One read of Claude Developer Platformapi-20260826T180819Z
239 pages moved out of 688 read.
Pages moved
239
significant first
Pages read
688
in this capture
Captured
18:08 UTC
Corpus hash
c1a577247bc1
corpus-hash
What this read moved
226-239 of 239, page 10 of 10This capture is too large to show at once. Changes 226-239 of 239 are below, significant first; the rest are on the following screens.
manage-claude/cmek-aws-kms Changed · +339 / -30 lines
from line 137
137137 For organizations on [Claude Platform on AWS](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws), the external key endpoints are not yet available. Register and attach your key in the Claude Console instead. There is no separate validation step; the key policy is first exercised when a workspace starts using the key, so a key policy problem surfaces at that point rather than at registration.
138138 </Note>
139139
140 ```bash
141 curl -sS https://api.anthropic.com/v1/organizations/external_keys \
142 -H "x-api-key: <anthropic-admin-api-key>" \
143 -H "anthropic-version: 2023-06-01" \
144 -H "content-type: application/json" \
145 -d '{
146 "display_name": "<friendly-name>",
147 "geo": "us",
148 "provider_config": {
149 "type": "aws",
150 "kms_arn": "<key-arn-from-create-key-step>",
151 "role_arn": "arn:aws:iam::915198916910:role/anthropic-cmek-client-us"
140 <CodeGroup>
141 ```bash cURL
142 curl -sS "https://api.anthropic.com/v1/organizations/external_keys" \
143 -H "x-api-key: $ANTHROPIC_API_KEY" \
144 -H "anthropic-version: 2023-06-01" \
145 -H "content-type: application/json" \
146 -d '{
147 "display_name": "<friendly-name>",
148 "geo": "us",
149 "provider_config": {
150 "type": "aws",
151 "kms_arn": "<key-arn-from-create-key-step>"
152 }
153 }'
154 ```
155
156 ```bash CLI
157 ant beta:organization:external-keys create <<'YAML'
158 display_name: "<friendly-name>"
159 geo: us
160 provider_config:
161 type: aws
162 kms_arn: "<key-arn-from-create-key-step>"
163 YAML
164 ```
165
166 ```python Python
167 client = anthropic.Anthropic()
168
169 external_key = client.beta.organization.external_keys.create(
170 display_name="<friendly-name>",
171 geo="us",
172 provider_config={"type": "aws", "kms_arn": "<key-arn-from-create-key-step>"},
173 )
174
175 print(f"id: {external_key.id}")
176 print(f"display_name: {external_key.display_name}")
177 ```
178
179 ```typescript TypeScript
180 const client = new Anthropic();
181
182 const externalKey = await client.beta.organization.externalKeys.create({
183 display_name: "<friendly-name>",
184 geo: "us",
185 provider_config: {
186 type: "aws",
187 kms_arn: "<key-arn-from-create-key-step>"
152188 }
153 }'
154 ```
189 });
155190
191 console.log(`id: ${externalKey.id}`);
192 console.log(`display_name: ${externalKey.display_name}`);
193 ```
194
195 ```csharp C#
196 using Anthropic.Models.Beta.Organization.ExternalKeys;
197
198 AnthropicClient client = new();
199
200 var externalKey = await client.Beta.Organization.ExternalKeys.Create(new()
201 {
202 DisplayName = "<friendly-name>",
203 Geo = Geo.Us,
204 ProviderConfig = new BetaAwsExternalKeyConfig
205 {
206 KmsArn = "<key-arn-from-create-key-step>"
207 }
208 });
209
210 Console.WriteLine($"id: {externalKey.ID}");
211 Console.WriteLine($"display_name: {externalKey.DisplayName}");
212 ```
213
214 ```go Go
215 client := anthropic.NewClient()
216
217 externalKey, err := client.Beta.Organization.ExternalKeys.New(context.Background(), anthropic.BetaOrganizationExternalKeyNewParams{
218 DisplayName: anthropic.String("<friendly-name>"),
219 Geo: anthropic.BetaOrganizationExternalKeyNewParamsGeoUs,
220 ProviderConfig: anthropic.BetaOrganizationExternalKeyNewParamsProviderConfigUnion{
221 OfAWS: &anthropic.BetaAWSExternalKeyConfigParam{
222 KMSARN: "<key-arn-from-create-key-step>",
223 },
224 },
225 })
226 if err != nil {
227 log.Fatal(err)
228 }
229
230 fmt.Printf("id: %s\n", externalKey.ID)
231 fmt.Printf("display_name: %s\n", externalKey.DisplayName)
232 ```
233
234 ```java Java
235 import com.anthropic.models.beta.organization.externalkeys.BetaAwsExternalKeyConfig;
236 import com.anthropic.models.beta.organization.externalkeys.ExternalKeyCreateParams;
237
238 void main() {
239 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
240
241 var params = ExternalKeyCreateParams.builder()
242 .displayName("<friendly-name>")
243 .geo(ExternalKeyCreateParams.Geo.US)
244 .providerConfig(BetaAwsExternalKeyConfig.builder()
245 .kmsArn("<key-arn-from-create-key-step>")
246 .build())
247 .build();
248 var externalKey = client.beta().organization().externalKeys().create(params);
249
250 IO.println("id: " + externalKey.id());
251 IO.println("display_name: " + externalKey.displayName().orElseThrow());
252 }
253 ```
254
255 ```php PHP
256 use Anthropic\Beta\Organization\ExternalKeys\ExternalKeyCreateParams\Geo;
257 // ...
258
259 $client = new Client();
260
261 $externalKey = $client->beta->organization->externalKeys->create(
262 displayName: '<friendly-name>',
263 geo: Geo::US,
264 providerConfig: [
265 'type' => 'aws',
266 'kmsARN' => '<key-arn-from-create-key-step>',
267 ],
268 );
269
270 echo "id: {$externalKey->id}\n";
271 echo "display_name: {$externalKey->displayName}\n";
272 ```
273
274 ```ruby Ruby
275 client = Anthropic::Client.new
276
277 external_key = client.beta.organization.external_keys.create(
278 display_name: "<friendly-name>",
279 geo: :us,
280 provider_config: {
281 type: :aws,
282 kms_arn: "<key-arn-from-create-key-step>"
283 }
284 )
285
286 puts "id: #{external_key.id}"
287 puts "display_name: #{external_key.display_name}"
288 ```
289 </CodeGroup>
290
156291 The response contains the external key ID:
157292
158293 ```json
from line 302
167302 <Step title="Validate the key">
168303 Trigger an encrypt and decrypt round-trip against your key.
169304
170 ```bash
171 curl -sS -X POST https://api.anthropic.com/v1/organizations/external_keys/ekey_<id>/validate \
172 -H "x-api-key: <anthropic-admin-api-key>" \
173 -H "anthropic-version: 2023-06-01" \
174 -H "content-type: application/json" \
175 -d '{}'
176 ```
305 <CodeGroup>
306 ```bash cURL
307 curl -sS -X POST "https://api.anthropic.com/v1/organizations/external_keys/ekey_<id>/validate" \
308 -H "x-api-key: $ANTHROPIC_API_KEY" \
309 -H "anthropic-version: 2023-06-01"
310 ```
177311
312 ```bash CLI
313 ant beta:organization:external-keys validate --external-key-id "ekey_<id>"
314 ```
315
316 ```python Python
317 client = anthropic.Anthropic()
318
319 validation = client.beta.organization.external_keys.validate("ekey_<id>")
320
321 print(f"status: {validation.status}")
322 print(f"error: {validation.error}")
323 ```
324
325 ```typescript TypeScript
326 const client = new Anthropic();
327
328 const validation = await client.beta.organization.externalKeys.validate("ekey_<id>");
329
330 console.log(`status: ${validation.status}`);
331 console.log(`error: ${validation.error}`);
332 ```
333
334 ```csharp C#
335 AnthropicClient client = new();
336
337 var validation = await client.Beta.Organization.ExternalKeys.Validate("ekey_<id>");
338
339 Console.WriteLine($"status: {validation.Status.Raw()}");
340 Console.WriteLine($"error: {validation.Error}");
341 ```
342
343 ```go Go
344 client := anthropic.NewClient()
345
346 validation, err := client.Beta.Organization.ExternalKeys.Validate(context.Background(), "ekey_<id>")
347 if err != nil {
348 log.Fatal(err)
349 }
350
351 fmt.Printf("status: %s\n", validation.Status)
352 fmt.Printf("error: %s\n", validation.Error)
353 ```
354
355 ```java Java
356 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
357
358 var validation = client.beta().organization().externalKeys().validate("ekey_<id>");
359
360 IO.println("status: " + validation.status().asString());
361 IO.println("error: " + validation.error().orElse(""));
362 ```
363
364 ```php PHP
365 $client = new Client();
366
367 $validation = $client->beta->organization->externalKeys->validate(
368 externalKeyID: 'ekey_<id>',
369 );
370
371 echo "status: {$validation->status}\n";
372 echo "error: {$validation->error}\n";
373 ```
374
375 ```ruby Ruby
376 client = Anthropic::Client.new
377
378 external_key_id = "ekey_<id>"
379 validation = client.beta.organization.external_keys.validate(external_key_id)
380
381 puts "status: #{validation.status}"
382 puts "error: #{validation.error}"
383 ```
384 </CodeGroup>
385
178386 A successful response looks like this:
179387
180388 ```json
from line 400
192400 <Step title="Attach the key to a workspace">
193401 Once the key is validated, attach it to a new workspace before you send any requests to that workspace. For a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).
194402
195 ```bash
196 curl -sS -X POST https://api.anthropic.com/v1/organizations/workspaces/<workspace-id> \
197 -H "x-api-key: <anthropic-admin-api-key>" \
198 -H "anthropic-version: 2023-06-01" \
199 -H "content-type: application/json" \
200 -d '{
201 "external_key_id": "ekey_<id>"
202 }'
203 ```
403 <CodeGroup>
404 ```bash cURL
405 curl -sS -X POST "https://api.anthropic.com/v1/organizations/workspaces/<workspace-id>" \
406 -H "x-api-key: $ANTHROPIC_API_KEY" \
407 -H "anthropic-version: 2023-06-01" \
408 -H "content-type: application/json" \
409 -d '{
410 "external_key_id": "ekey_<id>"
411 }'
412 ```
413
414 ```bash CLI
415 ant beta:organization:workspaces update \
416 --workspace-id "<workspace-id>" \
417 --external-key-id "ekey_<id>"
418 ```
419
420 ```python Python
421 client = anthropic.Anthropic()
422
423 workspace = client.beta.organization.workspaces.update(
424 "<workspace-id>", external_key_id="ekey_<id>"
425 )
426
427 print(f"id: {workspace.id}")
428 print(f"external_key_id: {workspace.external_key_id}")
429 ```
430
431 ```typescript TypeScript
432 const client = new Anthropic();
433
434 const workspace = await client.beta.organization.workspaces.update("<workspace-id>", {
435 external_key_id: "ekey_<id>"
436 });
437
438 console.log(`id: ${workspace.id}`);
439 console.log(`external_key_id: ${workspace.external_key_id}`);
440 ```
441
442 ```csharp C#
443 AnthropicClient client = new();
444
445 var workspace = await client.Beta.Organization.Workspaces.Update("<workspace-id>", new()
446 {
447 ExternalKeyID = "ekey_<id>"
448 });
449
450 Console.WriteLine($"id: {workspace.ID}");
451 Console.WriteLine($"external_key_id: {workspace.ExternalKeyID}");
452 ```
453
454 ```go Go
455 client := anthropic.NewClient()
456
457 workspace, err := client.Beta.Organization.Workspaces.Update(
458 context.Background(),
459 "<workspace-id>",
460 anthropic.BetaOrganizationWorkspaceUpdateParams{
461 ExternalKeyID: anthropic.String("ekey_<id>"),
462 },
463 )
464 if err != nil {
465 log.Fatal(err)
466 }
467
468 fmt.Printf("id: %s\n", workspace.ID)
469 fmt.Printf("external_key_id: %s\n", workspace.ExternalKeyID)
470 ```
471
472 ```java Java
473 import com.anthropic.models.beta.organization.workspaces.WorkspaceUpdateParams;
474
475 void main() {
476 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
477
478 var params = WorkspaceUpdateParams.builder()
479 .externalKeyId("ekey_<id>")
480 .build();
481 var workspace = client.beta().organization().workspaces().update("<workspace-id>", params);
482
483 IO.println("id: " + workspace.id());
484 IO.println("external_key_id: " + workspace.externalKeyId().orElseThrow());
485 }
486 ```
487
488 ```php PHP
489 $client = new Client();
490
491 $workspace = $client->beta->organization->workspaces->update(
492 workspaceID: '<workspace-id>',
493 externalKeyID: 'ekey_<id>',
494 );
495
496 echo "id: {$workspace->id}\n";
497 echo "external_key_id: {$workspace->externalKeyID}\n";
498 ```
499
500 ```ruby Ruby
501 client = Anthropic::Client.new
502
503 workspace_id = "<workspace-id>"
504 workspace = client.beta.organization.workspaces.update(
505 workspace_id,
506 external_key_id: "ekey_<id>"
507 )
508
509 puts "id: #{workspace.id}"
510 puts "external_key_id: #{workspace.external_key_id}"
511 ```
512 </CodeGroup>
204513 </Step>
205514 </Steps>
206515 </Tab>
manage-claude/cmek-azure-key-vault Changed · +358 / -30 lines
from line 147
147147 <Step title="Register the key with Anthropic">
148148 Create an external key configuration through the Admin API.
149149
150 ```bash
151 curl -sS https://api.anthropic.com/v1/organizations/external_keys \
152 -H "x-api-key: <anthropic-admin-api-key>" \
153 -H "anthropic-version: 2023-06-01" \
154 -H "content-type: application/json" \
155 -d '{
156 "display_name": "<friendly-name>",
157 "geo": "us",
158 "provider_config": {
159 "type": "azure",
160 "vault_uri": "https://<your-vault-name>.vault.azure.net/",
161 "key_name": "<your-key-name>",
162 "tenant_id": "<your-tenant-id>"
150 <CodeGroup>
151 ```bash cURL
152 curl -sS "https://api.anthropic.com/v1/organizations/external_keys" \
153 -H "x-api-key: $ANTHROPIC_API_KEY" \
154 -H "anthropic-version: 2023-06-01" \
155 -H "content-type: application/json" \
156 -d '{
157 "display_name": "<friendly-name>",
158 "geo": "us",
159 "provider_config": {
160 "type": "azure",
161 "vault_uri": "https://<your-vault-name>.vault.azure.net/",
162 "key_name": "<your-key-name>",
163 "tenant_id": "<your-tenant-id>"
164 }
165 }'
166 ```
167
168 ```bash CLI
169 ant beta:organization:external-keys create <<'YAML'
170 display_name: "<friendly-name>"
171 geo: us
172 provider_config:
173 type: azure
174 vault_uri: "https://<your-vault-name>.vault.azure.net/"
175 key_name: "<your-key-name>"
176 tenant_id: "<your-tenant-id>"
177 YAML
178 ```
179
180 ```python Python
181 client = anthropic.Anthropic()
182
183 external_key = client.beta.organization.external_keys.create(
184 display_name="<friendly-name>",
185 geo="us",
186 provider_config={
187 "type": "azure",
188 "vault_uri": "https://<your-vault-name>.vault.azure.net/",
189 "key_name": "<your-key-name>",
190 "tenant_id": "<your-tenant-id>",
191 },
192 )
193
194 print(f"id: {external_key.id}")
195 print(f"display_name: {external_key.display_name}")
196 ```
197
198 ```typescript TypeScript
199 const client = new Anthropic();
200
201 const externalKey = await client.beta.organization.externalKeys.create({
202 display_name: "<friendly-name>",
203 geo: "us",
204 provider_config: {
205 type: "azure",
206 vault_uri: "https://<your-vault-name>.vault.azure.net/",
207 key_name: "<your-key-name>",
208 tenant_id: "<your-tenant-id>"
163209 }
164 }'
165 ```
210 });
166211
212 console.log(`id: ${externalKey.id}`);
213 console.log(`display_name: ${externalKey.display_name}`);
214 ```
215
216 ```csharp C#
217 using Anthropic.Models.Beta.Organization.ExternalKeys;
218
219 AnthropicClient client = new();
220
221 var externalKey = await client.Beta.Organization.ExternalKeys.Create(new()
222 {
223 DisplayName = "<friendly-name>",
224 Geo = Geo.Us,
225 ProviderConfig = new BetaAzureExternalKeyConfigParam
226 {
227 VaultUri = "https://<your-vault-name>.vault.azure.net/",
228 KeyName = "<your-key-name>",
229 TenantID = "<your-tenant-id>"
230 }
231 });
232
233 Console.WriteLine($"id: {externalKey.ID}");
234 Console.WriteLine($"display_name: {externalKey.DisplayName}");
235 ```
236
237 ```go Go
238 client := anthropic.NewClient()
239
240 externalKey, err := client.Beta.Organization.ExternalKeys.New(context.Background(), anthropic.BetaOrganizationExternalKeyNewParams{
241 DisplayName: anthropic.String("<friendly-name>"),
242 Geo: anthropic.BetaOrganizationExternalKeyNewParamsGeoUs,
243 ProviderConfig: anthropic.BetaOrganizationExternalKeyNewParamsProviderConfigUnion{
244 OfAzure: &anthropic.BetaAzureExternalKeyConfigParam{
245 VaultURI: "https://<your-vault-name>.vault.azure.net/",
246 KeyName: "<your-key-name>",
247 TenantID: "<your-tenant-id>",
248 },
249 },
250 })
251 if err != nil {
252 log.Fatal(err)
253 }
254
255 fmt.Printf("id: %s\n", externalKey.ID)
256 fmt.Printf("display_name: %s\n", externalKey.DisplayName)
257 ```
258
259 ```java Java
260 import com.anthropic.models.beta.organization.externalkeys.BetaAzureExternalKeyConfigParam;
261 import com.anthropic.models.beta.organization.externalkeys.ExternalKeyCreateParams;
262
263 void main() {
264 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
265
266 var params = ExternalKeyCreateParams.builder()
267 .displayName("<friendly-name>")
268 .geo(ExternalKeyCreateParams.Geo.US)
269 .providerConfig(BetaAzureExternalKeyConfigParam.builder()
270 .vaultUri("https://<your-vault-name>.vault.azure.net/")
271 .keyName("<your-key-name>")
272 .tenantId("<your-tenant-id>")
273 .build())
274 .build();
275 var externalKey = client.beta().organization().externalKeys().create(params);
276
277 IO.println("id: " + externalKey.id());
278 IO.println("display_name: " + externalKey.displayName().orElseThrow());
279 }
280 ```
281
282 ```php PHP
283 use Anthropic\Beta\Organization\ExternalKeys\ExternalKeyCreateParams\Geo;
284 // ...
285
286 $client = new Client();
287
288 $externalKey = $client->beta->organization->externalKeys->create(
289 displayName: '<friendly-name>',
290 geo: Geo::US,
291 providerConfig: [
292 'type' => 'azure',
293 'vaultURI' => 'https://<your-vault-name>.vault.azure.net/',
294 'keyName' => '<your-key-name>',
295 'tenantID' => '<your-tenant-id>',
296 ],
297 );
298
299 echo "id: {$externalKey->id}\n";
300 echo "display_name: {$externalKey->displayName}\n";
301 ```
302
303 ```ruby Ruby
304 client = Anthropic::Client.new
305
306 external_key = client.beta.organization.external_keys.create(
307 display_name: "<friendly-name>",
308 geo: :us,
309 provider_config: {
310 type: :azure,
311 vault_uri: "https://<your-vault-name>.vault.azure.net/",
312 key_name: "<your-key-name>",
313 tenant_id: "<your-tenant-id>"
314 }
315 )
316
317 puts "id: #{external_key.id}"
318 puts "display_name: #{external_key.display_name}"
319 ```
320 </CodeGroup>
321
167322 The response contains the external key ID:
168323
169324 ```json
from line 333
178333 <Step title="Validate the key">
179334 Trigger an encrypt and decrypt round-trip against your key. This confirms that Anthropic can authenticate to your tenant and perform wrap and unwrap operations.
