One read of Claude Developer Platformapi-20260826T180819Z
239 pages moved out of 688 read.
What this read moved
76-100 of 239, page 4 of 10This capture is too large to show at once. Changes 76-100 of 239 are below, significant first; the rest are on the following screens.
api/beta/messages/create Changed · +29 / -7 lines
api/beta/models Changed · +30 / -2 lines
api/beta/models/list Changed · +15 / -1 lines
api/beta/models/retrieve Changed · +15 / -1 lines
api/beta/organization New page · 10225 lines, new page
# Organization ## Get Current Organization ### Returns ### Example #### Response (200) ## Domain types ### Beta Organization ### Beta Organization Role ## Organization › API Keys ### List API Keys #### Query parameters #### Returns #### Example ##### Response (200) ### Get API Key #### Path parameters #### Returns #### Example ##### Response (200) ### Update API Key #### Path parameters #### Body parameters #### Returns #### Example ##### Response (200) ## Organization › External Keys ### Create External Key #### Body parameters #### Returns #### Example ##### Response (200) ### List External Keys #### Query parameters #### Returns #### Example ##### Response (200) ### Get External Key #### Path parameters #### Returns #### Example ##### Response (200) ### Update External Key #### Path parameters #### Body parameters #### Returns #### Example ##### Response (200) ### Delete External Key #### Path parameters #### Returns #### Example ##### Response (200) ### Validate External Key #### Path parameters #### Returns #### Example ##### Response (200) ## Organization › Federation › Issuers ### Create Federation Issuer #### Headers #### Body parameters #### Returns #### Example ##### Response (200) ### List Federation Issuers #### Query parameters #### Headers #### Returns #### Example ##### Response (200) ### Get Federation Issuer #### Path parameters #### Headers #### Returns #### Example ##### Response (200) ### Update Federation Issuer #### Path parameters #### Headers #### Body parameters #### Returns #### Example ##### Response (200) ### Archive Federation Issuer #### Path parameters #### Headers #### Returns #### Example ##### Response (200) ## Organization › Federation › Rules ### Create Federation Rule #### Headers #### Body parameters #### Returns #### Example ##### Response (200) ### List Federation Rules #### Query parameters #### Headers #### Returns #### Example ##### Response (200) ### Get Federation Rule #### Path parameters #### Headers #### Returns #### Example ##### Response (200) ### Update Federation Rule #### Path parameters #### Headers #### Body parameters #### Returns #### Example ##### Response (200) ### Archive Federation Rule #### Path parameters #### Headers #### Returns #### Example ##### Response (200) ## Organization › Federation › Rules › Workspaces ### Add Federation Rule Workspace #### Path parameters #### Headers #### Body parameters #### Returns #### Example ##### Response (200) ### List Federation Rule Workspaces #### Path parameters #### Query parameters #### Headers #### Returns #### Example ##### Response (200) ### Remove Federation Rule Workspace #### Path parameters #### Headers #### Returns #### Example ##### Response (200) ## Organization › Invites ### Create Invite #### Body parameters #### Returns #### Example ##### Response (200) ### List Invites #### Query parameters #### Returns #### Example ##### Response (200) ### Get Invite #### Path parameters #### Returns #### Example ##### Response (200) ### Delete Invite #### Path parameters #### Returns #### Example ##### Response (200) ## Organization › Service Accounts ### Create Service Account #### Headers #### Body parameters #### Returns #### Example ##### Response (200) ### List Service Accounts #### Query parameters #### Headers #### Returns #### Example ##### Response (200) ### Get Service Account #### Path parameters #### Headers #### Returns #### Example ##### Response (200) ### Update Service Account #### Path parameters #### Headers #### Body parameters #### Returns #### Example ##### Response (200) ### Archive Service Account #### Path parameters #### Headers #### Returns #### Example ##### Response (200) ## Organization › Service Accounts › Workspaces ### Add Workspace To Service Account #### Path parameters #### Headers #### Body parameters #### Returns #### Example ##### Response (200) ### List Workspaces For Service Account #### Path parameters #### Query parameters #### Headers #### Returns #### Example ##### Response (200) ### Remove Workspace From Service Account #### Path parameters #### Headers #### Returns #### Example ##### Response (200) ## Organization › Users ### List Users #### Query parameters #### Returns #### Example ##### Response (200) ### Get User #### Path parameters #### Returns #### Example ##### Response (200) ### Update User #### Path parameters #### Body parameters #### Returns #### Example ##### Response (200) ### Remove User #### Path parameters #### Returns #### Example ##### Response (200) ## Organization › Workspaces ### List Workspaces #### Query parameters #### Returns #### Example ##### Response (200) ### Create Workspace #### Headers #### Body parameters #### Returns #### Example ##### Response (200) ### Get Workspace #### Path parameters #### Returns #### Example ##### Response (200) ### Update Workspace #### Path parameters #### Body parameters #### Returns #### Example ##### Response (200) ### Archive Workspace #### Path parameters #### Returns #### Example ##### Response (200) ## Organization › Workspaces › Rate Limits ### List Workspace Rate Limits #### Path parameters #### Query parameters #### Returns #### Example ##### Response (200) ## Organization › Workspaces › Members ### List Workspace Members #### Path parameters #### Query parameters #### Returns #### Example ##### Response (200) ### Create Workspace Member #### Path parameters #### Body parameters #### Returns #### Example ##### Response (200) ### Get Workspace Member #### Path parameters #### Returns #### Example ##### Response (200) ### Update Workspace Member #### Path parameters #### Body parameters #### Returns #### Example ##### Response (200) ### Delete Workspace Member #### Path parameters #### Returns #### Example ##### Response (200) ## Organization › Workspaces › Service Accounts ### List Service Account Workspace Members #### Path parameters #### Query parameters #### Headers #### Returns #### Example ##### Response (200) ### Create Service Account Workspace Member #### Path parameters #### Headers #### Body parameters #### Returns #### Example ##### Response (200) ### Get Service Account Workspace Member #### Path parameters #### Headers #### Returns #### Example ##### Response (200) ### Update Service Account Workspace Member #### Path parameters #### Headers #### Body parameters #### Returns #### Example ##### Response (200) ### Delete Service Account Workspace Member #### Path parameters #### Headers #### Returns #### Example ##### Response (200) ## Organization › Rate Limits ### List Organization Rate Limits #### Query parameters #### Returns #### Example ##### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
# Organization
## Get Current Organization
**GET** `/v1/organizations/me`
Retrieve information about the organization associated with the authenticated API key.
### Returns
- `BetaOrganization object`
- `id: string`
ID of the Organization.
format: uuid
- `name: string`
Name of the Organization.
- `type: "organization"`
Object type.
For Organizations, this is always `"organization"`.
default: organization
### Example
```bash
curl https://api.anthropic.com/v1/organizations/me \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
#### Response (200)
```json
{
"id": "12345678-1234-5678-1234-567812345678",
"name": "Organization Name",
"type": "organization"
}
```
## Domain types
### Beta Organization
- `BetaOrganization object`
- `id: string`
ID of the Organization.
format: uuid
- `name: string`
Name of the Organization.
- `type: "organization"`
Object type.
For Organizations, this is always `"organization"`.
default: organization
### Beta Organization Role
- `BetaOrganizationRole = "admin" or "billing" or "claude_code_user" or 6 more`
- `"admin"`
- `"billing"`
- `"claude_code_user"`
- `"developer"`
- `"managed"`
- `"membership_admin"`
- `"owner"`
- `"primary_owner"`
- `"user"`
## Organization › API Keys
### List API Keys
**GET** `/v1/organizations/api_keys`
List API Keys
#### Query parameters
- `after_id: optional string`
ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object.
- `before_id: optional string`
ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object.
- `created_by_user_id: optional string`
Filter by the ID of the User who created the object.
- `limit: optional number`
Number of items to return per page.
Defaults to `20`. Ranges from `1` to `1000`.
default: 20, maximum: 1000, minimum: 1
- `status: optional "active" or "archived" or "expired" or "inactive"`
Filter by API key status.
- `"active"`
- `"archived"`
- `"expired"`
- `"inactive"`
- `workspace_id: optional string`
Filter by Workspace ID.
#### Returns
- `data: array of BetaAPIKey`
- `id: string`
ID of the API key.
- `created_at: string`
RFC 3339 datetime string indicating when the API Key was created.
format: date-time
- `created_by: BetaAPIKeyCreatedBy or null`
The ID and type of the actor that created the API key, or `null` when the
creator is not recorded (legacy, workload-identity-federated, or
system-created keys).
- `id: string`
ID of the actor that created the object.
- `type: "service_account" or "user"`
Type of the actor that created the object.
- `"service_account"`
- `"user"`
- `expires_at: string or null`
RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.
format: date-time
- `name: string`
Name of the API key.
- `partial_key_hint: string or null`
Partially redacted hint for the API key.
- `principal: BetaAPIKeyUserActor or BetaAPIKeyServiceAccountActor or null`
The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal.
- `BetaAPIKeyUserActor object`
- `type: "user_actor"`
Principal type. Always `"user_actor"` for a User.
default: user_actor
- `user_id: string`
ID of the User the API key acts as.
- `BetaAPIKeyServiceAccountActor object`
- `service_account_id: string`
ID of the Service Account the API key acts as.
- `type: "service_account_actor"`
Principal type. Always `"service_account_actor"` for a Service Account.
default: service_account_actor
- `scope: BetaAPIKeyOrganizationScope or BetaAPIKeyWorkspaceScope`
Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace.
- `BetaAPIKeyOrganizationScope object`
- `type: "organization"`
Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope.
default: organization
- `BetaAPIKeyWorkspaceScope object`
- `type: "workspace"`
Scope type. Always `"workspace"`: the API key belongs to one Workspace.
default: workspace
- `workspace_id: string`
ID of the Workspace the API key belongs to. Unlike the deprecated top-level `workspace_id`, this is the Workspace's real ID even for the organization's default Workspace.
- `status: "active" or "archived" or "expired" or "inactive"`
Status of the API key.
- `"active"`
- `"archived"`
- `"expired"`
- `"inactive"`
- `type: "api_key"`
Object type.
For API Keys, this is always `"api_key"`.
default: api_key
- `workspace_id: string or null`
**Deprecated**: Use `scope` instead. `workspace_id` is `null` both for an API key in the default Workspace and for a principal-bound API key that has no Workspace.
Deprecated: use `scope` instead. ID of the Workspace associated with the API key, or `null` if the API key belongs to the default Workspace. Also `null` for a principal-bound API key that has no Workspace; `scope` tells the two apart.
- `first_id: string or null`
First ID in the `data` list. Can be used as the `before_id` for the previous page.
- `has_more: boolean`
Indicates if there are more results in the requested page direction.
- `last_id: string or null`
Last ID in the `data` list. Can be used as the `after_id` for the next page.
#### Example
```bash
curl https://api.anthropic.com/v1/organizations/api_keys \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
##### Response (200)
```json
{
"data": [
{
"id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by": {
"id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
"type": "user"
},
"expires_at": "2024-10-30T23:58:27.427722Z",
"name": "Developer Key",
"partial_key_hint": "sk-ant-api03-R2D...igAA",
"principal": {
Cut at 300 lines. The page has the rest.
api/beta/organization/api_keys New page · 779 lines, new page
# API Keys ## List API Keys ### Query parameters ### Returns ### Example #### Response (200) ## Get API Key ### Path parameters ### Returns ### Example #### Response (200) ## Update API Key ### Path parameters ### Body parameters ### Returns ### Example #### Response (200) ## Domain types ### Beta API Key ### Beta API Key Created By ### Beta API Key Organization Scope ### Beta API Key Service Account Actor ### Beta API Key User Actor ### Beta API Key Workspace Scope
A whole new page. There's nothing to diff it against, so here is what it says.
# API Keys
## List API Keys
**GET** `/v1/organizations/api_keys`
List API Keys
### Query parameters
- `after_id: optional string`
ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object.
- `before_id: optional string`
ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object.
- `created_by_user_id: optional string`
Filter by the ID of the User who created the object.
- `limit: optional number`
Number of items to return per page.
Defaults to `20`. Ranges from `1` to `1000`.
default: 20, maximum: 1000, minimum: 1
- `status: optional "active" or "archived" or "expired" or "inactive"`
Filter by API key status.
