One read of Claude Developer Platformapi-20260828T000723Z
127 pages moved out of 688 read.
Pages moved
127
significant first
Pages read
688
in this capture
Captured
00:07 UTC
Corpus hash
f8f8bcbeab53
corpus-hash
What this read moved
51-75 of 127, page 3 of 6This capture is too large to show at once. Changes 51-75 of 127 are below, significant first; the rest are on the following screens.
api/admin/spend_limits Changed · +369 / -33 lines
The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.
from line 18
1818
1919- `scope: object`
2020
21 Scope selecting a single member of the organization.
22
2123 - `type: "user"`
2224
25 Scope type. Always `user` for this scope.
26
2327 default: user
2428
2529 - `user_id: string`
2630
31 Tagged ID of the member the spend limit applies to.
32
2733- `period: optional "daily" or "monthly" or "weekly"`
2834
2935 - `"daily"`
from line 42
3642
3743- `SpendLimit object`
3844
45 A configured spend limit: a cap on metered spend for one scope and period.
46
3947 - `id: string`
4048
49 Unique tagged ID of the spend limit (`spl_...`).
50
4151 - `amount: string or null`
4252
4353 Limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD): "50000" is $500.00. `null` means no numeric cap is configured at this scope — see the effective report for whether a limit applies.
4454
4555 - `created_at: string`
4656
57 RFC 3339 datetime at which the spend limit was created.
58
4759 format: date-time
4860
4961 - `currency: string`
from line 64
5264
5365 - `period: "daily" or "monthly" or "weekly"`
5466
67 Length of the window the limit resets over. `amount` caps spend within each period.
68
5569 - `"daily"`
5670
5771 - `"monthly"`
from line 74
6074
6175 - `scope: object or object or object or 2 more`
6276
77 What the limit applies to. A tagged union on `type`; each variant carries the identifier for its scope.
78
6379 - `User object`
6480
81 Scope selecting a single member of the organization.
82
6583 - `type: "user"`
6684
85 Scope type. Always `user` for this scope.
86
6787 default: user
6888
6989 - `user_id: string`
7090
91 Tagged ID of the member the spend limit applies to.
92
7193 - `SeatTier object`
7294
7395 - `seat_tier: string`
from line 122
100122
101123 - `type: "spend_limit"`
102124
125 Object type. Always `spend_limit`.
126
103127 default: spend_limit
104128
105129 - `updated_at: string`
130
131 RFC 3339 datetime at which the spend limit was last modified.
106132
107133 format: date-time
108134
from line 143
117143 "amount": "50000",
118144 "scope": {
119145 "type": "user",
120 "user_id": "user_id"
146 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
121147 },
122148 "period": "monthly"
123149 }'
from line 160
134160 "period": "monthly",
135161 "scope": {
136162 "type": "user",
137 "user_id": "user_id"
163 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
138164 },
139165 "type": "spend_limit",
140166 "updated_at": "2019-12-27T18:11:19.117Z"
from line 183
157183
158184- `SpendLimit object`
159185
186 A configured spend limit: a cap on metered spend for one scope and period.
187
160188 - `id: string`
161189
190 Unique tagged ID of the spend limit (`spl_...`).
191
162192 - `amount: string or null`
163193
164194 Limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD): "50000" is $500.00. `null` means no numeric cap is configured at this scope — see the effective report for whether a limit applies.
165195
166196 - `created_at: string`
167197
198 RFC 3339 datetime at which the spend limit was created.
199
168200 format: date-time
169201
170202 - `currency: string`
from line 205
173205
174206 - `period: "daily" or "monthly" or "weekly"`
175207
208 Length of the window the limit resets over. `amount` caps spend within each period.
209
176210 - `"daily"`
177211
178212 - `"monthly"`
from line 215
181215
182216 - `scope: object or object or object or 2 more`
183217
218 What the limit applies to. A tagged union on `type`; each variant carries the identifier for its scope.
219
184220 - `User object`
185221
222 Scope selecting a single member of the organization.
223
186224 - `type: "user"`
187225
226 Scope type. Always `user` for this scope.
227
188228 default: user
189229
190230 - `user_id: string`
191231
232 Tagged ID of the member the spend limit applies to.
233
192234 - `SeatTier object`
193235
194236 - `seat_tier: string`
from line 263
221263
222264 - `type: "spend_limit"`
223265
266 Object type. Always `spend_limit`.
267
224268 default: spend_limit
225269
226270 - `updated_at: string`
271
272 RFC 3339 datetime at which the spend limit was last modified.
227273
228274 format: date-time
229275
from line 292
246292 "period": "monthly",
247293 "scope": {
248294 "type": "user",
249 "user_id": "user_id"
295 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
250296 },
251297 "type": "spend_limit",
252298 "updated_at": "2019-12-27T18:11:19.117Z"
from line 355
309355
310356- `limit: optional number`
311357
358 Maximum number of members per page. A member's period rows never split across pages, so a page may carry more rows than this. Defaults to `20`.
359
312360 default: 20, maximum: 1000, minimum: 1
313361
314362- `page: optional string`
315363
316- `period: optional array of string`
364 Opaque cursor from a previous response's `next_page` field.
365
366- `period: optional array of "daily" or "monthly" or "weekly"`
367
368 Restrict the report to these limit periods. Omit to return one row per period each member resolves a spend limit for.
317369
318370 maxItems: 3
319371
372 - `"daily"`
373
374 - `"monthly"`
375
376 - `"weekly"`
377
320378- `user_ids: optional array of string`
379
380 Restrict the report to these members, by tagged user ID (`user_...`). At most 100 entries.
321381
322382 maxItems: 100
323383
from line 393
333393
334394 - `deleted: boolean`
335395
396 True only when the underlying account has been deleted.
397
336398 default: false
337399
338400 - `email_address: string or null`
339401
402 The user's email address. Null when the account is unavailable or has been deleted.
403
340404 - `name: string or null`
341405
406 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
407
342408 - `type: "user_actor"`
343409
410 Actor type. Always `user_actor`.
411
344412 default: user_actor
345413
346414 - `user_id: string`
347415
416 Tagged ID of the user.
417
348418 - `amount: string or null`
349419
350420 Effective limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD). `null` means no limit applies for this row's `period` — each period resolves independently, so another period may still cap this member.
from line 425
355425
356426 - `period: "daily" or "monthly" or "weekly"`
357427
428 Period this row's effective limit and spend are reported for.
429
358430 - `"daily"`
359431
360432 - `"monthly"`
from line 439
367439
368440 - `scope: object`
369441
442 Scope selecting a single member of the organization.
443
370444 - `type: "user"`
371445
446 Scope type. Always `user` for this scope.
447
372448 default: user
373449
374450 - `user_id: string`
375451
452 Tagged ID of the member the spend limit applies to.
453
376454 - `source: object or object or object or 2 more`
377455
456 Scope selecting a single member of the organization.
457
378458 - `User object`
379459
460 Scope selecting a single member of the organization.
461
380462 - `type: "user"`
381463
464 Scope type. Always `user` for this scope.
465
382466 default: user
383467
384468 - `user_id: string`
469
470 Tagged ID of the member the spend limit applies to.
385471
386472 - `SeatTier object`
387473
from line 522
436522 "email_address": "email_address",
437523 "name": "name",
438524 "type": "user_actor",
439 "user_id": "user_id"
525 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
440526 },
441527 "amount": "50000",
442528 "currency": "USD",
from line 530
444530 "period_to_date_spend": "12050.5",
445531 "scope": {
446532 "type": "user",
447 "user_id": "user_id"
533 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
448534 },
449535 "source": {
450536 "type": "user",
451 "user_id": "user_id"
537 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
452538 },
453539 "spend_limit_id": "spend_limit_id"
454540 }
from line 549
463549
464550- `SpendLimit object`
465551
552 A configured spend limit: a cap on metered spend for one scope and period.
553
466554 - `id: string`
467555
556 Unique tagged ID of the spend limit (`spl_...`).
557
468558 - `amount: string or null`
469559
470560 Limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD): "50000" is $500.00. `null` means no numeric cap is configured at this scope — see the effective report for whether a limit applies.
471561
472562 - `created_at: string`
473563
564 RFC 3339 datetime at which the spend limit was created.
565
474566 format: date-time
475567
476568 - `currency: string`
from line 571
479571
480572 - `period: "daily" or "monthly" or "weekly"`
481573
574 Length of the window the limit resets over. `amount` caps spend within each period.
575
482576 - `"daily"`
483577
484578 - `"monthly"`
from line 581
487581
488582 - `scope: object or object or object or 2 more`
489583
584 What the limit applies to. A tagged union on `type`; each variant carries the identifier for its scope.
585
490586 - `User object`
491587
588 Scope selecting a single member of the organization.
589
492590 - `type: "user"`
493591
592 Scope type. Always `user` for this scope.
593
494594 default: user
495595
496596 - `user_id: string`
497597
598 Tagged ID of the member the spend limit applies to.
599
498600 - `SeatTier object`
499601
500602 - `seat_tier: string`
from line 629
527629
528630 - `type: "spend_limit"`
529631
632 Object type. Always `spend_limit`.
633
530634 default: spend_limit
531635
532636 - `updated_at: string`
533637
638 RFC 3339 datetime at which the spend limit was last modified.
639
534640 format: date-time
535641
536642### Spend Summary
537643
538644- `SpendSummary object`
539645
540 Per-member effective-limit report row (GET /spend_limits/effective).
646 Per-member effective-limit report row (`GET /spend_limits/effective`).
541647
542648 - `actor: object`
543649
from line 653
547653
548654 - `deleted: boolean`
549655
656 True only when the underlying account has been deleted.
657
550658 default: false
551659
552660 - `email_address: string or null`
553661
662 The user's email address. Null when the account is unavailable or has been deleted.
663
554664 - `name: string or null`
555665
666 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
667
556668 - `type: "user_actor"`
557669
670 Actor type. Always `user_actor`.
671
558672 default: user_actor
559673
560674 - `user_id: string`
561675
676 Tagged ID of the user.
677
562678 - `amount: string or null`
563679
564680 Effective limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD). `null` means no limit applies for this row's `period` — each period resolves independently, so another period may still cap this member.
from line 685
569685
570686 - `period: "daily" or "monthly" or "weekly"`
571687
688 Period this row's effective limit and spend are reported for.
689
572690 - `"daily"`
573691
574692 - `"monthly"`
from line 699
581699
582700 - `scope: object`
583701
702 Scope selecting a single member of the organization.
703
584704 - `type: "user"`
585705
706 Scope type. Always `user` for this scope.
707
586708 default: user
587709
588710 - `user_id: string`
589711
712 Tagged ID of the member the spend limit applies to.
713
590714 - `source: object or object or object or 2 more`
591715
716 Scope selecting a single member of the organization.
717
592718 - `User object`
593719
720 Scope selecting a single member of the organization.
721
594722 - `type: "user"`
595723
724 Scope type. Always `user` for this scope.
725
596726 default: user
597727
598728 - `user_id: string`
729
730 Tagged ID of the member the spend limit applies to.
599731
600732 - `SeatTier object`
601733
from line 820
688820
689821 - `deleted: boolean`
690822
823 True only when the underlying account has been deleted.
824
691825 default: false
692826
693827 - `email_address: string or null`
694828
829 The user's email address. Null when the account is unavailable or has been deleted.
830
695831 - `name: string or null`
696832
833 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
834
697835 - `type: "user_actor"`
698836
837 Actor type. Always `user_actor`.
838
699839 default: user_actor
700840
701841 - `user_id: string`
842
843 Tagged ID of the user.
702844
703845 - `created_at: string`
704846
from line 872
730872
731873 - `deleted: boolean`
732874
875 True only when the underlying account has been deleted.
876
733877 default: false
734878
735879 - `email_address: string or null`
736880
881 The user's email address. Null when the account is unavailable or has been deleted.
882
737883 - `name: string or null`
738884
885 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
886
739887 - `type: "user_actor"`
740888
889 Actor type. Always `user_actor`.
890
741891 default: user_actor
742892
743893 - `user_id: string`
744894
895 Tagged ID of the user.
896
745897 - `ScopedAPIKeyActor object`
746898
747899 A scoped Admin API key acting on behalf of the organization.
from line 906
754906
755907 - `spend_summary: SpendSummary or null`
756908
757 Per-member effective-limit report row (GET /spend_limits/effective).
909 Per-member effective-limit report row (`GET /spend_limits/effective`).
758910
759911 - `actor: object`
760912
from line 916
764916
765917 - `deleted: boolean`
766918
919 True only when the underlying account has been deleted.
920
767921 default: false
768922
769923 - `email_address: string or null`
770924
925 The user's email address. Null when the account is unavailable or has been deleted.
926
771927 - `name: string or null`
772928
929 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
930
773931 - `type: "user_actor"`
774932
933 Actor type. Always `user_actor`.
934
775935 default: user_actor
776936
777937 - `user_id: string`
778938
939 Tagged ID of the user.
940
779941 - `amount: string or null`
780942
781943 Effective limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD). `null` means no limit applies for this row's `period` — each period resolves independently, so another period may still cap this member.
from line 948
786948
787949 - `period: "daily" or "monthly" or "weekly"`
788950
951 Period this row's effective limit and spend are reported for.
952
789953 - `"daily"`
790954
791955 - `"monthly"`
from line 962
798962
799963 - `scope: object`
800964
965 Scope selecting a single member of the organization.
966
801967 - `type: "user"`
802968
969 Scope type. Always `user` for this scope.
970
803971 default: user
804972
805973 - `user_id: string`
806974
975 Tagged ID of the member the spend limit applies to.
976
807977 - `source: object or object or object or 2 more`
808978
979 Scope selecting a single member of the organization.
980
809981 - `User object`
810982
983 Scope selecting a single member of the organization.
984
811985 - `type: "user"`
812986
987 Scope type. Always `user` for this scope.
988
813989 default: user
814990
815991 - `user_id: string`
992
993 Tagged ID of the member the spend limit applies to.
816994
817995 - `SeatTier object`
818996
from line 1058
8801058 "email_address": "email_address",
8811059 "name": "name",
8821060 "type": "user_actor",
883 "user_id": "user_id"
1061 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
8841062 },
8851063 "created_at": "2019-12-27T18:11:19.117Z",
8861064 "period": "monthly",
from line 1068
8901068 "email_address": "email_address",
8911069 "name": "name",
8921070 "type": "user_actor",
893 "user_id": "user_id"
1071 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
8941072 },
8951073 "spend_summary": {
8961074 "actor": {
from line 1076
8981076 "email_address": "email_address",
8991077 "name": "name",
9001078 "type": "user_actor",
901 "user_id": "user_id"
1079 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
9021080 },
9031081 "amount": "50000",
9041082 "currency": "USD",
from line 1084
9061084 "period_to_date_spend": "12050.5",
9071085 "scope": {
9081086 "type": "user",
909 "user_id": "user_id"
1087 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
9101088 },
9111089 "source": {
9121090 "type": "user",
913 "user_id": "user_id"
1091 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
9141092 },
9151093 "spend_limit_id": "spend_limit_id"
9161094 },
from line 1129
9511129
9521130 - `deleted: boolean`
9531131
1132 True only when the underlying account has been deleted.
1133
9541134 default: false
9551135
9561136 - `email_address: string or null`
9571137
1138 The user's email address. Null when the account is unavailable or has been deleted.
1139
9581140 - `name: string or null`
9591141
1142 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
1143
9601144 - `type: "user_actor"`
9611145
1146 Actor type. Always `user_actor`.
1147
9621148 default: user_actor
9631149
9641150 - `user_id: string`
1151
1152 Tagged ID of the user.
9651153
9661154 - `created_at: string`
9671155
from line 1181
9931181
9941182 - `deleted: boolean`
9951183
1184 True only when the underlying account has been deleted.
1185
9961186 default: false
9971187
9981188 - `email_address: string or null`
9991189
1190 The user's email address. Null when the account is unavailable or has been deleted.
1191
10001192 - `name: string or null`
10011193
1194 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
1195
10021196 - `type: "user_actor"`
10031197
1198 Actor type. Always `user_actor`.
1199
10041200 default: user_actor
10051201
10061202 - `user_id: string`
10071203
1204 Tagged ID of the user.
1205
10081206 - `ScopedAPIKeyActor object`
10091207
10101208 A scoped Admin API key acting on behalf of the organization.
from line 1215
10171215
10181216 - `spend_summary: SpendSummary or null`
10191217
1020 Per-member effective-limit report row (GET /spend_limits/effective).
1218 Per-member effective-limit report row (`GET /spend_limits/effective`).
10211219
10221220 - `actor: object`
10231221
from line 1225
10271225
10281226 - `deleted: boolean`
10291227
1228 True only when the underlying account has been deleted.
1229
10301230 default: false
10311231
10321232 - `email_address: string or null`
10331233
1234 The user's email address. Null when the account is unavailable or has been deleted.
1235
10341236 - `name: string or null`
10351237
1238 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
1239
10361240 - `type: "user_actor"`
10371241
1242 Actor type. Always `user_actor`.
1243
10381244 default: user_actor
10391245
10401246 - `user_id: string`
10411247
1248 Tagged ID of the user.
1249
10421250 - `amount: string or null`
10431251
10441252 Effective limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD). `null` means no limit applies for this row's `period` — each period resolves independently, so another period may still cap this member.
from line 1257
10491257
10501258 - `period: "daily" or "monthly" or "weekly"`
10511259
1260 Period this row's effective limit and spend are reported for.
1261
10521262 - `"daily"`
10531263
10541264 - `"monthly"`
from line 1271
10611271
10621272 - `scope: object`
10631273
1274 Scope selecting a single member of the organization.
1275
10641276 - `type: "user"`
10651277
1278 Scope type. Always `user` for this scope.
1279
10661280 default: user
10671281
10681282 - `user_id: string`
10691283
1284 Tagged ID of the member the spend limit applies to.
1285
10701286 - `source: object or object or object or 2 more`
10711287
1288 Scope selecting a single member of the organization.
1289
10721290 - `User object`
10731291
1292 Scope selecting a single member of the organization.
1293
10741294 - `type: "user"`
10751295
1296 Scope type. Always `user` for this scope.
1297
10761298 default: user
10771299
10781300 - `user_id: string`
1301
1302 Tagged ID of the member the spend limit applies to.
10791303
10801304 - `SeatTier object`
10811305
from line 1363
11391363 "email_address": "email_address",
11401364 "name": "name",
11411365 "type": "user_actor",
1142 "user_id": "user_id"
1366 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
11431367 },
11441368 "created_at": "2019-12-27T18:11:19.117Z",
11451369 "period": "monthly",
from line 1373
11491373 "email_address": "email_address",
11501374 "name": "name",
11511375 "type": "user_actor",
1152 "user_id": "user_id"
1376 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
11531377 },
11541378 "spend_summary": {
11551379 "actor": {
from line 1381
11571381 "email_address": "email_address",
11581382 "name": "name",
11591383 "type": "user_actor",
1160 "user_id": "user_id"
1384 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
11611385 },
11621386 "amount": "50000",
11631387 "currency": "USD",
from line 1389
11651389 "period_to_date_spend": "12050.5",
11661390 "scope": {
11671391 "type": "user",
1168 "user_id": "user_id"
1392 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
11691393 },
11701394 "source": {
11711395 "type": "user",
1172 "user_id": "user_id"
1396 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
11731397 },
11741398 "spend_limit_id": "spend_limit_id"
11751399 },
from line 1447
12231447
12241448 - `deleted: boolean`
12251449
1450 True only when the underlying account has been deleted.
1451
12261452 default: false
12271453
12281454 - `email_address: string or null`
12291455
1456 The user's email address. Null when the account is unavailable or has been deleted.
1457
12301458 - `name: string or null`
12311459
1460 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
1461
12321462 - `type: "user_actor"`
12331463
1464 Actor type. Always `user_actor`.
1465
12341466 default: user_actor
12351467
12361468 - `user_id: string`
1469
1470 Tagged ID of the user.
12371471
12381472- `created_at: string`
12391473
from line 1499
12651499
12661500 - `deleted: boolean`
12671501
1502 True only when the underlying account has been deleted.
1503
12681504 default: false
12691505
12701506 - `email_address: string or null`
12711507
1508 The user's email address. Null when the account is unavailable or has been deleted.
1509
12721510 - `name: string or null`
12731511
1512 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
1513
12741514 - `type: "user_actor"`
12751515
1516 Actor type. Always `user_actor`.
1517
12761518 default: user_actor
12771519
12781520 - `user_id: string`
12791521
1522 Tagged ID of the user.
1523
12801524 - `ScopedAPIKeyActor object`
12811525
12821526 A scoped Admin API key acting on behalf of the organization.
from line 1533
12891533
12901534- `spend_limit: SpendLimit`
12911535
1536 A configured spend limit: a cap on metered spend for one scope and period.
1537
12921538 - `id: string`
12931539
1540 Unique tagged ID of the spend limit (`spl_...`).
1541
12941542 - `amount: string or null`
12951543
12961544 Limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD): "50000" is $500.00. `null` means no numeric cap is configured at this scope — see the effective report for whether a limit applies.