180335
181 ```bash
182 curl -sS -X POST https://api.anthropic.com/v1/organizations/external_keys/ekey_<id>/validate \
183 -H "x-api-key: <anthropic-admin-api-key>" \
184 -H "anthropic-version: 2023-06-01" \
185 -H "content-type: application/json" -d '{}'
186 ```
336 <CodeGroup>
337 ```bash cURL
338 curl -sS -X POST "https://api.anthropic.com/v1/organizations/external_keys/ekey_<id>/validate" \
339 -H "x-api-key: $ANTHROPIC_API_KEY" \
340 -H "anthropic-version: 2023-06-01"
341 ```
187342
343 ```bash CLI
344 ant beta:organization:external-keys validate --external-key-id "ekey_<id>"
345 ```
346
347 ```python Python
348 client = anthropic.Anthropic()
349
350 validation = client.beta.organization.external_keys.validate("ekey_<id>")
351
352 print(f"status: {validation.status}")
353 print(f"error: {validation.error}")
354 ```
355
356 ```typescript TypeScript
357 const client = new Anthropic();
358
359 const validation = await client.beta.organization.externalKeys.validate("ekey_<id>");
360
361 console.log(`status: ${validation.status}`);
362 console.log(`error: ${validation.error}`);
363 ```
364
365 ```csharp C#
366 AnthropicClient client = new();
367
368 var validation = await client.Beta.Organization.ExternalKeys.Validate("ekey_<id>");
369
370 Console.WriteLine($"status: {validation.Status.Raw()}");
371 Console.WriteLine($"error: {validation.Error}");
372 ```
373
374 ```go Go
375 client := anthropic.NewClient()
376
377 validation, err := client.Beta.Organization.ExternalKeys.Validate(context.Background(), "ekey_<id>")
378 if err != nil {
379 log.Fatal(err)
380 }
381
382 fmt.Printf("status: %s\n", validation.Status)
383 fmt.Printf("error: %s\n", validation.Error)
384 ```
385
386 ```java Java
387 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
388
389 var validation = client.beta().organization().externalKeys().validate("ekey_<id>");
390
391 IO.println("status: " + validation.status().asString());
392 IO.println("error: " + validation.error().orElse(""));
393 ```
394
395 ```php PHP
396 $client = new Client();
397
398 $validation = $client->beta->organization->externalKeys->validate(
399 externalKeyID: 'ekey_<id>',
400 );
401
402 echo "status: {$validation->status}\n";
403 echo "error: {$validation->error}\n";
404 ```
405
406 ```ruby Ruby
407 client = Anthropic::Client.new
408
409 validation = client.beta.organization.external_keys.validate("ekey_<id>")
410
411 puts "status: #{validation.status}"
412 puts "error: #{validation.error}"
413 ```
414 </CodeGroup>
415
188416 A successful response looks like this:
189417
190418 ```json
from line 429
201429 <Step title="Attach the key to a workspace">
202430 Once the key is validated, attach it to a new workspace before you send any requests to that workspace. For a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).
203431
204 ```bash
205 curl -sS -X POST https://api.anthropic.com/v1/organizations/workspaces/<workspace-id> \
206 -H "x-api-key: <anthropic-admin-api-key>" \
207 -H "anthropic-version: 2023-06-01" \
208 -H "content-type: application/json" \
209 -d '{
210 "external_key_id": "ekey_<id>"
211 }'
212 ```
432 <CodeGroup>
433 ```bash cURL
434 curl -sS -X POST "https://api.anthropic.com/v1/organizations/workspaces/<workspace-id>" \
435 -H "x-api-key: $ANTHROPIC_API_KEY" \
436 -H "anthropic-version: 2023-06-01" \
437 -H "content-type: application/json" \
438 -d '{
439 "external_key_id": "ekey_<id>"
440 }'
441 ```
442
443 ```bash CLI
444 ant beta:organization:workspaces update \
445 --workspace-id "<workspace-id>" \
446 --external-key-id "ekey_<id>"
447 ```
448
449 ```python Python
450 client = anthropic.Anthropic()
451
452 workspace = client.beta.organization.workspaces.update(
453 "<workspace-id>", external_key_id="ekey_<id>"
454 )
455
456 print(f"id: {workspace.id}")
457 print(f"external_key_id: {workspace.external_key_id}")
458 ```
459
460 ```typescript TypeScript
461 const client = new Anthropic();
462
463 const workspace = await client.beta.organization.workspaces.update("<workspace-id>", {
464 external_key_id: "ekey_<id>"
465 });
466
467 console.log(`id: ${workspace.id}`);
468 console.log(`external_key_id: ${workspace.external_key_id}`);
469 ```
470
471 ```csharp C#
472 AnthropicClient client = new();
473
474 var workspace = await client.Beta.Organization.Workspaces.Update("<workspace-id>", new()
475 {
476 ExternalKeyID = "ekey_<id>"
477 });
478
479 Console.WriteLine($"id: {workspace.ID}");
480 Console.WriteLine($"external_key_id: {workspace.ExternalKeyID}");
481 ```
482
483 ```go Go
484 client := anthropic.NewClient()
485
486 workspace, err := client.Beta.Organization.Workspaces.Update(
487 context.Background(),
488 "<workspace-id>",
489 anthropic.BetaOrganizationWorkspaceUpdateParams{
490 ExternalKeyID: anthropic.String("ekey_<id>"),
491 },
492 )
493 if err != nil {
494 log.Fatal(err)
495 }
496
497 fmt.Printf("id: %s\n", workspace.ID)
498 fmt.Printf("external_key_id: %s\n", workspace.ExternalKeyID)
499 ```
500
501 ```java Java
502 import com.anthropic.models.beta.organization.workspaces.WorkspaceUpdateParams;
503
504 void main() {
505 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
506
507 var params = WorkspaceUpdateParams.builder()
508 .externalKeyId("ekey_<id>")
509 .build();
510 var workspace = client.beta().organization().workspaces().update("<workspace-id>", params);
511
512 IO.println("id: " + workspace.id());
513 IO.println("external_key_id: " + workspace.externalKeyId().orElseThrow());
514 }
515 ```
516
517 ```php PHP
518 $client = new Client();
519
520 $workspace = $client->beta->organization->workspaces->update(
521 workspaceID: '<workspace-id>',
522 externalKeyID: 'ekey_<id>',
523 );
524
525 echo "id: {$workspace->id}\n";
526 echo "external_key_id: {$workspace->externalKeyID}\n";
527 ```
528
529 ```ruby Ruby
530 client = Anthropic::Client.new
531
532 workspace = client.beta.organization.workspaces.update(
533 "<workspace-id>",
534 external_key_id: "ekey_<id>"
535 )
536
537 puts "id: #{workspace.id}"
538 puts "external_key_id: #{workspace.external_key_id}"
539 ```
540 </CodeGroup>
213541 </Step>
214542 </Steps>
215543 </Tab>
manage-claude/cmek-google-cloud-kms Changed · +340 / -29 lines
from line 140
140140 <Step title="Register the key with Anthropic">
141141 Create an external key configuration through the Admin API, using the resource name from the Note the full key resource name step under Encryption key setup.
142142
143 ```bash
144 curl -sS https://api.anthropic.com/v1/organizations/external_keys \
145 -H "x-api-key: <anthropic-admin-api-key>" \
146 -H "anthropic-version: 2023-06-01" \
147 -H "content-type: application/json" \
148 -d '{
149 "display_name": "<friendly-name>",
150 "geo": "us",
151 "provider_config": {
152 "type": "gcp",
153 "key_name": "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
143 <CodeGroup>
144 ```bash cURL
145 curl -sS "https://api.anthropic.com/v1/organizations/external_keys" \
146 -H "x-api-key: $ANTHROPIC_API_KEY" \
147 -H "anthropic-version: 2023-06-01" \
148 -H "content-type: application/json" \
149 -d '{
150 "display_name": "<friendly-name>",
151 "geo": "us",
152 "provider_config": {
153 "type": "gcp",
154 "key_name": "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
155 }
156 }'
157 ```
158
159 ```bash CLI
160 ant beta:organization:external-keys create <<'YAML'
161 display_name: "<friendly-name>"
162 geo: us
163 provider_config:
164 type: gcp
165 key_name: "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
166 YAML
167 ```
168
169 ```python Python
170 client = anthropic.Anthropic()
171
172 external_key = client.beta.organization.external_keys.create(
173 display_name="<friendly-name>",
174 geo="us",
175 provider_config={
176 "type": "gcp",
177 "key_name": "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>",
178 },
179 )
180
181 print(f"id: {external_key.id}")
182 print(f"display_name: {external_key.display_name}")
183 ```
184
185 ```typescript TypeScript
186 const client = new Anthropic();
187
188 const externalKey = await client.beta.organization.externalKeys.create({
189 display_name: "<friendly-name>",
190 geo: "us",
191 provider_config: {
192 type: "gcp",
193 key_name:
194 "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
154195 }
155 }'
156 ```
196 });
157197
198 console.log(`id: ${externalKey.id}`);
199 console.log(`display_name: ${externalKey.display_name}`);
200 ```
201
202 ```csharp C#
203 using Anthropic.Models.Beta.Organization.ExternalKeys;
204
205 AnthropicClient client = new();
206
207 var externalKey = await client.Beta.Organization.ExternalKeys.Create(new()
208 {
209 DisplayName = "<friendly-name>",
210 Geo = Geo.Us,
211 ProviderConfig = new BetaGcpExternalKeyConfig
212 {
213 KeyName = "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
214 }
215 });
216
217 Console.WriteLine($"id: {externalKey.ID}");
218 Console.WriteLine($"display_name: {externalKey.DisplayName}");
219 ```
220
221 ```go Go
222 client := anthropic.NewClient()
223
224 externalKey, err := client.Beta.Organization.ExternalKeys.New(context.Background(), anthropic.BetaOrganizationExternalKeyNewParams{
225 DisplayName: anthropic.String("<friendly-name>"),
226 Geo: anthropic.BetaOrganizationExternalKeyNewParamsGeoUs,
227 ProviderConfig: anthropic.BetaOrganizationExternalKeyNewParamsProviderConfigUnion{
228 OfGCP: &anthropic.BetaGCPExternalKeyConfigParam{
229 KeyName: "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>",
230 },
231 },
232 })
233 if err != nil {
234 log.Fatal(err)
235 }
236
237 fmt.Printf("id: %s\n", externalKey.ID)
238 fmt.Printf("display_name: %s\n", externalKey.DisplayName)
239 ```
240
241 ```java Java
242 import com.anthropic.models.beta.organization.externalkeys.ExternalKeyCreateParams;
243
244 void main() {
245 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
246
247 var params = ExternalKeyCreateParams.builder()
248 .displayName("<friendly-name>")
249 .geo(ExternalKeyCreateParams.Geo.US)
250 .gcpProviderConfig("projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>")
251 .build();
252 var externalKey = client.beta().organization().externalKeys().create(params);
253
254 IO.println("id: " + externalKey.id());
255 IO.println("display_name: " + externalKey.displayName().orElseThrow());
256 }
257 ```
258
259 ```php PHP
260 use Anthropic\Beta\Organization\ExternalKeys\ExternalKeyCreateParams\Geo;
261 // ...
262
263 $client = new Client();
264
265 $externalKey = $client->beta->organization->externalKeys->create(
266 displayName: '<friendly-name>',
267 geo: Geo::US,
268 providerConfig: [
269 'type' => 'gcp',
270 'keyName' => 'projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>',
271 ],
272 );
273
274 echo "id: {$externalKey->id}\n";
275 echo "display_name: {$externalKey->displayName}\n";
276 ```
277
278 ```ruby Ruby
279 client = Anthropic::Client.new
280
281 external_key = client.beta.organization.external_keys.create(
282 display_name: "<friendly-name>",
283 geo: :us,
284 provider_config: {
285 type: :gcp,
286 key_name: "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
287 }
288 )
289
290 puts "id: #{external_key.id}"
291 puts "display_name: #{external_key.display_name}"
292 ```
293 </CodeGroup>
294
158295 The response contains the external key ID:
159296
160297 ```json
from line 306
169306 <Step title="Validate the key">
170307 Trigger an encrypt and decrypt round-trip against your key.
171308
172 ```bash
173 curl -sS -X POST https://api.anthropic.com/v1/organizations/external_keys/ekey_<id>/validate \
174 -H "x-api-key: <anthropic-admin-api-key>" \
175 -H "anthropic-version: 2023-06-01" \
176 -H "content-type: application/json" \
177 -d '{}'
178 ```
309 <CodeGroup>
310 ```bash cURL
311 curl -sS -X POST "https://api.anthropic.com/v1/organizations/external_keys/ekey_<id>/validate" \
312 -H "x-api-key: $ANTHROPIC_API_KEY" \
313 -H "anthropic-version: 2023-06-01"
314 ```
179315
316 ```bash CLI
317 ant beta:organization:external-keys validate --external-key-id "ekey_<id>"
318 ```
319
320 ```python Python
321 client = anthropic.Anthropic()
322
323 validation = client.beta.organization.external_keys.validate("ekey_<id>")
324
325 print(f"status: {validation.status}")
326 print(f"error: {validation.error}")
327 ```
328
329 ```typescript TypeScript
330 const client = new Anthropic();
331
332 const validation = await client.beta.organization.externalKeys.validate("ekey_<id>");
333
334 console.log(`status: ${validation.status}`);
335 console.log(`error: ${validation.error}`);
336 ```
337
338 ```csharp C#
339 AnthropicClient client = new();
340
341 var validation = await client.Beta.Organization.ExternalKeys.Validate("ekey_<id>");
342
343 Console.WriteLine($"status: {validation.Status.Raw()}");
344 Console.WriteLine($"error: {validation.Error}");
345 ```
346
347 ```go Go
348 client := anthropic.NewClient()
349
350 validation, err := client.Beta.Organization.ExternalKeys.Validate(context.Background(), "ekey_<id>")
351 if err != nil {
352 log.Fatal(err)
353 }
354
355 fmt.Printf("status: %s\n", validation.Status)
356 fmt.Printf("error: %s\n", validation.Error)
357 ```
358
359 ```java Java
360 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
361
362 var validation = client.beta().organization().externalKeys().validate("ekey_<id>");
363
364 IO.println("status: " + validation.status().asString());
365 IO.println("error: " + validation.error().orElse(""));
366 ```
367
368 ```php PHP
369 $client = new Client();
370
371 $validation = $client->beta->organization->externalKeys->validate(
372 externalKeyID: 'ekey_<id>',
373 );
374
375 echo "status: {$validation->status}\n";
376 echo "error: {$validation->error}\n";
377 ```
378
379 ```ruby Ruby
380 client = Anthropic::Client.new
381
382 external_key_id = "ekey_<id>"
383 validation = client.beta.organization.external_keys.validate(external_key_id)
384
385 puts "status: #{validation.status}"
386 puts "error: #{validation.error}"
387 ```
388 </CodeGroup>
389
180390 A successful response looks like this:
181391
182392 ```json
from line 403
193403 <Step title="Attach the key to a workspace">
194404 Once the key is validated, attach it to a new workspace before you send any requests to that workspace. For a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).
195405
196 ```bash
197 curl -sS -X POST https://api.anthropic.com/v1/organizations/workspaces/<workspace-id> \
198 -H "x-api-key: <anthropic-admin-api-key>" \
199 -H "anthropic-version: 2023-06-01" \
200 -H "content-type: application/json" \
201 -d '{
202 "external_key_id": "ekey_<id>"
203 }'
204 ```
406 <CodeGroup>
407 ```bash cURL
408 curl -sS -X POST "https://api.anthropic.com/v1/organizations/workspaces/<workspace-id>" \
409 -H "x-api-key: $ANTHROPIC_API_KEY" \
410 -H "anthropic-version: 2023-06-01" \
411 -H "content-type: application/json" \
412 -d '{
413 "external_key_id": "ekey_<id>"
414 }'
415 ```
416
417 ```bash CLI
418 ant beta:organization:workspaces update \
419 --workspace-id "<workspace-id>" \
420 --external-key-id "ekey_<id>"
421 ```
422
423 ```python Python
424 client = anthropic.Anthropic()
425
426 workspace = client.beta.organization.workspaces.update(
427 "<workspace-id>", external_key_id="ekey_<id>"
428 )
429
430 print(f"id: {workspace.id}")
431 print(f"external_key_id: {workspace.external_key_id}")
432 ```
433
434 ```typescript TypeScript
435 const client = new Anthropic();
436
437 const workspace = await client.beta.organization.workspaces.update("<workspace-id>", {
438 external_key_id: "ekey_<id>"
439 });
440
441 console.log(`id: ${workspace.id}`);
442 console.log(`external_key_id: ${workspace.external_key_id}`);
443 ```
444
445 ```csharp C#
446 AnthropicClient client = new();
447
448 var workspace = await client.Beta.Organization.Workspaces.Update("<workspace-id>", new()
449 {
450 ExternalKeyID = "ekey_<id>"
451 });
452
453 Console.WriteLine($"id: {workspace.ID}");
454 Console.WriteLine($"external_key_id: {workspace.ExternalKeyID}");
455 ```
456
457 ```go Go
458 client := anthropic.NewClient()
459
460 workspace, err := client.Beta.Organization.Workspaces.Update(
461 context.Background(),
462 "<workspace-id>",
463 anthropic.BetaOrganizationWorkspaceUpdateParams{
464 ExternalKeyID: anthropic.String("ekey_<id>"),
465 },
466 )
467 if err != nil {
468 log.Fatal(err)
469 }
470
471 fmt.Printf("id: %s\n", workspace.ID)
472 fmt.Printf("external_key_id: %s\n", workspace.ExternalKeyID)
473 ```
474
475 ```java Java
476 import com.anthropic.models.beta.organization.workspaces.WorkspaceUpdateParams;
477
478 void main() {
479 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
480
481 var params = WorkspaceUpdateParams.builder()
482 .externalKeyId("ekey_<id>")
483 .build();
484 var workspace = client.beta().organization().workspaces().update("<workspace-id>", params);
485
486 IO.println("id: " + workspace.id());
487 IO.println("external_key_id: " + workspace.externalKeyId().orElseThrow());
488 }
489 ```
490
491 ```php PHP
492 $client = new Client();
493
494 $workspace = $client->beta->organization->workspaces->update(
495 workspaceID: '<workspace-id>',
496 externalKeyID: 'ekey_<id>',
497 );
498
499 echo "id: {$workspace->id}\n";
500 echo "external_key_id: {$workspace->externalKeyID}\n";
501 ```
502
503 ```ruby Ruby
504 client = Anthropic::Client.new
505
506 workspace_id = "<workspace-id>"
507 workspace = client.beta.organization.workspaces.update(
508 workspace_id,
509 external_key_id: "ekey_<id>"
510 )
511
512 puts "id: #{workspace.id}"
513 puts "external_key_id: #{workspace.external_key_id}"
514 ```
515 </CodeGroup>
205516 </Step>
206517 </Steps>
207518 </Tab>
manage-claude/compliance-sessions Changed · +17 / -13 lines
from line 5
55---
66
77<Note>
8 The endpoints on this page are available only to Claude Enterprise organizations and are in beta. They work with the same Compliance Access Key and `read:compliance_user_data` scope as the [chat, file, and project endpoints](https://platform.claude.com/docs/en/manage-claude/compliance-content-data); no new key, scope, setting, or client update is required. See [Set up the Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api-access).
8 The endpoints on this page are available only to Claude Enterprise organizations. The local and remote session endpoints are stable for Cowork and Claude Code sessions; coverage of Claude Science and Claude for Microsoft 365 sessions is in beta. The endpoints work with the same Compliance Access Key and `read:compliance_user_data` scope as the [chat, file, and project endpoints](https://platform.claude.com/docs/en/manage-claude/compliance-content-data); no new key, scope, setting, or client update is required. See [Set up the Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api-access).
