api-20260825T033708Z / page 3 of 16 / documentation capture

api/admin/invites Changed · +59 / -32 lines

### Body parameters #### Response (200) ### Path parameters #### Response (200) ### Query parameters #### Response (200) ### Path parameters #### Response (200) ## Domain types ### Body Parameters #### Response ### Path Parameters #### Response ### Query Parameters #### Response ### Path Parameters #### Response ## Domain Types

from line 1

1---

2title: Invites

3url: https://platform.claude.com/docs/en/api/admin/invites

4---

5

61# Invites

72

83## Create Invite

94

10**post** `/v1/organizations/invites`

5**POST** `/v1/organizations/invites`

116

127For Claude Enterprise organizations, this endpoint's availability is in beta.

138

149On plans that draw members from a finite pool of purchased seats, the invite automatically consumes a seat from the lowest tier with availability; there is no seat-tier parameter. When no seat is free the request fails with a 400 error rather than purchasing a seat.

1510

16### Body Parameters

11### Body parameters

1712

1813- `email: string`

1914

2015 Email of the User.

2116

17 format: email

18

2219- `role: "billing" or "claude_code_user" or "developer" or 2 more`

2320

2421 Role for the invited User.

from line 36

3936

4037 RBAC group IDs to assign to the User when the Invite is accepted. A non-empty array is accepted only for a Claude Enterprise organization with RBAC groups (beta), and requires the key to carry the `write:rbac_groups` scope.

4138

39 maxItems: 100

40

4241### Returns

4342

44- `Invite object { id, accepted_at, email, 6 more }`

43- `Invite object`

4544

4645 - `id: string`

4746

from line 50

5150

5251 RFC 3339 datetime string indicating when the Invite was accepted, or null.

5352

53 format: date-time

54

5455 - `email: string`

5556

5657 Email of the User being invited.

from line 60

5960

6061 RFC 3339 datetime string indicating when the Invite expires.

6162

63 format: date-time

64

6265 - `invited_at: string`

6366

6467 RFC 3339 datetime string indicating when the Invite was created.

6568

69 format: date-time

70

6671 - `rbac_group_ids: array of string`

6772

6873 RBAC group IDs recorded on the Invite (beta, Claude Enterprise organizations), to be assigned to the User when the Invite is accepted. `[]` when none.

from line 112

107112

108113 For Invites, this is always `"invite"`.

109114

110 - `"invite"`

115 default: invite

111116

112117### Example

113118

114```http

119```bash

115120curl https://api.anthropic.com/v1/organizations/invites \

116121 -H 'Content-Type: application/json' \

117122 -H 'anthropic-version: 2023-06-01' \

from line 127

122127 }'

123128```

124129

125#### Response

130#### Response (200)

126131

127132```json

128133{

from line 147

142147

143148## Get Invite

144149

145**get** `/v1/organizations/invites/{invite_id}`

150**GET** `/v1/organizations/invites/{invite_id}`

146151

147152For Claude Enterprise organizations, this endpoint's availability is in beta.

148153

149### Path Parameters

154### Path parameters

150155

151156- `invite_id: string`

152157

from line 159

154159

155160### Returns

156161

157- `Invite object { id, accepted_at, email, 6 more }`

162- `Invite object`

158163

159164 - `id: string`

160165

from line 169

164169

165170 RFC 3339 datetime string indicating when the Invite was accepted, or null.

166171

172 format: date-time

173

167174 - `email: string`

168175

169176 Email of the User being invited.

from line 179

172179

173180 RFC 3339 datetime string indicating when the Invite expires.

174181

182 format: date-time

183

175184 - `invited_at: string`

176185

177186 RFC 3339 datetime string indicating when the Invite was created.

178187

188 format: date-time

189

179190 - `rbac_group_ids: array of string`

180191

181192 RBAC group IDs recorded on the Invite (beta, Claude Enterprise organizations), to be assigned to the User when the Invite is accepted. `[]` when none.

from line 231

220231

221232 For Invites, this is always `"invite"`.

222233

223 - `"invite"`

234 default: invite

224235

225236### Example

226237

227```http

238```bash

228239curl https://api.anthropic.com/v1/organizations/invites/$INVITE_ID \

229240 -H 'anthropic-version: 2023-06-01' \

230241 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

231242```

232243

233#### Response

244#### Response (200)

234245

235246```json

236247{

from line 261

250261

251262## List Invites

252263

253**get** `/v1/organizations/invites`

264**GET** `/v1/organizations/invites`

254265

255266For Claude Enterprise organizations, this endpoint's availability is in beta.

256267

257### Query Parameters

268### Query parameters

258269

259270- `after_id: optional string`

260271

from line 279

268279

269280 Filter by the email address the Invite was sent to. Matches the same way as the Users list's `email` filter (normalized, case-insensitive).

270281

282 format: email

283

271284- `limit: optional number`

272285

273286 Number of items to return per page.

from line 287

274287

275288 Defaults to `20`. Ranges from `1` to `1000`.

276289

290 default: 20, maximum: 1000, minimum: 1

291

277292- `roles: optional array of string`

278293

279294 Filter to items whose `role` equals one of the supplied values. Repeatable; values are OR'ed together.

from line 317

302317

303318 RFC 3339 datetime string indicating when the Invite was accepted, or null.

304319

320 format: date-time

321

305322 - `email: string`

306323

307324 Email of the User being invited.

from line 327

310327

311328 RFC 3339 datetime string indicating when the Invite expires.

312329

330 format: date-time

331

313332 - `invited_at: string`

314333

315334 RFC 3339 datetime string indicating when the Invite was created.

316335

336 format: date-time

337

317338 - `rbac_group_ids: array of string`

318339

319340 RBAC group IDs recorded on the Invite (beta, Claude Enterprise organizations), to be assigned to the User when the Invite is accepted. `[]` when none.

from line 379

358379

359380 For Invites, this is always `"invite"`.

360381

361 - `"invite"`

382 default: invite

362383

363384- `first_id: string or null`

364385

from line 395

374395

375396### Example

376397

377```http

398```bash

378399curl https://api.anthropic.com/v1/organizations/invites \

379400 -H 'anthropic-version: 2023-06-01' \

380401 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

381402```

382403

383#### Response

404#### Response (200)

384405

385406```json

386407{

from line 428

407428

408429## Delete Invite

409430

410**delete** `/v1/organizations/invites/{invite_id}`

431**DELETE** `/v1/organizations/invites/{invite_id}`

411432

412433For Claude Enterprise organizations, this endpoint's availability is in beta.

413434

414### Path Parameters

435### Path parameters

415436

416437- `invite_id: string`

417438

from line 450

429450

430451 For Invites, this is always `"invite_deleted"`.

431452

432 - `"invite_deleted"`

453 default: invite_deleted

433454

434455### Example

435456

436```http

457```bash

437458curl https://api.anthropic.com/v1/organizations/invites/$INVITE_ID \

438459 -X DELETE \

439460 -H 'anthropic-version: 2023-06-01' \

from line 461

440461 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

441462```

442463

443#### Response

464#### Response (200)

444465

445466```json

446467{

from line 470

449470}

450471```

451472

452## Domain Types

473## Domain types

453474

454475### Invite

455476

456- `Invite object { id, accepted_at, email, 6 more }`

477- `Invite object`

457478

458479 - `id: string`

459480

from line 484

463484

464485 RFC 3339 datetime string indicating when the Invite was accepted, or null.

465486

487 format: date-time

488

466489 - `email: string`

467490

468491 Email of the User being invited.

from line 494

471494

472495 RFC 3339 datetime string indicating when the Invite expires.

473496

497 format: date-time

498

474499 - `invited_at: string`

475500

476501 RFC 3339 datetime string indicating when the Invite was created.

477502

503 format: date-time

504

478505 - `rbac_group_ids: array of string`

479506

480507 RBAC group IDs recorded on the Invite (beta, Claude Enterprise organizations), to be assigned to the User when the Invite is accepted. `[]` when none.

from line 546

519546

520547 For Invites, this is always `"invite"`.

521548

522 - `"invite"`

549 default: invite

523550

524551### Invite Delete Response

525552

526- `InviteDeleteResponse object { id, type }`

553- `InviteDeleteResponse object`

527554

528555 - `id: string`

529556

from line 562

535562

536563 For Invites, this is always `"invite_deleted"`.

537564

538 - `"invite_deleted"`

565 default: invite_deleted

539566

api/admin/invites/create Changed · +19 / -14 lines

# Create Invite ## Body parameters ## Returns ## Example ### Response (200) ## Create Invite ### Body Parameters ### Returns ### Example #### Response

from line 1

1---

2title: Create Invite

3url: https://platform.claude.com/docs/en/api/admin/invites/create

4---

1# Create Invite

52

6## Create Invite

3**POST** `/v1/organizations/invites`

74

8**post** `/v1/organizations/invites`

9

105For Claude Enterprise organizations, this endpoint's availability is in beta.

116

127On plans that draw members from a finite pool of purchased seats, the invite automatically consumes a seat from the lowest tier with availability; there is no seat-tier parameter. When no seat is free the request fails with a 400 error rather than purchasing a seat.

138

14### Body Parameters

9## Body parameters

1510

1611- `email: string`

1712

1813 Email of the User.

1914

15 format: email

16

2017- `role: "billing" or "claude_code_user" or "developer" or 2 more`

2118

2219 Role for the invited User.

from line 34

3734

3835 RBAC group IDs to assign to the User when the Invite is accepted. A non-empty array is accepted only for a Claude Enterprise organization with RBAC groups (beta), and requires the key to carry the `write:rbac_groups` scope.

3936

40### Returns

37 maxItems: 100

4138

42- `Invite object { id, accepted_at, email, 6 more }`

39## Returns

4340

41- `Invite object`

42

4443 - `id: string`

4544

4645 ID of the Invite.

from line 48

4948

5049 RFC 3339 datetime string indicating when the Invite was accepted, or null.

5150

51 format: date-time

52

5253 - `email: string`

5354

5455 Email of the User being invited.

from line 58

5758

5859 RFC 3339 datetime string indicating when the Invite expires.

5960

61 format: date-time

62

6063 - `invited_at: string`

6164

6265 RFC 3339 datetime string indicating when the Invite was created.

6366

67 format: date-time

68

6469 - `rbac_group_ids: array of string`

6570

6671 RBAC group IDs recorded on the Invite (beta, Claude Enterprise organizations), to be assigned to the User when the Invite is accepted. `[]` when none.

from line 110

105110

106111 For Invites, this is always `"invite"`.

107112

108 - `"invite"`

113 default: invite

109114

110### Example

115## Example

111116

112```http

117```bash

113118curl https://api.anthropic.com/v1/organizations/invites \

114119 -H 'Content-Type: application/json' \

115120 -H 'anthropic-version: 2023-06-01' \

from line 125

120125 }'

121126```

122127

123#### Response

128### Response (200)

124129

125130```json

126131{

api/admin/invites/delete Changed · +8 / -13 lines

# Delete Invite ## Path parameters ## Returns ## Example ### Response (200) ## Delete Invite ### Path Parameters ### Returns ### Example #### Response

from line 1

1---

2title: Delete Invite

3url: https://platform.claude.com/docs/en/api/admin/invites/delete

4---

1# Delete Invite

52

6## Delete Invite

3**DELETE** `/v1/organizations/invites/{invite_id}`

74

8**delete** `/v1/organizations/invites/{invite_id}`

9

105For Claude Enterprise organizations, this endpoint's availability is in beta.

116

12### Path Parameters

7## Path parameters

138

149- `invite_id: string`

1510

1611 ID of the Invite.

1712

18### Returns

13## Returns

1914

2015- `id: string`

2116

from line 22

2722

2823 For Invites, this is always `"invite_deleted"`.

2924

30 - `"invite_deleted"`

25 default: invite_deleted

3126

32### Example

27## Example

3328

34```http

29```bash

3530curl https://api.anthropic.com/v1/organizations/invites/$INVITE_ID \

3631 -X DELETE \

3732 -H 'anthropic-version: 2023-06-01' \

from line 33

3833 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

3934```

4035

41#### Response

36### Response (200)

4237

4338```json

4439{

api/admin/invites/list Changed · +18 / -13 lines

# List Invites ## Query parameters ## Returns ## Example ### Response (200) ## List Invites ### Query Parameters ### Returns ### Example #### Response

from line 1

1---

2title: List Invites

3url: https://platform.claude.com/docs/en/api/admin/invites/list

4---

1# List Invites

52

6## List Invites

3**GET** `/v1/organizations/invites`

74

8**get** `/v1/organizations/invites`

9

105For Claude Enterprise organizations, this endpoint's availability is in beta.

116

12### Query Parameters

7## Query parameters

138

149- `after_id: optional string`

1510

from line 18

2318

2419 Filter by the email address the Invite was sent to. Matches the same way as the Users list's `email` filter (normalized, case-insensitive).

2520

21 format: email

22

2623- `limit: optional number`

2724

2825 Number of items to return per page.

from line 26

2926

3027 Defaults to `20`. Ranges from `1` to `1000`.

3128

29 default: 20, maximum: 1000, minimum: 1

30

3231- `roles: optional array of string`

3332

3433 Filter to items whose `role` equals one of the supplied values. Repeatable; values are OR'ed together.

from line 44

4544

4645 - `"pending"`

4746

48### Returns

47## Returns

4948

5049- `data: array of Invite`

5150

from line 56

5756

5857 RFC 3339 datetime string indicating when the Invite was accepted, or null.

5958

59 format: date-time

60

6061 - `email: string`

6162

6263 Email of the User being invited.

from line 66

6566

6667 RFC 3339 datetime string indicating when the Invite expires.

6768

69 format: date-time

70

6871 - `invited_at: string`

6972

7073 RFC 3339 datetime string indicating when the Invite was created.

7174

75 format: date-time

76

7277 - `rbac_group_ids: array of string`

7378

7479 RBAC group IDs recorded on the Invite (beta, Claude Enterprise organizations), to be assigned to the User when the Invite is accepted. `[]` when none.

from line 118

113118

114119 For Invites, this is always `"invite"`.

115120

116 - `"invite"`

121 default: invite

117122

118123- `first_id: string or null`

119124

from line 132

127132

128133 Last ID in the `data` list. Can be used as the `after_id` for the next page.

129134

130### Example

135## Example

131136

132```http

137```bash

133138curl https://api.anthropic.com/v1/organizations/invites \

134139 -H 'anthropic-version: 2023-06-01' \

135140 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

136141```

137142

138#### Response

143### Response (200)

139144

140145```json

141146{

api/admin/invites/retrieve Changed · +15 / -14 lines

# Get Invite ## Path parameters ## Returns ## Example ### Response (200) ## Get Invite ### Path Parameters ### Returns ### Example #### Response

from line 1

1---

2title: Get Invite

3url: https://platform.claude.com/docs/en/api/admin/invites/retrieve

4---

1# Get Invite

52

6## Get Invite

3**GET** `/v1/organizations/invites/{invite_id}`

74

8**get** `/v1/organizations/invites/{invite_id}`

9

105For Claude Enterprise organizations, this endpoint's availability is in beta.

