What this read moved
1–25 of 122This capture is too large to show at once. Changes 1-25 of 122 are below, significant first; the rest are on the following screens.
api/admin Changed · +499 / -186 lines
This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.
The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.
from line 35
3535```bash
3636curl https://api.anthropic.com/v1/organizations/me \
3737 -H 'anthropic-version: 2023-06-01' \
38 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
38 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
3939```
4040
4141##### Response (200)
from line 170
170170curl https://api.anthropic.com/v1/organizations/invites \
171171 -H 'Content-Type: application/json' \
172172 -H 'anthropic-version: 2023-06-01' \
173 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
173 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
174174 -d '{
176176 "role": "user"
from line 288
288288```bash
289289curl https://api.anthropic.com/v1/organizations/invites/$INVITE_ID \
290290 -H 'anthropic-version: 2023-06-01' \
291 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
291 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
292292```
293293
294294##### Response (200)
from line 448
448448```bash
449449curl https://api.anthropic.com/v1/organizations/invites \
450450 -H 'anthropic-version: 2023-06-01' \
451 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
451 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
452452```
453453
454454##### Response (200)
from line 508
508508curl https://api.anthropic.com/v1/organizations/invites/$INVITE_ID \
509509 -X DELETE \
510510 -H 'anthropic-version: 2023-06-01' \
511 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
511 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
512512```
513513
514514##### Response (200)
from line 591
591591```bash
592592curl https://api.anthropic.com/v1/organizations/users/$USER_ID \
593593 -H 'anthropic-version: 2023-06-01' \
594 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
594 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
595595```
596596
597597##### Response (200)
from line 712
712712```bash
713713curl https://api.anthropic.com/v1/organizations/users \
714714 -H 'anthropic-version: 2023-06-01' \
715 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
715 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
716716```
717717
718718##### Response (200)
from line 823
823823curl https://api.anthropic.com/v1/organizations/users/$USER_ID \
824824 -H 'Content-Type: application/json' \
825825 -H 'anthropic-version: 2023-06-01' \
826 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
826 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
827827 -d '{
828828 "role": "user"
829829 }'
from line 874
874874curl https://api.anthropic.com/v1/organizations/users/$USER_ID \
875875 -X DELETE \
876876 -H 'anthropic-version: 2023-06-01' \
877 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
877 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
878878```
879879
880880##### Response (200)
from line 967
967967```bash
968968curl https://api.anthropic.com/v1/organizations/rbac_groups \
969969 -H 'anthropic-version: 2023-06-01' \
970 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
970 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
971971```
972972
973973##### Response (200)
from line 1055
10551055```bash
10561056curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID \
10571057 -H 'anthropic-version: 2023-06-01' \
1058 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
1058 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
10591059```
10601060
10611061##### Response (200)
from line 1140
11401140curl https://api.anthropic.com/v1/organizations/rbac_groups \
11411141 -H 'Content-Type: application/json' \
11421142 -H 'anthropic-version: 2023-06-01' \
1143 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
1143 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
11441144 -d '{
11451145 "name": "Engineering"
11461146 }'
from line 1166
11661166
11671167**POST** `/v1/organizations/rbac_groups/{group_id}`
11681168
1169Update an RBAC Group's name. Groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API.
1169Update an RBAC Group's name. Groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API while an organization in the tenant uses SCIM provisioning.
11701170
11711171The RBAC Groups API is available to Claude Enterprise organizations only.
11721172
from line 1234
12341234curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID \
12351235 -H 'Content-Type: application/json' \
12361236 -H 'anthropic-version: 2023-06-01' \
1237 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
1237 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
12381238 -d '{
12391239 "name": "Engineering"
12401240 }'
from line 1260
12601260
12611261**DELETE** `/v1/organizations/rbac_groups/{group_id}`
12621262
1263Delete an RBAC Group. Groups provisioned by an identity provider (source type `"scim"`) cannot be deleted via the API.
1263Delete an RBAC Group. Groups provisioned by an identity provider (source type `"scim"`) cannot be deleted via the API while an organization in the tenant uses SCIM provisioning.
12641264
12651265The RBAC Groups API is available to Claude Enterprise organizations only.
12661266
from line 1292
12921292curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID \
12931293 -X DELETE \
12941294 -H 'anthropic-version: 2023-06-01' \
1295 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
1295 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
12961296```
12971297
12981298##### Response (200)
from line 1377
13771377```bash
13781378curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members \
13791379 -H 'anthropic-version: 2023-06-01' \
1380 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
1380 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
13811381```
13821382
13831383##### Response (200)
from line 1402
14021402
14031403**POST** `/v1/organizations/rbac_groups/{group_id}/members`
14041404
1405Add a User to an RBAC Group. Membership of groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API.
1405Add a User to an RBAC Group. Membership of groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API while an organization in the tenant uses SCIM provisioning.
14061406
14071407The RBAC Groups API is available to Claude Enterprise organizations only.
14081408
from line 1454
14541454curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members \
14551455 -H 'Content-Type: application/json' \
14561456 -H 'anthropic-version: 2023-06-01' \
1457 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
1457 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
14581458 -d '{
14591459 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
14601460 }'
from line 1476
14761476
14771477**DELETE** `/v1/organizations/rbac_groups/{group_id}/members/{user_id}`
14781478
1479Remove a User from an RBAC Group. Membership of groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API.
1479Remove a User from an RBAC Group. Membership of groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API while an organization in the tenant uses SCIM provisioning.
14801480
14811481The RBAC Groups API is available to Claude Enterprise organizations only.
14821482
from line 1514
15141514curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members/$USER_ID \
15151515 -X DELETE \
15161516 -H 'anthropic-version: 2023-06-01' \
1517 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
1517 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
15181518```
15191519
15201520##### Response (200)
from line 1597
15971597```bash
15981598curl https://api.anthropic.com/v1/organizations/rbac_roles \
15991599 -H 'anthropic-version: 2023-06-01' \
1600 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
1600 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
16011601```
16021602
16031603##### Response (200)
from line 1669
16691669```bash
16701670curl https://api.anthropic.com/v1/organizations/rbac_roles/$ROLE_ID \
16711671 -H 'anthropic-version: 2023-06-01' \
1672 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
1672 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
16731673```
16741674
16751675##### Response (200)
from line 1841
18411841```bash
18421842curl https://api.anthropic.com/v1/organizations/rbac_roles/$ROLE_ID/permissions \
18431843 -H 'anthropic-version: 2023-06-01' \
1844 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
1844 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
18451845```
18461846
18471847##### Response (200)
from line 1915
19151915
19161916 Geographic region for workspace data storage. Immutable after creation. Defaults to 'us' if omitted.
19171917
1918- `display_color: optional string or null`
1919
1920 Hex color code representing the Workspace in the Anthropic Console.
1921
1922 maxLength: 7, pattern: ^#[0-9A-Fa-f]{6}$
1923
19181924- `external_key_id: optional string or null`
19191925
19201926 ID of the customer-managed encryption key (CMEK) configuration to use for this
19211927 Workspace. Setting this field requires CMEK to be enabled for your
19221928 organization. When set, data stored for this Workspace is encrypted with the
1923 referenced key. Create key configurations with the External Keys API. This
1924 field is write-once: once a key is attached to a Workspace it cannot be
1925 detached or replaced. To rotate key material, rotate the underlying key on
1926 your cloud KMS; the `external_key_id` stays the same.
1929 referenced key. Create key configurations with the External Keys API. On
1930 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
1931 single-Region key in the same AWS account and Region as the Workspace. On that
1932 platform the key is validated against this Workspace when it is attached, so a
1933 key-policy problem is reported as an error on this request. This field is write-once:
1934 once a key is attached to a Workspace it cannot be detached or replaced. To
1935 rotate key material, rotate the underlying key on your cloud KMS; the
1936 `external_key_id` stays the same.
19271937
19281938- `tags: optional map[string] or null`
19291939
from line 1959
19491959 customer-managed encryption key (CMEK) on AWS, reference this value in your
19501960 KMS key-policy condition so the key is scoped to this compartment. On GCP and
19511961 Azure, Anthropic enforces the compartment binding automatically; you do not
1952 need to reference this value in your key configuration. See the CMEK integration guide for the
1953 required key configuration, including the value used during key validation.
1962 need to reference this value in your key configuration. See the CMEK
1963 integration guide for the required key configuration; unless your organization
1964 is on Claude Platform on AWS, it includes a separate value used during key
1965 validation. On Claude Platform on AWS there is no separate validation value:
1966 the key is validated against this Workspace's own value when it is attached, so
1967 if your key policy uses the compartment condition, add this value to it before
1968 attaching the key.
19541969
19551970 - `created_at: string`
19561971
from line 2002
19872002 ID of the customer-managed encryption key (CMEK) configuration to use for this
19882003 Workspace. Setting this field requires CMEK to be enabled for your
19892004 organization. When set, data stored for this Workspace is encrypted with the
1990 referenced key. Create key configurations with the External Keys API. This
1991 field is write-once: once a key is attached to a Workspace it cannot be
1992 detached or replaced. To rotate key material, rotate the underlying key on
1993 your cloud KMS; the `external_key_id` stays the same.
2005 referenced key. Create key configurations with the External Keys API. On
2006 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
2007 single-Region key in the same AWS account and Region as the Workspace. On that
2008 platform the key is validated against this Workspace when it is attached, so a
2009 key-policy problem is reported as an error on this request. This field is write-once:
2010 once a key is attached to a Workspace it cannot be detached or replaced. To
2011 rotate key material, rotate the underlying key on your cloud KMS; the
2012 `external_key_id` stays the same.
19942013
19952014 - `name: string`
19962015
from line 2033
20142033curl https://api.anthropic.com/v1/organizations/workspaces \
20152034 -H 'Content-Type: application/json' \
20162035 -H 'anthropic-version: 2023-06-01' \
2017 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
2036 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
20182037 -d '{
20192038 "name": "x",
2039 "display_color": "#6C5BB9",
20202040 "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
20212041 "tags": {
20222042 "env": "prod",
from line 2101
20812101 customer-managed encryption key (CMEK) on AWS, reference this value in your
20822102 KMS key-policy condition so the key is scoped to this compartment. On GCP and
20832103 Azure, Anthropic enforces the compartment binding automatically; you do not
2084 need to reference this value in your key configuration. See the CMEK integration guide for the
2085 required key configuration, including the value used during key validation.
2104 need to reference this value in your key configuration. See the CMEK
2105 integration guide for the required key configuration; unless your organization
2106 is on Claude Platform on AWS, it includes a separate value used during key
2107 validation. On Claude Platform on AWS there is no separate validation value:
2108 the key is validated against this Workspace's own value when it is attached, so
2109 if your key policy uses the compartment condition, add this value to it before
2110 attaching the key.
20862111
20872112 - `created_at: string`
20882113
from line 2144
21192144 ID of the customer-managed encryption key (CMEK) configuration to use for this
21202145 Workspace. Setting this field requires CMEK to be enabled for your
21212146 organization. When set, data stored for this Workspace is encrypted with the
2122 referenced key. Create key configurations with the External Keys API. This
2123 field is write-once: once a key is attached to a Workspace it cannot be
2124 detached or replaced. To rotate key material, rotate the underlying key on
2125 your cloud KMS; the `external_key_id` stays the same.
2147 referenced key. Create key configurations with the External Keys API. On
2148 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
2149 single-Region key in the same AWS account and Region as the Workspace. On that
2150 platform the key is validated against this Workspace when it is attached, so a
2151 key-policy problem is reported as an error on this request. This field is write-once:
2152 once a key is attached to a Workspace it cannot be detached or replaced. To
2153 rotate key material, rotate the underlying key on your cloud KMS; the
2154 `external_key_id` stays the same.
21262155
21272156 - `name: string`
21282157
from line 2174
21452174```bash
21462175curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID \
21472176 -H 'anthropic-version: 2023-06-01' \
2148 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
2177 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
21492178```
21502179
21512180##### Response (200)
from line 2251
22222251 customer-managed encryption key (CMEK) on AWS, reference this value in your
22232252 KMS key-policy condition so the key is scoped to this compartment. On GCP and
22242253 Azure, Anthropic enforces the compartment binding automatically; you do not
2225 need to reference this value in your key configuration. See the CMEK integration guide for the
2226 required key configuration, including the value used during key validation.
2254 need to reference this value in your key configuration. See the CMEK
2255 integration guide for the required key configuration; unless your organization
2256 is on Claude Platform on AWS, it includes a separate value used during key
2257 validation. On Claude Platform on AWS there is no separate validation value:
2258 the key is validated against this Workspace's own value when it is attached, so
2259 if your key policy uses the compartment condition, add this value to it before
2260 attaching the key.
22272261
22282262 - `created_at: string`
22292263
from line 2294
22602294 ID of the customer-managed encryption key (CMEK) configuration to use for this
22612295 Workspace. Setting this field requires CMEK to be enabled for your
22622296 organization. When set, data stored for this Workspace is encrypted with the
2263 referenced key. Create key configurations with the External Keys API. This
2264 field is write-once: once a key is attached to a Workspace it cannot be
2265 detached or replaced. To rotate key material, rotate the underlying key on
2266 your cloud KMS; the `external_key_id` stays the same.
2297 referenced key. Create key configurations with the External Keys API. On
2298 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
2299 single-Region key in the same AWS account and Region as the Workspace. On that
2300 platform the key is validated against this Workspace when it is attached, so a
2301 key-policy problem is reported as an error on this request. This field is write-once:
2302 once a key is attached to a Workspace it cannot be detached or replaced. To
2303 rotate key material, rotate the underlying key on your cloud KMS; the
2304 `external_key_id` stays the same.
22672305
22682306 - `name: string`
22692307
from line 2336
22982336```bash
22992337curl https://api.anthropic.com/v1/organizations/workspaces \
23002338 -H 'anthropic-version: 2023-06-01' \
2301 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
2339 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
23022340```
23032341
23042342##### Response (200)
from line 2406
23682406
23692407 - `"us"`
23702408
2409- `display_color: optional string`
2410
2411 Hex color code representing the Workspace in the Anthropic Console.
2412
2413 maxLength: 7, pattern: ^#[0-9A-Fa-f]{6}$
2414
23712415- `external_key_id: optional string`
23722416
23732417 ID of the customer-managed encryption key (CMEK) configuration to use for this
23742418 Workspace. Setting this field requires CMEK to be enabled for your
23752419 organization. When set, data stored for this Workspace is encrypted with the
2376 referenced key. Create key configurations with the External Keys API. This
2377 field is write-once: once a key is attached to a Workspace it cannot be
2378 detached or replaced. To rotate key material, rotate the underlying key on
2379 your cloud KMS; the `external_key_id` stays the same.
2420 referenced key. Create key configurations with the External Keys API. On
2421 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
2422 single-Region key in the same AWS account and Region as the Workspace. On that
2423 platform the key is validated against this Workspace when it is attached, so a
2424 key-policy problem is reported as an error on this request. This field is write-once:
2425 once a key is attached to a Workspace it cannot be detached or replaced. To
2426 rotate key material, rotate the underlying key on your cloud KMS; the
2427 `external_key_id` stays the same.
23802428
23812429- `name: optional string`
23822430
from line 2456
24082456 customer-managed encryption key (CMEK) on AWS, reference this value in your
24092457 KMS key-policy condition so the key is scoped to this compartment. On GCP and
24102458 Azure, Anthropic enforces the compartment binding automatically; you do not
2411 need to reference this value in your key configuration. See the CMEK integration guide for the
2412 required key configuration, including the value used during key validation.
2459 need to reference this value in your key configuration. See the CMEK
2460 integration guide for the required key configuration; unless your organization
2461 is on Claude Platform on AWS, it includes a separate value used during key
2462 validation. On Claude Platform on AWS there is no separate validation value:
2463 the key is validated against this Workspace's own value when it is attached, so
2464 if your key policy uses the compartment condition, add this value to it before
2465 attaching the key.
24132466
24142467 - `created_at: string`
24152468
from line 2499
24462499 ID of the customer-managed encryption key (CMEK) configuration to use for this
24472500 Workspace. Setting this field requires CMEK to be enabled for your
24482501 organization. When set, data stored for this Workspace is encrypted with the
2449 referenced key. Create key configurations with the External Keys API. This
2450 field is write-once: once a key is attached to a Workspace it cannot be
2451 detached or replaced. To rotate key material, rotate the underlying key on
2452 your cloud KMS; the `external_key_id` stays the same.
2502 referenced key. Create key configurations with the External Keys API. On
2503 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
2504 single-Region key in the same AWS account and Region as the Workspace. On that
2505 platform the key is validated against this Workspace when it is attached, so a
2506 key-policy problem is reported as an error on this request. This field is write-once:
2507 once a key is attached to a Workspace it cannot be detached or replaced. To
2508 rotate key material, rotate the underlying key on your cloud KMS; the
2509 `external_key_id` stays the same.
24532510
24542511 - `name: string`
24552512
from line 2530
24732530curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID \
24742531 -H 'Content-Type: application/json' \
24752532 -H 'anthropic-version: 2023-06-01' \
2476 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
2533 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
24772534 -d '{
2535 "display_color": "#6C5BB9",
24782536 "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
24792537 "tags": {
24802538 "env": "prod",
from line 2595
25372595 customer-managed encryption key (CMEK) on AWS, reference this value in your
25382596 KMS key-policy condition so the key is scoped to this compartment. On GCP and
25392597 Azure, Anthropic enforces the compartment binding automatically; you do not
2540 need to reference this value in your key configuration. See the CMEK integration guide for the
2541 required key configuration, including the value used during key validation.
2598 need to reference this value in your key configuration. See the CMEK
2599 integration guide for the required key configuration; unless your organization
2600 is on Claude Platform on AWS, it includes a separate value used during key
2601 validation. On Claude Platform on AWS there is no separate validation value:
2602 the key is validated against this Workspace's own value when it is attached, so
2603 if your key policy uses the compartment condition, add this value to it before
2604 attaching the key.
25422605
25432606 - `created_at: string`
25442607
from line 2638
25752638 ID of the customer-managed encryption key (CMEK) configuration to use for this
25762639 Workspace. Setting this field requires CMEK to be enabled for your
25772640 organization. When set, data stored for this Workspace is encrypted with the
2578 referenced key. Create key configurations with the External Keys API. This
2579 field is write-once: once a key is attached to a Workspace it cannot be
2580 detached or replaced. To rotate key material, rotate the underlying key on
2581 your cloud KMS; the `external_key_id` stays the same.
2641 referenced key. Create key configurations with the External Keys API. On
2642 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
2643 single-Region key in the same AWS account and Region as the Workspace. On that
2644 platform the key is validated against this Workspace when it is attached, so a
2645 key-policy problem is reported as an error on this request. This field is write-once:
2646 once a key is attached to a Workspace it cannot be detached or replaced. To
2647 rotate key material, rotate the underlying key on your cloud KMS; the
2648 `external_key_id` stays the same.
