lines
# Get Federation Rule ## Path parameters ## Headers ## Returns ## Example ### Response (200) ## Get Federation Rule ### Path Parameters ### Header Parameters ### Returns ### Example #### Response
from line 1
1---
2title: Get Federation Rule
3url: https://platform.claude.com/docs/en/api/admin/federation_rules/retrieve
4---
1# Get Federation Rule
52
6## Get Federation Rule
3**GET** `/v1/organizations/federation_rules/{federation_rule_id}`
74
8**get** `/v1/organizations/federation_rules/{federation_rule_id}`
9
105Retrieve a federation rule by its ID (`fdrl_...`).
116
12### Path Parameters
7## Path parameters
138
149- `federation_rule_id: string`
1510
1611 ID of the federation rule.
1712
18### Header Parameters
13## Headers
1914
2015- `"anthropic-beta": optional array of string`
2116
from line 18
2318
2419 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
2520
26### Returns
21## Returns
2722
28- `FederationRule object { id, applies_to_all_workspaces, archived_at, 17 more }`
23- `FederationRule object`
2924
3025 Authorization rule binding an external OIDC identity to Anthropic.
3126
from line 45
5045
5146 If set, this rule is archived and rejects token exchange.
5247
48 format: date-time
49
5350 - `archived_by_actor_id: string or null`
5451
5552 Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
from line 59
6259
6360 When this rule was created.
6461
62 format: date-time
63
6564 - `created_by_actor_id: string or null`
6665
6766 Tagged ID (`user_`/`svac_`) of the actor that created this rule.
from line 77
7877
7978 Issuer's display name at read time.
8079
81 - `match: object { audience, claims, condition, subject_prefix }`
80 - `match: object`
8281
8382 Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
8483
from line 85
8685
8786 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
8887
88 maxLength: 1024
89
8990 - `claims: optional map[string] or null`
9091
9192 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 95
9495
9596 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
9697
98 maxLength: 4096
99
97100 - `subject_prefix: optional string or null`
98101
99102 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
100103
104 maxLength: 1024
105
101106 - `name: string`
102107
103108 Admin-chosen slug identifier.
from line 111
106111
107112 Space-separated OAuth scopes granted on the minted token.
108113
109 - `target: object { service_account_id, type, service_account_name }`
114 - `target: object`
110115
111116 Identity that tokens minted via this rule act as. Currently always a `service_account` target.
112117
from line 121
116121
117122 - `type: "service_account"`
118123
119 - `"service_account"`
120
121124 - `service_account_name: optional string or null`
122125
123126 Service account's display name at read time. Ignored on writes.
from line 131
128131
129132 - `type: "federation_rule"`
130133
131 - `"federation_rule"`
134 default: federation_rule
132135
133136 - `updated_at: string`
134137
135138 When this rule was last updated.
136139
140 format: date-time
141
137142 - `updated_by_actor_id: string or null`
138143
139144 Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
from line 151
146151
147152 Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).
148153
149### Example
154## Example
150155
151```http
156```bash
152157curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID \
153158 -H 'anthropic-version: 2023-06-01' \
154159 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
155160```
156161
157#### Response
162### Response (200)
158163
159164```json
160165{
api/admin/federation_rules/update Changed · +44 / -27 lines
# Update Federation Rule ## Path parameters ## Headers ## Body parameters ## Returns ## Example ### Response (200) ## Update Federation Rule ### Path Parameters ### Header Parameters ### Body Parameters ### Returns ### Example #### Response
from line 1
1---
2title: Update Federation Rule
3url: https://platform.claude.com/docs/en/api/admin/federation_rules/update
4---
1# Update Federation Rule
52
6## Update Federation Rule
3**POST** `/v1/organizations/federation_rules/{federation_rule_id}`
74
8**post** `/v1/organizations/federation_rules/{federation_rule_id}`
9
105Partially update a federation rule.
116
127`issuer_id` is immutable. `match` and `target` are replaced as whole
from line 20
2520`workspace:developer` or `workspace:inference`; other scopes require a
2621Console session. Admin API keys are not accepted.
