What this read moved
276–300 of 519This capture is too large to show at once. Changes 276-300 of 519 are below, significant first; the rest are on the following screens.
api/beta/organization/mcp_tunnels/reveal_token New page · 163 lines, new page
# Reveal Tunnel Token ## Path parameters ## Headers ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Reveal Tunnel Token
url: https://platform.claude.com/docs/en/api/beta/organization/mcp_tunnels/reveal_token
---
# Reveal Tunnel Token
**POST** `/v1/organizations/tunnels/{tunnel_id}/reveal_token`
**Deprecated**
**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.
Return the tunnel's current connection token.
The value is fetched live on each call; Anthropic does not store it.
Repeated calls return the same value until the token is rotated.
Exposed as `POST` so the token does not appear in intermediary
access logs.
## Path parameters
- `tunnel_id: string`
ID of the Tunnel.
## Headers
- `"anthropic-beta": array of AnthropicBeta`
Optional header to specify the beta version(s) you want to use.
- `string`
- `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 42 more`
- `"message-batches-2024-09-24"`
- `"prompt-caching-2024-07-31"`
- `"computer-use-2024-10-22"`
- `"computer-use-2025-01-24"`
- `"pdfs-2024-09-25"`
- `"token-counting-2024-11-01"`
- `"token-efficient-tools-2025-02-19"`
- `"output-128k-2025-02-19"`
- `"files-api-2025-04-14"`
- `"mcp-client-2025-04-04"`
- `"mcp-client-2025-11-20"`
- `"dev-full-thinking-2025-05-14"`
- `"interleaved-thinking-2025-05-14"`
- `"code-execution-2025-05-22"`
- `"extended-cache-ttl-2025-04-11"`
- `"context-1m-2025-08-07"`
- `"context-management-2025-06-27"`
- `"model-context-window-exceeded-2025-08-26"`
- `"skills-2025-10-02"`
- `"fast-mode-2026-02-01"`
- `"output-300k-2026-03-24"`
- `"user-profiles-2026-03-24"`
- `"user-profiles-2026-08-18"`
- `"user-profiles-2026-09-04"`
- `"advisor-tool-2026-03-01"`
- `"managed-agents-2026-04-01"`
- `"cache-diagnosis-2026-04-07"`
- `"dreaming-2026-04-21"`
- `"thinking-token-count-2026-05-13"`
- `"server-side-fallback-2026-06-01"`
- `"server-side-fallback-2026-07-01"`
- `"fallback-credit-2026-06-01"`
- `"fallback-credit-2026-07-01"`
- `"agent-memory-2026-07-22"`
- `"mid-conversation-tool-changes-2026-07-01"`
- `"compact-2026-01-12"`
- `"computer-use-2025-11-24"`
- `"mcp-tunnels-2026-06-22"`
- `"structured-outputs-2025-11-13"`
- `"task-budgets-2026-03-13"`
- `"thinking-display-updates-2026-08-18"`
- `"ce-user-management-2026-07-13"`
- `"mid-conversation-output-config-2026-07-01"`
- `"thinking-binding-controls-2026-08-01"`
- `"mid-conversation-system-clear-at-2026-08-21"`
## Returns
- `BetaOrganizationTunnelToken object`
- `type: "tunnel_token"`
Object type. Always `tunnel_token` for Tunnel Tokens.
default: tunnel_token
- `id: string`
Stable identifier for the current token value. Changes when the token is
rotated.
- `tunnel_token: string`
The tunnel's connection token.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/reveal_token \
-X POST \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"id": "ttkn_bb97000eaec162831399ca9b6684a4fdf5be49ace5683057b017aab5c87e19e0",
"tunnel_token": "eyJhIjoiRVhBTVBMRSIsInQiOiJFWEFNUExFIiwicyI6IkVYQU1QTEUifQ==",
"type": "tunnel_token"
}
```
api/beta/organization/mcp_tunnels/rotate_token New page · 170 lines, new page
# Rotate Tunnel Token ## Path parameters ## Headers ## Body parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Rotate Tunnel Token
url: https://platform.claude.com/docs/en/api/beta/organization/mcp_tunnels/rotate_token
---
# Rotate Tunnel Token
**POST** `/v1/organizations/tunnels/{tunnel_id}/rotate_token`
**Deprecated**
**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.
Invalidate the tunnel's current token for new connections and return a fresh value.
Established connections are not severed by rotation; a connector
restarted after rotation must use the new value. An optional
`reason` is captured for operational context.
## Path parameters
- `tunnel_id: string`
ID of the Tunnel.
## Headers
- `"anthropic-beta": array of AnthropicBeta`
Optional header to specify the beta version(s) you want to use.
- `string`
- `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 42 more`
- `"message-batches-2024-09-24"`
- `"prompt-caching-2024-07-31"`
- `"computer-use-2024-10-22"`
- `"computer-use-2025-01-24"`
- `"pdfs-2024-09-25"`
- `"token-counting-2024-11-01"`
- `"token-efficient-tools-2025-02-19"`
- `"output-128k-2025-02-19"`
- `"files-api-2025-04-14"`
- `"mcp-client-2025-04-04"`
- `"mcp-client-2025-11-20"`
- `"dev-full-thinking-2025-05-14"`
- `"interleaved-thinking-2025-05-14"`
- `"code-execution-2025-05-22"`
- `"extended-cache-ttl-2025-04-11"`
- `"context-1m-2025-08-07"`
- `"context-management-2025-06-27"`
- `"model-context-window-exceeded-2025-08-26"`
- `"skills-2025-10-02"`
- `"fast-mode-2026-02-01"`
- `"output-300k-2026-03-24"`
- `"user-profiles-2026-03-24"`
- `"user-profiles-2026-08-18"`
- `"user-profiles-2026-09-04"`
- `"advisor-tool-2026-03-01"`
- `"managed-agents-2026-04-01"`
- `"cache-diagnosis-2026-04-07"`
- `"dreaming-2026-04-21"`
- `"thinking-token-count-2026-05-13"`
- `"server-side-fallback-2026-06-01"`
- `"server-side-fallback-2026-07-01"`
- `"fallback-credit-2026-06-01"`
- `"fallback-credit-2026-07-01"`
- `"agent-memory-2026-07-22"`
- `"mid-conversation-tool-changes-2026-07-01"`
- `"compact-2026-01-12"`
- `"computer-use-2025-11-24"`
- `"mcp-tunnels-2026-06-22"`
- `"structured-outputs-2025-11-13"`
- `"task-budgets-2026-03-13"`
- `"thinking-display-updates-2026-08-18"`
- `"ce-user-management-2026-07-13"`
- `"mid-conversation-output-config-2026-07-01"`
- `"thinking-binding-controls-2026-08-01"`
- `"mid-conversation-system-clear-at-2026-08-21"`
## Body parameters
- `reason: optional string or null`
Optional free-text reason for the rotation, recorded for audit.
maxLength: 1024
## Returns
- `BetaOrganizationTunnelToken object`
- `type: "tunnel_token"`
Object type. Always `tunnel_token` for Tunnel Tokens.
default: tunnel_token
- `id: string`
Stable identifier for the current token value. Changes when the token is
rotated.
- `tunnel_token: string`
The tunnel's connection token.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/rotate_token \
-X POST \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"id": "ttkn_bb97000eaec162831399ca9b6684a4fdf5be49ace5683057b017aab5c87e19e0",
"tunnel_token": "eyJhIjoiRVhBTVBMRSIsInQiOiJFWEFNUExFIiwicyI6IkVYQU1QTEUifQ==",
"type": "tunnel_token"
}
```
api/beta/organization/mcp_tunnels/tunnel_certificates New page · 832 lines, new page
# Tunnel Certificates ## Create Tunnel Certificate ### Path parameters ### Headers ### Body parameters ### Returns ### Example #### Response (200) ## List Tunnel Certificates ### Path parameters ### Query parameters ### Headers ### Returns ### Example #### Response (200) ## Get Tunnel Certificate ### Path parameters ### Headers ### Returns ### Example #### Response (200) ## Archive Tunnel Certificate ### Path parameters ### Headers ### Returns ### Example #### Response (200) ## Domain types ### Beta Organization Tunnel Certificate
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Tunnel Certificates
url: https://platform.claude.com/docs/en/api/beta/organization/mcp_tunnels/tunnel_certificates
---
# Tunnel Certificates
## Create Tunnel Certificate
**POST** `/v1/organizations/tunnels/{tunnel_id}/certificates`
**Deprecated**
**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.
Register a public CA certificate for the tunnel.
Anthropic verifies the gateway's server certificate against this CA
when it terminates the inner TLS session. The PEM body must contain
exactly one X.509 certificate and no private-key material. A tunnel
holds at most two non-archived certificates.
### Path parameters
- `tunnel_id: string`
ID of the Tunnel.
### Headers
- `"anthropic-beta": array of AnthropicBeta`
Optional header to specify the beta version(s) you want to use.