12971545
12981546 - `created_at: string`
12991547
1548 RFC 3339 datetime at which the spend limit was created.
1549
13001550 format: date-time
13011551
13021552 - `currency: string`
from line 1555
13051555
13061556 - `period: "daily" or "monthly" or "weekly"`
13071557
1558 Length of the window the limit resets over. `amount` caps spend within each period.
1559
13081560 - `"daily"`
13091561
13101562 - `"monthly"`
from line 1565
13131565
13141566 - `scope: object or object or object or 2 more`
13151567
1568 What the limit applies to. A tagged union on `type`; each variant carries the identifier for its scope.
1569
13161570 - `User object`
13171571
1572 Scope selecting a single member of the organization.
1573
13181574 - `type: "user"`
13191575
1576 Scope type. Always `user` for this scope.
1577
13201578 default: user
13211579
13221580 - `user_id: string`
13231581
1582 Tagged ID of the member the spend limit applies to.
1583
13241584 - `SeatTier object`
13251585
13261586 - `seat_tier: string`
from line 1613
13531613
13541614 - `type: "spend_limit"`
13551615
1616 Object type. Always `spend_limit`.
1617
13561618 default: spend_limit
13571619
13581620 - `updated_at: string`
13591621
1622 RFC 3339 datetime at which the spend limit was last modified.
1623
13601624 format: date-time
13611625
13621626- `spend_summary: SpendSummary or null`
13631627
1364 Per-member effective-limit report row (GET /spend_limits/effective).
1628 Per-member effective-limit report row (`GET /spend_limits/effective`).
13651629
13661630 - `actor: object`
13671631
from line 1635
13711635
13721636 - `deleted: boolean`
13731637
1638 True only when the underlying account has been deleted.
1639
13741640 default: false
13751641
13761642 - `email_address: string or null`
13771643
1644 The user's email address. Null when the account is unavailable or has been deleted.
1645
13781646 - `name: string or null`
13791647
1648 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
1649
13801650 - `type: "user_actor"`
13811651
1652 Actor type. Always `user_actor`.
1653
13821654 default: user_actor
13831655
13841656 - `user_id: string`
13851657
1658 Tagged ID of the user.
1659
13861660 - `amount: string or null`
13871661
13881662 Effective limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD). `null` means no limit applies for this row's `period` — each period resolves independently, so another period may still cap this member.
from line 1667
13931667
13941668 - `period: "daily" or "monthly" or "weekly"`
13951669
1670 Period this row's effective limit and spend are reported for.
1671
13961672 - `"daily"`
13971673
13981674 - `"monthly"`
from line 1681
14051681
14061682 - `scope: object`
14071683
1684 Scope selecting a single member of the organization.
1685
14081686 - `type: "user"`
14091687
1688 Scope type. Always `user` for this scope.
1689
14101690 default: user
14111691
14121692 - `user_id: string`
14131693
1694 Tagged ID of the member the spend limit applies to.
1695
14141696 - `source: object or object or object or 2 more`
14151697
1698 Scope selecting a single member of the organization.
1699
14161700 - `User object`
14171701
1702 Scope selecting a single member of the organization.
1703
14181704 - `type: "user"`
14191705
1706 Scope type. Always `user` for this scope.
1707
14201708 default: user
14211709
14221710 - `user_id: string`
1711
1712 Tagged ID of the member the spend limit applies to.
14231713
14241714 - `SeatTier object`
14251715
from line 1778
14881778 "email_address": "email_address",
14891779 "name": "name",
14901780 "type": "user_actor",
1491 "user_id": "user_id"
1781 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
14921782 },
14931783 "created_at": "2019-12-27T18:11:19.117Z",
14941784 "period": "monthly",
from line 1788
14981788 "email_address": "email_address",
14991789 "name": "name",
15001790 "type": "user_actor",
1501 "user_id": "user_id"
1791 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
15021792 },
15031793 "spend_limit": {
15041794 "id": "id",
from line 1798
15081798 "period": "monthly",
15091799 "scope": {
15101800 "type": "user",
1511 "user_id": "user_id"
1801 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
15121802 },
15131803 "type": "spend_limit",
15141804 "updated_at": "2019-12-27T18:11:19.117Z"
from line 1809
15191809 "email_address": "email_address",
15201810 "name": "name",
15211811 "type": "user_actor",
1522 "user_id": "user_id"
1812 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
15231813 },
15241814 "amount": "50000",
15251815 "currency": "USD",
from line 1817
15271817 "period_to_date_spend": "12050.5",
15281818 "scope": {
15291819 "type": "user",
1530 "user_id": "user_id"
1820 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
15311821 },
15321822 "source": {
15331823 "type": "user",
1534 "user_id": "user_id"
1824 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
15351825 },
15361826 "spend_limit_id": "spend_limit_id"
15371827 },
from line 1863
15731863
15741864 - `deleted: boolean`
15751865
1866 True only when the underlying account has been deleted.
1867
15761868 default: false
15771869
15781870 - `email_address: string or null`
15791871
1872 The user's email address. Null when the account is unavailable or has been deleted.
1873
15801874 - `name: string or null`
15811875
1876 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
1877
15821878 - `type: "user_actor"`
15831879
1880 Actor type. Always `user_actor`.
1881
15841882 default: user_actor
15851883
15861884 - `user_id: string`
1885
1886 Tagged ID of the user.
15871887
15881888 - `created_at: string`
15891889
from line 1915
16151915
16161916 - `deleted: boolean`
16171917
1918 True only when the underlying account has been deleted.
1919
16181920 default: false
16191921
16201922 - `email_address: string or null`
16211923
1924 The user's email address. Null when the account is unavailable or has been deleted.
1925
16221926 - `name: string or null`
16231927
1928 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
1929
16241930 - `type: "user_actor"`
16251931
1932 Actor type. Always `user_actor`.
1933
16261934 default: user_actor
16271935
16281936 - `user_id: string`
16291937
1938 Tagged ID of the user.
1939
16301940 - `ScopedAPIKeyActor object`
16311941
16321942 A scoped Admin API key acting on behalf of the organization.
from line 1949
16391949
16401950 - `spend_summary: SpendSummary or null`
16411951
1642 Per-member effective-limit report row (GET /spend_limits/effective).
1952 Per-member effective-limit report row (`GET /spend_limits/effective`).
16431953
16441954 - `actor: object`
16451955
from line 1959
16491959
16501960 - `deleted: boolean`
16511961
1962 True only when the underlying account has been deleted.
1963
16521964 default: false
16531965
16541966 - `email_address: string or null`
16551967
1968 The user's email address. Null when the account is unavailable or has been deleted.
1969
16561970 - `name: string or null`
16571971
1972 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
1973
16581974 - `type: "user_actor"`
16591975
1976 Actor type. Always `user_actor`.
1977
16601978 default: user_actor
16611979
16621980 - `user_id: string`
16631981
1982 Tagged ID of the user.
1983
16641984 - `amount: string or null`
16651985
16661986 Effective limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD). `null` means no limit applies for this row's `period` — each period resolves independently, so another period may still cap this member.
from line 1991
16711991
16721992 - `period: "daily" or "monthly" or "weekly"`
16731993
1994 Period this row's effective limit and spend are reported for.
1995
16741996 - `"daily"`
16751997
16761998 - `"monthly"`
from line 2005
16832005
16842006 - `scope: object`
16852007
2008 Scope selecting a single member of the organization.
2009
16862010 - `type: "user"`
16872011
2012 Scope type. Always `user` for this scope.
2013
16882014 default: user
16892015
16902016 - `user_id: string`
16912017
2018 Tagged ID of the member the spend limit applies to.
2019
16922020 - `source: object or object or object or 2 more`
16932021
2022 Scope selecting a single member of the organization.
2023
16942024 - `User object`
16952025
2026 Scope selecting a single member of the organization.
2027
16962028 - `type: "user"`
16972029
2030 Scope type. Always `user` for this scope.
2031
16982032 default: user
16992033
17002034 - `user_id: string`
2035
2036 Tagged ID of the member the spend limit applies to.
17012037
17022038 - `SeatTier object`
17032039
from line 2099
17632099 "email_address": "email_address",
17642100 "name": "name",
17652101 "type": "user_actor",
1766 "user_id": "user_id"
2102 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
17672103 },
17682104 "created_at": "2019-12-27T18:11:19.117Z",
17692105 "period": "monthly",
from line 2109
17732109 "email_address": "email_address",
17742110 "name": "name",
17752111 "type": "user_actor",
1776 "user_id": "user_id"
2112 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
17772113 },
17782114 "spend_summary": {
17792115 "actor": {
from line 2117
17812117 "email_address": "email_address",
17822118 "name": "name",
17832119 "type": "user_actor",
1784 "user_id": "user_id"
2120 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
17852121 },
17862122 "amount": "50000",
17872123 "currency": "USD",
from line 2125
17892125 "period_to_date_spend": "12050.5",
17902126 "scope": {
17912127 "type": "user",
1792 "user_id": "user_id"
2128 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
17932129 },
17942130 "source": {
17952131 "type": "user",
1796 "user_id": "user_id"
2132 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
17972133 },
17982134 "spend_limit_id": "spend_limit_id"
17992135 },
18002136
api/admin/spend_limits/create Changed · +28 / -2 lines
from line 16
1616
1717- `scope: object`
1818
19 Scope selecting a single member of the organization.
20
1921 - `type: "user"`
2022
23 Scope type. Always `user` for this scope.
24
2125 default: user
2226
2327 - `user_id: string`
2428
29 Tagged ID of the member the spend limit applies to.
30
2531- `period: optional "daily" or "monthly" or "weekly"`
2632
2733 - `"daily"`
from line 40
3440
3541- `SpendLimit object`
3642
43 A configured spend limit: a cap on metered spend for one scope and period.
44
3745 - `id: string`
3846
47 Unique tagged ID of the spend limit (`spl_...`).
48
3949 - `amount: string or null`
4050
4151 Limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD): "50000" is $500.00. `null` means no numeric cap is configured at this scope — see the effective report for whether a limit applies.
from line 52
4252
4353 - `created_at: string`
4454
55 RFC 3339 datetime at which the spend limit was created.
56
4557 format: date-time
4658
4759 - `currency: string`
from line 62
5062
5163 - `period: "daily" or "monthly" or "weekly"`
5264
65 Length of the window the limit resets over. `amount` caps spend within each period.
66
5367 - `"daily"`
5468
5569 - `"monthly"`
from line 72
5872
5973 - `scope: object or object or object or 2 more`
6074
75 What the limit applies to. A tagged union on `type`; each variant carries the identifier for its scope.
76
6177 - `User object`
6278
79 Scope selecting a single member of the organization.
80
6381 - `type: "user"`
6482
83 Scope type. Always `user` for this scope.
84
6585 default: user
6686
6787 - `user_id: string`
6888
89 Tagged ID of the member the spend limit applies to.
90
6991 - `SeatTier object`
7092
7193 - `seat_tier: string`
from line 120
98120
99121 - `type: "spend_limit"`
100122
123 Object type. Always `spend_limit`.
124
101125 default: spend_limit
102126
103127 - `updated_at: string`
104128
129 RFC 3339 datetime at which the spend limit was last modified.
130
105131 format: date-time
106132
107133## Example
from line 141
115141 "amount": "50000",
116142 "scope": {
117143 "type": "user",
118 "user_id": "user_id"
144 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
119145 },
120146 "period": "monthly"
121147 }'
from line 158
132158 "period": "monthly",
133159 "scope": {
134160 "type": "user",
135 "user_id": "user_id"
161 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
136162 },
137163 "type": "spend_limit",
138164 "updated_at": "2019-12-27T18:11:19.117Z"
api/admin/spend_limits/increase_requests Changed · +343 / -27 lines
from line 47
4747
4848 - `deleted: boolean`
4949
50 True only when the underlying account has been deleted.
51
5052 default: false
5153
5254 - `email_address: string or null`
5355
56 The user's email address. Null when the account is unavailable or has been deleted.
57
5458 - `name: string or null`
5559
60 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
61
5662 - `type: "user_actor"`
5763
64 Actor type. Always `user_actor`.
65
5866 default: user_actor
5967
6068 - `user_id: string`
6169
70 Tagged ID of the user.
71
6272 - `created_at: string`
6373
6474 format: date-time
from line 99
8999
90100 - `deleted: boolean`
91101
102 True only when the underlying account has been deleted.
103
92104 default: false
93105
94106 - `email_address: string or null`
95107
108 The user's email address. Null when the account is unavailable or has been deleted.
109
96110 - `name: string or null`
97111
112 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
113
98114 - `type: "user_actor"`
99115
116 Actor type. Always `user_actor`.
117
100118 default: user_actor
101119
102120 - `user_id: string`
103121
122 Tagged ID of the user.
123
104124 - `ScopedAPIKeyActor object`
105125
106126 A scoped Admin API key acting on behalf of the organization.
from line 133
113133
114134 - `spend_summary: SpendSummary or null`
115135
116 Per-member effective-limit report row (GET /spend_limits/effective).
136 Per-member effective-limit report row (`GET /spend_limits/effective`).
117137
118138 - `actor: object`
119139
from line 143
123143
124144 - `deleted: boolean`
125145
146 True only when the underlying account has been deleted.
147
126148 default: false
127149
128150 - `email_address: string or null`
129151
152 The user's email address. Null when the account is unavailable or has been deleted.
153
130154 - `name: string or null`
131155
156 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
157
132158 - `type: "user_actor"`
133159
160 Actor type. Always `user_actor`.
161
134162 default: user_actor
135163
136164 - `user_id: string`
137165
166 Tagged ID of the user.
167
138168 - `amount: string or null`
139169
140170 Effective limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD). `null` means no limit applies for this row's `period` — each period resolves independently, so another period may still cap this member.
from line 175
145175
146176 - `period: "daily" or "monthly" or "weekly"`
147177
178 Period this row's effective limit and spend are reported for.
179
148180 - `"daily"`
149181
150182 - `"monthly"`
from line 189
157189
158190 - `scope: object`
159191
192 Scope selecting a single member of the organization.
193
160194 - `type: "user"`
161195
196 Scope type. Always `user` for this scope.
197
162198 default: user
163199
164200 - `user_id: string`
165201
202 Tagged ID of the member the spend limit applies to.
203
166204 - `source: object or object or object or 2 more`
167205
206 Scope selecting a single member of the organization.
207
168208 - `User object`
169209
210 Scope selecting a single member of the organization.
211
170212 - `type: "user"`
171213
214 Scope type. Always `user` for this scope.
215
172216 default: user
173217
174218 - `user_id: string`
175219
220 Tagged ID of the member the spend limit applies to.
221
176222 - `SeatTier object`
177223
178224 - `seat_tier: string`
from line 285
239285 "email_address": "email_address",
240286 "name": "name",
241287 "type": "user_actor",
242 "user_id": "user_id"
288 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
243289 },
244290 "created_at": "2019-12-27T18:11:19.117Z",
245291 "period": "monthly",
from line 295
249295 "email_address": "email_address",
250296 "name": "name",
251297 "type": "user_actor",
252 "user_id": "user_id"
298 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
253299 },
254300 "spend_summary": {
255301 "actor": {
from line 303
257303 "email_address": "email_address",
258304 "name": "name",
259305 "type": "user_actor",
260 "user_id": "user_id"
306 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
261307 },
262308 "amount": "50000",
263309 "currency": "USD",
from line 311
265311 "period_to_date_spend": "12050.5",
266312 "scope": {
267313 "type": "user",
268 "user_id": "user_id"
314 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
269315 },
270316 "source": {
271317 "type": "user",
272 "user_id": "user_id"
318 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
273319 },
274320 "spend_limit_id": "spend_limit_id"
275321 },
from line 356
310356
311357 - `deleted: boolean`
312358
359 True only when the underlying account has been deleted.
360
313361 default: false
314362
315363 - `email_address: string or null`
316364
365 The user's email address. Null when the account is unavailable or has been deleted.
366
317367 - `name: string or null`
318368
369 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
370
319371 - `type: "user_actor"`
320372
373 Actor type. Always `user_actor`.
374
321375 default: user_actor
322376
323377 - `user_id: string`
324378
379 Tagged ID of the user.
380
325381 - `created_at: string`
326382
327383 format: date-time
from line 408
352408
353409 - `deleted: boolean`
354410
411 True only when the underlying account has been deleted.
412
355413 default: false
356414
357415 - `email_address: string or null`
358416
417 The user's email address. Null when the account is unavailable or has been deleted.
418
359419 - `name: string or null`
360420
421 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
422
361423 - `type: "user_actor"`
362424
425 Actor type. Always `user_actor`.
426
363427 default: user_actor
364428
365429 - `user_id: string`
366430
431 Tagged ID of the user.
432
367433 - `ScopedAPIKeyActor object`
368434
369435 A scoped Admin API key acting on behalf of the organization.
from line 442
376442
377443 - `spend_summary: SpendSummary or null`
378444
379 Per-member effective-limit report row (GET /spend_limits/effective).
445 Per-member effective-limit report row (`GET /spend_limits/effective`).
380446
381447 - `actor: object`
382448
from line 452
386452
387453 - `deleted: boolean`
388454
455 True only when the underlying account has been deleted.
456
389457 default: false
390458
391459 - `email_address: string or null`
392460
461 The user's email address. Null when the account is unavailable or has been deleted.
462
393463 - `name: string or null`
394464
465 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
466
395467 - `type: "user_actor"`
396468
469 Actor type. Always `user_actor`.
470
397471 default: user_actor
398472
399473 - `user_id: string`
400474
475 Tagged ID of the user.
476
401477 - `amount: string or null`
402478
403479 Effective limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD). `null` means no limit applies for this row's `period` — each period resolves independently, so another period may still cap this member.