2722
28### Path Parameters
23## Path parameters
2924
3025- `federation_rule_id: string`
3126
3227 ID of the federation rule to update.
3328
34### Header Parameters
29## Headers
3530
3631- `"anthropic-beta": optional array of string`
3732
from line 34
3934
4035 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
4136
42### Body Parameters
37## Body parameters
4338
4439- `applies_to_all_workspaces: optional boolean or null`
4540
from line 48
5348
5449 Replaces the description. Omit to leave unchanged; send `null` to clear (the field is stored as an empty string).
5550
56- `match: optional object { audience, claims, condition, subject_prefix } or null`
51 maxLength: 2000
5752
53- `match: optional object or null`
54
5855 Does the incoming JWT qualify?
5956
6057 All populated fields must pass; omitted fields are skipped. At least one
from line 62
6562
6663 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
6764
65 maxLength: 1024
66
6867 - `claims: optional map[string] or null`
6968
7069 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 72
7372
7473 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
7574
75 maxLength: 4096
76
7677 - `subject_prefix: optional string or null`
7778
7879 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
7980
81 maxLength: 1024
82
8083- `name: optional string or null`
8184
8285 Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
8386
87 maxLength: 255, minLength: 1
88
8489- `oauth_scope: optional string or null`
8590
8691 Replaces the space-separated OAuth scopes granted on minted tokens. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session.
8792
88- `target: optional object { service_account_id, type, service_account_name } or null`
93 minLength: 1
8994
95- `target: optional object or null`
96
9097 Bind to a fixed service account by ID.
9198
9299 - `service_account_id: string`
from line 102
95102
96103 - `type: "service_account"`
97104
98 - `"service_account"`
99
100105 - `service_account_name: optional string or null`
101106
102107 Service account's display name at read time. Ignored on writes.
from line 110
105110
106111 Replaces the lifetime in seconds for access tokens minted via this rule (60-86400). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.
107112
113 maximum: 86400, minimum: 60
114
108115- `workspace_id: optional string or null`
109116
110117 Replaces the existing single workspace enablement (the previous one is removed). Rejected with 400 if the rule is enabled for more than one workspace; use the `/federation_rules/{federation_rule_id}/workspaces` sub-resource instead.
111118
112### Returns
119## Returns
113120
114- `FederationRule object { id, applies_to_all_workspaces, archived_at, 17 more }`
121- `FederationRule object`
115122
116123 Authorization rule binding an external OIDC identity to Anthropic.
117124
from line 143
136143
137144 If set, this rule is archived and rejects token exchange.
138145
146 format: date-time
147
139148 - `archived_by_actor_id: string or null`
140149
141150 Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
from line 157
148157
149158 When this rule was created.
150159
160 format: date-time
161
151162 - `created_by_actor_id: string or null`
152163
153164 Tagged ID (`user_`/`svac_`) of the actor that created this rule.
from line 175
164175
165176 Issuer's display name at read time.
166177
167 - `match: object { audience, claims, condition, subject_prefix }`
178 - `match: object`
168179
169180 Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
170181
from line 183
172183
173184 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
174185
186 maxLength: 1024
187
175188 - `claims: optional map[string] or null`
176189
177190 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 193
180193
181194 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
182195
196 maxLength: 4096
197
183198 - `subject_prefix: optional string or null`
184199
185200 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
186201
202 maxLength: 1024
203
187204 - `name: string`
188205
189206 Admin-chosen slug identifier.
from line 209
192209
193210 Space-separated OAuth scopes granted on the minted token.
194211
195 - `target: object { service_account_id, type, service_account_name }`
212 - `target: object`
196213
197214 Identity that tokens minted via this rule act as. Currently always a `service_account` target.
198215
from line 219
202219
203220 - `type: "service_account"`
204221
205 - `"service_account"`
206
207222 - `service_account_name: optional string or null`
208223
209224 Service account's display name at read time. Ignored on writes.
from line 229
214229
215230 - `type: "federation_rule"`
216231
217 - `"federation_rule"`
232 default: federation_rule
218233
219234 - `updated_at: string`
220235
221236 When this rule was last updated.
222237
238 format: date-time
239
223240 - `updated_by_actor_id: string or null`
224241
225242 Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
from line 249
232249
233250 Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).