- `string`
- `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 42 more`
- `"message-batches-2024-09-24"`
- `"prompt-caching-2024-07-31"`
- `"computer-use-2024-10-22"`
- `"computer-use-2025-01-24"`
- `"pdfs-2024-09-25"`
- `"token-counting-2024-11-01"`
- `"token-efficient-tools-2025-02-19"`
- `"output-128k-2025-02-19"`
- `"files-api-2025-04-14"`
- `"mcp-client-2025-04-04"`
- `"mcp-client-2025-11-20"`
- `"dev-full-thinking-2025-05-14"`
- `"interleaved-thinking-2025-05-14"`
- `"code-execution-2025-05-22"`
- `"extended-cache-ttl-2025-04-11"`
- `"context-1m-2025-08-07"`
- `"context-management-2025-06-27"`
- `"model-context-window-exceeded-2025-08-26"`
- `"skills-2025-10-02"`
- `"fast-mode-2026-02-01"`
- `"output-300k-2026-03-24"`
- `"user-profiles-2026-03-24"`
- `"user-profiles-2026-08-18"`
- `"user-profiles-2026-09-04"`
- `"advisor-tool-2026-03-01"`
- `"managed-agents-2026-04-01"`
- `"cache-diagnosis-2026-04-07"`
- `"dreaming-2026-04-21"`
- `"thinking-token-count-2026-05-13"`
- `"server-side-fallback-2026-06-01"`
- `"server-side-fallback-2026-07-01"`
- `"fallback-credit-2026-06-01"`
- `"fallback-credit-2026-07-01"`
- `"agent-memory-2026-07-22"`
- `"mid-conversation-tool-changes-2026-07-01"`
- `"compact-2026-01-12"`
- `"computer-use-2025-11-24"`
- `"mcp-tunnels-2026-06-22"`
- `"structured-outputs-2025-11-13"`
- `"task-budgets-2026-03-13"`
- `"thinking-display-updates-2026-08-18"`
- `"ce-user-management-2026-07-13"`
- `"mid-conversation-output-config-2026-07-01"`
- `"thinking-binding-controls-2026-08-01"`
- `"mid-conversation-system-clear-at-2026-08-21"`
### Body parameters
- `ca_certificate_pem: string`
PEM-encoded X.509 CA certificate. Must contain exactly one certificate and
no private-key material.
maxLength: 8192
### Returns
- `BetaOrganizationTunnelCertificate object`
- `type: "tunnel_certificate"`
Object type. Always `tunnel_certificate` for Tunnel Certificates.
default: tunnel_certificate
- `id: string`
ID of the Tunnel Certificate.
- `archived_at: string or null`
RFC 3339 datetime string indicating when the certificate was archived, or
`null` if it is not archived.
format: date-time
- `created_at: string`
RFC 3339 datetime string indicating when the certificate was registered.
format: date-time
- `expires_at: string or null`
RFC 3339 datetime string indicating when the certificate expires, or
`null` if it does not expire.
format: date-time
- `fingerprint: string`
The certificate's SHA-256 fingerprint, as a lowercase hex string.
- `tunnel_id: string`
ID of the Tunnel this certificate is registered against.
### Example
```bash
curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY" \
-d '{
"ca_certificate_pem": "-----BEGIN CERTIFICATE-----\nMIIBexampleEXAMPLEexampleEXAMPLEexampleEXAMPLEexampleEXAMPLEexa\n...illustrative placeholder, not a real certificate...\n-----END CERTIFICATE-----\n"
}'
```
#### Response (200)
```json
{
"id": "tcrt_01JmWq4ZxnBvR7tKpY2sLdH9",
"archived_at": "2024-11-01T23:59:27.427722Z",
"created_at": "2024-10-30T23:58:27.427722Z",
"expires_at": "2024-10-30T23:58:27.427722Z",
"fingerprint": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
"tunnel_id": "tnl_01Hx9Kp2RtQvMn3sWbYdLcF8",
"type": "tunnel_certificate"
}
```
## List Tunnel Certificates
**GET** `/v1/organizations/tunnels/{tunnel_id}/certificates`
**Deprecated**
**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.
List the certificates registered on a tunnel.
Archived certificates are excluded unless `include_archived` is set.
### Path parameters
- `tunnel_id: string`
ID of the Tunnel.
### Query parameters
- `include_archived: optional boolean`
Include archived certificates in the results. Archived certificates are
excluded by default.
default: false
- `limit: optional number`
Maximum number of certificates to return.
default: 20, maximum: 1000, minimum: 1
- `page: optional string`
A tunnel has at most two active certificates, so this list is not
paginated.
### Headers
- `"anthropic-beta": array of AnthropicBeta`
Optional header to specify the beta version(s) you want to use.
- `string`
- `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 42 more`
- `"message-batches-2024-09-24"`
- `"prompt-caching-2024-07-31"`
- `"computer-use-2024-10-22"`
- `"computer-use-2025-01-24"`
- `"pdfs-2024-09-25"`
- `"token-counting-2024-11-01"`
- `"token-efficient-tools-2025-02-19"`
- `"output-128k-2025-02-19"`
- `"files-api-2025-04-14"`
- `"mcp-client-2025-04-04"`
- `"mcp-client-2025-11-20"`
- `"dev-full-thinking-2025-05-14"`
- `"interleaved-thinking-2025-05-14"`
- `"code-execution-2025-05-22"`
- `"extended-cache-ttl-2025-04-11"`
- `"context-1m-2025-08-07"`
- `"context-management-2025-06-27"`
- `"model-context-window-exceeded-2025-08-26"`
- `"skills-2025-10-02"`
- `"fast-mode-2026-02-01"`
- `"output-300k-2026-03-24"`
- `"user-profiles-2026-03-24"`
- `"user-profiles-2026-08-18"`
- `"user-profiles-2026-09-04"`
Cut at 300 lines. The page has the rest.
api/beta/organization/mcp_tunnels/tunnel_certificates/archive New page · 193 lines, new page
# Archive Tunnel Certificate ## Path parameters ## Headers ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Archive Tunnel Certificate
url: https://platform.claude.com/docs/en/api/beta/organization/mcp_tunnels/tunnel_certificates/archive
---
# Archive Tunnel Certificate
**POST** `/v1/organizations/tunnels/{tunnel_id}/certificates/{certificate_id}/archive`
**Deprecated**
**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.
Archive a certificate, removing it from the set Anthropic trusts for this tunnel.
The certificate record is retained. Archiving the last non-archived
certificate is permitted; the tunnel rejects MCP traffic until a new
certificate is added.
## Path parameters
- `tunnel_id: string`
ID of the Tunnel.
- `certificate_id: string`
ID of the Tunnel Certificate.
## Headers
- `"anthropic-beta": array of AnthropicBeta`
Optional header to specify the beta version(s) you want to use.
- `string`
- `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 42 more`
- `"message-batches-2024-09-24"`
- `"prompt-caching-2024-07-31"`
- `"computer-use-2024-10-22"`
- `"computer-use-2025-01-24"`
- `"pdfs-2024-09-25"`
- `"token-counting-2024-11-01"`
- `"token-efficient-tools-2025-02-19"`
- `"output-128k-2025-02-19"`
- `"files-api-2025-04-14"`
- `"mcp-client-2025-04-04"`
- `"mcp-client-2025-11-20"`
- `"dev-full-thinking-2025-05-14"`
- `"interleaved-thinking-2025-05-14"`
- `"code-execution-2025-05-22"`
- `"extended-cache-ttl-2025-04-11"`
- `"context-1m-2025-08-07"`
- `"context-management-2025-06-27"`
- `"model-context-window-exceeded-2025-08-26"`
- `"skills-2025-10-02"`
- `"fast-mode-2026-02-01"`
- `"output-300k-2026-03-24"`
- `"user-profiles-2026-03-24"`
- `"user-profiles-2026-08-18"`
- `"user-profiles-2026-09-04"`
- `"advisor-tool-2026-03-01"`
- `"managed-agents-2026-04-01"`
- `"cache-diagnosis-2026-04-07"`
- `"dreaming-2026-04-21"`
- `"thinking-token-count-2026-05-13"`
- `"server-side-fallback-2026-06-01"`
- `"server-side-fallback-2026-07-01"`
- `"fallback-credit-2026-06-01"`
- `"fallback-credit-2026-07-01"`
- `"agent-memory-2026-07-22"`
- `"mid-conversation-tool-changes-2026-07-01"`
- `"compact-2026-01-12"`
- `"computer-use-2025-11-24"`
- `"mcp-tunnels-2026-06-22"`
- `"structured-outputs-2025-11-13"`
- `"task-budgets-2026-03-13"`
- `"thinking-display-updates-2026-08-18"`
- `"ce-user-management-2026-07-13"`
- `"mid-conversation-output-config-2026-07-01"`
- `"thinking-binding-controls-2026-08-01"`
- `"mid-conversation-system-clear-at-2026-08-21"`
## Returns
- `BetaOrganizationTunnelCertificate object`
- `type: "tunnel_certificate"`
Object type. Always `tunnel_certificate` for Tunnel Certificates.
default: tunnel_certificate
- `id: string`
ID of the Tunnel Certificate.
- `archived_at: string or null`
RFC 3339 datetime string indicating when the certificate was archived, or
`null` if it is not archived.
format: date-time
- `created_at: string`
RFC 3339 datetime string indicating when the certificate was registered.
format: date-time
- `expires_at: string or null`
RFC 3339 datetime string indicating when the certificate expires, or
`null` if it does not expire.
format: date-time
- `fingerprint: string`
The certificate's SHA-256 fingerprint, as a lowercase hex string.
- `tunnel_id: string`
ID of the Tunnel this certificate is registered against.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID/archive \
-X POST \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"id": "tcrt_01JmWq4ZxnBvR7tKpY2sLdH9",
"archived_at": "2024-11-01T23:59:27.427722Z",
"created_at": "2024-10-30T23:58:27.427722Z",
"expires_at": "2024-10-30T23:58:27.427722Z",
"fingerprint": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
"tunnel_id": "tnl_01Hx9Kp2RtQvMn3sWbYdLcF8",
"type": "tunnel_certificate"
}
```
api/beta/organization/mcp_tunnels/tunnel_certificates/create New page · 202 lines, new page
# Create Tunnel Certificate ## Path parameters ## Headers ## Body parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Create Tunnel Certificate
url: https://platform.claude.com/docs/en/api/beta/organization/mcp_tunnels/tunnel_certificates/create
---
# Create Tunnel Certificate
**POST** `/v1/organizations/tunnels/{tunnel_id}/certificates`
**Deprecated**
**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.
Register a public CA certificate for the tunnel.
Anthropic verifies the gateway's server certificate against this CA
when it terminates the inner TLS session. The PEM body must contain
exactly one X.509 certificate and no private-key material. A tunnel
holds at most two non-archived certificates.
## Path parameters
- `tunnel_id: string`
ID of the Tunnel.
## Headers
- `"anthropic-beta": array of AnthropicBeta`
Optional header to specify the beta version(s) you want to use.