25822649
25832650 - `name: string`
25842651
from line 2669
26022669curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/archive \
26032670 -X POST \
26042671 -H 'anthropic-version: 2023-06-01' \
2605 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
2672 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
26062673```
26072674
26082675##### Response (200)
from line 2768
27012768curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/members \
27022769 -H 'Content-Type: application/json' \
27032770 -H 'anthropic-version: 2023-06-01' \
2704 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
2771 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
27052772 -d '{
27062773 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
27072774 "workspace_role": "workspace_admin"
from line 2841
27742841```bash
27752842curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/members/$USER_ID \
27762843 -H 'anthropic-version: 2023-06-01' \
2777 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
2844 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
27782845```
27792846
27802847##### Response (200)
from line 2936
28692936```bash
28702937curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/members \
28712938 -H 'anthropic-version: 2023-06-01' \
2872 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
2939 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
28732940```
28742941
28752942##### Response (200)
from line 3029
29623029curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/members/$USER_ID \
29633030 -H 'Content-Type: application/json' \
29643031 -H 'anthropic-version: 2023-06-01' \
2965 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
3032 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
29663033 -d '{
29673034 "workspace_role": "workspace_admin"
29683035 }'
from line 3086
30193086curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/members/$USER_ID \
30203087 -X DELETE \
30213088 -H 'anthropic-version: 2023-06-01' \
3022 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
3089 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
30233090```
30243091
30253092##### Response (200)
from line 3111
30443111override. Groups without overrides inherit the organization limits and
30453112are not listed; use `GET /v1/organizations/rate_limits` to see those.
30463113
3114When `limit` is omitted, every matching entry is returned in a single
3115page; when `limit` truncates the result, follow `next_page` to fetch
3116the remaining entries.
3117
30473118#### Path parameters
30483119
30493120- `workspace_id: string`
from line 3139
30683139
30693140 - `"web_search"`
30703141
3142- `limit: optional number`
3143
3144 Maximum number of items to return per page. Ranges from `1` to `1000`.
3145
3146 When omitted, every remaining entry is returned in a single page and `next_page` is `null`.
3147
3148 maximum: 1000, minimum: 1
3149
30713150- `page: optional string`
30723151
30733152 Opaque cursor from a previous response's `next_page`.
from line 3209
31303209
31313210- `next_page: string or null`
31323211
3133 Token to provide in as `page` in the subsequent request to retrieve the next page of data.
3212 Opaque cursor for the next page of results, or `null` when no entries remain beyond this response.
31343213
31353214#### Example
31363215
31373216```bash
31383217curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/rate_limits \
31393218 -H 'anthropic-version: 2023-06-01' \
3140 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
3219 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
31413220```
31423221
31433222##### Response (200)
from line 3251
31723251
31733252**POST** `/v1/organizations/workspaces/{workspace_id}/service_accounts`
31743253
3254**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
3255
31753256Add a service account to a workspace with the given `workspace_role`.
31763257
31773258The role determines what the service account can do in the workspace and
from line 3262
31813262assigns a chosen role. If the service account is already an explicit
31823263member of the workspace, its `workspace_role` is replaced with the
31833264value supplied here. Archived workspaces return 400. Archived service
3184accounts cannot be added and are rejected. Requires an OAuth bearer or
3185Console session; Admin API keys are not accepted.
3265accounts cannot be added and are rejected.
31863266
31873267#### Path parameters
31883268
from line 3338
32583338curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/service_accounts \
32593339 -H 'Content-Type: application/json' \
32603340 -H 'anthropic-version: 2023-06-01' \
3261 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
3341 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
32623342 -d '{
32633343 "service_account_id": "service_account_id",
32643344 "workspace_role": "workspace_admin"
from line 3362
32823362
32833363**GET** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}`
32843364
3365**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
3366
32853367Retrieve a service account's membership in a workspace.
32863368
32873369Returns the membership record, including the service account's
from line 3432
33503432```bash
33513433curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/service_accounts/$SERVICE_ACCOUNT_ID \
33523434 -H 'anthropic-version: 2023-06-01' \
3353 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
3435 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
33543436```
33553437
33563438##### Response (200)
from line 3452
33703452
33713453**GET** `/v1/organizations/workspaces/{workspace_id}/service_accounts`
33723454
3455**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
3456
33733457List the service accounts that are members of a workspace.
33743458
33753459Each entry includes the service account's `workspace_role`. Use `limit`
from line 3536
34523536```bash
34533537curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/service_accounts \
34543538 -H 'anthropic-version: 2023-06-01' \
3455 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
3539 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
34563540```
34573541
34583542##### Response (200)
from line 3561
34773561
34783562**POST** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}`
34793563
3564**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
3565
34803566Change a service account's role in a workspace.
34813567
34823568The new `workspace_role` replaces the current one. Only explicit
from line 3570
34843570default-workspace membership, add the service account explicitly with
34853571`POST /workspaces/{workspace_id}/service_accounts`. Archived workspaces
34863572return 400. Archived service accounts cannot be updated and are
3487rejected. Requires an OAuth bearer or Console session; Admin API keys
3488are not accepted.
3573rejected.
34893574
34903575#### Path parameters
34913576
from line 3646
35613646curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/service_accounts/$SERVICE_ACCOUNT_ID \
35623647 -H 'Content-Type: application/json' \
35633648 -H 'anthropic-version: 2023-06-01' \
3564 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
3649 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
35653650 -d '{
35663651 "workspace_role": "workspace_admin"
35673652 }'
from line 3669
35843669
35853670**DELETE** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}`
35863671
3672**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
3673
35873674Remove a service account from a workspace.
35883675
35893676Removal is idempotent (returns 200 even if the membership was already
35903677removed). A DELETE against the implicit default-workspace membership
35913678returns 200 but is a no-op and the membership persists; deleting an
35923679explicit default-workspace row reverts to the implicit `workspace_user`
3593membership. Archived workspaces return 400. Requires an OAuth bearer or
3594Console session; Admin API keys are not accepted.
3680membership. Archived workspaces return 400.
35953681
35963682#### Path parameters
35973683
from line 3717
36313717curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/service_accounts/$SERVICE_ACCOUNT_ID \
36323718 -X DELETE \
36333719 -H 'anthropic-version: 2023-06-01' \
3634 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
3720 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
36353721```
36363722
36373723##### Response (200)
from line 3873
37873873```bash
37883874curl https://api.anthropic.com/v1/organizations/api_keys/$API_KEY_ID \
37893875 -H 'anthropic-version: 2023-06-01' \
3790 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
3876 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
37913877```
37923878
37933879##### Response (200)
from line 4088
40024088```bash
40034089curl https://api.anthropic.com/v1/organizations/api_keys \
40044090 -H 'anthropic-version: 2023-06-01' \
4005 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
4091 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
40064092```
40074093
40084094##### Response (200)
from line 4285
41994285curl https://api.anthropic.com/v1/organizations/api_keys/$API_KEY_ID \
42004286 -H 'Content-Type: application/json' \
42014287 -H 'anthropic-version: 2023-06-01' \
4202 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
4288 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
42034289 -d '{}'
42044290```
42054291
from line 4334
42484334
42494335 - `kms_arn: string`
42504336
4251 Full ARN of the AWS KMS key.
4337 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
42524338
42534339 maxLength: 2048
42544340
from line 4348
42624348
42634349 **Deprecated**
42644350
4265 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
4351 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
42664352
42674353 - `Gcp object`
42684354
from line 4432
43464432
43474433 - `kms_arn: string`
43484434
4349 Full ARN of the AWS KMS key.
4435 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
43504436
43514437 maxLength: 2048
43524438
from line 4446
43604446
43614447 **Deprecated**
43624448
4363 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
4449 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
43644450
43654451 - `Gcp object`
43664452
from line 4490
44044490curl https://api.anthropic.com/v1/organizations/external_keys \
44054491 -H 'Content-Type: application/json' \
44064492 -H 'anthropic-version: 2023-06-01' \
4407 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
4493 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
44084494 -d '{
44094495 "provider_config": {
44104496 "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
from line 4586
45004586
45014587 - `kms_arn: string`
45024588
4503 Full ARN of the AWS KMS key.
4589 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
45044590
45054591 maxLength: 2048
45064592
from line 4600
45144600
45154601 **Deprecated**
45164602
4517 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
4603 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
45184604
45194605 - `Gcp object`
45204606
from line 4647
45614647```bash
45624648curl https://api.anthropic.com/v1/organizations/external_keys \
45634649 -H 'anthropic-version: 2023-06-01' \
4564 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
4650 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
45654651```
45664652
45674653##### Response (200)
from line 4733
46474733
46484734 - `kms_arn: string`
46494735
4650 Full ARN of the AWS KMS key.
4736 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
46514737
46524738 maxLength: 2048
46534739
from line 4747
46614747
46624748 **Deprecated**
46634749
4664 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
4750 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
46654751
46664752 - `Gcp object`
46674753
from line 4790
47044790```bash
47054791curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \
47064792 -H 'anthropic-version: 2023-06-01' \
4707 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
4793 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
47084794```
47094795
47104796##### Response (200)
from line 4853
47674853
47684854 - `kms_arn: string`
47694855
4770 Full ARN of the AWS KMS key.
4856 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
47714857
47724858 maxLength: 2048
47734859
from line 4867
47814867
47824868 **Deprecated**
47834869
4784 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
4870 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
47854871
47864872 - `Gcp object`
47874873
from line 4941
48554941
48564942 - `kms_arn: string`
48574943
4858 Full ARN of the AWS KMS key.
4944 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
48594945
48604946 maxLength: 2048
48614947
from line 4955
48694955
48704956 **Deprecated**
48714957
4872 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
4958 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
48734959
48744960 - `Gcp object`
48754961
from line 4999
49134999curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \
49145000 -H 'Content-Type: application/json' \
49155001 -H 'anthropic-version: 2023-06-01' \
4916 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
5002 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
49175003 -d '{}'
49185004```
49195005
from line 5057
49715057curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \
49725058 -X DELETE \
49735059 -H 'anthropic-version: 2023-06-01' \
4974 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
5060 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
49755061```
49765062
49775063##### Response (200)
from line 5112
50265112curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID/validate \
50275113 -X POST \
50285114 -H 'anthropic-version: 2023-06-01' \
5029 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
5115 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
50305116```
50315117
50325118##### Response (200)
from line 5390
53045390```bash
53055391curl https://api.anthropic.com/v1/organizations/usage_report/messages \
53065392 -H 'anthropic-version: 2023-06-01' \
5307 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
5393 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
53085394```
53095395
53105396##### Response (200)
from line 5616
55305616```bash
55315617curl https://api.anthropic.com/v1/organizations/usage_report/claude_code \
55325618 -H 'anthropic-version: 2023-06-01' \
5533 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
5619 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
55345620```
55355621
55365622##### Response (200)
from line 5862
57765862```bash
57775863curl https://api.anthropic.com/v1/organizations/cost_report \
57785864 -H 'anthropic-version: 2023-06-01' \
5779 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
5865 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
57805866```
57815867
57825868##### Response (200)
from line 6140
60546140
60556141 - `"1m"`
60566142
6143- `claude_tag_categories: optional array of "dm" or "engaged" or "monitoring" or 2 more`
6144
6145 Filter to Claude Tag (Claude in Slack) usage in specific spend categories. Usage with no category never matches. `dm` usage is reported under the user's product rather than `claude-tag`, so combining this filter with `products[]=claude-tag` excludes it. Use `group_by[]=claude_tag_category` to break out per-category values.
6146
6147 maxItems: 100
6148
6149 - `"dm"`
6150
6151 - `"engaged"`
6152
6153 - `"monitoring"`
6154
6155 - `"proactive"`
6156
6157 - `"scheduled"`
6158
6159- `claude_tag_user_ids: optional array of string`
6160
6161 Filter to Claude Tag (Claude in Slack) usage attributed to specific Slack users, by Slack user ID (for example `U0123ABCDEF`), not claude.ai user ID. Usage that is not Claude Tag, and Claude Tag usage not attributed to a single user, never matches. Use `group_by[]=claude_tag_user_id` to break out per-user values.
6162
6163 maxItems: 100
6164
60576165- `context_windows: optional array of "0-200k" or "200k-1M"`
60586166
60596167 Filter to specific context-window pricing tiers. Use `group_by[]=context_window` to break out per-tier values.
from line 6178
60706178
60716179 format: date-time
60726180
6073- `group_by: optional array of "context_window" or "inference_geo" or "model" or 4 more`
6181- `group_by: optional array of "claude_tag_category" or "claude_tag_user_id" or "context_window" or 6 more`
60746182
60756183 Dimensions to break each time bucket out by. Defaults to no grouping (one total per bucket). Each bucket reports at most its top 100 groups; a group beyond that cap has no row in that bucket (there is no remainder row), so grouped buckets are not exhaustive when a dimension has more than 100 distinct values.
60766184
60776185 maxItems: 100
60786186
6187 - `"claude_tag_category"`
6188
6189 - `"claude_tag_user_id"`
6190
60796191 - `"context_window"`
60806192
60816193 - `"inference_geo"`
from line 6311
61996311 - `cache_read_input_tokens: number`
62006312
62016313 The number of input tokens read from the cache.
6314
6315 - `claude_tag_category: "dm" or "engaged" or "monitoring" or 2 more or null`
6316
6317 Claude Tag (Claude in Slack) spend category: `engaged` (a person addressed Claude in a channel or thread), `proactive` (Claude responded without being addressed), `scheduled` (a scheduled routine ran), `monitoring` (Claude watching a channel it was asked to monitor), or `dm` (direct messages with Claude). Populated only when `claude_tag_category` is in `group_by[]`; null for usage that is not Claude Tag. Direct-message usage is billed to the individual user and is reported under that user's product, not under `claude-tag`. New categories may be added over time.
6318
6319 - `"dm"`
6320
6321 - `"engaged"`
6322
6323 - `"monitoring"`
6324
6325 - `"proactive"`
6326
6327 - `"scheduled"`
6328
6329 - `claude_tag_user_id: string or null`
6330
6331 Slack user ID (for example `U0123ABCDEF`) of the member the Claude Tag (Claude in Slack) usage is attributed to, not a claude.ai user ID. Populated only when `claude_tag_user_id` is in `group_by[]`; null for usage that is not Claude Tag and for Claude Tag usage that is not attributed to a single user (for example `monitoring`, and `proactive` usage Claude initiated), so per-user rows can sum to less than the Claude Tag total. Cannot be combined with `group_by[]=rbac_group_id` or the `rbac_group_ids[]` filter.
62026332
62036333 - `context_window: "0-200k" or "200k-1M" or null`
62046334
from line 6436
63066436 "ephemeral_5m_input_tokens": 500
63076437 },
63086438 "cache_read_input_tokens": 0,
6439 "claude_tag_category": "dm",
6440 "claude_tag_user_id": "U0123ABCDEF",
63096441 "context_window": "0-200k",
63106442 "inference_geo": "global",
63116443 "model": "claude-opus-5",
from line 6495
63636495
63646496 - `"1m"`
63656497
6498- `claude_tag_categories: optional array of "dm" or "engaged" or "monitoring" or 2 more`
6499
6500 Filter to Claude Tag (Claude in Slack) usage in specific spend categories. Usage with no category never matches. `dm` usage is reported under the user's product rather than `claude-tag`, so combining this filter with `products[]=claude-tag` excludes it. Use `group_by[]=claude_tag_category` to break out per-category values.
6501
6502 maxItems: 100
6503
6504 - `"dm"`
6505
6506 - `"engaged"`
6507
6508 - `"monitoring"`
6509
6510 - `"proactive"`
6511
6512 - `"scheduled"`
6513
6514- `claude_tag_user_ids: optional array of string`
6515
6516 Filter to Claude Tag (Claude in Slack) usage attributed to specific Slack users, by Slack user ID (for example `U0123ABCDEF`), not claude.ai user ID. Usage that is not Claude Tag, and Claude Tag usage not attributed to a single user, never matches. Use `group_by[]=claude_tag_user_id` to break out per-user values.
6517
6518 maxItems: 100
6519
63666520- `context_windows: optional array of "0-200k" or "200k-1M"`
63676521
63686522 Filter to specific context-window pricing tiers. Use `group_by[]=context_window` to break out per-tier values.
from line 6539
63856539
63866540 default: false
63876541
6388- `group_by: optional array of "context_window" or "inference_geo" or "model" or 4 more`
6542- `group_by: optional array of "claude_tag_category" or "claude_tag_user_id" or "context_window" or 6 more`
63896543
63906544 Break each actor's row out by the given dimensions. Accepts the same values as the bucketed `/usage_report` endpoint. `limit` bounds (actor × time bucket × dimension) rows — with dimensions or `bucket_width` present, one actor may span several rows.
63916545
63926546 maxItems: 100
63936547
6548 - `"claude_tag_category"`
6549
6550 - `"claude_tag_user_id"`
6551
63946552 - `"context_window"`
63956553
63966554 - `"inference_geo"`
from line 6710
65526710 - `cache_read_input_tokens: number`
65536711
65546712 The number of input tokens read from the cache.
6713
6714 - `claude_tag_category: "dm" or "engaged" or "monitoring" or 2 more or null`
6715
6716 Claude Tag (Claude in Slack) spend category: `engaged` (a person addressed Claude in a channel or thread), `proactive` (Claude responded without being addressed), `scheduled` (a scheduled routine ran), `monitoring` (Claude watching a channel it was asked to monitor), or `dm` (direct messages with Claude). Populated only when `claude_tag_category` is in `group_by[]`; null for usage that is not Claude Tag. Direct-message usage is billed to the individual user and is reported under that user's product, not under `claude-tag`. New categories may be added over time.
6717
6718 - `"dm"`
6719
6720 - `"engaged"`
6721
6722 - `"monitoring"`
6723
6724 - `"proactive"`
6725
6726 - `"scheduled"`
6727
6728 - `claude_tag_user_id: string or null`
6729
6730 Slack user ID (for example `U0123ABCDEF`) of the member the Claude Tag (Claude in Slack) usage is attributed to, not a claude.ai user ID. Populated only when `claude_tag_user_id` is in `group_by[]`; null for usage that is not Claude Tag and for Claude Tag usage that is not attributed to a single user (for example `monitoring`, and `proactive` usage Claude initiated), so per-user rows can sum to less than the Claude Tag total. Cannot be combined with `group_by[]=rbac_group_id` or the `rbac_group_ids[]` filter.