234251
235### Example
252## Example
236253
237```http
254```bash
238255curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID \
239256 -H 'Content-Type: application/json' \
240257 -H 'anthropic-version: 2023-06-01' \
from line 259
242259 -d '{}'
243260```
244261
245#### Response
262### Response (200)
246263
247264```json
248265{
api/admin/federation_rules/workspaces Changed · +38 / -33 lines
### Path parameters ### Query parameters ### Headers #### Response (200) ### Path parameters ### Headers ### Body parameters #### Response (200) ### Path parameters ### Headers #### Response (200) ## Domain types ### Path Parameters ### Query Parameters ### Header Parameters #### Response ### Path Parameters ### Header Parameters ### Body Parameters #### Response ### Path Parameters ### Header Parameters #### Response ## Domain Types
from line 1
1---
2title: Workspaces
3url: https://platform.claude.com/docs/en/api/admin/federation_rules/workspaces
4---
5
61# Workspaces
72
83## List Federation Rule Workspaces
94
10**get** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
5**GET** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
116
127List workspaces where this federation rule is enabled.
138
from line 12
1712rules with `applies_to_all_workspaces` or a legacy single
1813`workspace_id`, check those fields on the rule itself.
1914
20### Path Parameters
15### Path parameters
2116
2217- `federation_rule_id: string`
2318
2419 ID of the federation rule.
2520
26### Query Parameters
21### Query parameters
2722
2823- `limit: optional number`
2924
3025 Number of results per page.
3126
27 default: 20, maximum: 100, minimum: 1
28
3229- `page: optional string`
3330
3431 Opaque cursor from a previous response's `next_page`.
3532
36### Header Parameters
33### Headers
3734
3835- `"anthropic-beta": optional array of string`
3936
from line 40
4340
4441### Returns
4542
46- `data: array of object { created_at, created_by_actor_id, federation_rule_id, 3 more }`
43- `data: array of object`
4744
4845 - `created_at: string`
4946
5047 When this workspace was enabled for the rule.
5148
49 format: date-time
50
5251 - `created_by_actor_id: string or null`
5352
5453 Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.
from line 58
5958
6059 - `type: "federation_rule_workspace"`
6160
62 - `"federation_rule_workspace"`
61 default: federation_rule_workspace
6362
6463 - `workspace_id: string`
6564
from line 74
7574
7675### Example
7776
78```http
77```bash
7978curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \
8079 -H 'anthropic-version: 2023-06-01' \
8180 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
8281```
8382
84#### Response
83#### Response (200)
8584
8685```json
8786{
from line 100
101100
102101## Add Federation Rule Workspace
103102
104**post** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
103**POST** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
105104
106105Enable a federation rule for a workspace.
107106
from line 113
114113`oauth_scope` is `workspace:developer` or `workspace:inference`; other
115114scopes require a Console session. Admin API keys are not accepted.
116115
117### Path Parameters
116### Path parameters
118117
119118- `federation_rule_id: string`
120119
121120 ID of the federation rule.
122121
123### Header Parameters
122### Headers
124123
125124- `"anthropic-beta": optional array of string`
126125
from line 127
128127
129128 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
130129
131### Body Parameters
130### Body parameters
132131
133132- `workspace_id: string`
134133
from line 139
140139
141140 When this workspace was enabled for the rule.
142141
142 format: date-time
143
143144- `created_by_actor_id: string or null`
144145
145146 Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.
from line 151
150151
151152- `type: "federation_rule_workspace"`
152153
153 - `"federation_rule_workspace"`
154 default: federation_rule_workspace
154155
155156- `workspace_id: string`
156157
from line 163
162163
163164### Example
164165
165```http
166```bash
166167curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \
167168 -H 'Content-Type: application/json' \
168169 -H 'anthropic-version: 2023-06-01' \
from line 173
172173 }'
173174```
174175
175#### Response
176#### Response (200)
176177
177178```json
178179{
from line 188
187188
188189## Remove Federation Rule Workspace
189190
190**delete** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}`
191**DELETE** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}`
191192
192193Disable a federation rule for a workspace.
193194
from line 197
196197`workspace:developer` or `workspace:inference`; other scopes require a
197198Console session. Admin API keys are not accepted.