99</Note>
1010
1111<Check>
from line 14
1414 **Prerequisite:** None for listing sessions organization-wide. To filter the remote session list (sessions in the cloud) to specific users, you need user IDs from [List organization users](https://platform.claude.com/docs/en/manage-claude/compliance-org-data#list-organization-users); the local session list has no user filter.
1515</Check>
1616
17The endpoints on this page expose transcripts of the sessions your users run in Claude apps and agents (today, Cowork and Claude Code) from your Claude Enterprise organizations to compliance reviewers. Each session is a single conversation with Claude; its transcript is the sequence of user prompts, assistant responses, and tool calls and results in that conversation. The endpoints support eDiscovery (electronic discovery) exports and data loss prevention (DLP) enforcement.
17The endpoints on this page expose transcripts of the sessions your users run in Claude apps and agents (today: Cowork, Claude Code, Claude Science, and Claude for Microsoft 365) from your Claude Enterprise organizations to compliance reviewers. Each session is a single conversation with Claude; its transcript is the sequence of user prompts, assistant responses, and tool calls and results in that conversation. The endpoints support eDiscovery (electronic discovery) exports and data loss prevention (DLP) enforcement.
1818
1919The Compliance API groups sessions into two endpoint families according to where they run: local session endpoints for sessions on users' machines, and remote session endpoints for sessions that run in the cloud in Anthropic-managed environments. Both families are read-only, and neither is available to Admin API keys (`sk-ant-admin01-...`): calls authenticated with an Admin API key return [403 Forbidden](https://platform.claude.com/docs/en/manage-claude/compliance-errors#403-forbidden).
2020
2121The following table maps each product, and where it runs, to the endpoint family that returns its sessions and the `product_surface` value that identifies them in responses. Products are added to this table as coverage expands.
2222
23| Product and where it runs | Endpoint family | `product_surface` |
24| ---------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------- | ----------------- |
25| Cowork in Claude Desktop, running on the user's machine | Local session endpoints (`/v1/compliance/apps/sessions/local`) | `cowork` |
26| Claude Code in the terminal, in Claude Desktop, or in an IDE extension, running on the user's machine | Local session endpoints | `claude_code` |
27| Cowork sessions started on claude.ai web or mobile, running in the cloud in Anthropic-managed environments | Remote session endpoints (`/v1/compliance/apps/sessions/remote`) | `cowork_remote` |
23| Product and where it runs | Endpoint family | `product_surface` |
24| ---------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
25| Cowork in Claude Desktop, running on the user's machine | Local session endpoints (`/v1/compliance/apps/sessions/local`) | `cowork` |
26| Claude Code in the terminal, in Claude Desktop, or in an IDE extension, running on the user's machine | Local session endpoints | `claude_code` |
27| Claude Science desktop app, running on the user's machine | Local session endpoints | `claude_science` |
28| Claude for Microsoft 365 (the Claude add-ins for Excel, PowerPoint, Word, and Outlook), running in the Microsoft 365 desktop or web apps | Local session endpoints | `office_agents/excel`, `office_agents/powerpoint`, `office_agents/word`, or `office_agents/outlook` (`office_agents` when the app is not identified) |
29| Cowork sessions started on claude.ai web or mobile, running in the cloud in Anthropic-managed environments | Remote session endpoints (`/v1/compliance/apps/sessions/remote`) | `cowork_remote` |
2830
2931Capture of local sessions is tied to the Compliance API being enabled for your organization and applies while users are signed in with their Claude Enterprise account. The session endpoints do not return the following:
3032
from line 43
4143| Setup | Works with your existing Compliance Access Key | Works with your existing Compliance Access Key | Admin configures an OTLP endpoint and content-capture settings |
4244| Infrastructure | Anthropic-hosted | Anthropic-hosted | You run the collector and storage |
4345| ID prefix | `clls_` | `cse_` | N/A |
44| `product_surface` values | `cowork`, `claude_code` | `cowork_remote` | N/A |
46| `product_surface` values | `cowork`, `claude_code`, `claude_science`, and values beginning with `office_agents` | `cowork_remote` | N/A |
4547| Retention | 6 years by default, or your organization's custom conversation retention period when a finite one is set; held by Anthropic | 6 years, held by Anthropic | Your infrastructure, your policies |
4648| User prompts and assistant responses | Yes | Yes | Yes, subject to content-capture settings |
4749| Tool inputs | Truncated to 10,000 bytes per input by default; up to about 1 MiB on request | Truncated to 10,000 bytes per input by default; up to about 1 MiB on request | Truncated summaries |
from line 54
5254
5355## Sessions on users' machines (local sessions)
5456
55Local sessions run on users' machines while they are signed in with their Claude Enterprise account: today, Cowork in Claude Desktop, and Claude Code in the terminal, in Claude Desktop, or in an IDE extension.
57Local sessions run on users' machines while they are signed in with their Claude Enterprise account: today, Cowork in Claude Desktop, Claude Code (in the terminal, in Claude Desktop, or in an IDE extension), the Claude Science desktop app, and Claude for Microsoft 365 in Excel, PowerPoint, Word, and Outlook.
5658
5759The Compliance API exposes local sessions through three endpoints: `GET /v1/compliance/apps/sessions/local` lists session metadata, `GET /v1/compliance/apps/sessions/local/{session_id}` retrieves one session's metadata, and `GET /v1/compliance/apps/sessions/local/{session_id}/messages` returns one session's transcript. All three require the `read:compliance_user_data` scope and count only against the shared Compliance API rate limit; they are not subject to the second request budget that applies to the remote session endpoints. See [429 Too Many Requests](https://platform.claude.com/docs/en/manage-claude/compliance-errors#429-too-many-requests). If local sessions are not available to your parent organization, all three endpoints return 404 with the message `Local sessions are not available.` (see [Local session not found](https://platform.claude.com/docs/en/manage-claude/compliance-errors#local-session-not-found)); while session listings or captured content are temporarily unavailable, they return 503 (see [Local sessions temporarily unavailable](https://platform.claude.com/docs/en/manage-claude/compliance-errors#local-sessions-temporarily-unavailable)).
5860
from line 108
106108
107109Results are sorted in reverse chronological order (newest first) by `created_at`, with ties broken in a fixed server-side order, and capped at `limit` results per response (default 100, max 500). The endpoint paginates forward only with `page` and `next_page` tokens (see [Paginate results](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed#paginate-results)): pass the response's `next_page` value back as the `page` query parameter on the next request, and stop when `next_page` is `null`. The response has no `has_more` field. Complete a list walk within 24 hours of starting it; an older list cursor is still accepted but is re-evaluated against the current retention boundary, so sessions whose oldest retained activity is about to age out of the retention period can be skipped.
108110
109In each session object, `user.id` is always set and survives account deletion; `user.email_address` is `null` when the user's account has been deleted or the user is no longer a member of an organization your key can read. `workspace_id` is `null` when the session was not associated with a workspace. A local session corresponds to one client session ID: starting a new conversation in the client, or clearing its context, begins a new session record. Treat `id` values as opaque strings; the format may change without notice.
111In each session object, `user.id` is always set and survives account deletion; `user.email_address` is `null` when the user's account has been deleted or the user is no longer a member of an organization your key can read. `workspace_id` is `null` when the session was not associated with a workspace. A local session corresponds to one client session ID: starting a new conversation in the client, or clearing its context, begins a new session record. For Claude Science, the list can also include separate sessions for the app's own background work (for example, naming the conversation; on newer app versions also its reviewer and delegation tracks), and on older app versions some of that background work appears as extra messages inside the conversation's own transcript. A Claude Science conversation that continues across some app updates appears as two sessions. These behaviors are expected. Treat `id` values as opaque strings; the format may change without notice.
110112
113For Claude for Microsoft 365, deleting a conversation in the add-in happens only on the client, so it is not reflected in the API: local sessions have no `deleted_at` field, and the session stays listed until retention removes it.
114
111115Local sessions carry an `updated_at` but no `status`: a local session has no server-side lifecycle status, and its visibility is governed by retention instead. A local session is captured as the series of Claude API calls (inference calls) that the client makes during the session, and retention applies to each captured call individually. `created_at` is the timestamp of the session's earliest retained call and `updated_at` the timestamp of its last, both UTC. As older calls age past the retention period, `created_at` advances accordingly, and once every call in a session has aged out, the session is no longer returned; `updated_at` tracks the most recent call and is unaffected until then. Because `created_at` can shift between runs, deduplicate on `id` when you re-walk the list over time. To keep transcripts current as sessions gain messages, poll with the `updated_at.gte` filter, overlapping consecutive windows. On the list endpoint `updated_at` is a lower bound: for a session still active at a page or `created_at.lt` window boundary it can momentarily lag the session's true last activity, and a new call only becomes queryable after the short processing delay noted earlier. Because of that lag, set each run's `updated_at.gte` a few minutes before your previous run's start time, not to the previous run's time exactly. A bound set to the exact previous time silently and permanently drops a session whose final call was still indexing at that moment, because once the bound advances past that call no later run returns it. Deduplicate the returned sessions on `id`, re-fetch their transcripts, and deduplicate messages on `id`. Retrieving a session, or its messages, always reflects the exact latest retained call, so a periodic reconciliation pass over an older window is a more thorough alternative to widening the overlap.
112116
113117The list is built from session activity metadata, so it can include sessions whose transcript content was not captured, for example sessions that ran before capture began for your organization (as far back as your retention period allows); the transcript of such a session returns each message with its content marked unavailable (see [Retrieve a local session transcript](https://platform.claude.com/docs/en/manage-claude/compliance-sessions#retrieve-a-local-session-transcript)).
from line 120
116120
117121To fetch one session's metadata directly, pass its ID to `GET /v1/compliance/apps/sessions/local/{session_id}`. The response is the same session object the list endpoint returns, with no envelope and no transcript content. A malformed session ID returns [400 Bad Request](https://platform.claude.com/docs/en/manage-claude/compliance-errors#400-bad-request). A single [404 Not Found](https://platform.claude.com/docs/en/manage-claude/compliance-errors#404-not-found) covers four cases that the response does not distinguish: the session is not in an organization your key can read (including sessions under another parent organization), it does not exist, zero data retention is in effect for it, or every call in it has aged past retention.
118122
119`product_surface` (string or `null`) identifies the product that created the session: `cowork` for Cowork sessions running on the user's machine in Claude Desktop, and `claude_code` for Claude Code sessions. New values appear as coverage expands.
123`product_surface` (string or `null`) identifies the product that created the session: `cowork` (Cowork in Claude Desktop on the user's machine), `claude_code` (Claude Code), `claude_science` (Claude Science), or one of `office_agents/excel`, `office_agents/powerpoint`, `office_agents/word`, and `office_agents/outlook` (Claude for Microsoft 365, by app; `office_agents` alone when the app is not identified). New values appear as coverage expands.
120124
121125<Note>
122126 **Build forward-compatible handlers.** Pass through unrecognized `product_surface` values, and ignore fields your handler does not expect, so your integration keeps working as new product surfaces ship.
from line 133
129133* Thinking blocks are never included.
130134* The request's system prompt is never returned. A marker message reading `[system prompt content not shown]` stands in for it (normally once per session; a session with no captured content carries no marker).
131135* Tool definitions and MCP server configuration are not part of the transcript.
132* Images, PDFs, and other binary or structured blocks are not returned. Each appears as a `text` block reading `[<block type> content not shown]` (for example, `[image content not shown]`) with `truncated` set to `true`. Non-text items inside a tool result are replaced by one `[N non-text item(s) not shown]` entry, and the tool result block's `truncated` is `true`.
133* Citation metadata on `text` blocks is omitted, and the affected block carries `truncated` set to `true`.
136* Images, PDFs, and other binary or structured blocks are not returned. Each appears as a `text` block reading `[<block type> content not shown]` (for example, `[image content not shown]`) with `truncated` set to `true`. Non-text items inside a tool result, such as [web search](https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-search-tool) results or the output of the [code execution tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/code-execution-tool), are replaced by one `[N non-text item(s) not shown]` entry, and the tool result block's `truncated` is `true`. The matching tool call, with the search query or the code in its `input`, is still returned.
137* Citation metadata on `text` blocks, such as the source citations on an answer that draws on web search results, is omitted. The text itself is returned, and the block carries `truncated` set to `true`.
134138
135139Project instruction files such as `CLAUDE.md` appear as ordinary user-role content. Skill content appears when the client sends it as message content and is not distinguished from other user text. For a coverage summary, see the [Compliance API FAQ](https://platform.claude.com/docs/en/manage-claude/compliance-faq#data-coverage-and-retention); for a table comparing local sessions with remote sessions and OpenTelemetry logging, see this page's introduction.
136140
manage-claude/rate-limits-api Changed · +643 / -25 lines
The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.
from line 20
2020 **Admin API key required.** These endpoints require an Admin API key, which is different from a standard Claude API key. See [Create an Admin API key](https://platform.claude.com/docs/en/manage-claude/admin-api-keys) to find where to create one for your organization type and which scopes to select.
2121</Check>
2222
23The SDK and CLI examples on this page construct the default client, which reads the Admin API key from the `ANTHROPIC_API_KEY` environment variable. The SDKs expose these endpoints as `client.beta.organization.rate_limits` and `client.beta.organization.workspaces.rate_limits`; the Python, TypeScript, C#, Go, and Java list methods return an iterator that follows `next_page` for you, while the PHP, Ruby, and curl examples read one page.
24
2325## Quick start
2426
2527List the rate limits configured for your organization:
2628
27```bash cURL
28curl "https://api.anthropic.com/v1/organizations/rate_limits" \
29 --header "anthropic-version: 2023-06-01" \
30 --header "x-api-key: $ANTHROPIC_ADMIN_KEY"
31```
29<CodeGroup>
30 ```bash cURL
31 curl "https://api.anthropic.com/v1/organizations/rate_limits" \
32 -H "x-api-key: $ANTHROPIC_API_KEY" \
33 -H "anthropic-version: 2023-06-01"
34 ```
35
36 ```bash CLI
37 ant beta:organization:rate-limits list
38 ```
39
40 ```python Python
41 client = anthropic.Anthropic()
42
43 rate_limits = client.beta.organization.rate_limits.list()
44
45 for group in rate_limits:
46 models = f" ({', '.join(group.models)})" if group.models else ""
47 print(f"{group.group_type}{models}")
48 for limit in group.limits:
49 print(f" {limit.type}: {limit.value}")
50 ```
51
52 ```typescript TypeScript
53 const client = new Anthropic();
54
55 const rateLimits = await client.beta.organization.rateLimits.list();
56
57 for await (const group of rateLimits) {
58 const models = group.models ? ` (${group.models.join(", ")})` : "";
59 console.log(`${group.group_type}${models}`);
60 for (const limit of group.limits) {
61 console.log(` ${limit.type}: ${limit.value}`);
62 }
63 }
64 ```
65
66 ```csharp C#
67 AnthropicClient client = new();
68
69 var rateLimits = await client.Beta.Organization.RateLimits.List();
70
71 await foreach (var group in rateLimits.Paginate())
72 {
73 var models = group.Models is null ? "" : $" ({string.Join(", ", group.Models)})";
74 Console.WriteLine($"{group.GroupType.Raw()}{models}");
75 foreach (var limit in group.Limits)
76 {
77 Console.WriteLine($" {limit.Type}: {limit.Value}");
78 }
79 }
80 ```
81
82 ```go Go
83 client := anthropic.NewClient()
84
85 rateLimits := client.Beta.Organization.RateLimits.ListAutoPaging(context.Background(), anthropic.BetaOrganizationRateLimitListParams{})
86
87 for rateLimits.Next() {
88 group := rateLimits.Current()
89 models := ""
90 if len(group.Models) > 0 {
91 models = fmt.Sprintf(" (%s)", strings.Join(group.Models, ", "))
92 }
93 fmt.Printf("%s%s\n", group.GroupType, models)
94 for _, limit := range group.Limits {
95 fmt.Printf(" %s: %d\n", limit.Type, limit.Value)
96 }
97 }
98 if err := rateLimits.Err(); err != nil {
99 log.Fatal(err)
100 }
101 ```
102
103 ```java Java
104 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
105
106 var rateLimits = client.beta().organization().rateLimits().list();
107
108 for (var group : rateLimits.autoPager()) {
109 var models = group.models()
110 .map(modelIds -> " (" + String.join(", ", modelIds) + ")")
111 .orElse("");
112 IO.println(group.groupType().asString() + models);
113 for (var limit : group.limits()) {
114 IO.println(" " + limit.type() + ": " + limit.value());
115 }
116 }
117 ```
118
119 ```php PHP
120 $client = new Client();
121
122 $rateLimits = $client->beta->organization->rateLimits->list();
123
124 foreach ($rateLimits->data as $group) {
125 $models = $group->models ? ' (' . implode(', ', $group->models) . ')' : '';
126 echo "{$group->groupType}{$models}\n";
127 foreach ($group->limits as $limit) {
128 echo " {$limit->type}: {$limit->value}\n";
129 }
130 }
131 ```
132
133 ```ruby Ruby
134 client = Anthropic::Client.new
135
136 rate_limits = client.beta.organization.rate_limits.list
137
138 rate_limits.data.each do |group|
139 models = group.models ? " (#{group.models.join(", ")})" : ""
140 puts "#{group.group_type}#{models}"
141 group.limits.each do |limit|
142 puts " #{limit.type}: #{limit.value}"
143 end
144 end
145 ```
146</CodeGroup>
32147
33148## Organization rate limits
34149
from line 160
45160
46161### List all organization rate limits
47162
48```bash cURL
49curl "https://api.anthropic.com/v1/organizations/rate_limits" \
50 --header "anthropic-version: 2023-06-01" \
51 --header "x-api-key: $ANTHROPIC_ADMIN_KEY"
52```
163<CodeGroup>
164 ```bash cURL
165 curl "https://api.anthropic.com/v1/organizations/rate_limits" \
166 -H "x-api-key: $ANTHROPIC_API_KEY" \
167 -H "anthropic-version: 2023-06-01"
168 ```
169
170 ```bash CLI
171 ant beta:organization:rate-limits list
172 ```
173
174 ```python Python
175 client = anthropic.Anthropic()
176
177 rate_limits = client.beta.organization.rate_limits.list()
178
179 for group in rate_limits:
180 models = f" ({', '.join(group.models)})" if group.models else ""
181 print(f"{group.group_type}{models}")
182 for limit in group.limits:
183 print(f" {limit.type}: {limit.value}")
184 ```
185
186 ```typescript TypeScript
187 const client = new Anthropic();