116

12### Path Parameters

7## Path parameters

138

149- `invite_id: string`

1510

1611 ID of the Invite.

1712

18### Returns

13## Returns

1914

20- `Invite object { id, accepted_at, email, 6 more }`

15- `Invite object`

2116

2217 - `id: string`

2318

from line 22

2722

2823 RFC 3339 datetime string indicating when the Invite was accepted, or null.

2924

25 format: date-time

26

3027 - `email: string`

3128

3229 Email of the User being invited.

from line 32

3532

3633 RFC 3339 datetime string indicating when the Invite expires.

3734

35 format: date-time

36

3837 - `invited_at: string`

3938

4039 RFC 3339 datetime string indicating when the Invite was created.

4140

41 format: date-time

42

4243 - `rbac_group_ids: array of string`

4344

4445 RBAC group IDs recorded on the Invite (beta, Claude Enterprise organizations), to be assigned to the User when the Invite is accepted. `[]` when none.

from line 84

8384

8485 For Invites, this is always `"invite"`.

8586

86 - `"invite"`

87 default: invite

8788

88### Example

89## Example

8990

90```http

91```bash

9192curl https://api.anthropic.com/v1/organizations/invites/$INVITE_ID \

9293 -H 'anthropic-version: 2023-06-01' \

9394 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

9495```

9596

96#### Response

97### Response (200)

9798

9899```json

99100{

api/admin/mcp_tunnels Changed · +174 / -265 lines

### Path parameters ### Headers #### Response (200) ### Query parameters ### Headers #### Response (200) ### Path parameters ### Headers #### Response (200) ### Path parameters ### Headers ### Body parameters #### Response (200) ### Path parameters ### Headers #### Response (200) ## Domain types ## MCP Tunnels › Tunnel Certificates ### Create Tunnel Certificate #### Path parameters #### Headers #### Body parameters #### Returns #### Example ##### Response (200) ### Get Tunnel Certificate #### Path parameters #### Headers #### Returns #### Example ##### Response (200) ### List Tunnel Certificates #### Path parameters #### Query parameters #### Headers #### Returns #### Example ##### Response (200) ### Archive Tunnel Certificate #### Path parameters #### Headers #### Returns #### Example ##### Response (200) ### Path Parameters ### Header Parameters #### Response ### Query Parameters ### Header Parameters #### Response ### Path Parameters ### Header Parameters #### Response ### Path Parameters ### Header Parameters ### Body Parameters #### Response ### Path Parameters ### Header Parameters #### Response ## Domain Types # Tunnel Certificates ## Create Tunnel Certificate ### Path Parameters ### Header Parameters ### Body Parameters #### Response ## Get Tunnel Certificate ### Path Parameters ### Header Parameters #### Response ## List Tunnel Certificates ### Path Parameters ### Query Parameters ### Header Parameters #### Response ## Archive Tunnel Certificate ### Path Parameters ### Header Parameters #### Response ## Domain Types ### Tunnel Certificate Create Response ### Tunnel Certificate Retrieve Response ### Tunnel Certificate List Response ### Tunnel Certificate Archive Response

The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.

from line 1

1---

2title: MCP Tunnels

3url: https://platform.claude.com/docs/en/api/admin/mcp_tunnels

4---

5

61# MCP Tunnels

72

83## Get Tunnel

94

10**get** `/v1/organizations/tunnels/{tunnel_id}`

5**GET** `/v1/organizations/tunnels/{tunnel_id}`

6

7**Deprecated**

118

129**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.

1310

1411Retrieve a single tunnel in the caller's organization by ID.

1512

16### Path Parameters

13### Path parameters

1714

1815- `tunnel_id: string`

1916

2017 ID of the Tunnel.

2118

22### Header Parameters

19### Headers

2320

2421- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`

2522

2623 Required for all Tunnel endpoints.

27

28 - `"mcp-tunnels-2026-05-19"`

2924

3025### Returns

3126

from line 33

3833 RFC 3339 datetime string indicating when the Tunnel was archived, or

3934 `null` if it is not archived.

4035

36 format: date-time

37

4138- `created_at: string`

4239

4340 RFC 3339 datetime string indicating when the Tunnel was created.

41

42 format: date-time

4443

4544- `display_name: string or null`

4645

from line 55

5655

5756 Object type. Always `tunnel` for Tunnels.

5857

59 - `"tunnel"`

58 default: tunnel

6059

6160- `workspace_id: string or null`

6261

from line 64

6564

6665### Example

6766

68```http

67```bash

6968curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID \

7069 -H 'anthropic-version: 2023-06-01' \

7170 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

7271```

7372

74#### Response

73#### Response (200)

7574

7675```json

7776{

from line 86

8786

8887## List Tunnels

8988

90**get** `/v1/organizations/tunnels`

89**GET** `/v1/organizations/tunnels`

90

91**Deprecated**

9192

9293**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.

9394

from line 98

9798(newest first). Use `workspace_id` to filter to a single workspace;

9899archived tunnels are excluded unless `include_archived` is set.

99100

100### Query Parameters

101### Query parameters

101102

102103- `include_archived: optional boolean`

103104

104105 Include archived tunnels in the results. Archived tunnels are excluded by

105106 default.

106107

108 default: false

109

107110- `limit: optional number`

108111

109112 Maximum number of tunnels to return in a single page.

113

114 default: 20, maximum: 1000, minimum: 1

110115

111116- `page: optional string`

112117

from line 123

118123 Return only tunnels in this Workspace. Accepts a `wrkspc_`-prefixed

119124 Workspace ID; omit to list tunnels across all Workspaces.

120125

121### Header Parameters

126### Headers

122127

123128- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`

124129

125130 Required for all Tunnel endpoints.

126131

127 - `"mcp-tunnels-2026-05-19"`

128

129132### Returns

130133

131- `data: array of object { id, archived_at, created_at, 4 more }`

134- `data: array of object`

132135

133136 - `id: string`

134137

from line 142

139142 RFC 3339 datetime string indicating when the Tunnel was archived, or

140143 `null` if it is not archived.

141144

145 format: date-time

146

142147 - `created_at: string`

143148

144149 RFC 3339 datetime string indicating when the Tunnel was created.

150

151 format: date-time

145152

146153 - `display_name: string or null`

147154

from line 164

157164

158165 Object type. Always `tunnel` for Tunnels.

159166

160 - `"tunnel"`

167 default: tunnel

161168

162169 - `workspace_id: string or null`

163170

from line 177

170177

171178### Example

172179

173```http

180```bash

174181curl https://api.anthropic.com/v1/organizations/tunnels \

175182 -H 'anthropic-version: 2023-06-01' \

176183 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

177184```

178185

179#### Response

186#### Response (200)

180187

181188```json

182189{

from line 204

197204

198205## Reveal Tunnel Token

199206

200**post** `/v1/organizations/tunnels/{tunnel_id}/reveal_token`

207**POST** `/v1/organizations/tunnels/{tunnel_id}/reveal_token`

208

209**Deprecated**

201210

202211**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.

203212

from line 217

208217Exposed as `POST` so the token does not appear in intermediary

209218access logs.

210219

211### Path Parameters

220### Path parameters

212221

213222- `tunnel_id: string`

214223

215224 ID of the Tunnel.

216225

217### Header Parameters

226### Headers

218227

219228- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`

220229

221230 Required for all Tunnel endpoints.

222

223 - `"mcp-tunnels-2026-05-19"`

224231

225232### Returns

226233

from line 244

237244

238245 Object type. Always `tunnel_token` for Tunnel Tokens.

239246

240 - `"tunnel_token"`

247 default: tunnel_token

241248

242249### Example

243250

244```http

251```bash

245252curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/reveal_token \

246253 -X POST \

247254 -H 'anthropic-version: 2023-06-01' \

248255 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

249256```

250257

251#### Response

258#### Response (200)

252259

253260```json

254261{

from line 267

260267

261268## Rotate Tunnel Token

262269

263**post** `/v1/organizations/tunnels/{tunnel_id}/rotate_token`

270**POST** `/v1/organizations/tunnels/{tunnel_id}/rotate_token`

271

272**Deprecated**

264273

265274**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.

266275

from line 279

270279restarted after rotation must use the new value. An optional

271280`reason` is captured for operational context.

272281

273### Path Parameters

282### Path parameters

274283

275284- `tunnel_id: string`

276285

277286 ID of the Tunnel.

278287

279### Header Parameters

288### Headers

280289

281290- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`

282291

283292 Required for all Tunnel endpoints.

284293

285 - `"mcp-tunnels-2026-05-19"`

286

287### Body Parameters

294### Body parameters

288295

289296- `reason: optional string or null`

290297

291298 Optional free-text reason for the rotation, recorded for audit.

299

300 maxLength: 1024

292301

293302### Returns

294303

from line 314

305314

306315 Object type. Always `tunnel_token` for Tunnel Tokens.

307316

308 - `"tunnel_token"`

317 default: tunnel_token

309318

310319### Example

311320

312```http

321```bash

313322curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/rotate_token \

314323 -X POST \

315324 -H 'anthropic-version: 2023-06-01' \

316325 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

317326```

318327

319#### Response

328#### Response (200)

320329

321330```json

322331{

from line 337

328337

329338## Archive Tunnel

330339

331**post** `/v1/organizations/tunnels/{tunnel_id}/archive`

340**POST** `/v1/organizations/tunnels/{tunnel_id}/archive`

341

342**Deprecated**

332343

333344**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.

334345

from line 350

339350tunnel token is invalidated. Retrying against an already-archived

340351tunnel returns the existing record unchanged.

341352

342### Path Parameters

353### Path parameters

343354

344355- `tunnel_id: string`

345356

346357 ID of the Tunnel.

347358

348### Header Parameters

359### Headers

349360

350361- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`

351362

352363 Required for all Tunnel endpoints.

353

354 - `"mcp-tunnels-2026-05-19"`

355364

356365### Returns

357366

from line 373

364373 RFC 3339 datetime string indicating when the Tunnel was archived, or

365374 `null` if it is not archived.

366375

376 format: date-time

377

367378- `created_at: string`

368379

369380 RFC 3339 datetime string indicating when the Tunnel was created.

381

382 format: date-time

370383

371384- `display_name: string or null`

372385

from line 395

382395

383396 Object type. Always `tunnel` for Tunnels.

384397

385 - `"tunnel"`

398 default: tunnel

386399

387400- `workspace_id: string or null`

388401

from line 404

391404

392405### Example

393406

394```http

407```bash

395408curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/archive \

396409 -X POST \

397410 -H 'anthropic-version: 2023-06-01' \

398411 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

399412```

400413

401#### Response

414#### Response (200)

402415

403416```json

404417{

from line 425

412425}

413426```

414427

415## Domain Types

428## Domain types

416429

417430### MCP Tunnel Retrieve Response

418431

419- `MCPTunnelRetrieveResponse object { id, archived_at, created_at, 4 more }`

432- `MCPTunnelRetrieveResponse object`

420433

421434 - `id: string`

422435

from line 440

427440 RFC 3339 datetime string indicating when the Tunnel was archived, or

428441 `null` if it is not archived.

429442

443 format: date-time

444

430445 - `created_at: string`

431446

432447 RFC 3339 datetime string indicating when the Tunnel was created.

448

449 format: date-time

433450

434451 - `display_name: string or null`

435452

from line 462

445462

446463 Object type. Always `tunnel` for Tunnels.

447464

448 - `"tunnel"`

465 default: tunnel

449466

450467 - `workspace_id: string or null`

451468

from line 471

454471

455472### MCP Tunnel List Response

456473

457- `MCPTunnelListResponse object { id, archived_at, created_at, 4 more }`

474- `MCPTunnelListResponse object`

458475

459476 - `id: string`

460477

from line 482

465482 RFC 3339 datetime string indicating when the Tunnel was archived, or

466483 `null` if it is not archived.

467484

485 format: date-time

486

468487 - `created_at: string`

469488

470489 RFC 3339 datetime string indicating when the Tunnel was created.

490

491 format: date-time

471492

472493 - `display_name: string or null`

473494

from line 504

483504

484505 Object type. Always `tunnel` for Tunnels.

485506

486 - `"tunnel"`

507 default: tunnel

487508

488509 - `workspace_id: string or null`

489510

from line 513

492513

493514### MCP Tunnel Reveal Token Response

494515

495- `MCPTunnelRevealTokenResponse object { id, tunnel_token, type }`

516- `MCPTunnelRevealTokenResponse object`

496517

497518 - `id: string`

498519

from line 528

507528

508529 Object type. Always `tunnel_token` for Tunnel Tokens.

509530

510 - `"tunnel_token"`

531 default: tunnel_token

511532

512533### MCP Tunnel Rotate Token Response

513534

514- `MCPTunnelRotateTokenResponse object { id, tunnel_token, type }`

535- `MCPTunnelRotateTokenResponse object`

515536

516537 - `id: string`

517538

from line 547

526547

527548 Object type. Always `tunnel_token` for Tunnel Tokens.

528549

529 - `"tunnel_token"`

550 default: tunnel_token

530551

531552### MCP Tunnel Archive Response

532553

533- `MCPTunnelArchiveResponse object { id, archived_at, created_at, 4 more }`

554- `MCPTunnelArchiveResponse object`

534555

535556 - `id: string`

536557

from line 562

541562 RFC 3339 datetime string indicating when the Tunnel was archived, or

542563 `null` if it is not archived.