- `"active"`
- `"archived"`
- `"expired"`
- `"inactive"`
- `workspace_id: optional string`
Filter by Workspace ID.
### Returns
- `data: array of BetaAPIKey`
- `id: string`
ID of the API key.
- `created_at: string`
RFC 3339 datetime string indicating when the API Key was created.
format: date-time
- `created_by: BetaAPIKeyCreatedBy or null`
The ID and type of the actor that created the API key, or `null` when the
creator is not recorded (legacy, workload-identity-federated, or
system-created keys).
- `id: string`
ID of the actor that created the object.
- `type: "service_account" or "user"`
Type of the actor that created the object.
- `"service_account"`
- `"user"`
- `expires_at: string or null`
RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.
format: date-time
- `name: string`
Name of the API key.
- `partial_key_hint: string or null`
Partially redacted hint for the API key.
- `principal: BetaAPIKeyUserActor or BetaAPIKeyServiceAccountActor or null`
The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal.
- `BetaAPIKeyUserActor object`
- `type: "user_actor"`
Principal type. Always `"user_actor"` for a User.
default: user_actor
- `user_id: string`
ID of the User the API key acts as.
- `BetaAPIKeyServiceAccountActor object`
- `service_account_id: string`
ID of the Service Account the API key acts as.
- `type: "service_account_actor"`
Principal type. Always `"service_account_actor"` for a Service Account.
default: service_account_actor
- `scope: BetaAPIKeyOrganizationScope or BetaAPIKeyWorkspaceScope`
Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace.
- `BetaAPIKeyOrganizationScope object`
- `type: "organization"`
Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope.
default: organization
- `BetaAPIKeyWorkspaceScope object`
- `type: "workspace"`
Scope type. Always `"workspace"`: the API key belongs to one Workspace.
default: workspace
- `workspace_id: string`
ID of the Workspace the API key belongs to. Unlike the deprecated top-level `workspace_id`, this is the Workspace's real ID even for the organization's default Workspace.
- `status: "active" or "archived" or "expired" or "inactive"`
Status of the API key.
- `"active"`
- `"archived"`
- `"expired"`
- `"inactive"`
- `type: "api_key"`
Object type.
For API Keys, this is always `"api_key"`.
default: api_key
- `workspace_id: string or null`
**Deprecated**: Use `scope` instead. `workspace_id` is `null` both for an API key in the default Workspace and for a principal-bound API key that has no Workspace.
Deprecated: use `scope` instead. ID of the Workspace associated with the API key, or `null` if the API key belongs to the default Workspace. Also `null` for a principal-bound API key that has no Workspace; `scope` tells the two apart.
- `first_id: string or null`
First ID in the `data` list. Can be used as the `before_id` for the previous page.
- `has_more: boolean`
Indicates if there are more results in the requested page direction.
- `last_id: string or null`
Last ID in the `data` list. Can be used as the `after_id` for the next page.
### Example
```bash
curl https://api.anthropic.com/v1/organizations/api_keys \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
#### Response (200)
```json
{
"data": [
{
"id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by": {
"id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
"type": "user"
},
"expires_at": "2024-10-30T23:58:27.427722Z",
"name": "Developer Key",
"partial_key_hint": "sk-ant-api03-R2D...igAA",
"principal": {
"type": "user_actor",
"user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
},
"scope": {
"type": "workspace",
"workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
},
"status": "active",
"type": "api_key",
"workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
}
],
"first_id": "first_id",
"has_more": true,
"last_id": "last_id"
}
```
## Get API Key
**GET** `/v1/organizations/api_keys/{api_key_id}`
Get API Key
### Path parameters
- `api_key_id: string`
ID of the API key.
### Returns
- `BetaAPIKey object`
- `id: string`
ID of the API key.
- `created_at: string`
RFC 3339 datetime string indicating when the API Key was created.
format: date-time
- `created_by: BetaAPIKeyCreatedBy or null`
The ID and type of the actor that created the API key, or `null` when the
creator is not recorded (legacy, workload-identity-federated, or
system-created keys).
- `id: string`
ID of the actor that created the object.
- `type: "service_account" or "user"`
Type of the actor that created the object.
- `"service_account"`
- `"user"`
- `expires_at: string or null`
RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.
format: date-time
- `name: string`
Name of the API key.
- `partial_key_hint: string or null`
Partially redacted hint for the API key.
- `principal: BetaAPIKeyUserActor or BetaAPIKeyServiceAccountActor or null`
The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal.
- `BetaAPIKeyUserActor object`
- `type: "user_actor"`
Principal type. Always `"user_actor"` for a User.
default: user_actor
- `user_id: string`
ID of the User the API key acts as.
- `BetaAPIKeyServiceAccountActor object`
Cut at 300 lines. The page has the rest.
api/beta/organization/api_keys/list New page · 221 lines, new page
# List API Keys ## Query parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
# List API Keys
**GET** `/v1/organizations/api_keys`
List API Keys
## Query parameters
- `after_id: optional string`
ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object.
- `before_id: optional string`
ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object.
- `created_by_user_id: optional string`
Filter by the ID of the User who created the object.
- `limit: optional number`
Number of items to return per page.
Defaults to `20`. Ranges from `1` to `1000`.
default: 20, maximum: 1000, minimum: 1
- `status: optional "active" or "archived" or "expired" or "inactive"`
Filter by API key status.
- `"active"`
- `"archived"`
- `"expired"`
- `"inactive"`
- `workspace_id: optional string`
Filter by Workspace ID.
## Returns
- `data: array of BetaAPIKey`
- `id: string`
ID of the API key.
- `created_at: string`
RFC 3339 datetime string indicating when the API Key was created.
format: date-time
- `created_by: BetaAPIKeyCreatedBy or null`
The ID and type of the actor that created the API key, or `null` when the
creator is not recorded (legacy, workload-identity-federated, or
system-created keys).
- `id: string`
ID of the actor that created the object.
- `type: "service_account" or "user"`
Type of the actor that created the object.
- `"service_account"`
- `"user"`
- `expires_at: string or null`
RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.
format: date-time
- `name: string`
Name of the API key.
- `partial_key_hint: string or null`
Partially redacted hint for the API key.
- `principal: BetaAPIKeyUserActor or BetaAPIKeyServiceAccountActor or null`
The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal.
- `BetaAPIKeyUserActor object`
- `type: "user_actor"`
Principal type. Always `"user_actor"` for a User.
default: user_actor
- `user_id: string`
ID of the User the API key acts as.
- `BetaAPIKeyServiceAccountActor object`
- `service_account_id: string`
ID of the Service Account the API key acts as.
- `type: "service_account_actor"`
Principal type. Always `"service_account_actor"` for a Service Account.
default: service_account_actor
- `scope: BetaAPIKeyOrganizationScope or BetaAPIKeyWorkspaceScope`
Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace.
- `BetaAPIKeyOrganizationScope object`
- `type: "organization"`
Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope.
default: organization
- `BetaAPIKeyWorkspaceScope object`
- `type: "workspace"`
Scope type. Always `"workspace"`: the API key belongs to one Workspace.
default: workspace
- `workspace_id: string`
ID of the Workspace the API key belongs to. Unlike the deprecated top-level `workspace_id`, this is the Workspace's real ID even for the organization's default Workspace.
- `status: "active" or "archived" or "expired" or "inactive"`
Status of the API key.
- `"active"`
- `"archived"`
- `"expired"`
- `"inactive"`
- `type: "api_key"`
Object type.
For API Keys, this is always `"api_key"`.
default: api_key
- `workspace_id: string or null`
**Deprecated**: Use `scope` instead. `workspace_id` is `null` both for an API key in the default Workspace and for a principal-bound API key that has no Workspace.
Deprecated: use `scope` instead. ID of the Workspace associated with the API key, or `null` if the API key belongs to the default Workspace. Also `null` for a principal-bound API key that has no Workspace; `scope` tells the two apart.
- `first_id: string or null`
First ID in the `data` list. Can be used as the `before_id` for the previous page.
- `has_more: boolean`
Indicates if there are more results in the requested page direction.
- `last_id: string or null`
Last ID in the `data` list. Can be used as the `after_id` for the next page.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/api_keys \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"data": [
{
"id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by": {
"id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
"type": "user"
},
"expires_at": "2024-10-30T23:58:27.427722Z",
"name": "Developer Key",
"partial_key_hint": "sk-ant-api03-R2D...igAA",
"principal": {
"type": "user_actor",
"user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
},
"scope": {
"type": "workspace",
"workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
},
"status": "active",
"type": "api_key",
"workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
}
],
"first_id": "first_id",
"has_more": true,
"last_id": "last_id"
}
```
api/beta/organization/api_keys/retrieve New page · 170 lines, new page
# Get API Key ## Path parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
# Get API Key
**GET** `/v1/organizations/api_keys/{api_key_id}`
Get API Key
## Path parameters
- `api_key_id: string`
ID of the API key.
## Returns
- `BetaAPIKey object`
- `id: string`
ID of the API key.
- `created_at: string`
RFC 3339 datetime string indicating when the API Key was created.
format: date-time
- `created_by: BetaAPIKeyCreatedBy or null`
The ID and type of the actor that created the API key, or `null` when the
creator is not recorded (legacy, workload-identity-federated, or
system-created keys).
- `id: string`
ID of the actor that created the object.
- `type: "service_account" or "user"`
Type of the actor that created the object.
- `"service_account"`
- `"user"`
- `expires_at: string or null`
RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.
format: date-time
- `name: string`
Name of the API key.
- `partial_key_hint: string or null`
Partially redacted hint for the API key.
- `principal: BetaAPIKeyUserActor or BetaAPIKeyServiceAccountActor or null`
The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal.
- `BetaAPIKeyUserActor object`
- `type: "user_actor"`
Principal type. Always `"user_actor"` for a User.
default: user_actor
- `user_id: string`
ID of the User the API key acts as.
- `BetaAPIKeyServiceAccountActor object`
- `service_account_id: string`
ID of the Service Account the API key acts as.
- `type: "service_account_actor"`
Principal type. Always `"service_account_actor"` for a Service Account.
default: service_account_actor
- `scope: BetaAPIKeyOrganizationScope or BetaAPIKeyWorkspaceScope`
Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace.
- `BetaAPIKeyOrganizationScope object`
- `type: "organization"`
Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope.
default: organization
- `BetaAPIKeyWorkspaceScope object`
- `type: "workspace"`
Scope type. Always `"workspace"`: the API key belongs to one Workspace.
default: workspace
- `workspace_id: string`
ID of the Workspace the API key belongs to. Unlike the deprecated top-level `workspace_id`, this is the Workspace's real ID even for the organization's default Workspace.
- `status: "active" or "archived" or "expired" or "inactive"`
Status of the API key.
- `"active"`
- `"archived"`
- `"expired"`
- `"inactive"`
- `type: "api_key"`
Object type.
For API Keys, this is always `"api_key"`.
default: api_key
- `workspace_id: string or null`
**Deprecated**: Use `scope` instead. `workspace_id` is `null` both for an API key in the default Workspace and for a principal-bound API key that has no Workspace.
Deprecated: use `scope` instead. ID of the Workspace associated with the API key, or `null` if the API key belongs to the default Workspace. Also `null` for a principal-bound API key that has no Workspace; `scope` tells the two apart.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/api_keys/$API_KEY_ID \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by": {
"id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
"type": "user"
},
"expires_at": "2024-10-30T23:58:27.427722Z",
"name": "Developer Key",
"partial_key_hint": "sk-ant-api03-R2D...igAA",
"principal": {
"type": "user_actor",
"user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
},
"scope": {
"type": "workspace",
"workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
},
"status": "active",
"type": "api_key",
"workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
}
```
api/beta/organization/api_keys/update New page · 190 lines, new page
# Update API Key ## Path parameters ## Body parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
# Update API Key
**POST** `/v1/organizations/api_keys/{api_key_id}`
Update API Key
## Path parameters
- `api_key_id: string`
ID of the API key.
## Body parameters
- `name: optional string or null`
Name of the API key.
maxLength: 500, minLength: 1
- `status: optional "active" or "archived" or "inactive" or null`
Status of the API key.
- `"active"`
- `"archived"`
- `"inactive"`
## Returns
- `BetaAPIKey object`
- `id: string`
ID of the API key.