188
189 const rateLimits = await client.beta.organization.rateLimits.list();
190
191 for await (const group of rateLimits) {
192 const models = group.models ? ` (${group.models.join(", ")})` : "";
193 console.log(`${group.group_type}${models}`);
194 for (const limit of group.limits) {
195 console.log(` ${limit.type}: ${limit.value}`);
196 }
197 }
198 ```
199
200 ```csharp C#
201 AnthropicClient client = new();
202
203 var rateLimits = await client.Beta.Organization.RateLimits.List();
204
205 await foreach (var group in rateLimits.Paginate())
206 {
207 var models = group.Models is null ? "" : $" ({string.Join(", ", group.Models)})";
208 Console.WriteLine($"{group.GroupType.Raw()}{models}");
209 foreach (var limit in group.Limits)
210 {
211 Console.WriteLine($" {limit.Type}: {limit.Value}");
212 }
213 }
214 ```
215
216 ```go Go
217 client := anthropic.NewClient()
218
219 rateLimits := client.Beta.Organization.RateLimits.ListAutoPaging(context.Background(), anthropic.BetaOrganizationRateLimitListParams{})
220
221 for rateLimits.Next() {
222 group := rateLimits.Current()
223 models := ""
224 if len(group.Models) > 0 {
225 models = fmt.Sprintf(" (%s)", strings.Join(group.Models, ", "))
226 }
227 fmt.Printf("%s%s\n", group.GroupType, models)
228 for _, limit := range group.Limits {
229 fmt.Printf(" %s: %d\n", limit.Type, limit.Value)
230 }
231 }
232 if err := rateLimits.Err(); err != nil {
233 log.Fatal(err)
234 }
235 ```
236
237 ```java Java
238 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
239
240 var rateLimits = client.beta().organization().rateLimits().list();
241
242 for (var group : rateLimits.autoPager()) {
243 var models = group.models()
244 .map(modelIds -> " (" + String.join(", ", modelIds) + ")")
245 .orElse("");
246 IO.println(group.groupType().asString() + models);
247 for (var limit : group.limits()) {
248 IO.println(" " + limit.type() + ": " + limit.value());
249 }
250 }
251 ```
252
253 ```php PHP
254 $client = new Client();
255
256 $rateLimits = $client->beta->organization->rateLimits->list();
257
258 foreach ($rateLimits->data as $group) {
259 $models = $group->models ? ' (' . implode(', ', $group->models) . ')' : '';
260 echo "{$group->groupType}{$models}\n";
261 foreach ($group->limits as $limit) {
262 echo " {$limit->type}: {$limit->value}\n";
263 }
264 }
265 ```
266
267 ```ruby Ruby
268 client = Anthropic::Client.new
269
270 rate_limits = client.beta.organization.rate_limits.list
271
272 rate_limits.data.each do |group|
273 models = group.models ? " (#{group.models.join(", ")})" : ""
274 puts "#{group.group_type}#{models}"
275 group.limits.each do |limit|
276 puts " #{limit.type}: #{limit.value}"
277 end
278 end
279 ```
280</CodeGroup>
53281
54282```json
55283{
from line 323
95323
96324Pass any model ID or alias as the `model` query parameter to return only the entry that contains it:
97325
98```bash cURL
99curl "https://api.anthropic.com/v1/organizations/rate_limits?model=claude-opus-5" \
100 --header "anthropic-version: 2023-06-01" \
101 --header "x-api-key: $ANTHROPIC_ADMIN_KEY"
102```
326<CodeGroup>
327 ```bash cURL
328 curl "https://api.anthropic.com/v1/organizations/rate_limits?model=claude-opus-5" \
329 -H "x-api-key: $ANTHROPIC_API_KEY" \
330 -H "anthropic-version: 2023-06-01"
331 ```
332
333 ```bash CLI
334 ant beta:organization:rate-limits list --model claude-opus-5
335 ```
336
337 ```python Python
338 client = anthropic.Anthropic()
339
340 rate_limits = client.beta.organization.rate_limits.list(model="claude-opus-5")
341
342 for group in rate_limits:
343 models = f" ({', '.join(group.models)})" if group.models else ""
344 print(f"{group.group_type}{models}")
345 for limit in group.limits:
346 print(f" {limit.type}: {limit.value}")
347 ```
348
349 ```typescript TypeScript
350 const client = new Anthropic();
351
352 const rateLimits = await client.beta.organization.rateLimits.list({ model: "claude-opus-5" });
353
354 for await (const group of rateLimits) {
355 const models = group.models ? ` (${group.models.join(", ")})` : "";
356 console.log(`${group.group_type}${models}`);
357 for (const limit of group.limits) {
358 console.log(` ${limit.type}: ${limit.value}`);
359 }
360 }
361 ```
362
363 ```csharp C#
364 AnthropicClient client = new();
365
366 var rateLimits = await client.Beta.Organization.RateLimits.List(new()
367 {
368 Model = "claude-opus-5"
369 });
370
371 await foreach (var group in rateLimits.Paginate())
372 {
373 var models = group.Models is null ? "" : $" ({string.Join(", ", group.Models)})";
374 Console.WriteLine($"{group.GroupType.Raw()}{models}");
375 foreach (var limit in group.Limits)
376 {
377 Console.WriteLine($" {limit.Type}: {limit.Value}");
378 }
379 }
380 ```
381
382 ```go Go
383 client := anthropic.NewClient()
384
385 rateLimits := client.Beta.Organization.RateLimits.ListAutoPaging(context.Background(), anthropic.BetaOrganizationRateLimitListParams{
386 Model: anthropic.String(anthropic.ModelClaudeOpus5),
387 })
388
389 for rateLimits.Next() {
390 group := rateLimits.Current()
391 models := ""
392 if len(group.Models) > 0 {
393 models = fmt.Sprintf(" (%s)", strings.Join(group.Models, ", "))
394 }
395 fmt.Printf("%s%s\n", group.GroupType, models)
396 for _, limit := range group.Limits {
397 fmt.Printf(" %s: %d\n", limit.Type, limit.Value)
398 }
399 }
400 if err := rateLimits.Err(); err != nil {
401 log.Fatal(err)
402 }
403 ```
404
405 ```java Java
406 import com.anthropic.models.beta.organization.ratelimits.RateLimitListParams;
407 import com.anthropic.models.messages.Model;
408
409 void main() {
410 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
411
412 var params = RateLimitListParams.builder()
413 .model(Model.CLAUDE_OPUS_5.asString())
414 .build();
415 var rateLimits = client.beta().organization().rateLimits().list(params);
416
417 for (var group : rateLimits.autoPager()) {
418 var models = group.models()
419 .map(modelIds -> " (" + String.join(", ", modelIds) + ")")
420 .orElse("");
421 IO.println(group.groupType().asString() + models);
422 for (var limit : group.limits()) {
423 IO.println(" " + limit.type() + ": " + limit.value());
424 }
425 }
426 }
427 ```
428
429 ```php PHP
430 use Anthropic\Messages\Model;
431
432 $client = new Client();
433
434 $rateLimits = $client->beta->organization->rateLimits->list(
435 model: Model::CLAUDE_OPUS_5->value,
436 );
437
438 foreach ($rateLimits->data as $group) {
439 $models = $group->models ? ' (' . implode(', ', $group->models) . ')' : '';
440 echo "{$group->groupType}{$models}\n";
441 foreach ($group->limits as $limit) {
442 echo " {$limit->type}: {$limit->value}\n";
443 }
444 }
445 ```
446
447 ```ruby Ruby
448 client = Anthropic::Client.new
449
450 rate_limits = client.beta.organization.rate_limits.list(model: Anthropic::Model::CLAUDE_OPUS_5)
451
452 rate_limits.data.each do |group|
453 models = group.models ? " (#{group.models.join(", ")})" : ""
454 puts "#{group.group_type}#{models}"
455 group.limits.each do |limit|
456 puts " #{limit.type}: #{limit.value}"
457 end
458 end
459 ```
460</CodeGroup>
103461
104462If the model string doesn't match any group, the endpoint returns a 404 error. The `model` parameter is supported on the organization endpoint only; the workspace endpoint doesn't accept it.
105463
from line 477
119477 To retrieve your organization's workspace IDs, use the [List Workspaces](https://platform.claude.com/docs/en/api/admin/workspaces/list) endpoint, or find them in the [Claude Console](https://platform.claude.com/settings/workspaces). The default workspace cannot have rate limit overrides, so it has no entry on this endpoint; use the organization endpoint to read its limits.
120478</Tip>
121479
122```bash cURL
123curl "https://api.anthropic.com/v1/organizations/workspaces/wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ/rate_limits" \
124 --header "anthropic-version: 2023-06-01" \
125 --header "x-api-key: $ANTHROPIC_ADMIN_KEY"
126```
480<CodeGroup>
481 ```bash cURL
482 curl "https://api.anthropic.com/v1/organizations/workspaces/wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ/rate_limits" \
483 -H "x-api-key: $ANTHROPIC_API_KEY" \
484 -H "anthropic-version: 2023-06-01"
485 ```
486
487 ```bash CLI
488 ant beta:organization:workspaces:rate-limits list \
489 --workspace-id wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ
490 ```
491
492 ```python Python
493 client = anthropic.Anthropic()
494
495 rate_limits = client.beta.organization.workspaces.rate_limits.list(
496 "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
497 )
498
499 for group in rate_limits:
500 models = f" ({', '.join(group.models)})" if group.models else ""
501 print(f"{group.group_type}{models}")
502 for limit in group.limits:
503 print(f" {limit.type}: {limit.value}")
504 ```
505
506 ```typescript TypeScript
507 const client = new Anthropic();
508
509 const rateLimits = await client.beta.organization.workspaces.rateLimits.list(
510 "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
511 );
512
513 for await (const group of rateLimits) {
514 const models = group.models ? ` (${group.models.join(", ")})` : "";
515 console.log(`${group.group_type}${models}`);
516 for (const limit of group.limits) {
517 console.log(` ${limit.type}: ${limit.value}`);
518 }
519 }
520 ```
521
522 ```csharp C#
523 AnthropicClient client = new();
524
525 var rateLimits = await client.Beta.Organization.Workspaces.RateLimits.List(
526 "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
527 );
528
529 await foreach (var group in rateLimits.Paginate())
530 {
531 var models = group.Models is null ? "" : $" ({string.Join(", ", group.Models)})";
532 Console.WriteLine($"{group.GroupType.Raw()}{models}");
533 foreach (var limit in group.Limits)
534 {
535 Console.WriteLine($" {limit.Type}: {limit.Value}");
536 }
537 }
538 ```
539
540 ```go Go
541 client := anthropic.NewClient()
542
543 rateLimits := client.Beta.Organization.Workspaces.RateLimits.ListAutoPaging(
544 context.Background(),
545 "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
546 anthropic.BetaOrganizationWorkspaceRateLimitListParams{},
547 )
548
549 for rateLimits.Next() {
550 group := rateLimits.Current()
551 models := ""
552 if len(group.Models) > 0 {
553 models = fmt.Sprintf(" (%s)", strings.Join(group.Models, ", "))
554 }
555 fmt.Printf("%s%s\n", group.GroupType, models)
556 for _, limit := range group.Limits {
557 fmt.Printf(" %s: %d\n", limit.Type, limit.Value)
558 }
559 }
560 if err := rateLimits.Err(); err != nil {
561 log.Fatal(err)
562 }
563 ```
564
565 ```java Java
566 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
567
568 var rateLimits = client.beta().organization().workspaces().rateLimits()
569 .list("wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ");
570
571 for (var group : rateLimits.autoPager()) {
572 var models = group.models()
573 .map(modelIds -> " (" + String.join(", ", modelIds) + ")")
574 .orElse("");
575 IO.println(group.groupType().asString() + models);
576 for (var limit : group.limits()) {
577 IO.println(" " + limit.type() + ": " + limit.value());
578 }
579 }
580 ```
581
582 ```php PHP
583 $client = new Client();
584
585 $rateLimits = $client->beta->organization->workspaces->rateLimits->list(
586 workspaceID: 'wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ',
587 );
588
589 foreach ($rateLimits->data as $group) {
590 $models = $group->models ? ' (' . implode(', ', $group->models) . ')' : '';
591 echo "{$group->groupType}{$models}\n";
592 foreach ($group->limits as $limit) {
593 echo " {$limit->type}: {$limit->value}\n";
594 }
595 }
596 ```
597
598 ```ruby Ruby
599 client = Anthropic::Client.new
600
601 workspace_id = "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
602 rate_limits = client.beta.organization.workspaces.rate_limits.list(workspace_id)
603
604 rate_limits.data.each do |group|
605 models = group.models ? " (#{group.models.join(", ")})" : ""
606 puts "#{group.group_type}#{models}"
607 group.limits.each do |limit|
608 puts " #{limit.type}: #{limit.value}"
609 end
610 end
611 ```
612</CodeGroup>
127613
128614```json
129615{
from line 647
161647
162648Both endpoints accept an optional `group_type` query parameter that restricts the response to a single category:
163649
164```bash cURL
165curl "https://api.anthropic.com/v1/organizations/rate_limits?group_type=batch" \
166 --header "anthropic-version: 2023-06-01" \
167 --header "x-api-key: $ANTHROPIC_ADMIN_KEY"
168```
650<CodeGroup>
651 ```bash cURL
652 curl "https://api.anthropic.com/v1/organizations/rate_limits?group_type=batch" \
653 -H "x-api-key: $ANTHROPIC_API_KEY" \
654 -H "anthropic-version: 2023-06-01"
655 ```
656
657 ```bash CLI
658 ant beta:organization:rate-limits list --group-type batch
659 ```
660
661 ```python Python
662 client = anthropic.Anthropic()
663
664 rate_limits = client.beta.organization.rate_limits.list(group_type="batch")
665
666 for group in rate_limits:
667 models = f" ({', '.join(group.models)})" if group.models else ""
668 print(f"{group.group_type}{models}")
669 for limit in group.limits:
670 print(f" {limit.type}: {limit.value}")
671 ```
672
673 ```typescript TypeScript
674 const client = new Anthropic();
675
676 const rateLimits = await client.beta.organization.rateLimits.list({ group_type: "batch" });
677
678 for await (const group of rateLimits) {
679 const models = group.models ? ` (${group.models.join(", ")})` : "";
680 console.log(`${group.group_type}${models}`);
681 for (const limit of group.limits) {
682 console.log(` ${limit.type}: ${limit.value}`);
683 }
684 }
685 ```
686
687 ```csharp C#
688 using Anthropic.Models.Beta.Organization.RateLimits;
689
690 AnthropicClient client = new();
691
692 var rateLimits = await client.Beta.Organization.RateLimits.List(new()
693 {
694 GroupType = GroupType.Batch
695 });
696
697 await foreach (var group in rateLimits.Paginate())
698 {
699 var models = group.Models is null ? "" : $" ({string.Join(", ", group.Models)})";
700 Console.WriteLine($"{group.GroupType.Raw()}{models}");
701 foreach (var limit in group.Limits)
702 {
703 Console.WriteLine($" {limit.Type}: {limit.Value}");
704 }
705 }
706 ```
707
708 ```go Go
709 client := anthropic.NewClient()
710
711 rateLimits := client.Beta.Organization.RateLimits.ListAutoPaging(context.Background(), anthropic.BetaOrganizationRateLimitListParams{
712 GroupType: anthropic.BetaOrganizationRateLimitListParamsGroupTypeBatch,
713 })
714
715 for rateLimits.Next() {
716 group := rateLimits.Current()
717 models := ""
718 if len(group.Models) > 0 {
719 models = fmt.Sprintf(" (%s)", strings.Join(group.Models, ", "))
720 }
721 fmt.Printf("%s%s\n", group.GroupType, models)
722 for _, limit := range group.Limits {
723 fmt.Printf(" %s: %d\n", limit.Type, limit.Value)
724 }
725 }
726 if err := rateLimits.Err(); err != nil {
727 log.Fatal(err)
728 }
729 ```
730
731 ```java Java
732 import com.anthropic.models.beta.organization.ratelimits.RateLimitListParams;
733
734 void main() {
735 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
736
737 var params = RateLimitListParams.builder()
738 .groupType(RateLimitListParams.GroupType.BATCH)
739 .build();
740 var rateLimits = client.beta().organization().rateLimits().list(params);
741
742 for (var group : rateLimits.autoPager()) {
743 var models = group.models()
744 .map(modelIds -> " (" + String.join(", ", modelIds) + ")")
745 .orElse("");
746 IO.println(group.groupType().asString() + models);
747 for (var limit : group.limits()) {
748 IO.println(" " + limit.type() + ": " + limit.value());
749 }
750 }
751 }
752 ```
753
754 ```php PHP
755 use Anthropic\Beta\Organization\RateLimits\RateLimitListParams\GroupType;
756 // ...
757
758 $client = new Client();
759
760 $rateLimits = $client->beta->organization->rateLimits->list(
761 groupType: GroupType::BATCH,
762 );
763
764 foreach ($rateLimits->data as $group) {
765 $models = $group->models ? ' (' . implode(', ', $group->models) . ')' : '';
766 echo "{$group->groupType}{$models}\n";
767 foreach ($group->limits as $limit) {
768 echo " {$limit->type}: {$limit->value}\n";
769 }
770 }
771 ```
772
773 ```ruby Ruby
774 client = Anthropic::Client.new
775
776 rate_limits = client.beta.organization.rate_limits.list(group_type: :batch)
777
778 rate_limits.data.each do |group|
779 models = group.models ? " (#{group.models.join(", ")})" : ""
780 puts "#{group.group_type}#{models}"
781 group.limits.each do |limit|
782 puts " #{limit.type}: #{limit.value}"
783 end
784 end
785 ```
786</CodeGroup>
169787
170788Valid values are `model_group`, `batch`, `token_count`, `files`, `skills`, and `web_search`.
171789
172790
manage-claude/wif-admin-api Changed · +1149 / -82 lines
The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.
from line 12
1212
1313### Interactive (your terminal)
1414
15Log in with the [`ant` CLI](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/quickstart) under a dedicated profile, requesting the `org:admin` scope (see [Admin access](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/authentication#admin-access)), then export the bearer token:
15Log in with the [`ant` CLI](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/quickstart) under a dedicated profile, requesting the `org:admin` scope (see [Admin access](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/authentication#admin-access)), then export the bearer token. Logging in with `--profile admin` stores the `org:admin` credential under its own profile name and also makes it the CLI's active profile, and the exported variable applies to every SDK and CLI call in that shell; so use a shell you reserve for administration, unset the variable when you are done, and switch the CLI back with `ant profile activate default`:
1616
1717```bash CLI
1818ant auth login --profile admin --scope "org:admin"
19export ANTHROPIC_OAUTH_TOKEN=$(ant auth print-credentials --profile admin --access-token)
19export ANTHROPIC_AUTH_TOKEN=$(ant auth print-credentials --profile admin --access-token)
2020```
2121
2222Interactive tokens are short-lived; if requests start returning 401, re-run the export command (it refreshes the token automatically).
23
24The SDKs and the `ant` CLI read `ANTHROPIC_AUTH_TOKEN` automatically; leave `ANTHROPIC_API_KEY` unset in the same shell, because these endpoints reject API keys and some clients prefer the key when both are set.
2325
2426### Workload (CI and automation)
2527
from line 41
3941 </Step>
4042
4143 <Step title="Exchange the workload's identity token">
42 At runtime, the workload exchanges the JWT from its identity provider for a short-lived `org:admin` bearer token using the same [token exchange](https://platform.claude.com/docs/en/manage-claude/workload-identity-federation#authenticate-from-your-workload) as any other federated workload.
44 A workload that uses one of the SDKs or the `ant` CLI does not perform the exchange itself. Point the client at the rule with the federation environment variables and construct it with no arguments, exactly as for inference in [Construct the SDK client](https://platform.claude.com/docs/en/manage-claude/workload-identity-federation#construct-the-sdk-client); the client exchanges the identity token on the first request and, before the resulting access token expires, re-reads the identity token and exchanges it again:
45
46 ```bash
47 export ANTHROPIC_FEDERATION_RULE_ID=fdrl_... # the org:admin rule from step 1
48 export ANTHROPIC_ORGANIZATION_ID=00000000-0000-0000-0000-000000000000
49 export ANTHROPIC_SERVICE_ACCOUNT_ID=svac_... # the rule's target service account
50 export ANTHROPIC_IDENTITY_TOKEN_FILE=/path/to/jwt # or ANTHROPIC_IDENTITY_TOKEN
51 # ANTHROPIC_WORKSPACE_ID is required only if the rule is enabled for all
52 # workspaces or more than one; the org:admin endpoints ignore the binding.
53 unset ANTHROPIC_API_KEY ANTHROPIC_AUTH_TOKEN # both take precedence over federation
54 ```
55
56 The `ant` CLI reads the same variables, or takes `--federation-rule`, `--organization-id`, `--service-account-id`, and `--identity-token-file` flags. For a workload that runs more than one `ant` command, use a [federation profile](https://platform.claude.com/docs/en/manage-claude/wif-reference#profile-configuration-file) rather than flags or environment variables: with flags or variables the CLI exchanges the identity token again in every process, and identity tokens that carry a `jti` claim (GitHub Actions tokens do) are accepted only once, so a second command would be rejected; a profile is also the only way to give the CLI a `workspace_id` for the exchange when the rule is enabled for all workspaces or more than one, because unlike the SDKs the CLI does not pass `ANTHROPIC_WORKSPACE_ID` or `--workspace-id` into the exchange. Every SDK also accepts the same settings as explicit constructor arguments, shown per language in [Construct the SDK client](https://platform.claude.com/docs/en/manage-claude/workload-identity-federation#construct-the-sdk-client). See [Environment variables](https://platform.claude.com/docs/en/manage-claude/wif-reference#environment-variables) and [Credential precedence](https://platform.claude.com/docs/en/manage-claude/wif-reference#credential-precedence) for the full list and ordering.