65556731
65566732 - `context_window: "0-200k" or "200k-1M" or null`
65576733
from line 6849
66736849 "ephemeral_5m_input_tokens": 500
66746850 },
66756851 "cache_read_input_tokens": 3200000,
6852 "claude_tag_category": "dm",
6853 "claude_tag_user_id": "U0123ABCDEF",
66766854 "context_window": "0-200k",
66776855 "ending_at": "2019-12-27T18:11:19.117Z",
66786856 "inference_geo": "global",
from line 6909
67316909
67326910 - `"1m"`
67336911
6912- `claude_tag_categories: optional array of "dm" or "engaged" or "monitoring" or 2 more`
6913
6914 Filter to Claude Tag (Claude in Slack) usage in specific spend categories. Usage with no category never matches. `dm` usage is reported under the user's product rather than `claude-tag`, so combining this filter with `products[]=claude-tag` excludes it. Use `group_by[]=claude_tag_category` to break out per-category values.
6915
6916 maxItems: 100
6917
6918 - `"dm"`
6919
6920 - `"engaged"`
6921
6922 - `"monitoring"`
6923
6924 - `"proactive"`
6925
6926 - `"scheduled"`
6927
6928- `claude_tag_user_ids: optional array of string`
6929
6930 Filter to Claude Tag (Claude in Slack) usage attributed to specific Slack users, by Slack user ID (for example `U0123ABCDEF`), not claude.ai user ID. Usage that is not Claude Tag, and Claude Tag usage not attributed to a single user, never matches. Use `group_by[]=claude_tag_user_id` to break out per-user values.
6931
6932 maxItems: 100
6933
67346934- `context_windows: optional array of "0-200k" or "200k-1M"`
67356935
67366936 Filter to specific context-window pricing tiers. Use `group_by[]=context_window` to break out per-tier values.
from line 6947
67476947
67486948 format: date-time
67496949
6750- `group_by: optional array of "context_window" or "cost_type" or "inference_geo" or 6 more`
6950- `group_by: optional array of "claude_tag_category" or "claude_tag_user_id" or "context_window" or 8 more`
67516951
67526952 Dimensions to break each time bucket out by. Defaults to no grouping (one total per bucket). Each bucket reports at most its top 100 groups; a group beyond that cap has no row in that bucket (there is no remainder row), so grouped buckets are not exhaustive when a dimension has more than 100 distinct values.
67536953
67546954 maxItems: 100
67556955
6956 - `"claude_tag_category"`
6957
6958 - `"claude_tag_user_id"`
6959
67566960 - `"context_window"`
67576961
67586962 - `"cost_type"`
from line 7072
68687072 - `amount: string`
68697073
68707074 Amount (post-discount, pre-credit) in fractional cents.
7075
7076 - `claude_tag_category: "dm" or "engaged" or "monitoring" or 2 more or null`
7077
7078 Claude Tag (Claude in Slack) spend category: `engaged` (a person addressed Claude in a channel or thread), `proactive` (Claude responded without being addressed), `scheduled` (a scheduled routine ran), `monitoring` (Claude watching a channel it was asked to monitor), or `dm` (direct messages with Claude). Populated only when `claude_tag_category` is in `group_by[]`; null for usage that is not Claude Tag. Direct-message usage is billed to the individual user and is reported under that user's product, not under `claude-tag`. New categories may be added over time.
7079
7080 - `"dm"`
7081
7082 - `"engaged"`
7083
7084 - `"monitoring"`
7085
7086 - `"proactive"`
7087
7088 - `"scheduled"`
7089
7090 - `claude_tag_user_id: string or null`
7091
7092 Slack user ID (for example `U0123ABCDEF`) of the member the Claude Tag (Claude in Slack) usage is attributed to, not a claude.ai user ID. Populated only when `claude_tag_user_id` is in `group_by[]`; null for usage that is not Claude Tag and for Claude Tag usage that is not attributed to a single user (for example `monitoring`, and `proactive` usage Claude initiated), so per-user rows can sum to less than the Claude Tag total. Cannot be combined with `group_by[]=rbac_group_id` or the `rbac_group_ids[]` filter.
68717093
68727094 - `context_window: "0-200k" or "200k-1M" or null`
68737095
from line 7211
69897211 "results": [
69907212 {
69917213 "amount": "amount",
7214 "claude_tag_category": "dm",
7215 "claude_tag_user_id": "U0123ABCDEF",
69927216 "context_window": "0-200k",
69937217 "cost_type": "code_execution",
69947218 "currency": "USD",
from line 7269
70457269
70467270 - `"1m"`
70477271
7272- `claude_tag_categories: optional array of "dm" or "engaged" or "monitoring" or 2 more`
7273
7274 Filter to Claude Tag (Claude in Slack) usage in specific spend categories. Usage with no category never matches. `dm` usage is reported under the user's product rather than `claude-tag`, so combining this filter with `products[]=claude-tag` excludes it. Use `group_by[]=claude_tag_category` to break out per-category values.
7275
7276 maxItems: 100
7277
7278 - `"dm"`
7279
7280 - `"engaged"`
7281
7282 - `"monitoring"`
7283
7284 - `"proactive"`
7285
7286 - `"scheduled"`
7287
7288- `claude_tag_user_ids: optional array of string`
7289
7290 Filter to Claude Tag (Claude in Slack) usage attributed to specific Slack users, by Slack user ID (for example `U0123ABCDEF`), not claude.ai user ID. Usage that is not Claude Tag, and Claude Tag usage not attributed to a single user, never matches. Use `group_by[]=claude_tag_user_id` to break out per-user values.
7291
7292 maxItems: 100
7293
70487294- `context_windows: optional array of "0-200k" or "200k-1M"`
70497295
70507296 Filter to specific context-window pricing tiers. Use `group_by[]=context_window` to break out per-tier values.
from line 7313
70677313
70687314 default: false
70697315
7070- `group_by: optional array of "context_window" or "cost_type" or "inference_geo" or 6 more`
7316- `group_by: optional array of "claude_tag_category" or "claude_tag_user_id" or "context_window" or 8 more`
70717317
70727318 Break each actor's row out by the given dimensions. Accepts the same values as the bucketed `/cost_report` endpoint. The `product`, `model`, `context_window`, `inference_geo`, and `speed` dimensions — and the time bucket, when `bucket_width` is set — count toward `limit`. `cost_type` and `token_type` do not: `cost_type` returns one row per cost component (tokens, web search, code execution); `token_type` returns one row per token type, each with `cost_type: "tokens"`; combining both returns the per-token-type rows plus the web-search and code-execution rows. A page can therefore contain more rows than `limit` when `cost_type` or `token_type` is requested.
70737319
70747320 maxItems: 100
70757321
7322 - `"claude_tag_category"`
7323
7324 - `"claude_tag_user_id"`
7325
70767326 - `"context_window"`
70777327
70787328 - `"cost_type"`
from line 7472
72227472 - `amount: string`
72237473
72247474 Amount (post-discount, pre-credit) in fractional cents (minor units).
7475
7476 - `claude_tag_category: "dm" or "engaged" or "monitoring" or 2 more or null`
7477
7478 Claude Tag (Claude in Slack) spend category: `engaged` (a person addressed Claude in a channel or thread), `proactive` (Claude responded without being addressed), `scheduled` (a scheduled routine ran), `monitoring` (Claude watching a channel it was asked to monitor), or `dm` (direct messages with Claude). Populated only when `claude_tag_category` is in `group_by[]`; null for usage that is not Claude Tag. Direct-message usage is billed to the individual user and is reported under that user's product, not under `claude-tag`. New categories may be added over time.
7479
7480 - `"dm"`
7481
7482 - `"engaged"`
7483
7484 - `"monitoring"`
7485
7486 - `"proactive"`
7487
7488 - `"scheduled"`
7489
7490 - `claude_tag_user_id: string or null`
7491
7492 Slack user ID (for example `U0123ABCDEF`) of the member the Claude Tag (Claude in Slack) usage is attributed to, not a claude.ai user ID. Populated only when `claude_tag_user_id` is in `group_by[]`; null for usage that is not Claude Tag and for Claude Tag usage that is not attributed to a single user (for example `monitoring`, and `proactive` usage Claude initiated), so per-user rows can sum to less than the Claude Tag total. Cannot be combined with `group_by[]=rbac_group_id` or the `rbac_group_ids[]` filter.
72257493
72267494 - `context_window: "0-200k" or "200k-1M" or null`
72277495
from line 7621
73537621 "user_id": "user_01AbCdEfGhIjKlMnOpQrSt"
73547622 },
73557623 "amount": "41280.000000",
7624 "claude_tag_category": "dm",
7625 "claude_tag_user_id": "U0123ABCDEF",
73567626 "context_window": "0-200k",
73577627 "cost_type": "code_execution",
73587628 "currency": "USD",
from line 8365
80958365
80968366 - `skill_display_name: optional string or null`
80978367
8098 Human-readable display name for rows whose `skill_name` is an opaque skill id (user/organization skill types — user-defined names are withheld from the analytics pipeline). Only organization-shared skills resolve; the literal 'unknown' bucket row also gets a fixed 'Unknown skill' label. Null for private (user-defined) skills — their names are not disclosed to analytics-key holders — and null when `skill_name` is already a display name, when the skill was deleted, or when display-name resolution is not enabled for this organization.
8368 Human-readable display name for rows whose `skill_name` is an opaque skill id (user/organization skill types and plugin-delivered skills — user-defined names are withheld from the analytics pipeline). Organization-shared skills and skills delivered by the organization's own plugins (its plugin marketplaces and its library) resolve; plugin skill names are shown without their 'plugin:' prefix. The literal 'unknown' bucket row gets a fixed 'Unknown skill' label. Null for private (user-defined) skills and members' personal-plugin skills — those names are not disclosed to analytics-key holders — and for Anthropic-provided plugin skills (not resolved), and null when `skill_name` is already a display name, when the skill or plugin was deleted, or when display-name resolution is not enabled for this organization.
80998369
81008370 - `user_id: optional string or null`
81018371
from line 9301
90319301curl https://api.anthropic.com/v1/organizations/spend_limits \
90329302 -H 'Content-Type: application/json' \
90339303 -H 'anthropic-version: 2023-06-01' \
9034 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
9304 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
90359305 -d '{
90369306 "amount": "50000",
90379307 "scope": {
from line 9441
91719441```bash
91729442curl https://api.anthropic.com/v1/organizations/spend_limits/$SPEND_LIMIT_ID \
91739443 -H 'anthropic-version: 2023-06-01' \
9174 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
9444 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
91759445```
91769446
91779447##### Response (200)
from line 9492
92229492curl https://api.anthropic.com/v1/organizations/spend_limits/$SPEND_LIMIT_ID \
92239493 -X DELETE \
92249494 -H 'anthropic-version: 2023-06-01' \
9225 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
9495 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
92269496```
92279497
92289498##### Response (200)
from line 9671
94019671```bash
94029672curl https://api.anthropic.com/v1/organizations/spend_limits/effective \
94039673 -H 'anthropic-version: 2023-06-01' \
9404 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
9674 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
94059675```
94069676
94079677##### Response (200)
from line 9978
97089978```bash
97099979curl https://api.anthropic.com/v1/organizations/spend_limit_increase_requests \
97109980 -H 'anthropic-version: 2023-06-01' \
9711 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
9981 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
97129982```
97139983
97149984##### Response (200)
from line 10285
1001510285```bash
1001610286curl https://api.anthropic.com/v1/organizations/spend_limit_increase_requests/$SPEND_LIMIT_INCREASE_REQUEST_ID \
1001710287 -H 'anthropic-version: 2023-06-01' \
10018 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
10288 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
1001910289```
1002010290
1002110291##### Response (200)
from line 10696
1042610696curl https://api.anthropic.com/v1/organizations/spend_limit_increase_requests/$SPEND_LIMIT_INCREASE_REQUEST_ID/approve \
1042710697 -H 'Content-Type: application/json' \
1042810698 -H 'anthropic-version: 2023-06-01' \
10429 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
10699 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
1043010700 -d '{
1043110701 "amount": "50000",
1043210702 "period": "monthly"
from line 11020
1075011020curl https://api.anthropic.com/v1/organizations/spend_limit_increase_requests/$SPEND_LIMIT_INCREASE_REQUEST_ID/deny \
1075111021 -H 'Content-Type: application/json' \
1075211022 -H 'anthropic-version: 2023-06-01' \
10753 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
11023 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
1075411024 -d '{}'
1075511025```
1075611026
from line 11085
1081511085or an API-surface category such as the Files API or Message Batches)
1081611086and contains the set of limiter values that apply to it.
1081711087
11088When `limit` is omitted, every matching entry is returned in a single
11089page; when `limit` truncates the result, follow `next_page` to fetch
11090the remaining entries.
11091
1081811092#### Query parameters
1081911093
1082011094- `group_type: optional "batch" or "files" or "model_group" or 3 more`
from line 11107
1083311107
1083411108 - `"web_search"`
1083511109
11110- `limit: optional number`
11111
11112 Maximum number of items to return per page. Ranges from `1` to `1000`.
11113
11114 When omitted, every remaining entry is returned in a single page and `next_page` is `null`.
11115
11116 maximum: 1000, minimum: 1
11117
1083611118- `model: optional string`
1083711119
1083811120 Filter to the single entry containing this model. Accepts full model names and aliases. Returns 404 if the model is not found or has no rate limits for this organization.
from line 11173
1089111173
1089211174- `next_page: string or null`
1089311175
10894 Token to provide in as `page` in the subsequent request to retrieve the next page of data.
11176 Opaque cursor for the next page of results, or `null` when no entries remain beyond this response.
1089511177
1089611178#### Example
1089711179
1089811180```bash
1089911181curl https://api.anthropic.com/v1/organizations/rate_limits \
1090011182 -H 'anthropic-version: 2023-06-01' \
10901 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
11183 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
1090211184```
1090311185
1090411186##### Response (200)
from line 11213
1093111213
1093211214**POST** `/v1/organizations/service_accounts`
1093311215
11216**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
11217
1093411218Create a service account.
1093511219
1093611220A service account is a named workload identity that federation rules
1093711221target. `organization_role` is `developer` (default) or `admin`; a rule
1093811222may only be created or retargeted to grant `org:admin` scope when the
10939target's `organization_role` is `admin`. Requires an OAuth bearer (user
10940or WIF-minted service account token) or a Console session; Admin API
10941keys are not accepted. Creating an `admin`-role service account requires
10942an interactive credential (a user OAuth token or a Console session) — a
10943workload may only create `developer`-role service accounts.
11223target's `organization_role` is `admin`. Creating an `admin`-role service
11224account requires an interactive credential (a user OAuth token or a
11225Console session) — a workload may only create `developer`-role service
11226accounts.
1094411227
1094511228#### Headers
1094611229
from line 11324
1104111324curl https://api.anthropic.com/v1/organizations/service_accounts \
1104211325 -H 'Content-Type: application/json' \
1104311326 -H 'anthropic-version: 2023-06-01' \
11044 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
11327 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
1104511328 -d '{
1104611329 "name": "ci-deploy-bot"
1104711330 }'
from line 11352
1106911352
1107011353**GET** `/v1/organizations/service_accounts/{service_account_id}`
1107111354
11355**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
11356
1107211357Retrieve a service account by its ID (`svac_...`).
1107311358
1107411359#### Path parameters
from line 11438
1115311438```bash
1115411439curl https://api.anthropic.com/v1/organizations/service_accounts/$SERVICE_ACCOUNT_ID \
1115511440 -H 'anthropic-version: 2023-06-01' \
11156 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
11441 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
1115711442```
1115811443
1115911444##### Response (200)
from line 11463
1117811463
1117911464**GET** `/v1/organizations/service_accounts`
1118011465
11466**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
11467
1118111468List service accounts in the caller's organization.
1118211469
1118311470Results are ordered by creation time, newest first. Use `limit` and the
from line 11564
1127711564```bash
1127811565curl https://api.anthropic.com/v1/organizations/service_accounts \
1127911566 -H 'anthropic-version: 2023-06-01' \
11280 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
11567 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
1128111568```
1128211569
1128311570##### Response (200)
from line 11594
1130711594
1130811595**POST** `/v1/organizations/service_accounts/{service_account_id}`
1130911596
11597**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
11598
1131011599Update a service account.
1131111600
1131211601Only `description` and `organization_role` are mutable; `name` cannot be
1131311602changed. Archived service accounts cannot be updated; this returns 400.
1131411603Setting `organization_role` to `admin` (even when unchanged) requires an
11315interactive credential (a user OAuth token or a Console session). Admin
11316API keys are not accepted.
11604interactive credential (a user OAuth token or a Console session).
1131711605
1131811606#### Path parameters
1131911607
from line 11702
1141411702curl https://api.anthropic.com/v1/organizations/service_accounts/$SERVICE_ACCOUNT_ID \
1141511703 -H 'Content-Type: application/json' \
1141611704 -H 'anthropic-version: 2023-06-01' \
11417 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
11705 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
1141811706 -d '{}'
1141911707```
1142011708
from line 11728
1144011728
1144111729**POST** `/v1/organizations/service_accounts/{service_account_id}/archive`
1144211730
11731**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
11732
1144311733Archive a service account.
1144411734
1144511735Idempotent; re-archiving returns the service account with its original
from line 11737
1144711737rule still targets this service account, same as issuer archival; archive
1144811738those rules first or change their target to another service account.
1144911739
11450Requires an OAuth bearer or Console session; Admin API keys are not
11451accepted.
11452
1145311740#### Path parameters
1145411741
1145511742- `service_account_id: string`
from line 11820
1153311820curl https://api.anthropic.com/v1/organizations/service_accounts/$SERVICE_ACCOUNT_ID/archive \
1153411821 -X POST \
1153511822 -H 'anthropic-version: 2023-06-01' \
11536 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
11823 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
1153711824```
1153811825
1153911826##### Response (200)
from line 11847
1156011847
1156111848**POST** `/v1/organizations/service_accounts/{service_account_id}/workspaces`
1156211849
11850**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
11851
1156311852Add a service account to a workspace with the given `workspace_role`.
1156411853
1156511854Mirror of `POST /workspaces/{workspace_id}/service_accounts`, addressed
from line 11856
1156711856service account is already an explicit member of the workspace, its
1156811857`workspace_role` is replaced with the value supplied here. Archived
1156911858workspaces return 400. Archived service accounts cannot be added and are
11570rejected. Requires an OAuth bearer or Console session; Admin API keys
11571are not accepted.
11859rejected.
1157211860
1157311861#### Path parameters
1157411862
from line 11932
1164411932curl https://api.anthropic.com/v1/organizations/service_accounts/$SERVICE_ACCOUNT_ID/workspaces \
1164511933 -H 'Content-Type: application/json' \
1164611934 -H 'anthropic-version: 2023-06-01' \
11647 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
11935 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
1164811936 -d '{
1164911937 "workspace_id": "workspace_id",
1165011938 "workspace_role": "workspace_admin"
from line 11956
1166811956
1166911957**GET** `/v1/organizations/service_accounts/{service_account_id}/workspaces`
1167011958
11959**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
11960
1167111961List the workspaces a service account is a member of.
