One read of Claude Developer Platformapi-20260930T233759Z
343 pages moved out of 740 read.
What this read moved
76-100 of 343, page 4 of 14This capture is too large to show at once. Changes 76-100 of 343 are below, significant first; the rest are on the following screens.
api/compliance/activities Changed · +12 / -12 lines
This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.
Nothing in the body moved in this read. What changed is above.
api/compliance/activities/list Changed · +6 / -6 lines
This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.
Nothing in the body moved in this read. What changed is above.
api/compliance/code Changed · +17 / -0 lines
api/compliance/code/artifacts Changed · +36 / -1 lines
api/compliance/code/artifacts/list Changed · +17 / -0 lines
api/organization New page · 8158 lines, new page
# Organization ## Get Current Organization ### Returns ### Example #### Response (200) ## Domain types ### Organization Info ### Organization Role ## Organization › API Keys ### List API Keys #### Query parameters #### Returns #### Example ##### Response (200) ### Retrieve API Key (Admin API) #### Path parameters #### Returns #### Example ##### Response (200) ### Update API Key #### Path parameters #### Body parameters #### Returns #### Example ##### Response (200) ## Organization › External Keys ### Create External Key #### Body parameters #### Returns #### Example ##### Response (200) ### List External Keys #### Query parameters #### Returns #### Example ##### Response (200) ### Get External Key #### Path parameters #### Returns #### Example ##### Response (200) ### Update External Key #### Path parameters #### Body parameters #### Returns #### Example ##### Response (200) ### Delete External Key #### Path parameters #### Returns #### Example ##### Response (200) ### Validate External Key #### Path parameters #### Returns #### Example ##### Response (200) ## Organization › Federation › Issuers ### Create Federation Issuer #### Body parameters #### Returns #### Example ##### Response (200) ### List Federation Issuers #### Query parameters #### Returns #### Example ##### Response (200) ### Get Federation Issuer #### Path parameters #### Returns #### Example ##### Response (200) ### Update Federation Issuer #### Path parameters #### Body parameters #### Returns #### Example ##### Response (200) ### Archive Federation Issuer #### Path parameters #### Returns #### Example ##### Response (200) ## Organization › Federation › Rules ### Create Federation Rule #### Body parameters #### Returns #### Example ##### Response (200) ### List Federation Rules #### Query parameters #### Returns #### Example ##### Response (200) ### Get Federation Rule #### Path parameters #### Returns #### Example ##### Response (200) ### Update Federation Rule #### Path parameters #### Body parameters #### Returns #### Example ##### Response (200) ### Archive Federation Rule #### Path parameters #### Returns #### Example ##### Response (200) ## Organization › Federation › Rules › Workspaces ### Add Federation Rule Workspace #### Path parameters #### Body parameters #### Returns #### Example ##### Response (200) ### List Federation Rule Workspaces #### Path parameters #### Query parameters #### Returns #### Example ##### Response (200) ### Remove Federation Rule Workspace #### Path parameters #### Returns #### Example ##### Response (200) ## Organization › Invites ### Create Invite #### Body parameters #### Returns #### Example ##### Response (200) ### List Invites #### Query parameters #### Returns #### Example ##### Response (200) ### Get Invite #### Path parameters #### Returns #### Example ##### Response (200) ### Delete Invite #### Path parameters #### Returns #### Example ##### Response (200) ## Organization › Service Accounts ### Create Service Account #### Body parameters #### Returns #### Example ##### Response (200) ### List Service Accounts #### Query parameters #### Returns #### Example ##### Response (200) ### Get Service Account #### Path parameters #### Returns #### Example ##### Response (200) ### Update Service Account #### Path parameters #### Body parameters #### Returns #### Example ##### Response (200) ### Archive Service Account #### Path parameters #### Returns #### Example ##### Response (200) ## Organization › Service Accounts › Workspaces ### Add Workspace To Service Account #### Path parameters #### Body parameters #### Returns #### Example ##### Response (200) ### List Workspaces For Service Account #### Path parameters #### Query parameters #### Returns #### Example ##### Response (200) ### Remove Workspace From Service Account #### Path parameters #### Returns #### Example ##### Response (200) ## Organization › Users ### List Users #### Query parameters #### Returns #### Example ##### Response (200) ### Get User #### Path parameters #### Returns #### Example ##### Response (200) ### Update User #### Path parameters #### Body parameters #### Returns #### Example ##### Response (200) ### Remove User #### Path parameters #### Returns #### Example ##### Response (200) ## Organization › Workspaces ### List Workspaces #### Query parameters #### Returns #### Example ##### Response (200) ### Create Workspace #### Body parameters #### Returns #### Example ##### Response (200) ### Get Workspace #### Path parameters #### Returns #### Example ##### Response (200) ### Update Workspace #### Path parameters #### Body parameters #### Returns #### Example ##### Response (200) ### Archive Workspace #### Path parameters #### Returns #### Example ##### Response (200) ## Organization › Workspaces › Rate Limits ### List Workspace Rate Limits #### Path parameters #### Query parameters #### Returns #### Example ##### Response (200) ## Organization › Workspaces › Members ### List Workspace Members #### Path parameters #### Query parameters #### Returns #### Example ##### Response (200) ### Create Workspace Member #### Path parameters #### Body parameters #### Returns #### Example ##### Response (200) ### Get Workspace Member #### Path parameters #### Returns #### Example ##### Response (200) ### Update Workspace Member #### Path parameters #### Body parameters #### Returns #### Example ##### Response (200) ### Delete Workspace Member #### Path parameters #### Returns #### Example ##### Response (200) ## Organization › Workspaces › Service Accounts ### List Service Account Workspace Members #### Path parameters #### Query parameters #### Returns #### Example ##### Response (200) ### Create Service Account Workspace Member #### Path parameters #### Body parameters #### Returns #### Example ##### Response (200) ### Get Service Account Workspace Member #### Path parameters #### Returns #### Example ##### Response (200) ### Update Service Account Workspace Member #### Path parameters #### Body parameters #### Returns #### Example ##### Response (200) ### Delete Service Account Workspace Member #### Path parameters #### Returns #### Example ##### Response (200) ## Organization › Rate Limits ### List Organization Rate Limits #### Query parameters #### Returns #### Example ##### Response (200) ## Organization › Compliance Settings ### Get Compliance Settings #### Returns #### Example ##### Response (200) ### Update Compliance Settings #### Body parameters #### Returns #### Example ##### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Organization
url: https://platform.claude.com/docs/en/api/organization
---
# Organization
## Get Current Organization
**GET** `/v1/organizations/me`
Retrieve information about the organization associated with the authenticated API key.
### Returns
- `OrganizationInfo object`
- `type: "organization"`
Object type.
For Organizations, this is always `"organization"`.
default: organization
- `id: string`
ID of the Organization.
format: uuid
- `name: string`
Name of the Organization.
### Example
```bash
curl https://api.anthropic.com/v1/organizations/me \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
#### Response (200)
```json
{
"id": "12345678-1234-5678-1234-567812345678",
"name": "Organization Name",
"type": "organization"
}
```
## Domain types
### Organization Info
- `OrganizationInfo object`
- `type: "organization"`
Object type.
For Organizations, this is always `"organization"`.
default: organization
- `id: string`
ID of the Organization.
format: uuid
- `name: string`
Name of the Organization.
### Organization Role
- `OrganizationRole = "admin" or "billing" or "claude_code_user" or 6 more`
- `"admin"`
- `"billing"`
- `"claude_code_user"`
- `"developer"`
- `"managed"`
- `"membership_admin"`
- `"owner"`
- `"primary_owner"`
- `"user"`
## Organization › API Keys
### List API Keys
**GET** `/v1/organizations/api_keys`
List API Keys
#### Query parameters
- `after_id: optional string`
ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object.
- `before_id: optional string`
ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object.
- `created_by_user_id: optional string`
Filter by the ID of the User who created the object.
- `limit: optional number`
Number of items to return per page.
Defaults to `20`. Ranges from `1` to `1000`.
default: 20, minimum: 1, maximum: 1000
- `status: optional "active" or "archived" or "expired" or "inactive"`
Filter by API key status.
- `"active"`
- `"archived"`
- `"expired"`
- `"inactive"`
- `workspace_id: optional string`
Filter by Workspace ID.
#### Returns
- `data: array of APIKey`
- `type: "api_key"`
Object type.
For API Keys, this is always `"api_key"`.
default: api_key
- `id: string`
ID of the API key.
- `created_at: string`
RFC 3339 datetime string indicating when the API Key was created.
format: date-time
- `created_by: APIKeyCreatedBy or null`
The ID and type of the actor that created the API key, or `null` when the
creator is not recorded (legacy, workload-identity-federated, or
system-created keys).
- `type: "service_account" or "user"`
Type of the actor that created the object.
- `"service_account"`
- `"user"`
- `id: string`
ID of the actor that created the object.
- `expires_at: string or null`
RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.
format: date-time
- `name: string`
Name of the API key.
- `partial_key_hint: string or null`
Partially redacted hint for the API key.
- `principal: APIKeyUserActor or APIKeyServiceAccountActor or null`
The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal.
- `APIKeyUserActor object`
- `type: "user_actor"`
Principal type. Always `"user_actor"` for a User.
default: user_actor
- `user_id: string`
ID of the User the API key acts as.
- `APIKeyServiceAccountActor object`
- `type: "service_account_actor"`
Principal type. Always `"service_account_actor"` for a Service Account.
default: service_account_actor
- `service_account_id: string`
ID of the Service Account the API key acts as.