- `string`
- `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 42 more`
- `"message-batches-2024-09-24"`
- `"prompt-caching-2024-07-31"`
- `"computer-use-2024-10-22"`
- `"computer-use-2025-01-24"`
- `"pdfs-2024-09-25"`
- `"token-counting-2024-11-01"`
- `"token-efficient-tools-2025-02-19"`
- `"output-128k-2025-02-19"`
- `"files-api-2025-04-14"`
- `"mcp-client-2025-04-04"`
- `"mcp-client-2025-11-20"`
- `"dev-full-thinking-2025-05-14"`
- `"interleaved-thinking-2025-05-14"`
- `"code-execution-2025-05-22"`
- `"extended-cache-ttl-2025-04-11"`
- `"context-1m-2025-08-07"`
- `"context-management-2025-06-27"`
- `"model-context-window-exceeded-2025-08-26"`
- `"skills-2025-10-02"`
- `"fast-mode-2026-02-01"`
- `"output-300k-2026-03-24"`
- `"user-profiles-2026-03-24"`
- `"user-profiles-2026-08-18"`
- `"user-profiles-2026-09-04"`
- `"advisor-tool-2026-03-01"`
- `"managed-agents-2026-04-01"`
- `"cache-diagnosis-2026-04-07"`
- `"dreaming-2026-04-21"`
- `"thinking-token-count-2026-05-13"`
- `"server-side-fallback-2026-06-01"`
- `"server-side-fallback-2026-07-01"`
- `"fallback-credit-2026-06-01"`
- `"fallback-credit-2026-07-01"`
- `"agent-memory-2026-07-22"`
- `"mid-conversation-tool-changes-2026-07-01"`
- `"compact-2026-01-12"`
- `"computer-use-2025-11-24"`
- `"mcp-tunnels-2026-06-22"`
- `"structured-outputs-2025-11-13"`
- `"task-budgets-2026-03-13"`
- `"thinking-display-updates-2026-08-18"`
- `"ce-user-management-2026-07-13"`
- `"mid-conversation-output-config-2026-07-01"`
- `"thinking-binding-controls-2026-08-01"`
- `"mid-conversation-system-clear-at-2026-08-21"`
## Body parameters
- `ca_certificate_pem: string`
PEM-encoded X.509 CA certificate. Must contain exactly one certificate and
no private-key material.
maxLength: 8192
## Returns
- `BetaOrganizationTunnelCertificate object`
- `type: "tunnel_certificate"`
Object type. Always `tunnel_certificate` for Tunnel Certificates.
default: tunnel_certificate
- `id: string`
ID of the Tunnel Certificate.
- `archived_at: string or null`
RFC 3339 datetime string indicating when the certificate was archived, or
`null` if it is not archived.
format: date-time
- `created_at: string`
RFC 3339 datetime string indicating when the certificate was registered.
format: date-time
- `expires_at: string or null`
RFC 3339 datetime string indicating when the certificate expires, or
`null` if it does not expire.
format: date-time
- `fingerprint: string`
The certificate's SHA-256 fingerprint, as a lowercase hex string.
- `tunnel_id: string`
ID of the Tunnel this certificate is registered against.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY" \
-d '{
"ca_certificate_pem": "-----BEGIN CERTIFICATE-----\nMIIBexampleEXAMPLEexampleEXAMPLEexampleEXAMPLEexampleEXAMPLEexa\n...illustrative placeholder, not a real certificate...\n-----END CERTIFICATE-----\n"
}'
```
### Response (200)
```json
{
"id": "tcrt_01JmWq4ZxnBvR7tKpY2sLdH9",
"archived_at": "2024-11-01T23:59:27.427722Z",
"created_at": "2024-10-30T23:58:27.427722Z",
"expires_at": "2024-10-30T23:58:27.427722Z",
"fingerprint": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
"tunnel_id": "tnl_01Hx9Kp2RtQvMn3sWbYdLcF8",
"type": "tunnel_certificate"
}
```
api/beta/organization/mcp_tunnels/tunnel_certificates/list New page · 215 lines, new page
# List Tunnel Certificates ## Path parameters ## Query parameters ## Headers ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: List Tunnel Certificates
url: https://platform.claude.com/docs/en/api/beta/organization/mcp_tunnels/tunnel_certificates/list
---
# List Tunnel Certificates
**GET** `/v1/organizations/tunnels/{tunnel_id}/certificates`
**Deprecated**
**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.
List the certificates registered on a tunnel.
Archived certificates are excluded unless `include_archived` is set.
## Path parameters
- `tunnel_id: string`
ID of the Tunnel.
## Query parameters
- `include_archived: optional boolean`
Include archived certificates in the results. Archived certificates are
excluded by default.
default: false
- `limit: optional number`
Maximum number of certificates to return.
default: 20, maximum: 1000, minimum: 1
- `page: optional string`
A tunnel has at most two active certificates, so this list is not
paginated.
## Headers
- `"anthropic-beta": array of AnthropicBeta`
Optional header to specify the beta version(s) you want to use.
- `string`
- `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 42 more`
- `"message-batches-2024-09-24"`
- `"prompt-caching-2024-07-31"`
- `"computer-use-2024-10-22"`
- `"computer-use-2025-01-24"`
- `"pdfs-2024-09-25"`
- `"token-counting-2024-11-01"`
- `"token-efficient-tools-2025-02-19"`
- `"output-128k-2025-02-19"`
- `"files-api-2025-04-14"`
- `"mcp-client-2025-04-04"`
- `"mcp-client-2025-11-20"`
- `"dev-full-thinking-2025-05-14"`
- `"interleaved-thinking-2025-05-14"`
- `"code-execution-2025-05-22"`
- `"extended-cache-ttl-2025-04-11"`
- `"context-1m-2025-08-07"`
- `"context-management-2025-06-27"`
- `"model-context-window-exceeded-2025-08-26"`
- `"skills-2025-10-02"`
- `"fast-mode-2026-02-01"`
- `"output-300k-2026-03-24"`
- `"user-profiles-2026-03-24"`
- `"user-profiles-2026-08-18"`
- `"user-profiles-2026-09-04"`
- `"advisor-tool-2026-03-01"`
- `"managed-agents-2026-04-01"`
- `"cache-diagnosis-2026-04-07"`
- `"dreaming-2026-04-21"`
- `"thinking-token-count-2026-05-13"`
- `"server-side-fallback-2026-06-01"`
- `"server-side-fallback-2026-07-01"`
- `"fallback-credit-2026-06-01"`
- `"fallback-credit-2026-07-01"`
- `"agent-memory-2026-07-22"`
- `"mid-conversation-tool-changes-2026-07-01"`
- `"compact-2026-01-12"`
- `"computer-use-2025-11-24"`
- `"mcp-tunnels-2026-06-22"`
- `"structured-outputs-2025-11-13"`
- `"task-budgets-2026-03-13"`
- `"thinking-display-updates-2026-08-18"`
- `"ce-user-management-2026-07-13"`
- `"mid-conversation-output-config-2026-07-01"`
- `"thinking-binding-controls-2026-08-01"`
- `"mid-conversation-system-clear-at-2026-08-21"`
## Returns
- `data: array of BetaOrganizationTunnelCertificate`
- `type: "tunnel_certificate"`
Object type. Always `tunnel_certificate` for Tunnel Certificates.
default: tunnel_certificate
- `id: string`
ID of the Tunnel Certificate.
- `archived_at: string or null`
RFC 3339 datetime string indicating when the certificate was archived, or
`null` if it is not archived.
format: date-time
- `created_at: string`
RFC 3339 datetime string indicating when the certificate was registered.
format: date-time
- `expires_at: string or null`
RFC 3339 datetime string indicating when the certificate expires, or
`null` if it does not expire.
format: date-time
- `fingerprint: string`
The certificate's SHA-256 fingerprint, as a lowercase hex string.
- `tunnel_id: string`
ID of the Tunnel this certificate is registered against.
- `next_page: string or null`
Opaque cursor for the next page, or `null` if there are no more results.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"data": [
{
"id": "tcrt_01JmWq4ZxnBvR7tKpY2sLdH9",
"archived_at": "2024-11-01T23:59:27.427722Z",
"created_at": "2024-10-30T23:58:27.427722Z",
"expires_at": "2024-10-30T23:58:27.427722Z",
"fingerprint": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
"tunnel_id": "tnl_01Hx9Kp2RtQvMn3sWbYdLcF8",
"type": "tunnel_certificate"
}
],
"next_page": "page_MjAyNS0wNS0xNFQwMDowMDowMFo="
}
```
api/beta/organization/mcp_tunnels/tunnel_certificates/retrieve New page · 188 lines, new page
# Get Tunnel Certificate ## Path parameters ## Headers ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Get Tunnel Certificate
url: https://platform.claude.com/docs/en/api/beta/organization/mcp_tunnels/tunnel_certificates/retrieve
---
# Get Tunnel Certificate
**GET** `/v1/organizations/tunnels/{tunnel_id}/certificates/{certificate_id}`
**Deprecated**
**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.
Retrieve a single certificate registered on a tunnel by ID.
## Path parameters
- `tunnel_id: string`
ID of the Tunnel.
- `certificate_id: string`
ID of the Tunnel Certificate.
## Headers
- `"anthropic-beta": array of AnthropicBeta`
Optional header to specify the beta version(s) you want to use.