- `created_at: string`
RFC 3339 datetime string indicating when the API Key was created.
format: date-time
- `created_by: BetaAPIKeyCreatedBy or null`
The ID and type of the actor that created the API key, or `null` when the
creator is not recorded (legacy, workload-identity-federated, or
system-created keys).
- `id: string`
ID of the actor that created the object.
- `type: "service_account" or "user"`
Type of the actor that created the object.
- `"service_account"`
- `"user"`
- `expires_at: string or null`
RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.
format: date-time
- `name: string`
Name of the API key.
- `partial_key_hint: string or null`
Partially redacted hint for the API key.
- `principal: BetaAPIKeyUserActor or BetaAPIKeyServiceAccountActor or null`
The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal.
- `BetaAPIKeyUserActor object`
- `type: "user_actor"`
Principal type. Always `"user_actor"` for a User.
default: user_actor
- `user_id: string`
ID of the User the API key acts as.
- `BetaAPIKeyServiceAccountActor object`
- `service_account_id: string`
ID of the Service Account the API key acts as.
- `type: "service_account_actor"`
Principal type. Always `"service_account_actor"` for a Service Account.
default: service_account_actor
- `scope: BetaAPIKeyOrganizationScope or BetaAPIKeyWorkspaceScope`
Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace.
- `BetaAPIKeyOrganizationScope object`
- `type: "organization"`
Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope.
default: organization
- `BetaAPIKeyWorkspaceScope object`
- `type: "workspace"`
Scope type. Always `"workspace"`: the API key belongs to one Workspace.
default: workspace
- `workspace_id: string`
ID of the Workspace the API key belongs to. Unlike the deprecated top-level `workspace_id`, this is the Workspace's real ID even for the organization's default Workspace.
- `status: "active" or "archived" or "expired" or "inactive"`
Status of the API key.
- `"active"`
- `"archived"`
- `"expired"`
- `"inactive"`
- `type: "api_key"`
Object type.
For API Keys, this is always `"api_key"`.
default: api_key
- `workspace_id: string or null`
**Deprecated**: Use `scope` instead. `workspace_id` is `null` both for an API key in the default Workspace and for a principal-bound API key that has no Workspace.
Deprecated: use `scope` instead. ID of the Workspace associated with the API key, or `null` if the API key belongs to the default Workspace. Also `null` for a principal-bound API key that has no Workspace; `scope` tells the two apart.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/api_keys/$API_KEY_ID \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY" \
-d '{}'
```
### Response (200)
```json
{
"id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by": {
"id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
"type": "user"
},
"expires_at": "2024-10-30T23:58:27.427722Z",
"name": "Developer Key",
"partial_key_hint": "sk-ant-api03-R2D...igAA",
"principal": {
"type": "user_actor",
"user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
},
"scope": {
"type": "workspace",
"workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
},
"status": "active",
"type": "api_key",
"workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
}
```
api/beta/organization/external_keys New page · 1067 lines, new page
# External Keys ## Create External Key ### Body parameters ### Returns ### Example #### Response (200) ## List External Keys ### Query parameters ### Returns ### Example #### Response (200) ## Get External Key ### Path parameters ### Returns ### Example #### Response (200) ## Update External Key ### Path parameters ### Body parameters ### Returns ### Example #### Response (200) ## Delete External Key ### Path parameters ### Returns ### Example #### Response (200) ## Validate External Key ### Path parameters ### Returns ### Example #### Response (200) ## Domain types ### Beta AWS External Key Config ### Beta Azure External Key Config ### Beta Azure External Key Config Param ### Beta External Key ### Beta External Key Attached Attachment ### Beta External Key Unattached Attachment ### Beta GCP External Key Config ### External Key Delete Response ### External Key Validate Response
A whole new page. There's nothing to diff it against, so here is what it says.
# External Keys
## Create External Key
**POST** `/v1/organizations/external_keys`
Create an external key config owned by the caller's organization.
### Body parameters
- `provider_config: BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfigParam`
KMS provider identity and auth coordinates.
- `BetaAWSExternalKeyConfig object`
- `kms_arn: string`
Full ARN of the AWS KMS key.
maxLength: 2048
- `type: "aws"`
- `region: optional string or null`
AWS region. Derived from `kms_arn` if omitted.
- `role_arn: optional string or null`
**Deprecated**
IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
- `BetaGCPExternalKeyConfig object`
- `key_name: string`
Full resource name of the Cloud KMS key.
- `type: "gcp"`
- `BetaAzureExternalKeyConfigParam object`
Azure Key Vault provider configuration.
- `key_name: string`
Name of the key within the vault.
- `tenant_id: string`
Azure AD tenant ID.
- `type: "azure"`
- `vault_uri: string`
Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
- `client_id: optional string or null`
Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
- `display_name: optional string or null`
Human-friendly display name.
maxLength: 255, minLength: 1
- `geo: optional "us"`
Data residency geo. Only `us` is supported.
### Returns
- `BetaExternalKey object`
CMEK external key config belonging to the caller's organization.
Configs are organization-scoped. Workspaces attach to a config; once any
workspace references it, the provider fields become effectively immutable
(existing encrypted data needs the config for decrypt).
- `id: string`
Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
- `attachment: BetaExternalKeyAttachedAttachment or BetaExternalKeyUnattachedAttachment`
Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
- `BetaExternalKeyAttachedAttachment object`
- `type: "attached"`
default: attached
- `BetaExternalKeyUnattachedAttachment object`
- `type: "unattached"`
default: unattached
- `created_at: string`
format: date-time
- `display_name: string or null`
Human-friendly display name. Null if none was set.
- `geo: string`
Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
- `provider_config: BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfig`
KMS provider identity and auth coordinates.
- `BetaAWSExternalKeyConfig object`
- `kms_arn: string`
Full ARN of the AWS KMS key.
maxLength: 2048
- `type: "aws"`
- `region: optional string or null`
AWS region. Derived from `kms_arn` if omitted.
- `role_arn: optional string or null`
**Deprecated**
IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
- `BetaGCPExternalKeyConfig object`
- `key_name: string`
Full resource name of the Cloud KMS key.
- `type: "gcp"`
- `BetaAzureExternalKeyConfig object`
- `key_name: string`
Name of the key within the vault.
- `tenant_id: string`
Azure AD tenant ID.
- `type: "azure"`
- `vault_uri: string`
Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
- `client_id: optional string or null`
Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
- `type: "external_key"`
default: external_key
- `updated_at: string`
format: date-time
### Example
```bash
curl https://api.anthropic.com/v1/organizations/external_keys \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY" \
-d '{
"provider_config": {
"kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
"type": "aws"
}
}'
```
#### Response (200)
```json
{
"id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
"attachment": {
"type": "attached"
},
"created_at": "2024-10-30T23:58:27.427722Z",
"display_name": "prod-us-key",
"geo": "us",
"provider_config": {
"kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
"type": "aws",
"region": "us-east-1",
"role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
},
"type": "external_key",
"updated_at": "2024-10-30T23:58:27.427722Z"
}
```
## List External Keys
**GET** `/v1/organizations/external_keys`
List external key configs in the caller's organization.
Results are ordered by creation time (newest first). Use the
`next_page` cursor from the response to fetch subsequent pages.
### Query parameters
- `limit: optional number`
Number of results per page.
default: 20, maximum: 100, minimum: 1
- `page: optional string`
Opaque cursor from a previous response's `next_page`.
### Returns
- `data: array of BetaExternalKey`
- `id: string`
Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
- `attachment: BetaExternalKeyAttachedAttachment or BetaExternalKeyUnattachedAttachment`
Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
- `BetaExternalKeyAttachedAttachment object`
- `type: "attached"`
default: attached
- `BetaExternalKeyUnattachedAttachment object`
- `type: "unattached"`
default: unattached
- `created_at: string`
format: date-time
- `display_name: string or null`
Human-friendly display name. Null if none was set.
- `geo: string`
Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
- `provider_config: BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfig`
KMS provider identity and auth coordinates.
- `BetaAWSExternalKeyConfig object`
- `kms_arn: string`
Full ARN of the AWS KMS key.
maxLength: 2048
- `type: "aws"`
- `region: optional string or null`
AWS region. Derived from `kms_arn` if omitted.
- `role_arn: optional string or null`
**Deprecated**
IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
- `BetaGCPExternalKeyConfig object`
- `key_name: string`
Full resource name of the Cloud KMS key.
Cut at 300 lines. The page has the rest.
api/beta/organization/external_keys/create New page · 210 lines, new page
# Create External Key ## Body parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
# Create External Key
**POST** `/v1/organizations/external_keys`
Create an external key config owned by the caller's organization.
## Body parameters
- `provider_config: BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfigParam`
KMS provider identity and auth coordinates.
- `BetaAWSExternalKeyConfig object`
- `kms_arn: string`
Full ARN of the AWS KMS key.
maxLength: 2048
- `type: "aws"`
- `region: optional string or null`
AWS region. Derived from `kms_arn` if omitted.
- `role_arn: optional string or null`
**Deprecated**
IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
- `BetaGCPExternalKeyConfig object`
- `key_name: string`
Full resource name of the Cloud KMS key.
- `type: "gcp"`
- `BetaAzureExternalKeyConfigParam object`
Azure Key Vault provider configuration.
- `key_name: string`
Name of the key within the vault.
- `tenant_id: string`
Azure AD tenant ID.
- `type: "azure"`
- `vault_uri: string`
Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
- `client_id: optional string or null`
Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
- `display_name: optional string or null`
Human-friendly display name.
maxLength: 255, minLength: 1
- `geo: optional "us"`
Data residency geo. Only `us` is supported.
## Returns
- `BetaExternalKey object`
CMEK external key config belonging to the caller's organization.
Configs are organization-scoped. Workspaces attach to a config; once any
workspace references it, the provider fields become effectively immutable
(existing encrypted data needs the config for decrypt).
- `id: string`
Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
- `attachment: BetaExternalKeyAttachedAttachment or BetaExternalKeyUnattachedAttachment`
Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
- `BetaExternalKeyAttachedAttachment object`
- `type: "attached"`
default: attached
- `BetaExternalKeyUnattachedAttachment object`
- `type: "unattached"`
default: unattached
- `created_at: string`
format: date-time
- `display_name: string or null`
Human-friendly display name. Null if none was set.
- `geo: string`
Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
- `provider_config: BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfig`
KMS provider identity and auth coordinates.
- `BetaAWSExternalKeyConfig object`
- `kms_arn: string`
Full ARN of the AWS KMS key.
maxLength: 2048
- `type: "aws"`
- `region: optional string or null`
AWS region. Derived from `kms_arn` if omitted.
- `role_arn: optional string or null`
**Deprecated**
IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
- `BetaGCPExternalKeyConfig object`
- `key_name: string`
Full resource name of the Cloud KMS key.
- `type: "gcp"`
- `BetaAzureExternalKeyConfig object`
- `key_name: string`
Name of the key within the vault.
- `tenant_id: string`
Azure AD tenant ID.
- `type: "azure"`
- `vault_uri: string`
Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
- `client_id: optional string or null`
Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
- `type: "external_key"`
default: external_key
- `updated_at: string`
format: date-time
## Example
```bash
curl https://api.anthropic.com/v1/organizations/external_keys \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY" \
-d '{
"provider_config": {
"kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
"type": "aws"
}
}'
```
### Response (200)
```json
{
"id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
"attachment": {
"type": "attached"
},
"created_at": "2024-10-30T23:58:27.427722Z",
"display_name": "prod-us-key",
"geo": "us",
"provider_config": {
"kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
"type": "aws",
"region": "us-east-1",
"role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
},
"type": "external_key",
"updated_at": "2024-10-30T23:58:27.427722Z"
}
```
api/beta/organization/external_keys/delete New page · 43 lines, new page
# Delete External Key ## Path parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
# Delete External Key
**DELETE** `/v1/organizations/external_keys/{external_key_id}`
Delete an external key config.
The request is rejected if any workspace still references this config.
## Path parameters
- `external_key_id: string`
ID of the External Key.
maxLength: 2048
## Returns
- `id: string`
ID of the deleted External Key.
- `type: "external_key_deleted"`
default: external_key_deleted
## Example
```bash
curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \
-X DELETE \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"id": "ekey_01AbCdEfGhIjKlMnOpQrStUv",
"type": "external_key_deleted"
}
```
api/beta/organization/external_keys/list New page · 155 lines, new page
# List External Keys ## Query parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
# List External Keys
**GET** `/v1/organizations/external_keys`
List external key configs in the caller's organization.