- `scope: APIKeyOrganizationScope or APIKeyWorkspaceScope`
Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace.
- `APIKeyOrganizationScope object`
- `type: "organization"`
Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope.
default: organization
- `APIKeyWorkspaceScope object`
- `type: "workspace"`
Scope type. Always `"workspace"`: the API key belongs to one Workspace.
default: workspace
- `workspace_id: string`
ID of the Workspace the API key belongs to. Unlike the deprecated top-level `workspace_id`, this is the Workspace's real ID even for the organization's default Workspace.
- `status: "active" or "archived" or "expired" or "inactive"`
Status of the API key.
- `"active"`
- `"archived"`
- `"expired"`
- `"inactive"`
- `workspace_id: string or null`
**Deprecated**: Use `scope` instead. `workspace_id` is `null` both for an API key in the default Workspace and for a principal-bound API key that has no Workspace.
Deprecated: use `scope` instead. ID of the Workspace associated with the API key, or `null` if the API key belongs to the default Workspace. Also `null` for a principal-bound API key that has no Workspace; `scope` tells the two apart.
- `first_id: string or null`
First ID in the `data` list. Can be used as the `before_id` for the previous page.
- `has_more: boolean`
Indicates if there are more results in the requested page direction.
- `last_id: string or null`
Last ID in the `data` list. Can be used as the `after_id` for the next page.
#### Example
```bash
curl https://api.anthropic.com/v1/organizations/api_keys \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
##### Response (200)
```json
{
"data": [
{
"id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by": {
"id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
"type": "user"
Cut at 300 lines. The page has the rest.
api/organization/api_keys New page · 784 lines, new page
# API Keys ## List API Keys ### Query parameters ### Returns ### Example #### Response (200) ## Retrieve API Key (Admin API) ### Path parameters ### Returns ### Example #### Response (200) ## Update API Key ### Path parameters ### Body parameters ### Returns ### Example #### Response (200) ## Domain types ### API Key ### API Key Created By ### API Key Organization Scope ### API Key Service Account Actor ### API Key User Actor ### API Key Workspace Scope
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: API Keys
url: https://platform.claude.com/docs/en/api/organization/api_keys
---
# API Keys
## List API Keys
**GET** `/v1/organizations/api_keys`
List API Keys
### Query parameters
- `after_id: optional string`
ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object.
- `before_id: optional string`
ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object.
- `created_by_user_id: optional string`
Filter by the ID of the User who created the object.
- `limit: optional number`
Number of items to return per page.
Defaults to `20`. Ranges from `1` to `1000`.
default: 20, minimum: 1, maximum: 1000
- `status: optional "active" or "archived" or "expired" or "inactive"`
Filter by API key status.
- `"active"`
- `"archived"`
- `"expired"`
- `"inactive"`
- `workspace_id: optional string`
Filter by Workspace ID.
### Returns
- `data: array of APIKey`
- `type: "api_key"`
Object type.
For API Keys, this is always `"api_key"`.
default: api_key
- `id: string`
ID of the API key.
- `created_at: string`
RFC 3339 datetime string indicating when the API Key was created.
format: date-time
- `created_by: APIKeyCreatedBy or null`
The ID and type of the actor that created the API key, or `null` when the
creator is not recorded (legacy, workload-identity-federated, or
system-created keys).
- `type: "service_account" or "user"`
Type of the actor that created the object.
- `"service_account"`
- `"user"`
- `id: string`
ID of the actor that created the object.
- `expires_at: string or null`
RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.
format: date-time
- `name: string`
Name of the API key.
- `partial_key_hint: string or null`
Partially redacted hint for the API key.
- `principal: APIKeyUserActor or APIKeyServiceAccountActor or null`
The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal.
- `APIKeyUserActor object`
- `type: "user_actor"`
Principal type. Always `"user_actor"` for a User.
default: user_actor
- `user_id: string`
ID of the User the API key acts as.
- `APIKeyServiceAccountActor object`
- `type: "service_account_actor"`
Principal type. Always `"service_account_actor"` for a Service Account.
default: service_account_actor
- `service_account_id: string`
ID of the Service Account the API key acts as.
- `scope: APIKeyOrganizationScope or APIKeyWorkspaceScope`
Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace.
- `APIKeyOrganizationScope object`
- `type: "organization"`
Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope.
default: organization
- `APIKeyWorkspaceScope object`
- `type: "workspace"`
Scope type. Always `"workspace"`: the API key belongs to one Workspace.
default: workspace
- `workspace_id: string`
ID of the Workspace the API key belongs to. Unlike the deprecated top-level `workspace_id`, this is the Workspace's real ID even for the organization's default Workspace.
- `status: "active" or "archived" or "expired" or "inactive"`
Status of the API key.
- `"active"`
- `"archived"`
- `"expired"`
- `"inactive"`
- `workspace_id: string or null`
**Deprecated**: Use `scope` instead. `workspace_id` is `null` both for an API key in the default Workspace and for a principal-bound API key that has no Workspace.
Deprecated: use `scope` instead. ID of the Workspace associated with the API key, or `null` if the API key belongs to the default Workspace. Also `null` for a principal-bound API key that has no Workspace; `scope` tells the two apart.
- `first_id: string or null`
First ID in the `data` list. Can be used as the `before_id` for the previous page.
- `has_more: boolean`
Indicates if there are more results in the requested page direction.
- `last_id: string or null`
Last ID in the `data` list. Can be used as the `after_id` for the next page.
### Example
```bash
curl https://api.anthropic.com/v1/organizations/api_keys \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
#### Response (200)
```json
{
"data": [
{
"id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by": {
"id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
"type": "user"
},
"expires_at": "2024-10-30T23:58:27.427722Z",
"name": "Developer Key",
"partial_key_hint": "sk-ant-api03-R2D...igAA",
"principal": {
"type": "user_actor",
"user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
},
"scope": {
"type": "workspace",
"workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
},
"status": "active",
"type": "api_key",
"workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
}
],
"first_id": "first_id",
"has_more": true,
"last_id": "last_id"
}
```
## Retrieve API Key (Admin API)
**GET** `/v1/organizations/api_keys/{api_key_id}`
Retrieve information about a single API key in your organization, looked up by its ID. This Admin API endpoint requires an Admin API key, is intended for programmatic key management, and never returns the key's secret value. To view or create your own API keys, go to [API keys](https://platform.claude.com/settings/keys) in the Claude Console.
### Path parameters
- `api_key_id: string`
ID of the API key.
### Returns
- `APIKey object`
- `type: "api_key"`
Object type.
For API Keys, this is always `"api_key"`.
default: api_key
- `id: string`
ID of the API key.
- `created_at: string`
RFC 3339 datetime string indicating when the API Key was created.
format: date-time
- `created_by: APIKeyCreatedBy or null`
The ID and type of the actor that created the API key, or `null` when the
creator is not recorded (legacy, workload-identity-federated, or
system-created keys).
- `type: "service_account" or "user"`
Type of the actor that created the object.
- `"service_account"`
- `"user"`
- `id: string`
ID of the actor that created the object.
- `expires_at: string or null`
RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.
format: date-time
- `name: string`
Name of the API key.
- `partial_key_hint: string or null`
Partially redacted hint for the API key.
- `principal: APIKeyUserActor or APIKeyServiceAccountActor or null`
The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal.
- `APIKeyUserActor object`
Cut at 300 lines. The page has the rest.
api/organization/api_keys/list New page · 226 lines, new page
# List API Keys ## Query parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: List API Keys
url: https://platform.claude.com/docs/en/api/organization/api_keys/list
---
# List API Keys
**GET** `/v1/organizations/api_keys`
List API Keys
## Query parameters
- `after_id: optional string`
ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object.
- `before_id: optional string`
ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object.
- `created_by_user_id: optional string`
Filter by the ID of the User who created the object.
- `limit: optional number`
Number of items to return per page.
Defaults to `20`. Ranges from `1` to `1000`.
default: 20, minimum: 1, maximum: 1000
- `status: optional "active" or "archived" or "expired" or "inactive"`
Filter by API key status.
- `"active"`
- `"archived"`
- `"expired"`
- `"inactive"`
- `workspace_id: optional string`
Filter by Workspace ID.
## Returns
- `data: array of APIKey`
- `type: "api_key"`
Object type.
For API Keys, this is always `"api_key"`.
default: api_key
- `id: string`
ID of the API key.
- `created_at: string`
RFC 3339 datetime string indicating when the API Key was created.
format: date-time
- `created_by: APIKeyCreatedBy or null`
The ID and type of the actor that created the API key, or `null` when the
creator is not recorded (legacy, workload-identity-federated, or
system-created keys).
- `type: "service_account" or "user"`
Type of the actor that created the object.
- `"service_account"`
- `"user"`
- `id: string`
ID of the actor that created the object.
- `expires_at: string or null`
RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.
format: date-time
- `name: string`
Name of the API key.
- `partial_key_hint: string or null`
Partially redacted hint for the API key.
- `principal: APIKeyUserActor or APIKeyServiceAccountActor or null`
The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal.
- `APIKeyUserActor object`
- `type: "user_actor"`
Principal type. Always `"user_actor"` for a User.
default: user_actor
- `user_id: string`
ID of the User the API key acts as.
- `APIKeyServiceAccountActor object`
- `type: "service_account_actor"`
Principal type. Always `"service_account_actor"` for a Service Account.
default: service_account_actor
- `service_account_id: string`
ID of the Service Account the API key acts as.
- `scope: APIKeyOrganizationScope or APIKeyWorkspaceScope`
Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace.