- `string`
- `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 42 more`
- `"message-batches-2024-09-24"`
- `"prompt-caching-2024-07-31"`
- `"computer-use-2024-10-22"`
- `"computer-use-2025-01-24"`
- `"pdfs-2024-09-25"`
- `"token-counting-2024-11-01"`
- `"token-efficient-tools-2025-02-19"`
- `"output-128k-2025-02-19"`
- `"files-api-2025-04-14"`
- `"mcp-client-2025-04-04"`
- `"mcp-client-2025-11-20"`
- `"dev-full-thinking-2025-05-14"`
- `"interleaved-thinking-2025-05-14"`
- `"code-execution-2025-05-22"`
- `"extended-cache-ttl-2025-04-11"`
- `"context-1m-2025-08-07"`
- `"context-management-2025-06-27"`
- `"model-context-window-exceeded-2025-08-26"`
- `"skills-2025-10-02"`
- `"fast-mode-2026-02-01"`
- `"output-300k-2026-03-24"`
- `"user-profiles-2026-03-24"`
- `"user-profiles-2026-08-18"`
- `"user-profiles-2026-09-04"`
- `"advisor-tool-2026-03-01"`
- `"managed-agents-2026-04-01"`
- `"cache-diagnosis-2026-04-07"`
- `"dreaming-2026-04-21"`
- `"thinking-token-count-2026-05-13"`
- `"server-side-fallback-2026-06-01"`
- `"server-side-fallback-2026-07-01"`
- `"fallback-credit-2026-06-01"`
- `"fallback-credit-2026-07-01"`
- `"agent-memory-2026-07-22"`
- `"mid-conversation-tool-changes-2026-07-01"`
- `"compact-2026-01-12"`
- `"computer-use-2025-11-24"`
- `"mcp-tunnels-2026-06-22"`
- `"structured-outputs-2025-11-13"`
- `"task-budgets-2026-03-13"`
- `"thinking-display-updates-2026-08-18"`
- `"ce-user-management-2026-07-13"`
- `"mid-conversation-output-config-2026-07-01"`
- `"thinking-binding-controls-2026-08-01"`
- `"mid-conversation-system-clear-at-2026-08-21"`
## Returns
- `BetaOrganizationTunnelCertificate object`
- `type: "tunnel_certificate"`
Object type. Always `tunnel_certificate` for Tunnel Certificates.
default: tunnel_certificate
- `id: string`
ID of the Tunnel Certificate.
- `archived_at: string or null`
RFC 3339 datetime string indicating when the certificate was archived, or
`null` if it is not archived.
format: date-time
- `created_at: string`
RFC 3339 datetime string indicating when the certificate was registered.
format: date-time
- `expires_at: string or null`
RFC 3339 datetime string indicating when the certificate expires, or
`null` if it does not expire.
format: date-time
- `fingerprint: string`
The certificate's SHA-256 fingerprint, as a lowercase hex string.
- `tunnel_id: string`
ID of the Tunnel this certificate is registered against.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"id": "tcrt_01JmWq4ZxnBvR7tKpY2sLdH9",
"archived_at": "2024-11-01T23:59:27.427722Z",
"created_at": "2024-10-30T23:58:27.427722Z",
"expires_at": "2024-10-30T23:58:27.427722Z",
"fingerprint": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
"tunnel_id": "tnl_01Hx9Kp2RtQvMn3sWbYdLcF8",
"type": "tunnel_certificate"
}
```
api/beta/organization/rate_limits Changed · +17 / -12 lines
from line 1
1---
2title: Rate Limits
3url: https://platform.claude.com/docs/en/api/beta/organization/rate_limits
4---
5
16# Rate Limits
27
38## List Organization Rate Limits
from line 59
5459
5560 Rate-limit entries for the organization, one per group.
5661
62 - `type: "rate_limit"`
63
64 Object type. Always `rate_limit` for organization rate-limit entries.
65
66 default: rate_limit
67
5768 - `id: string`
5869
5970 Stable identifier for this rate-limit group within the organization.
from line 101
90101
91102 Model names this entry's limits apply to, including aliases. `null` when `group_type` is not `"model_group"`.
92103
93 - `type: "rate_limit"`
94
95 Object type. Always `rate_limit` for organization rate-limit entries.
96
97 default: rate_limit
98
99104- `next_page: string or null`
100105
101106 Opaque cursor for the next page of results, or `null` when no entries remain beyond this response.
from line 143
138143
139144- `BetaOrganizationRateLimit object`
140145
146 - `type: "rate_limit"`
147
148 Object type. Always `rate_limit` for organization rate-limit entries.
149
150 default: rate_limit
151
141152 - `id: string`
142153
143154 Stable identifier for this rate-limit group within the organization.
from line 184
173184 - `models: array of string or null`
174185
175186 Model names this entry's limits apply to, including aliases. `null` when `group_type` is not `"model_group"`.
176
177 - `type: "rate_limit"`
178
179 Object type. Always `rate_limit` for organization rate-limit entries.
180
181 default: rate_limit
182187
183188### Beta Organization Rate Limit Value
184189
api/beta/organization/rate_limits/list Changed · +11 / -6 lines
from line 1
1---
2title: List Organization Rate Limits
3url: https://platform.claude.com/docs/en/api/beta/organization/rate_limits/list
4---
5
16# List Organization Rate Limits
27
38**GET** `/v1/organizations/rate_limits`
from line 57
5257
5358 Rate-limit entries for the organization, one per group.
5459
60 - `type: "rate_limit"`
61
62 Object type. Always `rate_limit` for organization rate-limit entries.
63
64 default: rate_limit
65
5566 - `id: string`
5667
5768 Stable identifier for this rate-limit group within the organization.
from line 98
8798 - `models: array of string or null`
8899
89100 Model names this entry's limits apply to, including aliases. `null` when `group_type` is not `"model_group"`.
90
91 - `type: "rate_limit"`
92
93 Object type. Always `rate_limit` for organization rate-limit entries.
94
95 default: rate_limit
96101
97102- `next_page: string or null`
98103
api/beta/organization/rbac_groups New page · 715 lines, new page
# RBAC Groups ## List RBAC Groups ### Query parameters ### Returns ### Example #### Response (200) ## Get RBAC Group ### Path parameters ### Returns ### Example #### Response (200) ## Create RBAC Group ### Body parameters ### Returns ### Example #### Response (200) ## Update RBAC Group ### Path parameters ### Body parameters ### Returns ### Example #### Response (200) ## Delete RBAC Group ### Path parameters ### Returns ### Example #### Response (200) ## Domain types ### Beta RBAC Group ### Beta RBAC Group Deleted ## RBAC Groups › Members ### List RBAC Group Members #### Path parameters #### Query parameters #### Returns #### Example ##### Response (200) ### Add RBAC Group Member #### Path parameters #### Body parameters #### Returns #### Example ##### Response (200) ### Remove RBAC Group Member #### Path parameters #### Returns #### Example ##### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: RBAC Groups
url: https://platform.claude.com/docs/en/api/beta/organization/rbac_groups
---
# RBAC Groups
## List RBAC Groups
**GET** `/v1/organizations/rbac_groups`
List RBAC Groups in the Claude Enterprise tenant.
The RBAC Groups API is available to Claude Enterprise organizations only.
### Query parameters
- `limit: optional number`
Number of items to return per page.
Defaults to `20`. Ranges from `1` to `1000`.
default: 20, maximum: 1000, minimum: 1
- `page: optional string`
Optionally set to the `next_page` token from the previous response.
### Returns
- `data: array of BetaRBACGroup`
- `type: "rbac_group"`
Object type.
For RBAC Groups, this is always `"rbac_group"`.
default: rbac_group
- `id: string`
ID of the RBAC Group.
- `created_at: string`
RFC 3339 timestamp of when the RBAC Group was created.
format: date-time
- `name: string`
Name of the RBAC Group. Not uniqueness-enforced.
- `roles: array of string or null`
RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list.
- `source_type: "direct" or "scim"`
How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider.
- `"direct"`
- `"scim"`
- `updated_at: string`
RFC 3339 timestamp of when the RBAC Group was last updated.
format: date-time
- `has_more: boolean`
Indicates if there are more results in the requested page direction.
- `next_page: string or null`
Token to provide in as `page` in the subsequent request to retrieve the next page of data.
### Example
```bash
curl https://api.anthropic.com/v1/organizations/rbac_groups \
-H 'anthropic-version: 2023-06-01' \
-H 'anthropic-beta: ce-user-management-2026-07-13' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
#### Response (200)
```json
{
"data": [
{
"id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
"created_at": "2024-10-30T23:58:27.427722Z",
"name": "Engineering",
"roles": [
"rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s"
],
"source_type": "direct",
"type": "rbac_group",
"updated_at": "2024-10-30T23:58:27.427722Z"
}
],
"has_more": false,
"next_page": "eyJjdXJzb3IiOiAicmJhY19ncm91cF8wMSJ9"
}
```
## Get RBAC Group
**GET** `/v1/organizations/rbac_groups/{group_id}`
Retrieve an RBAC Group by ID.
The RBAC Groups API is available to Claude Enterprise organizations only.
### Path parameters
- `group_id: string`
ID of the RBAC Group.
### Returns
- `BetaRBACGroup object`
- `type: "rbac_group"`
Object type.
For RBAC Groups, this is always `"rbac_group"`.
default: rbac_group
- `id: string`
ID of the RBAC Group.
- `created_at: string`
RFC 3339 timestamp of when the RBAC Group was created.
format: date-time
- `name: string`
Name of the RBAC Group. Not uniqueness-enforced.
- `roles: array of string or null`
RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list.
- `source_type: "direct" or "scim"`
How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider.
- `"direct"`
- `"scim"`
- `updated_at: string`
RFC 3339 timestamp of when the RBAC Group was last updated.
format: date-time
### Example
```bash
curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID \
-H 'anthropic-version: 2023-06-01' \
-H 'anthropic-beta: ce-user-management-2026-07-13' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
#### Response (200)
```json
{
"id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
"created_at": "2024-10-30T23:58:27.427722Z",
"name": "Engineering",
"roles": [
"rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s"
],
"source_type": "direct",
"type": "rbac_group",
"updated_at": "2024-10-30T23:58:27.427722Z"
}
```
## Create RBAC Group
**POST** `/v1/organizations/rbac_groups`
Create an RBAC Group in the Claude Enterprise tenant. Groups created via the API have source type `"direct"`.
The RBAC Groups API is available to Claude Enterprise organizations only.
### Body parameters
- `name: string`
Name of the RBAC Group. Not uniqueness-enforced.
maxLength: 255, minLength: 1
### Returns
- `BetaRBACGroup object`
- `type: "rbac_group"`
Object type.
For RBAC Groups, this is always `"rbac_group"`.
default: rbac_group
- `id: string`
ID of the RBAC Group.
- `created_at: string`
RFC 3339 timestamp of when the RBAC Group was created.
format: date-time
- `name: string`
Name of the RBAC Group. Not uniqueness-enforced.
- `roles: array of string or null`
RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list.
- `source_type: "direct" or "scim"`
How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider.