Results are ordered by creation time (newest first). Use the
`next_page` cursor from the response to fetch subsequent pages.
## Query parameters
- `limit: optional number`
Number of results per page.
default: 20, maximum: 100, minimum: 1
- `page: optional string`
Opaque cursor from a previous response's `next_page`.
## Returns
- `data: array of BetaExternalKey`
- `id: string`
Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
- `attachment: BetaExternalKeyAttachedAttachment or BetaExternalKeyUnattachedAttachment`
Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
- `BetaExternalKeyAttachedAttachment object`
- `type: "attached"`
default: attached
- `BetaExternalKeyUnattachedAttachment object`
- `type: "unattached"`
default: unattached
- `created_at: string`
format: date-time
- `display_name: string or null`
Human-friendly display name. Null if none was set.
- `geo: string`
Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
- `provider_config: BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfig`
KMS provider identity and auth coordinates.
- `BetaAWSExternalKeyConfig object`
- `kms_arn: string`
Full ARN of the AWS KMS key.
maxLength: 2048
- `type: "aws"`
- `region: optional string or null`
AWS region. Derived from `kms_arn` if omitted.
- `role_arn: optional string or null`
**Deprecated**
IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
- `BetaGCPExternalKeyConfig object`
- `key_name: string`
Full resource name of the Cloud KMS key.
- `type: "gcp"`
- `BetaAzureExternalKeyConfig object`
- `key_name: string`
Name of the key within the vault.
- `tenant_id: string`
Azure AD tenant ID.
- `type: "azure"`
- `vault_uri: string`
Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
- `client_id: optional string or null`
Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
- `type: "external_key"`
default: external_key
- `updated_at: string`
format: date-time
- `next_page: string or null`
Opaque cursor for the next page, or null if no more results. Pass as `?page=` to fetch the next page.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/external_keys \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"data": [
{
"id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
"attachment": {
"type": "attached"
},
"created_at": "2024-10-30T23:58:27.427722Z",
"display_name": "prod-us-key",
"geo": "us",
"provider_config": {
"kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
"type": "aws",
"region": "us-east-1",
"role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
},
"type": "external_key",
"updated_at": "2024-10-30T23:58:27.427722Z"
}
],
"next_page": "next_page"
}
```
api/beta/organization/external_keys/retrieve New page · 145 lines, new page
# Get External Key ## Path parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
# Get External Key
**GET** `/v1/organizations/external_keys/{external_key_id}`
Retrieve a single external key config in the caller's organization by ID.
## Path parameters
- `external_key_id: string`
ID of the External Key.
maxLength: 2048
## Returns
- `BetaExternalKey object`
CMEK external key config belonging to the caller's organization.
Configs are organization-scoped. Workspaces attach to a config; once any
workspace references it, the provider fields become effectively immutable
(existing encrypted data needs the config for decrypt).
- `id: string`
Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
- `attachment: BetaExternalKeyAttachedAttachment or BetaExternalKeyUnattachedAttachment`
Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
- `BetaExternalKeyAttachedAttachment object`
- `type: "attached"`
default: attached
- `BetaExternalKeyUnattachedAttachment object`
- `type: "unattached"`
default: unattached
- `created_at: string`
format: date-time
- `display_name: string or null`
Human-friendly display name. Null if none was set.
- `geo: string`
Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
- `provider_config: BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfig`
KMS provider identity and auth coordinates.
- `BetaAWSExternalKeyConfig object`
- `kms_arn: string`
Full ARN of the AWS KMS key.
maxLength: 2048
- `type: "aws"`
- `region: optional string or null`
AWS region. Derived from `kms_arn` if omitted.
- `role_arn: optional string or null`
**Deprecated**
IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
- `BetaGCPExternalKeyConfig object`
- `key_name: string`
Full resource name of the Cloud KMS key.
- `type: "gcp"`
- `BetaAzureExternalKeyConfig object`
- `key_name: string`
Name of the key within the vault.
- `tenant_id: string`
Azure AD tenant ID.
- `type: "azure"`
- `vault_uri: string`
Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
- `client_id: optional string or null`
Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
- `type: "external_key"`
default: external_key
- `updated_at: string`
format: date-time
## Example
```bash
curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
"attachment": {
"type": "attached"
},
"created_at": "2024-10-30T23:58:27.427722Z",
"display_name": "prod-us-key",
"geo": "us",
"provider_config": {
"kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
"type": "aws",
"region": "us-east-1",
"role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
},
"type": "external_key",
"updated_at": "2024-10-30T23:58:27.427722Z"
}
```
api/beta/organization/external_keys/update New page · 217 lines, new page
# Update External Key ## Path parameters ## Body parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
# Update External Key
**POST** `/v1/organizations/external_keys/{external_key_id}`
Partially update an external key config. Omitted fields are left unchanged.
`display_name` is always editable. `geo` and `provider_config` cannot
be changed once any workspace references this config, because previously
encrypted data requires the original key identity to decrypt.
## Path parameters
- `external_key_id: string`
ID of the External Key.
maxLength: 2048
## Body parameters
- `display_name: optional string or null`
Human-friendly display name.
maxLength: 255, minLength: 1
- `geo: optional "us" or null`
Data residency geo. Only `us` is supported.
- `provider_config: optional BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfigParam or null`
KMS provider identity and auth coordinates.
- `BetaAWSExternalKeyConfig object`
- `kms_arn: string`
Full ARN of the AWS KMS key.
maxLength: 2048
- `type: "aws"`
- `region: optional string or null`
AWS region. Derived from `kms_arn` if omitted.
- `role_arn: optional string or null`
**Deprecated**
IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
- `BetaGCPExternalKeyConfig object`
- `key_name: string`
Full resource name of the Cloud KMS key.
- `type: "gcp"`
- `BetaAzureExternalKeyConfigParam object`
Azure Key Vault provider configuration.
- `key_name: string`
Name of the key within the vault.
- `tenant_id: string`
Azure AD tenant ID.
- `type: "azure"`
- `vault_uri: string`
Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
- `client_id: optional string or null`
Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
## Returns
- `BetaExternalKey object`
CMEK external key config belonging to the caller's organization.
Configs are organization-scoped. Workspaces attach to a config; once any
workspace references it, the provider fields become effectively immutable
(existing encrypted data needs the config for decrypt).
- `id: string`
Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
- `attachment: BetaExternalKeyAttachedAttachment or BetaExternalKeyUnattachedAttachment`
Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
- `BetaExternalKeyAttachedAttachment object`
- `type: "attached"`
default: attached
- `BetaExternalKeyUnattachedAttachment object`
- `type: "unattached"`
default: unattached
- `created_at: string`
format: date-time
- `display_name: string or null`
Human-friendly display name. Null if none was set.
- `geo: string`
Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
- `provider_config: BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfig`
KMS provider identity and auth coordinates.
- `BetaAWSExternalKeyConfig object`
- `kms_arn: string`
Full ARN of the AWS KMS key.
maxLength: 2048
- `type: "aws"`
- `region: optional string or null`
AWS region. Derived from `kms_arn` if omitted.
- `role_arn: optional string or null`
**Deprecated**
IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
- `BetaGCPExternalKeyConfig object`
- `key_name: string`
Full resource name of the Cloud KMS key.
- `type: "gcp"`
- `BetaAzureExternalKeyConfig object`
- `key_name: string`
Name of the key within the vault.
- `tenant_id: string`
Azure AD tenant ID.
- `type: "azure"`
- `vault_uri: string`
Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
- `client_id: optional string or null`
Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
- `type: "external_key"`
default: external_key
- `updated_at: string`
format: date-time
## Example
```bash
curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY" \
-d '{}'
```
### Response (200)
```json
{
"id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
"attachment": {
"type": "attached"
},
"created_at": "2024-10-30T23:58:27.427722Z",
"display_name": "prod-us-key",
"geo": "us",
"provider_config": {
"kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
"type": "aws",
"region": "us-east-1",
"role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
},
"type": "external_key",
"updated_at": "2024-10-30T23:58:27.427722Z"
}
```
api/beta/organization/external_keys/validate New page · 55 lines, new page
# Validate External Key ## Path parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
# Validate External Key
**POST** `/v1/organizations/external_keys/{external_key_id}/validate`
Validate an external key config against the customer's KMS.
Anthropic performs an encrypt/decrypt roundtrip against the configured
KMS key and waits up to 30 seconds for the result. The response status is
`success` if the roundtrip succeeded, or `failure` with an error
message if it failed or timed out.
## Path parameters
- `external_key_id: string`
ID of the External Key.
maxLength: 2048
## Returns
- `error: string or null`
Error message when status is `failure`. Null otherwise.
- `status: "failure" or "success"`
`success` — encrypt/decrypt roundtrip succeeded. `failure` — the roundtrip failed or timed out; see `error`.
- `"failure"`
- `"success"`
- `type: "external_key_validation"`
default: external_key_validation
## Example
```bash
curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID/validate \
-X POST \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"error": "error",
"status": "failure",
"type": "external_key_validation"
}
```
api/beta/organization/federation New page · 3816 lines, new page
# Federation ## Federation › Issuers ### Create Federation Issuer #### Headers #### Body parameters #### Returns #### Example ##### Response (200) ### List Federation Issuers #### Query parameters #### Headers #### Returns #### Example ##### Response (200) ### Get Federation Issuer #### Path parameters #### Headers #### Returns #### Example ##### Response (200) ### Update Federation Issuer #### Path parameters #### Headers #### Body parameters #### Returns #### Example ##### Response (200) ### Archive Federation Issuer #### Path parameters #### Headers #### Returns #### Example ##### Response (200) ## Federation › Rules ### Create Federation Rule #### Headers #### Body parameters #### Returns #### Example ##### Response (200) ### List Federation Rules #### Query parameters #### Headers #### Returns #### Example ##### Response (200) ### Get Federation Rule #### Path parameters #### Headers #### Returns #### Example ##### Response (200) ### Update Federation Rule #### Path parameters #### Headers #### Body parameters #### Returns #### Example ##### Response (200) ### Archive Federation Rule #### Path parameters #### Headers #### Returns #### Example ##### Response (200) ## Federation › Rules › Workspaces ### Add Federation Rule Workspace #### Path parameters #### Headers #### Body parameters #### Returns #### Example ##### Response (200) ### List Federation Rule Workspaces #### Path parameters #### Query parameters #### Headers #### Returns #### Example ##### Response (200) ### Remove Federation Rule Workspace #### Path parameters #### Headers #### Returns #### Example ##### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
# Federation
## Federation › Issuers
### Create Federation Issuer
**POST** `/v1/organizations/federation_issuers`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
Register an OIDC issuer that Anthropic will trust for workload identity
federation in your organization.
The `jwks` field controls how the issuer's signing keys are obtained and
takes one of three shapes selected by `type`: `discovery` (resolve keys
through OIDC discovery), `explicit_url` (fetch keys from a fixed JWKS
URL), or `inline` (provide a static key set). When `jwks.type` is
`discovery` and no `discovery_base` is set, the issuer URL must be
publicly reachable over HTTPS so Anthropic can fetch the discovery
document; for `explicit_url` and `inline` modes the issuer URL is only
matched as the JWT's `iss` claim and is not fetched.
#### Headers
- `"anthropic-beta": optional array of AnthropicBeta`
Optional header to specify the beta version(s) you want to use.