57
58 A workload that calls the API with curl exchanges the JWT for a short-lived `org:admin` bearer token itself, using the same [token exchange](https://platform.claude.com/docs/en/manage-claude/workload-identity-federation#authenticate-from-your-workload) as any other federated workload, and sends it in the `authorization: Bearer` header.
4359 </Step>
4460
4561 <Step title="Manage issuers and workspace-scoped rules through the API">
46 With the minted token in `ANTHROPIC_OAUTH_TOKEN`, the workload creates and manages your federation configuration using the endpoints on this page.
62 With the client configured (or, for curl, the minted token in `ANTHROPIC_AUTH_TOKEN`), the workload creates and manages your federation configuration using the endpoints on this page.
4763 </Step>
4864</Steps>
4965
from line 69
5369
5470All endpoints live under `https://api.anthropic.com/v1/organizations/`. Every request to the federation and service-account endpoints needs the API version header and the bearer token:
5571
56```bash cURL
57curl --fail-with-body -sS "https://api.anthropic.com/v1/organizations/service_accounts" \
58 -H "anthropic-version: 2023-06-01" \
59 -H "authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
60```
72In the SDKs these endpoints are `client.beta.organization.service_accounts`, `client.beta.organization.federation.issuers`, and `client.beta.organization.federation.rules` (`ant beta:organization:service-accounts`, `federation:issuers`, and `federation:rules` in the CLI). The SDK and CLI examples construct the default client, which sends the bearer token from `ANTHROPIC_AUTH_TOKEN`, or, in an automated workload, performs the federation exchange itself as described in [Bootstrap a workload to manage WIF](https://platform.claude.com/docs/en/manage-claude/wif-admin-api#bootstrap-a-workload-to-manage-wif). SDK list methods fetch further pages on demand, so `limit` sets the page size; the PHP and Ruby examples read one page.
73
74<CodeGroup>
75 ```bash cURL
76 curl --fail-with-body -sS "https://api.anthropic.com/v1/organizations/service_accounts" \
77 -H "authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
78 -H "anthropic-version: 2023-06-01"
79 ```
80
81 ```bash CLI
82 ant beta:organization:service-accounts list
83 ```
84
85 ```python Python
86 client = anthropic.Anthropic()
87
88 service_accounts = client.beta.organization.service_accounts.list()
89
90 for service_account in service_accounts:
91 print(f"{service_account.id}: {service_account.name}")
92 ```
93
94 ```typescript TypeScript
95 const client = new Anthropic();
96
97 for await (const serviceAccount of client.beta.organization.serviceAccounts.list()) {
98 console.log(`${serviceAccount.id}: ${serviceAccount.name}`);
99 }
100 ```
101
102 ```csharp C#
103 AnthropicClient client = new();
104
105 var page = await client.Beta.Organization.ServiceAccounts.List();
106
107 await foreach (var serviceAccount in page.Paginate())
108 {
109 Console.WriteLine($"{serviceAccount.ID}: {serviceAccount.Name}");
110 }
111 ```
112
113 ```go Go
114 client := anthropic.NewClient()
115
116 serviceAccounts := client.Beta.Organization.ServiceAccounts.ListAutoPaging(context.Background(), anthropic.BetaOrganizationServiceAccountListParams{})
117
118 for serviceAccounts.Next() {
119 serviceAccount := serviceAccounts.Current()
120 fmt.Printf("%s: %s\n", serviceAccount.ID, serviceAccount.Name)
121 }
122 if err := serviceAccounts.Err(); err != nil {
123 log.Fatal(err)
124 }
125 ```
126
127 ```java Java
128 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
129
130 var serviceAccounts = client.beta().organization().serviceAccounts().list();
131
132 for (var serviceAccount : serviceAccounts.autoPager()) {
133 IO.println(serviceAccount.id() + ": " + serviceAccount.name());
134 }
135 ```
136
137 ```php PHP
138 $client = new Client();
139
140 $serviceAccounts = $client->beta->organization->serviceAccounts->list();
141
142 foreach ($serviceAccounts->getItems() as $serviceAccount) {
143 echo "{$serviceAccount->id}: {$serviceAccount->name}\n";
144 }
145 ```
146
147 ```ruby Ruby
148 client = Anthropic::Client.new
149
150 service_accounts = client.beta.organization.service_accounts.list
151
152 service_accounts.data.each do |service_account|
153 puts "#{service_account.id}: #{service_account.name}"
154 end
155 ```
156</CodeGroup>
61157
62158Admin API keys are not accepted on these endpoints; the Admin API page's `x-api-key` examples do not apply here.
63159
from line 161
65161
66162A [service account](https://platform.claude.com/docs/en/manage-claude/workload-identity-federation#service-accounts) (`svac_...`) is the non-human identity that a federated token acts as. Set `organization_role` to `developer`.
67163
68```bash cURL
69# Create a service account
70curl --fail-with-body -sS "https://api.anthropic.com/v1/organizations/service_accounts" \
71 -H "anthropic-version: 2023-06-01" \
72 -H "authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
73 -H "content-type: application/json" \
74 -d '{
75 "name": "inference-worker",
76 "organization_role": "developer"
77 }'
78
79# List service accounts
80curl --fail-with-body -sS "https://api.anthropic.com/v1/organizations/service_accounts?limit=20" \
81 -H "anthropic-version: 2023-06-01" \
82 -H "authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
83
84# Archive a service account
85curl --fail-with-body -sS -X POST "https://api.anthropic.com/v1/organizations/service_accounts/svac_.../archive" \
86 -H "anthropic-version: 2023-06-01" \
87 -H "authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
88```
164Create a service account:
165
166<CodeGroup>
167 ```bash cURL
168 curl --fail-with-body -sS "https://api.anthropic.com/v1/organizations/service_accounts" \
169 -H "authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
170 -H "anthropic-version: 2023-06-01" \
171 -H "content-type: application/json" \
172 -d '{
173 "name": "inference-worker",
174 "organization_role": "developer"
175 }'
176 ```
177
178 ```bash CLI
179 ant beta:organization:service-accounts create \
180 --name inference-worker \
181 --organization-role developer
182 ```
183
184 ```python Python
185 client = anthropic.Anthropic()
186
187 service_account = client.beta.organization.service_accounts.create(
188 name="inference-worker", organization_role="developer"
189 )
190
191 print(f"id: {service_account.id}")
192 print(f"name: {service_account.name}")
193 ```
194
195 ```typescript TypeScript
196 const client = new Anthropic();
197
198 const serviceAccount = await client.beta.organization.serviceAccounts.create({
199 name: "inference-worker",
200 organization_role: "developer"
201 });
202
203 console.log(`id: ${serviceAccount.id}`);
204 console.log(`name: ${serviceAccount.name}`);
205 ```
206
207 ```csharp C#
208 using Anthropic.Models.Beta.Organization.ServiceAccounts;
209
210 AnthropicClient client = new();
211
212 var serviceAccount = await client.Beta.Organization.ServiceAccounts.Create(new()
213 {
214 Name = "inference-worker",
215 OrganizationRole = OrganizationRole.Developer
216 });
217
218 Console.WriteLine($"id: {serviceAccount.ID}");
219 Console.WriteLine($"name: {serviceAccount.Name}");
220 ```
221
222 ```go Go
223 client := anthropic.NewClient()
224
225 serviceAccount, err := client.Beta.Organization.ServiceAccounts.New(context.Background(), anthropic.BetaOrganizationServiceAccountNewParams{
226 Name: "inference-worker",
227 OrganizationRole: anthropic.BetaOrganizationServiceAccountNewParamsOrganizationRoleDeveloper,
228 })
229 if err != nil {
230 log.Fatal(err)
231 }
232
233 fmt.Printf("id: %s\n", serviceAccount.ID)
234 fmt.Printf("name: %s\n", serviceAccount.Name)
235 ```
236
237 ```java Java
238 import com.anthropic.models.beta.organization.serviceaccounts.ServiceAccountCreateParams;
239
240 void main() {
241 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
242
243 var params = ServiceAccountCreateParams.builder()
244 .name("inference-worker")
245 .organizationRole(ServiceAccountCreateParams.OrganizationRole.DEVELOPER)
246 .build();
247 var serviceAccount = client.beta().organization().serviceAccounts().create(params);
248
249 IO.println("id: " + serviceAccount.id());
250 IO.println("name: " + serviceAccount.name());
251 }
252 ```
253
254 ```php PHP
255 use Anthropic\Beta\Organization\ServiceAccounts\ServiceAccountCreateParams\OrganizationRole;
256 // ...
257
258 $client = new Client();
259
260 $serviceAccount = $client->beta->organization->serviceAccounts->create(
261 name: 'inference-worker',
262 organizationRole: OrganizationRole::DEVELOPER,
263 );
264
265 echo "id: {$serviceAccount->id}\n";
266 echo "name: {$serviceAccount->name}\n";
267 ```
268
269 ```ruby Ruby
270 client = Anthropic::Client.new
271
272 service_account = client.beta.organization.service_accounts.create(
273 name: "inference-worker",
274 organization_role: :developer
275 )
276
277 puts "id: #{service_account.id}"
278 puts "name: #{service_account.name}"
279 ```
280</CodeGroup>
281
282List service accounts:
283
284<CodeGroup>
285 ```bash cURL
286 curl --fail-with-body -sS "https://api.anthropic.com/v1/organizations/service_accounts?limit=20" \
287 -H "authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
288 -H "anthropic-version: 2023-06-01"
289 ```
290
291 ```bash CLI
292 ant beta:organization:service-accounts list --limit 20
293 ```
294
295 ```python Python
296 client = anthropic.Anthropic()
297
298 service_accounts = client.beta.organization.service_accounts.list(limit=20)
299
300 for service_account in service_accounts:
301 print(f"{service_account.id}: {service_account.name}")
302 ```
303
304 ```typescript TypeScript
305 const client = new Anthropic();
306
307 for await (const serviceAccount of client.beta.organization.serviceAccounts.list({
308 limit: 20
309 })) {
310 console.log(`${serviceAccount.id}: ${serviceAccount.name}`);
311 }
312 ```
313
314 ```csharp C#
315 AnthropicClient client = new();
316
317 var page = await client.Beta.Organization.ServiceAccounts.List(new() { Limit = 20 });
318
319 await foreach (var serviceAccount in page.Paginate())
320 {
321 Console.WriteLine($"{serviceAccount.ID}: {serviceAccount.Name}");
322 }
323 ```
324
325 ```go Go
326 client := anthropic.NewClient()
327
328 serviceAccounts := client.Beta.Organization.ServiceAccounts.ListAutoPaging(context.Background(), anthropic.BetaOrganizationServiceAccountListParams{
329 Limit: anthropic.Int(20),
330 })
331
332 for serviceAccounts.Next() {
333 serviceAccount := serviceAccounts.Current()
334 fmt.Printf("%s: %s\n", serviceAccount.ID, serviceAccount.Name)
335 }
336 if err := serviceAccounts.Err(); err != nil {
337 log.Fatal(err)
338 }
339 ```
340
341 ```java Java
342 import com.anthropic.models.beta.organization.serviceaccounts.ServiceAccountListParams;
343
344 void main() {
345 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
346
347 var params = ServiceAccountListParams.builder()
348 .limit(20)
349 .build();
350 var serviceAccounts = client.beta().organization().serviceAccounts().list(params);
351
352 for (var serviceAccount : serviceAccounts.autoPager()) {
353 IO.println(serviceAccount.id() + ": " + serviceAccount.name());
354 }
355 }
356 ```
357
358 ```php PHP
359 $client = new Client();
360
361 $serviceAccounts = $client->beta->organization->serviceAccounts->list(limit: 20);
362
363 foreach ($serviceAccounts->getItems() as $serviceAccount) {
364 echo "{$serviceAccount->id}: {$serviceAccount->name}\n";
365 }
366 ```
367
368 ```ruby Ruby
369 client = Anthropic::Client.new
370
371 service_accounts = client.beta.organization.service_accounts.list(limit: 20)
372
373 service_accounts.data.each do |service_account|
374 puts "#{service_account.id}: #{service_account.name}"
375 end
376 ```
377</CodeGroup>
378
379Archive a service account:
380
381<CodeGroup>
382 ```bash cURL
383 curl --fail-with-body -sS -X POST "https://api.anthropic.com/v1/organizations/service_accounts/svac_01ABCDEFabcdef0123456789XY/archive" \
384 -H "authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
385 -H "anthropic-version: 2023-06-01"
386 ```
387
388 ```bash CLI
389 ant beta:organization:service-accounts archive svac_01ABCDEFabcdef0123456789XY
390 ```
391
392 ```python Python
393 client = anthropic.Anthropic()
394
395 service_account = client.beta.organization.service_accounts.archive(
396 "svac_01ABCDEFabcdef0123456789XY"
397 )
398
399 print(f"id: {service_account.id}")
400 print(f"archived_at: {service_account.archived_at}")
401 ```
402
403 ```typescript TypeScript
404 const client = new Anthropic();
405
406 const serviceAccount = await client.beta.organization.serviceAccounts.archive(
407 "svac_01ABCDEFabcdef0123456789XY"
408 );
409
410 console.log(`id: ${serviceAccount.id}`);
411 console.log(`archived_at: ${serviceAccount.archived_at}`);
412 ```
413
414 ```csharp C#
415 AnthropicClient client = new();
416
417 var serviceAccount = await client.Beta.Organization.ServiceAccounts.Archive(
418 "svac_01ABCDEFabcdef0123456789XY"
419 );
420
421 Console.WriteLine($"id: {serviceAccount.ID}");
422 Console.WriteLine($"archived_at: {serviceAccount.ArchivedAt:O}");
423 ```
424
425 ```go Go
426 client := anthropic.NewClient()
427
428 serviceAccount, err := client.Beta.Organization.ServiceAccounts.Archive(
429 context.Background(),
430 "svac_01ABCDEFabcdef0123456789XY",
431 anthropic.BetaOrganizationServiceAccountArchiveParams{},
432 )
433 if err != nil {
434 log.Fatal(err)
435 }
436
437 fmt.Printf("id: %s\n", serviceAccount.ID)
438 fmt.Printf("archived_at: %s\n", serviceAccount.ArchivedAt)
439 ```
440
441 ```java Java
442 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
443
444 var serviceAccount = client.beta().organization().serviceAccounts()
445 .archive("svac_01ABCDEFabcdef0123456789XY");
446
447 IO.println("id: " + serviceAccount.id());
448 IO.println("archived_at: " + serviceAccount.archivedAt().orElseThrow());
449 ```
450
451 ```php PHP
452 $client = new Client();
453
454 $serviceAccount = $client->beta->organization->serviceAccounts->archive(
455 serviceAccountID: 'svac_01ABCDEFabcdef0123456789XY',
456 );
457
458 echo "id: {$serviceAccount->id}\n";
459 echo "archived_at: {$serviceAccount->archivedAt?->format(DATE_ATOM)}\n";
460 ```
461
462 ```ruby Ruby
463 client = Anthropic::Client.new
464
465 service_account_id = "svac_01ABCDEFabcdef0123456789XY"
466 service_account = client.beta.organization.service_accounts.archive(service_account_id)
467
468 puts "id: #{service_account.id}"
469 puts "archived_at: #{service_account.archived_at}"
470 ```
471</CodeGroup>
89472
90473The create endpoint returns the new service account:
91474
from line 497
114497| `{"type": "explicit_url", "url": "..."}` | Point at a JWKS endpoint directly. |
115498| `{"type": "inline", "keys": [...]}` | Upload the key set for providers that are not reachable from the public internet. |
116499
117```bash cURL
118# Register an issuer (GitHub Actions, with JWKS discovery)
119curl --fail-with-body -sS "https://api.anthropic.com/v1/organizations/federation_issuers" \
120 -H "anthropic-version: 2023-06-01" \
121 -H "authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
122 -H "content-type: application/json" \
123 -d '{
124 "name": "github-actions",
125 "issuer_url": "https://token.actions.githubusercontent.com",
126 "jwks": {"type": "discovery"}
127 }'
128
129# List issuers
130curl --fail-with-body -sS "https://api.anthropic.com/v1/organizations/federation_issuers?limit=20" \
131 -H "anthropic-version: 2023-06-01" \
132 -H "authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
133
134# Archive an issuer
135curl --fail-with-body -sS -X POST "https://api.anthropic.com/v1/organizations/federation_issuers/fdis_.../archive" \
136 -H "anthropic-version: 2023-06-01" \
137 -H "authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
138```
500Register an issuer. This example registers GitHub Actions with JWKS discovery:
501
502<CodeGroup>
503 ```bash cURL
504 curl --fail-with-body -sS "https://api.anthropic.com/v1/organizations/federation_issuers" \
505 -H "authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
506 -H "anthropic-version: 2023-06-01" \
507 -H "content-type: application/json" \
508 -d '{
509 "name": "github-actions",
510 "issuer_url": "https://token.actions.githubusercontent.com",
511 "jwks": {"type": "discovery"}
512 }'
513 ```
514
515 ```bash CLI
516 ant beta:organization:federation:issuers create \
517 --name github-actions \
518 --issuer-url https://token.actions.githubusercontent.com \
519 --jwks '{type: discovery}'
520 ```
521
522 ```python Python
523 client = anthropic.Anthropic()
524
525 issuer = client.beta.organization.federation.issuers.create(
526 name="github-actions",
527 issuer_url="https://token.actions.githubusercontent.com",
528 jwks={"type": "discovery"},
529 )
530
531 print(f"id: {issuer.id}")
532 print(f"name: {issuer.name}")
533 print(f"issuer_url: {issuer.issuer_url}")
534 ```
535
536 ```typescript TypeScript
537 const client = new Anthropic();
538
539 const issuer = await client.beta.organization.federation.issuers.create({
540 name: "github-actions",
541 issuer_url: "https://token.actions.githubusercontent.com",
542 jwks: { type: "discovery" }
543 });
544
545 console.log(`id: ${issuer.id}`);
546 console.log(`name: ${issuer.name}`);
547 console.log(`issuer_url: ${issuer.issuer_url}`);
548 ```
549
550 ```csharp C#
551 using Anthropic.Models.Beta.Organization.Federation.Issuers;
552
553 AnthropicClient client = new();
554
555 var issuer = await client.Beta.Organization.Federation.Issuers.Create(new()
556 {
557 Name = "github-actions",
558 IssuerUrl = "https://token.actions.githubusercontent.com",
559 Jwks = new BetaJwksDiscovery()
560 });
561
562 Console.WriteLine($"id: {issuer.ID}");
563 Console.WriteLine($"name: {issuer.Name}");
564 Console.WriteLine($"issuer_url: {issuer.IssuerUrl}");
565 ```
566
567 ```go Go
568 client := anthropic.NewClient()
569
570 issuer, err := client.Beta.Organization.Federation.Issuers.New(context.Background(), anthropic.BetaOrganizationFederationIssuerNewParams{
571 Name: "github-actions",
572 IssuerURL: "https://token.actions.githubusercontent.com",
573 JWKS: anthropic.BetaOrganizationFederationIssuerNewParamsJWKSUnion{
574 OfDiscovery: &anthropic.BetaJWKSDiscoveryParam{},
575 },
576 })
577 if err != nil {
578 log.Fatal(err)
579 }
580
581 fmt.Printf("id: %s\n", issuer.ID)
582 fmt.Printf("name: %s\n", issuer.Name)
583 fmt.Printf("issuer_url: %s\n", issuer.IssuerURL)
584 ```
585
586 ```java Java
587 import com.anthropic.models.beta.organization.federation.issuers.BetaJwksDiscovery;
588 import com.anthropic.models.beta.organization.federation.issuers.IssuerCreateParams;
589
590 void main() {
591 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
592
593 var params = IssuerCreateParams.builder()
594 .name("github-actions")
595 .issuerUrl("https://token.actions.githubusercontent.com")
596 .jwks(BetaJwksDiscovery.builder().build())
597 .build();
598 var issuer = client.beta().organization().federation().issuers().create(params);
599
600 IO.println("id: " + issuer.id());
601 IO.println("name: " + issuer.name());
602 IO.println("issuer_url: " + issuer.issuerUrl());
603 }
604 ```
605
606 ```php PHP
607 $client = new Client();
608
609 $issuer = $client->beta->organization->federation->issuers->create(
610 name: 'github-actions',
611 issuerURL: 'https://token.actions.githubusercontent.com',
612 jwks: ['type' => 'discovery'],
613 );
614
615 echo "id: {$issuer->id}\n";
616 echo "name: {$issuer->name}\n";
617 echo "issuer_url: {$issuer->issuerURL}\n";
618 ```
619
620 ```ruby Ruby
621 client = Anthropic::Client.new
622
623 issuer = client.beta.organization.federation.issuers.create(
624 name: "github-actions",
625 issuer_url: "https://token.actions.githubusercontent.com",
626 jwks: {type: :discovery}
627 )
628
629 puts "id: #{issuer.id}"
630 puts "name: #{issuer.name}"
631 puts "issuer_url: #{issuer.issuer_url}"
632 ```
633</CodeGroup>
634
635List issuers:
636
637<CodeGroup>
638 ```bash cURL