198199
199### Path Parameters
200### Path parameters
200201
201202- `federation_rule_id: string`
202203
from line 207
206207
207208 ID of the workspace to disable for.
208209
209### Header Parameters
210### Headers
210211
211212- `"anthropic-beta": optional array of string`
212213
from line 223
222223
223224- `type: "federation_rule_workspace_deleted"`
224225
225 - `"federation_rule_workspace_deleted"`
226 default: federation_rule_workspace_deleted
226227
227228- `workspace_id: string`
228229
from line 231
230231
231232### Example
232233
233```http
234```bash
234235curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces/$WORKSPACE_ID \
235236 -X DELETE \
236237 -H 'anthropic-version: 2023-06-01' \
from line 238
237238 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
238239```
239240
240#### Response
241#### Response (200)
241242
242243```json
243244{
from line 248
247248}
248249```
249250
250## Domain Types
251## Domain types
251252
252253### Workspace List Response
253254
254- `WorkspaceListResponse object { created_at, created_by_actor_id, federation_rule_id, 3 more }`
255- `WorkspaceListResponse object`
255256
256257 - `created_at: string`
257258
258259 When this workspace was enabled for the rule.
259260
261 format: date-time
262
260263 - `created_by_actor_id: string or null`
261264
262265 Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.
from line 270
267270
268271 - `type: "federation_rule_workspace"`
269272
270 - `"federation_rule_workspace"`
273 default: federation_rule_workspace
271274
272275 - `workspace_id: string`
273276
from line 282
279282
280283### Workspace Create Response
281284
282- `WorkspaceCreateResponse object { created_at, created_by_actor_id, federation_rule_id, 3 more }`
285- `WorkspaceCreateResponse object`
283286
284287 - `created_at: string`
285288
286289 When this workspace was enabled for the rule.
287290
291 format: date-time
292
288293 - `created_by_actor_id: string or null`
289294
290295 Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.
from line 300
295300
296301 - `type: "federation_rule_workspace"`
297302
298 - `"federation_rule_workspace"`
303 default: federation_rule_workspace
299304
300305 - `workspace_id: string`
301306
from line 312
307312
308313### Workspace Delete Response
309314
310- `WorkspaceDeleteResponse object { federation_rule_id, type, workspace_id }`
315- `WorkspaceDeleteResponse object`
311316
312317 - `federation_rule_id: string`
313318
from line 320
315320
316321 - `type: "federation_rule_workspace_deleted"`
317322
318 - `"federation_rule_workspace_deleted"`
323 default: federation_rule_workspace_deleted
319324
320325 - `workspace_id: string`
321326
api/admin/federation_rules/workspaces/create Changed · +12 / -15 lines
# Add Federation Rule Workspace ## Path parameters ## Headers ## Body parameters ## Returns ## Example ### Response (200) ## Add Federation Rule Workspace ### Path Parameters ### Header Parameters ### Body Parameters ### Returns ### Example #### Response
from line 1
1---
2title: Add Federation Rule Workspace
3url: https://platform.claude.com/docs/en/api/admin/federation_rules/workspaces/create
4---
1# Add Federation Rule Workspace
52
6## Add Federation Rule Workspace
3**POST** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
74
8**post** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
9
105Enable a federation rule for a workspace.
116
127Idempotent; re-enabling returns the existing enablement. The rule and
from line 13
1813`oauth_scope` is `workspace:developer` or `workspace:inference`; other
1914scopes require a Console session. Admin API keys are not accepted.
2015
21### Path Parameters
16## Path parameters
2217
2318- `federation_rule_id: string`
2419
2520 ID of the federation rule.
2621
27### Header Parameters
22## Headers
2823
2924- `"anthropic-beta": optional array of string`
3025
from line 27
3227
3328 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
3429
35### Body Parameters
30## Body parameters
3631
3732- `workspace_id: string`
3833
3934 Tagged ID of the workspace to enable this rule for.
4035
41### Returns
36## Returns
4237
4338- `created_at: string`
4439
4540 When this workspace was enabled for the rule.
4641
42 format: date-time
43
4744- `created_by_actor_id: string or null`
4845
4946 Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.