- `APIKeyOrganizationScope object`
- `type: "organization"`
Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope.
default: organization
- `APIKeyWorkspaceScope object`
- `type: "workspace"`
Scope type. Always `"workspace"`: the API key belongs to one Workspace.
default: workspace
- `workspace_id: string`
ID of the Workspace the API key belongs to. Unlike the deprecated top-level `workspace_id`, this is the Workspace's real ID even for the organization's default Workspace.
- `status: "active" or "archived" or "expired" or "inactive"`
Status of the API key.
- `"active"`
- `"archived"`
- `"expired"`
- `"inactive"`
- `workspace_id: string or null`
**Deprecated**: Use `scope` instead. `workspace_id` is `null` both for an API key in the default Workspace and for a principal-bound API key that has no Workspace.
Deprecated: use `scope` instead. ID of the Workspace associated with the API key, or `null` if the API key belongs to the default Workspace. Also `null` for a principal-bound API key that has no Workspace; `scope` tells the two apart.
- `first_id: string or null`
First ID in the `data` list. Can be used as the `before_id` for the previous page.
- `has_more: boolean`
Indicates if there are more results in the requested page direction.
- `last_id: string or null`
Last ID in the `data` list. Can be used as the `after_id` for the next page.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/api_keys \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"data": [
{
"id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by": {
"id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
"type": "user"
},
"expires_at": "2024-10-30T23:58:27.427722Z",
"name": "Developer Key",
"partial_key_hint": "sk-ant-api03-R2D...igAA",
"principal": {
"type": "user_actor",
"user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
},
"scope": {
"type": "workspace",
"workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
},
"status": "active",
"type": "api_key",
"workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
}
],
"first_id": "first_id",
"has_more": true,
"last_id": "last_id"
}
```
api/organization/api_keys/retrieve New page · 175 lines, new page
# Retrieve API Key (Admin API) ## Path parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Retrieve API Key (Admin API)
url: https://platform.claude.com/docs/en/api/organization/api_keys/retrieve
---
# Retrieve API Key (Admin API)
**GET** `/v1/organizations/api_keys/{api_key_id}`
Retrieve information about a single API key in your organization, looked up by its ID. This Admin API endpoint requires an Admin API key, is intended for programmatic key management, and never returns the key's secret value. To view or create your own API keys, go to [API keys](https://platform.claude.com/settings/keys) in the Claude Console.
## Path parameters
- `api_key_id: string`
ID of the API key.
## Returns
- `APIKey object`
- `type: "api_key"`
Object type.
For API Keys, this is always `"api_key"`.
default: api_key
- `id: string`
ID of the API key.
- `created_at: string`
RFC 3339 datetime string indicating when the API Key was created.
format: date-time
- `created_by: APIKeyCreatedBy or null`
The ID and type of the actor that created the API key, or `null` when the
creator is not recorded (legacy, workload-identity-federated, or
system-created keys).
- `type: "service_account" or "user"`
Type of the actor that created the object.
- `"service_account"`
- `"user"`
- `id: string`
ID of the actor that created the object.
- `expires_at: string or null`
RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.
format: date-time
- `name: string`
Name of the API key.
- `partial_key_hint: string or null`
Partially redacted hint for the API key.
- `principal: APIKeyUserActor or APIKeyServiceAccountActor or null`
The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal.
- `APIKeyUserActor object`
- `type: "user_actor"`
Principal type. Always `"user_actor"` for a User.
default: user_actor
- `user_id: string`
ID of the User the API key acts as.
- `APIKeyServiceAccountActor object`
- `type: "service_account_actor"`
Principal type. Always `"service_account_actor"` for a Service Account.
default: service_account_actor
- `service_account_id: string`
ID of the Service Account the API key acts as.
- `scope: APIKeyOrganizationScope or APIKeyWorkspaceScope`
Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace.
- `APIKeyOrganizationScope object`
- `type: "organization"`
Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope.
default: organization
- `APIKeyWorkspaceScope object`
- `type: "workspace"`
Scope type. Always `"workspace"`: the API key belongs to one Workspace.
default: workspace
- `workspace_id: string`
ID of the Workspace the API key belongs to. Unlike the deprecated top-level `workspace_id`, this is the Workspace's real ID even for the organization's default Workspace.
- `status: "active" or "archived" or "expired" or "inactive"`
Status of the API key.
- `"active"`
- `"archived"`
- `"expired"`
- `"inactive"`
- `workspace_id: string or null`
**Deprecated**: Use `scope` instead. `workspace_id` is `null` both for an API key in the default Workspace and for a principal-bound API key that has no Workspace.
Deprecated: use `scope` instead. ID of the Workspace associated with the API key, or `null` if the API key belongs to the default Workspace. Also `null` for a principal-bound API key that has no Workspace; `scope` tells the two apart.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/api_keys/$API_KEY_ID \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by": {
"id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
"type": "user"
},
"expires_at": "2024-10-30T23:58:27.427722Z",
"name": "Developer Key",
"partial_key_hint": "sk-ant-api03-R2D...igAA",
"principal": {
"type": "user_actor",
"user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
},
"scope": {
"type": "workspace",
"workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
},
"status": "active",
"type": "api_key",
"workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
}
```
api/organization/api_keys/update New page · 195 lines, new page
# Update API Key ## Path parameters ## Body parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Update API Key
url: https://platform.claude.com/docs/en/api/organization/api_keys/update
---
# Update API Key
**POST** `/v1/organizations/api_keys/{api_key_id}`
Update API Key
## Path parameters
- `api_key_id: string`
ID of the API key.
## Body parameters
- `name: optional string or null`
Name of the API key.
minLength: 1, maxLength: 500
- `status: optional "active" or "archived" or "inactive" or null`
Status of the API key.
- `"active"`
- `"archived"`
- `"inactive"`
## Returns
- `APIKey object`
- `type: "api_key"`
Object type.
For API Keys, this is always `"api_key"`.
default: api_key
- `id: string`
ID of the API key.
- `created_at: string`
RFC 3339 datetime string indicating when the API Key was created.
format: date-time
- `created_by: APIKeyCreatedBy or null`
The ID and type of the actor that created the API key, or `null` when the
creator is not recorded (legacy, workload-identity-federated, or
system-created keys).
- `type: "service_account" or "user"`
Type of the actor that created the object.
- `"service_account"`
- `"user"`
- `id: string`
ID of the actor that created the object.
- `expires_at: string or null`
RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.
format: date-time
- `name: string`
Name of the API key.
- `partial_key_hint: string or null`
Partially redacted hint for the API key.
- `principal: APIKeyUserActor or APIKeyServiceAccountActor or null`
The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal.
- `APIKeyUserActor object`
- `type: "user_actor"`
Principal type. Always `"user_actor"` for a User.
default: user_actor
- `user_id: string`
ID of the User the API key acts as.
- `APIKeyServiceAccountActor object`
- `type: "service_account_actor"`
Principal type. Always `"service_account_actor"` for a Service Account.
default: service_account_actor
- `service_account_id: string`
ID of the Service Account the API key acts as.
- `scope: APIKeyOrganizationScope or APIKeyWorkspaceScope`
Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace.
- `APIKeyOrganizationScope object`
- `type: "organization"`
Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope.
default: organization
- `APIKeyWorkspaceScope object`
- `type: "workspace"`
Scope type. Always `"workspace"`: the API key belongs to one Workspace.
default: workspace
- `workspace_id: string`
ID of the Workspace the API key belongs to. Unlike the deprecated top-level `workspace_id`, this is the Workspace's real ID even for the organization's default Workspace.
- `status: "active" or "archived" or "expired" or "inactive"`
Status of the API key.
- `"active"`
- `"archived"`
- `"expired"`
- `"inactive"`
- `workspace_id: string or null`
**Deprecated**: Use `scope` instead. `workspace_id` is `null` both for an API key in the default Workspace and for a principal-bound API key that has no Workspace.
Deprecated: use `scope` instead. ID of the Workspace associated with the API key, or `null` if the API key belongs to the default Workspace. Also `null` for a principal-bound API key that has no Workspace; `scope` tells the two apart.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/api_keys/$API_KEY_ID \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY" \
-d '{}'
```
### Response (200)
```json
{
"id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by": {
"id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
"type": "user"
},
"expires_at": "2024-10-30T23:58:27.427722Z",
"name": "Developer Key",
"partial_key_hint": "sk-ant-api03-R2D...igAA",
"principal": {
"type": "user_actor",
"user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
},
"scope": {
"type": "workspace",
"workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
},
"status": "active",
"type": "api_key",
"workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
}
```
api/organization/compliance_settings New page · 224 lines, new page
# Compliance Settings ## Get Compliance Settings ### Returns ### Example #### Response (200) ## Update Compliance Settings ### Body parameters ### Returns ### Example #### Response (200) ## Domain types ### Compliance Settings State ### Compliance Settings State Disabled ### Compliance Settings State Disabled Param ### Compliance Settings State Enabled ### Compliance Settings State Enabled Param ### Compliance Settings State Param ### Organization Compliance Settings
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Compliance Settings
url: https://platform.claude.com/docs/en/api/organization/compliance_settings
---
# Compliance Settings
## Get Compliance Settings
**GET** `/v1/organizations/compliance_settings`
Retrieve your organization's Compliance Settings.
Compliance Settings is a singleton resource: there is exactly one per
organization, addressed without an identifier. The `state` field reflects
whether the Compliance API is enabled. An organization with a parent
organization reads the state inherited from the parent's configuration.
### Returns
- `OrganizationComplianceSettings object`
- `type: "compliance_settings"`
default: compliance_settings
- `state: ComplianceSettingsState`
Whether the Compliance API is enabled for this organization.