543564

565 format: date-time

566

544567 - `created_at: string`

545568

546569 RFC 3339 datetime string indicating when the Tunnel was created.

570

571 format: date-time

547572

548573 - `display_name: string or null`

549574

from line 584

559584

560585 Object type. Always `tunnel` for Tunnels.

561586

562 - `"tunnel"`

587 default: tunnel

563588

564589 - `workspace_id: string or null`

565590

566591 ID of the Workspace this Tunnel belongs to, or `null` for the default

567592 Workspace. Immutable after creation.

568593

569# Tunnel Certificates

570

571## Create Tunnel Certificate

572

573**post** `/v1/organizations/tunnels/{tunnel_id}/certificates`

594## MCP Tunnels › Tunnel Certificates

595

596### Create Tunnel Certificate

597

598**POST** `/v1/organizations/tunnels/{tunnel_id}/certificates`

599

600**Deprecated**

574601

575602**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.

576603

from line 608

581608exactly one X.509 certificate and no private-key material. A tunnel

582609holds at most two non-archived certificates.

583610

584### Path Parameters

611#### Path parameters

585612

586613- `tunnel_id: string`

587614

588615 ID of the Tunnel.

589616

590### Header Parameters

617#### Headers

591618

592619- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`

593620

594621 Required for all Tunnel endpoints.

595622

596 - `"mcp-tunnels-2026-05-19"`

597

598### Body Parameters

623#### Body parameters

599624

600625- `ca_certificate_pem: string`

601626

602627 PEM-encoded X.509 CA certificate. Must contain exactly one certificate and

603628 no private-key material.

604629

605### Returns

630 maxLength: 8192

631

632#### Returns

606633

607634- `id: string`

608635

from line 640

613640 RFC 3339 datetime string indicating when the certificate was archived, or

614641 `null` if it is not archived.

615642

643 format: date-time

644

616645- `created_at: string`

617646

618647 RFC 3339 datetime string indicating when the certificate was registered.

648

649 format: date-time

619650

620651- `expires_at: string or null`

621652

622653 RFC 3339 datetime string indicating when the certificate expires, or

623654 `null` if it does not expire.

624655

656 format: date-time

657

625658- `fingerprint: string`

626659

627660 The certificate's SHA-256 fingerprint, as a lowercase hex string.

from line 667

634667

635668 Object type. Always `tunnel_certificate` for Tunnel Certificates.

636669

637 - `"tunnel_certificate"`

638

639### Example

640

641```http

670 default: tunnel_certificate

671

672#### Example

673

674```bash

642675curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \

643676 -H 'Content-Type: application/json' \

644677 -H 'anthropic-version: 2023-06-01' \

from line 681

648681 }'

649682```

650683

651#### Response

684##### Response (200)

652685

653686```json

654687{

from line 695

662695}

663696```

664697

665## Get Tunnel Certificate

666

667**get** `/v1/organizations/tunnels/{tunnel_id}/certificates/{certificate_id}`

698### Get Tunnel Certificate

699

700**GET** `/v1/organizations/tunnels/{tunnel_id}/certificates/{certificate_id}`

701

702**Deprecated**

668703

669704**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.

670705

671706Retrieve a single certificate registered on a tunnel by ID.

672707

673### Path Parameters

708#### Path parameters

674709

675710- `tunnel_id: string`

676711

from line 715

680715

681716 ID of the Tunnel Certificate.

682717

683### Header Parameters

718#### Headers

684719

685720- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`

686721

687722 Required for all Tunnel endpoints.

688723

689 - `"mcp-tunnels-2026-05-19"`

690

691### Returns

724#### Returns

692725

693726- `id: string`

694727

from line 732

699732 RFC 3339 datetime string indicating when the certificate was archived, or

700733 `null` if it is not archived.

701734

735 format: date-time

736

702737- `created_at: string`

703738

704739 RFC 3339 datetime string indicating when the certificate was registered.

740

741 format: date-time

705742

706743- `expires_at: string or null`

707744

708745 RFC 3339 datetime string indicating when the certificate expires, or

709746 `null` if it does not expire.

710747

748 format: date-time

749

711750- `fingerprint: string`

712751

713752 The certificate's SHA-256 fingerprint, as a lowercase hex string.

from line 759

720759

721760 Object type. Always `tunnel_certificate` for Tunnel Certificates.

722761

723 - `"tunnel_certificate"`

724

725### Example

726

727```http

762 default: tunnel_certificate

763

764#### Example

765

766```bash

728767curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID \

729768 -H 'anthropic-version: 2023-06-01' \

730769 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

731770```

732771

733#### Response

772##### Response (200)

734773

735774```json

736775{

from line 783

744783}

745784```

746785

747## List Tunnel Certificates

748

749**get** `/v1/organizations/tunnels/{tunnel_id}/certificates`

786### List Tunnel Certificates

787

788**GET** `/v1/organizations/tunnels/{tunnel_id}/certificates`

789

790**Deprecated**

750791

751792**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.

752793

from line 795

754795

755796Archived certificates are excluded unless `include_archived` is set.

756797

757### Path Parameters

798#### Path parameters

758799

759800- `tunnel_id: string`

760801

761802 ID of the Tunnel.

762803

763### Query Parameters

804#### Query parameters

764805

765806- `include_archived: optional boolean`

766807

767808 Include archived certificates in the results. Archived certificates are

768809 excluded by default.

769810

811 default: false

812

770813- `limit: optional number`

771814

772815 Maximum number of certificates to return.

816

817 default: 20, maximum: 1000, minimum: 1

773818

774819- `page: optional string`

775820

776821 A tunnel has at most two active certificates, so this list is not

777822 paginated.

778823

779### Header Parameters

824#### Headers

780825

781826- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`

782827

783828 Required for all Tunnel endpoints.

784829

785 - `"mcp-tunnels-2026-05-19"`

786

787### Returns

788

789- `data: array of object { id, archived_at, created_at, 4 more }`

830#### Returns

831

832- `data: array of object`

790833

791834 - `id: string`

792835

from line 840

797840 RFC 3339 datetime string indicating when the certificate was archived, or

798841 `null` if it is not archived.

799842

843 format: date-time

844

800845 - `created_at: string`

801846

802847 RFC 3339 datetime string indicating when the certificate was registered.

848

849 format: date-time

803850

804851 - `expires_at: string or null`

805852

806853 RFC 3339 datetime string indicating when the certificate expires, or

807854 `null` if it does not expire.

808855

856 format: date-time

857

809858 - `fingerprint: string`

810859

811860 The certificate's SHA-256 fingerprint, as a lowercase hex string.

from line 867

818867

819868 Object type. Always `tunnel_certificate` for Tunnel Certificates.

820869

821 - `"tunnel_certificate"`

870 default: tunnel_certificate

822871

823872- `next_page: string or null`

824873

825874 Opaque cursor for the next page, or `null` if there are no more results.

826875

827### Example

828

829```http

876#### Example

877

878```bash

830879curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \

831880 -H 'anthropic-version: 2023-06-01' \

832881 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

833882```

834883

835#### Response

884##### Response (200)

836885

837886```json

838887{

from line 900

851900}

852901```

853902

854## Archive Tunnel Certificate

855

856**post** `/v1/organizations/tunnels/{tunnel_id}/certificates/{certificate_id}/archive`

903### Archive Tunnel Certificate

904

905**POST** `/v1/organizations/tunnels/{tunnel_id}/certificates/{certificate_id}/archive`

906

907**Deprecated**

857908

858909**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.

859910

from line 914

863914certificate is permitted; the tunnel rejects MCP traffic until a new

864915certificate is added.

865916

866### Path Parameters

917#### Path parameters

867918

868919- `tunnel_id: string`

869920

from line 924

873924

874925 ID of the Tunnel Certificate.

875926

876### Header Parameters

927#### Headers

877928

878929- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`

879930

880931 Required for all Tunnel endpoints.

881932

882 - `"mcp-tunnels-2026-05-19"`

883

884### Returns

933#### Returns

885934

886935- `id: string`

887936

from line 941

892941 RFC 3339 datetime string indicating when the certificate was archived, or

893942 `null` if it is not archived.

894943

944 format: date-time

945

895946- `created_at: string`

896947

897948 RFC 3339 datetime string indicating when the certificate was registered.

949

950 format: date-time

898951

899952- `expires_at: string or null`

900953

901954 RFC 3339 datetime string indicating when the certificate expires, or

902955 `null` if it does not expire.

903956

957 format: date-time

958

904959- `fingerprint: string`

905960

906961 The certificate's SHA-256 fingerprint, as a lowercase hex string.

from line 968

913968

914969 Object type. Always `tunnel_certificate` for Tunnel Certificates.

915970

916 - `"tunnel_certificate"`

917

918### Example

919

920```http

971 default: tunnel_certificate

972

973#### Example

974

975```bash

921976curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID/archive \

922977 -X POST \

923978 -H 'anthropic-version: 2023-06-01' \

924979 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

925980```

926981

927#### Response

982##### Response (200)

928983

929984```json

930985{

from line 992

937992 "type": "tunnel_certificate"

938993}

939994```

940

941## Domain Types

942

943### Tunnel Certificate Create Response

944

945- `TunnelCertificateCreateResponse object { id, archived_at, created_at, 4 more }`

946

947 - `id: string`

948

949 ID of the Tunnel Certificate.

950

951 - `archived_at: string or null`

952

953 RFC 3339 datetime string indicating when the certificate was archived, or

954 `null` if it is not archived.

955

956 - `created_at: string`

957

958 RFC 3339 datetime string indicating when the certificate was registered.

959

960 - `expires_at: string or null`

961

962 RFC 3339 datetime string indicating when the certificate expires, or

963 `null` if it does not expire.

964

965 - `fingerprint: string`

966

967 The certificate's SHA-256 fingerprint, as a lowercase hex string.

968

969 - `tunnel_id: string`

970

971 ID of the Tunnel this certificate is registered against.

972

973 - `type: "tunnel_certificate"`

974

975 Object type. Always `tunnel_certificate` for Tunnel Certificates.

976

977 - `"tunnel_certificate"`

978

979### Tunnel Certificate Retrieve Response

980

981- `TunnelCertificateRetrieveResponse object { id, archived_at, created_at, 4 more }`

982

983 - `id: string`

984

985 ID of the Tunnel Certificate.

986

987 - `archived_at: string or null`

988

989 RFC 3339 datetime string indicating when the certificate was archived, or

990 `null` if it is not archived.

991

992 - `created_at: string`

993

994 RFC 3339 datetime string indicating when the certificate was registered.

995

996 - `expires_at: string or null`

997

998 RFC 3339 datetime string indicating when the certificate expires, or

999 `null` if it does not expire.

1000

1001 - `fingerprint: string`

1002

1003 The certificate's SHA-256 fingerprint, as a lowercase hex string.

1004

1005 - `tunnel_id: string`

1006

1007 ID of the Tunnel this certificate is registered against.

1008

1009 - `type: "tunnel_certificate"`

1010

1011 Object type. Always `tunnel_certificate` for Tunnel Certificates.

1012

1013 - `"tunnel_certificate"`

1014

1015### Tunnel Certificate List Response

1016

1017- `TunnelCertificateListResponse object { id, archived_at, created_at, 4 more }`

1018

1019 - `id: string`

1020

1021 ID of the Tunnel Certificate.

1022

1023 - `archived_at: string or null`

1024

1025 RFC 3339 datetime string indicating when the certificate was archived, or

1026 `null` if it is not archived.

1027

1028 - `created_at: string`

1029

1030 RFC 3339 datetime string indicating when the certificate was registered.

1031

1032 - `expires_at: string or null`

1033

1034 RFC 3339 datetime string indicating when the certificate expires, or

1035 `null` if it does not expire.

1036

1037 - `fingerprint: string`

1038

1039 The certificate's SHA-256 fingerprint, as a lowercase hex string.

1040

1041 - `tunnel_id: string`

1042

1043 ID of the Tunnel this certificate is registered against.

1044

1045 - `type: "tunnel_certificate"`

1046

1047 Object type. Always `tunnel_certificate` for Tunnel Certificates.

1048

1049 - `"tunnel_certificate"`

1050

1051### Tunnel Certificate Archive Response

1052

1053- `TunnelCertificateArchiveResponse object { id, archived_at, created_at, 4 more }`

1054

1055 - `id: string`

1056

1057 ID of the Tunnel Certificate.

1058

1059 - `archived_at: string or null`

1060

1061 RFC 3339 datetime string indicating when the certificate was archived, or

1062 `null` if it is not archived.

1063

1064 - `created_at: string`

1065

1066 RFC 3339 datetime string indicating when the certificate was registered.

1067

1068 - `expires_at: string or null`

1069

1070 RFC 3339 datetime string indicating when the certificate expires, or

1071 `null` if it does not expire.

1072

1073 - `fingerprint: string`

1074

1075 The certificate's SHA-256 fingerprint, as a lowercase hex string.

1076

1077 - `tunnel_id: string`

1078

1079 ID of the Tunnel this certificate is registered against.

1080

1081 - `type: "tunnel_certificate"`

1082

1083 Object type. Always `tunnel_certificate` for Tunnel Certificates.

1084

1085 - `"tunnel_certificate"`

1086995

api/admin/mcp_tunnels/archive Changed · +14 / -15 lines

# Archive Tunnel ## Path parameters ## Headers ## Returns ## Example ### Response (200) ## Archive Tunnel ### Path Parameters ### Header Parameters ### Returns ### Example #### Response

from line 1

1---

2title: Archive Tunnel

3url: https://platform.claude.com/docs/en/api/admin/mcp_tunnels/archive

4---

1# Archive Tunnel

52

6## Archive Tunnel

3**POST** `/v1/organizations/tunnels/{tunnel_id}/archive`

74

8**post** `/v1/organizations/tunnels/{tunnel_id}/archive`

5**Deprecated**

96

107**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.