- `"direct"`
- `"scim"`
- `updated_at: string`
RFC 3339 timestamp of when the RBAC Group was last updated.
format: date-time
### Example
```bash
curl https://api.anthropic.com/v1/organizations/rbac_groups \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H 'anthropic-beta: ce-user-management-2026-07-13' \
-H "X-Api-Key: $ANTHROPIC_API_KEY" \
-d '{
"name": "Engineering"
}'
```
#### Response (200)
```json
{
"id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
"created_at": "2024-10-30T23:58:27.427722Z",
"name": "Engineering",
"roles": [
"rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s"
],
"source_type": "direct",
"type": "rbac_group",
"updated_at": "2024-10-30T23:58:27.427722Z"
}
```
## Update RBAC Group
**POST** `/v1/organizations/rbac_groups/{group_id}`
Update an RBAC Group's name. Groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API while an organization in the tenant uses SCIM provisioning.
The RBAC Groups API is available to Claude Enterprise organizations only.
### Path parameters
- `group_id: string`
ID of the RBAC Group.
### Body parameters
Cut at 300 lines. The page has the rest.
api/beta/organization/rbac_groups/create New page · 93 lines, new page
# Create RBAC Group ## Body parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Create RBAC Group
url: https://platform.claude.com/docs/en/api/beta/organization/rbac_groups/create
---
# Create RBAC Group
**POST** `/v1/organizations/rbac_groups`
Create an RBAC Group in the Claude Enterprise tenant. Groups created via the API have source type `"direct"`.
The RBAC Groups API is available to Claude Enterprise organizations only.
## Body parameters
- `name: string`
Name of the RBAC Group. Not uniqueness-enforced.
maxLength: 255, minLength: 1
## Returns
- `BetaRBACGroup object`
- `type: "rbac_group"`
Object type.
For RBAC Groups, this is always `"rbac_group"`.
default: rbac_group
- `id: string`
ID of the RBAC Group.
- `created_at: string`
RFC 3339 timestamp of when the RBAC Group was created.
format: date-time
- `name: string`
Name of the RBAC Group. Not uniqueness-enforced.
- `roles: array of string or null`
RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list.
- `source_type: "direct" or "scim"`
How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider.
- `"direct"`
- `"scim"`
- `updated_at: string`
RFC 3339 timestamp of when the RBAC Group was last updated.
format: date-time
## Example
```bash
curl https://api.anthropic.com/v1/organizations/rbac_groups \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H 'anthropic-beta: ce-user-management-2026-07-13' \
-H "X-Api-Key: $ANTHROPIC_API_KEY" \
-d '{
"name": "Engineering"
}'
```
### Response (200)
```json
{
"id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
"created_at": "2024-10-30T23:58:27.427722Z",
"name": "Engineering",
"roles": [
"rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s"
],
"source_type": "direct",
"type": "rbac_group",
"updated_at": "2024-10-30T23:58:27.427722Z"
}
```
api/beta/organization/rbac_groups/delete New page · 53 lines, new page
# Delete RBAC Group ## Path parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Delete RBAC Group
url: https://platform.claude.com/docs/en/api/beta/organization/rbac_groups/delete
---
# Delete RBAC Group
**DELETE** `/v1/organizations/rbac_groups/{group_id}`
Delete an RBAC Group. Groups provisioned by an identity provider (source type `"scim"`) cannot be deleted via the API while an organization in the tenant uses SCIM provisioning.
The RBAC Groups API is available to Claude Enterprise organizations only.
## Path parameters
- `group_id: string`
ID of the RBAC Group.
## Returns
- `BetaRBACGroupDeleted object`
- `type: "rbac_group_deleted"`
Deleted object type.
For RBAC Groups, this is always `"rbac_group_deleted"`.
default: rbac_group_deleted
- `id: string`
ID of the RBAC Group.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID \
-X DELETE \
-H 'anthropic-version: 2023-06-01' \
-H 'anthropic-beta: ce-user-management-2026-07-13' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
"type": "rbac_group_deleted"
}
```
api/beta/organization/rbac_groups/list New page · 109 lines, new page
# List RBAC Groups ## Query parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: List RBAC Groups
url: https://platform.claude.com/docs/en/api/beta/organization/rbac_groups/list
---
# List RBAC Groups
**GET** `/v1/organizations/rbac_groups`
List RBAC Groups in the Claude Enterprise tenant.
The RBAC Groups API is available to Claude Enterprise organizations only.
## Query parameters
- `limit: optional number`
Number of items to return per page.
Defaults to `20`. Ranges from `1` to `1000`.
default: 20, maximum: 1000, minimum: 1
- `page: optional string`
Optionally set to the `next_page` token from the previous response.
## Returns
- `data: array of BetaRBACGroup`
- `type: "rbac_group"`
Object type.
For RBAC Groups, this is always `"rbac_group"`.
default: rbac_group
- `id: string`
ID of the RBAC Group.
- `created_at: string`
RFC 3339 timestamp of when the RBAC Group was created.
format: date-time
- `name: string`
Name of the RBAC Group. Not uniqueness-enforced.
- `roles: array of string or null`
RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list.
- `source_type: "direct" or "scim"`
How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider.
- `"direct"`
- `"scim"`
- `updated_at: string`
RFC 3339 timestamp of when the RBAC Group was last updated.
format: date-time
- `has_more: boolean`
Indicates if there are more results in the requested page direction.
- `next_page: string or null`
Token to provide in as `page` in the subsequent request to retrieve the next page of data.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/rbac_groups \
-H 'anthropic-version: 2023-06-01' \
-H 'anthropic-beta: ce-user-management-2026-07-13' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"data": [
{
"id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
"created_at": "2024-10-30T23:58:27.427722Z",
"name": "Engineering",
"roles": [
"rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s"
],
"source_type": "direct",
"type": "rbac_group",
"updated_at": "2024-10-30T23:58:27.427722Z"
}
],
"has_more": false,
"next_page": "eyJjdXJzb3IiOiAicmJhY19ncm91cF8wMSJ9"
}
```
api/beta/organization/rbac_groups/members New page · 280 lines, new page
# Members ## List RBAC Group Members ### Path parameters ### Query parameters ### Returns ### Example #### Response (200) ## Add RBAC Group Member ### Path parameters ### Body parameters ### Returns ### Example #### Response (200) ## Remove RBAC Group Member ### Path parameters ### Returns ### Example #### Response (200) ## Domain types ### Beta RBAC Group Member ### Beta RBAC Group Member Deleted
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Members
url: https://platform.claude.com/docs/en/api/beta/organization/rbac_groups/members
---
# Members
## List RBAC Group Members
**GET** `/v1/organizations/rbac_groups/{group_id}/members`
List members of an RBAC Group.
The RBAC Groups API is available to Claude Enterprise organizations only.
### Path parameters
- `group_id: string`
ID of the RBAC Group.
### Query parameters
- `limit: optional number`
Number of items to return per page.
Defaults to `20`. Ranges from `1` to `1000`.
default: 20, maximum: 1000, minimum: 1
- `page: optional string`
Optionally set to the `next_page` token from the previous response.
### Returns
- `data: array of BetaRBACGroupMember`
- `type: "rbac_group_member"`
Object type.
For RBAC Group Members, this is always `"rbac_group_member"`.
default: rbac_group_member
- `created_at: string`
RFC 3339 timestamp of when the User was added to the RBAC Group.
format: date-time
- `email: string`
Email of the User.
- `group_id: string`
ID of the RBAC Group.
- `user_id: string`
ID of the User.
- `has_more: boolean`
Indicates if there are more results in the requested page direction.
- `next_page: string or null`
Token to provide in as `page` in the subsequent request to retrieve the next page of data.
### Example
```bash
curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members \
-H 'anthropic-version: 2023-06-01' \
-H 'anthropic-beta: ce-user-management-2026-07-13' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
#### Response (200)
```json
{
"data": [
{
"created_at": "2024-10-30T23:58:27.427722Z",
"email": "[email protected]",
"group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
"type": "rbac_group_member",
"user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
}
],
"has_more": false,
"next_page": "eyJjdXJzb3IiOiAicmJhY19ncm91cF8wMSJ9"
}
```
## Add RBAC Group Member
**POST** `/v1/organizations/rbac_groups/{group_id}/members`
Add a User to an RBAC Group. Membership of groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API while an organization in the tenant uses SCIM provisioning.
The RBAC Groups API is available to Claude Enterprise organizations only.
### Path parameters
- `group_id: string`
ID of the RBAC Group.
### Body parameters
- `user_id: string`
ID of the User.
### Returns
- `BetaRBACGroupMember object`
- `type: "rbac_group_member"`
Object type.
For RBAC Group Members, this is always `"rbac_group_member"`.
default: rbac_group_member
- `created_at: string`
RFC 3339 timestamp of when the User was added to the RBAC Group.
format: date-time
- `email: string`
Email of the User.
- `group_id: string`
ID of the RBAC Group.
- `user_id: string`
ID of the User.
### Example
```bash
curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H 'anthropic-beta: ce-user-management-2026-07-13' \
-H "X-Api-Key: $ANTHROPIC_API_KEY" \
-d '{
"user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
}'
```
#### Response (200)
```json
{
"created_at": "2024-10-30T23:58:27.427722Z",
"email": "[email protected]",
"group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
"type": "rbac_group_member",
"user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
}
```
## Remove RBAC Group Member
**DELETE** `/v1/organizations/rbac_groups/{group_id}/members/{user_id}`
Remove a User from an RBAC Group. Membership of groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API while an organization in the tenant uses SCIM provisioning.
The RBAC Groups API is available to Claude Enterprise organizations only.
### Path parameters
- `group_id: string`
ID of the RBAC Group.
- `user_id: string`
ID of the User.
### Returns
- `BetaRBACGroupMemberDeleted object`
- `type: "rbac_group_member_deleted"`
Deleted object type. For RBAC Group Members, this is always `"rbac_group_member_deleted"`.
default: rbac_group_member_deleted
- `group_id: string`
ID of the RBAC Group.
- `user_id: string`
ID of the User.