- `ComplianceSettingsStateEnabled object`
- `type: "enabled"`
default: enabled
- `ComplianceSettingsStateDisabled object`
- `type: "disabled"`
default: disabled
### Example
```bash
curl https://api.anthropic.com/v1/organizations/compliance_settings \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
#### Response (200)
```json
{
"state": {
"type": "enabled"
},
"type": "compliance_settings"
}
```
## Update Compliance Settings
**POST** `/v1/organizations/compliance_settings`
Update your organization's Compliance Settings.
Setting `state` to `enabled` turns on the Compliance API and begins
capturing organization activity events. Setting it to `disabled` turns
both off. `state` reflects whether the Compliance API is enabled.
A request that sets `state` to its current value succeeds and leaves the
resource unchanged. A `disabled` request stays in effect until a later
`enabled` request or the organization's next provisioning action that
enables Access Transparency: enabling Access Transparency also enables
the Compliance API, which serves its activity events, so such
provisioning (including re-runs) re-enables the Compliance API even
after a `disabled` request. Automated provisioning never disables
compliance settings.
### Body parameters
- `state: ComplianceSettingsStateParam`
Desired state. Accepts the string shorthand "enabled" or "disabled" in place of the object form; the response always returns the canonical object form.
- `ComplianceSettingsStateEnabledParam object`
- `type: "enabled"`
- `ComplianceSettingsStateDisabledParam object`
- `type: "disabled"`
### Returns
- `OrganizationComplianceSettings object`
- `type: "compliance_settings"`
default: compliance_settings
- `state: ComplianceSettingsState`
Whether the Compliance API is enabled for this organization.
- `ComplianceSettingsStateEnabled object`
- `type: "enabled"`
default: enabled
- `ComplianceSettingsStateDisabled object`
- `type: "disabled"`
default: disabled
### Example
```bash
curl https://api.anthropic.com/v1/organizations/compliance_settings \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY" \
-d '{
"state": {
"type": "enabled"
}
}'
```
#### Response (200)
```json
{
"state": {
"type": "enabled"
},
"type": "compliance_settings"
}
```
## Domain types
### Compliance Settings State
- `ComplianceSettingsState = ComplianceSettingsStateEnabled or ComplianceSettingsStateDisabled`
- `ComplianceSettingsStateEnabled object`
- `type: "enabled"`
default: enabled
- `ComplianceSettingsStateDisabled object`
- `type: "disabled"`
default: disabled
### Compliance Settings State Disabled
- `ComplianceSettingsStateDisabled object`
- `type: "disabled"`
default: disabled
### Compliance Settings State Disabled Param
- `ComplianceSettingsStateDisabledParam object`
- `type: "disabled"`
### Compliance Settings State Enabled
- `ComplianceSettingsStateEnabled object`
- `type: "enabled"`
default: enabled
### Compliance Settings State Enabled Param
- `ComplianceSettingsStateEnabledParam object`
- `type: "enabled"`
### Compliance Settings State Param
- `ComplianceSettingsStateParam = ComplianceSettingsStateEnabledParam or ComplianceSettingsStateDisabledParam`
- `ComplianceSettingsStateEnabledParam object`
- `type: "enabled"`
- `ComplianceSettingsStateDisabledParam object`
- `type: "disabled"`
### Organization Compliance Settings
- `OrganizationComplianceSettings object`
- `type: "compliance_settings"`
default: compliance_settings
- `state: ComplianceSettingsState`
Whether the Compliance API is enabled for this organization.
- `ComplianceSettingsStateEnabled object`
- `type: "enabled"`
default: enabled
- `ComplianceSettingsStateDisabled object`
- `type: "disabled"`
default: disabled
api/organization/compliance_settings/retrieve New page · 58 lines, new page
# Get Compliance Settings ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Get Compliance Settings
url: https://platform.claude.com/docs/en/api/organization/compliance_settings/retrieve
---
# Get Compliance Settings
**GET** `/v1/organizations/compliance_settings`
Retrieve your organization's Compliance Settings.
Compliance Settings is a singleton resource: there is exactly one per
organization, addressed without an identifier. The `state` field reflects
whether the Compliance API is enabled. An organization with a parent
organization reads the state inherited from the parent's configuration.
## Returns
- `OrganizationComplianceSettings object`
- `type: "compliance_settings"`
default: compliance_settings
- `state: ComplianceSettingsState`
Whether the Compliance API is enabled for this organization.
- `ComplianceSettingsStateEnabled object`
- `type: "enabled"`
default: enabled
- `ComplianceSettingsStateDisabled object`
- `type: "disabled"`
default: disabled
## Example
```bash
curl https://api.anthropic.com/v1/organizations/compliance_settings \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"state": {
"type": "enabled"
},
"type": "compliance_settings"
}
```
api/organization/compliance_settings/update New page · 86 lines, new page
# Update Compliance Settings ## Body parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Update Compliance Settings
url: https://platform.claude.com/docs/en/api/organization/compliance_settings/update
---
# Update Compliance Settings
**POST** `/v1/organizations/compliance_settings`
Update your organization's Compliance Settings.
Setting `state` to `enabled` turns on the Compliance API and begins
capturing organization activity events. Setting it to `disabled` turns
both off. `state` reflects whether the Compliance API is enabled.
A request that sets `state` to its current value succeeds and leaves the
resource unchanged. A `disabled` request stays in effect until a later
`enabled` request or the organization's next provisioning action that
enables Access Transparency: enabling Access Transparency also enables
the Compliance API, which serves its activity events, so such
provisioning (including re-runs) re-enables the Compliance API even
after a `disabled` request. Automated provisioning never disables
compliance settings.
## Body parameters
- `state: ComplianceSettingsStateParam`
Desired state. Accepts the string shorthand "enabled" or "disabled" in place of the object form; the response always returns the canonical object form.
- `ComplianceSettingsStateEnabledParam object`
- `type: "enabled"`
- `ComplianceSettingsStateDisabledParam object`
- `type: "disabled"`
## Returns
- `OrganizationComplianceSettings object`
- `type: "compliance_settings"`
default: compliance_settings
- `state: ComplianceSettingsState`
Whether the Compliance API is enabled for this organization.
- `ComplianceSettingsStateEnabled object`
- `type: "enabled"`
default: enabled
- `ComplianceSettingsStateDisabled object`
- `type: "disabled"`
default: disabled
## Example
```bash
curl https://api.anthropic.com/v1/organizations/compliance_settings \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY" \
-d '{
"state": {
"type": "enabled"
}
}'
```
### Response (200)
```json
{
"state": {
"type": "enabled"
},
"type": "compliance_settings"
}
```
api/organization/external_keys New page · 1072 lines, new page
# External Keys ## Create External Key ### Body parameters ### Returns ### Example #### Response (200) ## List External Keys ### Query parameters ### Returns ### Example #### Response (200) ## Get External Key ### Path parameters ### Returns ### Example #### Response (200) ## Update External Key ### Path parameters ### Body parameters ### Returns ### Example #### Response (200) ## Delete External Key ### Path parameters ### Returns ### Example #### Response (200) ## Validate External Key ### Path parameters ### Returns ### Example #### Response (200) ## Domain types ### AWS External Key Config ### Azure External Key Config ### Azure External Key Config Param ### External Key ### External Key Attached Attachment ### External Key Unattached Attachment ### GCP External Key Config ### External Key Delete Response ### External Key Validate Response
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: External Keys
url: https://platform.claude.com/docs/en/api/organization/external_keys
---
# External Keys
## Create External Key
**POST** `/v1/organizations/external_keys`
Create an external key config owned by the caller's organization.
### Body parameters
- `provider_config: AWSExternalKeyConfig or GCPExternalKeyConfig or AzureExternalKeyConfigParam`
KMS provider identity and auth coordinates.
- `AWSExternalKeyConfig object`
- `type: "aws"`
- `kms_arn: string`
Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
maxLength: 2048
- `region: optional string or null`
AWS region. Derived from `kms_arn` if omitted.
- `role_arn: optional string or null`
**Deprecated**
IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
- `GCPExternalKeyConfig object`
- `type: "gcp"`
- `key_name: string`
Full resource name of the Cloud KMS key.
- `AzureExternalKeyConfigParam object`
Azure Key Vault provider configuration.
- `type: "azure"`
- `key_name: string`
Name of the key within the vault.
- `tenant_id: string`
Azure AD tenant ID.
- `vault_uri: string`
Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
- `client_id: optional string or null`
Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
- `display_name: optional string or null`
Human-friendly display name.
minLength: 1, maxLength: 255
- `geo: optional "us"`
Data residency geo. Only `us` is supported.
### Returns
- `ExternalKey object`
CMEK external key config belonging to the caller's organization.
Configs are organization-scoped. Workspaces attach to a config; once any
workspace references it, the provider fields become effectively immutable
(existing encrypted data needs the config for decrypt).
- `type: "external_key"`
default: external_key
- `id: string`
Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
- `attachment: ExternalKeyAttachedAttachment or ExternalKeyUnattachedAttachment`
Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
- `ExternalKeyAttachedAttachment object`
- `type: "attached"`
default: attached
- `ExternalKeyUnattachedAttachment object`
- `type: "unattached"`
default: unattached
- `created_at: string`
format: date-time
- `display_name: string or null`
Human-friendly display name. Null if none was set.
- `geo: string`
Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
- `provider_config: AWSExternalKeyConfig or GCPExternalKeyConfig or AzureExternalKeyConfig`
KMS provider identity and auth coordinates.