118

from line 13

1613tunnel token is invalidated. Retrying against an already-archived

1714tunnel returns the existing record unchanged.

1815

19### Path Parameters

16## Path parameters

2017

2118- `tunnel_id: string`

2219

2320 ID of the Tunnel.

2421

25### Header Parameters

22## Headers

2623

2724- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`

2825

2926 Required for all Tunnel endpoints.

3027

31 - `"mcp-tunnels-2026-05-19"`

28## Returns

3229

33### Returns

34

3530- `id: string`

3631

3732 ID of the Tunnel.

from line 36

4136 RFC 3339 datetime string indicating when the Tunnel was archived, or

4237 `null` if it is not archived.

4338

39 format: date-time

40

4441- `created_at: string`

4542

4643 RFC 3339 datetime string indicating when the Tunnel was created.

4744

45 format: date-time

46

4847- `display_name: string or null`

4948

5049 Human-readable name for the Tunnel (1–255 characters), or `null` if unset.

from line 58

5958

6059 Object type. Always `tunnel` for Tunnels.

6160

62 - `"tunnel"`

61 default: tunnel

6362

6463- `workspace_id: string or null`

6564

from line 65

6665 ID of the Workspace this Tunnel belongs to, or `null` for the default

6766 Workspace. Immutable after creation.

6867

69### Example

68## Example

7069

71```http

70```bash

7271curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/archive \

7372 -X POST \

7473 -H 'anthropic-version: 2023-06-01' \

from line 74

7574 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

7675```

7776

78#### Response

77### Response (200)

7978

8079```json

8180{

api/admin/mcp_tunnels/list Changed · +19 / -16 lines

# List Tunnels ## Query parameters ## Headers ## Returns ## Example ### Response (200) ## List Tunnels ### Query Parameters ### Header Parameters ### Returns ### Example #### Response

from line 1

1---

2title: List Tunnels

3url: https://platform.claude.com/docs/en/api/admin/mcp_tunnels/list

4---

1# List Tunnels

52

6## List Tunnels

3**GET** `/v1/organizations/tunnels`

74

8**get** `/v1/organizations/tunnels`

5**Deprecated**

96

107**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.

118

from line 12

1512(newest first). Use `workspace_id` to filter to a single workspace;

1613archived tunnels are excluded unless `include_archived` is set.

1714

18### Query Parameters

15## Query parameters

1916

2017- `include_archived: optional boolean`

2118

from line 19

2219 Include archived tunnels in the results. Archived tunnels are excluded by

2320 default.

2421

22 default: false

23

2524- `limit: optional number`

2625

2726 Maximum number of tunnels to return in a single page.

2827

28 default: 20, maximum: 1000, minimum: 1

29

2930- `page: optional string`

3031

3132 Opaque pagination cursor from a previous response's `next_page`. Omit to

from line 37

3637 Return only tunnels in this Workspace. Accepts a `wrkspc_`-prefixed

3738 Workspace ID; omit to list tunnels across all Workspaces.

3839

39### Header Parameters

40## Headers

4041

4142- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`

4243

4344 Required for all Tunnel endpoints.

4445

45 - `"mcp-tunnels-2026-05-19"`

46## Returns

4647

47### Returns

48- `data: array of object`

4849

49- `data: array of object { id, archived_at, created_at, 4 more }`

50

5150 - `id: string`

5251

5352 ID of the Tunnel.

from line 56

5756 RFC 3339 datetime string indicating when the Tunnel was archived, or

5857 `null` if it is not archived.

5958

59 format: date-time

60

6061 - `created_at: string`

6162

6263 RFC 3339 datetime string indicating when the Tunnel was created.

6364

65 format: date-time

66

6467 - `display_name: string or null`

6568

6669 Human-readable name for the Tunnel (1–255 characters), or `null` if unset.

from line 78

7578

7679 Object type. Always `tunnel` for Tunnels.

7780

78 - `"tunnel"`

81 default: tunnel

7982

8083 - `workspace_id: string or null`

8184

from line 89

8689

8790 Opaque cursor for the next page, or `null` if there are no more results.

8891

89### Example

92## Example

9093

91```http

94```bash

9295curl https://api.anthropic.com/v1/organizations/tunnels \

9396 -H 'anthropic-version: 2023-06-01' \

9497 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

9598```

9699

97#### Response

100### Response (200)

98101

99102```json

100103{

api/admin/mcp_tunnels/retrieve Changed · +14 / -15 lines

# Get Tunnel ## Path parameters ## Headers ## Returns ## Example ### Response (200) ## Get Tunnel ### Path Parameters ### Header Parameters ### Returns ### Example #### Response

from line 1

1---

2title: Get Tunnel

3url: https://platform.claude.com/docs/en/api/admin/mcp_tunnels/retrieve

4---

1# Get Tunnel

52

6## Get Tunnel

3**GET** `/v1/organizations/tunnels/{tunnel_id}`

74

8**get** `/v1/organizations/tunnels/{tunnel_id}`

5**Deprecated**

96

107**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.

118

129Retrieve a single tunnel in the caller's organization by ID.

1310

14### Path Parameters

11## Path parameters

1512

1613- `tunnel_id: string`

1714

1815 ID of the Tunnel.

1916

20### Header Parameters

17## Headers

2118

2219- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`

2320

2421 Required for all Tunnel endpoints.

2522

26 - `"mcp-tunnels-2026-05-19"`

23## Returns

2724

28### Returns

29

3025- `id: string`

3126

3227 ID of the Tunnel.

from line 31

3631 RFC 3339 datetime string indicating when the Tunnel was archived, or

3732 `null` if it is not archived.

3833

34 format: date-time

35

3936- `created_at: string`

4037

4138 RFC 3339 datetime string indicating when the Tunnel was created.

4239

40 format: date-time

41

4342- `display_name: string or null`

4443

4544 Human-readable name for the Tunnel (1–255 characters), or `null` if unset.

from line 53

5453

5554 Object type. Always `tunnel` for Tunnels.

5655

57 - `"tunnel"`

56 default: tunnel

5857

5958- `workspace_id: string or null`

6059

from line 60

6160 ID of the Workspace this Tunnel belongs to, or `null` for the default

6261 Workspace. Immutable after creation.

6362

64### Example

63## Example

6564

66```http

65```bash

6766curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID \

6867 -H 'anthropic-version: 2023-06-01' \

6968 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

7069```

7170

72#### Response

71### Response (200)

7372

7473```json

7574{

api/admin/mcp_tunnels/reveal_token Changed · +10 / -15 lines

# Reveal Tunnel Token ## Path parameters ## Headers ## Returns ## Example ### Response (200) ## Reveal Tunnel Token ### Path Parameters ### Header Parameters ### Returns ### Example #### Response

from line 1

1---

2title: Reveal Tunnel Token

3url: https://platform.claude.com/docs/en/api/admin/mcp_tunnels/reveal_token

4---

1# Reveal Tunnel Token

52

6## Reveal Tunnel Token

3**POST** `/v1/organizations/tunnels/{tunnel_id}/reveal_token`

74

8**post** `/v1/organizations/tunnels/{tunnel_id}/reveal_token`

5**Deprecated**

96

107**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.

118

from line 13

1613Exposed as `POST` so the token does not appear in intermediary

1714access logs.

1815

19### Path Parameters

16## Path parameters

2017

2118- `tunnel_id: string`

2219

2320 ID of the Tunnel.

2421

25### Header Parameters

22## Headers

2623

2724- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`

2825

2926 Required for all Tunnel endpoints.

3027

31 - `"mcp-tunnels-2026-05-19"`

28## Returns

3229

33### Returns

34

3530- `id: string`

3631

3732 Stable identifier for the current token value. Changes when the token is

from line 40

4540

4641 Object type. Always `tunnel_token` for Tunnel Tokens.

4742

48 - `"tunnel_token"`

43 default: tunnel_token

4944

50### Example

45## Example

5146

52```http

47```bash

5348curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/reveal_token \

5449 -X POST \

5550 -H 'anthropic-version: 2023-06-01' \

from line 51

5651 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

5752```

5853

59#### Response

54### Response (200)

6055

6156```json

6257{

api/admin/mcp_tunnels/rotate_token Changed · +13 / -16 lines

# Rotate Tunnel Token ## Path parameters ## Headers ## Body parameters ## Returns ## Example ### Response (200) ## Rotate Tunnel Token ### Path Parameters ### Header Parameters ### Body Parameters ### Returns ### Example #### Response

from line 1

1---

2title: Rotate Tunnel Token

3url: https://platform.claude.com/docs/en/api/admin/mcp_tunnels/rotate_token

4---

1# Rotate Tunnel Token

52

6## Rotate Tunnel Token

3**POST** `/v1/organizations/tunnels/{tunnel_id}/rotate_token`

74

8**post** `/v1/organizations/tunnels/{tunnel_id}/rotate_token`

5**Deprecated**

96

107**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.

118

from line 12

1512restarted after rotation must use the new value. An optional

1613`reason` is captured for operational context.

1714

18### Path Parameters

15## Path parameters

1916

2017- `tunnel_id: string`

2118

2219 ID of the Tunnel.

2320

24### Header Parameters

21## Headers

2522

2623- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`

2724

2825 Required for all Tunnel endpoints.

2926

30 - `"mcp-tunnels-2026-05-19"`

27## Body parameters

3128

32### Body Parameters

33

3429- `reason: optional string or null`

3530

3631 Optional free-text reason for the rotation, recorded for audit.

3732

38### Returns

33 maxLength: 1024

3934

35## Returns

36

4037- `id: string`

4138

4239 Stable identifier for the current token value. Changes when the token is

from line 47

5047

5148 Object type. Always `tunnel_token` for Tunnel Tokens.

5249

53 - `"tunnel_token"`

50 default: tunnel_token

5451

55### Example

52## Example

5653

57```http

54```bash

5855curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/rotate_token \

5956 -X POST \

6057 -H 'anthropic-version: 2023-06-01' \

from line 58

6158 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

6259```

6360

64#### Response

61### Response (200)

6562

6663```json

6764{

api/admin/mcp_tunnels/tunnel_certificates Changed · +98 / -49 lines

### Path parameters ### Headers ### Body parameters #### Response (200) ### Path parameters ### Headers #### Response (200) ### Path parameters ### Query parameters ### Headers #### Response (200) ### Path parameters ### Headers #### Response (200) ## Domain types ### Path Parameters ### Header Parameters ### Body Parameters #### Response ### Path Parameters ### Header Parameters #### Response ### Path Parameters ### Query Parameters ### Header Parameters #### Response ### Path Parameters ### Header Parameters #### Response ## Domain Types

from line 1

1---

2title: Tunnel Certificates

3url: https://platform.claude.com/docs/en/api/admin/mcp_tunnels/tunnel_certificates

4---

5

61# Tunnel Certificates

72

83## Create Tunnel Certificate

94

10**post** `/v1/organizations/tunnels/{tunnel_id}/certificates`

5**POST** `/v1/organizations/tunnels/{tunnel_id}/certificates`

116

7**Deprecated**

8

129**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.

1310

1411Register a public CA certificate for the tunnel.

from line 15

1815exactly one X.509 certificate and no private-key material. A tunnel

1916holds at most two non-archived certificates.

2017

21### Path Parameters

18### Path parameters

2219

2320- `tunnel_id: string`

2421

2522 ID of the Tunnel.

2623

27### Header Parameters

24### Headers

2825

2926- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`

3027

3128 Required for all Tunnel endpoints.

3229

33 - `"mcp-tunnels-2026-05-19"`

30### Body parameters

3431

35### Body Parameters

36

3732- `ca_certificate_pem: string`

3833

3934 PEM-encoded X.509 CA certificate. Must contain exactly one certificate and

4035 no private-key material.

4136

37 maxLength: 8192

38

4239### Returns

4340

4441- `id: string`

from line 47

5047 RFC 3339 datetime string indicating when the certificate was archived, or

5148 `null` if it is not archived.

5249

50 format: date-time

51

5352- `created_at: string`

5453

5554 RFC 3339 datetime string indicating when the certificate was registered.

5655

56 format: date-time

57

5758- `expires_at: string or null`

5859

5960 RFC 3339 datetime string indicating when the certificate expires, or

6061 `null` if it does not expire.

6162

63 format: date-time

64

6265- `fingerprint: string`

6366

6467 The certificate's SHA-256 fingerprint, as a lowercase hex string.

from line 74

7174

7275 Object type. Always `tunnel_certificate` for Tunnel Certificates.

7376

74 - `"tunnel_certificate"`

77 default: tunnel_certificate

7578

7679### Example

7780

78```http

81```bash

7982curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \

8083 -H 'Content-Type: application/json' \

8184 -H 'anthropic-version: 2023-06-01' \

from line 88

8588 }'

8689```

8790

88#### Response

91#### Response (200)

8992

9093```json

9194{

from line 104

101104

102105## Get Tunnel Certificate

103106

104**get** `/v1/organizations/tunnels/{tunnel_id}/certificates/{certificate_id}`

107**GET** `/v1/organizations/tunnels/{tunnel_id}/certificates/{certificate_id}`

105108

109**Deprecated**

110

106111**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.

107112

108113Retrieve a single certificate registered on a tunnel by ID.

109114

110### Path Parameters

115### Path parameters

111116

112117- `tunnel_id: string`

113118

from line 122

117122

118123 ID of the Tunnel Certificate.

119124

120### Header Parameters

125### Headers

121126

122127- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`

123128

124129 Required for all Tunnel endpoints.

125130

126 - `"mcp-tunnels-2026-05-19"`

127

128131### Returns

129132

130133- `id: string`

from line 139

136139 RFC 3339 datetime string indicating when the certificate was archived, or

137140 `null` if it is not archived.

138141

142 format: date-time

143

139144- `created_at: string`

140145

141146 RFC 3339 datetime string indicating when the certificate was registered.

142147

148 format: date-time

149

143150- `expires_at: string or null`

144151

145152 RFC 3339 datetime string indicating when the certificate expires, or

146153 `null` if it does not expire.