1167211962
1167311963Each entry includes the service account's `workspace_role` in that
from line 11967
1167711967the first page; with `limit=1` the first page may return up to 2 entries
1167811968(the implicit entry plus one explicit membership) so a pagination cursor
1167911969can be derived. Memberships are returned only while
11680the service account is active; an archived service account returns an
11681empty list.
11970the service account is active. Without a `page` cursor, an archived
11971service account returns an empty list. A `page` cursor that does not
11972match an active membership returns a 400 invalid-request error. A cursor
11973stops matching when the membership is removed, the workspace is deleted,
11974or the service account is archived. Restart pagination from the first
11975page to recover.
1168211976
1168311977#### Path parameters
1168411978
from line 12047
1175312047```bash
1175412048curl https://api.anthropic.com/v1/organizations/service_accounts/$SERVICE_ACCOUNT_ID/workspaces \
1175512049 -H 'anthropic-version: 2023-06-01' \
11756 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
12050 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
1175712051```
1175812052
1175912053##### Response (200)
from line 12072
1177812072
1177912073**DELETE** `/v1/organizations/service_accounts/{service_account_id}/workspaces/{workspace_id}`
1178012074
12075**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
12076
1178112077Remove a service account from a workspace.
1178212078
1178312079Mirror of `DELETE /workspaces/{workspace_id}/service_accounts/{service_account_id}`,
from line 12082
1178612082implicit default-workspace membership returns 200 but is a no-op and the
1178712083membership persists; deleting an explicit default-workspace row reverts
1178812084to the implicit `workspace_user` membership. Archived workspaces return
11789400. Requires an OAuth bearer or Console session; Admin API keys are not
11790accepted.
12085400.
1179112086
1179212087#### Path parameters
1179312088
from line 12122
1182712122curl https://api.anthropic.com/v1/organizations/service_accounts/$SERVICE_ACCOUNT_ID/workspaces/$WORKSPACE_ID \
1182812123 -X DELETE \
1182912124 -H 'anthropic-version: 2023-06-01' \
11830 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
12125 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
1183112126```
1183212127
1183312128##### Response (200)
from line 12140
1184512140### Create Federation Issuer
1184612141
1184712142**POST** `/v1/organizations/federation_issuers`
12143
12144**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
1184812145
1184912146Register an OIDC issuer that Anthropic will trust for workload identity
1185012147federation in your organization.
from line 12155
1185812155document; for `explicit_url` and `inline` modes the issuer URL is only
1185912156matched as the JWT's `iss` claim and is not fetched.
1186012157
11861Requires an OAuth bearer or Console session; Admin API keys are not
11862accepted.
11863
1186412158#### Headers
1186512159
1186612160- `"anthropic-beta": optional array of string`
from line 12386
1209212386curl https://api.anthropic.com/v1/organizations/federation_issuers \
1209312387 -H 'Content-Type: application/json' \
1209412388 -H 'anthropic-version: 2023-06-01' \
12095 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
12389 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
1209612390 -d '{
1209712391 "issuer_url": "x",
1209812392 "name": "x"
from line 12427
1213312427
1213412428**GET** `/v1/organizations/federation_issuers/{federation_issuer_id}`
1213512429
12430**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
12431
1213612432Retrieve a federation issuer by its ID (`fdis_...`).
1213712433
1213812434#### Path parameters
from line 12593
1229712593```bash
1229812594curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID \
1229912595 -H 'anthropic-version: 2023-06-01' \
12300 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
12596 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
1230112597```
1230212598
1230312599##### Response (200)
from line 12630
1233412630
1233512631**GET** `/v1/organizations/federation_issuers`
1233612632
12633**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
12634
1233712635List federation issuers in your organization.
1233812636
1233912637Archived issuers are excluded unless `include_archived=true`.
from line 12809
1251112809```bash
1251212810curl https://api.anthropic.com/v1/organizations/federation_issuers \
1251312811 -H 'anthropic-version: 2023-06-01' \
12514 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
12812 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
1251512813```
1251612814
1251712815##### Response (200)
from line 12851
1255312851
1255412852**POST** `/v1/organizations/federation_issuers/{federation_issuer_id}`
1255512853
12854**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
12855
1255612856Partially update a federation issuer.
1255712857
1255812858Setting `jwks` replaces the full JWKS shape at once. Archived issuers
from line 12860
1256012860
1256112861Updating an issuer that backs a rule with a scope outside
1256212862`workspace:developer` or `workspace:inference` requires a Console
12563session. Requires an OAuth bearer or Console session; Admin API keys
12564are not accepted.
12863session.
1256512864
1256612865#### Path parameters
1256712866
from line 13103
1280413103curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID \
1280513104 -H 'Content-Type: application/json' \
1280613105 -H 'anthropic-version: 2023-06-01' \
12807 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
13106 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
1280813107 -d '{}'
1280913108```
1281013109
from line 13141
1284213141
1284313142**POST** `/v1/organizations/federation_issuers/{federation_issuer_id}/archive`
1284413143
13144**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
13145
1284513146Archive a federation issuer.
1284613147
1284713148Idempotent; re-archiving returns the issuer with its original
from line 13150
1284913150rule still references the issuer; archive those rules first (a rule's
1285013151issuer cannot be changed), or recreate them against another issuer.
1285113152
12852Requires an OAuth bearer or Console session; Admin API keys are not
12853accepted.
12854
1285513153#### Path parameters
1285613154
1285713155- `federation_issuer_id: string`
from line 13313
1301513313curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID/archive \
1301613314 -X POST \
1301713315 -H 'anthropic-version: 2023-06-01' \
13018 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
13316 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
1301913317```
1302013318
1302113319##### Response (200)
from line 13352
1305413352
1305513353**POST** `/v1/organizations/federation_rules`
1305613354
13355**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
13356
1305713357Create a federation rule owned by your organization.
1305813358
1305913359The referenced issuer and the target service account must already exist
from line 13368
1306813368`repo:YOUR_ORG/...`), or a CEL condition referencing one of those
1306913369identity claims (e.g. `claims.repository_owner`). OAuth callers may only
1307013370manage rules whose `oauth_scope` is `workspace:developer` or
13071`workspace:inference`; other scopes require a Console session. Admin API
13072keys are not accepted.
13371`workspace:inference`; other scopes require a Console session.
1307313372
1307413373#### Headers
1307513374
from line 13599
1330013599curl https://api.anthropic.com/v1/organizations/federation_rules \
1330113600 -H 'Content-Type: application/json' \
1330213601 -H 'anthropic-version: 2023-06-01' \
13303 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
13602 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
1330413603 -d '{
1330513604 "issuer_id": "issuer_id",
1330613605 "match": {},
from line 13658
1335913658
1336013659**GET** `/v1/organizations/federation_rules/{federation_rule_id}`
1336113660
13661**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
13662
1336213663Retrieve a federation rule by its ID (`fdrl_...`).
1336313664
1336413665#### Path parameters
from line 13814
1351313814```bash
1351413815curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID \
1351513816 -H 'anthropic-version: 2023-06-01' \
13516 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
13817 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
1351713818```
1351813819
1351913820##### Response (200)
from line 13863
1356213863
1356313864**GET** `/v1/organizations/federation_rules`
1356413865
13866**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
13867
1356513868List federation rules in your organization.
1356613869
1356713870Optionally filter by issuer with `issuer_id`. Archived rules are excluded
from line 14031
1372814031```bash
1372914032curl https://api.anthropic.com/v1/organizations/federation_rules \
1373014033 -H 'anthropic-version: 2023-06-01' \
13731 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
14034 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
1373214035```
1373314036
1373414037##### Response (200)
from line 14085
1378214085
1378314086**POST** `/v1/organizations/federation_rules/{federation_rule_id}`
1378414087
14088**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
14089
1378514090Partially update a federation rule.
1378614091
1378714092`issuer_id` is immutable. `match` and `target` are replaced as whole
from line 14103
1379814103or description change) must also supply a conforming `match` in the same
1379914104request. OAuth callers may only manage rules whose `oauth_scope` is
1380014105`workspace:developer` or `workspace:inference`; other scopes require a
13801Console session. Admin API keys are not accepted.
14106Console session.
1380214107
1380314108#### Path parameters
1380414109
from line 14340
1403514340curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID \
1403614341 -H 'Content-Type: application/json' \
1403714342 -H 'anthropic-version: 2023-06-01' \
14038 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
14343 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
1403914344 -d '{}'
1404014345```
1404114346
from line 14390
1408514390
1408614391**POST** `/v1/organizations/federation_rules/{federation_rule_id}/archive`
1408714392
14393**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
14394
1408814395Archive a federation rule.
1408914396
1409014397Token exchange through this rule stops immediately. Idempotent;
from line 14400
1409314400`workspace_ids` are emptied). Tokens already minted before archive
1409414401remain valid until they expire. OAuth callers may only manage rules
1409514402whose `oauth_scope` is `workspace:developer` or `workspace:inference`;
14096other scopes require a Console session. Admin API keys are not accepted.
14403other scopes require a Console session.
1409714404
1409814405#### Path parameters
1409914406
from line 14555
1424814555curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/archive \
1424914556 -X POST \
1425014557 -H 'anthropic-version: 2023-06-01' \
14251 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
14558 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
1425214559```
1425314560
1425414561##### Response (200)
from line 14606
1429914606
1430014607**GET** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
1430114608
14609**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
14610
1430214611List workspaces where this federation rule is enabled.
1430314612
1430414613Returns all workspace enablements in a single response; the `limit` and
from line 14681
1437214681```bash
1437314682curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \
1437414683 -H 'anthropic-version: 2023-06-01' \
14375 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
14684 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
1437614685```
1437714686
1437814687##### Response (200)
from line 14706
1439714706
1439814707**POST** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
1439914708
14709**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
14710
1440014711Enable a federation rule for a workspace.
1440114712
1440214713Idempotent; re-enabling returns the existing enablement. The rule and
from line 14715
1440414715rule's target service account in this workspace is not checked at
1440514716enablement: token exchange into this workspace is rejected unless the
1440614717target is a member (it is implicitly a member of the default workspace).
14407Archived rules are rejected with 400. OAuth callers may only manage rules whose
14408`oauth_scope` is `workspace:developer` or `workspace:inference`; other
14409scopes require a Console session. Admin API keys are not accepted.
14718Archived rules are rejected with 400. OAuth callers may only manage rules
14719whose `oauth_scope` is `workspace:developer` or `workspace:inference`;
14720other scopes require a Console session.
1441014721
1441114722#### Path parameters
1441214723
from line 14773
1446214773curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \
1446314774 -H 'Content-Type: application/json' \
1446414775 -H 'anthropic-version: 2023-06-01' \
14465 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
14776 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
1446614777 -d '{
1446714778 "workspace_id": "workspace_id"
1446814779 }'
from line 14796
1448514796
1448614797**DELETE** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}`
1448714798
14799**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
14800
1448814801Disable a federation rule for a workspace.
1448914802
1449014803Idempotent; succeeds even if the enablement was already removed. OAuth
1449114804callers may only manage rules whose `oauth_scope` is
1449214805`workspace:developer` or `workspace:inference`; other scopes require a
14493Console session. Admin API keys are not accepted.
14806Console session.
1449414807
1449514808#### Path parameters
1449614809
from line 14843
1453014843curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces/$WORKSPACE_ID \
1453114844 -X DELETE \
1453214845 -H 'anthropic-version: 2023-06-01' \
14533 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
14846 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
1453414847```
1453514848
1453614849##### Response (200)
from line 14925
1461214925```bash
1461314926curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID \
1461414927 -H 'anthropic-version: 2023-06-01' \
14615 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
14928 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
1461614929```
1461714930
1461814931##### Response (200)
from line 15038
1472515038```bash
1472615039curl https://api.anthropic.com/v1/organizations/tunnels \
1472715040 -H 'anthropic-version: 2023-06-01' \
14728 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
15041 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
1472915042```
1473015043
1473115044##### Response (200)
from line 15110
1479715110curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/reveal_token \
1479815111 -X POST \
1479915112 -H 'anthropic-version: 2023-06-01' \
14800 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
15113 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
1480115114```
1480215115
1480315116##### Response (200)
from line 15180
1486715180curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/rotate_token \
1486815181 -X POST \
1486915182 -H 'anthropic-version: 2023-06-01' \
14870 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
15183 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
1487115184```
1487215185
1487315186##### Response (200)
from line 15266
1495315266curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/archive \
1495415267 -X POST \
1495515268 -H 'anthropic-version: 2023-06-01' \
14956 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
15269 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
1495715270```
1495815271
1495915272##### Response (200)
from line 15367
1505415367curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \
1505515368 -H 'Content-Type: application/json' \
1505615369 -H 'anthropic-version: 2023-06-01' \
15057 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
15370 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
1505815371 -d '{
1505915372 "ca_certificate_pem": "-----BEGIN CERTIFICATE-----\nMIIBexampleEXAMPLEexampleEXAMPLEexampleEXAMPLEexampleEXAMPLEexa\n...illustrative placeholder, not a real certificate...\n-----END CERTIFICATE-----\n"
1506015373 }'
from line 15458
1514515458```bash
1514615459curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID \
1514715460 -H 'anthropic-version: 2023-06-01' \
15148 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
15461 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
1514915462```
1515015463
1515115464##### Response (200)
from line 15570
1525715570```bash
1525815571curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \
1525915572 -H 'anthropic-version: 2023-06-01' \
15260 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
15573 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
1526115574```
1526215575
1526315576##### Response (200)
from line 15668
1535515668curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID/archive \
1535615669 -X POST \
1535715670 -H 'anthropic-version: 2023-06-01' \
15358 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
15671 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
1535915672```
1536015673
1536115674##### Response (200)
1536215675
api/admin/analytics Changed · +189 / -5 lines
from line 482
482482
483483 - `"1m"`
484484
485- `claude_tag_categories: optional array of "dm" or "engaged" or "monitoring" or 2 more`
486
487 Filter to Claude Tag (Claude in Slack) usage in specific spend categories. Usage with no category never matches. `dm` usage is reported under the user's product rather than `claude-tag`, so combining this filter with `products[]=claude-tag` excludes it. Use `group_by[]=claude_tag_category` to break out per-category values.
488
489 maxItems: 100
490
491 - `"dm"`
492
493 - `"engaged"`
494
495 - `"monitoring"`
496
497 - `"proactive"`
498
499 - `"scheduled"`
500
501- `claude_tag_user_ids: optional array of string`
502
503 Filter to Claude Tag (Claude in Slack) usage attributed to specific Slack users, by Slack user ID (for example `U0123ABCDEF`), not claude.ai user ID. Usage that is not Claude Tag, and Claude Tag usage not attributed to a single user, never matches. Use `group_by[]=claude_tag_user_id` to break out per-user values.
504
505 maxItems: 100
506
485507- `context_windows: optional array of "0-200k" or "200k-1M"`
486508
487509 Filter to specific context-window pricing tiers. Use `group_by[]=context_window` to break out per-tier values.
from line 520
498520
499521 format: date-time
500522
501- `group_by: optional array of "context_window" or "inference_geo" or "model" or 4 more`
523- `group_by: optional array of "claude_tag_category" or "claude_tag_user_id" or "context_window" or 6 more`
502524
503525 Dimensions to break each time bucket out by. Defaults to no grouping (one total per bucket). Each bucket reports at most its top 100 groups; a group beyond that cap has no row in that bucket (there is no remainder row), so grouped buckets are not exhaustive when a dimension has more than 100 distinct values.
504526
505527 maxItems: 100
506528
529 - `"claude_tag_category"`
530
531 - `"claude_tag_user_id"`
532
507533 - `"context_window"`
508534
509535 - `"inference_geo"`
from line 654
628654
629655 The number of input tokens read from the cache.
630656
657 - `claude_tag_category: "dm" or "engaged" or "monitoring" or 2 more or null`
658
659 Claude Tag (Claude in Slack) spend category: `engaged` (a person addressed Claude in a channel or thread), `proactive` (Claude responded without being addressed), `scheduled` (a scheduled routine ran), `monitoring` (Claude watching a channel it was asked to monitor), or `dm` (direct messages with Claude). Populated only when `claude_tag_category` is in `group_by[]`; null for usage that is not Claude Tag. Direct-message usage is billed to the individual user and is reported under that user's product, not under `claude-tag`. New categories may be added over time.
660
661 - `"dm"`
662
663 - `"engaged"`
664
665 - `"monitoring"`
666
667 - `"proactive"`
668
669 - `"scheduled"`
670
671 - `claude_tag_user_id: string or null`
672
673 Slack user ID (for example `U0123ABCDEF`) of the member the Claude Tag (Claude in Slack) usage is attributed to, not a claude.ai user ID. Populated only when `claude_tag_user_id` is in `group_by[]`; null for usage that is not Claude Tag and for Claude Tag usage that is not attributed to a single user (for example `monitoring`, and `proactive` usage Claude initiated), so per-user rows can sum to less than the Claude Tag total. Cannot be combined with `group_by[]=rbac_group_id` or the `rbac_group_ids[]` filter.
674
631675 - `context_window: "0-200k" or "200k-1M" or null`
632676
633677 Context-window pricing tier of the usage or cost. Null unless `context_window` is in `group_by[]`; it can also be null on grouped rows with no context-window tier, such as code execution.
from line 778
734778 "ephemeral_5m_input_tokens": 500
735779 },
736780 "cache_read_input_tokens": 0,
781 "claude_tag_category": "dm",
782 "claude_tag_user_id": "U0123ABCDEF",
737783 "context_window": "0-200k",
738784 "inference_geo": "global",
739785 "model": "claude-opus-5",
from line 837
791837
792838 - `"1m"`
793839
840- `claude_tag_categories: optional array of "dm" or "engaged" or "monitoring" or 2 more`
841
842 Filter to Claude Tag (Claude in Slack) usage in specific spend categories. Usage with no category never matches. `dm` usage is reported under the user's product rather than `claude-tag`, so combining this filter with `products[]=claude-tag` excludes it. Use `group_by[]=claude_tag_category` to break out per-category values.
843
844 maxItems: 100
845
846 - `"dm"`
847
848 - `"engaged"`
849
850 - `"monitoring"`
851
852 - `"proactive"`
853
854 - `"scheduled"`
855
856- `claude_tag_user_ids: optional array of string`
857
858 Filter to Claude Tag (Claude in Slack) usage attributed to specific Slack users, by Slack user ID (for example `U0123ABCDEF`), not claude.ai user ID. Usage that is not Claude Tag, and Claude Tag usage not attributed to a single user, never matches. Use `group_by[]=claude_tag_user_id` to break out per-user values.