from line 484
408484
409485 - `period: "daily" or "monthly" or "weekly"`
410486
487 Period this row's effective limit and spend are reported for.
488
411489 - `"daily"`
412490
413491 - `"monthly"`
from line 498
420498
421499 - `scope: object`
422500
501 Scope selecting a single member of the organization.
502
423503 - `type: "user"`
424504
505 Scope type. Always `user` for this scope.
506
425507 default: user
426508
427509 - `user_id: string`
428510
511 Tagged ID of the member the spend limit applies to.
512
429513 - `source: object or object or object or 2 more`
430514
515 Scope selecting a single member of the organization.
516
431517 - `User object`
432518
519 Scope selecting a single member of the organization.
520
433521 - `type: "user"`
434522
523 Scope type. Always `user` for this scope.
524
435525 default: user
436526
437527 - `user_id: string`
438528
529 Tagged ID of the member the spend limit applies to.
530
439531 - `SeatTier object`
440532
441533 - `seat_tier: string`
from line 590
498590 "email_address": "email_address",
499591 "name": "name",
500592 "type": "user_actor",
501 "user_id": "user_id"
593 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
502594 },
503595 "created_at": "2019-12-27T18:11:19.117Z",
504596 "period": "monthly",
from line 600
508600 "email_address": "email_address",
509601 "name": "name",
510602 "type": "user_actor",
511 "user_id": "user_id"
603 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
512604 },
513605 "spend_summary": {
514606 "actor": {
from line 608
516608 "email_address": "email_address",
517609 "name": "name",
518610 "type": "user_actor",
519 "user_id": "user_id"
611 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
520612 },
521613 "amount": "50000",
522614 "currency": "USD",
from line 616
524616 "period_to_date_spend": "12050.5",
525617 "scope": {
526618 "type": "user",
527 "user_id": "user_id"
619 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
528620 },
529621 "source": {
530622 "type": "user",
531 "user_id": "user_id"
623 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
532624 },
533625 "spend_limit_id": "spend_limit_id"
534626 },
from line 674
582674
583675 - `deleted: boolean`
584676
677 True only when the underlying account has been deleted.
678
585679 default: false
586680
587681 - `email_address: string or null`
588682
683 The user's email address. Null when the account is unavailable or has been deleted.
684
589685 - `name: string or null`
590686
687 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
688
591689 - `type: "user_actor"`
592690
691 Actor type. Always `user_actor`.
692
593693 default: user_actor
594694
595695 - `user_id: string`
596696
697 Tagged ID of the user.
698
597699- `created_at: string`
598700
599701 format: date-time
from line 726
624726
625727 - `deleted: boolean`
626728
729 True only when the underlying account has been deleted.
730
627731 default: false
628732
629733 - `email_address: string or null`
630734
735 The user's email address. Null when the account is unavailable or has been deleted.
736
631737 - `name: string or null`
632738
739 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
740
633741 - `type: "user_actor"`
634742
743 Actor type. Always `user_actor`.
744
635745 default: user_actor
636746
637747 - `user_id: string`
638748
749 Tagged ID of the user.
750
639751 - `ScopedAPIKeyActor object`
640752
641753 A scoped Admin API key acting on behalf of the organization.
from line 760
648760
649761- `spend_limit: SpendLimit`
650762
763 A configured spend limit: a cap on metered spend for one scope and period.
764
651765 - `id: string`
652766
767 Unique tagged ID of the spend limit (`spl_...`).
768
653769 - `amount: string or null`
654770
655771 Limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD): "50000" is $500.00. `null` means no numeric cap is configured at this scope — see the effective report for whether a limit applies.
from line 772
656772
657773 - `created_at: string`
658774
775 RFC 3339 datetime at which the spend limit was created.
776
659777 format: date-time
660778
661779 - `currency: string`
from line 782
664782
665783 - `period: "daily" or "monthly" or "weekly"`
666784
785 Length of the window the limit resets over. `amount` caps spend within each period.
786
667787 - `"daily"`
668788
669789 - `"monthly"`
from line 792
672792
673793 - `scope: object or object or object or 2 more`
674794
795 What the limit applies to. A tagged union on `type`; each variant carries the identifier for its scope.
796
675797 - `User object`
676798
799 Scope selecting a single member of the organization.
800
677801 - `type: "user"`
678802
803 Scope type. Always `user` for this scope.
804
679805 default: user
680806
681807 - `user_id: string`
682808
809 Tagged ID of the member the spend limit applies to.
810
683811 - `SeatTier object`
684812
685813 - `seat_tier: string`
from line 840
712840
713841 - `type: "spend_limit"`
714842
843 Object type. Always `spend_limit`.
844
715845 default: spend_limit
716846
717847 - `updated_at: string`
718848
849 RFC 3339 datetime at which the spend limit was last modified.
850
719851 format: date-time
720852
721853- `spend_summary: SpendSummary or null`
722854
723 Per-member effective-limit report row (GET /spend_limits/effective).
855 Per-member effective-limit report row (`GET /spend_limits/effective`).
724856
725857 - `actor: object`
726858
from line 862
730862
731863 - `deleted: boolean`
732864
865 True only when the underlying account has been deleted.
866
733867 default: false
734868
735869 - `email_address: string or null`
736870
871 The user's email address. Null when the account is unavailable or has been deleted.
872
737873 - `name: string or null`
738874
875 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
876
739877 - `type: "user_actor"`
740878
879 Actor type. Always `user_actor`.
880
741881 default: user_actor
742882
743883 - `user_id: string`
744884
885 Tagged ID of the user.
886
745887 - `amount: string or null`
746888
747889 Effective limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD). `null` means no limit applies for this row's `period` — each period resolves independently, so another period may still cap this member.
from line 894
752894
753895 - `period: "daily" or "monthly" or "weekly"`
754896
897 Period this row's effective limit and spend are reported for.
898
755899 - `"daily"`
756900
757901 - `"monthly"`
from line 908
764908
765909 - `scope: object`
766910
911 Scope selecting a single member of the organization.
912
767913 - `type: "user"`
768914
915 Scope type. Always `user` for this scope.
916
769917 default: user
770918
771919 - `user_id: string`
772920
921 Tagged ID of the member the spend limit applies to.
922
773923 - `source: object or object or object or 2 more`
774924
925 Scope selecting a single member of the organization.
926
775927 - `User object`
776928
929 Scope selecting a single member of the organization.
930
777931 - `type: "user"`
778932
933 Scope type. Always `user` for this scope.
934
779935 default: user
780936
781937 - `user_id: string`
782938
939 Tagged ID of the member the spend limit applies to.
940
783941 - `SeatTier object`
784942
785943 - `seat_tier: string`
from line 1005
8471005 "email_address": "email_address",
8481006 "name": "name",
8491007 "type": "user_actor",
850 "user_id": "user_id"
1008 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
8511009 },
8521010 "created_at": "2019-12-27T18:11:19.117Z",
8531011 "period": "monthly",
from line 1015
8571015 "email_address": "email_address",
8581016 "name": "name",
8591017 "type": "user_actor",
860 "user_id": "user_id"
1018 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
8611019 },
8621020 "spend_limit": {
8631021 "id": "id",
from line 1025
8671025 "period": "monthly",
8681026 "scope": {
8691027 "type": "user",
870 "user_id": "user_id"
1028 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
8711029 },
8721030 "type": "spend_limit",
8731031 "updated_at": "2019-12-27T18:11:19.117Z"
from line 1036
8781036 "email_address": "email_address",
8791037 "name": "name",
8801038 "type": "user_actor",
881 "user_id": "user_id"
1039 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
8821040 },
8831041 "amount": "50000",
8841042 "currency": "USD",
from line 1044
8861044 "period_to_date_spend": "12050.5",
8871045 "scope": {
8881046 "type": "user",
889 "user_id": "user_id"
1047 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
8901048 },
8911049 "source": {
8921050 "type": "user",
893 "user_id": "user_id"
1051 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
8941052 },
8951053 "spend_limit_id": "spend_limit_id"
8961054 },
from line 1090
9321090
9331091 - `deleted: boolean`
9341092
1093 True only when the underlying account has been deleted.
1094
9351095 default: false
9361096
9371097 - `email_address: string or null`
9381098
1099 The user's email address. Null when the account is unavailable or has been deleted.
1100
9391101 - `name: string or null`
9401102
1103 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
1104
9411105 - `type: "user_actor"`
9421106
1107 Actor type. Always `user_actor`.
1108
9431109 default: user_actor
9441110
9451111 - `user_id: string`
9461112
1113 Tagged ID of the user.
1114
9471115 - `created_at: string`
9481116
9491117 format: date-time
from line 1142
9741142
9751143 - `deleted: boolean`
9761144
1145 True only when the underlying account has been deleted.
1146
9771147 default: false
9781148
9791149 - `email_address: string or null`
9801150
1151 The user's email address. Null when the account is unavailable or has been deleted.
1152
9811153 - `name: string or null`
9821154
1155 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
1156
9831157 - `type: "user_actor"`
9841158
1159 Actor type. Always `user_actor`.
1160
9851161 default: user_actor
9861162
9871163 - `user_id: string`
9881164
1165 Tagged ID of the user.
1166
9891167 - `ScopedAPIKeyActor object`
9901168
9911169 A scoped Admin API key acting on behalf of the organization.
from line 1176
9981176
9991177 - `spend_summary: SpendSummary or null`
10001178
1001 Per-member effective-limit report row (GET /spend_limits/effective).
1179 Per-member effective-limit report row (`GET /spend_limits/effective`).
10021180
10031181 - `actor: object`
10041182
from line 1186
10081186
10091187 - `deleted: boolean`
10101188
1189 True only when the underlying account has been deleted.
1190
10111191 default: false
10121192
10131193 - `email_address: string or null`
10141194
1195 The user's email address. Null when the account is unavailable or has been deleted.
1196
10151197 - `name: string or null`
10161198
1199 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
1200
10171201 - `type: "user_actor"`
10181202
1203 Actor type. Always `user_actor`.
1204
10191205 default: user_actor
10201206
10211207 - `user_id: string`
10221208
1209 Tagged ID of the user.
1210
10231211 - `amount: string or null`
10241212
10251213 Effective limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD). `null` means no limit applies for this row's `period` — each period resolves independently, so another period may still cap this member.
from line 1218
10301218
10311219 - `period: "daily" or "monthly" or "weekly"`
10321220
1221 Period this row's effective limit and spend are reported for.
1222
10331223 - `"daily"`
10341224
10351225 - `"monthly"`
from line 1232
10421232
10431233 - `scope: object`
10441234
1235 Scope selecting a single member of the organization.
1236
10451237 - `type: "user"`
10461238
1239 Scope type. Always `user` for this scope.
1240
10471241 default: user
10481242
10491243 - `user_id: string`
10501244
1245 Tagged ID of the member the spend limit applies to.
1246
10511247 - `source: object or object or object or 2 more`
10521248
1249 Scope selecting a single member of the organization.
1250
10531251 - `User object`
10541252
1253 Scope selecting a single member of the organization.
1254
10551255 - `type: "user"`
10561256
1257 Scope type. Always `user` for this scope.
1258
10571259 default: user
10581260
10591261 - `user_id: string`
10601262
1263 Tagged ID of the member the spend limit applies to.
1264
10611265 - `SeatTier object`
10621266
10631267 - `seat_tier: string`
from line 1326
11221326 "email_address": "email_address",
11231327 "name": "name",
11241328 "type": "user_actor",
1125 "user_id": "user_id"
1329 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
11261330 },
11271331 "created_at": "2019-12-27T18:11:19.117Z",
11281332 "period": "monthly",
from line 1336
11321336 "email_address": "email_address",
11331337 "name": "name",
11341338 "type": "user_actor",
1135 "user_id": "user_id"
1339 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
11361340 },
11371341 "spend_summary": {
11381342 "actor": {
from line 1344
11401344 "email_address": "email_address",
11411345 "name": "name",
11421346 "type": "user_actor",
1143 "user_id": "user_id"
1347 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
11441348 },
11451349 "amount": "50000",
11461350 "currency": "USD",
from line 1352
11481352 "period_to_date_spend": "12050.5",
11491353 "scope": {
11501354 "type": "user",
1151 "user_id": "user_id"
1355 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
11521356 },
11531357 "source": {
11541358 "type": "user",
1155 "user_id": "user_id"
1359 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
11561360 },
11571361 "spend_limit_id": "spend_limit_id"
11581362 },
from line 1381
11771381
11781382 - `deleted: boolean`
11791383
1384 True only when the underlying account has been deleted.
1385
11801386 default: false
11811387
11821388 - `email_address: string or null`
11831389
1390 The user's email address. Null when the account is unavailable or has been deleted.
1391
11841392 - `name: string or null`
11851393
1394 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
1395
11861396 - `type: "user_actor"`
11871397
1398 Actor type. Always `user_actor`.
1399
11881400 default: user_actor
11891401
11901402 - `user_id: string`
11911403
1404 Tagged ID of the user.
1405
11921406 - `created_at: string`
11931407
11941408 format: date-time
from line 1433
12191433
12201434 - `deleted: boolean`
12211435
1436 True only when the underlying account has been deleted.
1437
12221438 default: false
12231439
12241440 - `email_address: string or null`
12251441
1442 The user's email address. Null when the account is unavailable or has been deleted.
1443
12261444 - `name: string or null`
12271445
1446 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
1447
12281448 - `type: "user_actor"`
12291449
1450 Actor type. Always `user_actor`.
1451
12301452 default: user_actor
12311453
12321454 - `user_id: string`
12331455
1456 Tagged ID of the user.
1457
12341458 - `ScopedAPIKeyActor object`
12351459
12361460 A scoped Admin API key acting on behalf of the organization.
from line 1467
12431467
12441468 - `spend_summary: SpendSummary or null`
12451469
1246 Per-member effective-limit report row (GET /spend_limits/effective).
1470 Per-member effective-limit report row (`GET /spend_limits/effective`).
12471471
12481472 - `actor: object`
12491473
from line 1477
12531477
12541478 - `deleted: boolean`
12551479
1480 True only when the underlying account has been deleted.
1481
12561482 default: false
12571483
12581484 - `email_address: string or null`
12591485
1486 The user's email address. Null when the account is unavailable or has been deleted.
1487
12601488 - `name: string or null`
12611489
1490 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
1491
12621492 - `type: "user_actor"`
12631493
1494 Actor type. Always `user_actor`.
1495
12641496 default: user_actor
12651497
12661498 - `user_id: string`
12671499
1500 Tagged ID of the user.
1501
12681502 - `amount: string or null`
12691503
12701504 Effective limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD). `null` means no limit applies for this row's `period` — each period resolves independently, so another period may still cap this member.
from line 1509
12751509
12761510 - `period: "daily" or "monthly" or "weekly"`
12771511
1512 Period this row's effective limit and spend are reported for.
1513
12781514 - `"daily"`
12791515
12801516 - `"monthly"`
from line 1523
12871523
12881524 - `scope: object`
12891525
1526 Scope selecting a single member of the organization.
1527
12901528 - `type: "user"`
12911529
1530 Scope type. Always `user` for this scope.
1531
12921532 default: user
12931533
12941534 - `user_id: string`
12951535
1536 Tagged ID of the member the spend limit applies to.
1537
12961538 - `source: object or object or object or 2 more`
12971539
1540 Scope selecting a single member of the organization.
1541
12981542 - `User object`
12991543
1544 Scope selecting a single member of the organization.
1545
13001546 - `type: "user"`
13011547
1548 Scope type. Always `user` for this scope.
1549
13021550 default: user
13031551
13041552 - `user_id: string`
13051553
1554 Tagged ID of the member the spend limit applies to.
1555
13061556 - `SeatTier object`
13071557
13081558 - `seat_tier: string`
from line 1611
13611611
13621612 - `deleted: boolean`
13631613
1614 True only when the underlying account has been deleted.
1615
13641616 default: false
13651617
13661618 - `email_address: string or null`
13671619
1620 The user's email address. Null when the account is unavailable or has been deleted.
1621
13681622 - `name: string or null`
13691623
1624 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
1625
13701626 - `type: "user_actor"`
13711627
1628 Actor type. Always `user_actor`.
1629
13721630 default: user_actor
13731631
13741632 - `user_id: string`
13751633
1634 Tagged ID of the user.
1635
13761636 - `created_at: string`
13771637
13781638 format: date-time
from line 1663
14031663
14041664 - `deleted: boolean`
14051665
1666 True only when the underlying account has been deleted.
1667
14061668 default: false
14071669
14081670 - `email_address: string or null`
14091671
1672 The user's email address. Null when the account is unavailable or has been deleted.
1673
14101674 - `name: string or null`
14111675
1676 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
1677
14121678 - `type: "user_actor"`
14131679
1680 Actor type. Always `user_actor`.
1681
14141682 default: user_actor
14151683
14161684 - `user_id: string`
14171685
1686 Tagged ID of the user.
1687
14181688 - `ScopedAPIKeyActor object`
14191689
14201690 A scoped Admin API key acting on behalf of the organization.
from line 1697
14271697
14281698 - `spend_limit: SpendLimit`
14291699
1700 A configured spend limit: a cap on metered spend for one scope and period.
1701
14301702 - `id: string`
14311703
1704 Unique tagged ID of the spend limit (`spl_...`).
1705
14321706 - `amount: string or null`
14331707
14341708 Limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD): "50000" is $500.00. `null` means no numeric cap is configured at this scope — see the effective report for whether a limit applies.
from line 1709
14351709
14361710 - `created_at: string`
14371711
1712 RFC 3339 datetime at which the spend limit was created.
1713
14381714 format: date-time
14391715
14401716 - `currency: string`
from line 1719
14431719
14441720 - `period: "daily" or "monthly" or "weekly"`
14451721
1722 Length of the window the limit resets over. `amount` caps spend within each period.
1723
14461724 - `"daily"`
14471725
14481726 - `"monthly"`
from line 1729
14511729
14521730 - `scope: object or object or object or 2 more`
14531731
1732 What the limit applies to. A tagged union on `type`; each variant carries the identifier for its scope.
1733
14541734 - `User object`
14551735
1736 Scope selecting a single member of the organization.
1737
14561738 - `type: "user"`
14571739
1740 Scope type. Always `user` for this scope.
1741
14581742 default: user
14591743
14601744 - `user_id: string`
14611745
1746 Tagged ID of the member the spend limit applies to.
1747
14621748 - `SeatTier object`
14631749
14641750 - `seat_tier: string`
from line 1777
14911777
14921778 - `type: "spend_limit"`
14931779
1780 Object type. Always `spend_limit`.
1781
14941782 default: spend_limit
14951783
14961784 - `updated_at: string`
14971785
1786 RFC 3339 datetime at which the spend limit was last modified.
1787
14981788 format: date-time
14991789
15001790 - `spend_summary: SpendSummary or null`
15011791
1502 Per-member effective-limit report row (GET /spend_limits/effective).
1792 Per-member effective-limit report row (`GET /spend_limits/effective`).
15031793
15041794 - `actor: object`
15051795
from line 1799
15091799
15101800 - `deleted: boolean`
15111801
1802 True only when the underlying account has been deleted.
1803
15121804 default: false
15131805
15141806 - `email_address: string or null`
15151807
1808 The user's email address. Null when the account is unavailable or has been deleted.
1809
15161810 - `name: string or null`
15171811
1812 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
1813
15181814 - `type: "user_actor"`
15191815
1816 Actor type. Always `user_actor`.
1817
15201818 default: user_actor
15211819
15221820 - `user_id: string`
15231821
1822 Tagged ID of the user.
1823
15241824 - `amount: string or null`
15251825
15261826 Effective limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD). `null` means no limit applies for this row's `period` — each period resolves independently, so another period may still cap this member.