- `AWSExternalKeyConfig object`
- `type: "aws"`
- `kms_arn: string`
Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
maxLength: 2048
- `region: optional string or null`
AWS region. Derived from `kms_arn` if omitted.
- `role_arn: optional string or null`
**Deprecated**
IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
- `GCPExternalKeyConfig object`
- `type: "gcp"`
- `key_name: string`
Full resource name of the Cloud KMS key.
- `AzureExternalKeyConfig object`
- `type: "azure"`
- `key_name: string`
Name of the key within the vault.
- `tenant_id: string`
Azure AD tenant ID.
- `vault_uri: string`
Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
- `client_id: optional string or null`
Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
- `updated_at: string`
format: date-time
### Example
```bash
curl https://api.anthropic.com/v1/organizations/external_keys \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY" \
-d '{
"provider_config": {
"kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
"type": "aws"
}
}'
```
#### Response (200)
```json
{
"id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
"attachment": {
"type": "attached"
},
"created_at": "2024-10-30T23:58:27.427722Z",
"display_name": "prod-us-key",
"geo": "us",
"provider_config": {
"kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
"type": "aws",
"region": "us-east-1",
"role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
},
"type": "external_key",
"updated_at": "2024-10-30T23:58:27.427722Z"
}
```
## List External Keys
**GET** `/v1/organizations/external_keys`
List external key configs in the caller's organization.
Results are ordered by creation time (newest first). Use the
`next_page` cursor from the response to fetch subsequent pages.
### Query parameters
- `limit: optional number`
Number of results per page.
default: 20, minimum: 1, maximum: 100
- `page: optional string`
Opaque cursor from a previous response's `next_page`.
### Returns
- `data: array of ExternalKey`
- `type: "external_key"`
default: external_key
- `id: string`
Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
- `attachment: ExternalKeyAttachedAttachment or ExternalKeyUnattachedAttachment`
Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
- `ExternalKeyAttachedAttachment object`
- `type: "attached"`
default: attached
- `ExternalKeyUnattachedAttachment object`
- `type: "unattached"`
default: unattached
- `created_at: string`
format: date-time
- `display_name: string or null`
Human-friendly display name. Null if none was set.
- `geo: string`
Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
- `provider_config: AWSExternalKeyConfig or GCPExternalKeyConfig or AzureExternalKeyConfig`
KMS provider identity and auth coordinates.
- `AWSExternalKeyConfig object`
- `type: "aws"`
- `kms_arn: string`
Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
maxLength: 2048
- `region: optional string or null`
AWS region. Derived from `kms_arn` if omitted.
- `role_arn: optional string or null`
**Deprecated**
Cut at 300 lines. The page has the rest.
api/organization/external_keys/create New page · 215 lines, new page
# Create External Key ## Body parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Create External Key
url: https://platform.claude.com/docs/en/api/organization/external_keys/create
---
# Create External Key
**POST** `/v1/organizations/external_keys`
Create an external key config owned by the caller's organization.
## Body parameters
- `provider_config: AWSExternalKeyConfig or GCPExternalKeyConfig or AzureExternalKeyConfigParam`
KMS provider identity and auth coordinates.
- `AWSExternalKeyConfig object`
- `type: "aws"`
- `kms_arn: string`
Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
maxLength: 2048
- `region: optional string or null`
AWS region. Derived from `kms_arn` if omitted.
- `role_arn: optional string or null`
**Deprecated**
IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
- `GCPExternalKeyConfig object`
- `type: "gcp"`
- `key_name: string`
Full resource name of the Cloud KMS key.
- `AzureExternalKeyConfigParam object`
Azure Key Vault provider configuration.
- `type: "azure"`
- `key_name: string`
Name of the key within the vault.
- `tenant_id: string`
Azure AD tenant ID.
- `vault_uri: string`
Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
- `client_id: optional string or null`
Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
- `display_name: optional string or null`
Human-friendly display name.
minLength: 1, maxLength: 255
- `geo: optional "us"`
Data residency geo. Only `us` is supported.
## Returns
- `ExternalKey object`
CMEK external key config belonging to the caller's organization.
Configs are organization-scoped. Workspaces attach to a config; once any
workspace references it, the provider fields become effectively immutable
(existing encrypted data needs the config for decrypt).
- `type: "external_key"`
default: external_key
- `id: string`
Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
- `attachment: ExternalKeyAttachedAttachment or ExternalKeyUnattachedAttachment`
Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
- `ExternalKeyAttachedAttachment object`
- `type: "attached"`
default: attached
- `ExternalKeyUnattachedAttachment object`
- `type: "unattached"`
default: unattached
- `created_at: string`
format: date-time
- `display_name: string or null`
Human-friendly display name. Null if none was set.
- `geo: string`
Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
- `provider_config: AWSExternalKeyConfig or GCPExternalKeyConfig or AzureExternalKeyConfig`
KMS provider identity and auth coordinates.
- `AWSExternalKeyConfig object`
- `type: "aws"`
- `kms_arn: string`
Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
maxLength: 2048
- `region: optional string or null`
AWS region. Derived from `kms_arn` if omitted.
- `role_arn: optional string or null`
**Deprecated**
IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
- `GCPExternalKeyConfig object`
- `type: "gcp"`
- `key_name: string`
Full resource name of the Cloud KMS key.
- `AzureExternalKeyConfig object`
- `type: "azure"`
- `key_name: string`
Name of the key within the vault.
- `tenant_id: string`
Azure AD tenant ID.
- `vault_uri: string`
Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
- `client_id: optional string or null`
Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
- `updated_at: string`
format: date-time
## Example
```bash
curl https://api.anthropic.com/v1/organizations/external_keys \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY" \
-d '{
"provider_config": {
"kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
"type": "aws"
}
}'
```
### Response (200)
```json
{
"id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
"attachment": {
"type": "attached"
},
"created_at": "2024-10-30T23:58:27.427722Z",
"display_name": "prod-us-key",
"geo": "us",
"provider_config": {
"kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
"type": "aws",
"region": "us-east-1",
"role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
},
"type": "external_key",
"updated_at": "2024-10-30T23:58:27.427722Z"
}
```
api/organization/external_keys/delete New page · 48 lines, new page
# Delete External Key ## Path parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Delete External Key
url: https://platform.claude.com/docs/en/api/organization/external_keys/delete
---
# Delete External Key
**DELETE** `/v1/organizations/external_keys/{external_key_id}`
Delete an external key config.
The request is rejected if any workspace still references this config.
## Path parameters
- `external_key_id: string`
ID of the External Key.
maxLength: 2048
## Returns
- `type: "external_key_deleted"`
default: external_key_deleted
- `id: string`
ID of the deleted External Key.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \
-X DELETE \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"id": "ekey_01AbCdEfGhIjKlMnOpQrStUv",
"type": "external_key_deleted"
}
```
api/organization/external_keys/list New page · 160 lines, new page
# List External Keys ## Query parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: List External Keys
url: https://platform.claude.com/docs/en/api/organization/external_keys/list
---
# List External Keys
**GET** `/v1/organizations/external_keys`
List external key configs in the caller's organization.
Results are ordered by creation time (newest first). Use the
`next_page` cursor from the response to fetch subsequent pages.
## Query parameters
- `limit: optional number`
Number of results per page.
default: 20, minimum: 1, maximum: 100
- `page: optional string`
Opaque cursor from a previous response's `next_page`.
## Returns
- `data: array of ExternalKey`
- `type: "external_key"`
default: external_key
- `id: string`
Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
- `attachment: ExternalKeyAttachedAttachment or ExternalKeyUnattachedAttachment`
Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
- `ExternalKeyAttachedAttachment object`
- `type: "attached"`
default: attached
- `ExternalKeyUnattachedAttachment object`
- `type: "unattached"`
default: unattached
- `created_at: string`
format: date-time
- `display_name: string or null`
Human-friendly display name. Null if none was set.
- `geo: string`
Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
- `provider_config: AWSExternalKeyConfig or GCPExternalKeyConfig or AzureExternalKeyConfig`
KMS provider identity and auth coordinates.
- `AWSExternalKeyConfig object`
- `type: "aws"`
- `kms_arn: string`
Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
maxLength: 2048
- `region: optional string or null`
AWS region. Derived from `kms_arn` if omitted.
- `role_arn: optional string or null`
**Deprecated**
IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
- `GCPExternalKeyConfig object`
- `type: "gcp"`
- `key_name: string`
Full resource name of the Cloud KMS key.
- `AzureExternalKeyConfig object`
- `type: "azure"`
- `key_name: string`
Name of the key within the vault.
- `tenant_id: string`
Azure AD tenant ID.
- `vault_uri: string`
Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
- `client_id: optional string or null`
Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
- `updated_at: string`
format: date-time
- `next_page: string or null`
Opaque cursor for the next page, or null if no more results. Pass as `?page=` to fetch the next page.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/external_keys \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"data": [
{
"id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
"attachment": {
"type": "attached"
},
"created_at": "2024-10-30T23:58:27.427722Z",
"display_name": "prod-us-key",
"geo": "us",
"provider_config": {
"kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
"type": "aws",
"region": "us-east-1",
"role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
},
"type": "external_key",
"updated_at": "2024-10-30T23:58:27.427722Z"
}
],
"next_page": "next_page"
}
```
api/organization/external_keys/retrieve New page · 150 lines, new page
# Get External Key ## Path parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Get External Key
url: https://platform.claude.com/docs/en/api/organization/external_keys/retrieve
---
# Get External Key
**GET** `/v1/organizations/external_keys/{external_key_id}`
Retrieve a single external key config in the caller's organization by ID.