- `string`
- `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 38 more`
- `"message-batches-2024-09-24"`
- `"prompt-caching-2024-07-31"`
- `"computer-use-2024-10-22"`
- `"computer-use-2025-01-24"`
- `"pdfs-2024-09-25"`
- `"token-counting-2024-11-01"`
- `"token-efficient-tools-2025-02-19"`
- `"output-128k-2025-02-19"`
- `"files-api-2025-04-14"`
- `"mcp-client-2025-04-04"`
- `"mcp-client-2025-11-20"`
- `"dev-full-thinking-2025-05-14"`
- `"interleaved-thinking-2025-05-14"`
- `"code-execution-2025-05-22"`
- `"extended-cache-ttl-2025-04-11"`
- `"context-1m-2025-08-07"`
- `"context-management-2025-06-27"`
- `"model-context-window-exceeded-2025-08-26"`
- `"skills-2025-10-02"`
- `"fast-mode-2026-02-01"`
- `"output-300k-2026-03-24"`
- `"user-profiles-2026-03-24"`
- `"user-profiles-2026-08-18"`
- `"advisor-tool-2026-03-01"`
- `"managed-agents-2026-04-01"`
- `"cache-diagnosis-2026-04-07"`
- `"dreaming-2026-04-21"`
- `"thinking-token-count-2026-05-13"`
- `"server-side-fallback-2026-06-01"`
- `"server-side-fallback-2026-07-01"`
- `"fallback-credit-2026-06-01"`
- `"fallback-credit-2026-07-01"`
- `"agent-memory-2026-07-22"`
- `"mid-conversation-tool-changes-2026-07-01"`
- `"compact-2026-01-12"`
- `"computer-use-2025-11-24"`
- `"mcp-tunnels-2026-06-22"`
- `"structured-outputs-2025-11-13"`
- `"task-budgets-2026-03-13"`
- `"thinking-display-updates-2026-08-18"`
- `"ce-user-management-2026-07-13"`
#### Body parameters
- `issuer_url: string`
The `iss` claim value to match against.
minLength: 1
- `name: string`
Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
maxLength: 255, minLength: 1
- `check_jti: optional boolean or null`
Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Defaults to true. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.
- `jwks: optional BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline`
How signing keys are obtained. Defaults to OIDC discovery.
- `BetaJWKSDiscovery object`
JWKS via the issuer's OIDC discovery document.
- `type: "discovery"`
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `discovery_base: optional string or null`
Set when the discovery URL differs from `issuer_url`.
- `BetaJWKSExplicitURL object`
JWKS fetched from a fixed endpoint.
- `type: "explicit_url"`
- `url: string`
JWKS endpoint.
minLength: 1
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `BetaJWKSInline object`
JWKS supplied directly; no network fetch.
- `keys: array of map[unknown]`
Inline JWK objects.
minItems: 1
- `type: "inline"`
- `max_jwt_lifetime_seconds: optional number or null`
Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Defaults to 3600 (1h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
maximum: 176400, exclusiveMinimum: 0
#### Returns
- `BetaFederationIssuer object`
Registered external OIDC identity provider.
Records an external IdP the organization trusts for the RFC 7523
jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly.
- `id: string`
Tagged ID of the federation issuer.
- `archived_at: string or null`
If set, all rules referencing this issuer reject token exchange.
format: date-time
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
- `check_jti: boolean`
Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.
- `created_at: string`
When this issuer was created.
format: date-time
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
- `issuer_url: string`
The `iss` claim value. Incoming JWTs must match exactly.
- `jwks: BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline`
How signing keys are obtained for signature verification.
- `BetaJWKSDiscovery object`
JWKS via the issuer's OIDC discovery document.
- `type: "discovery"`
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `discovery_base: optional string or null`
Set when the discovery URL differs from `issuer_url`.
- `BetaJWKSExplicitURL object`
JWKS fetched from a fixed endpoint.
- `type: "explicit_url"`
- `url: string`
JWKS endpoint.
minLength: 1
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `BetaJWKSInline object`
JWKS supplied directly; no network fetch.
- `keys: array of map[unknown]`
Inline JWK objects.
minItems: 1
- `type: "inline"`
- `jwks_polling_disabled_at: string or null`
If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
format: date-time
- `max_jwt_lifetime_seconds: number`
Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
- `name: string`
Admin-chosen slug identifier.
- `poll_status: BetaFederationIssuerPollStatus or null`
Status of automatic JWKS polling for a federation issuer.
Anthropic periodically fetches the issuer's signing keys in the
background. These fields summarize the most recent fetches so the
health of the JWKS endpoint can be monitored.
Cut at 300 lines. The page has the rest.
api/beta/organization/federation/issuers New page · 1853 lines, new page
# Issuers ## Create Federation Issuer ### Headers ### Body parameters ### Returns ### Example #### Response (200) ## List Federation Issuers ### Query parameters ### Headers ### Returns ### Example #### Response (200) ## Get Federation Issuer ### Path parameters ### Headers ### Returns ### Example #### Response (200) ## Update Federation Issuer ### Path parameters ### Headers ### Body parameters ### Returns ### Example #### Response (200) ## Archive Federation Issuer ### Path parameters ### Headers ### Returns ### Example #### Response (200) ## Domain types ### Beta Federation Issuer ### Beta Federation Issuer Poll Status ### Beta JWKS Discovery ### Beta JWKS Explicit URL ### Beta JWKS Inline
A whole new page. There's nothing to diff it against, so here is what it says.
# Issuers
## Create Federation Issuer
**POST** `/v1/organizations/federation_issuers`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
Register an OIDC issuer that Anthropic will trust for workload identity
federation in your organization.
The `jwks` field controls how the issuer's signing keys are obtained and
takes one of three shapes selected by `type`: `discovery` (resolve keys
through OIDC discovery), `explicit_url` (fetch keys from a fixed JWKS
URL), or `inline` (provide a static key set). When `jwks.type` is
`discovery` and no `discovery_base` is set, the issuer URL must be
publicly reachable over HTTPS so Anthropic can fetch the discovery
document; for `explicit_url` and `inline` modes the issuer URL is only
matched as the JWT's `iss` claim and is not fetched.
### Headers
- `"anthropic-beta": optional array of AnthropicBeta`
Optional header to specify the beta version(s) you want to use.
- `string`
- `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 38 more`
- `"message-batches-2024-09-24"`
- `"prompt-caching-2024-07-31"`
- `"computer-use-2024-10-22"`
- `"computer-use-2025-01-24"`
- `"pdfs-2024-09-25"`
- `"token-counting-2024-11-01"`
- `"token-efficient-tools-2025-02-19"`
- `"output-128k-2025-02-19"`
- `"files-api-2025-04-14"`
- `"mcp-client-2025-04-04"`
- `"mcp-client-2025-11-20"`
- `"dev-full-thinking-2025-05-14"`
- `"interleaved-thinking-2025-05-14"`
- `"code-execution-2025-05-22"`
- `"extended-cache-ttl-2025-04-11"`
- `"context-1m-2025-08-07"`
- `"context-management-2025-06-27"`
- `"model-context-window-exceeded-2025-08-26"`
- `"skills-2025-10-02"`
- `"fast-mode-2026-02-01"`
- `"output-300k-2026-03-24"`
- `"user-profiles-2026-03-24"`
- `"user-profiles-2026-08-18"`
- `"advisor-tool-2026-03-01"`
- `"managed-agents-2026-04-01"`
- `"cache-diagnosis-2026-04-07"`
- `"dreaming-2026-04-21"`
- `"thinking-token-count-2026-05-13"`
- `"server-side-fallback-2026-06-01"`
- `"server-side-fallback-2026-07-01"`
- `"fallback-credit-2026-06-01"`
- `"fallback-credit-2026-07-01"`
- `"agent-memory-2026-07-22"`
- `"mid-conversation-tool-changes-2026-07-01"`
- `"compact-2026-01-12"`
- `"computer-use-2025-11-24"`
- `"mcp-tunnels-2026-06-22"`
- `"structured-outputs-2025-11-13"`
- `"task-budgets-2026-03-13"`
- `"thinking-display-updates-2026-08-18"`
- `"ce-user-management-2026-07-13"`
### Body parameters
- `issuer_url: string`
The `iss` claim value to match against.
minLength: 1
- `name: string`
Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
maxLength: 255, minLength: 1
- `check_jti: optional boolean or null`
Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Defaults to true. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.
- `jwks: optional BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline`
How signing keys are obtained. Defaults to OIDC discovery.
- `BetaJWKSDiscovery object`
JWKS via the issuer's OIDC discovery document.
- `type: "discovery"`
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `discovery_base: optional string or null`
Set when the discovery URL differs from `issuer_url`.
- `BetaJWKSExplicitURL object`
JWKS fetched from a fixed endpoint.
- `type: "explicit_url"`
- `url: string`
JWKS endpoint.
minLength: 1
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `BetaJWKSInline object`
JWKS supplied directly; no network fetch.
- `keys: array of map[unknown]`
Inline JWK objects.
minItems: 1
- `type: "inline"`
- `max_jwt_lifetime_seconds: optional number or null`
Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Defaults to 3600 (1h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
maximum: 176400, exclusiveMinimum: 0
### Returns
- `BetaFederationIssuer object`
Registered external OIDC identity provider.
Records an external IdP the organization trusts for the RFC 7523
jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly.
- `id: string`
Tagged ID of the federation issuer.
- `archived_at: string or null`
If set, all rules referencing this issuer reject token exchange.
format: date-time
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
- `check_jti: boolean`
Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.
- `created_at: string`
When this issuer was created.
format: date-time
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
- `issuer_url: string`
The `iss` claim value. Incoming JWTs must match exactly.
- `jwks: BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline`
How signing keys are obtained for signature verification.
- `BetaJWKSDiscovery object`
JWKS via the issuer's OIDC discovery document.
- `type: "discovery"`
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `discovery_base: optional string or null`
Set when the discovery URL differs from `issuer_url`.
- `BetaJWKSExplicitURL object`
JWKS fetched from a fixed endpoint.
- `type: "explicit_url"`
- `url: string`
JWKS endpoint.
minLength: 1
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `BetaJWKSInline object`
JWKS supplied directly; no network fetch.
- `keys: array of map[unknown]`
Inline JWK objects.
minItems: 1
- `type: "inline"`
- `jwks_polling_disabled_at: string or null`
If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
format: date-time
- `max_jwt_lifetime_seconds: number`
Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
- `name: string`
Admin-chosen slug identifier.
- `poll_status: BetaFederationIssuerPollStatus or null`
Status of automatic JWKS polling for a federation issuer.
Anthropic periodically fetches the issuer's signing keys in the
background. These fields summarize the most recent fetches so the
health of the JWKS endpoint can be monitored.
- `consecutive_failures: number`
Cut at 300 lines. The page has the rest.
api/beta/organization/federation/issuers/archive New page · 292 lines, new page
# Archive Federation Issuer ## Path parameters ## Headers ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
# Archive Federation Issuer
**POST** `/v1/organizations/federation_issuers/{federation_issuer_id}/archive`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
Archive a federation issuer.
Idempotent; re-archiving returns the issuer with its original
`archived_at`. Rejected with 400 if any live (non-archived) federation
rule still references the issuer; archive those rules first (a rule's
issuer cannot be changed), or recreate them against another issuer.
## Path parameters
- `federation_issuer_id: string`
ID of the federation issuer to archive.
## Headers
- `"anthropic-beta": optional array of AnthropicBeta`
Optional header to specify the beta version(s) you want to use.
- `string`
- `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 38 more`
- `"message-batches-2024-09-24"`
- `"prompt-caching-2024-07-31"`
- `"computer-use-2024-10-22"`
- `"computer-use-2025-01-24"`
- `"pdfs-2024-09-25"`
- `"token-counting-2024-11-01"`
- `"token-efficient-tools-2025-02-19"`
- `"output-128k-2025-02-19"`
- `"files-api-2025-04-14"`
- `"mcp-client-2025-04-04"`
- `"mcp-client-2025-11-20"`
- `"dev-full-thinking-2025-05-14"`
- `"interleaved-thinking-2025-05-14"`
- `"code-execution-2025-05-22"`
- `"extended-cache-ttl-2025-04-11"`
- `"context-1m-2025-08-07"`
- `"context-management-2025-06-27"`
- `"model-context-window-exceeded-2025-08-26"`
- `"skills-2025-10-02"`
- `"fast-mode-2026-02-01"`
- `"output-300k-2026-03-24"`
- `"user-profiles-2026-03-24"`
- `"user-profiles-2026-08-18"`
- `"advisor-tool-2026-03-01"`
- `"managed-agents-2026-04-01"`
- `"cache-diagnosis-2026-04-07"`
- `"dreaming-2026-04-21"`
- `"thinking-token-count-2026-05-13"`
- `"server-side-fallback-2026-06-01"`
- `"server-side-fallback-2026-07-01"`
- `"fallback-credit-2026-06-01"`
- `"fallback-credit-2026-07-01"`
- `"agent-memory-2026-07-22"`
- `"mid-conversation-tool-changes-2026-07-01"`
- `"compact-2026-01-12"`
- `"computer-use-2025-11-24"`
- `"mcp-tunnels-2026-06-22"`
- `"structured-outputs-2025-11-13"`
- `"task-budgets-2026-03-13"`
- `"thinking-display-updates-2026-08-18"`
- `"ce-user-management-2026-07-13"`
## Returns
- `BetaFederationIssuer object`
Registered external OIDC identity provider.