### Example
```bash
curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members/$USER_ID \
-X DELETE \
-H 'anthropic-version: 2023-06-01' \
-H 'anthropic-beta: ce-user-management-2026-07-13' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
#### Response (200)
```json
{
"group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
"type": "rbac_group_member_deleted",
"user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
}
```
## Domain types
### Beta RBAC Group Member
- `BetaRBACGroupMember object`
- `type: "rbac_group_member"`
Object type.
For RBAC Group Members, this is always `"rbac_group_member"`.
default: rbac_group_member
- `created_at: string`
RFC 3339 timestamp of when the User was added to the RBAC Group.
format: date-time
- `email: string`
Email of the User.
- `group_id: string`
ID of the RBAC Group.
- `user_id: string`
ID of the User.
### Beta RBAC Group Member Deleted
- `BetaRBACGroupMemberDeleted object`
- `type: "rbac_group_member_deleted"`
Deleted object type. For RBAC Group Members, this is always `"rbac_group_member_deleted"`.
default: rbac_group_member_deleted
- `group_id: string`
ID of the RBAC Group.
- `user_id: string`
ID of the User.
api/beta/organization/rbac_groups/members/create New page · 79 lines, new page
# Add RBAC Group Member ## Path parameters ## Body parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Add RBAC Group Member
url: https://platform.claude.com/docs/en/api/beta/organization/rbac_groups/members/create
---
# Add RBAC Group Member
**POST** `/v1/organizations/rbac_groups/{group_id}/members`
Add a User to an RBAC Group. Membership of groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API while an organization in the tenant uses SCIM provisioning.
The RBAC Groups API is available to Claude Enterprise organizations only.
## Path parameters
- `group_id: string`
ID of the RBAC Group.
## Body parameters
- `user_id: string`
ID of the User.
## Returns
- `BetaRBACGroupMember object`
- `type: "rbac_group_member"`
Object type.
For RBAC Group Members, this is always `"rbac_group_member"`.
default: rbac_group_member
- `created_at: string`
RFC 3339 timestamp of when the User was added to the RBAC Group.
format: date-time
- `email: string`
Email of the User.
- `group_id: string`
ID of the RBAC Group.
- `user_id: string`
ID of the User.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H 'anthropic-beta: ce-user-management-2026-07-13' \
-H "X-Api-Key: $ANTHROPIC_API_KEY" \
-d '{
"user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
}'
```
### Response (200)
```json
{
"created_at": "2024-10-30T23:58:27.427722Z",
"email": "[email protected]",
"group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
"type": "rbac_group_member",
"user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
}
```
api/beta/organization/rbac_groups/members/delete New page · 60 lines, new page
# Remove RBAC Group Member ## Path parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Remove RBAC Group Member
url: https://platform.claude.com/docs/en/api/beta/organization/rbac_groups/members/delete
---
# Remove RBAC Group Member
**DELETE** `/v1/organizations/rbac_groups/{group_id}/members/{user_id}`
Remove a User from an RBAC Group. Membership of groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API while an organization in the tenant uses SCIM provisioning.
The RBAC Groups API is available to Claude Enterprise organizations only.
## Path parameters
- `group_id: string`
ID of the RBAC Group.
- `user_id: string`
ID of the User.
## Returns
- `BetaRBACGroupMemberDeleted object`
- `type: "rbac_group_member_deleted"`
Deleted object type. For RBAC Group Members, this is always `"rbac_group_member_deleted"`.
default: rbac_group_member_deleted
- `group_id: string`
ID of the RBAC Group.
- `user_id: string`
ID of the User.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members/$USER_ID \
-X DELETE \
-H 'anthropic-version: 2023-06-01' \
-H 'anthropic-beta: ce-user-management-2026-07-13' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
"type": "rbac_group_member_deleted",
"user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
}
```
api/beta/organization/rbac_groups/members/list New page · 97 lines, new page
# List RBAC Group Members ## Path parameters ## Query parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: List RBAC Group Members
url: https://platform.claude.com/docs/en/api/beta/organization/rbac_groups/members/list
---
# List RBAC Group Members
**GET** `/v1/organizations/rbac_groups/{group_id}/members`
List members of an RBAC Group.
The RBAC Groups API is available to Claude Enterprise organizations only.
## Path parameters
- `group_id: string`
ID of the RBAC Group.
## Query parameters
- `limit: optional number`
Number of items to return per page.
Defaults to `20`. Ranges from `1` to `1000`.
default: 20, maximum: 1000, minimum: 1
- `page: optional string`
Optionally set to the `next_page` token from the previous response.
## Returns
- `data: array of BetaRBACGroupMember`
- `type: "rbac_group_member"`
Object type.
For RBAC Group Members, this is always `"rbac_group_member"`.
default: rbac_group_member
- `created_at: string`
RFC 3339 timestamp of when the User was added to the RBAC Group.
format: date-time
- `email: string`
Email of the User.
- `group_id: string`
ID of the RBAC Group.
- `user_id: string`
ID of the User.
- `has_more: boolean`
Indicates if there are more results in the requested page direction.
- `next_page: string or null`
Token to provide in as `page` in the subsequent request to retrieve the next page of data.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members \
-H 'anthropic-version: 2023-06-01' \
-H 'anthropic-beta: ce-user-management-2026-07-13' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"data": [
{
"created_at": "2024-10-30T23:58:27.427722Z",
"email": "[email protected]",
"group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
"type": "rbac_group_member",
"user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
}
],
"has_more": false,
"next_page": "eyJjdXJzb3IiOiAicmJhY19ncm91cF8wMSJ9"
}
```
api/beta/organization/rbac_groups/retrieve New page · 87 lines, new page
# Get RBAC Group ## Path parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Get RBAC Group
url: https://platform.claude.com/docs/en/api/beta/organization/rbac_groups/retrieve
---
# Get RBAC Group
**GET** `/v1/organizations/rbac_groups/{group_id}`
Retrieve an RBAC Group by ID.
The RBAC Groups API is available to Claude Enterprise organizations only.
## Path parameters
- `group_id: string`
ID of the RBAC Group.
## Returns
- `BetaRBACGroup object`
- `type: "rbac_group"`
Object type.
For RBAC Groups, this is always `"rbac_group"`.
default: rbac_group
- `id: string`
ID of the RBAC Group.
- `created_at: string`
RFC 3339 timestamp of when the RBAC Group was created.
format: date-time
- `name: string`
Name of the RBAC Group. Not uniqueness-enforced.
- `roles: array of string or null`
RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list.
- `source_type: "direct" or "scim"`
How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider.
- `"direct"`
- `"scim"`
- `updated_at: string`
RFC 3339 timestamp of when the RBAC Group was last updated.
format: date-time
## Example
```bash
curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID \
-H 'anthropic-version: 2023-06-01' \
-H 'anthropic-beta: ce-user-management-2026-07-13' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
"created_at": "2024-10-30T23:58:27.427722Z",
"name": "Engineering",
"roles": [
"rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s"
],
"source_type": "direct",
"type": "rbac_group",
"updated_at": "2024-10-30T23:58:27.427722Z"
}
```
api/beta/organization/rbac_groups/update New page · 99 lines, new page
# Update RBAC Group ## Path parameters ## Body parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Update RBAC Group
url: https://platform.claude.com/docs/en/api/beta/organization/rbac_groups/update
---
# Update RBAC Group
**POST** `/v1/organizations/rbac_groups/{group_id}`
Update an RBAC Group's name. Groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API while an organization in the tenant uses SCIM provisioning.
The RBAC Groups API is available to Claude Enterprise organizations only.
## Path parameters
- `group_id: string`
ID of the RBAC Group.
## Body parameters
- `name: optional string or null`
Name of the RBAC Group. Not uniqueness-enforced.
maxLength: 255, minLength: 1
## Returns
- `BetaRBACGroup object`
- `type: "rbac_group"`
Object type.
For RBAC Groups, this is always `"rbac_group"`.
default: rbac_group
- `id: string`
ID of the RBAC Group.
- `created_at: string`
RFC 3339 timestamp of when the RBAC Group was created.
format: date-time
- `name: string`
Name of the RBAC Group. Not uniqueness-enforced.
- `roles: array of string or null`
RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list.
- `source_type: "direct" or "scim"`
How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider.
- `"direct"`
- `"scim"`
- `updated_at: string`
RFC 3339 timestamp of when the RBAC Group was last updated.
format: date-time
## Example
```bash
curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H 'anthropic-beta: ce-user-management-2026-07-13' \
-H "X-Api-Key: $ANTHROPIC_API_KEY" \
-d '{
"name": "Engineering"
}'
```
### Response (200)
```json
{
"id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
"created_at": "2024-10-30T23:58:27.427722Z",
"name": "Engineering",
"roles": [
"rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s"
],
"source_type": "direct",
"type": "rbac_group",
"updated_at": "2024-10-30T23:58:27.427722Z"
}
```
api/beta/organization/rbac_roles New page · 377 lines, new page
# RBAC Roles ## List RBAC Roles ### Query parameters ### Returns ### Example #### Response (200) ## Get RBAC Role ### Path parameters ### Returns ### Example #### Response (200) ## Domain types ### Beta RBAC Role ## RBAC Roles › Permissions ### List RBAC Role Permissions #### Path parameters #### Query parameters #### Returns #### Example ##### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: RBAC Roles
url: https://platform.claude.com/docs/en/api/beta/organization/rbac_roles
---
# RBAC Roles
## List RBAC Roles
**GET** `/v1/organizations/rbac_roles`
List RBAC Roles in the organization.
The RBAC Roles API is available to Claude Enterprise organizations only.
### Query parameters
- `limit: optional number`
Number of items to return per page.
Defaults to `20`. Ranges from `1` to `1000`.
default: 20, maximum: 1000, minimum: 1
- `page: optional string`
Optionally set to the `next_page` token from the previous response.
### Returns
- `data: array of BetaRBACRole`
- `type: "rbac_role"`
Object type.
For RBAC Roles, this is always `"rbac_role"`.
default: rbac_role
- `id: string`
ID of the RBAC Role.
- `created_at: string`
RFC 3339 datetime string indicating when the RBAC Role was created.
format: date-time
- `name: string`
Name of the RBAC Role.