from line 1831
15311831
15321832 - `period: "daily" or "monthly" or "weekly"`
15331833
1834 Period this row's effective limit and spend are reported for.
1835
15341836 - `"daily"`
15351837
15361838 - `"monthly"`
from line 1845
15431845
15441846 - `scope: object`
15451847
1848 Scope selecting a single member of the organization.
1849
15461850 - `type: "user"`
15471851
1852 Scope type. Always `user` for this scope.
1853
15481854 default: user
15491855
15501856 - `user_id: string`
15511857
1858 Tagged ID of the member the spend limit applies to.
1859
15521860 - `source: object or object or object or 2 more`
15531861
1862 Scope selecting a single member of the organization.
1863
15541864 - `User object`
15551865
1866 Scope selecting a single member of the organization.
1867
15561868 - `type: "user"`
15571869
1870 Scope type. Always `user` for this scope.
1871
15581872 default: user
15591873
15601874 - `user_id: string`
1875
1876 Tagged ID of the member the spend limit applies to.
15611877
15621878 - `SeatTier object`
15631879
api/admin/spend_limits/increase_requests/approve Changed · +73 / -7 lines
from line 43
4343
4444 - `deleted: boolean`
4545
46 True only when the underlying account has been deleted.
47
4648 default: false
4749
4850 - `email_address: string or null`
4951
52 The user's email address. Null when the account is unavailable or has been deleted.
53
5054 - `name: string or null`
5155
56 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
57
5258 - `type: "user_actor"`
5359
60 Actor type. Always `user_actor`.
61
5462 default: user_actor
5563
5664 - `user_id: string`
5765
66 Tagged ID of the user.
67
5868- `created_at: string`
5969
6070 format: date-time
from line 95
8595
8696 - `deleted: boolean`
8797
98 True only when the underlying account has been deleted.
99
88100 default: false
89101
90102 - `email_address: string or null`
91103
104 The user's email address. Null when the account is unavailable or has been deleted.
105
92106 - `name: string or null`
93107
108 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
109
94110 - `type: "user_actor"`
95111
112 Actor type. Always `user_actor`.
113
96114 default: user_actor
97115
98116 - `user_id: string`
99117
118 Tagged ID of the user.
119
100120 - `ScopedAPIKeyActor object`
101121
102122 A scoped Admin API key acting on behalf of the organization.
from line 129
109129
110130- `spend_limit: SpendLimit`
111131
132 A configured spend limit: a cap on metered spend for one scope and period.
133
112134 - `id: string`
113135
136 Unique tagged ID of the spend limit (`spl_...`).
137
114138 - `amount: string or null`
115139
116140 Limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD): "50000" is $500.00. `null` means no numeric cap is configured at this scope — see the effective report for whether a limit applies.
from line 141
117141
118142 - `created_at: string`
119143
144 RFC 3339 datetime at which the spend limit was created.
145
120146 format: date-time
121147
122148 - `currency: string`
from line 151
125151
126152 - `period: "daily" or "monthly" or "weekly"`
127153
154 Length of the window the limit resets over. `amount` caps spend within each period.
155
128156 - `"daily"`
129157
130158 - `"monthly"`
from line 161
133161
134162 - `scope: object or object or object or 2 more`
135163
164 What the limit applies to. A tagged union on `type`; each variant carries the identifier for its scope.
165
136166 - `User object`
137167
168 Scope selecting a single member of the organization.
169
138170 - `type: "user"`
139171
172 Scope type. Always `user` for this scope.
173
140174 default: user
141175
142176 - `user_id: string`
143177
178 Tagged ID of the member the spend limit applies to.
179
144180 - `SeatTier object`
145181
146182 - `seat_tier: string`
from line 209
173209
174210 - `type: "spend_limit"`
175211
212 Object type. Always `spend_limit`.
213
176214 default: spend_limit
177215
178216 - `updated_at: string`
179217
218 RFC 3339 datetime at which the spend limit was last modified.
219
180220 format: date-time
181221
182222- `spend_summary: SpendSummary or null`
183223
184 Per-member effective-limit report row (GET /spend_limits/effective).
224 Per-member effective-limit report row (`GET /spend_limits/effective`).
185225
186226 - `actor: object`
187227
from line 231
191231
192232 - `deleted: boolean`
193233
234 True only when the underlying account has been deleted.
235
194236 default: false
195237
196238 - `email_address: string or null`
197239
240 The user's email address. Null when the account is unavailable or has been deleted.
241
198242 - `name: string or null`
199243
244 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
245
200246 - `type: "user_actor"`
201247
248 Actor type. Always `user_actor`.
249
202250 default: user_actor
203251
204252 - `user_id: string`
205253
254 Tagged ID of the user.
255
206256 - `amount: string or null`
207257
208258 Effective limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD). `null` means no limit applies for this row's `period` — each period resolves independently, so another period may still cap this member.
from line 263
213263
214264 - `period: "daily" or "monthly" or "weekly"`
215265
266 Period this row's effective limit and spend are reported for.
267
216268 - `"daily"`
217269
218270 - `"monthly"`
from line 277
225277
226278 - `scope: object`
227279
280 Scope selecting a single member of the organization.
281
228282 - `type: "user"`
229283
284 Scope type. Always `user` for this scope.
285
230286 default: user
231287
232288 - `user_id: string`
233289
290 Tagged ID of the member the spend limit applies to.
291
234292 - `source: object or object or object or 2 more`
235293
294 Scope selecting a single member of the organization.
295
236296 - `User object`
237297
298 Scope selecting a single member of the organization.
299
238300 - `type: "user"`
239301
302 Scope type. Always `user` for this scope.
303
240304 default: user
241305
242306 - `user_id: string`
243307
308 Tagged ID of the member the spend limit applies to.
309
244310 - `SeatTier object`
245311
246312 - `seat_tier: string`
from line 374
308374 "email_address": "email_address",
309375 "name": "name",
310376 "type": "user_actor",
311 "user_id": "user_id"
377 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
312378 },
313379 "created_at": "2019-12-27T18:11:19.117Z",
314380 "period": "monthly",
from line 384
318384 "email_address": "email_address",
319385 "name": "name",
320386 "type": "user_actor",
321 "user_id": "user_id"
387 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
322388 },
323389 "spend_limit": {
324390 "id": "id",
from line 394
328394 "period": "monthly",
329395 "scope": {
330396 "type": "user",
331 "user_id": "user_id"
397 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
332398 },
333399 "type": "spend_limit",
334400 "updated_at": "2019-12-27T18:11:19.117Z"
from line 405
339405 "email_address": "email_address",
340406 "name": "name",
341407 "type": "user_actor",
342 "user_id": "user_id"
408 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
343409 },
344410 "amount": "50000",
345411 "currency": "USD",
from line 413
347413 "period_to_date_spend": "12050.5",
348414 "scope": {
349415 "type": "user",
350 "user_id": "user_id"
416 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
351417 },
352418 "source": {
353419 "type": "user",
354 "user_id": "user_id"
420 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
355421 },
356422 "spend_limit_id": "spend_limit_id"
357423 },
api/admin/spend_limits/increase_requests/deny Changed · +52 / -6 lines
from line 31
3131
3232 - `deleted: boolean`
3333
34 True only when the underlying account has been deleted.
35
3436 default: false
3537
3638 - `email_address: string or null`
3739
40 The user's email address. Null when the account is unavailable or has been deleted.
41
3842 - `name: string or null`
3943
44 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
45
4046 - `type: "user_actor"`
4147
48 Actor type. Always `user_actor`.
49
4250 default: user_actor
4351
4452 - `user_id: string`
4553
54 Tagged ID of the user.
55
4656 - `created_at: string`
4757
4858 format: date-time
from line 83
7383
7484 - `deleted: boolean`
7585
86 True only when the underlying account has been deleted.
87
7688 default: false
7789
7890 - `email_address: string or null`
7991
92 The user's email address. Null when the account is unavailable or has been deleted.
93
8094 - `name: string or null`
8195
96 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
97
8298 - `type: "user_actor"`
8399
100 Actor type. Always `user_actor`.
101
84102 default: user_actor
85103
86104 - `user_id: string`
87105
106 Tagged ID of the user.
107
88108 - `ScopedAPIKeyActor object`
89109
90110 A scoped Admin API key acting on behalf of the organization.
from line 117
97117
98118 - `spend_summary: SpendSummary or null`
99119
100 Per-member effective-limit report row (GET /spend_limits/effective).
120 Per-member effective-limit report row (`GET /spend_limits/effective`).
101121
102122 - `actor: object`
103123
from line 127
107127
108128 - `deleted: boolean`
109129
130 True only when the underlying account has been deleted.
131
110132 default: false
111133
112134 - `email_address: string or null`
113135
136 The user's email address. Null when the account is unavailable or has been deleted.
137
114138 - `name: string or null`
115139
140 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
141
116142 - `type: "user_actor"`
117143
144 Actor type. Always `user_actor`.
145
118146 default: user_actor
119147
120148 - `user_id: string`
121149
150 Tagged ID of the user.
151
122152 - `amount: string or null`
123153
124154 Effective limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD). `null` means no limit applies for this row's `period` — each period resolves independently, so another period may still cap this member.
from line 159
129159
130160 - `period: "daily" or "monthly" or "weekly"`
131161
162 Period this row's effective limit and spend are reported for.
163
132164 - `"daily"`
133165
134166 - `"monthly"`
from line 173
141173
142174 - `scope: object`
143175
176 Scope selecting a single member of the organization.
177
144178 - `type: "user"`
145179
180 Scope type. Always `user` for this scope.
181
146182 default: user
147183
148184 - `user_id: string`
149185
186 Tagged ID of the member the spend limit applies to.
187
150188 - `source: object or object or object or 2 more`
151189
190 Scope selecting a single member of the organization.
191
152192 - `User object`
153193
194 Scope selecting a single member of the organization.
195
154196 - `type: "user"`
155197
198 Scope type. Always `user` for this scope.
199
156200 default: user
157201
158202 - `user_id: string`
159203
204 Tagged ID of the member the spend limit applies to.
205
160206 - `SeatTier object`
161207
162208 - `seat_tier: string`
from line 267
221267 "email_address": "email_address",
222268 "name": "name",
223269 "type": "user_actor",
224 "user_id": "user_id"
270 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
225271 },
226272 "created_at": "2019-12-27T18:11:19.117Z",
227273 "period": "monthly",
from line 277
231277 "email_address": "email_address",
232278 "name": "name",
233279 "type": "user_actor",
234 "user_id": "user_id"
280 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
235281 },
236282 "spend_summary": {
237283 "actor": {
from line 285
239285 "email_address": "email_address",
240286 "name": "name",
241287 "type": "user_actor",
242 "user_id": "user_id"
288 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
243289 },
244290 "amount": "50000",
245291 "currency": "USD",
from line 293
247293 "period_to_date_spend": "12050.5",
248294 "scope": {
249295 "type": "user",
250 "user_id": "user_id"
296 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
251297 },
252298 "source": {
253299 "type": "user",
254 "user_id": "user_id"
300 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
255301 },
256302 "spend_limit_id": "spend_limit_id"
257303 },
api/admin/spend_limits/increase_requests/list Changed · +52 / -6 lines
from line 45
4545
4646 - `deleted: boolean`
4747
48 True only when the underlying account has been deleted.
49
4850 default: false
4951
5052 - `email_address: string or null`
5153
54 The user's email address. Null when the account is unavailable or has been deleted.
55
5256 - `name: string or null`
5357
58 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
59
5460 - `type: "user_actor"`
5561
62 Actor type. Always `user_actor`.
63
5664 default: user_actor
5765
5866 - `user_id: string`
5967
68 Tagged ID of the user.
69
6070 - `created_at: string`
6171
6272 format: date-time
from line 97
8797
8898 - `deleted: boolean`
8999
100 True only when the underlying account has been deleted.
101
90102 default: false
91103
92104 - `email_address: string or null`
93105
106 The user's email address. Null when the account is unavailable or has been deleted.
107
94108 - `name: string or null`
95109
110 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
111
96112 - `type: "user_actor"`
97113
114 Actor type. Always `user_actor`.
115
98116 default: user_actor
99117
100118 - `user_id: string`
101119
120 Tagged ID of the user.
121
102122 - `ScopedAPIKeyActor object`
103123
104124 A scoped Admin API key acting on behalf of the organization.
from line 131
111131
112132 - `spend_summary: SpendSummary or null`
113133
114 Per-member effective-limit report row (GET /spend_limits/effective).
134 Per-member effective-limit report row (`GET /spend_limits/effective`).
115135
116136 - `actor: object`
117137
from line 141
121141
122142 - `deleted: boolean`
123143
144 True only when the underlying account has been deleted.
145
124146 default: false
125147
126148 - `email_address: string or null`
127149
150 The user's email address. Null when the account is unavailable or has been deleted.
151
128152 - `name: string or null`
129153
154 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
155
130156 - `type: "user_actor"`
131157
158 Actor type. Always `user_actor`.
159
132160 default: user_actor
133161
134162 - `user_id: string`
135163
164 Tagged ID of the user.
165
136166 - `amount: string or null`
137167
138168 Effective limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD). `null` means no limit applies for this row's `period` — each period resolves independently, so another period may still cap this member.
from line 173
143173
144174 - `period: "daily" or "monthly" or "weekly"`
145175
176 Period this row's effective limit and spend are reported for.
177
146178 - `"daily"`
147179
148180 - `"monthly"`
from line 187
155187
156188 - `scope: object`
157189
190 Scope selecting a single member of the organization.
191
158192 - `type: "user"`
159193
194 Scope type. Always `user` for this scope.
195
160196 default: user
161197
162198 - `user_id: string`
163199
200 Tagged ID of the member the spend limit applies to.
201
164202 - `source: object or object or object or 2 more`
165203
204 Scope selecting a single member of the organization.
205
166206 - `User object`
167207
208 Scope selecting a single member of the organization.
209
168210 - `type: "user"`
169211
212 Scope type. Always `user` for this scope.
213
170214 default: user
171215
172216 - `user_id: string`
173217
218 Tagged ID of the member the spend limit applies to.
219
174220 - `SeatTier object`
175221
176222 - `seat_tier: string`
from line 283
237283 "email_address": "email_address",
238284 "name": "name",
239285 "type": "user_actor",
240 "user_id": "user_id"
286 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
241287 },
242288 "created_at": "2019-12-27T18:11:19.117Z",
243289 "period": "monthly",
from line 293
247293 "email_address": "email_address",
248294 "name": "name",
249295 "type": "user_actor",
250 "user_id": "user_id"
296 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
251297 },
252298 "spend_summary": {
253299 "actor": {
from line 301
255301 "email_address": "email_address",
256302 "name": "name",
257303 "type": "user_actor",
258 "user_id": "user_id"
304 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
259305 },
260306 "amount": "50000",
261307 "currency": "USD",
from line 309
263309 "period_to_date_spend": "12050.5",
264310 "scope": {
265311 "type": "user",
266 "user_id": "user_id"
312 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
267313 },
268314 "source": {
269315 "type": "user",
270 "user_id": "user_id"
316 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
271317 },
272318 "spend_limit_id": "spend_limit_id"
273319 },
api/admin/spend_limits/increase_requests/retrieve Changed · +52 / -6 lines
from line 27
2727
2828 - `deleted: boolean`
2929
30 True only when the underlying account has been deleted.
31
3032 default: false
3133
3234 - `email_address: string or null`
3335
36 The user's email address. Null when the account is unavailable or has been deleted.
37
3438 - `name: string or null`
3539
40 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
41
3642 - `type: "user_actor"`
3743
44 Actor type. Always `user_actor`.
45
3846 default: user_actor
3947
4048 - `user_id: string`
4149
50 Tagged ID of the user.
51
4252 - `created_at: string`
4353
4454 format: date-time
from line 79
6979
7080 - `deleted: boolean`
7181
82 True only when the underlying account has been deleted.
83
7284 default: false
7385
7486 - `email_address: string or null`
7587
88 The user's email address. Null when the account is unavailable or has been deleted.
89
7690 - `name: string or null`
7791
92 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
93
7894 - `type: "user_actor"`
7995
96 Actor type. Always `user_actor`.
97
8098 default: user_actor
8199
82100 - `user_id: string`
83101
102 Tagged ID of the user.
103
84104 - `ScopedAPIKeyActor object`
85105
86106 A scoped Admin API key acting on behalf of the organization.
from line 113
93113
94114 - `spend_summary: SpendSummary or null`
95115
96 Per-member effective-limit report row (GET /spend_limits/effective).
116 Per-member effective-limit report row (`GET /spend_limits/effective`).
97117
98118 - `actor: object`
99119
from line 123
103123
104124 - `deleted: boolean`
105125
126 True only when the underlying account has been deleted.
127
106128 default: false
107129
108130 - `email_address: string or null`
109131
132 The user's email address. Null when the account is unavailable or has been deleted.
133
110134 - `name: string or null`
111135
136 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
137
112138 - `type: "user_actor"`
113139
140 Actor type. Always `user_actor`.
141
114142 default: user_actor
115143
116144 - `user_id: string`
117145
146 Tagged ID of the user.
147
118148 - `amount: string or null`
119149
120150 Effective limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD). `null` means no limit applies for this row's `period` — each period resolves independently, so another period may still cap this member.
from line 155
125155
126156 - `period: "daily" or "monthly" or "weekly"`
127157
158 Period this row's effective limit and spend are reported for.
159
128160 - `"daily"`
129161
130162 - `"monthly"`
from line 169
137169
138170 - `scope: object`
139171
172 Scope selecting a single member of the organization.
173
140174 - `type: "user"`
141175
176 Scope type. Always `user` for this scope.
177
142178 default: user
143179
144180 - `user_id: string`
145181
182 Tagged ID of the member the spend limit applies to.
183
146184 - `source: object or object or object or 2 more`
147185
186 Scope selecting a single member of the organization.
187
148188 - `User object`
149189
190 Scope selecting a single member of the organization.
191
150192 - `type: "user"`
151193
194 Scope type. Always `user` for this scope.
195
152196 default: user
153197
154198 - `user_id: string`
155199
200 Tagged ID of the member the spend limit applies to.
201
156202 - `SeatTier object`
157203
158204 - `seat_tier: string`
from line 261
215261 "email_address": "email_address",
216262 "name": "name",
217263 "type": "user_actor",
218 "user_id": "user_id"
264 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
219265 },
220266 "created_at": "2019-12-27T18:11:19.117Z",
221267 "period": "monthly",
from line 271
225271 "email_address": "email_address",
226272 "name": "name",
227273 "type": "user_actor",
228 "user_id": "user_id"
274 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
229275 },
230276 "spend_summary": {
231277 "actor": {
from line 279
233279 "email_address": "email_address",
234280 "name": "name",
235281 "type": "user_actor",
236 "user_id": "user_id"
282 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
237283 },
238284 "amount": "50000",
239285 "currency": "USD",
from line 287
241287 "period_to_date_spend": "12050.5",
242288 "scope": {
243289 "type": "user",
244 "user_id": "user_id"
290 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
245291 },
246292 "source": {
247293 "type": "user",
248 "user_id": "user_id"
294 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
249295 },
250296 "spend_limit_id": "spend_limit_id"
251297 },
api/admin/spend_limits/list_effective Changed · +44 / -4 lines
from line 12
1212
1313- `limit: optional number`
1414
15 Maximum number of members per page. A member's period rows never split across pages, so a page may carry more rows than this. Defaults to `20`.