Records an external IdP the organization trusts for the RFC 7523
jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly.
- `id: string`
Tagged ID of the federation issuer.
- `archived_at: string or null`
If set, all rules referencing this issuer reject token exchange.
format: date-time
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
- `check_jti: boolean`
Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.
- `created_at: string`
When this issuer was created.
format: date-time
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
- `issuer_url: string`
The `iss` claim value. Incoming JWTs must match exactly.
- `jwks: BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline`
How signing keys are obtained for signature verification.
- `BetaJWKSDiscovery object`
JWKS via the issuer's OIDC discovery document.
- `type: "discovery"`
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `discovery_base: optional string or null`
Set when the discovery URL differs from `issuer_url`.
- `BetaJWKSExplicitURL object`
JWKS fetched from a fixed endpoint.
- `type: "explicit_url"`
- `url: string`
JWKS endpoint.
minLength: 1
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `BetaJWKSInline object`
JWKS supplied directly; no network fetch.
- `keys: array of map[unknown]`
Inline JWK objects.
minItems: 1
- `type: "inline"`
- `jwks_polling_disabled_at: string or null`
If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
format: date-time
- `max_jwt_lifetime_seconds: number`
Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
- `name: string`
Admin-chosen slug identifier.
- `poll_status: BetaFederationIssuerPollStatus or null`
Status of automatic JWKS polling for a federation issuer.
Anthropic periodically fetches the issuer's signing keys in the
background. These fields summarize the most recent fetches so the
health of the JWKS endpoint can be monitored.
- `consecutive_failures: number`
Consecutive fetch failures since the last success.
- `last_fetched_at: string or null`
When the last successful fetch completed.
format: date-time
- `next_poll_at: string or null`
When the next fetch is scheduled. Null if paused.
format: date-time
- `type: "federation_issuer"`
default: federation_issuer
- `updated_at: string`
When this issuer was last updated.
format: date-time
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID/archive \
-X POST \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"check_jti": true,
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"issuer_url": "https://token.actions.githubusercontent.com",
"jwks": {
"type": "discovery",
"ca_cert_pem": "ca_cert_pem",
"discovery_base": "discovery_base"
},
"jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",
"max_jwt_lifetime_seconds": 0,
"name": "github-actions",
"poll_status": {
"consecutive_failures": 0,
"last_fetched_at": "2019-12-27T18:11:19.117Z",
"next_poll_at": "2019-12-27T18:11:19.117Z"
},
"type": "federation_issuer",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id"
}
```
api/beta/organization/federation/issuers/create New page · 369 lines, new page
# Create Federation Issuer ## Headers ## Body parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
# Create Federation Issuer
**POST** `/v1/organizations/federation_issuers`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
Register an OIDC issuer that Anthropic will trust for workload identity
federation in your organization.
The `jwks` field controls how the issuer's signing keys are obtained and
takes one of three shapes selected by `type`: `discovery` (resolve keys
through OIDC discovery), `explicit_url` (fetch keys from a fixed JWKS
URL), or `inline` (provide a static key set). When `jwks.type` is
`discovery` and no `discovery_base` is set, the issuer URL must be
publicly reachable over HTTPS so Anthropic can fetch the discovery
document; for `explicit_url` and `inline` modes the issuer URL is only
matched as the JWT's `iss` claim and is not fetched.
## Headers
- `"anthropic-beta": optional array of AnthropicBeta`
Optional header to specify the beta version(s) you want to use.
- `string`
- `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 38 more`
- `"message-batches-2024-09-24"`
- `"prompt-caching-2024-07-31"`
- `"computer-use-2024-10-22"`
- `"computer-use-2025-01-24"`
- `"pdfs-2024-09-25"`
- `"token-counting-2024-11-01"`
- `"token-efficient-tools-2025-02-19"`
- `"output-128k-2025-02-19"`
- `"files-api-2025-04-14"`
- `"mcp-client-2025-04-04"`
- `"mcp-client-2025-11-20"`
- `"dev-full-thinking-2025-05-14"`
- `"interleaved-thinking-2025-05-14"`
- `"code-execution-2025-05-22"`
- `"extended-cache-ttl-2025-04-11"`
- `"context-1m-2025-08-07"`
- `"context-management-2025-06-27"`
- `"model-context-window-exceeded-2025-08-26"`
- `"skills-2025-10-02"`
- `"fast-mode-2026-02-01"`
- `"output-300k-2026-03-24"`
- `"user-profiles-2026-03-24"`
- `"user-profiles-2026-08-18"`
- `"advisor-tool-2026-03-01"`
- `"managed-agents-2026-04-01"`
- `"cache-diagnosis-2026-04-07"`
- `"dreaming-2026-04-21"`
- `"thinking-token-count-2026-05-13"`
- `"server-side-fallback-2026-06-01"`
- `"server-side-fallback-2026-07-01"`
- `"fallback-credit-2026-06-01"`
- `"fallback-credit-2026-07-01"`
- `"agent-memory-2026-07-22"`
- `"mid-conversation-tool-changes-2026-07-01"`
- `"compact-2026-01-12"`
- `"computer-use-2025-11-24"`
- `"mcp-tunnels-2026-06-22"`
- `"structured-outputs-2025-11-13"`
- `"task-budgets-2026-03-13"`
- `"thinking-display-updates-2026-08-18"`
- `"ce-user-management-2026-07-13"`
## Body parameters
- `issuer_url: string`
The `iss` claim value to match against.
minLength: 1
- `name: string`
Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
maxLength: 255, minLength: 1
- `check_jti: optional boolean or null`
Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Defaults to true. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.
- `jwks: optional BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline`
How signing keys are obtained. Defaults to OIDC discovery.
- `BetaJWKSDiscovery object`
JWKS via the issuer's OIDC discovery document.
- `type: "discovery"`
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `discovery_base: optional string or null`
Set when the discovery URL differs from `issuer_url`.
- `BetaJWKSExplicitURL object`
JWKS fetched from a fixed endpoint.
- `type: "explicit_url"`
- `url: string`
JWKS endpoint.
minLength: 1
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `BetaJWKSInline object`
JWKS supplied directly; no network fetch.
- `keys: array of map[unknown]`
Inline JWK objects.
minItems: 1
- `type: "inline"`
- `max_jwt_lifetime_seconds: optional number or null`
Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Defaults to 3600 (1h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
maximum: 176400, exclusiveMinimum: 0
## Returns
- `BetaFederationIssuer object`
Registered external OIDC identity provider.
Records an external IdP the organization trusts for the RFC 7523
jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly.
- `id: string`
Tagged ID of the federation issuer.
- `archived_at: string or null`
If set, all rules referencing this issuer reject token exchange.
format: date-time
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
- `check_jti: boolean`
Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.
- `created_at: string`
When this issuer was created.
format: date-time
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
- `issuer_url: string`
The `iss` claim value. Incoming JWTs must match exactly.
- `jwks: BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline`
How signing keys are obtained for signature verification.
- `BetaJWKSDiscovery object`
JWKS via the issuer's OIDC discovery document.
- `type: "discovery"`
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `discovery_base: optional string or null`
Set when the discovery URL differs from `issuer_url`.
- `BetaJWKSExplicitURL object`
JWKS fetched from a fixed endpoint.
- `type: "explicit_url"`
- `url: string`
JWKS endpoint.
minLength: 1
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `BetaJWKSInline object`
JWKS supplied directly; no network fetch.
- `keys: array of map[unknown]`
Inline JWK objects.
minItems: 1
- `type: "inline"`
- `jwks_polling_disabled_at: string or null`
If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
format: date-time
- `max_jwt_lifetime_seconds: number`
Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
- `name: string`
Admin-chosen slug identifier.
- `poll_status: BetaFederationIssuerPollStatus or null`
Status of automatic JWKS polling for a federation issuer.
Anthropic periodically fetches the issuer's signing keys in the
background. These fields summarize the most recent fetches so the
health of the JWKS endpoint can be monitored.
- `consecutive_failures: number`
Consecutive fetch failures since the last success.
Cut at 300 lines. The page has the rest.
api/beta/organization/federation/issuers/list New page · 304 lines, new page
# List Federation Issuers ## Query parameters ## Headers ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
# List Federation Issuers
**GET** `/v1/organizations/federation_issuers`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
List federation issuers in your organization.
Archived issuers are excluded unless `include_archived=true`.
## Query parameters
- `include_archived: optional boolean`
Include archived resources. Defaults to false.
default: false
- `limit: optional number`
Number of results per page.
default: 20, maximum: 100, minimum: 1
- `page: optional string`
Opaque cursor from a previous response's `next_page`.
## Headers
- `"anthropic-beta": optional array of AnthropicBeta`
Optional header to specify the beta version(s) you want to use.
- `string`
- `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 38 more`
- `"message-batches-2024-09-24"`
- `"prompt-caching-2024-07-31"`
- `"computer-use-2024-10-22"`
- `"computer-use-2025-01-24"`
- `"pdfs-2024-09-25"`
- `"token-counting-2024-11-01"`
- `"token-efficient-tools-2025-02-19"`
- `"output-128k-2025-02-19"`
- `"files-api-2025-04-14"`
- `"mcp-client-2025-04-04"`
- `"mcp-client-2025-11-20"`
- `"dev-full-thinking-2025-05-14"`
- `"interleaved-thinking-2025-05-14"`
- `"code-execution-2025-05-22"`
- `"extended-cache-ttl-2025-04-11"`
- `"context-1m-2025-08-07"`
- `"context-management-2025-06-27"`
- `"model-context-window-exceeded-2025-08-26"`
- `"skills-2025-10-02"`
- `"fast-mode-2026-02-01"`
- `"output-300k-2026-03-24"`
- `"user-profiles-2026-03-24"`
- `"user-profiles-2026-08-18"`
- `"advisor-tool-2026-03-01"`
- `"managed-agents-2026-04-01"`
- `"cache-diagnosis-2026-04-07"`
- `"dreaming-2026-04-21"`
- `"thinking-token-count-2026-05-13"`
- `"server-side-fallback-2026-06-01"`
- `"server-side-fallback-2026-07-01"`
- `"fallback-credit-2026-06-01"`
- `"fallback-credit-2026-07-01"`
- `"agent-memory-2026-07-22"`
- `"mid-conversation-tool-changes-2026-07-01"`
- `"compact-2026-01-12"`
- `"computer-use-2025-11-24"`
- `"mcp-tunnels-2026-06-22"`
- `"structured-outputs-2025-11-13"`
- `"task-budgets-2026-03-13"`
- `"thinking-display-updates-2026-08-18"`
- `"ce-user-management-2026-07-13"`
## Returns
- `data: array of BetaFederationIssuer`
- `id: string`
Tagged ID of the federation issuer.
- `archived_at: string or null`
If set, all rules referencing this issuer reject token exchange.
format: date-time
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
- `check_jti: boolean`
Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.
- `created_at: string`
When this issuer was created.
format: date-time
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
- `issuer_url: string`
The `iss` claim value. Incoming JWTs must match exactly.
- `jwks: BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline`
How signing keys are obtained for signature verification.
- `BetaJWKSDiscovery object`
JWKS via the issuer's OIDC discovery document.
- `type: "discovery"`
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `discovery_base: optional string or null`
Set when the discovery URL differs from `issuer_url`.
- `BetaJWKSExplicitURL object`
JWKS fetched from a fixed endpoint.
- `type: "explicit_url"`
- `url: string`
JWKS endpoint.
minLength: 1
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `BetaJWKSInline object`
JWKS supplied directly; no network fetch.
- `keys: array of map[unknown]`
Inline JWK objects.
minItems: 1
- `type: "inline"`
- `jwks_polling_disabled_at: string or null`
If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
format: date-time
- `max_jwt_lifetime_seconds: number`
Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
- `name: string`
Admin-chosen slug identifier.
- `poll_status: BetaFederationIssuerPollStatus or null`
Status of automatic JWKS polling for a federation issuer.