639 curl --fail-with-body -sS "https://api.anthropic.com/v1/organizations/federation_issuers?limit=20" \
640 -H "authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
641 -H "anthropic-version: 2023-06-01"
642 ```
643
644 ```bash CLI
645 ant beta:organization:federation:issuers list --limit 20
646 ```
647
648 ```python Python
649 client = anthropic.Anthropic()
650
651 issuers = client.beta.organization.federation.issuers.list(limit=20)
652
653 for issuer in issuers:
654 print(f"{issuer.id}: {issuer.name}")
655 ```
656
657 ```typescript TypeScript
658 const client = new Anthropic();
659
660 for await (const issuer of client.beta.organization.federation.issuers.list({ limit: 20 })) {
661 console.log(`${issuer.id}: ${issuer.name}`);
662 }
663 ```
664
665 ```csharp C#
666 AnthropicClient client = new();
667
668 var page = await client.Beta.Organization.Federation.Issuers.List(new() { Limit = 20 });
669
670 await foreach (var issuer in page.Paginate())
671 {
672 Console.WriteLine($"{issuer.ID}: {issuer.Name}");
673 }
674 ```
675
676 ```go Go
677 client := anthropic.NewClient()
678
679 issuers := client.Beta.Organization.Federation.Issuers.ListAutoPaging(context.Background(), anthropic.BetaOrganizationFederationIssuerListParams{
680 Limit: anthropic.Int(20),
681 })
682
683 for issuers.Next() {
684 issuer := issuers.Current()
685 fmt.Printf("%s: %s\n", issuer.ID, issuer.Name)
686 }
687 if err := issuers.Err(); err != nil {
688 log.Fatal(err)
689 }
690 ```
691
692 ```java Java
693 import com.anthropic.models.beta.organization.federation.issuers.IssuerListParams;
694
695 void main() {
696 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
697
698 var params = IssuerListParams.builder()
699 .limit(20)
700 .build();
701 var issuers = client.beta().organization().federation().issuers().list(params);
702
703 for (var issuer : issuers.autoPager()) {
704 IO.println(issuer.id() + ": " + issuer.name());
705 }
706 }
707 ```
708
709 ```php PHP
710 $client = new Client();
711
712 $issuers = $client->beta->organization->federation->issuers->list(limit: 20);
713
714 foreach ($issuers->getItems() as $issuer) {
715 echo "{$issuer->id}: {$issuer->name}\n";
716 }
717 ```
718
719 ```ruby Ruby
720 client = Anthropic::Client.new
721
722 issuers = client.beta.organization.federation.issuers.list(limit: 20)
723
724 issuers.data.each do |issuer|
725 puts "#{issuer.id}: #{issuer.name}"
726 end
727 ```
728</CodeGroup>
729
730Archive an issuer:
731
732<CodeGroup>
733 ```bash cURL
734 curl --fail-with-body -sS -X POST "https://api.anthropic.com/v1/organizations/federation_issuers/fdis_01ABCDEFabcdef0123456789XY/archive" \
735 -H "authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
736 -H "anthropic-version: 2023-06-01"
737 ```
738
739 ```bash CLI
740 ant beta:organization:federation:issuers archive \
741 --federation-issuer-id fdis_01ABCDEFabcdef0123456789XY
742 ```
743
744 ```python Python
745 client = anthropic.Anthropic()
746
747 issuer = client.beta.organization.federation.issuers.archive(
748 "fdis_01ABCDEFabcdef0123456789XY"
749 )
750
751 print(f"id: {issuer.id}")
752 print(f"archived_at: {issuer.archived_at}")
753 ```
754
755 ```typescript TypeScript
756 const client = new Anthropic();
757
758 const issuer = await client.beta.organization.federation.issuers.archive(
759 "fdis_01ABCDEFabcdef0123456789XY"
760 );
761
762 console.log(`id: ${issuer.id}`);
763 console.log(`archived_at: ${issuer.archived_at}`);
764 ```
765
766 ```csharp C#
767 AnthropicClient client = new();
768
769 var issuer = await client.Beta.Organization.Federation.Issuers.Archive(
770 "fdis_01ABCDEFabcdef0123456789XY"
771 );
772
773 Console.WriteLine($"id: {issuer.ID}");
774 Console.WriteLine($"archived_at: {issuer.ArchivedAt:O}");
775 ```
776
777 ```go Go
778 client := anthropic.NewClient()
779
780 issuer, err := client.Beta.Organization.Federation.Issuers.Archive(
781 context.Background(),
782 "fdis_01ABCDEFabcdef0123456789XY",
783 anthropic.BetaOrganizationFederationIssuerArchiveParams{},
784 )
785 if err != nil {
786 log.Fatal(err)
787 }
788
789 fmt.Printf("id: %s\n", issuer.ID)
790 fmt.Printf("archived_at: %s\n", issuer.ArchivedAt)
791 ```
792
793 ```java Java
794 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
795
796 var issuer = client.beta().organization().federation().issuers()
797 .archive("fdis_01ABCDEFabcdef0123456789XY");
798
799 IO.println("id: " + issuer.id());
800 IO.println("archived_at: " + issuer.archivedAt().orElseThrow());
801 ```
802
803 ```php PHP
804 $client = new Client();
805
806 $issuer = $client->beta->organization->federation->issuers->archive(
807 federationIssuerID: 'fdis_01ABCDEFabcdef0123456789XY',
808 );
809
810 echo "id: {$issuer->id}\n";
811 echo "archived_at: {$issuer->archivedAt?->format(DATE_ATOM)}\n";
812 ```
813
814 ```ruby Ruby
815 client = Anthropic::Client.new
816
817 issuer_id = "fdis_01ABCDEFabcdef0123456789XY"
818 issuer = client.beta.organization.federation.issuers.archive(issuer_id)
819
820 puts "id: #{issuer.id}"
821 puts "archived_at: #{issuer.archived_at}"
822 ```
823</CodeGroup>
139824
140825To read or update a single issuer, use `GET` and `POST` on `/v1/organizations/federation_issuers/{issuer_id}`. An OAuth caller cannot update an issuer that backs a rule whose `oauth_scope` is anything other than `workspace:developer` or `workspace:inference`; see [Permissions and constraints](https://platform.claude.com/docs/en/manage-claude/wif-admin-api#permissions-and-constraints).
141826
from line 830
145830
146831A [federation rule](https://platform.claude.com/docs/en/manage-claude/workload-identity-federation#federation-rules) (`fdrl_...`) binds an issuer to a service account: JWTs from the issuer that satisfy the rule's match conditions can mint tokens that act as the rule's target. The `workspace_id` in the create request enables the rule in that workspace at creation; add more workspaces later through the `/federation_rules/{rule_id}/workspaces` sub-resource. Either `workspace_id` or `applies_to_all_workspaces: true` is required on create.
147832
148```bash cURL
149# Create a rule (GitHub Actions deploys from the main branch)
150curl --fail-with-body -sS "https://api.anthropic.com/v1/organizations/federation_rules" \
151 -H "anthropic-version: 2023-06-01" \
152 -H "authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
153 -H "content-type: application/json" \
154 -d '{
155 "name": "gha-deploy",
156 "issuer_id": "fdis_...",
157 "match": {
158 "subject_prefix": "repo:my-org/my-repo:ref:refs/heads/main",
159 "claims": {"repository_owner": "my-org"}
833Create a rule. This example lets GitHub Actions deploys from the main branch act as the service account:
834
835<CodeGroup>
836 ```bash cURL
837 curl --fail-with-body -sS "https://api.anthropic.com/v1/organizations/federation_rules" \
838 -H "authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
839 -H "anthropic-version: 2023-06-01" \
840 -H "content-type: application/json" \
841 -d '{
842 "name": "gha-deploy",
843 "issuer_id": "fdis_01ABCDEFabcdef0123456789XY",
844 "match": {
845 "subject_prefix": "repo:my-org/my-repo:ref:refs/heads/main",
846 "claims": {"repository_owner": "my-org"}
847 },
848 "target": {
849 "type": "service_account",
850 "service_account_id": "svac_01ABCDEFabcdef0123456789XY"
851 },
852 "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
853 "oauth_scope": "workspace:developer",
854 "token_lifetime_seconds": 600
855 }'
856 ```
857
858 ```bash CLI
859 ant beta:organization:federation:rules create <<'YAML'
860 name: gha-deploy
861 issuer_id: fdis_01ABCDEFabcdef0123456789XY
862 match:
863 subject_prefix: "repo:my-org/my-repo:ref:refs/heads/main"
864 claims:
865 repository_owner: my-org
866 target:
867 type: service_account
868 service_account_id: svac_01ABCDEFabcdef0123456789XY
869 workspace_id: wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ
870 oauth_scope: "workspace:developer"
871 token_lifetime_seconds: 600
872 YAML
873 ```
874
875 ```python Python
876 client = anthropic.Anthropic()
877
878 rule = client.beta.organization.federation.rules.create(
879 name="gha-deploy",
880 issuer_id="fdis_01ABCDEFabcdef0123456789XY",
881 match={
882 "subject_prefix": "repo:my-org/my-repo:ref:refs/heads/main",
883 "claims": {"repository_owner": "my-org"},
884 },
885 target={
886 "type": "service_account",
887 "service_account_id": "svac_01ABCDEFabcdef0123456789XY",
888 },
889 workspace_id="wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
890 oauth_scope="workspace:developer",
891 token_lifetime_seconds=600,
892 )
893
894 print(f"id: {rule.id}")
895 print(f"name: {rule.name}")
896 ```
897
898 ```typescript TypeScript
899 const client = new Anthropic();
900
901 const rule = await client.beta.organization.federation.rules.create({
902 name: "gha-deploy",
903 issuer_id: "fdis_01ABCDEFabcdef0123456789XY",
904 match: {
905 subject_prefix: "repo:my-org/my-repo:ref:refs/heads/main",
906 claims: { repository_owner: "my-org" }
160907 },
161 "target": {
162 "type": "service_account",
163 "service_account_id": "svac_..."
908 target: {
909 type: "service_account",
910 service_account_id: "svac_01ABCDEFabcdef0123456789XY"
164911 },
165 "workspace_id": "wrkspc_...",
166 "oauth_scope": "workspace:developer",
167 "token_lifetime_seconds": 600
168 }'
169
170# List rules, optionally filtered by issuer
171curl --fail-with-body -sS "https://api.anthropic.com/v1/organizations/federation_rules?issuer_id=fdis_..." \
172 -H "anthropic-version: 2023-06-01" \
173 -H "authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
174
175# Archive a rule
176curl --fail-with-body -sS -X POST "https://api.anthropic.com/v1/organizations/federation_rules/fdrl_.../archive" \
177 -H "anthropic-version: 2023-06-01" \
178 -H "authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
179```
912 workspace_id: "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
913 oauth_scope: "workspace:developer",
914 token_lifetime_seconds: 600
915 });
916
917 console.log(`id: ${rule.id}`);
918 console.log(`name: ${rule.name}`);
919 ```
920
921 ```csharp C#
922 AnthropicClient client = new();
923
924 var rule = await client.Beta.Organization.Federation.Rules.Create(new()
925 {
926 Name = "gha-deploy",
927 IssuerID = "fdis_01ABCDEFabcdef0123456789XY",
928 Match = new()
929 {
930 SubjectPrefix = "repo:my-org/my-repo:ref:refs/heads/main",
931 Claims = new Dictionary<string, string> { ["repository_owner"] = "my-org" }
932 },
933 Target = new() { ServiceAccountID = "svac_01ABCDEFabcdef0123456789XY" },
934 WorkspaceID = "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
935 OAuthScope = "workspace:developer",
936 TokenLifetimeSeconds = 600
937 });
938
939 Console.WriteLine($"id: {rule.ID}");
940 Console.WriteLine($"name: {rule.Name}");
941 ```
942
943 ```go Go
944 client := anthropic.NewClient()
945
946 rule, err := client.Beta.Organization.Federation.Rules.New(context.Background(), anthropic.BetaOrganizationFederationRuleNewParams{
947 Name: "gha-deploy",
948 IssuerID: "fdis_01ABCDEFabcdef0123456789XY",
949 Match: anthropic.BetaFederationRuleMatchParam{
950 SubjectPrefix: anthropic.String("repo:my-org/my-repo:ref:refs/heads/main"),
951 Claims: map[string]string{"repository_owner": "my-org"},
952 },
953 Target: anthropic.BetaServiceAccountTargetParam{
954 ServiceAccountID: "svac_01ABCDEFabcdef0123456789XY",
955 },
956 WorkspaceID: anthropic.String("wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"),
957 OAuthScope: "workspace:developer",
958 TokenLifetimeSeconds: anthropic.Int(600),
959 })
960 if err != nil {
961 log.Fatal(err)
962 }
963
964 fmt.Printf("id: %s\n", rule.ID)
965 fmt.Printf("name: %s\n", rule.Name)
966 ```
967
968 ```java Java
969 import com.anthropic.core.JsonValue;
970 import com.anthropic.models.beta.organization.federation.rules.BetaFederationRuleMatch;
971 import com.anthropic.models.beta.organization.federation.rules.BetaServiceAccountTarget;
972 import com.anthropic.models.beta.organization.federation.rules.RuleCreateParams;
973
974 void main() {
975 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
976
977 var match = BetaFederationRuleMatch.builder()
978 .subjectPrefix("repo:my-org/my-repo:ref:refs/heads/main")
979 .claims(BetaFederationRuleMatch.Claims.builder()
980 .putAdditionalProperty("repository_owner", JsonValue.from("my-org"))
981 .build())
982 .build();
983 var params = RuleCreateParams.builder()
984 .name("gha-deploy")
985 .issuerId("fdis_01ABCDEFabcdef0123456789XY")
986 .match(match)
987 .target(BetaServiceAccountTarget.of("svac_01ABCDEFabcdef0123456789XY"))
988 .workspaceId("wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ")
989 .oauthScope("workspace:developer")
990 .tokenLifetimeSeconds(600)
991 .build();
992 var rule = client.beta().organization().federation().rules().create(params);
993
994 IO.println("id: " + rule.id());
995 IO.println("name: " + rule.name());
996 }
997 ```
998
999 ```php PHP
1000 $client = new Client();
1001
1002 $rule = $client->beta->organization->federation->rules->create(
1003 name: 'gha-deploy',
1004 issuerID: 'fdis_01ABCDEFabcdef0123456789XY',
1005 match: [
1006 'subjectPrefix' => 'repo:my-org/my-repo:ref:refs/heads/main',
1007 'claims' => ['repository_owner' => 'my-org'],
1008 ],
1009 target: [
1010 'type' => 'service_account',
1011 'serviceAccountID' => 'svac_01ABCDEFabcdef0123456789XY',
1012 ],
1013 workspaceID: 'wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ',
1014 oauthScope: 'workspace:developer',
1015 tokenLifetimeSeconds: 600,
1016 );
1017
1018 echo "id: {$rule->id}\n";
1019 echo "name: {$rule->name}\n";
1020 ```
1021
1022 ```ruby Ruby
1023 client = Anthropic::Client.new
1024
1025 rule = client.beta.organization.federation.rules.create(
1026 name: "gha-deploy",
1027 issuer_id: "fdis_01ABCDEFabcdef0123456789XY",
1028 match: {
1029 subject_prefix: "repo:my-org/my-repo:ref:refs/heads/main",
1030 claims: {repository_owner: "my-org"}
1031 },
1032 target: {
1033 type: :service_account,
1034 service_account_id: "svac_01ABCDEFabcdef0123456789XY"
1035 },
1036 workspace_id: "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
1037 oauth_scope: "workspace:developer",
1038 token_lifetime_seconds: 600
1039 )
1040
1041 puts "id: #{rule.id}"
1042 puts "name: #{rule.name}"
1043 ```
1044</CodeGroup>
1045
1046List rules, optionally filtered by issuer:
1047
1048<CodeGroup>
1049 ```bash cURL
1050 curl --fail-with-body -sS "https://api.anthropic.com/v1/organizations/federation_rules?issuer_id=fdis_01ABCDEFabcdef0123456789XY" \
1051 -H "authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
1052 -H "anthropic-version: 2023-06-01"
1053 ```
1054
1055 ```bash CLI
1056 ant beta:organization:federation:rules list \
1057 --issuer-id fdis_01ABCDEFabcdef0123456789XY
1058 ```
1059
1060 ```python Python
1061 client = anthropic.Anthropic()
1062
1063 rules = client.beta.organization.federation.rules.list(
1064 issuer_id="fdis_01ABCDEFabcdef0123456789XY"
1065 )
1066
1067 for rule in rules:
1068 print(f"{rule.id}: {rule.name}")
1069 ```
1070
1071 ```typescript TypeScript
1072 const client = new Anthropic();
1073
1074 for await (const rule of client.beta.organization.federation.rules.list({
1075 issuer_id: "fdis_01ABCDEFabcdef0123456789XY"
1076 })) {
1077 console.log(`${rule.id}: ${rule.name}`);
1078 }
1079 ```
1080
1081 ```csharp C#
1082 AnthropicClient client = new();
1083
1084 var page = await client.Beta.Organization.Federation.Rules.List(new()
1085 {
1086 IssuerID = "fdis_01ABCDEFabcdef0123456789XY"
1087 });
1088
1089 await foreach (var rule in page.Paginate())
1090 {
1091 Console.WriteLine($"{rule.ID}: {rule.Name}");
1092 }
1093 ```
1094
1095 ```go Go
1096 client := anthropic.NewClient()
1097
1098 rules := client.Beta.Organization.Federation.Rules.ListAutoPaging(context.Background(), anthropic.BetaOrganizationFederationRuleListParams{
1099 IssuerID: anthropic.String("fdis_01ABCDEFabcdef0123456789XY"),
1100 })
1101
1102 for rules.Next() {
1103 rule := rules.Current()
1104 fmt.Printf("%s: %s\n", rule.ID, rule.Name)
1105 }
1106 if err := rules.Err(); err != nil {
1107 log.Fatal(err)
1108 }
1109 ```
1110
1111 ```java Java
1112 import com.anthropic.models.beta.organization.federation.rules.RuleListParams;
1113
1114 void main() {
1115 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
1116
1117 var params = RuleListParams.builder()
1118 .issuerId("fdis_01ABCDEFabcdef0123456789XY")
1119 .build();
1120 var rules = client.beta().organization().federation().rules().list(params);
1121
1122 for (var rule : rules.autoPager()) {
1123 IO.println(rule.id() + ": " + rule.name());
1124 }
1125 }
1126 ```
1127
1128 ```php PHP
1129 $client = new Client();
1130
1131 $rules = $client->beta->organization->federation->rules->list(
1132 issuerID: 'fdis_01ABCDEFabcdef0123456789XY',
1133 );
1134
1135 foreach ($rules->getItems() as $rule) {
1136 echo "{$rule->id}: {$rule->name}\n";
1137 }
1138 ```
1139
1140 ```ruby Ruby
1141 client = Anthropic::Client.new
1142
1143 rules = client.beta.organization.federation.rules.list(
1144 issuer_id: "fdis_01ABCDEFabcdef0123456789XY"
1145 )
1146
1147 rules.data.each do |rule|
1148 puts "#{rule.id}: #{rule.name}"
1149 end
1150 ```
1151</CodeGroup>
1152
1153Archive a rule:
1154
1155<CodeGroup>
1156 ```bash cURL
1157 curl --fail-with-body -sS -X POST "https://api.anthropic.com/v1/organizations/federation_rules/fdrl_01ABCDEFabcdef0123456789XY/archive" \
1158 -H "authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
1159 -H "anthropic-version: 2023-06-01"
1160 ```
1161
1162 ```bash CLI
1163 ant beta:organization:federation:rules archive \
1164 --federation-rule-id fdrl_01ABCDEFabcdef0123456789XY
1165 ```
1166
1167 ```python Python
1168 client = anthropic.Anthropic()
1169
1170 rule = client.beta.organization.federation.rules.archive(
1171 "fdrl_01ABCDEFabcdef0123456789XY"
1172 )
1173
1174 print(f"id: {rule.id}")
1175 print(f"archived_at: {rule.archived_at}")
1176 ```
1177
1178 ```typescript TypeScript
1179 const client = new Anthropic();
1180
1181 const rule = await client.beta.organization.federation.rules.archive(
1182 "fdrl_01ABCDEFabcdef0123456789XY"
1183 );
1184
1185 console.log(`id: ${rule.id}`);
1186 console.log(`archived_at: ${rule.archived_at}`);
1187 ```
1188
1189 ```csharp C#
1190 AnthropicClient client = new();
1191
1192 var rule = await client.Beta.Organization.Federation.Rules.Archive(
1193 "fdrl_01ABCDEFabcdef0123456789XY"
1194 );
1195
1196 Console.WriteLine($"id: {rule.ID}");
1197 Console.WriteLine($"archived_at: {rule.ArchivedAt:O}");
1198 ```
1199
1200 ```go Go
1201 client := anthropic.NewClient()
1202
1203 rule, err := client.Beta.Organization.Federation.Rules.Archive(
1204 context.Background(),
1205 "fdrl_01ABCDEFabcdef0123456789XY",
1206 anthropic.BetaOrganizationFederationRuleArchiveParams{},
1207 )
1208 if err != nil {
1209 log.Fatal(err)
1210 }
1211
1212 fmt.Printf("id: %s\n", rule.ID)
1213 fmt.Printf("archived_at: %s\n", rule.ArchivedAt)
1214 ```
1215
1216 ```java Java
1217 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
1218
1219 var rule = client.beta().organization().federation().rules()
1220 .archive("fdrl_01ABCDEFabcdef0123456789XY");
1221
1222 IO.println("id: " + rule.id());
1223 IO.println("archived_at: " + rule.archivedAt().orElseThrow());
1224 ```
1225
1226 ```php PHP
1227 $client = new Client();
1228
1229 $rule = $client->beta->organization->federation->rules->archive(
1230 federationRuleID: 'fdrl_01ABCDEFabcdef0123456789XY',
1231 );
1232
1233 echo "id: {$rule->id}\n";
1234 echo "archived_at: {$rule->archivedAt?->format(DATE_ATOM)}\n";
1235 ```
1236
1237 ```ruby Ruby
1238 client = Anthropic::Client.new
1239
1240 rule_id = "fdrl_01ABCDEFabcdef0123456789XY"
1241 rule = client.beta.organization.federation.rules.archive(rule_id)
1242
1243 puts "id: #{rule.id}"
1244 puts "archived_at: #{rule.archived_at}"
1245 ```
1246</CodeGroup>
1801247
1811248The list endpoint returns a page of rules and the cursor for the next page:
1821249
1831250
manage-claude/workspaces Changed · +669 / -43 lines
The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.