16
1517 default: 20, maximum: 1000, minimum: 1
1618
1719- `page: optional string`
1820
19- `period: optional array of string`
21 Opaque cursor from a previous response's `next_page` field.
2022
23- `period: optional array of "daily" or "monthly" or "weekly"`
24
25 Restrict the report to these limit periods. Omit to return one row per period each member resolves a spend limit for.
26
2127 maxItems: 3
2228
29 - `"daily"`
30
31 - `"monthly"`
32
33 - `"weekly"`
34
2335- `user_ids: optional array of string`
2436
37 Restrict the report to these members, by tagged user ID (`user_...`). At most 100 entries.
38
2539 maxItems: 100
2640
2741## Returns
from line 50
3650
3751 - `deleted: boolean`
3852
53 True only when the underlying account has been deleted.
54
3955 default: false
4056
4157 - `email_address: string or null`
4258
59 The user's email address. Null when the account is unavailable or has been deleted.
60
4361 - `name: string or null`
4462
63 The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.
64
4565 - `type: "user_actor"`
4666
67 Actor type. Always `user_actor`.
68
4769 default: user_actor
4870
4971 - `user_id: string`
5072
73 Tagged ID of the user.
74
5175 - `amount: string or null`
5276
5377 Effective limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD). `null` means no limit applies for this row's `period` — each period resolves independently, so another period may still cap this member.
from line 82
5882
5983 - `period: "daily" or "monthly" or "weekly"`
6084
85 Period this row's effective limit and spend are reported for.
86
6187 - `"daily"`
6288
6389 - `"monthly"`
from line 96
7096
7197 - `scope: object`
7298
99 Scope selecting a single member of the organization.
100
73101 - `type: "user"`
74102
103 Scope type. Always `user` for this scope.
104
75105 default: user
76106
77107 - `user_id: string`
78108
109 Tagged ID of the member the spend limit applies to.
110
79111 - `source: object or object or object or 2 more`
80112
113 Scope selecting a single member of the organization.
114
81115 - `User object`
82116
117 Scope selecting a single member of the organization.
118
83119 - `type: "user"`
84120
121 Scope type. Always `user` for this scope.
122
85123 default: user
86124
87125 - `user_id: string`
88126
127 Tagged ID of the member the spend limit applies to.
128
89129 - `SeatTier object`
90130
91131 - `seat_tier: string`
from line 179
139179 "email_address": "email_address",
140180 "name": "name",
141181 "type": "user_actor",
142 "user_id": "user_id"
182 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
143183 },
144184 "amount": "50000",
145185 "currency": "USD",
from line 187
147187 "period_to_date_spend": "12050.5",
148188 "scope": {
149189 "type": "user",
150 "user_id": "user_id"
190 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
151191 },
152192 "source": {
153193 "type": "user",
154 "user_id": "user_id"
194 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
155195 },
156196 "spend_limit_id": "spend_limit_id"
157197 }
api/admin/spend_limits/retrieve Changed · +21 / -1 lines
from line 14
1414
1515- `SpendLimit object`
1616
17 A configured spend limit: a cap on metered spend for one scope and period.
18
1719 - `id: string`
1820
21 Unique tagged ID of the spend limit (`spl_...`).
22
1923 - `amount: string or null`
2024
2125 Limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD): "50000" is $500.00. `null` means no numeric cap is configured at this scope — see the effective report for whether a limit applies.
from line 26
2226
2327 - `created_at: string`
2428
29 RFC 3339 datetime at which the spend limit was created.
30
2531 format: date-time
2632
2733 - `currency: string`
from line 36
3036
3137 - `period: "daily" or "monthly" or "weekly"`
3238
39 Length of the window the limit resets over. `amount` caps spend within each period.
40
3341 - `"daily"`
3442
3543 - `"monthly"`
from line 46
3846
3947 - `scope: object or object or object or 2 more`
4048
49 What the limit applies to. A tagged union on `type`; each variant carries the identifier for its scope.
50
4151 - `User object`
4252
53 Scope selecting a single member of the organization.
54
4355 - `type: "user"`
4456
57 Scope type. Always `user` for this scope.
58
4559 default: user
4660
4761 - `user_id: string`
4862
63 Tagged ID of the member the spend limit applies to.
64
4965 - `SeatTier object`
5066
5167 - `seat_tier: string`
from line 94
7894
7995 - `type: "spend_limit"`
8096
97 Object type. Always `spend_limit`.
98
8199 default: spend_limit
82100
83101 - `updated_at: string`
84102
103 RFC 3339 datetime at which the spend limit was last modified.
104
85105 format: date-time
86106
87107## Example
from line 123
103123 "period": "monthly",
104124 "scope": {
105125 "type": "user",
106 "user_id": "user_id"
126 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
107127 },
108128 "type": "spend_limit",
109129 "updated_at": "2019-12-27T18:11:19.117Z"
api/admin/usage_report Changed · +3 / -3 lines
from line 284
284284 "cache_read_input_tokens": 200,
285285 "context_window": "0-200k",
286286 "inference_geo": "global",
287 "model": "claude-opus-4-6",
287 "model": "claude-opus-5",
288288 "output_tokens": 500,
289289 "server_tool_use": {
290290 "web_search_requests": 10
from line 316
316316
317317 UTC date in YYYY-MM-DD format. Returns metrics for this single day only.
318318
319 pattern: ^\d{4}-\d{2}-\d{2}$
319 pattern: ^\d{4}-\d{2}-\d{2}$, format: date
320320
321321- `limit: optional number`
322322
from line 520
520520 "amount": 186,
521521 "currency": "USD"
522522 },
523 "model": "claude-opus-4-8",
523 "model": "claude-opus-5",
524524 "tokens": {
525525 "cache_creation": 2340,
526526 "cache_read": 8790,
api/admin/users Changed · +6 / -6 lines
from line 4
44
55**GET** `/v1/organizations/users/{user_id}`
66
7For Claude Enterprise organizations, this endpoint's availability is in beta.
7Retrieve a member of the organization by user ID.
88
99### Path parameters
1010
from line 89
8989
9090**GET** `/v1/organizations/users`
9191
92For Claude Enterprise organizations, this endpoint's availability is in beta.
92List the organization's members.
9393
9494### Query parameters
9595
from line 119
119119
120120 Filter to items whose `role` equals one of the supplied values. Repeatable; values are OR'ed together.
121121
122 Accepted values depend on the organization type: Console and API organizations accept `user`, `developer`, `billing`, `admin`, and `claude_code_user`; Claude Enterprise organizations (beta) accept `user`, `owner`, `primary_owner`, `membership_admin`, and `managed`.
122 Accepted values depend on the organization type: Console and API organizations accept `user`, `developer`, `billing`, `admin`, and `claude_code_user`; Claude Enterprise organizations accept `user`, `owner`, `primary_owner`, `membership_admin`, and `managed`.
123123
124124### Returns
125125
from line 217
217217
218218**POST** `/v1/organizations/users/{user_id}`
219219
220For Claude Enterprise organizations, this endpoint's availability is in beta.
220Update a member's organization role.
221221
222222### Path parameters
223223
from line 231
231231
232232 New role for the User.
233233
234 The accepted values depend on the organization type. Console and API organizations accept `user`, `developer`, `billing`, and `claude_code_user`; `admin` cannot be assigned through the API. Claude Enterprise organizations (beta) accept `user` and `managed`.
234 The accepted values depend on the organization type. Console and API organizations accept `user`, `developer`, `billing`, and `claude_code_user`; `admin` cannot be assigned through the API. Claude Enterprise organizations accept `user` and `managed`.
235235
236236 - `"billing"`
237237
from line 324
324324
325325**DELETE** `/v1/organizations/users/{user_id}`
326326
327For Claude Enterprise organizations, this endpoint's availability is in beta.
327Remove a member from the organization.
328328
329329### Path parameters
330330
api/admin/workspaces Changed · +8 / -8 lines
from line 24
2424
2525- `data_residency: optional object or null`
2626
27 Data residency configuration for the workspace. If omitted, defaults to workspace_geo=`"us"`, allowed_inference_geos=`"unrestricted"`, and default_inference_geo=`"global"`.
27 Data residency configuration for the workspace. If omitted, defaults to `workspace_geo: "us"`, `allowed_inference_geos: "unrestricted"`, and `default_inference_geo: "global"`.
2828
2929 - `allowed_inference_geos: optional array of "global" or "us" or "unrestricted" or null`
3030
from line 40
4040
4141 - `default_inference_geo: optional "global" or "us" or null`
4242
43 Default inference geo applied when requests omit the parameter. Defaults to 'global' if omitted. Must be a member of allowed_inference_geos unless allowed_inference_geos is `"unrestricted"`.
43 Default inference geo applied when requests omit the parameter. Defaults to 'global' if omitted. Must be a member of `allowed_inference_geos` unless `allowed_inference_geos` is `"unrestricted"`.
4444
4545 - `"global"`
4646
from line 497
497497
498498 - `default_inference_geo: optional "global" or "us" or null`
499499
500 Default inference geo applied when requests omit the parameter. Must be a member of allowed_inference_geos unless allowed_inference_geos is `"unrestricted"`.
500 Default inference geo applied when requests omit the parameter. Must be a member of `allowed_inference_geos` unless `allowed_inference_geos` is `"unrestricted"`.
501501
502502 - `"global"`
503503
from line 786
786786
787787- `workspace_role: "workspace_admin" or "workspace_developer" or "workspace_restricted_developer" or "workspace_user"`
788788
789 Role of the new Workspace Member. Cannot be "workspace_billing".
789 Role of the new Workspace Member. Cannot be `workspace_billing`.
790790
791791 - `"workspace_admin"`
792792
from line 1359
13591359
13601360- `implicit: boolean or null`
13611361
1362 True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role workspace_user and cannot be removed.
1362 True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.
13631363
13641364- `service_account_id: string`
13651365
from line 1452
14521452
14531453- `implicit: boolean or null`
14541454
1455 True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role workspace_user and cannot be removed.
1455 True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.
14561456
14571457- `service_account_id: string`
14581458
from line 1550
15501550
15511551 - `implicit: boolean or null`
15521552
1553 True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role workspace_user and cannot be removed.
1553 True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.
15541554
15551555 - `service_account_id: string`
15561556
from line 1662
16621662
16631663- `implicit: boolean or null`
16641664
1665 True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role workspace_user and cannot be removed.
1665 True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.
16661666
16671667- `service_account_id: string`
16681668
api/admin/workspaces/service_accounts Changed · +8 / -8 lines
from line 56
5656
5757- `implicit: boolean or null`
5858
59 True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role workspace_user and cannot be removed.
59 True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.
6060
6161- `service_account_id: string`
6262
from line 149
149149
150150- `implicit: boolean or null`
151151
152 True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role workspace_user and cannot be removed.
152 True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.
153153
154154- `service_account_id: string`
155155
from line 247
247247
248248 - `implicit: boolean or null`
249249
250 True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role workspace_user and cannot be removed.
250 True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.
251251
252252 - `service_account_id: string`
253253
from line 359
359359
360360- `implicit: boolean or null`
361361
362 True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role workspace_user and cannot be removed.
362 True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.
363363
364364- `service_account_id: string`
365365
from line 488
488488
489489 - `implicit: boolean or null`
490490
491 True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role workspace_user and cannot be removed.
491 True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.
492492
493493 - `service_account_id: string`
494494
from line 526
526526
527527 - `implicit: boolean or null`
528528
529 True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role workspace_user and cannot be removed.
529 True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.
530530
531531 - `service_account_id: string`
532532
from line 564
564564
565565 - `implicit: boolean or null`
566566
567 True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role workspace_user and cannot be removed.
567 True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.
568568
569569 - `service_account_id: string`
570570
from line 602
602602
603603 - `implicit: boolean or null`
604604
605 True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role workspace_user and cannot be removed.
605 True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.
606606
607607 - `service_account_id: string`
608608
api/claude-platform-on-aws-iam-actions Changed · +27 / -8 lines
### Encryption keys
from line 23
2323
2424## Actions
2525
26The service defines 66 actions. Actions follow the AWS `VerbNoun` convention and use verb discipline so that `Get*` and `List*` wildcards produce a clean read-only boundary.
26The service defines 71 actions. Actions follow the AWS `VerbNoun` convention and use verb discipline so that `Get*` and `List*` wildcards produce a clean read-only boundary.
2727
2828### Inference
2929
from line 217
217217 Workspaces support only archive, not hard delete. A policy that denies `aws-external-anthropic:Delete*` does not block `ArchiveWorkspace`. Deny `ArchiveWorkspace`, `UpdateWorkspace`, and `CreateWorkspace` if you need to prevent any workspace mutation.
218218</Note>
219219
220### Encryption keys
221
222| Action | Routes authorized |
223| ------------- | --------------------------------------------- |
224| `RegisterKey` | `POST /v1/organizations/external_keys` |
225| `GetKey` | `GET /v1/organizations/external_keys/{id}` |
226| `ListKeys` | `GET /v1/organizations/external_keys` |
227| `UpdateKey` | `POST /v1/organizations/external_keys/{id}` |
228| `DisableKey` | `DELETE /v1/organizations/external_keys/{id}` |
229
230<Note>
231 These actions manage your organization's [customer-managed encryption key (CMEK)](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#claude-platform-on-aws) registrations, the record of which AWS KMS key ARNs are registered. They do not create, change, or disable the keys in AWS KMS. `DisableKey` removes a registration and is rejected while any workspace still uses the key. `RegisterKey` and `DisableKey` are not matched by `Create*`, `Update*`, or `Delete*` wildcards; deny `RegisterKey`, `UpdateKey`, and `DisableKey` if you need to prevent any change to key registrations. In these routes, `{id}` is the URL-encoded KMS key ARN. Attaching a registered key to a workspace is a workspace operation, authorized by `CreateWorkspace` or `UpdateWorkspace`; the principal that attaches a key also needs `kms:DescribeKey`, `kms:Encrypt`, and `kms:Decrypt` on that key (see the [prerequisites](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#claude-platform-on-aws)). External key actions are account-scoped: specifying a workspace ARN on them has no effect; use `Resource: "*"`.
232</Note>
233
220234### Compliance
221235
222236| Action | Routes authorized |
from line 263
249263
250264## Route-to-action mapping
251265
252The following table lists every route on Claude Platform on AWS and the IAM action required to call it. Each IAM action also authorizes requests that use the `anthropic-beta` header; beta variants of a route do not require a separate IAM action. CloudTrail classifies each action as either a Data event (high-volume, data-plane operations) or a Management event (control-plane operations). Vault and webhook actions are classified as Management events because they hold secrets (vault credentials and webhook signing secrets) and benefit from default-on audit logging. Workspace and compliance actions are also classified as Management events because they are organization-scoped control-plane operations. All other actions, including inference, batch, model, file, skill, user profile, and the remaining Claude Managed Agents actions, are classified as Data events.
266The following table lists every route on Claude Platform on AWS and the IAM action required to call it. Each IAM action also authorizes requests that use the `anthropic-beta` header; beta variants of a route do not require a separate IAM action. CloudTrail classifies each action as either a Data event (high-volume, data-plane operations) or a Management event (control-plane operations). Vault and webhook actions are classified as Management events because they hold secrets (vault credentials and webhook signing secrets) and benefit from default-on audit logging. Workspace, external key, and compliance actions are also classified as Management events because they are organization-scoped control-plane operations. All other actions, including inference, batch, model, file, skill, user profile, and the remaining Claude Managed Agents actions, are classified as Data events.
253267
254268| Method | Route | IAM action | CloudTrail event type |
255269| -------- | ---------------------------------------------------- | -------------------------- | --------------------- |
from line 300
286300| `GET` | `/v1/organizations/workspaces/{id}` | `GetWorkspace` | Management |
287301| `POST` | `/v1/organizations/workspaces/{id}` | `UpdateWorkspace` | Management |
288302| `POST` | `/v1/organizations/workspaces/{id}/archive` | `ArchiveWorkspace` | Management |
303| `POST` | `/v1/organizations/external_keys` | `RegisterKey` | Management |
304| `GET` | `/v1/organizations/external_keys` | `ListKeys` | Management |
305| `GET` | `/v1/organizations/external_keys/{id}` | `GetKey` | Management |
306| `POST` | `/v1/organizations/external_keys/{id}` | `UpdateKey` | Management |
307| `DELETE` | `/v1/organizations/external_keys/{id}` | `DisableKey` | Management |
289308| `GET` | `/v1/compliance/activities` | `ListComplianceActivities` | Management |
290309| `POST` | `/v1/agents` | `CreateAgent` | Data |
291310| `GET` | `/v1/agents` | `ListAgents` | Data |
from line 376
357376Routes not in this table are not available on Claude Platform on AWS. The gateway denies any route not listed here by default.
358377
359378<Note>
360 Workspace routes are the only Admin API routes available on Claude Platform on AWS. You can also create, update, or archive workspaces in the AWS Console or, with the Admin role, in the Claude Console.
379 Workspace and external key routes are the only Admin API routes available on Claude Platform on AWS. You can also create, update, or archive workspaces in the AWS Console or, with the Admin role, in the Claude Console. Encryption keys can also be registered and attached in the Claude Console.
361380</Note>
362381
363382## Managed policies
from line 391
372391| `AnthropicLimitedAccess` | All `AnthropicInferenceAccess` actions, plus all Claude Managed Agents actions (agents, sessions, environments, vaults, memory stores, webhooks, and self-hosted environment work) |
373392| `AnthropicSelfHostedEnvironmentAccess` | `GetEnvironment`, `ProcessEnvironmentWork`, `GetSession`, `UpdateSession`, `GetSkill`, `CallWithBearerToken` |
374393
375`AnthropicInferenceAccess` is the narrowest managed policy sufficient to run inference. It covers both synchronous and batch inference and, through the `Get*` and `List*` wildcards, grants read access to every API resource in the namespace, including Claude Managed Agents (CMA) resources (agents, sessions, environments, vaults, memory stores, and webhooks). This includes file content download through `GetFile` (see the [Files](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#files) note), skill content download through `GetSkill` (see the [Skills](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#skills) note), and memory contents through `GetMemoryStore`. Vault credential secrets and webhook signing secrets are not exposed: those fields are write-only and are never returned by `GetVault` or `GetWebhook` (see [Authenticate with vaults](https://platform.claude.com/docs/en/managed-agents/vaults)). `AnthropicInferenceAccess` does not grant file creation or deletion, skill management, user profile management, workspace mutation, or any Claude Managed Agents write action (create, update, archive, delete, process, or rotate). To exclude CMA reads, replace `AnthropicInferenceAccess` with a custom policy that enumerates only the specific non-CMA actions you need.
394`AnthropicInferenceAccess` is the narrowest managed policy sufficient to run inference. It covers both synchronous and batch inference and, through the `Get*` and `List*` wildcards, grants read access to every API resource in the namespace, including Claude Managed Agents (CMA) resources (agents, sessions, environments, vaults, memory stores, and webhooks). This includes file content download through `GetFile` (see the [Files](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#files) note), skill content download through `GetSkill` (see the [Skills](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#skills) note), and memory contents through `GetMemoryStore`. Vault credential secrets and webhook signing secrets are not exposed: those fields are write-only and are never returned by `GetVault` or `GetWebhook` (see [Authenticate with vaults](https://platform.claude.com/docs/en/managed-agents/vaults)). `AnthropicInferenceAccess` does not grant file creation or deletion, skill management, user profile management, workspace mutation, encryption key management, or any Claude Managed Agents write action (create, update, archive, delete, process, or rotate). To exclude CMA reads, replace `AnthropicInferenceAccess` with a custom policy that enumerates only the specific non-CMA actions you need.
376395
377396<Note>
378 `AnthropicReadOnlyAccess`, `AnthropicInferenceAccess`, and `AnthropicLimitedAccess` all carry the `Get*` and `List*` wildcards, which grant read access to all content in the workspace: file bytes, skill content, batch results, session conversation history, and memory contents. The `List*` wildcard also grants `ListComplianceActivities`, which reads the organization's compliance [Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed) once the Compliance API is enabled for the organization (see [Compliance](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#compliance)). Vault credential secrets and webhook signing secrets are not exposed; those fields are write-only and are never returned by `GetVault` or `GetWebhook`. If your principal should not read existing content, use a custom policy that enumerates only the actions you need.
397 `AnthropicReadOnlyAccess`, `AnthropicInferenceAccess`, and `AnthropicLimitedAccess` all carry the `Get*` and `List*` wildcards, which grant read access to all content in the workspace: file bytes, skill content, batch results, session conversation history, and memory contents. The wildcards also grant `GetKey` and `ListKeys`, which read the organization's registered encryption key configurations (key ARNs and metadata, never key material). The `List*` wildcard also grants `ListComplianceActivities`, which reads the organization's compliance [Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed) once the Compliance API is enabled for the organization (see [Compliance](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#compliance)). Vault credential secrets and webhook signing secrets are not exposed; those fields are write-only and are never returned by `GetVault` or `GetWebhook`. If your principal should not read existing content, use a custom policy that enumerates only the actions you need.
379398</Note>
380399
381400`AnthropicLimitedAccess` includes all Claude Managed Agents actions in addition to inference actions.
from line 464
445464```
446465
447466<Note>
448 The `aws-external-anthropic:*` wildcard in the first statement includes account-scoped actions (`CreateWorkspace`, `ListWorkspaces`, `ListComplianceActivities`) that the workspace ARN constraint silently filters out. This is consistent with the "isolation" intent (the role cannot create workspaces, enumerate workspaces, or read the compliance Activity Feed), but the policy contains permissions that have no effect. See [Provisioning automation](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#provisioning-automation) for the account-scoped pattern.