147154

155 format: date-time

156

148157- `fingerprint: string`

149158

150159 The certificate's SHA-256 fingerprint, as a lowercase hex string.

from line 166

157166

158167 Object type. Always `tunnel_certificate` for Tunnel Certificates.

159168

160 - `"tunnel_certificate"`

169 default: tunnel_certificate

161170

162171### Example

163172

164```http

173```bash

165174curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID \

166175 -H 'anthropic-version: 2023-06-01' \

167176 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

168177```

169178

170#### Response

179#### Response (200)

171180

172181```json

173182{

from line 192

183192

184193## List Tunnel Certificates

185194

186**get** `/v1/organizations/tunnels/{tunnel_id}/certificates`

195**GET** `/v1/organizations/tunnels/{tunnel_id}/certificates`

187196

197**Deprecated**

198

188199**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.

189200

190201List the certificates registered on a tunnel.

from line 202

191202

192203Archived certificates are excluded unless `include_archived` is set.

193204

194### Path Parameters

205### Path parameters

195206

196207- `tunnel_id: string`

197208

198209 ID of the Tunnel.

199210

200### Query Parameters

211### Query parameters

201212

202213- `include_archived: optional boolean`

203214

from line 215

204215 Include archived certificates in the results. Archived certificates are

205216 excluded by default.

206217

218 default: false

219

207220- `limit: optional number`

208221

209222 Maximum number of certificates to return.

210223

224 default: 20, maximum: 1000, minimum: 1

225

211226- `page: optional string`

212227

213228 A tunnel has at most two active certificates, so this list is not

214229 paginated.

215230

216### Header Parameters

231### Headers

217232

218233- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`

219234

220235 Required for all Tunnel endpoints.

221236

222 - `"mcp-tunnels-2026-05-19"`

223

224237### Returns

225238

226- `data: array of object { id, archived_at, created_at, 4 more }`

239- `data: array of object`

227240

228241 - `id: string`

229242

from line 247

234247 RFC 3339 datetime string indicating when the certificate was archived, or

235248 `null` if it is not archived.

236249

250 format: date-time

251

237252 - `created_at: string`

238253

239254 RFC 3339 datetime string indicating when the certificate was registered.

240255

256 format: date-time

257

241258 - `expires_at: string or null`

242259

243260 RFC 3339 datetime string indicating when the certificate expires, or

244261 `null` if it does not expire.

245262

263 format: date-time

264

246265 - `fingerprint: string`

247266

248267 The certificate's SHA-256 fingerprint, as a lowercase hex string.

from line 274

255274

256275 Object type. Always `tunnel_certificate` for Tunnel Certificates.

257276

258 - `"tunnel_certificate"`

277 default: tunnel_certificate

259278

260279- `next_page: string or null`

261280

from line 282

263282

264283### Example

265284

266```http

285```bash

267286curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \

268287 -H 'anthropic-version: 2023-06-01' \

269288 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

270289```

271290

272#### Response

291#### Response (200)

273292

274293```json

275294{

from line 309

290309

291310## Archive Tunnel Certificate

292311

293**post** `/v1/organizations/tunnels/{tunnel_id}/certificates/{certificate_id}/archive`

312**POST** `/v1/organizations/tunnels/{tunnel_id}/certificates/{certificate_id}/archive`

294313

314**Deprecated**

315

295316**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.

296317

297318Archive a certificate, removing it from the set Anthropic trusts for this tunnel.

from line 321

300321certificate is permitted; the tunnel rejects MCP traffic until a new

301322certificate is added.

302323

303### Path Parameters

324### Path parameters

304325

305326- `tunnel_id: string`

306327

from line 331

310331

311332 ID of the Tunnel Certificate.

312333

313### Header Parameters

334### Headers

314335

315336- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`

316337

317338 Required for all Tunnel endpoints.

318339

319 - `"mcp-tunnels-2026-05-19"`

320

321340### Returns

322341

323342- `id: string`

from line 348

329348 RFC 3339 datetime string indicating when the certificate was archived, or

330349 `null` if it is not archived.

331350

351 format: date-time

352

332353- `created_at: string`

333354

334355 RFC 3339 datetime string indicating when the certificate was registered.

335356

357 format: date-time

358

336359- `expires_at: string or null`

337360

338361 RFC 3339 datetime string indicating when the certificate expires, or

339362 `null` if it does not expire.

340363

364 format: date-time

365

341366- `fingerprint: string`

342367

343368 The certificate's SHA-256 fingerprint, as a lowercase hex string.

from line 375

350375

351376 Object type. Always `tunnel_certificate` for Tunnel Certificates.

352377

353 - `"tunnel_certificate"`

378 default: tunnel_certificate

354379

355380### Example

356381

357```http

382```bash

358383curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID/archive \

359384 -X POST \

360385 -H 'anthropic-version: 2023-06-01' \

from line 386

361386 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

362387```

363388

364#### Response

389#### Response (200)

365390

366391```json

367392{

from line 400

375400}

376401```

377402

378## Domain Types

403## Domain types

379404

380405### Tunnel Certificate Create Response

381406

382- `TunnelCertificateCreateResponse object { id, archived_at, created_at, 4 more }`

407- `TunnelCertificateCreateResponse object`

383408

384409 - `id: string`

385410

from line 415

390415 RFC 3339 datetime string indicating when the certificate was archived, or

391416 `null` if it is not archived.

392417

418 format: date-time

419

393420 - `created_at: string`

394421

395422 RFC 3339 datetime string indicating when the certificate was registered.

396423

424 format: date-time

425

397426 - `expires_at: string or null`

398427

399428 RFC 3339 datetime string indicating when the certificate expires, or

400429 `null` if it does not expire.

401430

431 format: date-time

432

402433 - `fingerprint: string`

403434

404435 The certificate's SHA-256 fingerprint, as a lowercase hex string.

from line 442

411442

412443 Object type. Always `tunnel_certificate` for Tunnel Certificates.

413444

414 - `"tunnel_certificate"`

445 default: tunnel_certificate

415446

416447### Tunnel Certificate Retrieve Response

417448

418- `TunnelCertificateRetrieveResponse object { id, archived_at, created_at, 4 more }`

449- `TunnelCertificateRetrieveResponse object`

419450

420451 - `id: string`

421452

from line 457

426457 RFC 3339 datetime string indicating when the certificate was archived, or

427458 `null` if it is not archived.

428459

460 format: date-time

461

429462 - `created_at: string`

430463

431464 RFC 3339 datetime string indicating when the certificate was registered.

432465

466 format: date-time

467

433468 - `expires_at: string or null`

434469

435470 RFC 3339 datetime string indicating when the certificate expires, or

436471 `null` if it does not expire.

437472

473 format: date-time

474

438475 - `fingerprint: string`

439476

440477 The certificate's SHA-256 fingerprint, as a lowercase hex string.

from line 484

447484

448485 Object type. Always `tunnel_certificate` for Tunnel Certificates.

449486

450 - `"tunnel_certificate"`

487 default: tunnel_certificate

451488

452489### Tunnel Certificate List Response

453490

454- `TunnelCertificateListResponse object { id, archived_at, created_at, 4 more }`

491- `TunnelCertificateListResponse object`

455492

456493 - `id: string`

457494

from line 499

462499 RFC 3339 datetime string indicating when the certificate was archived, or

463500 `null` if it is not archived.

464501

502 format: date-time

503

465504 - `created_at: string`

466505

467506 RFC 3339 datetime string indicating when the certificate was registered.

468507

508 format: date-time

509

469510 - `expires_at: string or null`

470511

471512 RFC 3339 datetime string indicating when the certificate expires, or

472513 `null` if it does not expire.

473514

515 format: date-time

516

474517 - `fingerprint: string`

475518

476519 The certificate's SHA-256 fingerprint, as a lowercase hex string.

from line 526

483526

484527 Object type. Always `tunnel_certificate` for Tunnel Certificates.

485528

486 - `"tunnel_certificate"`

529 default: tunnel_certificate

487530

488531### Tunnel Certificate Archive Response

489532

490- `TunnelCertificateArchiveResponse object { id, archived_at, created_at, 4 more }`

533- `TunnelCertificateArchiveResponse object`

491534

492535 - `id: string`

493536

from line 541

498541 RFC 3339 datetime string indicating when the certificate was archived, or

499542 `null` if it is not archived.

500543

544 format: date-time

545

501546 - `created_at: string`

502547

503548 RFC 3339 datetime string indicating when the certificate was registered.

504549

550 format: date-time

551

505552 - `expires_at: string or null`

506553

507554 RFC 3339 datetime string indicating when the certificate expires, or

508555 `null` if it does not expire.

509556

557 format: date-time

558

510559 - `fingerprint: string`

511560

512561 The certificate's SHA-256 fingerprint, as a lowercase hex string.

from line 568

519568

520569 Object type. Always `tunnel_certificate` for Tunnel Certificates.

521570

522 - `"tunnel_certificate"`

571 default: tunnel_certificate

523572

api/admin/mcp_tunnels/tunnel_certificates/archive Changed · +16 / -15 lines

# Archive Tunnel Certificate ## Path parameters ## Headers ## Returns ## Example ### Response (200) ## Archive Tunnel Certificate ### Path Parameters ### Header Parameters ### Returns ### Example #### Response

from line 1

1---

2title: Archive Tunnel Certificate

3url: https://platform.claude.com/docs/en/api/admin/mcp_tunnels/tunnel_certificates/archive

4---

1# Archive Tunnel Certificate

52

6## Archive Tunnel Certificate

3**POST** `/v1/organizations/tunnels/{tunnel_id}/certificates/{certificate_id}/archive`

74

8**post** `/v1/organizations/tunnels/{tunnel_id}/certificates/{certificate_id}/archive`

5**Deprecated**

96

107**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.

118

from line 12

1512certificate is permitted; the tunnel rejects MCP traffic until a new

1613certificate is added.

1714

18### Path Parameters

15## Path parameters

1916

2017- `tunnel_id: string`

2118

from line 22

2522

2623 ID of the Tunnel Certificate.

2724

28### Header Parameters

25## Headers

2926

3027- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`

3128

3229 Required for all Tunnel endpoints.

3330

34 - `"mcp-tunnels-2026-05-19"`

31## Returns

3532

36### Returns

37

3833- `id: string`

3934

4035 ID of the Tunnel Certificate.

from line 39

4439 RFC 3339 datetime string indicating when the certificate was archived, or

4540 `null` if it is not archived.

4641

42 format: date-time

43

4744- `created_at: string`

4845

4946 RFC 3339 datetime string indicating when the certificate was registered.

5047

48 format: date-time

49

5150- `expires_at: string or null`

5251

5352 RFC 3339 datetime string indicating when the certificate expires, or

5453 `null` if it does not expire.

5554

55 format: date-time

56

5657- `fingerprint: string`

5758

5859 The certificate's SHA-256 fingerprint, as a lowercase hex string.

from line 66

6566

6667 Object type. Always `tunnel_certificate` for Tunnel Certificates.

6768

68 - `"tunnel_certificate"`

69 default: tunnel_certificate

6970

70### Example

71## Example

7172

72```http

73```bash

7374curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID/archive \

7475 -X POST \

7576 -H 'anthropic-version: 2023-06-01' \

from line 77

7677 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

7778```

7879

79#### Response

80### Response (200)

8081

8182```json

8283{

api/admin/mcp_tunnels/tunnel_certificates/create Changed · +19 / -16 lines

# Create Tunnel Certificate ## Path parameters ## Headers ## Body parameters ## Returns ## Example ### Response (200) ## Create Tunnel Certificate ### Path Parameters ### Header Parameters ### Body Parameters ### Returns ### Example #### Response

from line 1

1---

2title: Create Tunnel Certificate

3url: https://platform.claude.com/docs/en/api/admin/mcp_tunnels/tunnel_certificates/create

4---

1# Create Tunnel Certificate

52

6## Create Tunnel Certificate

3**POST** `/v1/organizations/tunnels/{tunnel_id}/certificates`

74

8**post** `/v1/organizations/tunnels/{tunnel_id}/certificates`

5**Deprecated**

96

107**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.

118

from line 13

1613exactly one X.509 certificate and no private-key material. A tunnel

1714holds at most two non-archived certificates.

1815

19### Path Parameters

16## Path parameters

2017

2118- `tunnel_id: string`

2219

2320 ID of the Tunnel.

2421

25### Header Parameters

22## Headers

2623

2724- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`

2825

2926 Required for all Tunnel endpoints.

3027

31 - `"mcp-tunnels-2026-05-19"`

28## Body parameters

3229

33### Body Parameters

34

3530- `ca_certificate_pem: string`

3631

3732 PEM-encoded X.509 CA certificate. Must contain exactly one certificate and

3833 no private-key material.

3934

40### Returns

35 maxLength: 8192

4136

37## Returns

38

4239- `id: string`

4340

4441 ID of the Tunnel Certificate.

from line 45

4845 RFC 3339 datetime string indicating when the certificate was archived, or

4946 `null` if it is not archived.

5047

48 format: date-time

49

5150- `created_at: string`

5251

5352 RFC 3339 datetime string indicating when the certificate was registered.

5453

54 format: date-time

55

5556- `expires_at: string or null`

5657

5758 RFC 3339 datetime string indicating when the certificate expires, or

5859 `null` if it does not expire.

5960

61 format: date-time

62

6063- `fingerprint: string`

6164

6265 The certificate's SHA-256 fingerprint, as a lowercase hex string.

from line 72

6972

7073 Object type. Always `tunnel_certificate` for Tunnel Certificates.

7174

72 - `"tunnel_certificate"`

75 default: tunnel_certificate

7376

74### Example

77## Example

7578

76```http

79```bash

7780curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \

7881 -H 'Content-Type: application/json' \

7982 -H 'anthropic-version: 2023-06-01' \

from line 86

8386 }'

8487```

8588

86#### Response

89### Response (200)

8790

8891```json

8992{

api/admin/mcp_tunnels/tunnel_certificates/list Changed · +22 / -17 lines

# List Tunnel Certificates ## Path parameters ## Query parameters ## Headers ## Returns ## Example ### Response (200) ## List Tunnel Certificates ### Path Parameters ### Query Parameters ### Header Parameters ### Returns ### Example #### Response

from line 1

1---

2title: List Tunnel Certificates

3url: https://platform.claude.com/docs/en/api/admin/mcp_tunnels/tunnel_certificates/list

4---

1# List Tunnel Certificates

52

6## List Tunnel Certificates

3**GET** `/v1/organizations/tunnels/{tunnel_id}/certificates`

74

8**get** `/v1/organizations/tunnels/{tunnel_id}/certificates`

5**Deprecated**

96

107**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.