## Path parameters
- `external_key_id: string`
ID of the External Key.
maxLength: 2048
## Returns
- `ExternalKey object`
CMEK external key config belonging to the caller's organization.
Configs are organization-scoped. Workspaces attach to a config; once any
workspace references it, the provider fields become effectively immutable
(existing encrypted data needs the config for decrypt).
- `type: "external_key"`
default: external_key
- `id: string`
Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
- `attachment: ExternalKeyAttachedAttachment or ExternalKeyUnattachedAttachment`
Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
- `ExternalKeyAttachedAttachment object`
- `type: "attached"`
default: attached
- `ExternalKeyUnattachedAttachment object`
- `type: "unattached"`
default: unattached
- `created_at: string`
format: date-time
- `display_name: string or null`
Human-friendly display name. Null if none was set.
- `geo: string`
Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
- `provider_config: AWSExternalKeyConfig or GCPExternalKeyConfig or AzureExternalKeyConfig`
KMS provider identity and auth coordinates.
- `AWSExternalKeyConfig object`
- `type: "aws"`
- `kms_arn: string`
Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
maxLength: 2048
- `region: optional string or null`
AWS region. Derived from `kms_arn` if omitted.
- `role_arn: optional string or null`
**Deprecated**
IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
- `GCPExternalKeyConfig object`
- `type: "gcp"`
- `key_name: string`
Full resource name of the Cloud KMS key.
- `AzureExternalKeyConfig object`
- `type: "azure"`
- `key_name: string`
Name of the key within the vault.
- `tenant_id: string`
Azure AD tenant ID.
- `vault_uri: string`
Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
- `client_id: optional string or null`
Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
- `updated_at: string`
format: date-time
## Example
```bash
curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
"attachment": {
"type": "attached"
},
"created_at": "2024-10-30T23:58:27.427722Z",
"display_name": "prod-us-key",
"geo": "us",
"provider_config": {
"kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
"type": "aws",
"region": "us-east-1",
"role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
},
"type": "external_key",
"updated_at": "2024-10-30T23:58:27.427722Z"
}
```
api/organization/external_keys/update New page · 222 lines, new page
# Update External Key ## Path parameters ## Body parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Update External Key
url: https://platform.claude.com/docs/en/api/organization/external_keys/update
---
# Update External Key
**POST** `/v1/organizations/external_keys/{external_key_id}`
Partially update an external key config. Omitted fields are left unchanged.
`display_name` is always editable. `geo` and `provider_config` cannot
be changed once any workspace references this config, because previously
encrypted data requires the original key identity to decrypt.
## Path parameters
- `external_key_id: string`
ID of the External Key.
maxLength: 2048
## Body parameters
- `display_name: optional string or null`
Human-friendly display name.
minLength: 1, maxLength: 255
- `geo: optional "us" or null`
Data residency geo. Only `us` is supported.
- `provider_config: optional AWSExternalKeyConfig or GCPExternalKeyConfig or AzureExternalKeyConfigParam or null`
KMS provider identity and auth coordinates.
- `AWSExternalKeyConfig object`
- `type: "aws"`
- `kms_arn: string`
Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
maxLength: 2048
- `region: optional string or null`
AWS region. Derived from `kms_arn` if omitted.
- `role_arn: optional string or null`
**Deprecated**
IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
- `GCPExternalKeyConfig object`
- `type: "gcp"`
- `key_name: string`
Full resource name of the Cloud KMS key.
- `AzureExternalKeyConfigParam object`
Azure Key Vault provider configuration.
- `type: "azure"`
- `key_name: string`
Name of the key within the vault.
- `tenant_id: string`
Azure AD tenant ID.
- `vault_uri: string`
Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
- `client_id: optional string or null`
Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
## Returns
- `ExternalKey object`
CMEK external key config belonging to the caller's organization.
Configs are organization-scoped. Workspaces attach to a config; once any
workspace references it, the provider fields become effectively immutable
(existing encrypted data needs the config for decrypt).
- `type: "external_key"`
default: external_key
- `id: string`
Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
- `attachment: ExternalKeyAttachedAttachment or ExternalKeyUnattachedAttachment`
Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
- `ExternalKeyAttachedAttachment object`
- `type: "attached"`
default: attached
- `ExternalKeyUnattachedAttachment object`
- `type: "unattached"`
default: unattached
- `created_at: string`
format: date-time
- `display_name: string or null`
Human-friendly display name. Null if none was set.
- `geo: string`
Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
- `provider_config: AWSExternalKeyConfig or GCPExternalKeyConfig or AzureExternalKeyConfig`
KMS provider identity and auth coordinates.
- `AWSExternalKeyConfig object`
- `type: "aws"`
- `kms_arn: string`
Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
maxLength: 2048
- `region: optional string or null`
AWS region. Derived from `kms_arn` if omitted.
- `role_arn: optional string or null`
**Deprecated**
IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
- `GCPExternalKeyConfig object`
- `type: "gcp"`
- `key_name: string`
Full resource name of the Cloud KMS key.
- `AzureExternalKeyConfig object`
- `type: "azure"`
- `key_name: string`
Name of the key within the vault.
- `tenant_id: string`
Azure AD tenant ID.
- `vault_uri: string`
Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
- `client_id: optional string or null`
Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
- `updated_at: string`
format: date-time
## Example
```bash
curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY" \
-d '{}'
```
### Response (200)
```json
{
"id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
"attachment": {
"type": "attached"
},
"created_at": "2024-10-30T23:58:27.427722Z",
"display_name": "prod-us-key",
"geo": "us",
"provider_config": {
"kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
"type": "aws",
"region": "us-east-1",
"role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
},
"type": "external_key",
"updated_at": "2024-10-30T23:58:27.427722Z"
}
```
api/organization/external_keys/validate New page · 60 lines, new page
# Validate External Key ## Path parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Validate External Key
url: https://platform.claude.com/docs/en/api/organization/external_keys/validate
---
# Validate External Key
**POST** `/v1/organizations/external_keys/{external_key_id}/validate`
Validate an external key config against the customer's KMS.
Anthropic performs an encrypt/decrypt roundtrip against the configured
KMS key and waits up to 30 seconds for the result. The response status is
`success` if the roundtrip succeeded, or `failure` with an error
message if it failed or timed out.
## Path parameters
- `external_key_id: string`
ID of the External Key.
maxLength: 2048
## Returns
- `type: "external_key_validation"`
default: external_key_validation
- `error: string or null`
Error message when status is `failure`. Null otherwise.
- `status: "failure" or "success"`
`success` — encrypt/decrypt roundtrip succeeded. `failure` — the roundtrip failed or timed out; see `error`.
- `"failure"`
- `"success"`
## Example
```bash
curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID/validate \
-X POST \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"error": "error",
"status": "failure",
"type": "external_key_validation"
}
```
api/organization/federation New page · 2601 lines, new page
# Federation ## Federation › Issuers ### Create Federation Issuer #### Body parameters #### Returns #### Example ##### Response (200) ### List Federation Issuers #### Query parameters #### Returns #### Example ##### Response (200) ### Get Federation Issuer #### Path parameters #### Returns #### Example ##### Response (200) ### Update Federation Issuer #### Path parameters #### Body parameters #### Returns #### Example ##### Response (200) ### Archive Federation Issuer #### Path parameters #### Returns #### Example ##### Response (200) ## Federation › Rules ### Create Federation Rule #### Body parameters #### Returns #### Example ##### Response (200) ### List Federation Rules #### Query parameters #### Returns #### Example ##### Response (200) ### Get Federation Rule #### Path parameters #### Returns #### Example ##### Response (200) ### Update Federation Rule #### Path parameters #### Body parameters #### Returns #### Example ##### Response (200) ### Archive Federation Rule #### Path parameters #### Returns #### Example ##### Response (200) ## Federation › Rules › Workspaces ### Add Federation Rule Workspace #### Path parameters #### Body parameters #### Returns #### Example ##### Response (200) ### List Federation Rule Workspaces #### Path parameters #### Query parameters #### Returns #### Example ##### Response (200) ### Remove Federation Rule Workspace #### Path parameters #### Returns #### Example ##### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Federation
url: https://platform.claude.com/docs/en/api/organization/federation
---
# Federation
## Federation › Issuers
### Create Federation Issuer
**POST** `/v1/organizations/federation_issuers`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
Register an OIDC issuer that Anthropic will trust for workload identity
federation in your organization.
The `jwks` field controls how the issuer's signing keys are obtained and
takes one of three shapes selected by `type`: `discovery` (resolve keys
through OIDC discovery), `explicit_url` (fetch keys from a fixed JWKS
URL), or `inline` (provide a static key set). When `jwks.type` is
`discovery` and no `discovery_base` is set, the issuer URL must be
publicly reachable over HTTPS so Anthropic can fetch the discovery
document; for `explicit_url` and `inline` modes the issuer URL is only
matched as the JWT's `iss` claim and is not fetched.
#### Body parameters
- `issuer_url: string`
The `iss` claim value to match against.
minLength: 1
- `name: string`
Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
minLength: 1, maxLength: 255
- `check_jti: optional boolean or null`
Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Defaults to true. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.
- `jwks: optional JWKSDiscovery or JWKSExplicitURL or JWKSInline`
How signing keys are obtained. Defaults to OIDC discovery.
- `JWKSDiscovery object`
JWKS via the issuer's OIDC discovery document.
- `type: "discovery"`
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `discovery_base: optional string or null`
Set when the discovery URL differs from `issuer_url`.
- `JWKSExplicitURL object`
JWKS fetched from a fixed endpoint.