859
860 maxItems: 100
861
794862- `context_windows: optional array of "0-200k" or "200k-1M"`
795863
796864 Filter to specific context-window pricing tiers. Use `group_by[]=context_window` to break out per-tier values.
from line 881
813881
814882 default: false
815883
816- `group_by: optional array of "context_window" or "inference_geo" or "model" or 4 more`
884- `group_by: optional array of "claude_tag_category" or "claude_tag_user_id" or "context_window" or 6 more`
817885
818886 Break each actor's row out by the given dimensions. Accepts the same values as the bucketed `/usage_report` endpoint. `limit` bounds (actor × time bucket × dimension) rows — with dimensions or `bucket_width` present, one actor may span several rows.
819887
820888 maxItems: 100
821889
890 - `"claude_tag_category"`
891
892 - `"claude_tag_user_id"`
893
822894 - `"context_window"`
823895
824896 - `"inference_geo"`
from line 1053
9811053
9821054 The number of input tokens read from the cache.
9831055
1056 - `claude_tag_category: "dm" or "engaged" or "monitoring" or 2 more or null`
1057
1058 Claude Tag (Claude in Slack) spend category: `engaged` (a person addressed Claude in a channel or thread), `proactive` (Claude responded without being addressed), `scheduled` (a scheduled routine ran), `monitoring` (Claude watching a channel it was asked to monitor), or `dm` (direct messages with Claude). Populated only when `claude_tag_category` is in `group_by[]`; null for usage that is not Claude Tag. Direct-message usage is billed to the individual user and is reported under that user's product, not under `claude-tag`. New categories may be added over time.
1059
1060 - `"dm"`
1061
1062 - `"engaged"`
1063
1064 - `"monitoring"`
1065
1066 - `"proactive"`
1067
1068 - `"scheduled"`
1069
1070 - `claude_tag_user_id: string or null`
1071
1072 Slack user ID (for example `U0123ABCDEF`) of the member the Claude Tag (Claude in Slack) usage is attributed to, not a claude.ai user ID. Populated only when `claude_tag_user_id` is in `group_by[]`; null for usage that is not Claude Tag and for Claude Tag usage that is not attributed to a single user (for example `monitoring`, and `proactive` usage Claude initiated), so per-user rows can sum to less than the Claude Tag total. Cannot be combined with `group_by[]=rbac_group_id` or the `rbac_group_ids[]` filter.
1073
9841074 - `context_window: "0-200k" or "200k-1M" or null`
9851075
9861076 Context-window pricing tier of the usage or cost. Null unless `context_window` is in `group_by[]`; it can also be null on grouped rows with no context-window tier, such as code execution.
from line 1191
11011191 "ephemeral_5m_input_tokens": 500
11021192 },
11031193 "cache_read_input_tokens": 3200000,
1194 "claude_tag_category": "dm",
1195 "claude_tag_user_id": "U0123ABCDEF",
11041196 "context_window": "0-200k",
11051197 "ending_at": "2019-12-27T18:11:19.117Z",
11061198 "inference_geo": "global",
from line 1251
11591251
11601252 - `"1m"`
11611253
1254- `claude_tag_categories: optional array of "dm" or "engaged" or "monitoring" or 2 more`
1255
1256 Filter to Claude Tag (Claude in Slack) usage in specific spend categories. Usage with no category never matches. `dm` usage is reported under the user's product rather than `claude-tag`, so combining this filter with `products[]=claude-tag` excludes it. Use `group_by[]=claude_tag_category` to break out per-category values.
1257
1258 maxItems: 100
1259
1260 - `"dm"`
1261
1262 - `"engaged"`
1263
1264 - `"monitoring"`
1265
1266 - `"proactive"`
1267
1268 - `"scheduled"`
1269
1270- `claude_tag_user_ids: optional array of string`
1271
1272 Filter to Claude Tag (Claude in Slack) usage attributed to specific Slack users, by Slack user ID (for example `U0123ABCDEF`), not claude.ai user ID. Usage that is not Claude Tag, and Claude Tag usage not attributed to a single user, never matches. Use `group_by[]=claude_tag_user_id` to break out per-user values.
1273
1274 maxItems: 100
1275
11621276- `context_windows: optional array of "0-200k" or "200k-1M"`
11631277
11641278 Filter to specific context-window pricing tiers. Use `group_by[]=context_window` to break out per-tier values.
from line 1289
11751289
11761290 format: date-time
11771291
1178- `group_by: optional array of "context_window" or "cost_type" or "inference_geo" or 6 more`
1292- `group_by: optional array of "claude_tag_category" or "claude_tag_user_id" or "context_window" or 8 more`
11791293
11801294 Dimensions to break each time bucket out by. Defaults to no grouping (one total per bucket). Each bucket reports at most its top 100 groups; a group beyond that cap has no row in that bucket (there is no remainder row), so grouped buckets are not exhaustive when a dimension has more than 100 distinct values.
11811295
11821296 maxItems: 100
11831297
1298 - `"claude_tag_category"`
1299
1300 - `"claude_tag_user_id"`
1301
11841302 - `"context_window"`
11851303
11861304 - `"cost_type"`
from line 1415
12971415
12981416 Amount (post-discount, pre-credit) in fractional cents.
12991417
1418 - `claude_tag_category: "dm" or "engaged" or "monitoring" or 2 more or null`
1419
1420 Claude Tag (Claude in Slack) spend category: `engaged` (a person addressed Claude in a channel or thread), `proactive` (Claude responded without being addressed), `scheduled` (a scheduled routine ran), `monitoring` (Claude watching a channel it was asked to monitor), or `dm` (direct messages with Claude). Populated only when `claude_tag_category` is in `group_by[]`; null for usage that is not Claude Tag. Direct-message usage is billed to the individual user and is reported under that user's product, not under `claude-tag`. New categories may be added over time.
1421
1422 - `"dm"`
1423
1424 - `"engaged"`
1425
1426 - `"monitoring"`
1427
1428 - `"proactive"`
1429
1430 - `"scheduled"`
1431
1432 - `claude_tag_user_id: string or null`
1433
1434 Slack user ID (for example `U0123ABCDEF`) of the member the Claude Tag (Claude in Slack) usage is attributed to, not a claude.ai user ID. Populated only when `claude_tag_user_id` is in `group_by[]`; null for usage that is not Claude Tag and for Claude Tag usage that is not attributed to a single user (for example `monitoring`, and `proactive` usage Claude initiated), so per-user rows can sum to less than the Claude Tag total. Cannot be combined with `group_by[]=rbac_group_id` or the `rbac_group_ids[]` filter.
1435
13001436 - `context_window: "0-200k" or "200k-1M" or null`
13011437
13021438 Context-window pricing tier of the usage or cost. Null unless `context_window` is in `group_by[]`; it can also be null on grouped rows with no context-window tier, such as code execution.
from line 1553
14171553 "results": [
14181554 {
14191555 "amount": "amount",
1556 "claude_tag_category": "dm",
1557 "claude_tag_user_id": "U0123ABCDEF",
14201558 "context_window": "0-200k",
14211559 "cost_type": "code_execution",
14221560 "currency": "USD",
from line 1611
14731611
14741612 - `"1m"`
14751613
1614- `claude_tag_categories: optional array of "dm" or "engaged" or "monitoring" or 2 more`
1615
1616 Filter to Claude Tag (Claude in Slack) usage in specific spend categories. Usage with no category never matches. `dm` usage is reported under the user's product rather than `claude-tag`, so combining this filter with `products[]=claude-tag` excludes it. Use `group_by[]=claude_tag_category` to break out per-category values.
1617
1618 maxItems: 100
1619
1620 - `"dm"`
1621
1622 - `"engaged"`
1623
1624 - `"monitoring"`
1625
1626 - `"proactive"`
1627
1628 - `"scheduled"`
1629
1630- `claude_tag_user_ids: optional array of string`
1631
1632 Filter to Claude Tag (Claude in Slack) usage attributed to specific Slack users, by Slack user ID (for example `U0123ABCDEF`), not claude.ai user ID. Usage that is not Claude Tag, and Claude Tag usage not attributed to a single user, never matches. Use `group_by[]=claude_tag_user_id` to break out per-user values.
1633
1634 maxItems: 100
1635
14761636- `context_windows: optional array of "0-200k" or "200k-1M"`
14771637
14781638 Filter to specific context-window pricing tiers. Use `group_by[]=context_window` to break out per-tier values.
from line 1655
14951655
14961656 default: false
14971657
1498- `group_by: optional array of "context_window" or "cost_type" or "inference_geo" or 6 more`
1658- `group_by: optional array of "claude_tag_category" or "claude_tag_user_id" or "context_window" or 8 more`
14991659
15001660 Break each actor's row out by the given dimensions. Accepts the same values as the bucketed `/cost_report` endpoint. The `product`, `model`, `context_window`, `inference_geo`, and `speed` dimensions — and the time bucket, when `bucket_width` is set — count toward `limit`. `cost_type` and `token_type` do not: `cost_type` returns one row per cost component (tokens, web search, code execution); `token_type` returns one row per token type, each with `cost_type: "tokens"`; combining both returns the per-token-type rows plus the web-search and code-execution rows. A page can therefore contain more rows than `limit` when `cost_type` or `token_type` is requested.
15011661
15021662 maxItems: 100
15031663
1664 - `"claude_tag_category"`
1665
1666 - `"claude_tag_user_id"`
1667
15041668 - `"context_window"`
15051669
15061670 - `"cost_type"`
from line 1815
16511815
16521816 Amount (post-discount, pre-credit) in fractional cents (minor units).
16531817
1818 - `claude_tag_category: "dm" or "engaged" or "monitoring" or 2 more or null`
1819
1820 Claude Tag (Claude in Slack) spend category: `engaged` (a person addressed Claude in a channel or thread), `proactive` (Claude responded without being addressed), `scheduled` (a scheduled routine ran), `monitoring` (Claude watching a channel it was asked to monitor), or `dm` (direct messages with Claude). Populated only when `claude_tag_category` is in `group_by[]`; null for usage that is not Claude Tag. Direct-message usage is billed to the individual user and is reported under that user's product, not under `claude-tag`. New categories may be added over time.
1821
1822 - `"dm"`
1823
1824 - `"engaged"`
1825
1826 - `"monitoring"`
1827
1828 - `"proactive"`
1829
1830 - `"scheduled"`
1831
1832 - `claude_tag_user_id: string or null`
1833
1834 Slack user ID (for example `U0123ABCDEF`) of the member the Claude Tag (Claude in Slack) usage is attributed to, not a claude.ai user ID. Populated only when `claude_tag_user_id` is in `group_by[]`; null for usage that is not Claude Tag and for Claude Tag usage that is not attributed to a single user (for example `monitoring`, and `proactive` usage Claude initiated), so per-user rows can sum to less than the Claude Tag total. Cannot be combined with `group_by[]=rbac_group_id` or the `rbac_group_ids[]` filter.
1835
16541836 - `context_window: "0-200k" or "200k-1M" or null`
16551837
16561838 Context-window pricing tier of the usage or cost. Null unless `context_window` is in `group_by[]`; it can also be null on grouped rows with no context-window tier, such as code execution.
from line 1963
17811963 "user_id": "user_01AbCdEfGhIjKlMnOpQrSt"
17821964 },
17831965 "amount": "41280.000000",
1966 "claude_tag_category": "dm",
1967 "claude_tag_user_id": "U0123ABCDEF",
17841968 "context_window": "0-200k",
17851969 "cost_type": "code_execution",
17861970 "currency": "USD",
from line 2707
25232707
25242708 - `skill_display_name: optional string or null`
25252709
2526 Human-readable display name for rows whose `skill_name` is an opaque skill id (user/organization skill types — user-defined names are withheld from the analytics pipeline). Only organization-shared skills resolve; the literal 'unknown' bucket row also gets a fixed 'Unknown skill' label. Null for private (user-defined) skills — their names are not disclosed to analytics-key holders — and null when `skill_name` is already a display name, when the skill was deleted, or when display-name resolution is not enabled for this organization.
2710 Human-readable display name for rows whose `skill_name` is an opaque skill id (user/organization skill types and plugin-delivered skills — user-defined names are withheld from the analytics pipeline). Organization-shared skills and skills delivered by the organization's own plugins (its plugin marketplaces and its library) resolve; plugin skill names are shown without their 'plugin:' prefix. The literal 'unknown' bucket row gets a fixed 'Unknown skill' label. Null for private (user-defined) skills and members' personal-plugin skills — those names are not disclosed to analytics-key holders — and for Anthropic-provided plugin skills (not resolved), and null when `skill_name` is already a display name, when the skill or plugin was deleted, or when display-name resolution is not enabled for this organization.
25272711
25282712 - `user_id: optional string or null`
25292713
api/admin/analytics/cost Changed · +130 / -2 lines
from line 31
3131
3232 - `"1m"`
3333
34- `claude_tag_categories: optional array of "dm" or "engaged" or "monitoring" or 2 more`
35
36 Filter to Claude Tag (Claude in Slack) usage in specific spend categories. Usage with no category never matches. `dm` usage is reported under the user's product rather than `claude-tag`, so combining this filter with `products[]=claude-tag` excludes it. Use `group_by[]=claude_tag_category` to break out per-category values.
37
38 maxItems: 100
39
40 - `"dm"`
41
42 - `"engaged"`
43
44 - `"monitoring"`
45
46 - `"proactive"`
47
48 - `"scheduled"`
49
50- `claude_tag_user_ids: optional array of string`
51
52 Filter to Claude Tag (Claude in Slack) usage attributed to specific Slack users, by Slack user ID (for example `U0123ABCDEF`), not claude.ai user ID. Usage that is not Claude Tag, and Claude Tag usage not attributed to a single user, never matches. Use `group_by[]=claude_tag_user_id` to break out per-user values.
53
54 maxItems: 100
55
3456- `context_windows: optional array of "0-200k" or "200k-1M"`
3557
3658 Filter to specific context-window pricing tiers. Use `group_by[]=context_window` to break out per-tier values.
from line 69
4769
4870 format: date-time
4971
50- `group_by: optional array of "context_window" or "cost_type" or "inference_geo" or 6 more`
72- `group_by: optional array of "claude_tag_category" or "claude_tag_user_id" or "context_window" or 8 more`
5173
5274 Dimensions to break each time bucket out by. Defaults to no grouping (one total per bucket). Each bucket reports at most its top 100 groups; a group beyond that cap has no row in that bucket (there is no remainder row), so grouped buckets are not exhaustive when a dimension has more than 100 distinct values.
5375
5476 maxItems: 100
5577
78 - `"claude_tag_category"`
79
80 - `"claude_tag_user_id"`
81
5682 - `"context_window"`
5783
5884 - `"cost_type"`
from line 195
169195
170196 Amount (post-discount, pre-credit) in fractional cents.
171197
198 - `claude_tag_category: "dm" or "engaged" or "monitoring" or 2 more or null`
199
200 Claude Tag (Claude in Slack) spend category: `engaged` (a person addressed Claude in a channel or thread), `proactive` (Claude responded without being addressed), `scheduled` (a scheduled routine ran), `monitoring` (Claude watching a channel it was asked to monitor), or `dm` (direct messages with Claude). Populated only when `claude_tag_category` is in `group_by[]`; null for usage that is not Claude Tag. Direct-message usage is billed to the individual user and is reported under that user's product, not under `claude-tag`. New categories may be added over time.
201
202 - `"dm"`
203
204 - `"engaged"`
205
206 - `"monitoring"`
207
208 - `"proactive"`
209
210 - `"scheduled"`
211
212 - `claude_tag_user_id: string or null`
213
214 Slack user ID (for example `U0123ABCDEF`) of the member the Claude Tag (Claude in Slack) usage is attributed to, not a claude.ai user ID. Populated only when `claude_tag_user_id` is in `group_by[]`; null for usage that is not Claude Tag and for Claude Tag usage that is not attributed to a single user (for example `monitoring`, and `proactive` usage Claude initiated), so per-user rows can sum to less than the Claude Tag total. Cannot be combined with `group_by[]=rbac_group_id` or the `rbac_group_ids[]` filter.
215
172216 - `context_window: "0-200k" or "200k-1M" or null`
173217
174218 Context-window pricing tier of the usage or cost. Null unless `context_window` is in `group_by[]`; it can also be null on grouped rows with no context-window tier, such as code execution.
from line 333
289333 "results": [
290334 {
291335 "amount": "amount",
336 "claude_tag_category": "dm",
337 "claude_tag_user_id": "U0123ABCDEF",
292338 "context_window": "0-200k",
293339 "cost_type": "code_execution",
294340 "currency": "USD",
from line 391
345391
346392 - `"1m"`
347393
394- `claude_tag_categories: optional array of "dm" or "engaged" or "monitoring" or 2 more`
395
396 Filter to Claude Tag (Claude in Slack) usage in specific spend categories. Usage with no category never matches. `dm` usage is reported under the user's product rather than `claude-tag`, so combining this filter with `products[]=claude-tag` excludes it. Use `group_by[]=claude_tag_category` to break out per-category values.
397
398 maxItems: 100
399
400 - `"dm"`
401
402 - `"engaged"`
403
404 - `"monitoring"`
405
406 - `"proactive"`
407
408 - `"scheduled"`
409
410- `claude_tag_user_ids: optional array of string`
411
412 Filter to Claude Tag (Claude in Slack) usage attributed to specific Slack users, by Slack user ID (for example `U0123ABCDEF`), not claude.ai user ID. Usage that is not Claude Tag, and Claude Tag usage not attributed to a single user, never matches. Use `group_by[]=claude_tag_user_id` to break out per-user values.
413
414 maxItems: 100
415
348416- `context_windows: optional array of "0-200k" or "200k-1M"`
349417
350418 Filter to specific context-window pricing tiers. Use `group_by[]=context_window` to break out per-tier values.
from line 435
367435
368436 default: false
369437
370- `group_by: optional array of "context_window" or "cost_type" or "inference_geo" or 6 more`
438- `group_by: optional array of "claude_tag_category" or "claude_tag_user_id" or "context_window" or 8 more`
371439
372440 Break each actor's row out by the given dimensions. Accepts the same values as the bucketed `/cost_report` endpoint. The `product`, `model`, `context_window`, `inference_geo`, and `speed` dimensions — and the time bucket, when `bucket_width` is set — count toward `limit`. `cost_type` and `token_type` do not: `cost_type` returns one row per cost component (tokens, web search, code execution); `token_type` returns one row per token type, each with `cost_type: "tokens"`; combining both returns the per-token-type rows plus the web-search and code-execution rows. A page can therefore contain more rows than `limit` when `cost_type` or `token_type` is requested.
373441
374442 maxItems: 100
375443
444 - `"claude_tag_category"`
445
446 - `"claude_tag_user_id"`
447
376448 - `"context_window"`
377449
378450 - `"cost_type"`
from line 595
523595
524596 Amount (post-discount, pre-credit) in fractional cents (minor units).
525597
598 - `claude_tag_category: "dm" or "engaged" or "monitoring" or 2 more or null`
599
600 Claude Tag (Claude in Slack) spend category: `engaged` (a person addressed Claude in a channel or thread), `proactive` (Claude responded without being addressed), `scheduled` (a scheduled routine ran), `monitoring` (Claude watching a channel it was asked to monitor), or `dm` (direct messages with Claude). Populated only when `claude_tag_category` is in `group_by[]`; null for usage that is not Claude Tag. Direct-message usage is billed to the individual user and is reported under that user's product, not under `claude-tag`. New categories may be added over time.