118

from line 10

1310

1411Archived certificates are excluded unless `include_archived` is set.

1512

16### Path Parameters

13## Path parameters

1714

1815- `tunnel_id: string`

1916

2017 ID of the Tunnel.

2118

22### Query Parameters

19## Query parameters

2320

2421- `include_archived: optional boolean`

2522

from line 23

2623 Include archived certificates in the results. Archived certificates are

2724 excluded by default.

2825

26 default: false

27

2928- `limit: optional number`

3029

3130 Maximum number of certificates to return.

3231

32 default: 20, maximum: 1000, minimum: 1

33

3334- `page: optional string`

3435

3536 A tunnel has at most two active certificates, so this list is not

3637 paginated.

3738

38### Header Parameters

39## Headers

3940

4041- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`

4142

4243 Required for all Tunnel endpoints.

4344

44 - `"mcp-tunnels-2026-05-19"`

45## Returns

4546

46### Returns

47- `data: array of object`

4748

48- `data: array of object { id, archived_at, created_at, 4 more }`

49

5049 - `id: string`

5150

5251 ID of the Tunnel Certificate.

from line 55

5655 RFC 3339 datetime string indicating when the certificate was archived, or

5756 `null` if it is not archived.

5857

58 format: date-time

59

5960 - `created_at: string`

6061

6162 RFC 3339 datetime string indicating when the certificate was registered.

6263

64 format: date-time

65

6366 - `expires_at: string or null`

6467

6568 RFC 3339 datetime string indicating when the certificate expires, or

6669 `null` if it does not expire.

6770

71 format: date-time

72

6873 - `fingerprint: string`

6974

7075 The certificate's SHA-256 fingerprint, as a lowercase hex string.

from line 82

7782

7883 Object type. Always `tunnel_certificate` for Tunnel Certificates.

7984

80 - `"tunnel_certificate"`

85 default: tunnel_certificate

8186

8287- `next_page: string or null`

8388

8489 Opaque cursor for the next page, or `null` if there are no more results.

8590

86### Example

91## Example

8792

88```http

93```bash

8994curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \

9095 -H 'anthropic-version: 2023-06-01' \

9196 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

9297```

9398

94#### Response

99### Response (200)

95100

96101```json

97102{

api/admin/mcp_tunnels/tunnel_certificates/retrieve Changed · +16 / -15 lines

# Get Tunnel Certificate ## Path parameters ## Headers ## Returns ## Example ### Response (200) ## Get Tunnel Certificate ### Path Parameters ### Header Parameters ### Returns ### Example #### Response

from line 1

1---

2title: Get Tunnel Certificate

3url: https://platform.claude.com/docs/en/api/admin/mcp_tunnels/tunnel_certificates/retrieve

4---

1# Get Tunnel Certificate

52

6## Get Tunnel Certificate

3**GET** `/v1/organizations/tunnels/{tunnel_id}/certificates/{certificate_id}`

74

8**get** `/v1/organizations/tunnels/{tunnel_id}/certificates/{certificate_id}`

5**Deprecated**

96

107**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.

118

129Retrieve a single certificate registered on a tunnel by ID.

1310

14### Path Parameters

11## Path parameters

1512

1613- `tunnel_id: string`

1714

from line 18

2118

2219 ID of the Tunnel Certificate.

2320

24### Header Parameters

21## Headers

2522

2623- `"anthropic-beta": array of "mcp-tunnels-2026-05-19"`

2724

2825 Required for all Tunnel endpoints.

2926

30 - `"mcp-tunnels-2026-05-19"`

27## Returns

3128

32### Returns

33

3429- `id: string`

3530

3631 ID of the Tunnel Certificate.

from line 35

4035 RFC 3339 datetime string indicating when the certificate was archived, or

4136 `null` if it is not archived.

4237

38 format: date-time

39

4340- `created_at: string`

4441

4542 RFC 3339 datetime string indicating when the certificate was registered.

4643

44 format: date-time

45

4746- `expires_at: string or null`

4847

4948 RFC 3339 datetime string indicating when the certificate expires, or

5049 `null` if it does not expire.

5150

51 format: date-time

52

5253- `fingerprint: string`

5354

5455 The certificate's SHA-256 fingerprint, as a lowercase hex string.

from line 62

6162

6263 Object type. Always `tunnel_certificate` for Tunnel Certificates.

6364

64 - `"tunnel_certificate"`

65 default: tunnel_certificate

6566

66### Example

67## Example

6768

68```http

69```bash

6970curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID \

7071 -H 'anthropic-version: 2023-06-01' \

7172 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

7273```

7374

74#### Response

75### Response (200)

7576

7677```json

7778{

api/admin/organizations Changed · +12 / -13 lines

#### Response (200) ## Domain types #### Response ## Domain Types

from line 1

1---

2title: Organizations

3url: https://platform.claude.com/docs/en/api/admin/organizations

4---

5

61# Organizations

72

83## Get Current Organization

94

10**get** `/v1/organizations/me`

5**GET** `/v1/organizations/me`

116

127Retrieve information about the organization associated with the authenticated API key.

138

149### Returns

1510

16- `Organization object { id, name, type }`

11- `Organization object`

1712

1813 - `id: string`

1914

2015 ID of the Organization.

2116

17 format: uuid

18

2219 - `name: string`

2320

2421 Name of the Organization.

from line 26

2926

3027 For Organizations, this is always `"organization"`.

3128

32 - `"organization"`

29 default: organization

3330

3431### Example

3532

36```http

33```bash

3734curl https://api.anthropic.com/v1/organizations/me \

3835 -H 'anthropic-version: 2023-06-01' \

3936 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

4037```

4138

42#### Response

39#### Response (200)

4340

4441```json

4542{

from line 46

4946}

5047```

5148

52## Domain Types

49## Domain types

5350

5451### Organization

5552

56- `Organization object { id, name, type }`

53- `Organization object`

5754

5855 - `id: string`

5956

6057 ID of the Organization.

6158

59 format: uuid

60

6261 - `name: string`

6362

6463 Name of the Organization.

from line 68

6968

7069 For Organizations, this is always `"organization"`.

7170

72 - `"organization"`

71 default: organization

7372

api/admin/organizations/me Changed · +10 / -13 lines

# Get Current Organization ## Returns ## Example ### Response (200) ## Get Current Organization ### Returns ### Example #### Response

from line 1

1---

2title: Get Current Organization

3url: https://platform.claude.com/docs/en/api/admin/organizations/me

4---

1# Get Current Organization

52

6## Get Current Organization

3**GET** `/v1/organizations/me`

74

8**get** `/v1/organizations/me`

9

105Retrieve information about the organization associated with the authenticated API key.

116

12### Returns

7## Returns

138

14- `Organization object { id, name, type }`

9- `Organization object`

1510

1611 - `id: string`

1712

1813 ID of the Organization.

1914

15 format: uuid

16

2017 - `name: string`

2118

2219 Name of the Organization.

from line 24

2724

2825 For Organizations, this is always `"organization"`.

2926

30 - `"organization"`

27 default: organization

3128

32### Example

29## Example

3330

34```http

31```bash

3532curl https://api.anthropic.com/v1/organizations/me \

3633 -H 'anthropic-version: 2023-06-01' \

3734 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

3835```

3936

40#### Response

37### Response (200)

4138

4239```json

4340{

api/admin/rate_limits Changed · +12 / -17 lines

### Query parameters #### Response (200) ## Domain types ### Query Parameters #### Response ## Domain Types

from line 1

1---

2title: Rate Limits

3url: https://platform.claude.com/docs/en/api/admin/rate_limits

4---

5

61# Rate Limits

72

83## List Organization Rate Limits

94

10**get** `/v1/organizations/rate_limits`

5**GET** `/v1/organizations/rate_limits`

116

127List Messages API rate limits for your organization.

138

from line 10

1510or an API-surface category such as the Files API or Message Batches)

1611and contains the set of limiter values that apply to it.

1712

18### Query Parameters

13### Query parameters

1914

2015- `group_type: optional "batch" or "files" or "model_group" or 3 more`

2116

from line 38

4338

4439### Returns

4540

46- `data: array of object { id, group_type, limits, 2 more }`

41- `data: array of object`

4742

4843 Rate-limit entries for the organization, one per group.

4944

from line 62

6762

6863 - `"web_search"`

6964

70 - `limits: array of object { type, value }`

65 - `limits: array of object`

7166

7267 The limiter values that apply to this group.

7368

from line 82

8782

8883 Object type. Always `rate_limit` for organization rate-limit entries.

8984

90 - `"rate_limit"`

85 default: rate_limit

9186

9287- `next_page: string or null`

9388

from line 90

9590

9691### Example

9792

98```http

93```bash

9994curl https://api.anthropic.com/v1/organizations/rate_limits \

10095 -H 'anthropic-version: 2023-06-01' \

10196 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

10297```

10398

104#### Response

99#### Response (200)

105100

106101```json

107102{

from line 120

125120}

126121```

127122

128## Domain Types

123## Domain types

129124

130125### Rate Limit List Response

131126

132- `RateLimitListResponse object { data, next_page }`

127- `RateLimitListResponse object`

133128

134 - `data: array of object { id, group_type, limits, 2 more }`

129 - `data: array of object`

135130

136131 Rate-limit entries for the organization, one per group.

137132

from line 150

155150

156151 - `"web_search"`

157152

158 - `limits: array of object { type, value }`

153 - `limits: array of object`

159154

160155 The limiter values that apply to this group.

161156

from line 170

175170

176171 Object type. Always `rate_limit` for organization rate-limit entries.

177172

178 - `"rate_limit"`

173 default: rate_limit

179174

180175 - `next_page: string or null`

181176

api/admin/rate_limits/list Changed · +10 / -15 lines

# List Organization Rate Limits ## Query parameters ## Returns ## Example ### Response (200) ## List Organization Rate Limits ### Query Parameters ### Returns ### Example #### Response

from line 1

1---

2title: List Organization Rate Limits

3url: https://platform.claude.com/docs/en/api/admin/rate_limits/list

4---

1# List Organization Rate Limits

52

6## List Organization Rate Limits

3**GET** `/v1/organizations/rate_limits`

74

8**get** `/v1/organizations/rate_limits`

9

105List Messages API rate limits for your organization.

116

127Each entry corresponds to one rate-limit group (either a model family

from line 8

138or an API-surface category such as the Files API or Message Batches)

149and contains the set of limiter values that apply to it.

1510

16### Query Parameters

11## Query parameters

1712

1813- `group_type: optional "batch" or "files" or "model_group" or 3 more`

1914

from line 34

3934

4035 Opaque cursor from a previous response's `next_page`.

4136

42### Returns

37## Returns

4338

44- `data: array of object { id, group_type, limits, 2 more }`

39- `data: array of object`

4540

4641 Rate-limit entries for the organization, one per group.

4742

from line 60

6560

6661 - `"web_search"`

6762

68 - `limits: array of object { type, value }`

63 - `limits: array of object`

6964

7065 The limiter values that apply to this group.

7166

from line 80

8580

8681 Object type. Always `rate_limit` for organization rate-limit entries.

8782

88 - `"rate_limit"`

83 default: rate_limit

8984

9085- `next_page: string or null`

9186

9287 Token to provide in as `page` in the subsequent request to retrieve the next page of data.

9388

94### Example

89## Example

9590

96```http

91```bash

9792curl https://api.anthropic.com/v1/organizations/rate_limits \

9893 -H 'anthropic-version: 2023-06-01' \

9994 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

10095```

10196

102#### Response

97### Response (200)

10398

10499```json

105100{

api/admin/rbac_groups Changed · +114 / -135 lines

### Query parameters ### Headers #### Response (200) ### Path parameters ### Headers #### Response (200) ### Headers ### Body parameters #### Response (200) ### Path parameters ### Headers ### Body parameters #### Response (200) ### Path parameters ### Headers #### Response (200) ## Domain types ## RBAC Groups › Members ### List RBAC Group Members #### Path parameters #### Query parameters #### Headers #### Returns #### Example ##### Response (200) ### Add RBAC Group Member #### Path parameters #### Headers #### Body parameters #### Returns #### Example ##### Response (200) ### Remove RBAC Group Member #### Path parameters #### Headers #### Returns #### Example ##### Response (200) ### Query Parameters ### Header Parameters #### Response ### Path Parameters ### Header Parameters #### Response ### Header Parameters ### Body Parameters #### Response ### Path Parameters ### Header Parameters ### Body Parameters #### Response ### Path Parameters ### Header Parameters #### Response ## Domain Types # Members ## List RBAC Group Members ### Path Parameters ### Query Parameters ### Header Parameters #### Response ## Add RBAC Group Member ### Path Parameters ### Header Parameters ### Body Parameters #### Response ## Remove RBAC Group Member ### Path Parameters ### Header Parameters #### Response ## Domain Types ### Rbac Group Member ### Rbac Group Member Deleted

from line 1

1---

2title: RBAC Groups

3url: https://platform.claude.com/docs/en/api/admin/rbac_groups

4---

5

61# RBAC Groups

72

83## List RBAC Groups

94

10**get** `/v1/organizations/rbac_groups`

5**GET** `/v1/organizations/rbac_groups`

116

127List RBAC Groups in the Claude Enterprise tenant.

138

149The RBAC Groups API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.