- `type: "explicit_url"`
- `url: string`
JWKS endpoint.
minLength: 1
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `JWKSInline object`
JWKS supplied directly; no network fetch.
- `type: "inline"`
- `keys: array of map[unknown]`
Inline JWK objects.
minItems: 1
- `max_jwt_lifetime_seconds: optional number or null`
Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Defaults to 3600 (1h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
minimum: 1, maximum: 176400
#### Returns
- `FederationIssuer object`
Registered external OIDC identity provider.
Records an external IdP the organization trusts for the RFC 7523
jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly.
- `type: "federation_issuer"`
default: federation_issuer
- `id: string`
Tagged ID of the federation issuer.
- `archived_at: string or null`
If set, all rules referencing this issuer reject token exchange.
format: date-time
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
- `check_jti: boolean`
Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.
- `created_at: string`
When this issuer was created.
format: date-time
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
- `issuer_url: string`
The `iss` claim value. Incoming JWTs must match exactly.
- `jwks: JWKSDiscovery or JWKSExplicitURL or JWKSInline`
How signing keys are obtained for signature verification.
- `JWKSDiscovery object`
JWKS via the issuer's OIDC discovery document.
- `type: "discovery"`
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `discovery_base: optional string or null`
Set when the discovery URL differs from `issuer_url`.
- `JWKSExplicitURL object`
JWKS fetched from a fixed endpoint.
- `type: "explicit_url"`
- `url: string`
JWKS endpoint.
minLength: 1
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `JWKSInline object`
JWKS supplied directly; no network fetch.
- `type: "inline"`
- `keys: array of map[unknown]`
Inline JWK objects.
minItems: 1
- `jwks_polling_disabled_at: string or null`
If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
format: date-time
- `max_jwt_lifetime_seconds: number`
Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
- `name: string`
Admin-chosen slug identifier.
- `poll_status: FederationIssuerPollStatus or null`
Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet.
- `consecutive_failures: number`
Consecutive fetch failures since the last success.
- `last_fetched_at: string or null`
When the last successful fetch completed.
format: date-time
- `next_poll_at: string or null`
When the next fetch is scheduled. Null if paused.
format: date-time
- `updated_at: string`
When this issuer was last updated.
format: date-time
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.
#### Example
```bash
curl https://api.anthropic.com/v1/organizations/federation_issuers \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY" \
-d '{
"issuer_url": "x",
"name": "x"
}'
```
##### Response (200)
```json
{
"id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"check_jti": true,
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"issuer_url": "https://token.actions.githubusercontent.com",
"jwks": {
"type": "discovery",
"ca_cert_pem": "ca_cert_pem",
"discovery_base": "discovery_base"
},
"jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",
"max_jwt_lifetime_seconds": 0,
"name": "github-actions",
"poll_status": {
"consecutive_failures": 0,
"last_fetched_at": "2019-12-27T18:11:19.117Z",
"next_poll_at": "2019-12-27T18:11:19.117Z"
},
"type": "federation_issuer",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id"
}
```
### List Federation Issuers
**GET** `/v1/organizations/federation_issuers`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
List federation issuers in your organization.
Archived issuers are excluded unless `include_archived=true`.
#### Query parameters
- `include_archived: optional boolean`
Include archived resources. Defaults to false.
default: false
Cut at 300 lines. The page has the rest.
api/organization/federation/issuers New page · 1374 lines, new page
# Issuers ## Create Federation Issuer ### Body parameters ### Returns ### Example #### Response (200) ## List Federation Issuers ### Query parameters ### Returns ### Example #### Response (200) ## Get Federation Issuer ### Path parameters ### Returns ### Example #### Response (200) ## Update Federation Issuer ### Path parameters ### Body parameters ### Returns ### Example #### Response (200) ## Archive Federation Issuer ### Path parameters ### Returns ### Example #### Response (200) ## Domain types ### Federation Issuer ### Federation Issuer Poll Status ### JWKS Discovery ### JWKS Explicit URL ### JWKS Inline
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Issuers
url: https://platform.claude.com/docs/en/api/organization/federation/issuers
---
# Issuers
## Create Federation Issuer
**POST** `/v1/organizations/federation_issuers`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
Register an OIDC issuer that Anthropic will trust for workload identity
federation in your organization.
The `jwks` field controls how the issuer's signing keys are obtained and
takes one of three shapes selected by `type`: `discovery` (resolve keys
through OIDC discovery), `explicit_url` (fetch keys from a fixed JWKS
URL), or `inline` (provide a static key set). When `jwks.type` is
`discovery` and no `discovery_base` is set, the issuer URL must be
publicly reachable over HTTPS so Anthropic can fetch the discovery
document; for `explicit_url` and `inline` modes the issuer URL is only
matched as the JWT's `iss` claim and is not fetched.
### Body parameters
- `issuer_url: string`
The `iss` claim value to match against.
minLength: 1
- `name: string`
Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
minLength: 1, maxLength: 255
- `check_jti: optional boolean or null`
Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Defaults to true. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.
- `jwks: optional JWKSDiscovery or JWKSExplicitURL or JWKSInline`
How signing keys are obtained. Defaults to OIDC discovery.
- `JWKSDiscovery object`
JWKS via the issuer's OIDC discovery document.
- `type: "discovery"`
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `discovery_base: optional string or null`
Set when the discovery URL differs from `issuer_url`.
- `JWKSExplicitURL object`
JWKS fetched from a fixed endpoint.
- `type: "explicit_url"`
- `url: string`
JWKS endpoint.
minLength: 1
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `JWKSInline object`
JWKS supplied directly; no network fetch.
- `type: "inline"`
- `keys: array of map[unknown]`
Inline JWK objects.
minItems: 1
- `max_jwt_lifetime_seconds: optional number or null`
Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Defaults to 3600 (1h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
minimum: 1, maximum: 176400
### Returns
- `FederationIssuer object`
Registered external OIDC identity provider.
Records an external IdP the organization trusts for the RFC 7523
jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly.
- `type: "federation_issuer"`
default: federation_issuer
- `id: string`
Tagged ID of the federation issuer.
- `archived_at: string or null`
If set, all rules referencing this issuer reject token exchange.
format: date-time
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
- `check_jti: boolean`
Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.
- `created_at: string`
When this issuer was created.
format: date-time
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
- `issuer_url: string`
The `iss` claim value. Incoming JWTs must match exactly.
- `jwks: JWKSDiscovery or JWKSExplicitURL or JWKSInline`
How signing keys are obtained for signature verification.
- `JWKSDiscovery object`
JWKS via the issuer's OIDC discovery document.
- `type: "discovery"`
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `discovery_base: optional string or null`
Set when the discovery URL differs from `issuer_url`.
- `JWKSExplicitURL object`
JWKS fetched from a fixed endpoint.
- `type: "explicit_url"`
- `url: string`
JWKS endpoint.
minLength: 1
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `JWKSInline object`
JWKS supplied directly; no network fetch.
- `type: "inline"`
- `keys: array of map[unknown]`
Inline JWK objects.
minItems: 1
- `jwks_polling_disabled_at: string or null`
If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
format: date-time
- `max_jwt_lifetime_seconds: number`
Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
- `name: string`
Admin-chosen slug identifier.
- `poll_status: FederationIssuerPollStatus or null`
Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet.
- `consecutive_failures: number`
Consecutive fetch failures since the last success.
- `last_fetched_at: string or null`
When the last successful fetch completed.
format: date-time
- `next_poll_at: string or null`
When the next fetch is scheduled. Null if paused.
format: date-time
- `updated_at: string`
When this issuer was last updated.
format: date-time
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.
### Example
```bash
curl https://api.anthropic.com/v1/organizations/federation_issuers \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY" \
-d '{
"issuer_url": "x",
"name": "x"
}'
```
#### Response (200)
```json
{
"id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"check_jti": true,
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"issuer_url": "https://token.actions.githubusercontent.com",
"jwks": {
"type": "discovery",
"ca_cert_pem": "ca_cert_pem",
"discovery_base": "discovery_base"
},
"jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",
"max_jwt_lifetime_seconds": 0,
"name": "github-actions",
"poll_status": {
"consecutive_failures": 0,
"last_fetched_at": "2019-12-27T18:11:19.117Z",
"next_poll_at": "2019-12-27T18:11:19.117Z"
},
"type": "federation_issuer",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id"
}
```
## List Federation Issuers
**GET** `/v1/organizations/federation_issuers`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
List federation issuers in your organization.
Archived issuers are excluded unless `include_archived=true`.
### Query parameters
- `include_archived: optional boolean`
Include archived resources. Defaults to false.
default: false
- `limit: optional number`
Cut at 300 lines. The page has the rest.
api/organization/federation/issuers/archive New page · 201 lines, new page
# Archive Federation Issuer ## Path parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Archive Federation Issuer
url: https://platform.claude.com/docs/en/api/organization/federation/issuers/archive
---
# Archive Federation Issuer
**POST** `/v1/organizations/federation_issuers/{federation_issuer_id}/archive`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
Archive a federation issuer.
Idempotent; re-archiving returns the issuer with its original
`archived_at`. Rejected with 400 if any live (non-archived) federation
rule still references the issuer; archive those rules first (a rule's
issuer cannot be changed), or recreate them against another issuer.
## Path parameters
- `federation_issuer_id: string`
ID of the federation issuer to archive.
## Returns
- `FederationIssuer object`
Registered external OIDC identity provider.
Records an external IdP the organization trusts for the RFC 7523
jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly.
- `type: "federation_issuer"`
default: federation_issuer
- `id: string`
Tagged ID of the federation issuer.