from line 140
140140 Admin API endpoints require an Admin API key (starting with `sk-ant-admin...`) that differs from standard API keys. See [Create an Admin API key](https://platform.claude.com/docs/en/manage-claude/admin-api-keys) for how to provision one.
141141</Note>
142142
143```bash cURL
144# Create a workspace
145curl -X POST "https://api.anthropic.com/v1/organizations/workspaces" \
146 -H "anthropic-version: 2023-06-01" \
147 -H "content-type: application/json" \
148 -H "x-api-key: $ANTHROPIC_ADMIN_KEY" \
149 -d '{"name": "Production"}'
150
151# List workspaces
152curl "https://api.anthropic.com/v1/organizations/workspaces?limit=10&include_archived=false" \
153 -H "anthropic-version: 2023-06-01" \
154 -H "x-api-key: $ANTHROPIC_ADMIN_KEY"
155
156# Archive a workspace
157curl -X POST "https://api.anthropic.com/v1/organizations/workspaces/{workspace_id}/archive" \
158 -H "anthropic-version: 2023-06-01" \
159 -H "x-api-key: $ANTHROPIC_ADMIN_KEY"
160```
143The following SDK and CLI examples construct the default client, which reads the Admin API key from the `ANTHROPIC_API_KEY` environment variable; the SDKs expose these endpoints under `client.beta.organization.workspaces`. SDK list methods fetch further pages on demand, so `limit` sets the page size; the PHP, Ruby, and curl examples return one page.
144
145Create a workspace:
146
147<CodeGroup>
148 ```bash cURL
149 curl -X POST "https://api.anthropic.com/v1/organizations/workspaces" \
150 -H "x-api-key: $ANTHROPIC_API_KEY" \
151 -H "anthropic-version: 2023-06-01" \
152 -H "content-type: application/json" \
153 -d '{"name": "Production"}'
154 ```
155
156 ```bash CLI
157 ant beta:organization:workspaces create --name Production
158 ```
159
160 ```python Python
161 client = anthropic.Anthropic()
162
163 workspace = client.beta.organization.workspaces.create(name="Production")
164
165 print(f"id: {workspace.id}")
166 print(f"name: {workspace.name}")
167 ```
168
169 ```typescript TypeScript
170 const client = new Anthropic();
171
172 const workspace = await client.beta.organization.workspaces.create({ name: "Production" });
173
174 console.log(`id: ${workspace.id}`);
175 console.log(`name: ${workspace.name}`);
176 ```
177
178 ```csharp C#
179 AnthropicClient client = new();
180
181 var workspace = await client.Beta.Organization.Workspaces.Create(new()
182 {
183 Name = "Production"
184 });
185
186 Console.WriteLine($"id: {workspace.ID}");
187 Console.WriteLine($"name: {workspace.Name}");
188 ```
189
190 ```go Go
191 client := anthropic.NewClient()
192
193 workspace, err := client.Beta.Organization.Workspaces.New(context.Background(), anthropic.BetaOrganizationWorkspaceNewParams{
194 Name: "Production",
195 })
196 if err != nil {
197 log.Fatal(err)
198 }
199
200 fmt.Printf("id: %s\n", workspace.ID)
201 fmt.Printf("name: %s\n", workspace.Name)
202 ```
203
204 ```java Java
205 import com.anthropic.models.beta.organization.workspaces.WorkspaceCreateParams;
206
207 void main() {
208 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
209
210 var params = WorkspaceCreateParams.builder()
211 .name("Production")
212 .build();
213 var workspace = client.beta().organization().workspaces().create(params);
214
215 IO.println("id: " + workspace.id());
216 IO.println("name: " + workspace.name());
217 }
218 ```
219
220 ```php PHP
221 $client = new Client();
222
223 $workspace = $client->beta->organization->workspaces->create(
224 name: 'Production',
225 );
226
227 echo "id: {$workspace->id}\n";
228 echo "name: {$workspace->name}\n";
229 ```
230
231 ```ruby Ruby
232 client = Anthropic::Client.new
233
234 workspace = client.beta.organization.workspaces.create(name: "Production")
235
236 puts "id: #{workspace.id}"
237 puts "name: #{workspace.name}"
238 ```
239</CodeGroup>
240
241List workspaces:
242
243<CodeGroup>
244 ```bash cURL
245 curl "https://api.anthropic.com/v1/organizations/workspaces?limit=10&include_archived=false" \
246 -H "x-api-key: $ANTHROPIC_API_KEY" \
247 -H "anthropic-version: 2023-06-01"
248 ```
249
250 ```bash CLI
251 ant beta:organization:workspaces list --limit 10 --include-archived=false
252 ```
253
254 ```python Python
255 client = anthropic.Anthropic()
256
257 workspaces = client.beta.organization.workspaces.list(limit=10, include_archived=False)
258
259 for workspace in workspaces:
260 print(f"{workspace.id}: {workspace.name}")
261 ```
262
263 ```typescript TypeScript
264 const client = new Anthropic();
265
266 const workspaces = await client.beta.organization.workspaces.list({
267 limit: 10,
268 include_archived: false
269 });
270
271 for await (const workspace of workspaces) {
272 console.log(`${workspace.id}: ${workspace.name}`);
273 }
274 ```
275
276 ```csharp C#
277 AnthropicClient client = new();
278
279 var workspaces = await client.Beta.Organization.Workspaces.List(new()
280 {
281 Limit = 10,
282 IncludeArchived = false
283 });
284
285 await foreach (var workspace in workspaces.Paginate())
286 {
287 Console.WriteLine($"{workspace.ID}: {workspace.Name}");
288 }
289 ```
290
291 ```go Go
292 client := anthropic.NewClient()
293
294 workspaces := client.Beta.Organization.Workspaces.ListAutoPaging(context.Background(), anthropic.BetaOrganizationWorkspaceListParams{
295 Limit: anthropic.Int(10),
296 IncludeArchived: anthropic.Bool(false),
297 })
298
299 for workspaces.Next() {
300 workspace := workspaces.Current()
301 fmt.Printf("%s: %s\n", workspace.ID, workspace.Name)
302 }
303 if err := workspaces.Err(); err != nil {
304 log.Fatal(err)
305 }
306 ```
307
308 ```java Java
309 import com.anthropic.models.beta.organization.workspaces.WorkspaceListParams;
310
311 void main() {
312 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
313
314 var params = WorkspaceListParams.builder()
315 .limit(10)
316 .includeArchived(false)
317 .build();
318 var workspaces = client.beta().organization().workspaces().list(params);
319
320 for (var workspace : workspaces.autoPager()) {
321 IO.println(workspace.id() + ": " + workspace.name());
322 }
323 }
324 ```
325
326 ```php PHP
327 $client = new Client();
328
329 $workspaces = $client->beta->organization->workspaces->list(
330 limit: 10,
331 includeArchived: false,
332 );
333
334 foreach ($workspaces->getItems() as $workspace) {
335 echo "{$workspace->id}: {$workspace->name}\n";
336 }
337 ```
338
339 ```ruby Ruby
340 client = Anthropic::Client.new
341
342 workspaces = client.beta.organization.workspaces.list(limit: 10, include_archived: false)
343
344 workspaces.data.each do |workspace|
345 puts "#{workspace.id}: #{workspace.name}"
346 end
347 ```
348</CodeGroup>
349
350Archive a workspace:
351
352<CodeGroup>
353 ```bash cURL
354 curl -X POST "https://api.anthropic.com/v1/organizations/workspaces/wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ/archive" \
355 -H "x-api-key: $ANTHROPIC_API_KEY" \
356 -H "anthropic-version: 2023-06-01"
357 ```
358
359 ```bash CLI
360 ant beta:organization:workspaces archive --workspace-id wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ
361 ```
362
363 ```python Python
364 client = anthropic.Anthropic()
365
366 workspace = client.beta.organization.workspaces.archive(
367 "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
368 )
369
370 print(f"id: {workspace.id}")
371 print(f"archived_at: {workspace.archived_at}")
372 ```
373
374 ```typescript TypeScript
375 const client = new Anthropic();
376
377 const workspace = await client.beta.organization.workspaces.archive(
378 "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
379 );
380
381 console.log(`id: ${workspace.id}`);
382 console.log(`archived_at: ${workspace.archived_at}`);
383 ```
384
385 ```csharp C#
386 AnthropicClient client = new();
387
388 var workspace = await client.Beta.Organization.Workspaces.Archive(
389 "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
390 );
391
392 Console.WriteLine($"id: {workspace.ID}");
393 Console.WriteLine($"archived_at: {workspace.ArchivedAt:O}");
394 ```
395
396 ```go Go
397 client := anthropic.NewClient()
398
399 workspace, err := client.Beta.Organization.Workspaces.Archive(context.Background(), "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ")
400 if err != nil {
401 log.Fatal(err)
402 }
403
404 fmt.Printf("id: %s\n", workspace.ID)
405 fmt.Printf("archived_at: %s\n", workspace.ArchivedAt)
406 ```
407
408 ```java Java
409 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
410
411 var workspace = client.beta().organization().workspaces()
412 .archive("wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ");
413
414 IO.println("id: " + workspace.id());
415 IO.println("archived_at: " + workspace.archivedAt().orElseThrow());
416 ```
417
418 ```php PHP
419 $client = new Client();
420
421 $workspace = $client->beta->organization->workspaces->archive(
422 workspaceID: 'wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ',
423 );
424
425 echo "id: {$workspace->id}\n";
426 echo "archived_at: {$workspace->archivedAt?->format(DATE_ATOM)}\n";
427 ```
428
429 ```ruby Ruby
430 client = Anthropic::Client.new
431
432 workspace_id = "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
433 workspace = client.beta.organization.workspaces.archive(workspace_id)
434
435 puts "id: #{workspace.id}"
436 puts "archived_at: #{workspace.archived_at}"
437 ```
438</CodeGroup>
161439
162440For complete parameter details and response schemas, see the [Workspaces API reference](https://platform.claude.com/docs/en/api/admin/workspaces/retrieve).
163441
164442### Managing workspace members
165443
166Add, update, or remove members from a workspace:
167
168```bash cURL
169# Add a member to a workspace
170curl -X POST "https://api.anthropic.com/v1/organizations/workspaces/{workspace_id}/members" \
171 -H "anthropic-version: 2023-06-01" \
172 -H "content-type: application/json" \
173 -H "x-api-key: $ANTHROPIC_ADMIN_KEY" \
174 -d '{
175 "user_id": "user_xxx",
176 "workspace_role": "workspace_developer"
177 }'
178
179# Update a member's role
180curl -X POST "https://api.anthropic.com/v1/organizations/workspaces/{workspace_id}/members/{user_id}" \
181 -H "anthropic-version: 2023-06-01" \
182 -H "content-type: application/json" \
183 -H "x-api-key: $ANTHROPIC_ADMIN_KEY" \
184 -d '{"workspace_role": "workspace_admin"}'
185
186# Remove a member from a workspace
187curl -X DELETE "https://api.anthropic.com/v1/organizations/workspaces/{workspace_id}/members/{user_id}" \
188 -H "anthropic-version: 2023-06-01" \
189 -H "x-api-key: $ANTHROPIC_ADMIN_KEY"
190```
444Add a member to a workspace:
445
446<CodeGroup>
447 ```bash cURL
448 curl -X POST "https://api.anthropic.com/v1/organizations/workspaces/wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ/members" \
449 -H "x-api-key: $ANTHROPIC_API_KEY" \
450 -H "anthropic-version: 2023-06-01" \
451 -H "content-type: application/json" \
452 -d '{
453 "user_id": "user_01XyDMpzjS89pFZXqSFUBDr6",
454 "workspace_role": "workspace_developer"
455 }'
456 ```
457
458 ```bash CLI
459 ant beta:organization:workspaces:members add \
460 --workspace-id wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ \
461 --user-id user_01XyDMpzjS89pFZXqSFUBDr6 \
462 --workspace-role workspace_developer
463 ```
464
465 ```python Python
466 client = anthropic.Anthropic()
467
468 member = client.beta.organization.workspaces.members.add(
469 "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
470 user_id="user_01XyDMpzjS89pFZXqSFUBDr6",
471 workspace_role="workspace_developer",
472 )
473
474 print(f"user_id: {member.user_id}")
475 print(f"workspace_role: {member.workspace_role}")
476 ```
477
478 ```typescript TypeScript
479 const client = new Anthropic();
480
481 const member = await client.beta.organization.workspaces.members.add(
482 "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
483 {
484 user_id: "user_01XyDMpzjS89pFZXqSFUBDr6",
485 workspace_role: "workspace_developer"
486 }
487 );
488
489 console.log(`user_id: ${member.user_id}`);
490 console.log(`workspace_role: ${member.workspace_role}`);
491 ```
492
493 ```csharp C#
494 using Anthropic.Models.Beta.Organization.Workspaces;
495
496 AnthropicClient client = new();
497
498 var member = await client.Beta.Organization.Workspaces.Members.Add(
499 "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
500 new()
501 {
502 UserID = "user_01XyDMpzjS89pFZXqSFUBDr6",
503 WorkspaceRole = BetaNoBillingWorkspaceRole.WorkspaceDeveloper
504 }
505 );
506
507 Console.WriteLine($"user_id: {member.UserID}");
508 Console.WriteLine($"workspace_role: {member.WorkspaceRole.Raw()}");
509 ```
510
511 ```go Go
512 client := anthropic.NewClient()
513
514 member, err := client.Beta.Organization.Workspaces.Members.Add(
515 context.Background(),
516 "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
517 anthropic.BetaOrganizationWorkspaceMemberAddParams{
518 UserID: "user_01XyDMpzjS89pFZXqSFUBDr6",
519 WorkspaceRole: anthropic.BetaNoBillingWorkspaceRoleWorkspaceDeveloper,
520 },
521 )
522 if err != nil {
523 log.Fatal(err)
524 }
525
526 fmt.Printf("user_id: %s\n", member.UserID)
527 fmt.Printf("workspace_role: %s\n", member.WorkspaceRole)
528 ```
529
530 ```java Java
531 import com.anthropic.models.beta.organization.workspaces.BetaNoBillingWorkspaceRole;
532 import com.anthropic.models.beta.organization.workspaces.members.MemberAddParams;
533
534 void main() {
535 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
536
537 var params = MemberAddParams.builder()
538 .userId("user_01XyDMpzjS89pFZXqSFUBDr6")
539 .workspaceRole(BetaNoBillingWorkspaceRole.WORKSPACE_DEVELOPER)
540 .build();
541 var member = client.beta().organization().workspaces().members()
542 .add("wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", params);
543
544 IO.println("user_id: " + member.userId());
545 IO.println("workspace_role: " + member.workspaceRole().asString());
546 }
547 ```
548
549 ```php PHP
550 use Anthropic\Beta\Organization\Workspaces\NoBillingWorkspaceRole;
551 // ...