1510

16### Query Parameters

11### Query parameters

1712

1813- `limit: optional number`

1914

from line 16

2116

2217 Defaults to `20`. Ranges from `1` to `1000`.

2318

19 default: 20, maximum: 1000, minimum: 1

20

2421- `page: optional string`

2522

2623 Optionally set to the `next_page` token from the previous response.

2724

28### Header Parameters

25### Headers

2926

3027- `"anthropic-beta": optional array of string`

3128

from line 42

4542

4643 RFC 3339 timestamp of when the RBAC Group was created.

4744

45 format: date-time

46

4847 - `name: string`

4948

5049 Name of the RBAC Group. Not uniqueness-enforced.

from line 66

6766

6867 For RBAC Groups, this is always `"rbac_group"`.

6968

70 - `"rbac_group"`

69 default: rbac_group

7170

7271 - `updated_at: string`

7372

7473 RFC 3339 timestamp of when the RBAC Group was last updated.

7574

75 format: date-time

76

7677- `has_more: boolean`

7778

7879 Indicates if there are more results in the requested page direction.

from line 84

8384

8485### Example

8586

86```http

87```bash

8788curl https://api.anthropic.com/v1/organizations/rbac_groups \

8889 -H 'anthropic-version: 2023-06-01' \

8990 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

9091```

9192

92#### Response

93#### Response (200)

9394

9495```json

9596{

from line 114

113114

114115## Get RBAC Group

115116

116**get** `/v1/organizations/rbac_groups/{group_id}`

117**GET** `/v1/organizations/rbac_groups/{group_id}`

117118

118119Retrieve an RBAC Group by ID.

119120

120121The RBAC Groups API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.

121122

122### Path Parameters

123### Path parameters

123124

124125- `group_id: string`

125126

126127 ID of the RBAC Group.

127128

128### Header Parameters

129### Headers

129130

130131- `"anthropic-beta": optional array of string`

131132

from line 136

135136

136137### Returns

137138

138- `RbacGroup object { id, created_at, name, 4 more }`

139- `RbacGroup object`

139140

140141 - `id: string`

141142

from line 146

145146

146147 RFC 3339 timestamp of when the RBAC Group was created.

147148

149 format: date-time

150

148151 - `name: string`

149152

150153 Name of the RBAC Group. Not uniqueness-enforced.

from line 170

167170

168171 For RBAC Groups, this is always `"rbac_group"`.

169172

170 - `"rbac_group"`

173 default: rbac_group

171174

172175 - `updated_at: string`

173176

174177 RFC 3339 timestamp of when the RBAC Group was last updated.

175178

179 format: date-time

180

176181### Example

177182

178```http

183```bash

179184curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID \

180185 -H 'anthropic-version: 2023-06-01' \

181186 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

182187```

183188

184#### Response

189#### Response (200)

185190

186191```json

187192{

from line 204

199204

200205## Create RBAC Group

201206

202**post** `/v1/organizations/rbac_groups`

207**POST** `/v1/organizations/rbac_groups`

203208

204209Create an RBAC Group in the Claude Enterprise tenant. Groups created via the API have source type `"direct"`.

205210

206211The RBAC Groups API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.

207212

208### Header Parameters

213### Headers

209214

210215- `"anthropic-beta": optional array of string`

211216

from line 218

213218

214219 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.

215220

216### Body Parameters

221### Body parameters

217222

218223- `name: string`

219224

220225 Name of the RBAC Group. Not uniqueness-enforced.

221226

227 maxLength: 255, minLength: 1

228

222229### Returns

223230

224- `RbacGroup object { id, created_at, name, 4 more }`

231- `RbacGroup object`

225232

226233 - `id: string`

227234

from line 238

231238

232239 RFC 3339 timestamp of when the RBAC Group was created.

233240

241 format: date-time

242

234243 - `name: string`

235244

236245 Name of the RBAC Group. Not uniqueness-enforced.

from line 262

253262

254263 For RBAC Groups, this is always `"rbac_group"`.

255264

256 - `"rbac_group"`

265 default: rbac_group

257266

258267 - `updated_at: string`

259268

260269 RFC 3339 timestamp of when the RBAC Group was last updated.

261270

271 format: date-time

272

262273### Example

263274

264```http

275```bash

265276curl https://api.anthropic.com/v1/organizations/rbac_groups \

266277 -H 'Content-Type: application/json' \

267278 -H 'anthropic-version: 2023-06-01' \

from line 282

271282 }'

272283```

273284

274#### Response

285#### Response (200)

275286

276287```json

277288{

from line 300

289300

290301## Update RBAC Group

291302

292**post** `/v1/organizations/rbac_groups/{group_id}`

303**POST** `/v1/organizations/rbac_groups/{group_id}`

293304

294305Update an RBAC Group's name. Groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API.

295306

296307The RBAC Groups API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.

297308

298### Path Parameters

309### Path parameters

299310

300311- `group_id: string`

301312

302313 ID of the RBAC Group.

303314

304### Header Parameters

315### Headers

305316

306317- `"anthropic-beta": optional array of string`

307318

from line 320

309320

310321 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.

311322

312### Body Parameters

323### Body parameters

313324

314325- `name: optional string or null`

315326

316327 Name of the RBAC Group. Not uniqueness-enforced.

317328

329 maxLength: 255, minLength: 1

330

318331### Returns

319332

320- `RbacGroup object { id, created_at, name, 4 more }`

333- `RbacGroup object`

321334

322335 - `id: string`

323336

from line 340

327340

328341 RFC 3339 timestamp of when the RBAC Group was created.

329342

343 format: date-time

344

330345 - `name: string`

331346

332347 Name of the RBAC Group. Not uniqueness-enforced.

from line 364

349364

350365 For RBAC Groups, this is always `"rbac_group"`.

351366

352 - `"rbac_group"`

367 default: rbac_group

353368

354369 - `updated_at: string`

355370

356371 RFC 3339 timestamp of when the RBAC Group was last updated.

357372

373 format: date-time

374

358375### Example

359376

360```http

377```bash

361378curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID \

362379 -H 'Content-Type: application/json' \

363380 -H 'anthropic-version: 2023-06-01' \

from line 384

367384 }'

368385```

369386

370#### Response

387#### Response (200)

371388

372389```json

373390{

from line 402

385402

386403## Delete RBAC Group

387404

388**delete** `/v1/organizations/rbac_groups/{group_id}`

405**DELETE** `/v1/organizations/rbac_groups/{group_id}`

389406

390407Delete an RBAC Group. Groups provisioned by an identity provider (source type `"scim"`) cannot be deleted via the API.

391408

392409The RBAC Groups API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.

393410

394### Path Parameters

411### Path parameters

395412

396413- `group_id: string`

397414

398415 ID of the RBAC Group.

399416

400### Header Parameters

417### Headers

401418

402419- `"anthropic-beta": optional array of string`

403420

from line 424

407424

408425### Returns

409426

410- `RbacGroupDeleted object { id, type }`

427- `RbacGroupDeleted object`

411428

412429 - `id: string`

413430

from line 436

419436

420437 For RBAC Groups, this is always `"rbac_group_deleted"`.

421438

422 - `"rbac_group_deleted"`

439 default: rbac_group_deleted

423440

424441### Example

425442

426```http

443```bash

427444curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID \

428445 -X DELETE \

429446 -H 'anthropic-version: 2023-06-01' \

from line 447

430447 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

431448```

432449

433#### Response

450#### Response (200)

434451

435452```json

436453{

from line 456

439456}

440457```

441458

442## Domain Types

459## Domain types

443460

444461### Rbac Group

445462

446- `RbacGroup object { id, created_at, name, 4 more }`

463- `RbacGroup object`

447464

448465 - `id: string`

449466

from line 470

453470

454471 RFC 3339 timestamp of when the RBAC Group was created.

455472

473 format: date-time

474

456475 - `name: string`

457476

458477 Name of the RBAC Group. Not uniqueness-enforced.

from line 494

475494

476495 For RBAC Groups, this is always `"rbac_group"`.

477496

478 - `"rbac_group"`

497 default: rbac_group

479498

480499 - `updated_at: string`

481500

482501 RFC 3339 timestamp of when the RBAC Group was last updated.

483502

503 format: date-time

504

484505### Rbac Group Deleted

485506

486- `RbacGroupDeleted object { id, type }`

507- `RbacGroupDeleted object`

487508

488509 - `id: string`

489510

from line 516

495516

496517 For RBAC Groups, this is always `"rbac_group_deleted"`.

497518

498 - `"rbac_group_deleted"`

519 default: rbac_group_deleted

499520

500# Members

521## RBAC Groups › Members

501522

502## List RBAC Group Members

523### List RBAC Group Members

503524

504**get** `/v1/organizations/rbac_groups/{group_id}/members`

525**GET** `/v1/organizations/rbac_groups/{group_id}/members`

505526

506527List members of an RBAC Group.

507528

508529The RBAC Groups API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.

509530

510### Path Parameters

531#### Path parameters

511532

512533- `group_id: string`

513534

514535 ID of the RBAC Group.

515536

516### Query Parameters

537#### Query parameters

517538

518539- `limit: optional number`

519540

from line 542

521542

522543 Defaults to `20`. Ranges from `1` to `1000`.

523544

545 default: 20, maximum: 1000, minimum: 1

546

524547- `page: optional string`

525548

526549 Optionally set to the `next_page` token from the previous response.

527550

528### Header Parameters

551#### Headers

529552

530553- `"anthropic-beta": optional array of string`

531554

from line 556

533556

534557 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.

535558

536### Returns

559#### Returns

537560

538561- `data: array of RbacGroupMember`

539562

from line 564

541564

542565 RFC 3339 timestamp of when the User was added to the RBAC Group.

543566

567 format: date-time

568

544569 - `email: string`

545570

546571 Email of the User.

from line 580

555580

556581 For RBAC Group Members, this is always `"rbac_group_member"`.

557582

558 - `"rbac_group_member"`

583 default: rbac_group_member

559584

560585 - `user_id: string`

561586

from line 594

569594

570595 Token to provide in as `page` in the subsequent request to retrieve the next page of data.

571596

572### Example

597#### Example

573598

574```http

599```bash

575600curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members \

576601 -H 'anthropic-version: 2023-06-01' \

577602 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

578603```

579604

580#### Response

605##### Response (200)

581606

582607```json

583608{

from line 620

595620}

596621```

597622

598## Add RBAC Group Member

623### Add RBAC Group Member

599624

600**post** `/v1/organizations/rbac_groups/{group_id}/members`

625**POST** `/v1/organizations/rbac_groups/{group_id}/members`

601626

602627Add a User to an RBAC Group. Membership of groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API.

603628

604629The RBAC Groups API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.

605630

606### Path Parameters

631#### Path parameters

607632

608633- `group_id: string`

609634

610635 ID of the RBAC Group.

611636

612### Header Parameters

637#### Headers

613638

614639- `"anthropic-beta": optional array of string`

615640

from line 642

617642

618643 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.

619644

620### Body Parameters

645#### Body parameters

621646

622647- `user_id: string`

623648

624649 ID of the User.

625650

626### Returns

651#### Returns

627652

628- `RbacGroupMember object { created_at, email, group_id, 2 more }`

653- `RbacGroupMember object`

629654

630655 - `created_at: string`

631656

632657 RFC 3339 timestamp of when the User was added to the RBAC Group.

633658

659 format: date-time

660

634661 - `email: string`

635662

636663 Email of the User.

from line 672

645672

646673 For RBAC Group Members, this is always `"rbac_group_member"`.

647674

648 - `"rbac_group_member"`

675 default: rbac_group_member

649676

650677 - `user_id: string`

651678

652679 ID of the User.

653680

654### Example

681#### Example

655682

656```http

683```bash

657684curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members \

658685 -H 'Content-Type: application/json' \

659686 -H 'anthropic-version: 2023-06-01' \

from line 690

663690 }'

664691```

665692

666#### Response

693##### Response (200)

667694

668695```json

669696{

from line 702

675702}

676703```

677704

678## Remove RBAC Group Member

705### Remove RBAC Group Member

679706

680**delete** `/v1/organizations/rbac_groups/{group_id}/members/{user_id}`

707**DELETE** `/v1/organizations/rbac_groups/{group_id}/members/{user_id}`

681708

682709Remove a User from an RBAC Group. Membership of groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API.

683710

684711The RBAC Groups API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.

685712

686### Path Parameters

713#### Path parameters

687714

688715- `group_id: string`

689716

from line 720

693720

694721 ID of the User.

695722

696### Header Parameters

723#### Headers

697724

698725- `"anthropic-beta": optional array of string`

699726

from line 728

701728

702729 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.

703730

704### Returns

731#### Returns

705732

706- `RbacGroupMemberDeleted object { group_id, type, user_id }`

733- `RbacGroupMemberDeleted object`

707734

708735 - `group_id: string`

709736

from line 740

713740

714741 Deleted object type. For RBAC Group Members, this is always `"rbac_group_member_deleted"`.

715742

716 - `"rbac_group_member_deleted"`

743 default: rbac_group_member_deleted

717744

718745 - `user_id: string`

719746

720747 ID of the User.

721748

722### Example

749#### Example

723750

724```http

751```bash

725752curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members/$USER_ID \

726753 -X DELETE \

727754 -H 'anthropic-version: 2023-06-01' \

from line 755

728755 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

729756```

730757

731#### Response

758##### Response (200)

732759

733760```json

734761{

from line 764

737764 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"

738765}

739766```

740

741## Domain Types

742

743### Rbac Group Member

744

745- `RbacGroupMember object { created_at, email, group_id, 2 more }`

746

747 - `created_at: string`

748

749 RFC 3339 timestamp of when the User was added to the RBAC Group.

750

751 - `email: string`

752

753 Email of the User.

754

755 - `group_id: string`

756

757 ID of the RBAC Group.

758

759 - `type: "rbac_group_member"`

760

761 Object type.

762

763 For RBAC Group Members, this is always `"rbac_group_member"`.

764

765 - `"rbac_group_member"`

766

767 - `user_id: string`

768

769 ID of the User.

770

771### Rbac Group Member Deleted

772

773- `RbacGroupMemberDeleted object { group_id, type, user_id }`

774

775 - `group_id: string`

776

777 ID of the RBAC Group.

778

779 - `type: "rbac_group_member_deleted"`

780

781 Deleted object type. For RBAC Group Members, this is always `"rbac_group_member_deleted"`.

782

783 - `"rbac_group_member_deleted"`

784

785 - `user_id: string`

786

787 ID of the User.

788767

api/admin/rbac_groups/create Changed · +16 / -15 lines

# Create RBAC Group ## Headers ## Body parameters ## Returns ## Example ### Response (200) ## Create RBAC Group ### Header Parameters ### Body Parameters ### Returns ### Example #### Response

from line 1

1---

2title: Create RBAC Group

3url: https://platform.claude.com/docs/en/api/admin/rbac_groups/create

4---

1# Create RBAC Group

52

6## Create RBAC Group

3**POST** `/v1/organizations/rbac_groups`

74

8**post** `/v1/organizations/rbac_groups`

9

105Create an RBAC Group in the Claude Enterprise tenant. Groups created via the API have source type `"direct"`.