from line 51
5451
5552- `type: "federation_rule_workspace"`
5653
57 - `"federation_rule_workspace"`
54 default: federation_rule_workspace
5855
5956- `workspace_id: string`
6057
from line 61
6461
6562 Workspace display name. Populated when listing; null in the enable response.
6663
67### Example
64## Example
6865
69```http
66```bash
7067curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \
7168 -H 'Content-Type: application/json' \
7269 -H 'anthropic-version: 2023-06-01' \
from line 73
7673 }'
7774```
7875
79#### Response
76### Response (200)
8077
8178```json
8279{
api/admin/federation_rules/workspaces/delete Changed · +9 / -14 lines
# Remove Federation Rule Workspace ## Path parameters ## Headers ## Returns ## Example ### Response (200) ## Remove Federation Rule Workspace ### Path Parameters ### Header Parameters ### Returns ### Example #### Response
from line 1
1---
2title: Remove Federation Rule Workspace
3url: https://platform.claude.com/docs/en/api/admin/federation_rules/workspaces/delete
4---
1# Remove Federation Rule Workspace
52
6## Remove Federation Rule Workspace
3**DELETE** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}`
74
8**delete** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}`
9
105Disable a federation rule for a workspace.
116
127Idempotent; succeeds even if the enablement was already removed. OAuth
from line 9
149`workspace:developer` or `workspace:inference`; other scopes require a
1510Console session. Admin API keys are not accepted.
1611
17### Path Parameters
12## Path parameters
1813
1914- `federation_rule_id: string`
2015
from line 19
2419
2520 ID of the workspace to disable for.
2621
27### Header Parameters
22## Headers
2823
2924- `"anthropic-beta": optional array of string`
3025
from line 27
3227
3328 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
3429
35### Returns
30## Returns
3631
3732- `federation_rule_id: string`
3833
from line 35
4035
4136- `type: "federation_rule_workspace_deleted"`
4237
43 - `"federation_rule_workspace_deleted"`
38 default: federation_rule_workspace_deleted
4439
4540- `workspace_id: string`
4641
4742 Tagged ID of the workspace named in the delete request. Removal is idempotent.
4843
49### Example
44## Example
5045
51```http
46```bash
5247curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces/$WORKSPACE_ID \
5348 -X DELETE \
5449 -H 'anthropic-version: 2023-06-01' \
from line 50
5550 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
5651```
5752
58#### Response
53### Response (200)
5954
6055```json
6156{
api/admin/federation_rules/workspaces/list Changed · +15 / -16 lines
# List Federation Rule Workspaces ## Path parameters ## Query parameters ## Headers ## Returns ## Example ### Response (200) ## List Federation Rule Workspaces ### Path Parameters ### Query Parameters ### Header Parameters ### Returns ### Example #### Response
from line 1
1---
2title: List Federation Rule Workspaces
3url: https://platform.claude.com/docs/en/api/admin/federation_rules/workspaces/list
4---
1# List Federation Rule Workspaces
52
6## List Federation Rule Workspaces
3**GET** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
74
8**get** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
9
105List workspaces where this federation rule is enabled.
116
127Returns all workspace enablements in a single response; the `limit` and
from line 10
1510rules with `applies_to_all_workspaces` or a legacy single
1611`workspace_id`, check those fields on the rule itself.
1712
18### Path Parameters
13## Path parameters
1914
2015- `federation_rule_id: string`
2116
2217 ID of the federation rule.
2318
24### Query Parameters
19## Query parameters
2520
2621- `limit: optional number`
2722
2823 Number of results per page.
2924
25 default: 20, maximum: 100, minimum: 1
26
3027- `page: optional string`
3128
3229 Opaque cursor from a previous response's `next_page`.
3330
34### Header Parameters
31## Headers
3532
3633- `"anthropic-beta": optional array of string`
3734
from line 36
3936
4037 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
4138
42### Returns
39## Returns
4340
44- `data: array of object { created_at, created_by_actor_id, federation_rule_id, 3 more }`
41- `data: array of object`
4542
4643 - `created_at: string`
4744
4845 When this workspace was enabled for the rule.
4946
47 format: date-time
48
5049 - `created_by_actor_id: string or null`
5150
5251 Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.
from line 56
5756
5857 - `type: "federation_rule_workspace"`
5958
60 - `"federation_rule_workspace"`
59 default: federation_rule_workspace
6160
6261 - `workspace_id: string`
6362
from line 70
7170
7271 Opaque cursor for the next page; null when there are no more results.
7372
74### Example
73## Example
7574
76```http
75```bash
7776curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \
7877 -H 'anthropic-version: 2023-06-01' \
7978 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
8079```
8180
82#### Response
81### Response (200)
8382
8483```json
8584{