- `archived_at: string or null`
If set, all rules referencing this issuer reject token exchange.
format: date-time
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
- `check_jti: boolean`
Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.
- `created_at: string`
When this issuer was created.
format: date-time
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
- `issuer_url: string`
The `iss` claim value. Incoming JWTs must match exactly.
- `jwks: JWKSDiscovery or JWKSExplicitURL or JWKSInline`
How signing keys are obtained for signature verification.
- `JWKSDiscovery object`
JWKS via the issuer's OIDC discovery document.
- `type: "discovery"`
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `discovery_base: optional string or null`
Set when the discovery URL differs from `issuer_url`.
- `JWKSExplicitURL object`
JWKS fetched from a fixed endpoint.
- `type: "explicit_url"`
- `url: string`
JWKS endpoint.
minLength: 1
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `JWKSInline object`
JWKS supplied directly; no network fetch.
- `type: "inline"`
- `keys: array of map[unknown]`
Inline JWK objects.
minItems: 1
- `jwks_polling_disabled_at: string or null`
If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
format: date-time
- `max_jwt_lifetime_seconds: number`
Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
- `name: string`
Admin-chosen slug identifier.
- `poll_status: FederationIssuerPollStatus or null`
Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet.
- `consecutive_failures: number`
Consecutive fetch failures since the last success.
- `last_fetched_at: string or null`
When the last successful fetch completed.
format: date-time
- `next_poll_at: string or null`
When the next fetch is scheduled. Null if paused.
format: date-time
- `updated_at: string`
When this issuer was last updated.
format: date-time
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID/archive \
-X POST \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"check_jti": true,
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"issuer_url": "https://token.actions.githubusercontent.com",
"jwks": {
"type": "discovery",
"ca_cert_pem": "ca_cert_pem",
"discovery_base": "discovery_base"
},
"jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",
"max_jwt_lifetime_seconds": 0,
"name": "github-actions",
"poll_status": {
"consecutive_failures": 0,
"last_fetched_at": "2019-12-27T18:11:19.117Z",
"next_poll_at": "2019-12-27T18:11:19.117Z"
},
"type": "federation_issuer",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id"
}
```
api/organization/federation/issuers/create New page · 278 lines, new page
# Create Federation Issuer ## Body parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Create Federation Issuer
url: https://platform.claude.com/docs/en/api/organization/federation/issuers/create
---
# Create Federation Issuer
**POST** `/v1/organizations/federation_issuers`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
Register an OIDC issuer that Anthropic will trust for workload identity
federation in your organization.
The `jwks` field controls how the issuer's signing keys are obtained and
takes one of three shapes selected by `type`: `discovery` (resolve keys
through OIDC discovery), `explicit_url` (fetch keys from a fixed JWKS
URL), or `inline` (provide a static key set). When `jwks.type` is
`discovery` and no `discovery_base` is set, the issuer URL must be
publicly reachable over HTTPS so Anthropic can fetch the discovery
document; for `explicit_url` and `inline` modes the issuer URL is only
matched as the JWT's `iss` claim and is not fetched.
## Body parameters
- `issuer_url: string`
The `iss` claim value to match against.
minLength: 1
- `name: string`
Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
minLength: 1, maxLength: 255
- `check_jti: optional boolean or null`
Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Defaults to true. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.
- `jwks: optional JWKSDiscovery or JWKSExplicitURL or JWKSInline`
How signing keys are obtained. Defaults to OIDC discovery.
- `JWKSDiscovery object`
JWKS via the issuer's OIDC discovery document.
- `type: "discovery"`
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `discovery_base: optional string or null`
Set when the discovery URL differs from `issuer_url`.
- `JWKSExplicitURL object`
JWKS fetched from a fixed endpoint.
- `type: "explicit_url"`
- `url: string`
JWKS endpoint.
minLength: 1
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `JWKSInline object`
JWKS supplied directly; no network fetch.
- `type: "inline"`
- `keys: array of map[unknown]`
Inline JWK objects.
minItems: 1
- `max_jwt_lifetime_seconds: optional number or null`
Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Defaults to 3600 (1h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
minimum: 1, maximum: 176400
## Returns
- `FederationIssuer object`
Registered external OIDC identity provider.
Records an external IdP the organization trusts for the RFC 7523
jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly.
- `type: "federation_issuer"`
default: federation_issuer
- `id: string`
Tagged ID of the federation issuer.
- `archived_at: string or null`
If set, all rules referencing this issuer reject token exchange.
format: date-time
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
- `check_jti: boolean`
Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.
- `created_at: string`
When this issuer was created.
format: date-time
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
- `issuer_url: string`
The `iss` claim value. Incoming JWTs must match exactly.
- `jwks: JWKSDiscovery or JWKSExplicitURL or JWKSInline`
How signing keys are obtained for signature verification.
- `JWKSDiscovery object`
JWKS via the issuer's OIDC discovery document.
- `type: "discovery"`
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `discovery_base: optional string or null`
Set when the discovery URL differs from `issuer_url`.
- `JWKSExplicitURL object`
JWKS fetched from a fixed endpoint.
- `type: "explicit_url"`
- `url: string`
JWKS endpoint.
minLength: 1
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `JWKSInline object`
JWKS supplied directly; no network fetch.
- `type: "inline"`
- `keys: array of map[unknown]`
Inline JWK objects.
minItems: 1
- `jwks_polling_disabled_at: string or null`
If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
format: date-time
- `max_jwt_lifetime_seconds: number`
Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
- `name: string`
Admin-chosen slug identifier.
- `poll_status: FederationIssuerPollStatus or null`
Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet.
- `consecutive_failures: number`
Consecutive fetch failures since the last success.
- `last_fetched_at: string or null`
When the last successful fetch completed.
format: date-time
- `next_poll_at: string or null`
When the next fetch is scheduled. Null if paused.
format: date-time
- `updated_at: string`
When this issuer was last updated.
format: date-time
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/federation_issuers \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY" \
-d '{
"issuer_url": "x",
"name": "x"
}'
```
### Response (200)
```json
{
"id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"check_jti": true,
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"issuer_url": "https://token.actions.githubusercontent.com",
"jwks": {
"type": "discovery",
"ca_cert_pem": "ca_cert_pem",
"discovery_base": "discovery_base"
},
"jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",
"max_jwt_lifetime_seconds": 0,
"name": "github-actions",
"poll_status": {
"consecutive_failures": 0,
"last_fetched_at": "2019-12-27T18:11:19.117Z",
"next_poll_at": "2019-12-27T18:11:19.117Z"
},
"type": "federation_issuer",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id"
}
```
api/organization/federation/issuers/list New page · 213 lines, new page
# List Federation Issuers ## Query parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: List Federation Issuers
url: https://platform.claude.com/docs/en/api/organization/federation/issuers/list
---
# List Federation Issuers
**GET** `/v1/organizations/federation_issuers`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
List federation issuers in your organization.
Archived issuers are excluded unless `include_archived=true`.
## Query parameters
- `include_archived: optional boolean`
Include archived resources. Defaults to false.
default: false
- `limit: optional number`
Number of results per page.
default: 20, minimum: 1, maximum: 100
- `page: optional string`
Opaque cursor from a previous response's `next_page`.
## Returns
- `data: array of FederationIssuer`
- `type: "federation_issuer"`
default: federation_issuer
- `id: string`
Tagged ID of the federation issuer.
- `archived_at: string or null`
If set, all rules referencing this issuer reject token exchange.
format: date-time
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
- `check_jti: boolean`
Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.
- `created_at: string`
When this issuer was created.
format: date-time
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
- `issuer_url: string`
The `iss` claim value. Incoming JWTs must match exactly.
- `jwks: JWKSDiscovery or JWKSExplicitURL or JWKSInline`
How signing keys are obtained for signature verification.
- `JWKSDiscovery object`
JWKS via the issuer's OIDC discovery document.
- `type: "discovery"`
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `discovery_base: optional string or null`
Set when the discovery URL differs from `issuer_url`.
- `JWKSExplicitURL object`
JWKS fetched from a fixed endpoint.
- `type: "explicit_url"`
- `url: string`
JWKS endpoint.
minLength: 1
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `JWKSInline object`
JWKS supplied directly; no network fetch.
- `type: "inline"`
- `keys: array of map[unknown]`
Inline JWK objects.
minItems: 1
- `jwks_polling_disabled_at: string or null`
If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
format: date-time
- `max_jwt_lifetime_seconds: number`
Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
- `name: string`
Admin-chosen slug identifier.
- `poll_status: FederationIssuerPollStatus or null`
Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet.
- `consecutive_failures: number`
Consecutive fetch failures since the last success.
- `last_fetched_at: string or null`
When the last successful fetch completed.
format: date-time
- `next_poll_at: string or null`
When the next fetch is scheduled. Null if paused.
format: date-time
- `updated_at: string`
When this issuer was last updated.
format: date-time
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.
- `next_page: string or null`
Opaque cursor for the next page, or null if no more results.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/federation_issuers \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"data": [
{
"id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"check_jti": true,
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"issuer_url": "https://token.actions.githubusercontent.com",
"jwks": {
"type": "discovery",
"ca_cert_pem": "ca_cert_pem",
"discovery_base": "discovery_base"
},
"jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",
"max_jwt_lifetime_seconds": 0,
"name": "github-actions",
"poll_status": {
"consecutive_failures": 0,
"last_fetched_at": "2019-12-27T18:11:19.117Z",
"next_poll_at": "2019-12-27T18:11:19.117Z"
},
"type": "federation_issuer",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id"
}
],
"next_page": "next_page"
}
```