467 The `aws-external-anthropic:*` wildcard in the first statement includes account-scoped actions (`CreateWorkspace`, `ListWorkspaces`, `ListComplianceActivities`, and the external key actions) that the workspace ARN constraint silently filters out. This is consistent with the "isolation" intent (the role cannot create workspaces, enumerate workspaces, manage encryption key registrations, or read the compliance Activity Feed; it can still attach an already-registered key to its own workspace through `UpdateWorkspace`), but the policy contains permissions that have no effect. See [Provisioning automation](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#provisioning-automation) for the account-scoped pattern.
449468
450469 `CallWithBearerToken` and `AssumeConsole` are route-less actions that do not bind to a workspace ARN. The second statement grants them on `Resource: "*"` so the role can authenticate with an API key and open the Claude Console. Omit this statement if the role uses SigV4 only and does not need Claude Console access.
451470</Note>
api/overview Changed · +10 / -9 lines
from line 40
4040
4141## Authentication
4242
43For details on both authentication methods and when to use each, see [Authentication](https://platform.claude.com/docs/en/manage-claude/authentication). All requests to the Claude API must include these headers:
43For details on each authentication method and when to use it, see [Authentication](https://platform.claude.com/docs/en/manage-claude/authentication). Requests to the Claude API include these headers:
4444
45| Header | Value | Required |
46| ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------- |
47| `x-api-key` | Your API key from Console | One of `x-api-key` or `Authorization` |
48| `Authorization` | `Bearer <token>`, where `<token>` is a short-lived access token obtained from `POST /v1/oauth/token` through [Workload Identity Federation](https://platform.claude.com/docs/en/manage-claude/workload-identity-federation) | One of `x-api-key` or `Authorization` |
49| `anthropic-version` | API version (for example, `2023-06-01`) | Yes |
50| `content-type` | `application/json` | Yes |
45| Header | Value | Required |
46| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
47| `x-api-key` | Your API key from Console | One of `x-api-key` or `Authorization` |
48| `Authorization` | `Bearer <token>`, where `<token>` is a short-lived access token obtained from `POST /v1/oauth/token` through [Workload Identity Federation](https://platform.claude.com/docs/en/manage-claude/workload-identity-federation) | One of `x-api-key` or `Authorization` |
49| `anthropic-workspace-id` | ID of the [workspace](https://platform.claude.com/docs/en/manage-claude/workspaces) the request runs in (for example, `wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ`). See [Select a workspace](https://platform.claude.com/docs/en/manage-claude/authentication#select-a-workspace). | Required with a multi-workspace API key. Optional for other API keys. Not used with Workload Identity Federation tokens, which select a workspace at token exchange. |
50| `anthropic-version` | API version (for example, `2023-06-01`) | Yes |
51| `content-type` | `application/json` | Yes |
5152
52If you are using the [Client SDKs](https://platform.claude.com/docs/en/api/overview#client-sdks), the SDK will send these headers automatically. For API versioning details, see [API versions](https://platform.claude.com/docs/en/api/versioning).
53If you are using the [Client SDKs](https://platform.claude.com/docs/en/api/overview#client-sdks), the SDK sends the authentication, version, and content-type headers automatically; you pass `anthropic-workspace-id` yourself when your key needs it. For API versioning details, see [API versions](https://platform.claude.com/docs/en/api/versioning).
5354
5455When accessing Claude through a [cloud platform](https://platform.claude.com/docs/en/api/overview#claude-api-vs-cloud-platforms), authentication is integrated with the cloud provider's IAM system. See the platform-specific documentation for supported credential types, required headers, and authentication options.
5556
5657### Getting API keys
5758
58The API is made available through the web [Console](https://platform.claude.com/). You can use [playground](https://platform.claude.com/playground) to try out the API in the browser and then generate API keys in [Account Settings](https://platform.claude.com/settings/keys). You choose each key's [expiration](https://platform.claude.com/docs/en/manage-claude/authentication#key-expiration) when you create it. Use [workspaces](https://platform.claude.com/settings/workspaces) to segment your API keys and [control spend](https://platform.claude.com/docs/en/api/rate-limits) by use case.
59The API is made available through the web [Console](https://platform.claude.com/). You can use [playground](https://platform.claude.com/playground) to try out the API in the browser and then generate API keys in [Account Settings](https://platform.claude.com/settings/keys). You choose each key's type (see [Key types](https://platform.claude.com/docs/en/manage-claude/authentication#key-types)) and its [expiration](https://platform.claude.com/docs/en/manage-claude/authentication#key-expiration) when you create it. Use [workspaces](https://platform.claude.com/settings/workspaces) to separate environments and [control spend](https://platform.claude.com/docs/en/api/rate-limits) by use case.
5960
6061## Client SDKs
6162
build-with-claude/batch-processing Changed · +3 / -3 lines
from line 43
4343* A Message Batch is limited to either 100,000 Message requests or 256 MB in size, whichever is reached first.
4444* The system processes each batch as fast as possible, with most batches completing within 1 hour. You can access batch results when all messages have completed or after 24 hours, whichever comes first. Batches expire if processing does not complete within 24 hours.
4545* Batch results are available for 29 days after creation. After that, you may still view the Batch, but its results will no longer be available for download.
46* Batches are scoped to a [Workspace](https://platform.claude.com/settings/workspaces). You may view all batches (and their results) that were created within the Workspace that your API key belongs to.
46* Batches are scoped to a [Workspace](https://platform.claude.com/settings/workspaces). You may view all batches (and their results) that were created within the Workspace your request runs in.
4747* Rate limits apply to both Batches API HTTP requests and the number of requests within a batch waiting to be processed. See [Message Batches API rate limits](https://platform.claude.com/docs/en/api/rate-limits#message-batches-api). Additionally, processing may be slowed down based on current demand and your request volume. In that case, you may see more requests expiring after 24 hours.
4848* Because of high throughput and concurrent processing, batches may go slightly over your Workspace's configured [spend limit](https://platform.claude.com/settings/billing).
4949* Each batched request must have `max_tokens` of at least `1`. `max_tokens: 0` ([cache pre-warming](https://platform.claude.com/docs/en/build-with-claude/prompt-caching#pre-warming-the-cache)) is not supported inside a batch, because an ephemeral cache entry written during batch processing would likely expire before the follow-up request runs.
from line 1819
18191819
18201820## Batch storage and privacy
18211821
1822* **Workspace isolation**: Batches are isolated within the Workspace they are created in. They can only be accessed by API keys associated with that Workspace, or users with permission to view Workspace batches in the Console.
1822* **Workspace isolation**: Batches are isolated within the Workspace they are created in. They can only be accessed by API requests in that same Workspace, or users with permission to view Workspace batches in the Console.
18231823
18241824* **Result availability**: Batch results are available for 29 days after the batch is created, allowing ample time for retrieval and processing.
18251825
from line 1863
18631863 <Accordion title="How does the Message Batches API handle privacy and data separation?">
18641864 The Message Batches API is designed with strong privacy and data separation measures:
18651865
1866 1. Batches and their results are isolated within the Workspace in which they were created. This means they can only be accessed by API keys from that same Workspace.
1866 1. Batches and their results are isolated within the Workspace in which they were created. This means they can only be accessed by API requests in that same Workspace.
18671867 2. Each request within a batch is processed independently, with no data leakage between requests.
18681868 3. Results are only available for a limited time (29 days), and follow Anthropic's [data retention policy](https://support.claude.com/en/articles/7996866-how-long-do-you-store-personal-data).
18691869 4. Downloading batch results in the Console can be disabled on the organization-level or on a per-workspace basis.
build-with-claude/claude-on-vertex-ai Changed · +4 / -4 lines
from line 45
4545 <Tab title="Java">
4646 <CodeGroup exclude="shell, python, typescript, csharp, go, php, ruby">
4747 ```groovy Gradle
48 implementation("com.anthropic:anthropic-java:2.57.0")
49 implementation("com.anthropic:anthropic-java-vertex:2.57.0")
48 implementation("com.anthropic:anthropic-java:2.58.0")
49 implementation("com.anthropic:anthropic-java-vertex:2.58.0")
5050 ```
5151
5252 ```xml Maven
from line 53
5353 <dependency>
5454 <groupId>com.anthropic</groupId>
5555 <artifactId>anthropic-java</artifactId>
56 <version>2.57.0</version>
56 <version>2.58.0</version>
5757 </dependency>
5858 <dependency>
5959 <groupId>com.anthropic</groupId>
6060 <artifactId>anthropic-java-vertex</artifactId>
61 <version>2.57.0</version>
61 <version>2.58.0</version>
6262 </dependency>
6363 ```
6464
build-with-claude/claude-platform-on-aws Changed · +25 / -24 lines
from line 305
305305
306306 <Tab title="Java">
307307 ```kotlin Gradle
308 implementation("com.anthropic:anthropic-java-aws:2.57.0")
308 implementation("com.anthropic:anthropic-java-aws:2.58.0")
309309 ```
310310
311311 ```xml Maven
from line 312
312312 <dependency>
313313 <groupId>com.anthropic</groupId>
314314 <artifactId>anthropic-java-aws</artifactId>
315 <version>2.57.0</version>
315 <version>2.58.0</version>
316316 </dependency>
317317 ```
318318 </Tab>
from line 542
542542* **Batch processing:** Submit batch requests for high-throughput workloads.
543543* **Prompt caching:** Cache tools, system prompts, and message history to reduce latency and cost. All prompt caching capabilities (5-minute TTL, 1-hour TTL, and automatic caching) are available.
544544* **Files API:** Upload and reference files across requests.
545* **Customer-managed encryption keys (CMEK):** [CMEK](https://platform.claude.com/docs/en/manage-claude/cmek) is available with [AWS KMS](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms) keys only. Google Cloud KMS and Azure Key Vault keys cannot be registered. Create and attach keys in the [Claude Console](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#using-the-claude-console). There is no separate validation step: the key is implicitly validated when you attach it to a workspace (the attach call performs an encrypt/decrypt round), so a key policy problem surfaces at attach time rather than at registration. The `external_keys` Admin API endpoints are not currently available. The key must be in the same AWS region as the workspace it is attached to.
545* **Customer-managed encryption keys (CMEK):** [CMEK](https://platform.claude.com/docs/en/manage-claude/cmek) is available with [AWS KMS](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms) keys only. Google Cloud KMS and Azure Key Vault keys cannot be registered. The key must be a single-region KMS key in the same AWS account and region as the workspace it is attached to, and its key policy must grant access to the `aws-external-anthropic.amazonaws.com` service principal; see [Set up CMEK on Claude Platform on AWS](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#claude-platform-on-aws). Register and attach keys in the [Claude Console](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#using-the-claude-console); the external key endpoints are also available, authorized through [IAM actions](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#encryption-keys). There is no separate validation step: the key is implicitly validated when you attach it to a workspace (the attach call performs an encrypt/decrypt round), so a key policy problem surfaces at attach time rather than at registration.
546546* **Compliance API:** The [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api) is available. Access is authorized through the AWS IAM [`ListComplianceActivities` action](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#compliance).
547547
548548See the [comparison table](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#claude-platform-on-aws-vs-amazon-bedrock) for feature-availability differences from Amazon Bedrock.
from line 563
563563* **HIPAA readiness:** Anthropic's HIPAA-ready program is not available. See [API and data retention](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention).
564564* **Computer use and browser use toolsets:** `computer_toolset_20260801` and `browser_toolset_20260801` are not currently available on Claude Platform on AWS. The beta [computer use](https://platform.claude.com/docs/en/agents-and-tools/tool-use/computer-use-tool#earlier-tool-versions) tool versions remain available.
565565
566- **Admin API:** Workspace endpoints (create, get, list, update, and archive on `/v1/organizations/workspaces`) are available. Other Admin API endpoints (organization members, workspace members, invites, API keys, usage reports, cost reports, rate limit reports, and external keys) are not currently available. Manage [CMEK](https://platform.claude.com/docs/en/manage-claude/cmek) keys in the Claude Console instead. View usage and cost data in the [Claude Console](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#using-the-claude-console) instead. AWS IAM manages organization membership.
566- **Admin API:** Workspace endpoints (create, get, list, update, and archive on `/v1/organizations/workspaces`) and external key endpoints (register, get, list, update, and delete on `/v1/organizations/external_keys`, for [CMEK](https://platform.claude.com/docs/en/manage-claude/cmek); keys are validated when attached to a workspace rather than through a validate endpoint) are available. Other Admin API endpoints (organization members, workspace members, invites, API keys, usage reports, cost reports, and rate limit reports) are not currently available. View usage and cost data in the [Claude Console](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#using-the-claude-console) instead. AWS IAM manages organization membership.
567567- **Workspace member management:** Adding or removing users from individual workspaces is not available. AWS IAM policies on workspace ARNs control access.
568568- **Claude Code workspace and Analytics API:** The Claude Code workspace with automatic rate limits is not available. Claude Code usage appears in the general usage view rather than a dedicated screen.
569569- **OAuth authentication:** Not supported. Use SigV4 or API key authentication.
from line 794
794794
795795The **Through AWS gateway** column indicates whether the page reads and writes data through the AWS gateway (and is therefore governed by [IAM actions](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions)). Pages marked **No** read organization-level metadata directly from Anthropic and bypass IAM action checks.
796796
797| Page | Available | Through AWS gateway | Notes |
798| --------------------- | ------------- | ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
799| **Usage** | Yes | No | View token usage by model, workspace, and dimension. Data can take a few minutes to appear after a request. |
800| **Cost** | Yes | No | View cost breakdowns by model and workspace. AWS Cost Explorer shows the aggregated [Claude Consumption Unit (CCU)](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#billing) line item. |
801| **Rate limits** | Yes | No | View rate limits (read-only). Tier increases go through your Anthropic account representative; see [Rate limits and quotas](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#rate-limits-and-quotas). |
802| **Workspaces** | Yes | Yes (except spend limits) | View per-region workspaces. With the Admin role, you can also create, rename, and archive workspaces, and set per-workspace [spend limits](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#spend-limits). |
803| **Files** | Yes | Yes | View and manage uploaded files. |
804| **Skills** | Yes | Yes | View and manage Agent Skills. |
805| **Batches** | Yes | Yes | View and manage batch processing jobs. |
806| **Agents** | Yes | Yes | View and manage agent definitions. |
807| **Sessions** | Yes | Yes | View agent sessions and event history. |
808| **Environments** | Yes | Yes | View and manage cloud sandbox configurations for sessions. |
809| **Credential vaults** | Yes | Yes | View and manage credential vaults for session authentication. |
810| **Memory stores** | Yes | Yes | View and manage persistent agent memory. |
811| **Webhooks** | Yes | Yes | View and manage webhook endpoints under **Settings → Webhooks**. |
812| **API keys** | No | N/A | Manage API keys in the AWS Console (**Claude Platform on AWS → API keys**). See [API key authentication](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#api-key-authentication). |
813| **Members** | No | N/A | Not applicable. AWS IAM manages access. |
814| **Billing** | Yes (limited) | No | Set an organization monthly spend limit; see [Spend limits](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#spend-limits). AWS Marketplace manages invoicing. View cost breakdowns on the Cost page. |
815| **Claude Code** | No | N/A | View Claude Code usage on the Usage page. |
797| Page | Available | Through AWS gateway | Notes |
798| --------------------- | ------------- | ------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
799| **Usage** | Yes | No | View token usage by model, workspace, and dimension. Data can take a few minutes to appear after a request. |
800| **Cost** | Yes | No | View cost breakdowns by model and workspace. AWS Cost Explorer shows the aggregated [Claude Consumption Unit (CCU)](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#billing) line item. |
801| **Rate limits** | Yes | No | View rate limits (read-only). Tier increases go through your Anthropic account representative; see [Rate limits and quotas](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#rate-limits-and-quotas). |
802| **Workspaces** | Yes | Yes (except spend limits) | View per-region workspaces. With the Admin role, you can also create, rename, and archive workspaces, and set per-workspace [spend limits](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#spend-limits). |
803| **Encryption keys** | Yes | Yes | Under **Settings → Encryption keys**, register AWS KMS keys for [CMEK](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#claude-platform-on-aws) (Admin role). Attach a registered key to a workspace from that workspace's **Security** settings. |
804| **Files** | Yes | Yes | View and manage uploaded files. |
805| **Skills** | Yes | Yes | View and manage Agent Skills. |
806| **Batches** | Yes | Yes | View and manage batch processing jobs. |
807| **Agents** | Yes | Yes | View and manage agent definitions. |
808| **Sessions** | Yes | Yes | View agent sessions and event history. |
809| **Environments** | Yes | Yes | View and manage cloud sandbox configurations for sessions. |
810| **Credential vaults** | Yes | Yes | View and manage credential vaults for session authentication. |
811| **Memory stores** | Yes | Yes | View and manage persistent agent memory. |
812| **Webhooks** | Yes | Yes | View and manage webhook endpoints under **Settings → Webhooks**. |
813| **API keys** | No | N/A | Manage API keys in the AWS Console (**Claude Platform on AWS → API keys**). See [API key authentication](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#api-key-authentication). |
814| **Members** | No | N/A | Not applicable. AWS IAM manages access. |
815| **Billing** | Yes (limited) | No | Set an organization monthly spend limit; see [Spend limits](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#spend-limits). AWS Marketplace manages invoicing. View cost breakdowns on the Cost page. |
816| **Claude Code** | No | N/A | View Claude Code usage on the Usage page. |
816817
817818### Switching organizations
818819
from line 854
853854
854855## Monitoring and logging
855856
856AWS CloudTrail can capture all requests to Claude Platform on AWS. Workspace, compliance, vault, and webhook operations are logged as Management events by default. Inference, batch, file, skill, model, user profile, and Claude Managed Agents operations (other than vaults and webhooks) are classified as Data events and require explicit data event logging configuration, which incurs additional CloudTrail charges. See the [IAM actions reference](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#route-to-action-mapping) for the full event type classification and the [AWS CloudTrail documentation](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/) for configuration details.
857AWS CloudTrail can capture all requests to Claude Platform on AWS. Workspace, external key, compliance, vault, and webhook operations are logged as Management events by default. Inference, batch, file, skill, model, user profile, and Claude Managed Agents operations (other than vaults and webhooks) are classified as Data events and require explicit data event logging configuration, which incurs additional CloudTrail charges. See the [IAM actions reference](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#route-to-action-mapping) for the full event type classification and the [AWS CloudTrail documentation](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/) for configuration details.
857858
858859### Request IDs
859860
cli-sdks-libraries/cli/authentication Changed · +11 / -1 lines
from line 73
7373
7474To override the key for a single invocation, pass `--api-key`. To point at a different API host, set `ANTHROPIC_BASE_URL` or pass `--base-url`.
7575
76If you are using an API key scoped to multiple workspaces, such as a [personal or service account key](https://platform.claude.com/docs/en/manage-claude/authentication#key-types), you must [specify the workspace](https://platform.claude.com/docs/en/manage-claude/authentication#select-a-workspace) to run your command in. Do this by setting an `ANTHROPIC_WORKSPACE_ID` environment variable, which the CLI reads automatically, or by using the [`--workspace-id` flag](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/using#global-flags). The value must be a `wrkspc_...` ID; the literal `default` that the SDKs accept in `ANTHROPIC_WORKSPACE_ID` for [federated token exchange](https://platform.claude.com/docs/en/manage-claude/wif-reference#environment-variables) isn't valid here.
77
78```bash CLI
79ant messages create \
80 --workspace-id wrkspc_01... \
81 --model claude-opus-5 \
82 --max-tokens 1024 \
83 --message '{role: user, content: "Hello, Claude"}'
84```
85
7686## Check authentication status
7787
7888`ant auth status` prints the credential source the CLI selected (API key environment variable, OAuth login, federation, or profile), the active profile, the workspace the active token is bound to, and the configuration directory paths. Use it to diagnose why a workload picked the wrong credential or workspace.
from line 127
117127Run [`ant auth status`](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/authentication#check-authentication-status) to confirm which profile and workspace are active.