601
602 - `"dm"`
603
604 - `"engaged"`
605
606 - `"monitoring"`
607
608 - `"proactive"`
609
610 - `"scheduled"`
611
612 - `claude_tag_user_id: string or null`
613
614 Slack user ID (for example `U0123ABCDEF`) of the member the Claude Tag (Claude in Slack) usage is attributed to, not a claude.ai user ID. Populated only when `claude_tag_user_id` is in `group_by[]`; null for usage that is not Claude Tag and for Claude Tag usage that is not attributed to a single user (for example `monitoring`, and `proactive` usage Claude initiated), so per-user rows can sum to less than the Claude Tag total. Cannot be combined with `group_by[]=rbac_group_id` or the `rbac_group_ids[]` filter.
615
526616 - `context_window: "0-200k" or "200k-1M" or null`
527617
528618 Context-window pricing tier of the usage or cost. Null unless `context_window` is in `group_by[]`; it can also be null on grouped rows with no context-window tier, such as code execution.
from line 743
653743 "user_id": "user_01AbCdEfGhIjKlMnOpQrSt"
654744 },
655745 "amount": "41280.000000",
746 "claude_tag_category": "dm",
747 "claude_tag_user_id": "U0123ABCDEF",
656748 "context_window": "0-200k",
657749 "cost_type": "code_execution",
658750 "currency": "USD",
from line 792
700792
701793 Amount (post-discount, pre-credit) in fractional cents.
702794
795 - `claude_tag_category: "dm" or "engaged" or "monitoring" or 2 more or null`
796
797 Claude Tag (Claude in Slack) spend category: `engaged` (a person addressed Claude in a channel or thread), `proactive` (Claude responded without being addressed), `scheduled` (a scheduled routine ran), `monitoring` (Claude watching a channel it was asked to monitor), or `dm` (direct messages with Claude). Populated only when `claude_tag_category` is in `group_by[]`; null for usage that is not Claude Tag. Direct-message usage is billed to the individual user and is reported under that user's product, not under `claude-tag`. New categories may be added over time.
798
799 - `"dm"`
800
801 - `"engaged"`
802
803 - `"monitoring"`
804
805 - `"proactive"`
806
807 - `"scheduled"`
808
809 - `claude_tag_user_id: string or null`
810
811 Slack user ID (for example `U0123ABCDEF`) of the member the Claude Tag (Claude in Slack) usage is attributed to, not a claude.ai user ID. Populated only when `claude_tag_user_id` is in `group_by[]`; null for usage that is not Claude Tag and for Claude Tag usage that is not attributed to a single user (for example `monitoring`, and `proactive` usage Claude initiated), so per-user rows can sum to less than the Claude Tag total. Cannot be combined with `group_by[]=rbac_group_id` or the `rbac_group_ids[]` filter.
812
703813 - `context_window: "0-200k" or "200k-1M" or null`
704814
705815 Context-window pricing tier of the usage or cost. Null unless `context_window` is in `group_by[]`; it can also be null on grouped rows with no context-window tier, such as code execution.
from line 947
837947 - `amount: string`
838948
839949 Amount (post-discount, pre-credit) in fractional cents (minor units).
950
951 - `claude_tag_category: "dm" or "engaged" or "monitoring" or 2 more or null`
952
953 Claude Tag (Claude in Slack) spend category: `engaged` (a person addressed Claude in a channel or thread), `proactive` (Claude responded without being addressed), `scheduled` (a scheduled routine ran), `monitoring` (Claude watching a channel it was asked to monitor), or `dm` (direct messages with Claude). Populated only when `claude_tag_category` is in `group_by[]`; null for usage that is not Claude Tag. Direct-message usage is billed to the individual user and is reported under that user's product, not under `claude-tag`. New categories may be added over time.
954
955 - `"dm"`
956
957 - `"engaged"`
958
959 - `"monitoring"`
960
961 - `"proactive"`
962
963 - `"scheduled"`
964
965 - `claude_tag_user_id: string or null`
966
967 Slack user ID (for example `U0123ABCDEF`) of the member the Claude Tag (Claude in Slack) usage is attributed to, not a claude.ai user ID. Populated only when `claude_tag_user_id` is in `group_by[]`; null for usage that is not Claude Tag and for Claude Tag usage that is not attributed to a single user (for example `monitoring`, and `proactive` usage Claude initiated), so per-user rows can sum to less than the Claude Tag total. Cannot be combined with `group_by[]=rbac_group_id` or the `rbac_group_ids[]` filter.
840968
841969 - `context_window: "0-200k" or "200k-1M" or null`
842970
api/admin/analytics/cost/list Changed · +47 / -1 lines
from line 29
2929
3030 - `"1m"`
3131
32- `claude_tag_categories: optional array of "dm" or "engaged" or "monitoring" or 2 more`
33
34 Filter to Claude Tag (Claude in Slack) usage in specific spend categories. Usage with no category never matches. `dm` usage is reported under the user's product rather than `claude-tag`, so combining this filter with `products[]=claude-tag` excludes it. Use `group_by[]=claude_tag_category` to break out per-category values.
35
36 maxItems: 100
37
38 - `"dm"`
39
40 - `"engaged"`
41
42 - `"monitoring"`
43
44 - `"proactive"`
45
46 - `"scheduled"`
47
48- `claude_tag_user_ids: optional array of string`
49
50 Filter to Claude Tag (Claude in Slack) usage attributed to specific Slack users, by Slack user ID (for example `U0123ABCDEF`), not claude.ai user ID. Usage that is not Claude Tag, and Claude Tag usage not attributed to a single user, never matches. Use `group_by[]=claude_tag_user_id` to break out per-user values.
51
52 maxItems: 100
53
3254- `context_windows: optional array of "0-200k" or "200k-1M"`
3355
3456 Filter to specific context-window pricing tiers. Use `group_by[]=context_window` to break out per-tier values.
from line 67
4567
4668 format: date-time
4769
48- `group_by: optional array of "context_window" or "cost_type" or "inference_geo" or 6 more`
70- `group_by: optional array of "claude_tag_category" or "claude_tag_user_id" or "context_window" or 8 more`
4971
5072 Dimensions to break each time bucket out by. Defaults to no grouping (one total per bucket). Each bucket reports at most its top 100 groups; a group beyond that cap has no row in that bucket (there is no remainder row), so grouped buckets are not exhaustive when a dimension has more than 100 distinct values.
5173
5274 maxItems: 100
5375
76 - `"claude_tag_category"`
77
78 - `"claude_tag_user_id"`
79
5480 - `"context_window"`
5581
5682 - `"cost_type"`
from line 193
167193
168194 Amount (post-discount, pre-credit) in fractional cents.
169195
196 - `claude_tag_category: "dm" or "engaged" or "monitoring" or 2 more or null`
197
198 Claude Tag (Claude in Slack) spend category: `engaged` (a person addressed Claude in a channel or thread), `proactive` (Claude responded without being addressed), `scheduled` (a scheduled routine ran), `monitoring` (Claude watching a channel it was asked to monitor), or `dm` (direct messages with Claude). Populated only when `claude_tag_category` is in `group_by[]`; null for usage that is not Claude Tag. Direct-message usage is billed to the individual user and is reported under that user's product, not under `claude-tag`. New categories may be added over time.
199
200 - `"dm"`
201
202 - `"engaged"`
203
204 - `"monitoring"`
205
206 - `"proactive"`
207
208 - `"scheduled"`
209
210 - `claude_tag_user_id: string or null`
211
212 Slack user ID (for example `U0123ABCDEF`) of the member the Claude Tag (Claude in Slack) usage is attributed to, not a claude.ai user ID. Populated only when `claude_tag_user_id` is in `group_by[]`; null for usage that is not Claude Tag and for Claude Tag usage that is not attributed to a single user (for example `monitoring`, and `proactive` usage Claude initiated), so per-user rows can sum to less than the Claude Tag total. Cannot be combined with `group_by[]=rbac_group_id` or the `rbac_group_ids[]` filter.
213
170214 - `context_window: "0-200k" or "200k-1M" or null`
171215
172216 Context-window pricing tier of the usage or cost. Null unless `context_window` is in `group_by[]`; it can also be null on grouped rows with no context-window tier, such as code execution.
from line 331
287331 "results": [
288332 {
289333 "amount": "amount",
334 "claude_tag_category": "dm",
335 "claude_tag_user_id": "U0123ABCDEF",
290336 "context_window": "0-200k",
291337 "cost_type": "code_execution",
292338 "currency": "USD",
api/admin/analytics/cost/list_by_user Changed · +47 / -1 lines
from line 30
3030
3131 - `"1m"`
3232
33- `claude_tag_categories: optional array of "dm" or "engaged" or "monitoring" or 2 more`
34
35 Filter to Claude Tag (Claude in Slack) usage in specific spend categories. Usage with no category never matches. `dm` usage is reported under the user's product rather than `claude-tag`, so combining this filter with `products[]=claude-tag` excludes it. Use `group_by[]=claude_tag_category` to break out per-category values.
36
37 maxItems: 100
38
39 - `"dm"`
40
41 - `"engaged"`
42
43 - `"monitoring"`
44
45 - `"proactive"`
46
47 - `"scheduled"`
48
49- `claude_tag_user_ids: optional array of string`
50
51 Filter to Claude Tag (Claude in Slack) usage attributed to specific Slack users, by Slack user ID (for example `U0123ABCDEF`), not claude.ai user ID. Usage that is not Claude Tag, and Claude Tag usage not attributed to a single user, never matches. Use `group_by[]=claude_tag_user_id` to break out per-user values.
52
53 maxItems: 100
54
3355- `context_windows: optional array of "0-200k" or "200k-1M"`
3456
3557 Filter to specific context-window pricing tiers. Use `group_by[]=context_window` to break out per-tier values.
from line 74
5274
5375 default: false
5476
55- `group_by: optional array of "context_window" or "cost_type" or "inference_geo" or 6 more`
77- `group_by: optional array of "claude_tag_category" or "claude_tag_user_id" or "context_window" or 8 more`
5678
5779 Break each actor's row out by the given dimensions. Accepts the same values as the bucketed `/cost_report` endpoint. The `product`, `model`, `context_window`, `inference_geo`, and `speed` dimensions — and the time bucket, when `bucket_width` is set — count toward `limit`. `cost_type` and `token_type` do not: `cost_type` returns one row per cost component (tokens, web search, code execution); `token_type` returns one row per token type, each with `cost_type: "tokens"`; combining both returns the per-token-type rows plus the web-search and code-execution rows. A page can therefore contain more rows than `limit` when `cost_type` or `token_type` is requested.
5880
5981 maxItems: 100
6082
83 - `"claude_tag_category"`
84
85 - `"claude_tag_user_id"`
86
6187 - `"context_window"`
6288
6389 - `"cost_type"`
from line 234
208234
209235 Amount (post-discount, pre-credit) in fractional cents (minor units).
210236
237 - `claude_tag_category: "dm" or "engaged" or "monitoring" or 2 more or null`
238
239 Claude Tag (Claude in Slack) spend category: `engaged` (a person addressed Claude in a channel or thread), `proactive` (Claude responded without being addressed), `scheduled` (a scheduled routine ran), `monitoring` (Claude watching a channel it was asked to monitor), or `dm` (direct messages with Claude). Populated only when `claude_tag_category` is in `group_by[]`; null for usage that is not Claude Tag. Direct-message usage is billed to the individual user and is reported under that user's product, not under `claude-tag`. New categories may be added over time.
240
241 - `"dm"`
242
243 - `"engaged"`
244
245 - `"monitoring"`
246
247 - `"proactive"`
248
249 - `"scheduled"`
250
251 - `claude_tag_user_id: string or null`
252
253 Slack user ID (for example `U0123ABCDEF`) of the member the Claude Tag (Claude in Slack) usage is attributed to, not a claude.ai user ID. Populated only when `claude_tag_user_id` is in `group_by[]`; null for usage that is not Claude Tag and for Claude Tag usage that is not attributed to a single user (for example `monitoring`, and `proactive` usage Claude initiated), so per-user rows can sum to less than the Claude Tag total. Cannot be combined with `group_by[]=rbac_group_id` or the `rbac_group_ids[]` filter.
254
211255 - `context_window: "0-200k" or "200k-1M" or null`
212256
213257 Context-window pricing tier of the usage or cost. Null unless `context_window` is in `group_by[]`; it can also be null on grouped rows with no context-window tier, such as code execution.
from line 382
338382 "user_id": "user_01AbCdEfGhIjKlMnOpQrSt"
339383 },
340384 "amount": "41280.000000",
385 "claude_tag_category": "dm",
386 "claude_tag_user_id": "U0123ABCDEF",
341387 "context_window": "0-200k",
342388 "cost_type": "code_execution",
343389 "currency": "USD",
api/admin/analytics/usage Changed · +130 / -2 lines
from line 31
3131
3232 - `"1m"`
3333
34- `claude_tag_categories: optional array of "dm" or "engaged" or "monitoring" or 2 more`
35
36 Filter to Claude Tag (Claude in Slack) usage in specific spend categories. Usage with no category never matches. `dm` usage is reported under the user's product rather than `claude-tag`, so combining this filter with `products[]=claude-tag` excludes it. Use `group_by[]=claude_tag_category` to break out per-category values.
37
38 maxItems: 100
39
40 - `"dm"`
41
42 - `"engaged"`
43
44 - `"monitoring"`
45
46 - `"proactive"`
47
48 - `"scheduled"`
49
50- `claude_tag_user_ids: optional array of string`
51
52 Filter to Claude Tag (Claude in Slack) usage attributed to specific Slack users, by Slack user ID (for example `U0123ABCDEF`), not claude.ai user ID. Usage that is not Claude Tag, and Claude Tag usage not attributed to a single user, never matches. Use `group_by[]=claude_tag_user_id` to break out per-user values.
53
54 maxItems: 100
55
3456- `context_windows: optional array of "0-200k" or "200k-1M"`
3557
3658 Filter to specific context-window pricing tiers. Use `group_by[]=context_window` to break out per-tier values.
from line 69
4769
4870 format: date-time
4971
50- `group_by: optional array of "context_window" or "inference_geo" or "model" or 4 more`
72- `group_by: optional array of "claude_tag_category" or "claude_tag_user_id" or "context_window" or 6 more`
5173
5274 Dimensions to break each time bucket out by. Defaults to no grouping (one total per bucket). Each bucket reports at most its top 100 groups; a group beyond that cap has no row in that bucket (there is no remainder row), so grouped buckets are not exhaustive when a dimension has more than 100 distinct values.
5375
5476 maxItems: 100
5577
78 - `"claude_tag_category"`
79
80 - `"claude_tag_user_id"`
81
5682 - `"context_window"`
5783
5884 - `"inference_geo"`
from line 203
177203
178204 The number of input tokens read from the cache.
179205
206 - `claude_tag_category: "dm" or "engaged" or "monitoring" or 2 more or null`
207
208 Claude Tag (Claude in Slack) spend category: `engaged` (a person addressed Claude in a channel or thread), `proactive` (Claude responded without being addressed), `scheduled` (a scheduled routine ran), `monitoring` (Claude watching a channel it was asked to monitor), or `dm` (direct messages with Claude). Populated only when `claude_tag_category` is in `group_by[]`; null for usage that is not Claude Tag. Direct-message usage is billed to the individual user and is reported under that user's product, not under `claude-tag`. New categories may be added over time.
209
210 - `"dm"`
211
212 - `"engaged"`
213
214 - `"monitoring"`
215
216 - `"proactive"`
217
218 - `"scheduled"`
219
220 - `claude_tag_user_id: string or null`
221
222 Slack user ID (for example `U0123ABCDEF`) of the member the Claude Tag (Claude in Slack) usage is attributed to, not a claude.ai user ID. Populated only when `claude_tag_user_id` is in `group_by[]`; null for usage that is not Claude Tag and for Claude Tag usage that is not attributed to a single user (for example `monitoring`, and `proactive` usage Claude initiated), so per-user rows can sum to less than the Claude Tag total. Cannot be combined with `group_by[]=rbac_group_id` or the `rbac_group_ids[]` filter.
223
180224 - `context_window: "0-200k" or "200k-1M" or null`
181225
182226 Context-window pricing tier of the usage or cost. Null unless `context_window` is in `group_by[]`; it can also be null on grouped rows with no context-window tier, such as code execution.
from line 327
283327 "ephemeral_5m_input_tokens": 500
284328 },
285329 "cache_read_input_tokens": 0,
330 "claude_tag_category": "dm",
331 "claude_tag_user_id": "U0123ABCDEF",
286332 "context_window": "0-200k",
287333 "inference_geo": "global",
288334 "model": "claude-opus-5",
from line 386
340386
341387 - `"1m"`
342388
389- `claude_tag_categories: optional array of "dm" or "engaged" or "monitoring" or 2 more`
390
391 Filter to Claude Tag (Claude in Slack) usage in specific spend categories. Usage with no category never matches. `dm` usage is reported under the user's product rather than `claude-tag`, so combining this filter with `products[]=claude-tag` excludes it. Use `group_by[]=claude_tag_category` to break out per-category values.
392
393 maxItems: 100
394
395 - `"dm"`
396
397 - `"engaged"`
398
399 - `"monitoring"`
400
401 - `"proactive"`
402
403 - `"scheduled"`
404
405- `claude_tag_user_ids: optional array of string`
406
407 Filter to Claude Tag (Claude in Slack) usage attributed to specific Slack users, by Slack user ID (for example `U0123ABCDEF`), not claude.ai user ID. Usage that is not Claude Tag, and Claude Tag usage not attributed to a single user, never matches. Use `group_by[]=claude_tag_user_id` to break out per-user values.
408
409 maxItems: 100
410
343411- `context_windows: optional array of "0-200k" or "200k-1M"`
344412
345413 Filter to specific context-window pricing tiers. Use `group_by[]=context_window` to break out per-tier values.
from line 430
362430
363431 default: false
364432
365- `group_by: optional array of "context_window" or "inference_geo" or "model" or 4 more`
433- `group_by: optional array of "claude_tag_category" or "claude_tag_user_id" or "context_window" or 6 more`
366434
367435 Break each actor's row out by the given dimensions. Accepts the same values as the bucketed `/usage_report` endpoint. `limit` bounds (actor × time bucket × dimension) rows — with dimensions or `bucket_width` present, one actor may span several rows.