Anthropic periodically fetches the issuer's signing keys in the
background. These fields summarize the most recent fetches so the
health of the JWKS endpoint can be monitored.
- `consecutive_failures: number`
Consecutive fetch failures since the last success.
- `last_fetched_at: string or null`
When the last successful fetch completed.
format: date-time
- `next_poll_at: string or null`
When the next fetch is scheduled. Null if paused.
format: date-time
- `type: "federation_issuer"`
default: federation_issuer
- `updated_at: string`
When this issuer was last updated.
format: date-time
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.
- `next_page: string or null`
Opaque cursor for the next page, or null if no more results.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/federation_issuers \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"data": [
{
"id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"check_jti": true,
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"issuer_url": "https://token.actions.githubusercontent.com",
"jwks": {
"type": "discovery",
"ca_cert_pem": "ca_cert_pem",
"discovery_base": "discovery_base"
},
"jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",
"max_jwt_lifetime_seconds": 0,
"name": "github-actions",
"poll_status": {
"consecutive_failures": 0,
"last_fetched_at": "2019-12-27T18:11:19.117Z",
"next_poll_at": "2019-12-27T18:11:19.117Z"
},
"type": "federation_issuer",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id"
}
Cut at 300 lines. The page has the rest.
api/beta/organization/federation/issuers/retrieve New page · 286 lines, new page
# Get Federation Issuer ## Path parameters ## Headers ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
# Get Federation Issuer
**GET** `/v1/organizations/federation_issuers/{federation_issuer_id}`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
Retrieve a federation issuer by its ID (`fdis_...`).
## Path parameters
- `federation_issuer_id: string`
ID of the federation issuer.
## Headers
- `"anthropic-beta": optional array of AnthropicBeta`
Optional header to specify the beta version(s) you want to use.
- `string`
- `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 38 more`
- `"message-batches-2024-09-24"`
- `"prompt-caching-2024-07-31"`
- `"computer-use-2024-10-22"`
- `"computer-use-2025-01-24"`
- `"pdfs-2024-09-25"`
- `"token-counting-2024-11-01"`
- `"token-efficient-tools-2025-02-19"`
- `"output-128k-2025-02-19"`
- `"files-api-2025-04-14"`
- `"mcp-client-2025-04-04"`
- `"mcp-client-2025-11-20"`
- `"dev-full-thinking-2025-05-14"`
- `"interleaved-thinking-2025-05-14"`
- `"code-execution-2025-05-22"`
- `"extended-cache-ttl-2025-04-11"`
- `"context-1m-2025-08-07"`
- `"context-management-2025-06-27"`
- `"model-context-window-exceeded-2025-08-26"`
- `"skills-2025-10-02"`
- `"fast-mode-2026-02-01"`
- `"output-300k-2026-03-24"`
- `"user-profiles-2026-03-24"`
- `"user-profiles-2026-08-18"`
- `"advisor-tool-2026-03-01"`
- `"managed-agents-2026-04-01"`
- `"cache-diagnosis-2026-04-07"`
- `"dreaming-2026-04-21"`
- `"thinking-token-count-2026-05-13"`
- `"server-side-fallback-2026-06-01"`
- `"server-side-fallback-2026-07-01"`
- `"fallback-credit-2026-06-01"`
- `"fallback-credit-2026-07-01"`
- `"agent-memory-2026-07-22"`
- `"mid-conversation-tool-changes-2026-07-01"`
- `"compact-2026-01-12"`
- `"computer-use-2025-11-24"`
- `"mcp-tunnels-2026-06-22"`
- `"structured-outputs-2025-11-13"`
- `"task-budgets-2026-03-13"`
- `"thinking-display-updates-2026-08-18"`
- `"ce-user-management-2026-07-13"`
## Returns
- `BetaFederationIssuer object`
Registered external OIDC identity provider.
Records an external IdP the organization trusts for the RFC 7523
jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly.
- `id: string`
Tagged ID of the federation issuer.
- `archived_at: string or null`
If set, all rules referencing this issuer reject token exchange.
format: date-time
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
- `check_jti: boolean`
Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.
- `created_at: string`
When this issuer was created.
format: date-time
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
- `issuer_url: string`
The `iss` claim value. Incoming JWTs must match exactly.
- `jwks: BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline`
How signing keys are obtained for signature verification.
- `BetaJWKSDiscovery object`
JWKS via the issuer's OIDC discovery document.
- `type: "discovery"`
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `discovery_base: optional string or null`
Set when the discovery URL differs from `issuer_url`.
- `BetaJWKSExplicitURL object`
JWKS fetched from a fixed endpoint.
- `type: "explicit_url"`
- `url: string`
JWKS endpoint.
minLength: 1
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `BetaJWKSInline object`
JWKS supplied directly; no network fetch.
- `keys: array of map[unknown]`
Inline JWK objects.
minItems: 1
- `type: "inline"`
- `jwks_polling_disabled_at: string or null`
If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
format: date-time
- `max_jwt_lifetime_seconds: number`
Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
- `name: string`
Admin-chosen slug identifier.
- `poll_status: BetaFederationIssuerPollStatus or null`
Status of automatic JWKS polling for a federation issuer.
Anthropic periodically fetches the issuer's signing keys in the
background. These fields summarize the most recent fetches so the
health of the JWKS endpoint can be monitored.
- `consecutive_failures: number`
Consecutive fetch failures since the last success.
- `last_fetched_at: string or null`
When the last successful fetch completed.
format: date-time
- `next_poll_at: string or null`
When the next fetch is scheduled. Null if paused.
format: date-time
- `type: "federation_issuer"`
default: federation_issuer
- `updated_at: string`
When this issuer was last updated.
format: date-time
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"check_jti": true,
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"issuer_url": "https://token.actions.githubusercontent.com",
"jwks": {
"type": "discovery",
"ca_cert_pem": "ca_cert_pem",
"discovery_base": "discovery_base"
},
"jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",
"max_jwt_lifetime_seconds": 0,
"name": "github-actions",
"poll_status": {
"consecutive_failures": 0,
"last_fetched_at": "2019-12-27T18:11:19.117Z",
"next_poll_at": "2019-12-27T18:11:19.117Z"
},
"type": "federation_issuer",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id"
}
```
api/beta/organization/federation/issuers/update New page · 373 lines, new page
# Update Federation Issuer ## Path parameters ## Headers ## Body parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
# Update Federation Issuer
**POST** `/v1/organizations/federation_issuers/{federation_issuer_id}`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
Partially update a federation issuer.
Setting `jwks` replaces the full JWKS shape at once. Archived issuers
cannot be updated; this returns 400. Create a new issuer instead.
Updating an issuer that backs a rule with a scope outside
`workspace:developer` or `workspace:inference` requires a Console
session.
## Path parameters
- `federation_issuer_id: string`
ID of the federation issuer to update.
## Headers
- `"anthropic-beta": optional array of AnthropicBeta`
Optional header to specify the beta version(s) you want to use.
- `string`
- `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 38 more`
- `"message-batches-2024-09-24"`
- `"prompt-caching-2024-07-31"`
- `"computer-use-2024-10-22"`
- `"computer-use-2025-01-24"`
- `"pdfs-2024-09-25"`
- `"token-counting-2024-11-01"`
- `"token-efficient-tools-2025-02-19"`
- `"output-128k-2025-02-19"`
- `"files-api-2025-04-14"`
- `"mcp-client-2025-04-04"`
- `"mcp-client-2025-11-20"`
- `"dev-full-thinking-2025-05-14"`
- `"interleaved-thinking-2025-05-14"`
- `"code-execution-2025-05-22"`
- `"extended-cache-ttl-2025-04-11"`
- `"context-1m-2025-08-07"`
- `"context-management-2025-06-27"`
- `"model-context-window-exceeded-2025-08-26"`
- `"skills-2025-10-02"`
- `"fast-mode-2026-02-01"`
- `"output-300k-2026-03-24"`
- `"user-profiles-2026-03-24"`
- `"user-profiles-2026-08-18"`
- `"advisor-tool-2026-03-01"`
- `"managed-agents-2026-04-01"`
- `"cache-diagnosis-2026-04-07"`
- `"dreaming-2026-04-21"`
- `"thinking-token-count-2026-05-13"`
- `"server-side-fallback-2026-06-01"`
- `"server-side-fallback-2026-07-01"`
- `"fallback-credit-2026-06-01"`
- `"fallback-credit-2026-07-01"`
- `"agent-memory-2026-07-22"`
- `"mid-conversation-tool-changes-2026-07-01"`
- `"compact-2026-01-12"`
- `"computer-use-2025-11-24"`
- `"mcp-tunnels-2026-06-22"`
- `"structured-outputs-2025-11-13"`
- `"task-budgets-2026-03-13"`
- `"thinking-display-updates-2026-08-18"`
- `"ce-user-management-2026-07-13"`
## Body parameters
- `check_jti: optional boolean or null`
Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.
- `issuer_url: optional string or null`
Replaces the `iss` claim value to match against. For discovery-mode issuers without a `discovery_base`, this is also the URL Anthropic fetches the OIDC discovery document and signing keys from, so changing it repoints the JWKS source. Changing the issuer URL to a well-known shared platform is rejected while any live rule under this issuer would not constrain tenant identity.
minLength: 1
- `jwks: optional BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline or null`
Replaces the entire JWKS configuration.
- `BetaJWKSDiscovery object`
JWKS via the issuer's OIDC discovery document.
- `type: "discovery"`
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `discovery_base: optional string or null`
Set when the discovery URL differs from `issuer_url`.
- `BetaJWKSExplicitURL object`
JWKS fetched from a fixed endpoint.
- `type: "explicit_url"`
- `url: string`
JWKS endpoint.
minLength: 1
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `BetaJWKSInline object`
JWKS supplied directly; no network fetch.
- `keys: array of map[unknown]`
Inline JWK objects.
minItems: 1
- `type: "inline"`
- `jwks_polling_disabled: optional boolean or null`
Only `false` is accepted, to re-enable polling after the system pauses it. Polling is paused automatically; sending `true` is rejected.
- `max_jwt_lifetime_seconds: optional number or null`
Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
maximum: 176400, exclusiveMinimum: 0
- `name: optional string or null`
Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
maxLength: 255, minLength: 1
## Returns
- `BetaFederationIssuer object`
Registered external OIDC identity provider.
Records an external IdP the organization trusts for the RFC 7523
jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly.
- `id: string`
Tagged ID of the federation issuer.
- `archived_at: string or null`
If set, all rules referencing this issuer reject token exchange.
format: date-time
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
- `check_jti: boolean`
Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.
- `created_at: string`
When this issuer was created.
format: date-time
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
- `issuer_url: string`
The `iss` claim value. Incoming JWTs must match exactly.
- `jwks: BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline`
How signing keys are obtained for signature verification.
- `BetaJWKSDiscovery object`
JWKS via the issuer's OIDC discovery document.
- `type: "discovery"`
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `discovery_base: optional string or null`
Set when the discovery URL differs from `issuer_url`.
- `BetaJWKSExplicitURL object`
JWKS fetched from a fixed endpoint.
- `type: "explicit_url"`
- `url: string`
JWKS endpoint.
minLength: 1
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `BetaJWKSInline object`
JWKS supplied directly; no network fetch.
- `keys: array of map[unknown]`
Inline JWK objects.
minItems: 1
- `type: "inline"`
- `jwks_polling_disabled_at: string or null`
If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
format: date-time
- `max_jwt_lifetime_seconds: number`
Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
- `name: string`
Admin-chosen slug identifier.
- `poll_status: BetaFederationIssuerPollStatus or null`
Status of automatic JWKS polling for a federation issuer.
Cut at 300 lines. The page has the rest.
api/beta/organization/federation/rules New page · 2396 lines, new page
# Rules ## Create Federation Rule ### Headers ### Body parameters ### Returns ### Example #### Response (200) ## List Federation Rules ### Query parameters ### Headers ### Returns ### Example #### Response (200) ## Get Federation Rule ### Path parameters ### Headers ### Returns ### Example #### Response (200) ## Update Federation Rule ### Path parameters ### Headers ### Body parameters ### Returns ### Example #### Response (200) ## Archive Federation Rule ### Path parameters ### Headers ### Returns ### Example #### Response (200) ## Domain types ### Beta Federation Rule ### Beta Federation Rule Match ### Beta Federation Rule Workspace ### Beta Service Account Target ## Rules › Workspaces ### Add Federation Rule Workspace #### Path parameters #### Headers #### Body parameters #### Returns #### Example ##### Response (200) ### List Federation Rule Workspaces #### Path parameters #### Query parameters #### Headers #### Returns #### Example ##### Response (200) ### Remove Federation Rule Workspace #### Path parameters #### Headers #### Returns #### Example ##### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
# Rules
## Create Federation Rule
**POST** `/v1/organizations/federation_rules`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
Create a federation rule owned by your organization.