118128
119129<Note>
120 Profiles are only consulted when no API key is set. If `ANTHROPIC_API_KEY` is present in your environment, it overrides every profile and these commands all use whatever workspace that key is scoped to. Unset it before switching profiles.
130 Profiles are only consulted when no API key is set. If `ANTHROPIC_API_KEY` is present in your environment, it overrides every profile and these commands all use that key's workspace (or, for a multi-workspace key, the workspace set with `ANTHROPIC_WORKSPACE_ID` or `--workspace-id`). Unset it before switching profiles.
121131</Note>
122132
123133## Manage profiles
cli-sdks-libraries/cli/using Changed · +10 / -9 lines
from line 27
2727
2828### Global flags
2929
30| Flag | Description |
31| ------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
32| `--profile` | Named profile to use for this invocation (equivalent to setting `ANTHROPIC_PROFILE`). See [Switch between workspaces](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/authentication#switch-between-workspaces). |
33| `--format` | Output format: `auto`, `json`, `jsonl`, `yaml`, `pretty`, `raw`, `explore` |
34| `--transform` | Filter or reshape the response with a [GJSON path](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/using#transform-output-with-gjson) |
35| `-r`, `--raw-output` | Print string results without surrounding quotes, like `jq -r` |
36| `--base-url` | Override the API base URL |
37| `--debug` | Print full HTTP request and response to stderr |
38| `--format-error`, `--transform-error` | Same as `--format` and `--transform` but applied to [error responses](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/scripting#inspect-errors) |
30| Flag | Description |
31| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
32| `--profile` | Named profile to use for this invocation (equivalent to setting `ANTHROPIC_PROFILE`). See [Switch between workspaces](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/authentication#switch-between-workspaces). |
33| `--format` | Output format: `auto`, `json`, `jsonl`, `yaml`, `pretty`, `raw`, `explore` |
34| `--transform` | Filter or reshape the response with a [GJSON path](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/using#transform-output-with-gjson) |
35| `-r`, `--raw-output` | Print string results without surrounding quotes, like `jq -r` |
36| `--base-url` | Override the API base URL |
37| `--workspace-id` | Optional. Workspace ID (`wrkspc_...`) to send as the `anthropic-workspace-id` header, for API keys with access to multiple workspaces (equivalent to setting `ANTHROPIC_WORKSPACE_ID`). See [Select a workspace](https://platform.claude.com/docs/en/manage-claude/authentication#select-a-workspace). [Admin API](https://platform.claude.com/docs/en/manage-claude/admin-api) commands take their own `--workspace-id`, which names the workspace they manage instead. |
38| `--debug` | Print full HTTP request and response to stderr |
39| `--format-error`, `--transform-error` | Same as `--format` and `--transform` but applied to [error responses](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/scripting#inspect-errors) |
3940
4041## Output formats
4142
cli-sdks-libraries/sdks/java Changed · +3 / -3 lines
from line 15
1515<Tabs>
1616 <Tab title="Gradle">
1717 ```kotlin
18 implementation("com.anthropic:anthropic-java:2.57.0")
18 implementation("com.anthropic:anthropic-java:2.58.0")
1919 ```
2020 </Tab>
2121
from line 24
2424 <dependency>
2525 <groupId>com.anthropic</groupId>
2626 <artifactId>anthropic-java</artifactId>
27 <version>2.57.0</version>
27 <version>2.58.0</version>
2828 </dependency>
2929 ```
3030 </Tab>
from line 99
9999 .build();
100100```
101101
102For authentication options including Workload Identity Federation, see [Authentication](https://platform.claude.com/docs/en/manage-claude/authentication).
102For authentication options including Workload Identity Federation, see [Authentication](https://platform.claude.com/docs/en/manage-claude/authentication). If your API key is a [personal or service account key](https://platform.claude.com/docs/en/manage-claude/authentication#key-types) with access to multiple workspaces, set the workspace ID in the `anthropic-workspace-id` request header; [Select a workspace](https://platform.claude.com/docs/en/manage-claude/authentication#select-a-workspace) shows the per-request option for this SDK.
103103
104104### Configuration options
105105
get-api-key Changed · +12 / -4 lines
## Choose a key type
from line 6
66
77API keys for the Claude API (also called Anthropic API keys) live in the Claude Console. To view your existing keys or create a new one, go to [Settings → API keys](https://platform.claude.com/settings/keys).
88
9## Choose a key type
10
11When you create a key, you choose its type, which determines what the key can do, where it works, and when it stops working. A **personal key** acts as you, and stops working if you leave an organization. A **service account key** represents a [service account](https://platform.claude.com/docs/en/manage-claude/workload-identity-federation#service-accounts) which can be used by workloads such as CI pipelines, production services, or agents. Use a personal key for your own development, and a service account key for anything shared.
12
13You can also create a **workspace key**, a legacy key without an owner: it belongs to the workspace you create it in and keeps working after its creator leaves. It is preferable to use a personal or service account key, as these stop working automatically when their associated account is removed from the organization.
14
915## Create an API key
1016
1117<Steps>
from line 24
1824 </Step>
1925
2026 <Step title="Create a key">
21 Click **Create key**, then give the key a name. You can also choose a [workspace](https://platform.claude.com/settings/workspaces) to scope the key to, and an expiration.
27 Click **Create key**, name the key, choose an [expiration](https://platform.claude.com/docs/en/manage-claude/authentication#key-expiration), and set **Linked account** to yourself or a service account. You can also choose a [workspace](https://platform.claude.com/settings/workspaces) to scope the key to.
2228 </Step>
2329
2430 <Step title="Copy and store the key">
from line 32
2632 </Step>
2733</Steps>
2834
29If the **Create key** button is disabled, you may not have permission to create keys in that workspace. Ask an organization admin to grant you access or to create a key for you.
35If the **Create key** button on the API keys page is disabled, your role may not allow you to create keys there. Ask an organization admin to change your role, or to create a service account key for your workload.
3036
3137## Use your API key
3238
from line 42
3642export ANTHROPIC_API_KEY="sk-ant-api03-..."
3743```
3844
39The [client SDKs](https://platform.claude.com/docs/en/cli-sdks-libraries/overview) read `ANTHROPIC_API_KEY` automatically. Direct HTTP requests send the key in the `x-api-key` header. To make your first request, follow the [Quickstart](https://platform.claude.com/docs/en/get-started), and see [Authentication](https://platform.claude.com/docs/en/manage-claude/authentication) for the full picture, including short-lived credentials with Workload Identity Federation.
45The [client SDKs](https://platform.claude.com/docs/en/cli-sdks-libraries/overview) read `ANTHROPIC_API_KEY` automatically. Direct HTTP requests send the key in the `x-api-key` header. If your API key works on multiple workspaces, you must also send the `anthropic-workspace-id` header on each Claude API request, as shown in [Select a workspace](https://platform.claude.com/docs/en/manage-claude/authentication#select-a-workspace). For the Admin API, see [API keys and the Admin API](https://platform.claude.com/docs/en/get-api-key#api-keys-and-the-admin-api).
4046
47To make your first request, follow the [Quickstart](https://platform.claude.com/docs/en/get-started), and see [Authentication](https://platform.claude.com/docs/en/manage-claude/authentication) for the full picture, including short-lived credentials with Workload Identity Federation.
48
4149## API keys and the Admin API
4250
43The [Admin API](https://platform.claude.com/docs/en/api/admin) includes endpoints for managing your organization's API keys programmatically, such as [Retrieve API Key](https://platform.claude.com/docs/en/api/admin/api_keys/retrieve) and [List API Keys](https://platform.claude.com/docs/en/api/admin/api_keys/list). These endpoints are for organization admins automating key management. They require a separate [Admin API key](https://platform.claude.com/docs/en/manage-claude/admin-api-keys), and they never return a key's secret value, only a partially redacted hint.
51The [Admin API](https://platform.claude.com/docs/en/api/admin) includes endpoints for managing your organization's API keys programmatically, such as [Retrieve API Key](https://platform.claude.com/docs/en/api/admin/api_keys/retrieve) and [List API Keys](https://platform.claude.com/docs/en/api/admin/api_keys/list). These endpoints are for organization admins automating key management. They accept an [Admin API key](https://platform.claude.com/docs/en/manage-claude/admin-api-keys), an OAuth token with the `org:admin` scope, or a personal or service account key that isn't scoped to a specific workspace; workspace keys don't work there. They never return a key's secret value, only a partially redacted hint.
4452
4553<Note>
4654 The Admin API can't recover a lost key or give you a key to call the Claude API with. To get a usable API key, create one in [Settings → API keys](https://platform.claude.com/settings/keys) in the Claude Console.
manage-claude/admin-api Changed · +12 / -9 lines
from line 1
11---
22title: Admin API
33url: https://platform.claude.com/docs/en/manage-claude/admin-api
4description: Manage organization members, workspaces, invites, and API keys programmatically with the Admin API, using an Admin API key or an `org:admin` OAuth token.
4description: Manage organization members, workspaces, invites, and API keys programmatically with the Admin API, using an Admin API key, an `org:admin` OAuth token, or a personal or service account key.
55---
66
77<Tip>
from line 13
1313<Check>
1414 **The Admin API requires special access**
1515
16 The Admin API accepts two credentials:
16 The Admin API accepts three credentials:
1717
1818 * An **Admin API key** (starting with `sk-ant-admin...`) sent in the `x-api-key` header. Only organization members with the admin role can provision one. See [Create an Admin API key](https://platform.claude.com/docs/en/manage-claude/admin-api-keys).
1919 * An **OAuth bearer token** with the `org:admin` scope sent in the `authorization: Bearer` header. Only members with the admin, owner, or primary owner role can obtain one. See [Obtain an OAuth bearer token](https://platform.claude.com/docs/en/manage-claude/admin-api#oauth-bearer-token).
20 * A **personal key** or **service account key** that isn't scoped to a specific workspace, sent in the `x-api-key` header. The key has the same permissions as the linked account. See [Key types](https://platform.claude.com/docs/en/manage-claude/authentication#key-types).
2021</Check>
2122
2223<Note>
from line 25
2425</Note>
2526
2627<Note>
27 **Claude Platform on AWS:** Only the workspace endpoints (create, get, list, update, and archive on `/v1/organizations/workspaces`) are available on Claude Platform on AWS. Organization members, workspace members, invites, API keys, and the usage, cost, and rate limit reports aren't. See [Claude Platform on AWS](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws).
28 **Claude Platform on AWS:** Only the workspace endpoints (create, get, list, update, and archive on `/v1/organizations/workspaces`) and the external key endpoints (register, get, list, update, and delete on `/v1/organizations/external_keys`, for [CMEK](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#claude-platform-on-aws); there is no validate endpoint, because keys are validated when attached to a workspace) are available on Claude Platform on AWS. Organization members, workspace members, invites, API keys, and the usage, cost, and rate limit reports aren't. See [Claude Platform on AWS](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws).
2829</Note>
2930
3031## Authentication
3132
32Authenticate with either credential. An Admin API key covers most endpoints. The service-account, federation-issuer, and federation-rule endpoints accept only an `org:admin` OAuth token. The following examples call the [organization info endpoint](https://platform.claude.com/docs/en/manage-claude/admin-api#accessing-organization-info) both ways.
33Authenticate with any of the three credentials. An Admin API key covers most endpoints. The service-account, federation-issuer, and federation-rule endpoints accept only an `org:admin` OAuth token. Send a personal key or service account key in the `x-api-key` header, as you would an Admin API key. The following examples call the [organization info endpoint](https://platform.claude.com/docs/en/manage-claude/admin-api#accessing-organization-info) with an OAuth token and with an Admin API key.
3334
3435The Python, TypeScript, C#, Go, Java, PHP, and Ruby SDKs expose the Admin API under `client.beta.organization`, and the `ant` CLI under `ant beta:organization`. The examples on this page use the default client, which reads an Admin API key from `ANTHROPIC_API_KEY` or an OAuth bearer token from `ANTHROPIC_AUTH_TOKEN`. SDK list methods in Python, TypeScript, C#, Go, and Java return an iterator that fetches more pages on demand, so `limit` sets the page size, not the total. The PHP, Ruby, and curl examples return one page. In the CLI, `--limit` caps the results on the member, invite, workspace, workspace-member, and API-key lists. For each endpoint's parameters and responses, see the [Admin API reference](https://platform.claude.com/docs/en/api/admin).
3536
from line 215
214215
215216## How the Admin API works
216217
217Authenticate with either credential from [Authentication](https://platform.claude.com/docs/en/manage-claude/admin-api#authentication), then manage the following resources:
218Authenticate with any credential from [Authentication](https://platform.claude.com/docs/en/manage-claude/admin-api#authentication), then manage the following resources:
218219
219220* Organization members and their roles
220221* Organization invites
from line 1350
13491350
13501351### API keys
13511352
1352Monitor and manage [API keys](https://platform.claude.com/docs/en/api/admin/api_keys/list). Each key in the response includes its `expires_at` timestamp (`null` for keys without an [expiration](https://platform.claude.com/docs/en/manage-claude/authentication#key-expiration)):
1353Monitor and manage [API keys](https://platform.claude.com/docs/en/api/admin/api_keys/list). Each key in the response includes its `expires_at` timestamp (`null` for keys without an [expiration](https://platform.claude.com/docs/en/manage-claude/authentication#key-expiration)) and `principal`, the identity it acts as (see [Key types](https://platform.claude.com/docs/en/manage-claude/authentication#key-types)). For a personal key, `principal` is `{"type": "user_actor", "user_id": "user_..."}`; for a service account key, `{"type": "service_account_actor", "service_account_id": "svac_..."}`; and for a workspace key, `null`. Each key also has a `scope` object: `{"type": "workspace", "workspace_id": "wrkspc_..."}` for a key bound to one workspace, or `{"type": "organization"}` for a key that can work across any workspace the account has access to. The top-level `workspace_id` field is deprecated and is `null` both for keys bound to the Default Workspace and for keys without a workspace scope; use `scope` to tell them apart. Filtering the list by `workspace_id` with the Default Workspace's ID returns only keys bound to the Default Workspace; keys without a workspace scope aren't returned under any `workspace_id` filter.
13531354
13541355List the active API keys in a workspace:
13551356
from line 1623
16221623
16231624### Service accounts
16241625
1625Create and manage service accounts (`svac_...`), the non-human identities that [Workload Identity Federation](https://platform.claude.com/docs/en/manage-claude/workload-identity-federation) tokens act as. These endpoints, like the federation-issuer and federation-rule endpoints, require an `org:admin` OAuth token. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api#service-accounts).
1626Create and manage service accounts (`svac_...`), the non-human identities that [service account keys](https://platform.claude.com/docs/en/manage-claude/authentication#key-types) and [Workload Identity Federation](https://platform.claude.com/docs/en/manage-claude/workload-identity-federation) tokens act as. These endpoints, like the federation-issuer and federation-rule endpoints, require an `org:admin` OAuth token. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api#service-accounts).
16261627
16271628### Federation issuers
16281629
from line 1753
17521753
17531754<AccordionGroup>
17541755 <Accordion title="What permissions are needed to use the Admin API?">
1755 The Admin API accepts either an Admin API key (starting with `sk-ant-admin`) or an OAuth bearer token with the `org:admin` scope. Only organization members with the admin role can provision Admin API keys, and only members with the admin, owner, or primary owner role can obtain `org:admin` tokens. See [Authentication](https://platform.claude.com/docs/en/manage-claude/admin-api#authentication).
1756 The Admin API accepts an Admin API key (starting with `sk-ant-admin`), an OAuth bearer token with the `org:admin` scope, or a personal key or service account key that isn't scoped to a specific workspace. Only organization members with the admin role can provision Admin API keys, and only members with the admin, owner, or primary owner role can obtain `org:admin` tokens. A personal key or service account key has the same permissions as the linked account. See [Authentication](https://platform.claude.com/docs/en/manage-claude/admin-api#authentication).
17561757 </Accordion>
17571758
17581759 <Accordion title="Can I create new API keys through the Admin API?">
from line 1761
17601761 </Accordion>
17611762
17621763 <Accordion title="What happens to API keys when removing a user?">
1763 They're unaffected. API keys belong to the organization, not to individual users.
1764 Behavior depends on the [key type](https://platform.claude.com/docs/en/manage-claude/authentication#key-types).
1765
1766 Personal keys stop working when their user is removed from the organization. Service account keys stop working if their service account is archived, but continue to work even if the user that created them is removed. Workspace API keys continue to work. In the [Claude Code workspace](https://platform.claude.com/docs/en/manage-claude/workspaces#claude-code-workspace), each key is bound to the member who created it and stops working when that member is removed.
17641767 </Accordion>
17651768
17661769 <Accordion title="Can organization admins be removed through the API?">
manage-claude/authentication Changed · +245 / -8 lines
### Key types ### Create and use a key ### Select a workspace ### Replacing workspace API keys
from line 8
88
99| Method | Credential | Best for |
1010| ----------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
11| [API key](https://platform.claude.com/docs/en/manage-claude/authentication#api-keys) | Static `sk-ant-api...` secret in the `x-api-key` header | Local development, prototyping, scripts, and single-tenant servers where you control secret storage |
11| [API key](https://platform.claude.com/docs/en/manage-claude/authentication#api-keys) | Static `sk-ant-api...` secret in the `x-api-key` header | Local development, prototyping, scripts, and servers where you control secret storage |
1212| [Workload Identity Federation](https://platform.claude.com/docs/en/manage-claude/authentication#workload-identity-federation) | Short-lived bearer token exchanged from your identity provider's identity token | Production workloads on cloud platforms (AWS, Google Cloud, Azure), CI/CD pipelines, and Kubernetes, where you want to eliminate static secrets |
1313| [App Attest](https://platform.claude.com/docs/en/manage-claude/authentication#app-attest) | Short-lived access token issued to a genuine, attested installation of your registered iOS or macOS app | iOS and macOS apps distributed to end users, where the app calls the Claude API directly with no back end or proxy |
1414
15API keys and Workload Identity Federation grant the same access to Claude API endpoints. Choose API keys to get started quickly, and move to Workload Identity Federation when your workload already has a platform-issued identity you can federate. Use App Attest for iOS and macOS apps you distribute to end users.
15API keys and Workload Identity Federation grant the same access to Claude API endpoints. Choose API keys to get started quickly: a personal key for your own development, or a service account key for anything shared. Move to Workload Identity Federation when your workload already has a platform-issued identity you can federate. Use App Attest for iOS and macOS apps you distribute to end users.
1616
1717## API keys
1818
19API keys are static secrets that you generate in the Claude Console and pass on every request.
19API keys are static secrets that you generate in the Claude Console and send on every request in the `x-api-key` header.
2020
21* **Create a key:** Go to [Settings → API keys](https://platform.claude.com/settings/keys) in the Claude Console. You choose an [expiration](https://platform.claude.com/docs/en/manage-claude/authentication#key-expiration) as part of creation. Use [workspaces](https://platform.claude.com/settings/workspaces) to scope keys by project or environment.
22* **Send the key:** Set the `x-api-key` header on direct HTTP requests, or set the `ANTHROPIC_API_KEY` environment variable and the [client SDKs](https://platform.claude.com/docs/en/cli-sdks-libraries/overview) pick it up automatically.