368436
369437 maxItems: 100
370438
439 - `"claude_tag_category"`
440
441 - `"claude_tag_user_id"`
442
371443 - `"context_window"`
372444
373445 - `"inference_geo"`
from line 602
530602
531603 The number of input tokens read from the cache.
532604
605 - `claude_tag_category: "dm" or "engaged" or "monitoring" or 2 more or null`
606
607 Claude Tag (Claude in Slack) spend category: `engaged` (a person addressed Claude in a channel or thread), `proactive` (Claude responded without being addressed), `scheduled` (a scheduled routine ran), `monitoring` (Claude watching a channel it was asked to monitor), or `dm` (direct messages with Claude). Populated only when `claude_tag_category` is in `group_by[]`; null for usage that is not Claude Tag. Direct-message usage is billed to the individual user and is reported under that user's product, not under `claude-tag`. New categories may be added over time.
608
609 - `"dm"`
610
611 - `"engaged"`
612
613 - `"monitoring"`
614
615 - `"proactive"`
616
617 - `"scheduled"`
618
619 - `claude_tag_user_id: string or null`
620
621 Slack user ID (for example `U0123ABCDEF`) of the member the Claude Tag (Claude in Slack) usage is attributed to, not a claude.ai user ID. Populated only when `claude_tag_user_id` is in `group_by[]`; null for usage that is not Claude Tag and for Claude Tag usage that is not attributed to a single user (for example `monitoring`, and `proactive` usage Claude initiated), so per-user rows can sum to less than the Claude Tag total. Cannot be combined with `group_by[]=rbac_group_id` or the `rbac_group_ids[]` filter.
622
533623 - `context_window: "0-200k" or "200k-1M" or null`
534624
535625 Context-window pricing tier of the usage or cost. Null unless `context_window` is in `group_by[]`; it can also be null on grouped rows with no context-window tier, such as code execution.
from line 740
650740 "ephemeral_5m_input_tokens": 500
651741 },
652742 "cache_read_input_tokens": 3200000,
743 "claude_tag_category": "dm",
744 "claude_tag_user_id": "U0123ABCDEF",
653745 "context_window": "0-200k",
654746 "ending_at": "2019-12-27T18:11:19.117Z",
655747 "inference_geo": "global",
from line 803
711803
712804 The number of input tokens read from the cache.
713805
806 - `claude_tag_category: "dm" or "engaged" or "monitoring" or 2 more or null`
807
808 Claude Tag (Claude in Slack) spend category: `engaged` (a person addressed Claude in a channel or thread), `proactive` (Claude responded without being addressed), `scheduled` (a scheduled routine ran), `monitoring` (Claude watching a channel it was asked to monitor), or `dm` (direct messages with Claude). Populated only when `claude_tag_category` is in `group_by[]`; null for usage that is not Claude Tag. Direct-message usage is billed to the individual user and is reported under that user's product, not under `claude-tag`. New categories may be added over time.
809
810 - `"dm"`
811
812 - `"engaged"`
813
814 - `"monitoring"`
815
816 - `"proactive"`
817
818 - `"scheduled"`
819
820 - `claude_tag_user_id: string or null`
821
822 Slack user ID (for example `U0123ABCDEF`) of the member the Claude Tag (Claude in Slack) usage is attributed to, not a claude.ai user ID. Populated only when `claude_tag_user_id` is in `group_by[]`; null for usage that is not Claude Tag and for Claude Tag usage that is not attributed to a single user (for example `monitoring`, and `proactive` usage Claude initiated), so per-user rows can sum to less than the Claude Tag total. Cannot be combined with `group_by[]=rbac_group_id` or the `rbac_group_ids[]` filter.
823
714824 - `context_window: "0-200k" or "200k-1M" or null`
715825
716826 Context-window pricing tier of the usage or cost. Null unless `context_window` is in `group_by[]`; it can also be null on grouped rows with no context-window tier, such as code execution.
from line 952
842952 - `cache_read_input_tokens: number`
843953
844954 The number of input tokens read from the cache.
955
956 - `claude_tag_category: "dm" or "engaged" or "monitoring" or 2 more or null`
957
958 Claude Tag (Claude in Slack) spend category: `engaged` (a person addressed Claude in a channel or thread), `proactive` (Claude responded without being addressed), `scheduled` (a scheduled routine ran), `monitoring` (Claude watching a channel it was asked to monitor), or `dm` (direct messages with Claude). Populated only when `claude_tag_category` is in `group_by[]`; null for usage that is not Claude Tag. Direct-message usage is billed to the individual user and is reported under that user's product, not under `claude-tag`. New categories may be added over time.
959
960 - `"dm"`
961
962 - `"engaged"`
963
964 - `"monitoring"`
965
966 - `"proactive"`
967
968 - `"scheduled"`
969
970 - `claude_tag_user_id: string or null`
971
972 Slack user ID (for example `U0123ABCDEF`) of the member the Claude Tag (Claude in Slack) usage is attributed to, not a claude.ai user ID. Populated only when `claude_tag_user_id` is in `group_by[]`; null for usage that is not Claude Tag and for Claude Tag usage that is not attributed to a single user (for example `monitoring`, and `proactive` usage Claude initiated), so per-user rows can sum to less than the Claude Tag total. Cannot be combined with `group_by[]=rbac_group_id` or the `rbac_group_ids[]` filter.
845973
846974 - `context_window: "0-200k" or "200k-1M" or null`
847975
api/admin/analytics/usage/list Changed · +47 / -1 lines
from line 29
2929
3030 - `"1m"`
3131
32- `claude_tag_categories: optional array of "dm" or "engaged" or "monitoring" or 2 more`
33
34 Filter to Claude Tag (Claude in Slack) usage in specific spend categories. Usage with no category never matches. `dm` usage is reported under the user's product rather than `claude-tag`, so combining this filter with `products[]=claude-tag` excludes it. Use `group_by[]=claude_tag_category` to break out per-category values.
35
36 maxItems: 100
37
38 - `"dm"`
39
40 - `"engaged"`
41
42 - `"monitoring"`
43
44 - `"proactive"`
45
46 - `"scheduled"`
47
48- `claude_tag_user_ids: optional array of string`
49
50 Filter to Claude Tag (Claude in Slack) usage attributed to specific Slack users, by Slack user ID (for example `U0123ABCDEF`), not claude.ai user ID. Usage that is not Claude Tag, and Claude Tag usage not attributed to a single user, never matches. Use `group_by[]=claude_tag_user_id` to break out per-user values.
51
52 maxItems: 100
53
3254- `context_windows: optional array of "0-200k" or "200k-1M"`
3355
3456 Filter to specific context-window pricing tiers. Use `group_by[]=context_window` to break out per-tier values.
from line 67
4567
4668 format: date-time
4769
48- `group_by: optional array of "context_window" or "inference_geo" or "model" or 4 more`
70- `group_by: optional array of "claude_tag_category" or "claude_tag_user_id" or "context_window" or 6 more`
4971
5072 Dimensions to break each time bucket out by. Defaults to no grouping (one total per bucket). Each bucket reports at most its top 100 groups; a group beyond that cap has no row in that bucket (there is no remainder row), so grouped buckets are not exhaustive when a dimension has more than 100 distinct values.
5173
5274 maxItems: 100
5375
76 - `"claude_tag_category"`
77
78 - `"claude_tag_user_id"`
79
5480 - `"context_window"`
5581
5682 - `"inference_geo"`
from line 201
175201
176202 The number of input tokens read from the cache.
177203
204 - `claude_tag_category: "dm" or "engaged" or "monitoring" or 2 more or null`
205
206 Claude Tag (Claude in Slack) spend category: `engaged` (a person addressed Claude in a channel or thread), `proactive` (Claude responded without being addressed), `scheduled` (a scheduled routine ran), `monitoring` (Claude watching a channel it was asked to monitor), or `dm` (direct messages with Claude). Populated only when `claude_tag_category` is in `group_by[]`; null for usage that is not Claude Tag. Direct-message usage is billed to the individual user and is reported under that user's product, not under `claude-tag`. New categories may be added over time.
207
208 - `"dm"`
209
210 - `"engaged"`
211
212 - `"monitoring"`
213
214 - `"proactive"`
215
216 - `"scheduled"`
217
218 - `claude_tag_user_id: string or null`
219
220 Slack user ID (for example `U0123ABCDEF`) of the member the Claude Tag (Claude in Slack) usage is attributed to, not a claude.ai user ID. Populated only when `claude_tag_user_id` is in `group_by[]`; null for usage that is not Claude Tag and for Claude Tag usage that is not attributed to a single user (for example `monitoring`, and `proactive` usage Claude initiated), so per-user rows can sum to less than the Claude Tag total. Cannot be combined with `group_by[]=rbac_group_id` or the `rbac_group_ids[]` filter.
221
178222 - `context_window: "0-200k" or "200k-1M" or null`
179223
180224 Context-window pricing tier of the usage or cost. Null unless `context_window` is in `group_by[]`; it can also be null on grouped rows with no context-window tier, such as code execution.
from line 325
281325 "ephemeral_5m_input_tokens": 500
282326 },
283327 "cache_read_input_tokens": 0,
328 "claude_tag_category": "dm",
329 "claude_tag_user_id": "U0123ABCDEF",
284330 "context_window": "0-200k",
285331 "inference_geo": "global",
286332 "model": "claude-opus-5",
api/admin/analytics/usage/list_by_user Changed · +47 / -1 lines
from line 30
3030
3131 - `"1m"`
3232
33- `claude_tag_categories: optional array of "dm" or "engaged" or "monitoring" or 2 more`
34
35 Filter to Claude Tag (Claude in Slack) usage in specific spend categories. Usage with no category never matches. `dm` usage is reported under the user's product rather than `claude-tag`, so combining this filter with `products[]=claude-tag` excludes it. Use `group_by[]=claude_tag_category` to break out per-category values.
36
37 maxItems: 100
38
39 - `"dm"`
40
41 - `"engaged"`
42
43 - `"monitoring"`
44
45 - `"proactive"`
46
47 - `"scheduled"`
48
49- `claude_tag_user_ids: optional array of string`
50
51 Filter to Claude Tag (Claude in Slack) usage attributed to specific Slack users, by Slack user ID (for example `U0123ABCDEF`), not claude.ai user ID. Usage that is not Claude Tag, and Claude Tag usage not attributed to a single user, never matches. Use `group_by[]=claude_tag_user_id` to break out per-user values.
52
53 maxItems: 100
54
3355- `context_windows: optional array of "0-200k" or "200k-1M"`
3456
3557 Filter to specific context-window pricing tiers. Use `group_by[]=context_window` to break out per-tier values.
from line 74
5274
5375 default: false
5476
55- `group_by: optional array of "context_window" or "inference_geo" or "model" or 4 more`
77- `group_by: optional array of "claude_tag_category" or "claude_tag_user_id" or "context_window" or 6 more`
5678
5779 Break each actor's row out by the given dimensions. Accepts the same values as the bucketed `/usage_report` endpoint. `limit` bounds (actor × time bucket × dimension) rows — with dimensions or `bucket_width` present, one actor may span several rows.
5880
5981 maxItems: 100
6082
83 - `"claude_tag_category"`
84
85 - `"claude_tag_user_id"`
86
6187 - `"context_window"`
6288
6389 - `"inference_geo"`
from line 246
220246
221247 The number of input tokens read from the cache.
222248
249 - `claude_tag_category: "dm" or "engaged" or "monitoring" or 2 more or null`
250
251 Claude Tag (Claude in Slack) spend category: `engaged` (a person addressed Claude in a channel or thread), `proactive` (Claude responded without being addressed), `scheduled` (a scheduled routine ran), `monitoring` (Claude watching a channel it was asked to monitor), or `dm` (direct messages with Claude). Populated only when `claude_tag_category` is in `group_by[]`; null for usage that is not Claude Tag. Direct-message usage is billed to the individual user and is reported under that user's product, not under `claude-tag`. New categories may be added over time.
252
253 - `"dm"`
254
255 - `"engaged"`
256
257 - `"monitoring"`
258
259 - `"proactive"`
260
261 - `"scheduled"`
262
263 - `claude_tag_user_id: string or null`
264
265 Slack user ID (for example `U0123ABCDEF`) of the member the Claude Tag (Claude in Slack) usage is attributed to, not a claude.ai user ID. Populated only when `claude_tag_user_id` is in `group_by[]`; null for usage that is not Claude Tag and for Claude Tag usage that is not attributed to a single user (for example `monitoring`, and `proactive` usage Claude initiated), so per-user rows can sum to less than the Claude Tag total. Cannot be combined with `group_by[]=rbac_group_id` or the `rbac_group_ids[]` filter.
266
223267 - `context_window: "0-200k" or "200k-1M" or null`
224268
225269 Context-window pricing tier of the usage or cost. Null unless `context_window` is in `group_by[]`; it can also be null on grouped rows with no context-window tier, such as code execution.
from line 384
340384 "ephemeral_5m_input_tokens": 500
341385 },
342386 "cache_read_input_tokens": 3200000,
387 "claude_tag_category": "dm",
388 "claude_tag_user_id": "U0123ABCDEF",
343389 "context_window": "0-200k",
344390 "ending_at": "2019-12-27T18:11:19.117Z",
345391 "inference_geo": "global",
api/admin/api_keys Changed · +3 / -3 lines
from line 141
141141```bash
142142curl https://api.anthropic.com/v1/organizations/api_keys/$API_KEY_ID \
143143 -H 'anthropic-version: 2023-06-01' \
144 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
144 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
145145```
146146
147147#### Response (200)
from line 356
356356```bash
357357curl https://api.anthropic.com/v1/organizations/api_keys \
358358 -H 'anthropic-version: 2023-06-01' \
359 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
359 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
360360```
361361
362362#### Response (200)
from line 553
553553curl https://api.anthropic.com/v1/organizations/api_keys/$API_KEY_ID \
554554 -H 'Content-Type: application/json' \
555555 -H 'anthropic-version: 2023-06-01' \
556 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
556 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
557557 -d '{}'
558558```
559559
api/admin/external_keys Changed · +26 / -26 lines
from line 16
1616
1717 - `kms_arn: string`
1818
19 Full ARN of the AWS KMS key.
19 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
2020
2121 maxLength: 2048
2222
from line 30
3030
3131 **Deprecated**
3232
33 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
33 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
3434
3535 - `Gcp object`
3636
from line 114
114114
115115 - `kms_arn: string`
116116
117 Full ARN of the AWS KMS key.
117 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
118118
119119 maxLength: 2048
120120
from line 128
128128
129129 **Deprecated**
130130
131 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
131 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
132132
133133 - `Gcp object`
134134
from line 172
172172curl https://api.anthropic.com/v1/organizations/external_keys \
173173 -H 'Content-Type: application/json' \
174174 -H 'anthropic-version: 2023-06-01' \
175 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
175 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
176176 -d '{
177177 "provider_config": {
178178 "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
from line 268
268268
269269 - `kms_arn: string`
270270
271 Full ARN of the AWS KMS key.
271 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
272272
273273 maxLength: 2048
274274
from line 282
282282
283283 **Deprecated**
284284
285 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
285 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
286286
287287 - `Gcp object`
288288
from line 329
329329```bash
330330curl https://api.anthropic.com/v1/organizations/external_keys \
331331 -H 'anthropic-version: 2023-06-01' \
332 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
332 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
333333```
334334
335335#### Response (200)
from line 415
415415
416416 - `kms_arn: string`
417417
418 Full ARN of the AWS KMS key.
418 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
419419
420420 maxLength: 2048
421421
from line 429
429429
430430 **Deprecated**
431431
432 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
432 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
433433
434434 - `Gcp object`
435435
from line 472
472472```bash
473473curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \
474474 -H 'anthropic-version: 2023-06-01' \
475 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
475 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
476476```
477477
478478#### Response (200)
from line 535
535535
536536 - `kms_arn: string`
537537
538 Full ARN of the AWS KMS key.
538 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
539539
540540 maxLength: 2048
541541
from line 549
549549
550550 **Deprecated**
551551
552 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
552 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
553553
554554 - `Gcp object`
555555
from line 623
623623
624624 - `kms_arn: string`
625625
626 Full ARN of the AWS KMS key.
626 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
627627
628628 maxLength: 2048
629629
from line 637
637637
638638 **Deprecated**
639639
640 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
640 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
641641
642642 - `Gcp object`
643643
from line 681
681681curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \
682682 -H 'Content-Type: application/json' \
683683 -H 'anthropic-version: 2023-06-01' \
684 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
684 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
685685 -d '{}'
686686```
687687
from line 739
739739curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \
740740 -X DELETE \
741741 -H 'anthropic-version: 2023-06-01' \
742 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
742 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
743743```
744744
745745#### Response (200)
from line 794
794794curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID/validate \
795795 -X POST \
796796 -H 'anthropic-version: 2023-06-01' \
797 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
797 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
798798```
799799
800800#### Response (200)
from line 859
859859
860860 - `kms_arn: string`
861861
862 Full ARN of the AWS KMS key.
862 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
863863
864864 maxLength: 2048
865865
from line 873
873873
874874 **Deprecated**
875875
876 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
876 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
877877
878878 - `Gcp object`
879879
from line 961
961961
962962 - `kms_arn: string`
963963
964 Full ARN of the AWS KMS key.
964 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
965965
966966 maxLength: 2048
967967
from line 975
975975
976976 **Deprecated**
977977
978 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
978 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
979979
980980 - `Gcp object`
981981
from line 1063
10631063
10641064 - `kms_arn: string`
10651065
1066 Full ARN of the AWS KMS key.
1066 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
10671067
10681068 maxLength: 2048
10691069
from line 1077
10771077
10781078 **Deprecated**
10791079
1080 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
1080 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
10811081
10821082 - `Gcp object`
10831083
from line 1165
11651165
11661166 - `kms_arn: string`
11671167
1168 Full ARN of the AWS KMS key.
1168 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
11691169
11701170 maxLength: 2048
11711171
from line 1179
11791179
11801180 **Deprecated**
11811181
1182 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
1182 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
11831183
11841184 - `Gcp object`
11851185
api/admin/external_keys/create Changed · +5 / -5 lines
from line 14
1414
1515 - `kms_arn: string`
1616
17 Full ARN of the AWS KMS key.
17 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
1818
1919 maxLength: 2048
2020
from line 28
2828
2929 **Deprecated**
3030
31 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
31 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
3232
3333 - `Gcp object`
3434
from line 112
112112
113113 - `kms_arn: string`
114114
115 Full ARN of the AWS KMS key.
115 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
116116
117117 maxLength: 2048
118118
from line 126
126126
127127 **Deprecated**
128128
129 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
129 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
130130
131131 - `Gcp object`
132132
from line 170
170170curl https://api.anthropic.com/v1/organizations/external_keys \
171171 -H 'Content-Type: application/json' \
172172 -H 'anthropic-version: 2023-06-01' \
173 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
173 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
174174 -d '{
175175 "provider_config": {
176176 "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
api/admin/external_keys/list Changed · +3 / -3 lines
from line 63
6363
6464 - `kms_arn: string`
6565
66 Full ARN of the AWS KMS key.
66 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
6767
6868 maxLength: 2048
6969
from line 77
7777
7878 **Deprecated**
7979
80 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
80 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
8181
8282 - `Gcp object`
8383
from line 124
124124```bash
125125curl https://api.anthropic.com/v1/organizations/external_keys \
126126 -H 'anthropic-version: 2023-06-01' \
127 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
127 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
128128```
129129
130130### Response (200)
api/admin/external_keys/retrieve Changed · +3 / -3 lines
from line 54
5454
5555 - `kms_arn: string`
5656
57 Full ARN of the AWS KMS key.
57 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
5858
5959 maxLength: 2048
6060
from line 68
6868
6969 **Deprecated**
7070
71 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
71 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
7272
7373 - `Gcp object`
7474
from line 111
111111```bash
112112curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \
113113 -H 'anthropic-version: 2023-06-01' \
114 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
114 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
115115```
116116
117117### Response (200)
api/admin/external_keys/update Changed · +5 / -5 lines
from line 36
3636
3737 - `kms_arn: string`
3838
39 Full ARN of the AWS KMS key.
39 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
4040
4141 maxLength: 2048
4242
from line 50
5050
5151 **Deprecated**
5252
53 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
53 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
5454
5555 - `Gcp object`
5656
from line 124
124124
125125 - `kms_arn: string`
126126
127 Full ARN of the AWS KMS key.
127 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
128128
129129 maxLength: 2048
130130
from line 138
138138
139139 **Deprecated**
140140
141 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
141 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
142142
143143 - `Gcp object`
144144
from line 182
182182curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \
183183 -H 'Content-Type: application/json' \
184184 -H 'anthropic-version: 2023-06-01' \
185 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
185 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
186186 -d '{}'
187187```
188188
api/admin/federation_issuers Changed · +16 / -13 lines
from line 4
44
55**POST** `/v1/organizations/federation_issuers`
66
7**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
8
79Register an OIDC issuer that Anthropic will trust for workload identity
810federation in your organization.