The referenced issuer and the target service account must already exist
in the same organization; invalid references are rejected with a 400
error. The workspace reference is validated. Membership is not checked
at rule creation: token exchange resolves a single enabled workspace per
call and is rejected unless the target service account is a member of
that workspace (it is implicitly a member of the default workspace).
Rules on well-known shared issuers (GitHub Actions, GitLab, Buildkite,
Terraform Cloud, Google) must constrain tenant identity via an
identity-bearing claim, a tenant-pinning subject prefix (such as
`repo:YOUR_ORG/...`), or a CEL condition referencing one of those
identity claims (e.g. `claims.repository_owner`). OAuth callers may only
manage rules whose `oauth_scope` is `workspace:developer` or
`workspace:inference`; other scopes require a Console session.
### Headers
- `"anthropic-beta": optional array of AnthropicBeta`
Optional header to specify the beta version(s) you want to use.
- `string`
- `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 38 more`
- `"message-batches-2024-09-24"`
- `"prompt-caching-2024-07-31"`
- `"computer-use-2024-10-22"`
- `"computer-use-2025-01-24"`
- `"pdfs-2024-09-25"`
- `"token-counting-2024-11-01"`
- `"token-efficient-tools-2025-02-19"`
- `"output-128k-2025-02-19"`
- `"files-api-2025-04-14"`
- `"mcp-client-2025-04-04"`
- `"mcp-client-2025-11-20"`
- `"dev-full-thinking-2025-05-14"`
- `"interleaved-thinking-2025-05-14"`
- `"code-execution-2025-05-22"`
- `"extended-cache-ttl-2025-04-11"`
- `"context-1m-2025-08-07"`
- `"context-management-2025-06-27"`
- `"model-context-window-exceeded-2025-08-26"`
- `"skills-2025-10-02"`
- `"fast-mode-2026-02-01"`
- `"output-300k-2026-03-24"`
- `"user-profiles-2026-03-24"`
- `"user-profiles-2026-08-18"`
- `"advisor-tool-2026-03-01"`
- `"managed-agents-2026-04-01"`
- `"cache-diagnosis-2026-04-07"`
- `"dreaming-2026-04-21"`
- `"thinking-token-count-2026-05-13"`
- `"server-side-fallback-2026-06-01"`
- `"server-side-fallback-2026-07-01"`
- `"fallback-credit-2026-06-01"`
- `"fallback-credit-2026-07-01"`
- `"agent-memory-2026-07-22"`
- `"mid-conversation-tool-changes-2026-07-01"`
- `"compact-2026-01-12"`
- `"computer-use-2025-11-24"`
- `"mcp-tunnels-2026-06-22"`
- `"structured-outputs-2025-11-13"`
- `"task-budgets-2026-03-13"`
- `"thinking-display-updates-2026-08-18"`
- `"ce-user-management-2026-07-13"`
### Body parameters
- `issuer_id: string`
Tagged ID of the federation issuer.
- `match: BetaFederationRuleMatch`
Conditions the verified JWT must satisfy for this rule to apply. At least one of `subject_prefix` (other than a wildcard-only value like `*`), `claims`, or `condition` is required; `audience` alone is not sufficient.
- `audience: optional string or null`
Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
maxLength: 1024
- `claims: optional map[string] or null`
Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
- `condition: optional string or null`
CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
maxLength: 4096
- `subject_prefix: optional string or null`
Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
maxLength: 1024
- `name: string`
Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
maxLength: 255, minLength: 1
- `oauth_scope: string`
Space-separated OAuth scopes. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session.
minLength: 1
- `target: BetaServiceAccountTarget`
Identity that tokens minted via this rule act as. Currently always a `service_account` target.
- `service_account_id: string`
Tagged ID of the service account to mint tokens for.
- `type: "service_account"`
- `service_account_name: optional string or null`
Service account's display name at read time. Ignored on writes.
- `applies_to_all_workspaces: optional boolean`
When true, enable this rule for every workspace in the org (including workspaces created later).
- `attributes: optional map[string] or null`
CEL expressions `{name: expr}` extracting named values from claims. Not yet supported; any non-empty value is rejected with 400.
- `description: optional string or null`
Optional free-text description.
maxLength: 2000
- `token_lifetime_seconds: optional number`
Lifetime in seconds for access tokens minted via this rule (60-86400). Defaults to 3600 (1h). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.
maximum: 86400, minimum: 60
- `workspace_id: optional string or null`
Tagged ID of the workspace to enable this rule for. Required unless `applies_to_all_workspaces` is true. Additional workspaces can be added via the `/federation_rules/{federation_rule_id}/workspaces` sub-resource.
### Returns
- `BetaFederationRule object`
Authorization rule binding an external OIDC identity to Anthropic.
Evaluates the match conditions and mints an OAuth access token for the
resolved target, scoped to a single workspace where the rule is enabled
(chosen by the caller at exchange time when the rule is enabled for more
than one). For rules enabled via `workspace_ids` or
`applies_to_all_workspaces`, the target service account must be a member
of that workspace (it is implicitly a member of the default workspace);
rules carrying only the legacy `workspace_id` binding do not enforce
this.
- `id: string`
Tagged ID of the federation rule.
- `applies_to_all_workspaces: boolean`
When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.
- `archived_at: string or null`
If set, this rule is archived and rejects token exchange.
format: date-time
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
- `attributes: map[string] or null`
CEL expressions extracting named values from claims. Not yet supported; always null.
- `created_at: string`
When this rule was created.
format: date-time
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this rule.
- `description: string or null`
Optional free-text description.
- `issuer_id: string`
Tagged ID of the issuer whose tokens this rule accepts.
- `issuer_name: string or null`
Issuer's display name at read time.
- `match: BetaFederationRuleMatch`
Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
- `audience: optional string or null`
Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
maxLength: 1024
- `claims: optional map[string] or null`
Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
- `condition: optional string or null`
CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
maxLength: 4096
- `subject_prefix: optional string or null`
Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
maxLength: 1024
- `name: string`
Admin-chosen slug identifier.
- `oauth_scope: string`
Space-separated OAuth scopes granted on the minted token.
- `target: BetaServiceAccountTarget`
Identity that tokens minted via this rule act as. Currently always a `service_account` target.
- `service_account_id: string`
Tagged ID of the service account to mint tokens for.
- `type: "service_account"`
Cut at 300 lines. The page has the rest.
api/beta/organization/federation/rules/archive New page · 297 lines, new page
# Archive Federation Rule ## Path parameters ## Headers ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
# Archive Federation Rule
**POST** `/v1/organizations/federation_rules/{federation_rule_id}/archive`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
Archive a federation rule.
Token exchange through this rule stops immediately. Idempotent;
re-archiving returns the rule with its original `archived_at`. Archiving
clears the rule's workspace targeting (`workspace_id` and
`workspace_ids` are emptied). Tokens already minted before archive
remain valid until they expire. OAuth callers may only manage rules
whose `oauth_scope` is `workspace:developer` or `workspace:inference`;
other scopes require a Console session.
## Path parameters
- `federation_rule_id: string`
ID of the federation rule to archive.
## Headers
- `"anthropic-beta": optional array of AnthropicBeta`
Optional header to specify the beta version(s) you want to use.
- `string`
- `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 38 more`
- `"message-batches-2024-09-24"`
- `"prompt-caching-2024-07-31"`
- `"computer-use-2024-10-22"`
- `"computer-use-2025-01-24"`
- `"pdfs-2024-09-25"`
- `"token-counting-2024-11-01"`
- `"token-efficient-tools-2025-02-19"`
- `"output-128k-2025-02-19"`
- `"files-api-2025-04-14"`
- `"mcp-client-2025-04-04"`
- `"mcp-client-2025-11-20"`
- `"dev-full-thinking-2025-05-14"`
- `"interleaved-thinking-2025-05-14"`
- `"code-execution-2025-05-22"`
- `"extended-cache-ttl-2025-04-11"`
- `"context-1m-2025-08-07"`
- `"context-management-2025-06-27"`
- `"model-context-window-exceeded-2025-08-26"`
- `"skills-2025-10-02"`
- `"fast-mode-2026-02-01"`
- `"output-300k-2026-03-24"`
- `"user-profiles-2026-03-24"`
- `"user-profiles-2026-08-18"`
- `"advisor-tool-2026-03-01"`
- `"managed-agents-2026-04-01"`
- `"cache-diagnosis-2026-04-07"`
- `"dreaming-2026-04-21"`
- `"thinking-token-count-2026-05-13"`
- `"server-side-fallback-2026-06-01"`
- `"server-side-fallback-2026-07-01"`
- `"fallback-credit-2026-06-01"`
- `"fallback-credit-2026-07-01"`
- `"agent-memory-2026-07-22"`
- `"mid-conversation-tool-changes-2026-07-01"`
- `"compact-2026-01-12"`
- `"computer-use-2025-11-24"`
- `"mcp-tunnels-2026-06-22"`
- `"structured-outputs-2025-11-13"`
- `"task-budgets-2026-03-13"`
- `"thinking-display-updates-2026-08-18"`
- `"ce-user-management-2026-07-13"`
## Returns
- `BetaFederationRule object`
Authorization rule binding an external OIDC identity to Anthropic.
Evaluates the match conditions and mints an OAuth access token for the
resolved target, scoped to a single workspace where the rule is enabled
(chosen by the caller at exchange time when the rule is enabled for more
than one). For rules enabled via `workspace_ids` or
`applies_to_all_workspaces`, the target service account must be a member
of that workspace (it is implicitly a member of the default workspace);
rules carrying only the legacy `workspace_id` binding do not enforce
this.
- `id: string`
Tagged ID of the federation rule.
- `applies_to_all_workspaces: boolean`
When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.
- `archived_at: string or null`
If set, this rule is archived and rejects token exchange.
format: date-time
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
- `attributes: map[string] or null`
CEL expressions extracting named values from claims. Not yet supported; always null.
- `created_at: string`
When this rule was created.
format: date-time
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this rule.
- `description: string or null`
Optional free-text description.
- `issuer_id: string`
Tagged ID of the issuer whose tokens this rule accepts.
- `issuer_name: string or null`
Issuer's display name at read time.
- `match: BetaFederationRuleMatch`
Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
- `audience: optional string or null`
Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
maxLength: 1024
- `claims: optional map[string] or null`
Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
- `condition: optional string or null`
CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
maxLength: 4096
- `subject_prefix: optional string or null`
Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
maxLength: 1024
- `name: string`
Admin-chosen slug identifier.
- `oauth_scope: string`
Space-separated OAuth scopes granted on the minted token.
- `target: BetaServiceAccountTarget`
Identity that tokens minted via this rule act as. Currently always a `service_account` target.
- `service_account_id: string`
Tagged ID of the service account to mint tokens for.
- `type: "service_account"`
- `service_account_name: optional string or null`
Service account's display name at read time. Ignored on writes.
- `token_lifetime_seconds: number`
Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.
- `type: "federation_rule"`
default: federation_rule
- `updated_at: string`
When this rule was last updated.
format: date-time
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
- `workspace_id: string or null`
Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement.
- `workspace_ids: array of string`
Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).
## Example
```bash
curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/archive \
-X POST \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
"applies_to_all_workspaces": true,
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"attributes": {
"foo": "string"
},
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"description": "description",
"issuer_id": "issuer_id",
"issuer_name": "issuer_name",
"match": {
"audience": "audience",
"claims": {
"foo": "string"
},
"condition": "condition",
"subject_prefix": "subject_prefix"
},
"name": "prod-deploy-pipeline",
"oauth_scope": "oauth_scope",
"target": {
"service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
"type": "service_account",
"service_account_name": "service_account_name"
},
"token_lifetime_seconds": 0,
"type": "federation_rule",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id",
"workspace_id": "workspace_id",
"workspace_ids": [
"string"
]
}
```