116

127The RBAC Groups API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.

138

14### Header Parameters

9## Headers

1510

1611- `"anthropic-beta": optional array of string`

1712

from line 14

1914

2015 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.

2116

22### Body Parameters

17## Body parameters

2318

2419- `name: string`

2520

2621 Name of the RBAC Group. Not uniqueness-enforced.

2722

28### Returns

23 maxLength: 255, minLength: 1

2924

30- `RbacGroup object { id, created_at, name, 4 more }`

25## Returns

3126

27- `RbacGroup object`

28

3229 - `id: string`

3330

3431 ID of the RBAC Group.

from line 34

3734

3835 RFC 3339 timestamp of when the RBAC Group was created.

3936

37 format: date-time

38

4039 - `name: string`

4140

4241 Name of the RBAC Group. Not uniqueness-enforced.

from line 58

5958

6059 For RBAC Groups, this is always `"rbac_group"`.

6160

62 - `"rbac_group"`

61 default: rbac_group

6362

6463 - `updated_at: string`

6564

6665 RFC 3339 timestamp of when the RBAC Group was last updated.

6766

68### Example

67 format: date-time

6968

70```http

69## Example

70

71```bash

7172curl https://api.anthropic.com/v1/organizations/rbac_groups \

7273 -H 'Content-Type: application/json' \

7374 -H 'anthropic-version: 2023-06-01' \

from line 78

7778 }'

7879```

7980

80#### Response

81### Response (200)

8182

8283```json

8384{

api/admin/rbac_groups/delete Changed · +10 / -15 lines

# Delete RBAC Group ## Path parameters ## Headers ## Returns ## Example ### Response (200) ## Delete RBAC Group ### Path Parameters ### Header Parameters ### Returns ### Example #### Response

from line 1

1---

2title: Delete RBAC Group

3url: https://platform.claude.com/docs/en/api/admin/rbac_groups/delete

4---

1# Delete RBAC Group

52

6## Delete RBAC Group

3**DELETE** `/v1/organizations/rbac_groups/{group_id}`

74

8**delete** `/v1/organizations/rbac_groups/{group_id}`

9

105Delete an RBAC Group. Groups provisioned by an identity provider (source type `"scim"`) cannot be deleted via the API.

116

127The RBAC Groups API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.

138

14### Path Parameters

9## Path parameters

1510

1611- `group_id: string`

1712

1813 ID of the RBAC Group.

1914

20### Header Parameters

15## Headers

2116

2217- `"anthropic-beta": optional array of string`

2318

from line 20

2520

2621 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.

2722

28### Returns

23## Returns

2924

30- `RbacGroupDeleted object { id, type }`

25- `RbacGroupDeleted object`

3126

3227 - `id: string`

3328

from line 34

3934

4035 For RBAC Groups, this is always `"rbac_group_deleted"`.

4136

42 - `"rbac_group_deleted"`

37 default: rbac_group_deleted

4338

44### Example

39## Example

4540

46```http

41```bash

4742curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID \

4843 -X DELETE \

4944 -H 'anthropic-version: 2023-06-01' \

from line 45

5045 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

5146```

5247

53#### Response

48### Response (200)

5449

5550```json

5651{

api/admin/rbac_groups/list Changed · +15 / -14 lines

# List RBAC Groups ## Query parameters ## Headers ## Returns ## Example ### Response (200) ## List RBAC Groups ### Query Parameters ### Header Parameters ### Returns ### Example #### Response

from line 1

1---

2title: List RBAC Groups

3url: https://platform.claude.com/docs/en/api/admin/rbac_groups/list

4---

1# List RBAC Groups

52

6## List RBAC Groups

3**GET** `/v1/organizations/rbac_groups`

74

8**get** `/v1/organizations/rbac_groups`

9

105List RBAC Groups in the Claude Enterprise tenant.

116

127The RBAC Groups API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.

138

14### Query Parameters

9## Query parameters

1510

1611- `limit: optional number`

1712

from line 14

1914

2015 Defaults to `20`. Ranges from `1` to `1000`.

2116

17 default: 20, maximum: 1000, minimum: 1

18

2219- `page: optional string`

2320

2421 Optionally set to the `next_page` token from the previous response.

2522

26### Header Parameters

23## Headers

2724

2825- `"anthropic-beta": optional array of string`

2926

from line 28

3128

3229 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.

3330

34### Returns

31## Returns

3532

3633- `data: array of RbacGroup`

3734

from line 40

4340

4441 RFC 3339 timestamp of when the RBAC Group was created.

4542

43 format: date-time

44

4645 - `name: string`

4746

4847 Name of the RBAC Group. Not uniqueness-enforced.

from line 64

6564

6665 For RBAC Groups, this is always `"rbac_group"`.

6766

68 - `"rbac_group"`

67 default: rbac_group

6968

7069 - `updated_at: string`

7170

7271 RFC 3339 timestamp of when the RBAC Group was last updated.

7372

73 format: date-time

74

7475- `has_more: boolean`

7576

7677 Indicates if there are more results in the requested page direction.

from line 80

7980

8081 Token to provide in as `page` in the subsequent request to retrieve the next page of data.

8182

82### Example

83## Example

8384

84```http

85```bash

8586curl https://api.anthropic.com/v1/organizations/rbac_groups \

8687 -H 'anthropic-version: 2023-06-01' \

8788 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

8889```

8990

90#### Response

91### Response (200)

9192

9293```json

9394{

api/admin/rbac_groups/members Changed · +39 / -36 lines

### Path parameters ### Query parameters ### Headers #### Response (200) ### Path parameters ### Headers ### Body parameters #### Response (200) ### Path parameters ### Headers #### Response (200) ## Domain types ### Path Parameters ### Query Parameters ### Header Parameters #### Response ### Path Parameters ### Header Parameters ### Body Parameters #### Response ### Path Parameters ### Header Parameters #### Response ## Domain Types

from line 1

1---

2title: Members

3url: https://platform.claude.com/docs/en/api/admin/rbac_groups/members

4---

5

61# Members

72

83## List RBAC Group Members

94

10**get** `/v1/organizations/rbac_groups/{group_id}/members`

5**GET** `/v1/organizations/rbac_groups/{group_id}/members`

116

127List members of an RBAC Group.

138

149The RBAC Groups API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.

1510

16### Path Parameters

11### Path parameters

1712

1813- `group_id: string`

1914

2015 ID of the RBAC Group.

2116

22### Query Parameters

17### Query parameters

2318

2419- `limit: optional number`

2520

from line 22

2722

2823 Defaults to `20`. Ranges from `1` to `1000`.

2924

25 default: 20, maximum: 1000, minimum: 1

26

3027- `page: optional string`

3128

3229 Optionally set to the `next_page` token from the previous response.

3330

34### Header Parameters

31### Headers

3532

3633- `"anthropic-beta": optional array of string`

3734

from line 44

4744

4845 RFC 3339 timestamp of when the User was added to the RBAC Group.

4946

47 format: date-time

48

5049 - `email: string`

5150

5251 Email of the User.

from line 60

6160

6261 For RBAC Group Members, this is always `"rbac_group_member"`.

6362

64 - `"rbac_group_member"`

63 default: rbac_group_member

6564

6665 - `user_id: string`

6766

from line 76

7776

7877### Example

7978

80```http

79```bash

8180curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members \

8281 -H 'anthropic-version: 2023-06-01' \

8382 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

8483```

8584

86#### Response

85#### Response (200)

8786

8887```json

8988{

from line 102

103102

104103## Add RBAC Group Member

105104

106**post** `/v1/organizations/rbac_groups/{group_id}/members`

105**POST** `/v1/organizations/rbac_groups/{group_id}/members`

107106

108107Add a User to an RBAC Group. Membership of groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API.

109108

110109The RBAC Groups API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.

111110

112### Path Parameters

111### Path parameters

113112

114113- `group_id: string`

115114

116115 ID of the RBAC Group.

117116

118### Header Parameters

117### Headers

119118

120119- `"anthropic-beta": optional array of string`

121120

from line 122

123122

124123 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.

125124

126### Body Parameters

125### Body parameters

127126

128127- `user_id: string`

129128

from line 130

131130

132131### Returns

133132

134- `RbacGroupMember object { created_at, email, group_id, 2 more }`

133- `RbacGroupMember object`

135134

136135 - `created_at: string`

137136

138137 RFC 3339 timestamp of when the User was added to the RBAC Group.

139138

139 format: date-time

140

140141 - `email: string`

141142

142143 Email of the User.

from line 152

151152

152153 For RBAC Group Members, this is always `"rbac_group_member"`.

153154

154 - `"rbac_group_member"`

155 default: rbac_group_member

155156

156157 - `user_id: string`

157158

from line 160

159160

160161### Example

161162

162```http

163```bash

163164curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members \

164165 -H 'Content-Type: application/json' \

165166 -H 'anthropic-version: 2023-06-01' \

from line 170

169170 }'

170171```

171172

172#### Response

173#### Response (200)

173174

174175```json

175176{

from line 184

183184

184185## Remove RBAC Group Member

185186

186**delete** `/v1/organizations/rbac_groups/{group_id}/members/{user_id}`

187**DELETE** `/v1/organizations/rbac_groups/{group_id}/members/{user_id}`

187188

188189Remove a User from an RBAC Group. Membership of groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API.

189190

190191The RBAC Groups API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.

191192

192### Path Parameters

193### Path parameters

193194

194195- `group_id: string`

195196

from line 200

199200

200201 ID of the User.

201202

202### Header Parameters

203### Headers

203204

204205- `"anthropic-beta": optional array of string`

205206

from line 210

209210

210211### Returns

211212

212- `RbacGroupMemberDeleted object { group_id, type, user_id }`

213- `RbacGroupMemberDeleted object`

213214

214215 - `group_id: string`

215216

from line 220

219220

220221 Deleted object type. For RBAC Group Members, this is always `"rbac_group_member_deleted"`.

221222

222 - `"rbac_group_member_deleted"`

223 default: rbac_group_member_deleted

223224

224225 - `user_id: string`

225226

from line 228

227228

228229### Example

229230

230```http

231```bash

231232curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members/$USER_ID \

232233 -X DELETE \

233234 -H 'anthropic-version: 2023-06-01' \

from line 235

234235 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

235236```

236237

237#### Response

238#### Response (200)

238239

239240```json

240241{

from line 245

244245}

245246```

246247

247## Domain Types

248## Domain types

248249

249250### Rbac Group Member

250251

251- `RbacGroupMember object { created_at, email, group_id, 2 more }`

252- `RbacGroupMember object`

252253

253254 - `created_at: string`

254255

255256 RFC 3339 timestamp of when the User was added to the RBAC Group.

256257

258 format: date-time

259

257260 - `email: string`

258261

259262 Email of the User.

from line 271

268271

269272 For RBAC Group Members, this is always `"rbac_group_member"`.

270273

271 - `"rbac_group_member"`

274 default: rbac_group_member

272275

273276 - `user_id: string`

274277

from line 279

276279

277280### Rbac Group Member Deleted

278281

279- `RbacGroupMemberDeleted object { group_id, type, user_id }`

282- `RbacGroupMemberDeleted object`

280283

281284 - `group_id: string`

282285

from line 289

286289

287290 Deleted object type. For RBAC Group Members, this is always `"rbac_group_member_deleted"`.

288291

289 - `"rbac_group_member_deleted"`

292 default: rbac_group_member_deleted

290293

291294 - `user_id: string`

292295

One read of Claude Developer Platformapi-20260825T033708Z

What this read moved

api/admin/invites Changed · +59 / -32 lines

api/admin/invites/create Changed · +19 / -14 lines

api/admin/invites/delete Changed · +8 / -13 lines

api/admin/invites/list Changed · +18 / -13 lines

api/admin/invites/retrieve Changed · +15 / -14 lines

api/admin/mcp_tunnels Changed · +174 / -265 lines

api/admin/mcp_tunnels/archive Changed · +14 / -15 lines

api/admin/mcp_tunnels/list Changed · +19 / -16 lines

api/admin/mcp_tunnels/retrieve Changed · +14 / -15 lines

api/admin/mcp_tunnels/reveal_token Changed · +10 / -15 lines

api/admin/mcp_tunnels/rotate_token Changed · +13 / -16 lines

api/admin/mcp_tunnels/tunnel_certificates Changed · +98 / -49 lines

api/admin/mcp_tunnels/tunnel_certificates/archive Changed · +16 / -15 lines

api/admin/mcp_tunnels/tunnel_certificates/create Changed · +19 / -16 lines

api/admin/mcp_tunnels/tunnel_certificates/list Changed · +22 / -17 lines

api/admin/mcp_tunnels/tunnel_certificates/retrieve Changed · +16 / -15 lines

api/admin/organizations Changed · +12 / -13 lines

api/admin/organizations/me Changed · +10 / -13 lines

api/admin/rate_limits Changed · +12 / -17 lines

api/admin/rate_limits/list Changed · +10 / -15 lines

api/admin/rbac_groups Changed · +114 / -135 lines

api/admin/rbac_groups/create Changed · +16 / -15 lines

api/admin/rbac_groups/delete Changed · +10 / -15 lines

api/admin/rbac_groups/list Changed · +15 / -14 lines

api/admin/rbac_groups/members Changed · +39 / -36 lines