552
553 $client = new Client();
554
555 $member = $client->beta->organization->workspaces->members->add(
556 workspaceID: 'wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ',
557 userID: 'user_01XyDMpzjS89pFZXqSFUBDr6',
558 workspaceRole: NoBillingWorkspaceRole::WORKSPACE_DEVELOPER,
559 );
560
561 echo "user_id: {$member->userID}\n";
562 echo "workspace_role: {$member->workspaceRole}\n";
563 ```
564
565 ```ruby Ruby
566 client = Anthropic::Client.new
567
568 workspace_id = "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
569 member = client.beta.organization.workspaces.members.add(
570 workspace_id,
571 user_id: "user_01XyDMpzjS89pFZXqSFUBDr6",
572 workspace_role: :workspace_developer
573 )
574
575 puts "user_id: #{member.user_id}"
576 puts "workspace_role: #{member.workspace_role}"
577 ```
578</CodeGroup>
579
580Update a member's role:
581
582<CodeGroup>
583 ```bash cURL
584 curl -X POST "https://api.anthropic.com/v1/organizations/workspaces/wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ/members/user_01XyDMpzjS89pFZXqSFUBDr6" \
585 -H "x-api-key: $ANTHROPIC_API_KEY" \
586 -H "anthropic-version: 2023-06-01" \
587 -H "content-type: application/json" \
588 -d '{"workspace_role": "workspace_admin"}'
589 ```
590
591 ```bash CLI
592 ant beta:organization:workspaces:members update \
593 --user-id user_01XyDMpzjS89pFZXqSFUBDr6 \
594 --workspace-id wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ \
595 --workspace-role workspace_admin
596 ```
597
598 ```python Python
599 client = anthropic.Anthropic()
600
601 member = client.beta.organization.workspaces.members.update(
602 "user_01XyDMpzjS89pFZXqSFUBDr6",
603 workspace_id="wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
604 workspace_role="workspace_admin",
605 )
606
607 print(f"user_id: {member.user_id}")
608 print(f"workspace_role: {member.workspace_role}")
609 ```
610
611 ```typescript TypeScript
612 const client = new Anthropic();
613
614 const member = await client.beta.organization.workspaces.members.update(
615 "user_01XyDMpzjS89pFZXqSFUBDr6",
616 {
617 workspace_id: "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
618 workspace_role: "workspace_admin"
619 }
620 );
621
622 console.log(`user_id: ${member.user_id}`);
623 console.log(`workspace_role: ${member.workspace_role}`);
624 ```
625
626 ```csharp C#
627 using Anthropic.Models.Beta.Organization.Workspaces;
628
629 AnthropicClient client = new();
630
631 var member = await client.Beta.Organization.Workspaces.Members.Update(
632 "user_01XyDMpzjS89pFZXqSFUBDr6",
633 new()
634 {
635 WorkspaceID = "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
636 WorkspaceRole = BetaWorkspaceRole.WorkspaceAdmin
637 }
638 );
639
640 Console.WriteLine($"user_id: {member.UserID}");
641 Console.WriteLine($"workspace_role: {member.WorkspaceRole.Raw()}");
642 ```
643
644 ```go Go
645 client := anthropic.NewClient()
646
647 member, err := client.Beta.Organization.Workspaces.Members.Update(
648 context.Background(),
649 "user_01XyDMpzjS89pFZXqSFUBDr6",
650 anthropic.BetaOrganizationWorkspaceMemberUpdateParams{
651 WorkspaceID: "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
652 WorkspaceRole: anthropic.BetaWorkspaceRoleWorkspaceAdmin,
653 },
654 )
655 if err != nil {
656 log.Fatal(err)
657 }
658
659 fmt.Printf("user_id: %s\n", member.UserID)
660 fmt.Printf("workspace_role: %s\n", member.WorkspaceRole)
661 ```
662
663 ```java Java
664 import com.anthropic.models.beta.organization.workspaces.BetaWorkspaceRole;
665 import com.anthropic.models.beta.organization.workspaces.members.MemberUpdateParams;
666
667 void main() {
668 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
669
670 var params = MemberUpdateParams.builder()
671 .workspaceId("wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ")
672 .workspaceRole(BetaWorkspaceRole.WORKSPACE_ADMIN)
673 .build();
674 var member = client.beta().organization().workspaces().members()
675 .update("user_01XyDMpzjS89pFZXqSFUBDr6", params);
676
677 IO.println("user_id: " + member.userId());
678 IO.println("workspace_role: " + member.workspaceRole().asString());
679 }
680 ```
681
682 ```php PHP
683 use Anthropic\Beta\Organization\Workspaces\WorkspaceRole;
684 // ...
685
686 $client = new Client();
687
688 $member = $client->beta->organization->workspaces->members->update(
689 userID: 'user_01XyDMpzjS89pFZXqSFUBDr6',
690 workspaceID: 'wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ',
691 workspaceRole: WorkspaceRole::WORKSPACE_ADMIN,
692 );
693
694 echo "user_id: {$member->userID}\n";
695 echo "workspace_role: {$member->workspaceRole}\n";
696 ```
697
698 ```ruby Ruby
699 client = Anthropic::Client.new
700
701 user_id = "user_01XyDMpzjS89pFZXqSFUBDr6"
702 member = client.beta.organization.workspaces.members.update(
703 user_id,
704 workspace_id: "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
705 workspace_role: :workspace_admin
706 )
707
708 puts "user_id: #{member.user_id}"
709 puts "workspace_role: #{member.workspace_role}"
710 ```
711</CodeGroup>
712
713Remove a member from a workspace:
714
715<CodeGroup>
716 ```bash cURL
717 curl -X DELETE "https://api.anthropic.com/v1/organizations/workspaces/wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ/members/user_01XyDMpzjS89pFZXqSFUBDr6" \
718 -H "x-api-key: $ANTHROPIC_API_KEY" \
719 -H "anthropic-version: 2023-06-01"
720 ```
721
722 ```bash CLI
723 ant beta:organization:workspaces:members remove \
724 --user-id user_01XyDMpzjS89pFZXqSFUBDr6 \
725 --workspace-id wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ
726 ```
727
728 ```python Python
729 client = anthropic.Anthropic()
730
731 removed_member = client.beta.organization.workspaces.members.remove(
732 "user_01XyDMpzjS89pFZXqSFUBDr6",
733 workspace_id="wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
734 )
735
736 print(f"user_id: {removed_member.user_id}")
737 ```
738
739 ```typescript TypeScript
740 const client = new Anthropic();
741
742 const removedMember = await client.beta.organization.workspaces.members.remove(
743 "user_01XyDMpzjS89pFZXqSFUBDr6",
744 { workspace_id: "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" }
745 );
746
747 console.log(`user_id: ${removedMember.user_id}`);
748 ```
749
750 ```csharp C#
751 AnthropicClient client = new();
752
753 var removedMember = await client.Beta.Organization.Workspaces.Members.Remove(
754 "user_01XyDMpzjS89pFZXqSFUBDr6",
755 new() { WorkspaceID = "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" }
756 );
757
758 Console.WriteLine($"user_id: {removedMember.UserID}");
759 ```
760
761 ```go Go
762 client := anthropic.NewClient()
763
764 removedMember, err := client.Beta.Organization.Workspaces.Members.Remove(
765 context.Background(),
766 "user_01XyDMpzjS89pFZXqSFUBDr6",
767 anthropic.BetaOrganizationWorkspaceMemberRemoveParams{
768 WorkspaceID: "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
769 },
770 )
771 if err != nil {
772 log.Fatal(err)
773 }
774
775 fmt.Printf("user_id: %s\n", removedMember.UserID)
776 ```
777
778 ```java Java
779 import com.anthropic.models.beta.organization.workspaces.members.MemberRemoveParams;
780
781 void main() {
782 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
783
784 var params = MemberRemoveParams.builder()
785 .workspaceId("wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ")
786 .build();
787 var removedMember = client.beta().organization().workspaces().members()
788 .remove("user_01XyDMpzjS89pFZXqSFUBDr6", params);
789
790 IO.println("user_id: " + removedMember.userId());
791 }
792 ```
793
794 ```php PHP
795 $client = new Client();
796
797 $removedMember = $client->beta->organization->workspaces->members->remove(
798 userID: 'user_01XyDMpzjS89pFZXqSFUBDr6',
799 workspaceID: 'wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ',
800 );
801
802 echo "user_id: {$removedMember->userID}\n";
803 ```
804
805 ```ruby Ruby
806 client = Anthropic::Client.new
807
808 user_id = "user_01XyDMpzjS89pFZXqSFUBDr6"
809 removed_member = client.beta.organization.workspaces.members.remove(
810 user_id,
811 workspace_id: "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
812 )
813
814 puts "user_id: #{removed_member.user_id}"
815 ```
816</CodeGroup>
191817
192818For complete parameter details, see the [Workspace Members API reference](https://platform.claude.com/docs/en/api/admin/workspaces/members/retrieve).
193819
194820
release-notes/overview Changed · +7 / -0 lines
### August 26, 2026
from line 12
1212 For updates to Claude Code, see the [complete CHANGELOG.md](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md) in the `claude-code` repository.
1313</Tip>
1414
15### August 26, 2026
16
17* The [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api) session endpoints are out of beta for Cowork and Claude Code sessions. See [Retrieve session transcripts](https://platform.claude.com/docs/en/manage-claude/compliance-sessions).
18* The [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api) local session endpoints now also return transcripts of Claude Science sessions (`product_surface` value `claude_science`) and Claude for Microsoft 365 sessions in Excel, PowerPoint, Word, and Outlook (`product_surface` values beginning with `office_agents`), in beta for Claude Enterprise organizations, with your existing Compliance Access Key and the `read:compliance_user_data` scope. See [Sessions on users' machines](https://platform.claude.com/docs/en/manage-claude/compliance-sessions#retrieve-local-sessions).
19
20- The [Admin API](https://platform.claude.com/docs/en/manage-claude/admin-api) is now available in the `ant` CLI and the Python, TypeScript, C#, Go, Java, PHP, and Ruby SDKs under `client.beta.organization`. They cover organization info, members, invites, workspaces and workspace members, API keys, rate limits, service accounts, workload identity federation issuers and rules, and customer-managed encryption keys. Usage and cost reports and the Claude Enterprise user-management and analytics endpoints remain curl-only. The CLI and SDKs read an Admin API key from `ANTHROPIC_API_KEY` or an `org:admin` OAuth token from `ANTHROPIC_AUTH_TOKEN`.
21
1522### August 20, 2026
1623
1724* We've released **v1.0 of the [Python SDK](https://platform.claude.com/docs/en/cli-sdks-libraries/sdks/python)**. The SDK's HTTP layer moves from `httpx` to [httpx2](https://httpx2.pydantic.dev), a maintained, API-compatible fork: build custom `http_client`, `Timeout`, and transport objects from `httpx2` (the `DefaultHttpxClient` helpers are unchanged), and call `httpx2.alias_httpx()` at startup if you rely on tracing or mocking libraries that patch `httpx`. v1.0 requires Python 3.10 or later and removes long-deprecated surface, including the legacy Text Completions API, the `temperature`, `top_p`, and `top_k` parameters on Messages methods, and the tool runner's client-side `compaction_control`. On the async client, `.with_raw_response` results now need `await response.parse()`, and `AnthropicBedrock` now raises an error when no AWS region is configured instead of defaulting to `us-east-1`. See the [v1 migration guide](https://github.com/anthropics/anthropic-sdk-python/blob/main/MIGRATION.md) for every change with before-and-after snippets.
api/skills Changed · +2 / -2 lines
from line 734
734734
735735- `version: string`
736736
737 Identifies the skill version: a version ID, or — where the endpoint accepts it — the literal `latest` for the skill's most recent version.
737 Identifies the skill version: a version ID, or the literal `latest` for the skill's most recent version.
738738
739739 Requests carrying the `skills-2025-10-02` beta header address versions by their Unix epoch timestamp instead (e.g., "1759178010641129").
740740
from line 817
817817
818818- `version: string`
819819
820 Identifies the skill version: a version ID, or — where the endpoint accepts it — the literal `latest` for the skill's most recent version.
820 Identifies the skill version by its version ID.
821821
822822 Requests carrying the `skills-2025-10-02` beta header address versions by their Unix epoch timestamp instead (e.g., "1759178010641129").
823823
api/skills/versions Changed · +2 / -2 lines
from line 207
207207
208208- `version: string`
209209
210 Identifies the skill version: a version ID, or — where the endpoint accepts it — the literal `latest` for the skill's most recent version.
210 Identifies the skill version: a version ID, or the literal `latest` for the skill's most recent version.
211211
212212 Requests carrying the `skills-2025-10-02` beta header address versions by their Unix epoch timestamp instead (e.g., "1759178010641129").
213213
from line 290
290290
291291- `version: string`
292292
293 Identifies the skill version: a version ID, or — where the endpoint accepts it — the literal `latest` for the skill's most recent version.
293 Identifies the skill version by its version ID.
294294
295295 Requests carrying the `skills-2025-10-02` beta header address versions by their Unix epoch timestamp instead (e.g., "1759178010641129").
296296
api/skills/versions/delete Changed · +1 / -1 lines
from line 14
1414
1515- `version: string`
1616
17 Identifies the skill version: a version ID, or — where the endpoint accepts it — the literal `latest` for the skill's most recent version.
17 Identifies the skill version by its version ID.
1818
1919 Requests carrying the `skills-2025-10-02` beta header address versions by their Unix epoch timestamp instead (e.g., "1759178010641129").
2020
api/skills/versions/retrieve Changed · +1 / -1 lines
from line 14
1414
1515- `version: string`
1616
17 Identifies the skill version: a version ID, or — where the endpoint accepts it — the literal `latest` for the skill's most recent version.
17 Identifies the skill version: a version ID, or the literal `latest` for the skill's most recent version.
1818
1919 Requests carrying the `skills-2025-10-02` beta header address versions by their Unix epoch timestamp instead (e.g., "1759178010641129").
2020
manage-claude/compliance-api Changed · +2 / -2 lines
from line 4
44description: Programmatic access to your organization's Claude activity, chats, files, projects, Claude Cowork and Claude Code sessions, and users for compliance, audit, and governance.
55---
66
7The Compliance API gives Claude Enterprise and Claude Console customers programmatic access to their organization's Activity Feed. For Claude Enterprise organizations, it also covers the directory of users, roles, and groups across every linked organization; the effective settings in force for each organization; the underlying chats, files, and projects in claude.ai organizations; and Cowork and Claude Code sessions. Security, legal, and compliance teams use it to audit activity, retrieve or delete content, and feed events into downstream tooling.
7The Compliance API gives Claude Enterprise and Claude Console customers programmatic access to their organization's Activity Feed. For Claude Enterprise organizations, it also covers the directory of users, roles, and groups across every linked organization; the effective settings in force for each organization; the underlying chats, files, and projects in claude.ai organizations; and Cowork, Claude Code, Claude Science, and Claude for Microsoft 365 sessions. Security, legal, and compliance teams use it to audit activity, retrieve or delete content, and feed events into downstream tooling.
88
99<Note>
1010 Two key types unlock the Compliance API. A **Compliance Access Key** (created in claude.ai) reaches every endpoint, and an **Admin API key** (created in Claude Console) reaches the Activity Feed only. See [Which key do you need?](https://platform.claude.com/docs/en/manage-claude/compliance-api-access#which-key-do-you-need) for the full key-type comparison.
from line 54
5454
5555The Activity Feed (`GET /v1/compliance/activities`) is available to any key that carries the `read:compliance_activities` scope; see [Query the Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed) for filters, pagination, and the full `Activity` object. The remaining endpoints require a Compliance Access Key carrying the relevant scope.
5656
57A Claude Enterprise tenant has one parent organization (the top-level container that centralizes identity) with linked organizations of two kinds: claude.ai organizations, where users chat and store content, and Claude Console organizations, where users manage Claude API workloads. For a key that covers the parent organization, the directory endpoints (organizations, users, roles, and groups) return data from every linked organization of either kind. The content endpoints (chats, files, projects, project attachments, and sessions) serve Claude Enterprise data only. The chat, file, and project endpoints return claude.ai chats, files, and projects. The session endpoints return transcripts of Cowork and Claude Code sessions on users' machines (local sessions), captured while users are signed in with their Claude Enterprise account. They also return transcripts of Cowork sessions started on claude.ai web or mobile, which run in the cloud in Anthropic-managed environments (remote sessions). A standalone Claude Console organization (one with no parent organization) is not part of a Claude Enterprise tenant; it uses Admin API keys and can query the Activity Feed only.
57A Claude Enterprise tenant has one parent organization (the top-level container that centralizes identity) with linked organizations of two kinds: claude.ai organizations, where users chat and store content, and Claude Console organizations, where users manage Claude API workloads. For a key that covers the parent organization, the directory endpoints (organizations, users, roles, and groups) return data from every linked organization of either kind. The content endpoints (chats, files, projects, project attachments, and sessions) serve Claude Enterprise data only. The chat, file, and project endpoints return claude.ai chats, files, and projects. The session endpoints return transcripts of Cowork, Claude Code, Claude Science, and Claude for Microsoft 365 sessions on users' machines (local sessions), captured while users are signed in with their Claude Enterprise account. They also return transcripts of Cowork sessions started on claude.ai web or mobile, which run in the cloud in Anthropic-managed environments (remote sessions). A standalone Claude Console organization (one with no parent organization) is not part of a Claude Enterprise tenant; it uses Admin API keys and can query the Activity Feed only.
5858
5959All `/v1/compliance/*` endpoints share a rate limit of 600 requests per minute per parent organization (for a standalone Claude Console organization, per organization). The local session endpoints count only against that shared limit, and the remote session endpoints carry a second request budget on top. See [429 Too Many Requests](https://platform.claude.com/docs/en/manage-claude/compliance-errors#429-too-many-requests) for the response headers and retry contract.
6060
manage-claude/compliance-faq Changed · +2 / -2 lines
from line 70
7070 </Accordion>
7171
7272 <Accordion title="Do Cowork and Claude Code sessions appear in the Compliance API?">
73 Yes. Cowork sessions in Claude Desktop that run on users' machines, and Claude Code sessions in the terminal, in Claude Desktop, or in an IDE extension, are captured while users are signed in with their Claude Enterprise account and are available through the [local session endpoints](https://platform.claude.com/docs/en/manage-claude/compliance-sessions#retrieve-local-sessions). Cowork sessions started on claude.ai web or mobile, which run in the cloud in Anthropic-managed environments, are available through the [remote session endpoints](https://platform.claude.com/docs/en/manage-claude/compliance-sessions#retrieve-remote-sessions). Each family has a list endpoint that returns session metadata and a messages endpoint that returns the session transcript (user prompts, assistant responses, and tool calls and results). The local family adds a third endpoint that retrieves one session's metadata. All of these endpoints use your existing Compliance Access Key with `read:compliance_user_data`; no new key or scope is needed.
73 Yes. Cowork sessions in Claude Desktop that run on users' machines, Claude Code sessions (in the terminal, in Claude Desktop, or in an IDE extension), sessions in the Claude Science desktop app, and Claude for Microsoft 365 sessions in Excel, PowerPoint, Word, and Outlook are captured while users are signed in with their Claude Enterprise account and are available through the [local session endpoints](https://platform.claude.com/docs/en/manage-claude/compliance-sessions#retrieve-local-sessions). Cowork sessions started on claude.ai web or mobile, which run in the cloud in Anthropic-managed environments, are available through the [remote session endpoints](https://platform.claude.com/docs/en/manage-claude/compliance-sessions#retrieve-remote-sessions). Each family has a list endpoint that returns session metadata and a messages endpoint that returns the session transcript (user prompts, assistant responses, and tool calls and results). The local family adds a third endpoint that retrieves one session's metadata. All of these endpoints use your existing Compliance Access Key with `read:compliance_user_data`; no new key or scope is needed.
7474
7575 Local sessions are captured as their requests reach the Claude API, so nothing is installed on the device, and on-device activity that never reaches the API is not captured. Claude Code sessions authenticated with a Claude Console API key, Claude Code sessions run through a third-party cloud platform (Amazon Bedrock, Google Cloud, or Microsoft Foundry), and Claude Code on the web are not captured. Claude Code on the web also runs in the cloud in Anthropic-managed environments, but it is not a remote session; the remote session endpoints return Cowork sessions only. Organizations with [HIPAA readiness](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#hipaa-readiness) enabled get no local session data, and sessions for which [zero data retention (ZDR)](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#zero-data-retention-zdr-scope) is in effect are excluded.
7676
77 The local and remote session endpoints are in beta.
77 The local and remote session endpoints are stable for Cowork and Claude Code sessions; coverage of Claude Science and Claude for Microsoft 365 sessions is in beta.
7878 </Accordion>
7979
8080 <Accordion title="What do Cowork and Claude Code session transcripts include?">