21### Key types
2322
23When you create a key, you choose its type, which determines what the key can do, where it works, and when it stops working:
24
25| Key type | Acts as | Works in | Stops working when |
26| -------------------------- | -------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
27| **Personal key** | You, the user, with your roles and permissions | Either a single workspace or the workspaces where your role allows API use, chosen when the key is created | You lose access to the organization or, for a single-workspace key, to that workspace. Personal keys are archived when you are removed from the organization. If you are re-invited, create new keys; archived keys are not restored |
28| **Service account key** | A [service account](https://platform.claude.com/docs/en/manage-claude/workload-identity-federation#service-accounts) | Either a single workspace or anything the service account has access to, chosen when the key is created. A service account has access to the Default Workspace and to workspaces it has been added to | The service account is archived or, for a single-workspace key, is removed from that workspace |
29| **Workspace key** (legacy) | No one: it belongs to the workspace it was created in | That workspace | It expires, is disabled or deleted, or its workspace is archived, regardless of whether its creator leaves the organization |
30
31Personal keys and service account keys are identity-backed: each belongs to a user or service account your organization already manages, and every request acts as that identity. When that identity is removed from the organization, the key stops working. This means that keys won't accidentally outlive the people or workloads that own them. Prefer them over workspace keys for new integrations.
32
33Use a personal key for your own development and scripts. A shared personal key acts as one person and breaks when they leave. For shared or automated workloads (CI, production services), have an organization admin create a service account so the workload has its own identity.
34
35Workspace API keys still work but should be considered legacy; identity-backed keys or [Workload Identity Federation](https://platform.claude.com/docs/en/manage-claude/workload-identity-federation) are preferred. To migrate, see [Replacing workspace API keys](https://platform.claude.com/docs/en/manage-claude/authentication#replacing-workspace-api-keys).
36
37### Create and use a key
38
39* **Create a key:** Go to [Settings → API keys](https://platform.claude.com/settings/keys) in the Claude Console and click **Create key**. Name the key and choose an [expiration](https://platform.claude.com/docs/en/manage-claude/authentication#key-expiration). Set **Linked account** to yourself for a personal key, or to a service account for a key shared across multiple users. You can also scope the key to a specific workspace, which lets you skip setting a workspace ID manually in future requests.
40* **Use the key:** Set the `x-api-key` header on direct HTTP requests, or set the `ANTHROPIC_API_KEY` environment variable and the [client SDKs](https://platform.claude.com/docs/en/cli-sdks-libraries/overview) pick it up automatically.
41
2442```http
2543POST /v1/messages
2644x-api-key: YOUR_API_KEY
from line 46
2846content-type: application/json
2947```
3048
31Store API keys in a secrets manager, rotate them periodically, and revoke any key you suspect has leaked. You can also set an [expiration](https://platform.claude.com/docs/en/manage-claude/authentication#key-expiration) when you create a key to limit how long a leaked credential stays usable.
49Store API keys in a secrets manager, rotate them periodically, and disable or delete any key you suspect has leaked. On the [API keys page](https://platform.claude.com/settings/keys), **Disable** is reversible (the Admin API reports the key's `status` as `"inactive"`, and **Re-enable** returns it to `"active"`), while **Delete** is permanent: the key is archived and still appears in [List API Keys](https://platform.claude.com/docs/en/api/admin/api_keys/list) with `status: "archived"`. Expired keys can only be deleted. You can also set an [expiration](https://platform.claude.com/docs/en/manage-claude/authentication#key-expiration) when you create a key to limit how long a leaked credential stays usable.
3250
3351<CodeGroup>
3452 ```bash cURL
from line 119
101119 ```
102120</CodeGroup>
103121
122### Select a workspace
123
124API keys that are created for a specific workspace only work in that workspace, and API requests using these keys can omit the workspace ID.
125
126If your API key isn't scoped to a workspace, you must specify the workspace ID in the `anthropic-workspace-id` header for each request. See the following example for how to set this header in a request or in SDKs.
127
128The [Admin API](https://platform.claude.com/docs/en/manage-claude/admin-api) accepts a personal key or service account key only if the key isn't scoped to a specific workspace.
129
130You can find a workspace's ID in the **ID** column of [Settings → Workspaces](https://platform.claude.com/settings/workspaces) in the Claude Console, or by calling the [List Workspaces](https://platform.claude.com/docs/en/api/admin/workspaces/list) endpoint. Neither lists the Default Workspace's ID: read it from the `anthropic-workspace-id` [response header](https://platform.claude.com/docs/en/manage-claude/workspaces#identify-the-workspace-behind-an-api-response) of any request that runs there (for example, one made with a workspace key from the Default Workspace), or from `scope.workspace_id` on such a key in [List API Keys](https://platform.claude.com/docs/en/api/admin/api_keys/list).
131
132<CodeGroup>
133 ```bash cURL
134 # Required on every request for a multi-workspace key.
135 # Omit the anthropic-workspace-id header for a single-workspace key.
136 curl https://api.anthropic.com/v1/messages \
137 -H "x-api-key: $ANTHROPIC_API_KEY" \
138 -H "anthropic-version: 2023-06-01" \
139 -H "anthropic-workspace-id: wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" \
140 -H "content-type: application/json" \
141 -d '{
142 "model": "claude-opus-5",
143 "max_tokens": 1024,
144 "messages": [{"role": "user", "content": "Hello, Claude"}]
145 }'
146 ```
147
148 ```bash CLI
149 # Required on every command for a multi-workspace key.
150 # Omit --workspace-id for a single-workspace key.
151 ant messages create \
152 --workspace-id wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ \
153 --model claude-opus-5 \
154 --max-tokens 1024 \
155 --message '{role: user, content: "Hello, Claude"}'
156 ```
157
158 ```python Python
159 client = Anthropic() # reads ANTHROPIC_API_KEY
160
161 # Required on every request for a multi-workspace key.
162 # Omit extra_headers for a single-workspace key.
163 message = client.messages.create(
164 model="claude-opus-5",
165 max_tokens=1024,
166 messages=[{"role": "user", "content": "Hello, Claude"}],
167 extra_headers={"anthropic-workspace-id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"},
168 )
169 print(message.content)
170
171 # Or set it once for every request from this client:
172 workspace_client = Anthropic(
173 default_headers={"anthropic-workspace-id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"},
174 )
175 ```
176
177 ```typescript TypeScript
178 const client = new Anthropic(); // reads ANTHROPIC_API_KEY
179
180 // Required on every request for a multi-workspace key.
181 // Omit the second argument for a single-workspace key.
182 const message = await client.messages.create(
183 {
184 model: "claude-opus-5",
185 max_tokens: 1024,
186 messages: [{ role: "user", content: "Hello, Claude" }]
187 },
188 { headers: { "anthropic-workspace-id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" } }
189 );
190 console.log(message.content);
191
192 // Or set it once for every request from this client:
193 const workspaceClient = new Anthropic({
194 defaultHeaders: { "anthropic-workspace-id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" }
195 });
196 ```
197
198 ```csharp C#
199 AnthropicClient client = new(); // reads ANTHROPIC_API_KEY
200
201 MessageCreateParams parameters = new()
202 {
203 Model = Model.ClaudeOpus5,
204 MaxTokens = 1024,
205 Messages = [new() { Role = Role.User, Content = "Hello, Claude" }],
206 };
207
208 // Required on every request for a multi-workspace key.
209 // Call client.Messages.Create(parameters) directly for a single-workspace key.
210 var message = await client
211 .WithOptions(options =>
212 options with
213 {
214 ExtraHeaders = new Dictionary<string, string>
215 {
216 ["anthropic-workspace-id"] = "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
217 },
218 }
219 )
220 .Messages.Create(parameters);
221 Console.WriteLine(message);
222
223 // Or set it once for every request from this client:
224 AnthropicClient workspaceClient = new(new ClientOptions
225 {
226 ExtraHeaders = new Dictionary<string, string>
227 {
228 ["anthropic-workspace-id"] = "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
229 },
230 });
231 ```
232
233 ```go Go
234 client := anthropic.NewClient() // reads ANTHROPIC_API_KEY
235
236 // Required on every request for a multi-workspace key.
237 // Omit the option for a single-workspace key.
238 message, err := client.Messages.New(context.TODO(), anthropic.MessageNewParams{
239 Model: anthropic.ModelClaudeOpus5,
240 MaxTokens: 1024,
241 Messages: []anthropic.MessageParam{
242 anthropic.NewUserMessage(anthropic.NewTextBlock("Hello, Claude")),
243 },
244 }, option.WithHeader("anthropic-workspace-id", "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"))
245 if err != nil {
246 log.Fatal(err)
247 }
248 fmt.Println(message.Content)
249
250 // Or set it once for every request from this client:
251 workspaceClient := anthropic.NewClient(
252 option.WithHeader("anthropic-workspace-id", "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"),
253 )
254 ```
255
256 ```java Java
257 AnthropicClient client = AnthropicOkHttpClient.fromEnv(); // reads ANTHROPIC_API_KEY
258
259 // Required on every request for a multi-workspace key.
260 // Omit putAdditionalHeader for a single-workspace key.
261 Message message = client.messages().create(MessageCreateParams.builder()
262 .model(Model.CLAUDE_OPUS_5)
263 .maxTokens(1024)
264 .addUserMessage("Hello, Claude")
265 .putAdditionalHeader("anthropic-workspace-id", "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ")
266 .build());
267
268 IO.println(message.content());
269
270 // Or set it once for every request from this client:
271 AnthropicClient workspaceClient = AnthropicOkHttpClient.builder()
272 .fromEnv()
273 .putHeader("anthropic-workspace-id", "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ")
274 .build();
275 ```
276
277 ```php PHP
278 $client = new Client(); // reads ANTHROPIC_API_KEY
279
280 // Required on every request for a multi-workspace key.
281 // Omit requestOptions for a single-workspace key.
282 $message = $client->messages->create(
283 model: Model::CLAUDE_OPUS_5,
284 maxTokens: 1024,
285 messages: [['role' => 'user', 'content' => 'Hello, Claude']],
286 requestOptions: [
287 'extraHeaders' => ['anthropic-workspace-id' => 'wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ'],
288 ],
289 );
290
291 echo json_encode($message->content), PHP_EOL;
292 ```
293
294 ```ruby Ruby
295 client = Anthropic::Client.new # reads ANTHROPIC_API_KEY
296
297 # Required on every request for a multi-workspace key.
298 # Omit request_options for a single-workspace key.
299 message = client.messages.create(
300 model: Anthropic::Model::CLAUDE_OPUS_5,
301 max_tokens: 1024,
302 messages: [{role: "user", content: "Hello, Claude"}],
303 request_options: {extra_headers: {"anthropic-workspace-id" => "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"}}
304 )
305
306 puts message.content
307 ```
308</CodeGroup>
309
310If a request made with a key that isn't scoped to a workspace omits the header, the API returns a 400 `invalid_request_error`:
311
312```json JSON
313{
314 "type": "error",
315 "error": {
316 "type": "invalid_request_error",
317 "message": "anthropic-workspace-id is required when authenticating with an identity-linked API key; send the id of the workspace this request acts in."
318 },
319 "request_id": "req_011CSHoEeqs5C35K2UUqR7Fy"
320}
321```
322
323A header value that isn't a valid workspace ID returns a 400 `invalid_request_error` with the message `anthropic-workspace-id header must be a valid workspace ID.` If the workspace doesn't exist, or the key's user or service account doesn't have access to it, the API returns a 404 `not_found_error` with the message ``Workspace `<id>` not found.``, the same response as for any unknown workspace.
324
325Workload Identity Federation selects a workspace at token exchange instead; see the [WIF reference](https://platform.claude.com/docs/en/manage-claude/wif-reference) for details.
326
104327### Key expiration
105328
106329When you create an API key from the [API keys page](https://platform.claude.com/settings/keys) in the Claude Console, you choose an expiration: a preset (3 hours, 1 day, 7 days, or 30 days), a custom duration, or **Never** for keys you store in a secrets manager and rotate yourself. If your organization has a maximum expiration policy, the Console limits presets and custom durations to the policy maximum, and **Never** is unavailable. Existing keys keep their current behavior; expiration is set at creation time and cannot be changed afterward. The same expiration choice applies when you [create an Admin API key](https://platform.claude.com/docs/en/manage-claude/admin-api-keys) in the Claude Console.
from line 334
111334
112335The Console API keys table shows each key's expiration, and the Admin API reports each key's `expires_at` timestamp on the [List API Keys](https://platform.claude.com/docs/en/api/admin/api_keys/list) and [Retrieve API Key](https://platform.claude.com/docs/en/api/admin/api_keys/retrieve) endpoints, so you can audit and rotate keys before they expire. The field is `null` for keys without an expiration.
113336
114Expiration limits the lifetime of a leaked credential, but it is not a substitute for secret hygiene. Regardless of expiration, store keys in a secrets manager and revoke any key you suspect has leaked.
337Expiration limits the lifetime of a leaked credential, but it is not a substitute for secret hygiene. Regardless of expiration, store keys in a secrets manager and disable or delete any key you suspect has leaked.
338
339### Replacing workspace API keys
340
341If you have a workspace key, you may want to replace it with [Workload Identity Federation](https://platform.claude.com/docs/en/manage-claude/wif-reference) or a personal or service account key. This provides better security and observability.
342
343See [Workload Identity Federation](https://platform.claude.com/docs/en/manage-claude/wif-reference) for details on configuring Workload Identity Federation, which is preferred over long-lived keys.
344
345To replace a workspace key with a personal or service account key:
346
3471. **Decide the key type.** Your own tooling should use a personal key. A shared or unattended workload should use a service account key.
3482. **Create a service account** if necessary. You may have to ask an organization admin to create one in [Settings → Service accounts](https://platform.claude.com/settings/service-accounts) and add it to the relevant workspace.
3493. **Create the new key.** Create it specifically for the integration's workspace unless multiple workspaces are needed.
3504. **Deploy the new key.** Replace the old key wherever the integration reads it, typically the `ANTHROPIC_API_KEY` environment variable or a secrets manager entry. For a multi-workspace key, also send the `anthropic-workspace-id` header as shown in [Select a workspace](https://platform.claude.com/docs/en/manage-claude/authentication#select-a-workspace).
3515. **Delete the old key.** Confirm that requests succeed, then delete the workspace key on the [API keys page](https://platform.claude.com/settings/keys).
115352
116353## Workload Identity Federation
117354
manage-claude/cmek Changed · +8 / -10 lines
from line 18
1818 Enabling CMEK is permanent. Anthropic keeps no copy of your key, so misconfiguration or key loss can permanently destroy your CMEK-protected data. If you are uncertain about any step, contact your Anthropic representative before applying changes.
1919
2020 * **Permanent data loss:** If your encryption key is deleted, scheduled for deletion, or has its key material destroyed, Anthropic cannot recover your data.
21 * **Identifier verification is mandatory:** Granting key access to an incorrect or spoofed principal can expose your data to an unauthorized party. Always verify the Anthropic identifier against the published production identities in each configuration guide. Never trust an identifier provided over email, chat, or any onboarding channel.
21 * **Identifier verification is mandatory:** Granting key access to an incorrect or spoofed principal can expose your data to an unauthorized party. Always verify the Anthropic identifier against the published production identities in each configuration guide. On Claude Platform on AWS, that identity is the AWS service principal published in the [AWS KMS guide](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#claude-platform-on-aws). Never trust an identifier provided over email, chat, or any onboarding channel.
2222</Warning>
2323
2424## How it works
2525
26Only Organization Admins (on Claude Platform) or Owners and the Primary Owner (on Claude Enterprise) can configure CMEK. On Claude Platform, CMEK is scoped per workspace and configured with the Admin API. On Claude Enterprise, CMEK is scoped per organization and configured in [claude.ai > Organization settings > Data and privacy](https://claude.ai/admin-settings/data-privacy-controls). On either product, CMEK protects data written after your key takes effect. Existing data (prior chats, files, and sessions) remains encrypted with Anthropic-managed keys and is not re-encrypted under your key.
26Only Organization Admins (on Claude Platform; the Admin role on Claude Platform on AWS) or Owners and the Primary Owner (on Claude Enterprise) can configure CMEK. On Claude Platform, CMEK is scoped per workspace and configured with the Admin API (on Claude Platform on AWS, in the Claude Console or through the IAM-authorized external key and workspace endpoints). On Claude Enterprise, CMEK is scoped per organization and configured in [claude.ai > Organization settings > Data and privacy](https://claude.ai/admin-settings/data-privacy-controls). On either product, CMEK protects data written after your key takes effect. Existing data (prior chats, files, and sessions) remains encrypted with Anthropic-managed keys and is not re-encrypted under your key.
2727
2828On Claude Platform, Anthropic recommends attaching your key to a new workspace before you send any requests to that workspace. If you attach a key to a workspace that already receives requests, your key can take up to a day to take effect. Data written before then, like existing data, is encrypted with Anthropic-managed keys and is not re-encrypted.
2929
3030CMEK configuration events appear in the [Compliance API Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed). The key operations Anthropic performs against your key (such as wrapping and unwrapping data keys) do not appear in the Compliance API; they appear in your cloud provider's audit logs.
3131
32Anthropic calls your key management service from its standard public IP range. If you restrict access to your key management service by IP, allow the addresses listed in [IP addresses](https://platform.claude.com/docs/en/api/ip-addresses).
32Anthropic calls your key management service from its standard public IP range. If you restrict access to your key management service by IP, allow the addresses listed in [IP addresses](https://platform.claude.com/docs/en/api/ip-addresses). On Claude Platform on AWS, don't rely on IP-based restrictions for your key; scope access with the key policy described in the [AWS KMS guide](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#claude-platform-on-aws) instead.
3333
3434## Prerequisites
3535
3636* Permissions to create encryption keys and manage key access in the account, project, or subscription that will host the encryption key.
37* An Organization Admin role in the Claude Console on Claude Platform, or an Owner or Primary Owner role on Claude Enterprise.
37* An Organization Admin role in the Claude Console on Claude Platform (the Admin role on Claude Platform on AWS), or an Owner or Primary Owner role on Claude Enterprise.
3838* Data retention configuration: CMEK is allowed with [Zero data retention (ZDR)](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention) for both Claude Platform and Claude Enterprise.
3939
4040## Availability and regions
4141
42CMEK is currently available in US regions only, and all encryption operations are processed in US regions.
42Except on Claude Platform on AWS (covered at the end of this section), CMEK is currently available in US regions only, and all encryption operations are processed in US regions. For minimal latency, choose a region close to Anthropic's US infrastructure:
4343
44On [Claude Platform on AWS](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws), CMEK is available with AWS KMS keys only; Google Cloud KMS and Azure Key Vault keys cannot be registered. Create and attach keys in the Claude Console; the `external_keys` API endpoints are not currently available on Claude Platform on AWS. There is no separate validation step: the key is implicitly validated when you attach it to a workspace (the attach call performs an encrypt/decrypt round), so a key policy problem surfaces at attach time rather than at registration. The key must be in the same AWS region as the workspace it is attached to.
45
46For minimal latency, choose a region close to Anthropic's US infrastructure:
47
4844| Provider | Recommended regions |
4945| ------------ | --------------------------- |
5046| AWS | `us-east-2` |
from line 47
5147| Google Cloud | `us-central1`, `us-east5` |
5248| Azure | `northcentralus`, `eastus2` |
5349
50On [Claude Platform on AWS](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws), CMEK is available with AWS KMS keys only; Google Cloud KMS and Azure Key Vault keys cannot be registered. These region recommendations do not apply there: the key must be a single-region KMS key in the same AWS account and region as the workspace it is attached to, and its key policy must grant access to an AWS service principal rather than Anthropic's IAM role; see [Set up CMEK on Claude Platform on AWS](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#claude-platform-on-aws). Register and attach keys in the Claude Console; the external key endpoints are also available on Claude Platform on AWS, authorized through [IAM actions](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#encryption-keys). There is no separate validation step: the key is implicitly validated when you attach it to a workspace (the attach call performs an encrypt/decrypt round), so a key policy problem surfaces at attach time rather than at registration.
51
5452## What CMEK protects
5553
5654What CMEK covers depends on which product you use.
from line 153
155153
156154<CardGroup cols={3}>
157155 <Card href="https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms" title="AWS KMS">
158 Create an AWS KMS key with a cross-account key policy, then register and validate it.
156 Create an AWS KMS key with a key policy that grants Anthropic access, then register it.
159157 </Card>
160158
161159 <Card href="https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms" title="Google Cloud KMS">