911
from line 18
1618document; for `explicit_url` and `inline` modes the issuer URL is only
1719matched as the JWT's `iss` claim and is not fetched.
1820
19Requires an OAuth bearer or Console session; Admin API keys are not
20accepted.
21
2221### Headers
2322
2423- `"anthropic-beta": optional array of string`
from line 249
250249curl https://api.anthropic.com/v1/organizations/federation_issuers \
251250 -H 'Content-Type: application/json' \
252251 -H 'anthropic-version: 2023-06-01' \
253 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
252 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
254253 -d '{
255254 "issuer_url": "x",
256255 "name": "x"
from line 290
291290
292291**GET** `/v1/organizations/federation_issuers/{federation_issuer_id}`
293292
293**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
294
294295Retrieve a federation issuer by its ID (`fdis_...`).
295296
296297### Path parameters
from line 456
455456```bash
456457curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID \
457458 -H 'anthropic-version: 2023-06-01' \
458 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
459 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
459460```
460461
461462#### Response (200)
from line 493
492493
493494**GET** `/v1/organizations/federation_issuers`
494495
496**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
497
495498List federation issuers in your organization.
496499
497500Archived issuers are excluded unless `include_archived=true`.
from line 672
669672```bash
670673curl https://api.anthropic.com/v1/organizations/federation_issuers \
671674 -H 'anthropic-version: 2023-06-01' \
672 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
675 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
673676```
674677
675678#### Response (200)
from line 714
711714
712715**POST** `/v1/organizations/federation_issuers/{federation_issuer_id}`
713716
717**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
718
714719Partially update a federation issuer.
715720
716721Setting `jwks` replaces the full JWKS shape at once. Archived issuers
from line 723
718723
719724Updating an issuer that backs a rule with a scope outside
720725`workspace:developer` or `workspace:inference` requires a Console
721session. Requires an OAuth bearer or Console session; Admin API keys
722are not accepted.
726session.
723727
724728### Path parameters
725729
from line 966
962966curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID \
963967 -H 'Content-Type: application/json' \
964968 -H 'anthropic-version: 2023-06-01' \
965 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
969 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
966970 -d '{}'
967971```
968972
from line 1004
10001004
10011005**POST** `/v1/organizations/federation_issuers/{federation_issuer_id}/archive`
10021006
1007**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
1008
10031009Archive a federation issuer.
10041010
10051011Idempotent; re-archiving returns the issuer with its original
from line 1013
10071013rule still references the issuer; archive those rules first (a rule's
10081014issuer cannot be changed), or recreate them against another issuer.
10091015
1010Requires an OAuth bearer or Console session; Admin API keys are not
1011accepted.
1012
10131016### Path parameters
10141017
10151018- `federation_issuer_id: string`
from line 1176
11731176curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID/archive \
11741177 -X POST \
11751178 -H 'anthropic-version: 2023-06-01' \
1176 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
1179 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
11771180```
11781181
11791182#### Response (200)
api/admin/federation_issuers/archive Changed · +3 / -4 lines
from line 2
22
33**POST** `/v1/organizations/federation_issuers/{federation_issuer_id}/archive`
44
5**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
6
57Archive a federation issuer.
68
79Idempotent; re-archiving returns the issuer with its original
from line 11
911rule still references the issuer; archive those rules first (a rule's
1012issuer cannot be changed), or recreate them against another issuer.
1113
12Requires an OAuth bearer or Console session; Admin API keys are not
13accepted.
14
1514## Path parameters
1615
1716- `federation_issuer_id: string`
from line 174
175174curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID/archive \
176175 -X POST \
177176 -H 'anthropic-version: 2023-06-01' \
178 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
177 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
179178```
180179
181180### Response (200)
api/admin/federation_issuers/create Changed · +3 / -4 lines
from line 2
22
33**POST** `/v1/organizations/federation_issuers`
44
5**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
6
57Register an OIDC issuer that Anthropic will trust for workload identity
68federation in your organization.
79
from line 16
1416document; for `explicit_url` and `inline` modes the issuer URL is only
1517matched as the JWT's `iss` claim and is not fetched.
1618
17Requires an OAuth bearer or Console session; Admin API keys are not
18accepted.
19
2019## Headers
2120
2221- `"anthropic-beta": optional array of string`
from line 247
248247curl https://api.anthropic.com/v1/organizations/federation_issuers \
249248 -H 'Content-Type: application/json' \
250249 -H 'anthropic-version: 2023-06-01' \
251 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
250 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
252251 -d '{
253252 "issuer_url": "x",
254253 "name": "x"
api/admin/federation_issuers/update Changed · +4 / -3 lines
from line 2
22
33**POST** `/v1/organizations/federation_issuers/{federation_issuer_id}`
44
5**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
6
57Partially update a federation issuer.
68
79Setting `jwks` replaces the full JWKS shape at once. Archived issuers
from line 11
911
1012Updating an issuer that backs a rule with a scope outside
1113`workspace:developer` or `workspace:inference` requires a Console
12session. Requires an OAuth bearer or Console session; Admin API keys
13are not accepted.
14session.
1415
1516## Path parameters
1617
from line 254
253254curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID \
254255 -H 'Content-Type: application/json' \
255256 -H 'anthropic-version: 2023-06-01' \
256 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
257 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
257258 -d '{}'
258259```
259260
api/admin/federation_rules Changed · +31 / -16 lines
from line 4
44
55**POST** `/v1/organizations/federation_rules`
66
7**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
8
79Create a federation rule owned by your organization.
810
911The referenced issuer and the target service account must already exist
from line 20
1820`repo:YOUR_ORG/...`), or a CEL condition referencing one of those
1921identity claims (e.g. `claims.repository_owner`). OAuth callers may only
2022manage rules whose `oauth_scope` is `workspace:developer` or
21`workspace:inference`; other scopes require a Console session. Admin API
22keys are not accepted.
23`workspace:inference`; other scopes require a Console session.
2324
2425### Headers
2526
from line 251
250251curl https://api.anthropic.com/v1/organizations/federation_rules \
251252 -H 'Content-Type: application/json' \
252253 -H 'anthropic-version: 2023-06-01' \
253 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
254 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
254255 -d '{
255256 "issuer_id": "issuer_id",
256257 "match": {},
from line 310
309310
310311**GET** `/v1/organizations/federation_rules/{federation_rule_id}`
311312
313**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
314
312315Retrieve a federation rule by its ID (`fdrl_...`).
313316
314317### Path parameters
from line 466
463466```bash
464467curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID \
465468 -H 'anthropic-version: 2023-06-01' \
466 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
469 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
467470```
468471
469472#### Response (200)
from line 515
512515
513516**GET** `/v1/organizations/federation_rules`
514517
518**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
519
515520List federation rules in your organization.
516521
517522Optionally filter by issuer with `issuer_id`. Archived rules are excluded
from line 683
678683```bash
679684curl https://api.anthropic.com/v1/organizations/federation_rules \
680685 -H 'anthropic-version: 2023-06-01' \
681 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
686 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
682687```
683688
684689#### Response (200)
from line 737
732737
733738**POST** `/v1/organizations/federation_rules/{federation_rule_id}`
734739
740**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
741
735742Partially update a federation rule.
736743
737744`issuer_id` is immutable. `match` and `target` are replaced as whole
from line 755
748755or description change) must also supply a conforming `match` in the same
749756request. OAuth callers may only manage rules whose `oauth_scope` is
750757`workspace:developer` or `workspace:inference`; other scopes require a
751Console session. Admin API keys are not accepted.
758Console session.
752759
753760### Path parameters
754761
from line 992
985992curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID \
986993 -H 'Content-Type: application/json' \
987994 -H 'anthropic-version: 2023-06-01' \
988 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
995 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
989996 -d '{}'
990997```
991998
from line 1042
10351042
10361043**POST** `/v1/organizations/federation_rules/{federation_rule_id}/archive`
10371044
1045**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
1046
10381047Archive a federation rule.
10391048
10401049Token exchange through this rule stops immediately. Idempotent;
from line 1052
10431052`workspace_ids` are emptied). Tokens already minted before archive
10441053remain valid until they expire. OAuth callers may only manage rules
10451054whose `oauth_scope` is `workspace:developer` or `workspace:inference`;
1046other scopes require a Console session. Admin API keys are not accepted.
1055other scopes require a Console session.
10471056
10481057### Path parameters
10491058
from line 1207
11981207curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/archive \
11991208 -X POST \
12001209 -H 'anthropic-version: 2023-06-01' \
1201 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
1210 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
12021211```
12031212
12041213#### Response (200)
from line 1393
13841393
13851394**GET** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
13861395
1396**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
1397
13871398List workspaces where this federation rule is enabled.
13881399
13891400Returns all workspace enablements in a single response; the `limit` and
from line 1468
14571468```bash
14581469curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \
14591470 -H 'anthropic-version: 2023-06-01' \
1460 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
1471 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
14611472```
14621473
14631474##### Response (200)
from line 1493
14821493
14831494**POST** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
14841495
1496**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
1497
14851498Enable a federation rule for a workspace.
14861499
14871500Idempotent; re-enabling returns the existing enablement. The rule and
from line 1502
14891502rule's target service account in this workspace is not checked at
14901503enablement: token exchange into this workspace is rejected unless the
14911504target is a member (it is implicitly a member of the default workspace).
1492Archived rules are rejected with 400. OAuth callers may only manage rules whose
1493`oauth_scope` is `workspace:developer` or `workspace:inference`; other
1494scopes require a Console session. Admin API keys are not accepted.
1505Archived rules are rejected with 400. OAuth callers may only manage rules
1506whose `oauth_scope` is `workspace:developer` or `workspace:inference`;
1507other scopes require a Console session.
14951508
14961509#### Path parameters
14971510
from line 1560
15471560curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \
15481561 -H 'Content-Type: application/json' \
15491562 -H 'anthropic-version: 2023-06-01' \
1550 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
1563 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
15511564 -d '{
15521565 "workspace_id": "workspace_id"
15531566 }'
from line 1583
15701583
15711584**DELETE** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}`
15721585
1586**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
1587
15731588Disable a federation rule for a workspace.
15741589
15751590Idempotent; succeeds even if the enablement was already removed. OAuth
15761591callers may only manage rules whose `oauth_scope` is
15771592`workspace:developer` or `workspace:inference`; other scopes require a
1578Console session. Admin API keys are not accepted.
1593Console session.
15791594
15801595#### Path parameters
15811596
from line 1630
16151630curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces/$WORKSPACE_ID \
16161631 -X DELETE \
16171632 -H 'anthropic-version: 2023-06-01' \
1618 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
1633 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
16191634```
16201635
16211636##### Response (200)
api/admin/federation_rules/archive Changed · +4 / -2 lines
from line 2
22
33**POST** `/v1/organizations/federation_rules/{federation_rule_id}/archive`
44
5**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
6
57Archive a federation rule.
68
79Token exchange through this rule stops immediately. Idempotent;
from line 12
1012`workspace_ids` are emptied). Tokens already minted before archive
1113remain valid until they expire. OAuth callers may only manage rules
1214whose `oauth_scope` is `workspace:developer` or `workspace:inference`;
13other scopes require a Console session. Admin API keys are not accepted.
15other scopes require a Console session.
1416
1517## Path parameters
1618
from line 167
165167curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/archive \
166168 -X POST \
167169 -H 'anthropic-version: 2023-06-01' \
168 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
170 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
169171```
170172
171173### Response (200)
api/admin/federation_rules/create Changed · +4 / -3 lines
from line 2
22
33**POST** `/v1/organizations/federation_rules`
44
5**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
6
57Create a federation rule owned by your organization.
68
79The referenced issuer and the target service account must already exist
from line 18
1618`repo:YOUR_ORG/...`), or a CEL condition referencing one of those
1719identity claims (e.g. `claims.repository_owner`). OAuth callers may only
1820manage rules whose `oauth_scope` is `workspace:developer` or
19`workspace:inference`; other scopes require a Console session. Admin API
20keys are not accepted.
21`workspace:inference`; other scopes require a Console session.
2122
2223## Headers
2324
from line 249
248249curl https://api.anthropic.com/v1/organizations/federation_rules \
249250 -H 'Content-Type: application/json' \
250251 -H 'anthropic-version: 2023-06-01' \
251 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
252 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
252253 -d '{
253254 "issuer_id": "issuer_id",
254255 "match": {},
api/admin/federation_rules/update Changed · +4 / -2 lines
from line 2
22
33**POST** `/v1/organizations/federation_rules/{federation_rule_id}`
44
5**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
6
57Partially update a federation rule.
68
79`issuer_id` is immutable. `match` and `target` are replaced as whole
from line 20
1820or description change) must also supply a conforming `match` in the same
1921request. OAuth callers may only manage rules whose `oauth_scope` is
2022`workspace:developer` or `workspace:inference`; other scopes require a
21Console session. Admin API keys are not accepted.
23Console session.
2224
2325## Path parameters
2426
from line 257
255257curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID \
256258 -H 'Content-Type: application/json' \
257259 -H 'anthropic-version: 2023-06-01' \
258 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
260 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
259261 -d '{}'
260262```
261263
api/admin/federation_rules/workspaces Changed · +13 / -7 lines
from line 4
44
55**GET** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
66
7**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
8
79List workspaces where this federation rule is enabled.
810
911Returns all workspace enablements in a single response; the `limit` and
from line 79
7779```bash
7880curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \
7981 -H 'anthropic-version: 2023-06-01' \
80 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
82 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
8183```
8284
8385#### Response (200)
from line 104
102104
103105**POST** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
104106
107**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
108
105109Enable a federation rule for a workspace.
106110
107111Idempotent; re-enabling returns the existing enablement. The rule and
from line 113
109113rule's target service account in this workspace is not checked at
110114enablement: token exchange into this workspace is rejected unless the
111115target is a member (it is implicitly a member of the default workspace).
112Archived rules are rejected with 400. OAuth callers may only manage rules whose
113`oauth_scope` is `workspace:developer` or `workspace:inference`; other
114scopes require a Console session. Admin API keys are not accepted.
116Archived rules are rejected with 400. OAuth callers may only manage rules
117whose `oauth_scope` is `workspace:developer` or `workspace:inference`;
118other scopes require a Console session.
115119
116120### Path parameters
117121
from line 171
167171curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \
168172 -H 'Content-Type: application/json' \
169173 -H 'anthropic-version: 2023-06-01' \
170 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
174 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
171175 -d '{
172176 "workspace_id": "workspace_id"
173177 }'
from line 194
190194
191195**DELETE** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}`
192196
197**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
198
193199Disable a federation rule for a workspace.
194200
195201Idempotent; succeeds even if the enablement was already removed. OAuth
196202callers may only manage rules whose `oauth_scope` is
197203`workspace:developer` or `workspace:inference`; other scopes require a
198Console session. Admin API keys are not accepted.
204Console session.
199205
200206### Path parameters
201207
from line 241
235241curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces/$WORKSPACE_ID \
236242 -X DELETE \
237243 -H 'anthropic-version: 2023-06-01' \
238 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
244 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
239245```
240246
241247#### Response (200)
api/admin/federation_rules/workspaces/create Changed · +6 / -4 lines
from line 2
22
33**POST** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
44
5**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
6
57Enable a federation rule for a workspace.
68
79Idempotent; re-enabling returns the existing enablement. The rule and
from line 11
911rule's target service account in this workspace is not checked at
1012enablement: token exchange into this workspace is rejected unless the
1113target is a member (it is implicitly a member of the default workspace).
12Archived rules are rejected with 400. OAuth callers may only manage rules whose
13`oauth_scope` is `workspace:developer` or `workspace:inference`; other
14scopes require a Console session. Admin API keys are not accepted.
14Archived rules are rejected with 400. OAuth callers may only manage rules
15whose `oauth_scope` is `workspace:developer` or `workspace:inference`;
16other scopes require a Console session.
1517
1618## Path parameters
1719
from line 69
6769curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \
6870 -H 'Content-Type: application/json' \
6971 -H 'anthropic-version: 2023-06-01' \
70 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
72 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
7173 -d '{
7274 "workspace_id": "workspace_id"
7375 }'
api/admin/federation_rules/workspaces/delete Changed · +4 / -2 lines
from line 2
22
33**DELETE** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}`
44
5**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
6
57Disable a federation rule for a workspace.
68
79Idempotent; succeeds even if the enablement was already removed. OAuth
810callers may only manage rules whose `oauth_scope` is
911`workspace:developer` or `workspace:inference`; other scopes require a
10Console session. Admin API keys are not accepted.
12Console session.
1113
1214## Path parameters
1315
from line 49
4749curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces/$WORKSPACE_ID \
4850 -X DELETE \
4951 -H 'anthropic-version: 2023-06-01' \
50 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
52 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
5153```
5254
5355### Response (200)