- `updated_at: string`
RFC 3339 datetime string indicating when the RBAC Role was last updated.
format: date-time
- `has_more: boolean`
Indicates whether there are more results beyond this page.
- `next_page: string or null`
Opaque cursor for the next page. Pass as the `page` parameter on the next
request.
### Example
```bash
curl https://api.anthropic.com/v1/organizations/rbac_roles \
-H 'anthropic-version: 2023-06-01' \
-H 'anthropic-beta: ce-user-management-2026-07-13' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
#### Response (200)
```json
{
"data": [
{
"id": "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s",
"created_at": "2024-10-30T23:58:27.427722Z",
"name": "Project Editor",
"type": "rbac_role",
"updated_at": "2024-10-30T23:58:27.427722Z"
}
],
"has_more": true,
"next_page": "eyJjdXJzb3IiOiAicmJhY19yb2xlXzAxIn0"
}
```
## Get RBAC Role
**GET** `/v1/organizations/rbac_roles/{role_id}`
Retrieve an RBAC Role by ID.
The RBAC Roles API is available to Claude Enterprise organizations only.
### Path parameters
- `role_id: string`
ID of the RBAC Role.
### Returns
- `BetaRBACRole object`
- `type: "rbac_role"`
Object type.
For RBAC Roles, this is always `"rbac_role"`.
default: rbac_role
- `id: string`
ID of the RBAC Role.
- `created_at: string`
RFC 3339 datetime string indicating when the RBAC Role was created.
format: date-time
- `name: string`
Name of the RBAC Role.
- `updated_at: string`
RFC 3339 datetime string indicating when the RBAC Role was last updated.
format: date-time
### Example
```bash
curl https://api.anthropic.com/v1/organizations/rbac_roles/$ROLE_ID \
-H 'anthropic-version: 2023-06-01' \
-H 'anthropic-beta: ce-user-management-2026-07-13' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
#### Response (200)
```json
{
"id": "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s",
"created_at": "2024-10-30T23:58:27.427722Z",
"name": "Project Editor",
"type": "rbac_role",
"updated_at": "2024-10-30T23:58:27.427722Z"
}
```
## Domain types
### Beta RBAC Role
- `BetaRBACRole object`
- `type: "rbac_role"`
Object type.
For RBAC Roles, this is always `"rbac_role"`.
default: rbac_role
- `id: string`
ID of the RBAC Role.
- `created_at: string`
RFC 3339 datetime string indicating when the RBAC Role was created.
format: date-time
- `name: string`
Name of the RBAC Role.
- `updated_at: string`
RFC 3339 datetime string indicating when the RBAC Role was last updated.
format: date-time
## RBAC Roles › Permissions
### List RBAC Role Permissions
**GET** `/v1/organizations/rbac_roles/{role_id}/permissions`
List the permissions an RBAC Role grants.
The RBAC Roles API is available to Claude Enterprise organizations only.
#### Path parameters
- `role_id: string`
ID of the RBAC Role.
#### Query parameters
- `limit: optional number`
Number of items to return per page.
Defaults to `20`. Ranges from `1` to `1000`.
default: 20, maximum: 1000, minimum: 1
- `page: optional string`
Optionally set to the `next_page` token from the previous response.
#### Returns
- `data: array of BetaRBACRolePermission`
- `type: "rbac_role_permission"`
Object type.
For RBAC Role Permissions, this is always `"rbac_role_permission"`.
default: rbac_role_permission
- `action: string`
Action the permission grants on the resource.
The vocabulary follows the resource: an `organization` grant carries a
product-feature entitlement (for example `chat`), an admin-panel
permission entitlement (`permission_*`), or a blanket capability-access
mode — `capability_access_all` grants every product-feature entitlement,
and `capability_access_all_ga` grants the generally-available subset as
it stands at permission-check time; neither mode grants model-access
entitlements. A consumer enumerating a role's per-feature grants should
treat a blanket row as granting every product-feature entitlement it
covers, or it will under-report the role's effective access. A `connector_tool` grant carries
a tool-access action (`use` or `always_allow`); a `connector_scope` grant
carries the scope action `grant` (the role may receive the named OAuth
scope when tokens are minted for the connector); `connector` and
`all_connectors` grants carry a tool-access action, the scope action, or
an authentication-method action (`interactive` or `managed`).
- `resource: object or object or object or 2 more`
What the permission applies to.
A tagged union: `type` names the kind of resource and determines which
identifier fields are present.
- `Organization object`
- `type: "organization"`
Kind of resource the permission applies to.
default: organization
- `organization_id: string`
UUID of the organization the permission applies to.
- `ConnectorTool object`
- `type: "connector_tool"`
Kind of resource the permission applies to.
default: connector_tool
- `connector_id: string`
ID of the connector the permission applies to.
- `tool_name: string`
Published name of the connector tool the permission applies to.
When the published name contains characters outside `[a-zA-Z0-9_-]` (or
collides with a reserved form), it is server-encoded into a stable
`{prefix}_{32-hex}` form — a shortened readable prefix of the name plus
a hash — from which the published name is not recoverable.
- `ConnectorScope object`
Cut at 300 lines. The page has the rest.
api/beta/organization/rbac_roles/list New page · 94 lines, new page
# List RBAC Roles ## Query parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: List RBAC Roles
url: https://platform.claude.com/docs/en/api/beta/organization/rbac_roles/list
---
# List RBAC Roles
**GET** `/v1/organizations/rbac_roles`
List RBAC Roles in the organization.
The RBAC Roles API is available to Claude Enterprise organizations only.
## Query parameters
- `limit: optional number`
Number of items to return per page.
Defaults to `20`. Ranges from `1` to `1000`.
default: 20, maximum: 1000, minimum: 1
- `page: optional string`
Optionally set to the `next_page` token from the previous response.
## Returns
- `data: array of BetaRBACRole`
- `type: "rbac_role"`
Object type.
For RBAC Roles, this is always `"rbac_role"`.
default: rbac_role
- `id: string`
ID of the RBAC Role.
- `created_at: string`
RFC 3339 datetime string indicating when the RBAC Role was created.
format: date-time
- `name: string`
Name of the RBAC Role.
- `updated_at: string`
RFC 3339 datetime string indicating when the RBAC Role was last updated.
format: date-time
- `has_more: boolean`
Indicates whether there are more results beyond this page.
- `next_page: string or null`
Opaque cursor for the next page. Pass as the `page` parameter on the next
request.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/rbac_roles \
-H 'anthropic-version: 2023-06-01' \
-H 'anthropic-beta: ce-user-management-2026-07-13' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"data": [
{
"id": "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s",
"created_at": "2024-10-30T23:58:27.427722Z",
"name": "Project Editor",
"type": "rbac_role",
"updated_at": "2024-10-30T23:58:27.427722Z"
}
],
"has_more": true,
"next_page": "eyJjdXJzb3IiOiAicmJhY19yb2xlXzAxIn0"
}
```
api/beta/organization/rbac_roles/permissions New page · 299 lines, new page
# Permissions ## List RBAC Role Permissions ### Path parameters ### Query parameters ### Returns ### Example #### Response (200) ## Domain types ### Beta RBAC Role Permission
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Permissions
url: https://platform.claude.com/docs/en/api/beta/organization/rbac_roles/permissions
---
# Permissions
## List RBAC Role Permissions
**GET** `/v1/organizations/rbac_roles/{role_id}/permissions`
List the permissions an RBAC Role grants.
The RBAC Roles API is available to Claude Enterprise organizations only.
### Path parameters
- `role_id: string`
ID of the RBAC Role.
### Query parameters
- `limit: optional number`
Number of items to return per page.
Defaults to `20`. Ranges from `1` to `1000`.
default: 20, maximum: 1000, minimum: 1
- `page: optional string`
Optionally set to the `next_page` token from the previous response.
### Returns
- `data: array of BetaRBACRolePermission`
- `type: "rbac_role_permission"`
Object type.
For RBAC Role Permissions, this is always `"rbac_role_permission"`.
default: rbac_role_permission
- `action: string`
Action the permission grants on the resource.
The vocabulary follows the resource: an `organization` grant carries a
product-feature entitlement (for example `chat`), an admin-panel
permission entitlement (`permission_*`), or a blanket capability-access
mode — `capability_access_all` grants every product-feature entitlement,
and `capability_access_all_ga` grants the generally-available subset as
it stands at permission-check time; neither mode grants model-access
entitlements. A consumer enumerating a role's per-feature grants should
treat a blanket row as granting every product-feature entitlement it
covers, or it will under-report the role's effective access. A `connector_tool` grant carries
a tool-access action (`use` or `always_allow`); a `connector_scope` grant
carries the scope action `grant` (the role may receive the named OAuth
scope when tokens are minted for the connector); `connector` and
`all_connectors` grants carry a tool-access action, the scope action, or
an authentication-method action (`interactive` or `managed`).
- `resource: object or object or object or 2 more`
What the permission applies to.
A tagged union: `type` names the kind of resource and determines which
identifier fields are present.
- `Organization object`
- `type: "organization"`
Kind of resource the permission applies to.
default: organization
- `organization_id: string`
UUID of the organization the permission applies to.
- `ConnectorTool object`
- `type: "connector_tool"`
Kind of resource the permission applies to.
default: connector_tool
- `connector_id: string`
ID of the connector the permission applies to.
- `tool_name: string`
Published name of the connector tool the permission applies to.
When the published name contains characters outside `[a-zA-Z0-9_-]` (or
collides with a reserved form), it is server-encoded into a stable
`{prefix}_{32-hex}` form — a shortened readable prefix of the name plus
a hash — from which the published name is not recoverable.
- `ConnectorScope object`
- `type: "connector_scope"`
Kind of resource the permission applies to.
default: connector_scope
- `connector_id: string`
ID of the connector the permission applies to.
- `scope: string`
OAuth scope the permission names — the role may receive this scope when
tokens are minted for the connector.
Subject to the same encoding rule as `tool_name`: a scope containing
characters outside `[a-zA-Z0-9_-]` (or colliding with a reserved form)
appears server-encoded in a stable `{prefix}_{32-hex}` form. OAuth
scopes routinely contain `:` and `/`, so most appear encoded.
- `Connector object`
- `type: "connector"`
Kind of resource the permission applies to.
default: connector
- `connector_id: string`
ID of the connector the permission applies to.
- `AllConnectors object`
- `type: "all_connectors"`
Kind of resource the permission applies to.
default: all_connectors
- `has_more: boolean`
Indicates whether there are more results beyond this page.
- `next_page: string or null`
Opaque cursor for the next page. Pass as the `page` parameter on the next
request.
### Example
```bash
curl https://api.anthropic.com/v1/organizations/rbac_roles/$ROLE_ID/permissions \
-H 'anthropic-version: 2023-06-01' \
-H 'anthropic-beta: ce-user-management-2026-07-13' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
#### Response (200)
```json
{
"data": [
{
"action": "use",
"resource": {
"organization_id": "3c4f5e6d-7a8b-49c0-9d1e-2f3a4b5c6d7e",
"type": "organization"
},
"type": "rbac_role_permission"
}
],
"has_more": true,
"next_page": "eyJjdXJzb3IiOiAicmJhY19yb2xlXzAxIn0"
}
```
## Domain types
### Beta RBAC Role Permission
- `BetaRBACRolePermission object`
- `type: "rbac_role_permission"`
Object type.
For RBAC Role Permissions, this is always `"rbac_role_permission"`.
default: rbac_role_permission
- `action: string`
Action the permission grants on the resource.
The vocabulary follows the resource: an `organization` grant carries a
product-feature entitlement (for example `chat`), an admin-panel
permission entitlement (`permission_*`), or a blanket capability-access
mode — `capability_access_all` grants every product-feature entitlement,
and `capability_access_all_ga` grants the generally-available subset as
it stands at permission-check time; neither mode grants model-access
entitlements. A consumer enumerating a role's per-feature grants should
treat a blanket row as granting every product-feature entitlement it
covers, or it will under-report the role's effective access. A `connector_tool` grant carries
a tool-access action (`use` or `always_allow`); a `connector_scope` grant
carries the scope action `grant` (the role may receive the named OAuth
scope when tokens are minted for the connector); `connector` and
`all_connectors` grants carry a tool-access action, the scope action, or
an authentication-method action (`interactive` or `managed`).
- `resource: object or object or object or 2 more`
What the permission applies to.
A tagged union: `type` names the kind of resource and determines which
identifier fields are present.
- `Organization object`
- `type: "organization"`
Kind of resource the permission applies to.
default: organization
- `organization_id: string`
UUID of the organization the permission applies to.
- `ConnectorTool object`
- `type: "connector_tool"`
Kind of resource the permission applies to.
default: connector_tool
- `connector_id: string`
ID of the connector the permission applies to.
- `tool_name: string`
Published name of the connector tool the permission applies to.
When the published name contains characters outside `[a-zA-Z0-9_-]` (or
collides with a reserved form), it is server-encoded into a stable
`{prefix}_{32-hex}` form — a shortened readable prefix of the name plus
a hash — from which the published name is not recoverable.
- `ConnectorScope object`
- `type: "connector_scope"`
Kind of resource the permission applies to.
default: connector_scope
- `connector_id: string`
ID of the connector the permission applies to.
- `scope: string`
OAuth scope the permission names — the role may receive this scope when
tokens are minted for the connector.
Subject to the same encoding rule as `tool_name`: a scope containing
characters outside `[a-zA-Z0-9_-]` (or colliding with a reserved form)
appears server-encoded in a stable `{prefix}_{32-hex}` form. OAuth
scopes routinely contain `:` and `/`, so most appear encoded.
- `Connector object`
- `type: "connector"`
Kind of resource the permission applies to.
default: connector
- `connector_id: string`
ID of the connector the permission applies to.
- `AllConnectors object`
- `type: "all_connectors"`
Kind of resource the permission applies to.
default: all_connectors
api/beta/organization/rbac_roles/permissions/list New page · 182 lines, new page
# List RBAC Role Permissions ## Path parameters ## Query parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: List RBAC Role Permissions
url: https://platform.claude.com/docs/en/api/beta/organization/rbac_roles/permissions/list
---
# List RBAC Role Permissions
**GET** `/v1/organizations/rbac_roles/{role_id}/permissions`
List the permissions an RBAC Role grants.
The RBAC Roles API is available to Claude Enterprise organizations only.
## Path parameters
- `role_id: string`
ID of the RBAC Role.
## Query parameters
- `limit: optional number`
Number of items to return per page.
Defaults to `20`. Ranges from `1` to `1000`.
default: 20, maximum: 1000, minimum: 1
- `page: optional string`
Optionally set to the `next_page` token from the previous response.
## Returns
- `data: array of BetaRBACRolePermission`
- `type: "rbac_role_permission"`
Object type.
For RBAC Role Permissions, this is always `"rbac_role_permission"`.
default: rbac_role_permission
- `action: string`
Action the permission grants on the resource.
The vocabulary follows the resource: an `organization` grant carries a
product-feature entitlement (for example `chat`), an admin-panel
permission entitlement (`permission_*`), or a blanket capability-access
mode — `capability_access_all` grants every product-feature entitlement,
and `capability_access_all_ga` grants the generally-available subset as
it stands at permission-check time; neither mode grants model-access
entitlements. A consumer enumerating a role's per-feature grants should
treat a blanket row as granting every product-feature entitlement it
covers, or it will under-report the role's effective access. A `connector_tool` grant carries
a tool-access action (`use` or `always_allow`); a `connector_scope` grant
carries the scope action `grant` (the role may receive the named OAuth
scope when tokens are minted for the connector); `connector` and
`all_connectors` grants carry a tool-access action, the scope action, or
an authentication-method action (`interactive` or `managed`).
- `resource: object or object or object or 2 more`
What the permission applies to.
A tagged union: `type` names the kind of resource and determines which
identifier fields are present.
- `Organization object`
- `type: "organization"`
Kind of resource the permission applies to.
default: organization
- `organization_id: string`
UUID of the organization the permission applies to.
- `ConnectorTool object`
- `type: "connector_tool"`
Kind of resource the permission applies to.
default: connector_tool
- `connector_id: string`
ID of the connector the permission applies to.
- `tool_name: string`
Published name of the connector tool the permission applies to.
When the published name contains characters outside `[a-zA-Z0-9_-]` (or
collides with a reserved form), it is server-encoded into a stable
`{prefix}_{32-hex}` form — a shortened readable prefix of the name plus
a hash — from which the published name is not recoverable.
- `ConnectorScope object`
- `type: "connector_scope"`
Kind of resource the permission applies to.
default: connector_scope
- `connector_id: string`
ID of the connector the permission applies to.
- `scope: string`
OAuth scope the permission names — the role may receive this scope when
tokens are minted for the connector.
Subject to the same encoding rule as `tool_name`: a scope containing
characters outside `[a-zA-Z0-9_-]` (or colliding with a reserved form)
appears server-encoded in a stable `{prefix}_{32-hex}` form. OAuth
scopes routinely contain `:` and `/`, so most appear encoded.
- `Connector object`
- `type: "connector"`
Kind of resource the permission applies to.
default: connector
- `connector_id: string`
ID of the connector the permission applies to.
- `AllConnectors object`
- `type: "all_connectors"`
Kind of resource the permission applies to.
default: all_connectors
- `has_more: boolean`
Indicates whether there are more results beyond this page.
- `next_page: string or null`
Opaque cursor for the next page. Pass as the `page` parameter on the next
request.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/rbac_roles/$ROLE_ID/permissions \
-H 'anthropic-version: 2023-06-01' \
-H 'anthropic-beta: ce-user-management-2026-07-13' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"data": [
{
"action": "use",
"resource": {
"organization_id": "3c4f5e6d-7a8b-49c0-9d1e-2f3a4b5c6d7e",
"type": "organization"
},
"type": "rbac_role_permission"
}
],
"has_more": true,
"next_page": "eyJjdXJzb3IiOiAicmJhY19yb2xlXzAxIn0"
}
```
api/beta/organization/rbac_roles/retrieve New page · 71 lines, new page
# Get RBAC Role ## Path parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Get RBAC Role
url: https://platform.claude.com/docs/en/api/beta/organization/rbac_roles/retrieve
---
# Get RBAC Role
**GET** `/v1/organizations/rbac_roles/{role_id}`
Retrieve an RBAC Role by ID.
The RBAC Roles API is available to Claude Enterprise organizations only.
## Path parameters
- `role_id: string`
ID of the RBAC Role.
## Returns
- `BetaRBACRole object`
- `type: "rbac_role"`
Object type.
For RBAC Roles, this is always `"rbac_role"`.
default: rbac_role
- `id: string`
ID of the RBAC Role.
- `created_at: string`
RFC 3339 datetime string indicating when the RBAC Role was created.
format: date-time
- `name: string`
Name of the RBAC Role.
- `updated_at: string`
RFC 3339 datetime string indicating when the RBAC Role was last updated.
format: date-time
## Example
```bash
curl https://api.anthropic.com/v1/organizations/rbac_roles/$ROLE_ID \
-H 'anthropic-version: 2023-06-01' \
-H 'anthropic-beta: ce-user-management-2026-07-13' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"id": "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s",
"created_at": "2024-10-30T23:58:27.427722Z",
"name": "Project Editor",
"type": "rbac_role",
"updated_at": "2024-10-30T23:58:27.427722Z"
}
```
api/beta/organization/retrieve Changed · +13 / -8 lines
from line 1
1---
2title: Get Current Organization
3url: https://platform.claude.com/docs/en/api/beta/organization/retrieve
4---
5
16# Get Current Organization
27
38**GET** `/v1/organizations/me`
from line 13
813
914- `BetaOrganization object`
1015
16 - `type: "organization"`
17
18 Object type.
19
20 For Organizations, this is always `"organization"`.
21
22 default: organization
23
1124 - `id: string`
1225
1326 ID of the Organization.
from line 30
1730 - `name: string`
1831
1932 Name of the Organization.
20
21 - `type: "organization"`
22
23 Object type.
24
25 For Organizations, this is always `"organization"`.
26
27 default: organization
2833
2934## Example
3035